z386: An Open-Source 80386 Built Around Original Microcode

z386 brings original Intel 386 microcode to life on FPGA hardware

An open-source FPGA CPU project has reconstructed the Intel 80386 processor using recovered original microcode, enabling it to boot real DOS software and run protected-mode applications. The project, called z386, is built around a 37-bit-wide, 2,560-entry microcode ROM extracted from the original chip, and can play games such as Doom and Cannon Fodder.

---

z386 Brings Original Intel 386 Microcode to Life on FPGA Hardware

z386 is a 386-class CPU built around the original Intel microcode, designed to recreate enough of the original machine that the recovered 386 control ROM can drive it. The project is not an instruction-by-instruction emulator in RTL, but rather a faithful architectural reconstruction. It currently boots DOS 6 and DOS 7, runs protected-mode programs including DOS/4GW and DOS/32A, and plays games such as Doom and Cannon Fodder.

The project follows in the spirit of z8086, an earlier original-microcode-driven 8086 implementation that demonstrated it was possible to build a working CPU around recovered microcode. When 80386 microcode was subsequently extracted, a group of researchers — including reenigne and several collaborators — were working on a disassembly and shared their work, allowing z386 to begin development. The reconstruction took roughly four months of evenings and weekends to reach its current state.

The developer describes the 386 as a considerably harder problem than the 8086. The instruction set is larger, the internal state is much richer, and the machine must enforce protection, paging, privilege checks, and precise faults. The 80386 micro-operations are also described as denser and more contextual — more like hand-tuned assembly than a straightforward program, and full of assumptions about hidden hardware.

How It Works

z386 preserves many structures from the original 386 microarchitecture, including a 32-entry paging TLB, a barrel shifter shaped like the original, ROM/PLA-style decoding, the Protection PLA model, and the 37-bit-wide, 2,560-entry microcode ROM. At the same time, it uses FPGA-friendly shortcuts where appropriate, such as DSP blocks for multiplication and a small, fast L1 cache.

The current cache is a 16 KB, 4-way set-associative unified L1, chosen partly to keep the clock speed high. In current builds, z386 performs like a fast, approximately 70 MHz cached 386-class machine, or a low-end 486. It runs at a much higher clock than historical 386 CPUs, though with somewhat worse CPI (cycles per instruction). Real high-end 386 systems often used larger external caches, typically in the 32 KB to 128 KB range.

The design covers eight major units at a high level, and the project's documentation spans five instalments, covering topics including the multiplication and division datapath, the barrel shifter, protection and paging, and the memory pipeline. The fifth post fills in instruction prefetch, decode, the microcode sequencer, cache design, testing, and lessons from the bring-up process.

Availability and Goals

z386 is described as aiming to be both an educational reconstruction and a usable FPGA CPU. The project is open-source and documented across a series of detailed technical posts on the developer's website. The result is not described as a perfect 386, but it is far enough along to run real protected-mode DOS software.

The project builds on prior work in the open-source CPU reconstruction community, and credits reenigne and several others for their contributions to the microcode disassembly effort that made z386 possible.

Story based on discussion on Hacker News.