And presumably stage 3 is to grab a VAX11/7xx
printset,
figure out the microinstruction word, then disassemble the
appropriate bit of the microocde and understand how it works.
If you have access to the appropriate printset, that
might be an option. I don't have it on paper - I know
that some of the 780 stuff is up at bitsavers, but I
don't know whether any of the available prints have
microcode listings.
AFAIK they don't contain microcode listings (some of the PDP11 ones do,
but those machines don't have the POLY instruction).
What I was suggesting (semi-seriously, I did this sort of thing for fun
when I was an undergrad) was taking the printset and working out what the
microcode word bits actually did. Then possibly writing a
cross-disassembler for said microcode. THen taking the microcode binaries
(IIRC the 11/7xx loads its microcode from TU58 or RX01 when it boots.
Then commenting the appropriate bits for the POLY routine.
-tony