Inside the PlayStation3

POWER PROCESSING ELEMENT (PPE)
A 64-bit dual-issue, dual-threaded processor based on IBM’s PowerPC architecture would act as the host core. Despite popular belief, it is not dual-core. It does however function similarly to Intel’s HyperThreading technology, and when one thread stalls, the second continues to execute.

While not as complete or powerful as the chips you’d find in a G4 or G5 Mac, the PPE would be sufficient. The main difference being in-order execution instead of out-of-order execution, unusual for a CPU but significantly reducing transistor counts, power consumption and heat generation, at the cost of lacklustre performance on branching code. The chip, in its PS3 configuration, is clocked at 3.2GHz and features a 32KB two-way set-associative L1 cache and an error-corrected (ECC) 512KB eight-way set-associative L2 cache. For all intents and purposes, it is 100 percent compatible with the PPC instruction set.

SYNERGISTIC PROCESSING ELEMENT (SPE)
Eight 128-bit supplementary cores clocked at 4GHz and built to a new design. Each features eight computational units – four single-precision floating point and four integer – providing 32 gigaflops of theoretical performance. A 256KB ‘local store’ provides read/write data storage. Any SPE can also be switched to ‘Isolation Mode’ providing a secure environment in which to run applications (see the Lockdown! boxout for more information).

RAMBUS FLEXIO BUS (FLEXIO)
Provides two 12.8GB/s paths between Cell and system memory, for a total bandwidth of 25.6GB/s, when combined with Rambus’s XDR memory. In combination with the internal bandwidth on-chip, data communication is extremely fast.



‘I think the design goals were all accomplished,’ says D’Amora. ‘Cell has supercomputer attributes, for example extreme floating point performance and a high degree of on chip parallelism. It can support photorealistic algorithms such as ray tracing. It has a predictable realtime response characteristic, so can support natural interactivity. It is flexible to support a variety of application domains.’

Even six years after the initial design was conceived, Cell is a phenomenally powerful chip and testament to the brilliance of IBM and Toshiba’s R&D faculties. Except the Cell chip inside the PS3 is not as good as the one we’ve just described.

LOCKDOWN!
Each SPE in Cell supports a special setting called ‘Isolation Mode’ that locks the core out from the rest of the system, save for a few commands and limited read/write capabilities. To initiate lockdown on an SPE, a program must first be loaded onto the target SPE. Once loaded, the SPE and a small chunk of the local store is isolated from the memory bus, and read/write functions to this small chunk can only be conducted by the SPE. The only way to release the SPE from isolation is to send it an exit command, which erases all registers on the chip and clears the local store before complying. Essentially, you could load a key and its decryption program into an SPE, lock it down, and read only the results from the accessible section of the local store. Once completed, all traces of the program and its execution
are destroyed.

Of course, this does leave the program itself as an exploitable target, but attempts to read and write data or manipulate the execution of the SPE while it is isolated is impossible.

PS3 CRIPPLED?
Not exactly. Sony faced a number of problems transforming the PS3 from a fanboy’s wet dream into a purchasable product, most of them engineering-related. Cell was not an easy chip to manufacture given its high degree of complexity.

In a late 2006 interview with EDN.com, IBM’s VP of semiconductor and technology services Tom Reeves stated that yields of Cell with all eight SPEs functional was 10 to 20 percent – a dismal number when compared to the 95 percent figure Reeves provides for conventional CPUs in the same interview. Eventually, STI was forced to deactivate one of the SPEs to improve yields. Given that one SPE is also locked out by the hardware for OS/security use, the PS3 is left with seven cores – six SPEs and the PPC – for games and applications. While you do lose 25 percent of the SPEs on the chip, the PS3 is hardly crippled, especially when you consider that there’s more to the console than just Cell.