Well the first problem is obvious with hindsight. Consider all the state changes that occur when an instruction is speculatively executed. Are any of these roll

Well the first problem is obvious with hindsight. Consider all the state changes that occur when an instruction is speculatively executed. Are any of these rolled back? In this case, the cache is not being rolled back. Neither (presumably) is the branch predictor. And then what of the performance counters? (do they count if an instruction is not retired?). I see many potential attack vectors opening up and it's much harder to prove that any of these state changes can't be exploited.