Xbox’s Last-Second Intel Switcheroo Left AMD Engineers Heartbroken

The last-second switch also introduced a giant vulnerability - the error trap ("panic handler") code in the Xbox's "Secret ROM" was intended to disable access to the Secret ROM and halt. Of course, this was a challenge as disabling the Secret ROM would also prevent the Halt instruction from being read. So, instead, the error trap was placed at the end of the mapped address space, and relied on EIP overflowing to 0x0 afterwards and causing a double fault, which would halt the CPU.

This was true for AMD CPUs, but for Intel CPUs, false - they'd just roll over and restart execution at 0x0.

This was the so-called "visor" exploit which enabled unencrypted bootloader payloads.

> I was standing there on the stage for the announcement, with BillG, and there they were right there, front row, looking so sad. I’ll never forget it. They had helped so much with the prototypes. Prototypes that were literally running the launch announcement demos ON AMD HARDWARE.

Wow, that's brutal and sort of heart-breaking.

If I remember history correctly the original xbox CPU was very close to an intel P3-based 733 MHz celeron. Likely Intel was able to undercut AMD significantly on price by using binned P3 production wafers where some of the L2 cache didn't test OK.