82

From what I've read it's used to fix bugs in the CPU without modifying the BIOS. From my basic knowledge of Assembly I know that assembly instructions are split into microcodes internally by the CPU and executed accordingly. But intel somehow gives access to make some updates while the system is up and running.

Anyone has more info on them? Is there any documentation regarding what can it be done with microcodes and how can they be used?


EDIT: I've read the wikipedia article: didn't figure out how can I write some on my own, and what uses it would have.

8

2 Answers 2

77

In older times, microcode was heavily used in CPU: every single instruction was split into microcode. This enabled relatively complex instruction sets in modest CPU (consider that a Motorola 68000, with its many operand modes and eight 32-bit registers, fits in 40000 transistors, whereas a single-core modern x86 will have more than a hundred millions). This is not true anymore. For performance reasons, most instructions are now "hardwired": their interpretation is performed by inflexible circuitry, outside of any microcode.

In a recent x86, it is plausible that some complex instructions such as fsin (which computes the sine function on a floating point value) are implemented with microcode, but simple instructions (including integer multiplication with imul) are not. This limits what can be achieved with custom microcode.

That being said, microcode format is not only very specific to the specific processor model (e.g. microcode for a Pentium III and a Pentium IV cannot be freely exchanged with eachother -- and, of course, using Intel microcode for an AMD processor is out of the question), but it is also a severely protected secret. Intel has published the method by which an operating system or a motherboard BIOS may update the microcode (it must be done after each hard reset; the update is kept in volatile RAM) but the microcode contents are undocumented. The Intel® 64 and IA-32 Architectures Software Developer’s Manual (volume 3a) describes the update procedure (section 9.11 "microcode update facilities") but states that the actual microcode is "encrypted" and clock-full of checksums. The wording is vague enough that just about any kind of cryptographic protection may be hidden, but the bottom-line is that it is not currently possible, for people other than Intel, to write and try some custom microcode.

If the "encryption" does not include a digital (asymmetric) signature and/or if the people at Intel botched the protection system somehow, then it may be conceivable that some remarkable reverse-engineering effort could potentially enable one to produce such microcode, but, given the probably limited applicability (since most instructions are hardwired), chances are that this would not buy much, as far as programming power is concerned.

13
  • 48
    "This is not true anymore. For performance reasons, most instructions are now "hardwired": their interpretation is performed by inflexible circuitry, outside of any microcode." I don't think this is correct. Agnor Fog has done a lot of reverse engineering of modern x86 CPUs and mentions microcode frequently, in fact I think microcode is what gets pipelined and OOE instead of normal instructions, and normal things like using a memory address instead of a register for an operation generate extra u-ops. Agnor Fog manual here: agner.org/optimize/microarchitecture.pdf Aug 30, 2012 at 2:20
  • 5
    Also, pltsim, which attempts to do a full x86-64 CPU simulation, specifically emulates microcode: ptlsim.org Aug 30, 2012 at 2:22
  • 2
    @JosephGarvin: another revealing fact is that the Pentium IV had a trace cache instead of a normal L1 icache.
    – ninjalj
    Sep 8, 2012 at 9:27
  • 5
    That reads like a whole lot of speculation and no references.
    – ʇsәɹoɈ
    Nov 24, 2015 at 18:32
  • 2
    It seems ptlsim.org no longer exists, but Marss86 is based on ptlsim. Jan 30, 2016 at 19:30
19

Think loosely about a virtual machine or simulator where say for example qemu-arm can simulate an arm processor on an x86 host, ideally the software running on the simulated arm has no idea that it isnt a real arm. Take this idea to the level where the whole chip is designed such that it always looks like you are an x86, the software never knows there is some programmable items inside the chip. And that some other processor inside is somewhat designed for the purpose of implementing/simulating an x86. Supposedly the popular AMD 29000 product line just went away because the hardware team and perhaps processor/core became the guts of an early x86 clone. Transmeta, where Linus worked, had a vliw processor that was made to be a low power x86. In that case the translation layer was not (as much of) a secret. Vliw, very long instruction word, RISC taken to the extreme, is the kind of thing you build for this kind of task.

No it is not as much of an emulation layer as I am implying, there isnt some linux running there with a qemu program inside each chip. It is somewhere between hardwired where there is no software/microcode in the middle and a full blow emulation. The programmable bits may be like an fpga, programmable gates, or it may be software or programmable state machines, meaning not-programmable gates, just what runs on the gates is programmable.

Your non-x86, non-big iron type processors. Take ARM for example, are hardwired, no microcode. Microcontrollers, PIC, MSP430, AVR, assume these are not microcoded. Basically do not assume all processors are microcoded, few if any processor families are. It is just that the ones we deal with in PCs have been and may still be, so it may feel like they all are.

As fun as it may sound to play with this microcode, it is likely very specific to the processor family, and you likely will never gain access to how it works unless you work for Intel or AMD, each of which likely have their own internals. So you would need to get a job at one of the two, then work your way through the trenches to become one of what is likely an elite team that does this work. And once you get that far your career is trapped, your skills may be limited to one job at one company. You might have more fun programming individual gpus on a video card, something that is documented or at least has tools, something you can do today without spending 10 years at AMD or Intel to possibly get nowhere.

5
  • Thanks for the clear answer. So, in a way, we can say that a CPU is a lesser and specialized form of a FPGA, and we can think microcode is something similar to Verilog?
    – Tu Do
    Sep 24, 2015 at 8:29
  • 1
    it is not that generic inside, more like a cpu inside a cpu but the inner one is more primitive, possibly RISC but likely simpler than that (simpler in that it may take multiple instructions to do anything one interesting or useful thing).
    – old_timer
    Sep 24, 2015 at 11:31
  • 5
    "there isnt some linux running there with a qemu program inside each chip." I would have laughed at that prospect - until a few days ago. Then, this got reported: zdnet.com/article/minix-intels-hidden-in-chip-operating-system. Things have gotten a lot more complicated than they used to be. Nov 16, 2017 at 7:13
  • @EuroMicelli: Just to clarify for future readers: that's the management engine, outside of the x86 cores themselves. It's not involved in the process of fetch/decode/execute of x86 machine code by an individual core. Microcode updates can update things about how the CPUs cores work, like for Spectre mitigation they added a new MSR, since writing an MSR effectively is a way to give access to totally new microcode that wasn't part of any previous instruction, without changing how existing instructions work. They've also done stuff like disable some HW bits, like the loop buffer on Skylake. Oct 10, 2022 at 2:39
  • @EuroMicelli: Also, the management engine is in the chipset, not on the CPU proper. IDK if a CPU microcode update can even affect it. (Which is still somewhat insane, and yeah there'd be room to put something like that on the CPU dies if they wanted.) What's actually onboard the CPU's silicon is an extra controller with about as many transistors as a 486, which manages power / turbo states according to temperature and load history, and some knobs like energy_performance_preference. Oct 10, 2022 at 2:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.