80286 Protected Mode Test

[Peter Corlett]

On Sun, Mar 14, 2021 at 04:32:20PM +0100, Maciej W. Rozycki via cctalk wrote:
> On Sun, 7 Mar 2021, Noel Chiappa via cctalk wrote:
>>> The 286 can exit protected mode with the LOADALL instruction.
[...]
> The existence of LOADALL (used for in-circuit emulation, a predecessor
> technique to modern JTAG debugging and the instruction the modern x86 RSM
> instruction grew from) in the 80286 wasn't public information for a very
> long time, and you won't find it in public Intel 80286 CPU documentation
> even today. Even if IBM engineers knew of its existence at the time the
> PC/AT was being designed, surely they have decided not to rely in their
> design on something not guaranteed by the CPU manufacturer to exist.

The Wikipedia page on LOADALL claims "The 80286 LOADALL instruction can not
be used to switch from protected back to real mode (it can't clear the PE
bit in the MSW). However, use of the LOADALL instruction can avoid the need
to switch to protected mode altogether."

I find that paragraph very persuasive. The author knows about LOADALL and
the desire to use it to avoid going into protected mode, and also explains
that there's a specific exception in its behaviour which prevents returning
to real mode. All of the other hacky uses of LOADALL would be unnecessary if
it could be used to switch modes at will. It just doesn't seem like
something that would be written if it was wrong.

Is Wikipedia incorrect and the 286 LOADALL *can* exit protected mode, and if
so, how?