For the older Goldmont/Goldmont Plus cores inside Apollo Lake, Gemini Lake and Denverton CPUs, the microcode update files (encrypted with RC4) have been decrypted and the format of the micro-instructions has been reverse-engineered.

There is a presentation about it at:

https://www.youtube.com/watch?v=V1nJeV0Uq0M


A microcode disassembler and a few extracted microcode updates are at:

https://github.com/chip-red-pill


The micro-instruction format for Apollo Lake is a kind of VLIW format somewhat similar to the format of an Intel Itanium instruction bundle, with 3 simultaneous micro-operations, each of them encoding, besides an opcode, three 6-bit register addresses and one 13-bit immediate constant.

It is likely that this does not offer much information about the micro-instruction format used in the mainstream Core and Xeon CPUs, which must be much more complex.


The decryption and the reverse-engineering of the microcode format has been possible only because these older Atom CPUs have a bug in the Management Engine that can be exploited to allow the CPU to be switched in a mode where JTAG debugging is enabled.

By running test programs and studying the bits read simultaneously from the internal buses and from the microcode memory, after a lot of work, the encryption algorithm, the decryption keys and the microinstruction format could be determined.


One of the more surprising facts, which has been published by Intel only last year (without details), several years after being implemented in many CPUs, and of which I was not aware, is that there is a feature of Intel SGX, named XuCode, which allows an instruction to initiate not only the execution of a microprogram, as in CPUs without SGX, to alter the instruction behavior, but also the execution of an entire executable file, which is hidden inside the microcode update, as an ELF file.

When executing XuCode, the Intel CPU is in a special mode, where only a subset of the x86-64 ISA is recognized, but there are available additional instructions and MSRs.

https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/secure-coding/xucode-implementing-complex-instruction-flows.html