Enthusiasts managed to successfully extract and disassemble the microcode of the Intel 80386 processor, which was considered a 'black box' due to the lack of documentation. The binary image of the microcode was recreated with the help of AI from high-resolution photographs of the chip, and the operation logic was analyzed through connection tracing on the chip. Gradually, the structure of the micro-operations (μ-ops), fields, execution order, and instruction end markers were identified. The project's findings has been published are available on GitHub as public domain.
It was found that in the 80386 CPU, each instruction is fully executed through microcode, while in the 8086 and modern processors, some instructions are processed directly. Furthermore, unlike the 8086 processors, in the 80386, the microcode does not implement algorithms directly, but mainly configures hardware accelerators (multiplier, divider, fast shift, PTU (Protection Test Unit)).
During the research, a possible security issue was also discovered related to the processing of the IO permission bitmap: when performing a 4-byte access to ports, access rights were only checked for the first 3 bytes, and access to the 4th byte was not checked, which theoretically allowed access to hardware registers that should have been prohibited.
Based on the published microcode an open CPU z386, implemented in SystemVerilog and running on FPGA. Instead of implementing each instruction as a separate RTL (wikipedia.org) (Register-transfer level), z386 implements hardware structures controlled by the original microcode. The performance of the developed implementation is comparable to a fast 386 PC (~70MHz). With z386, it was possible to successfully run DOS 6/7, DOS/4GW, DOS/32A, and games such as Doom and Cannon Fodder.
Source: linux.org.ru
