Enthusiasts successfully extracted and disassembled the microcode of the Intel 80386 processor, which was considered a "black box" due to the lack of documentation. The binary image of the microcode was recreated with the aid of AI, based on high-resolution photographs of the chip, and the operational logic was analyzed through tracing connections on the die. Over time, the structure of micro-operations (μ-ops), fields, execution order, and instruction end markers were determined. The project's findings have been published on GitHub as public domain.
It was discovered that in the 80386 CPU, each instruction is fully executed via microcode, whereas in the 8086 and modern processors, part of the instructions is handled directly. Additionally, unlike the 8086 processors, in the 80386, the microcode does not directly implement algorithms but primarily configures hardware accelerators (multiplier, divider, fast shifter, PTU (Protection Test Unit)).
The research also revealed a potential security issue in handling the I/O permission bitmap: when accessing ports with a 4-byte operation, the access rights were only checked for the first 3 bytes, and access to the 4th byte was not verified, theoretically allowing access to hardware registers that should have been restricted.
Based on the published microcode, an open CPU z386 has been developed, implemented in SystemVerilog and running on FPGA. Instead of implementing each instruction as a separate RTL (Register-transfer level) component, the z386 uses hardware structures managed by the original microcode. The performance of the prepared implementation corresponds to a fast 386 PC (~70MHz). Under the z386, it was possible to successfully run DOS 6/7, DOS/4GW, DOS/32A, and games such as Doom and Cannon Fodder.
Source: opennet.ru
