hckrnws

Could they do this with x86-16?

No, because it depends on speculative execution and performance counters. The earliest microarchitecture where this might be possible would be the P6?

And I don't think there are any more x86-16 opcodes left to be discovered. Some time ago I did quite a bit of experimentation with the 80286 to find what is probably the last one[1], and also looked closely at its "entry point PLA" in die shots, which maps opcodes to microcode addresses. The undefined ones all seem to go to the same entry point, which would be the one that triggers #UD.

[1] or at least, figure out what two "useless" undocumented opcodes actually do, and how to use them together: https://rep-lodsb.mataroa.blog/blog/intel-286-secrets-ice-mo...

In modern processors, 16-bit, 32-bit, and 64-bit x86 all use mostly the same instructions, just with different default operand sizes. In particular, with a few big exceptions (like INC/DEC r32 being replaced with the REX prefixes, and segment PUSH/POP being removed), they all have the same encodings. So the set of undocumented instructions, especially in the multibyte encoding ranges, is likely the same. Though their behavior might vary, or be absent altogether.

(2021)

[flagged]