x86 documentation suggests speculation is of x86 asm,

but as I understand it x86 asm is emulated above a RISC core
and AFAICS speculative execution must be done in hardware,

so as x86 is in software doesnt that mean that
speculative execution is speculated RISC core execution
and NOT speculated x86 asm execution??

Heh, what difference does it make?

The x86 architecture of today consists of multiple layers anyway, both in depth and breadth.

well that itself is a question!

to the programmer no difference as speculative code is
an implementation optimisation,

but if the speculation is in the RISC core then it will
be less impressive at the x86 level, eg if the RISC core
speculates 20 instructions ahead but each x86 instruction
is implemented in 4 RISC instructions then that presumably
is 5 x86 instructions of speculation??

I guess the x86 instruction cache is a data cache for the
RISC core,

is anything at all known about the x86 RISC cores?

how do they compare to conventional RISC cpus such
as PPC and MIPS,

eg how would an x86 emulator above PPC compare
to RISC core x86?

(say you reversed the PPC CPU endianess flag)

I wonder if the RISC core uses just in time emulation?

those MSR's must be just global variables in write
protected pages,

Well, one thing that springs to mind is that recent (pentium4+) intel processors don't have a regular L1 code cache, it has a "trace cache" instead of decoded x86 instructions...

Not so. P4 was the result of a whole generation of computer architects growing up on Hennesy & Patterson thinking that RISC was the only way to design a processor. Intel gave up on that failed architecture and its hated trace cache last year: Core Duo and Core 2 Duo have real instructions caches.
If there were a RISC core in Intel processors, one would think that macro-op fusion would synthesize a three-register opcode out of

movapd xmm2, xmm0
addpd xmm0, xmm1

instead of the worthless combinations which really can get fused.