> It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning > "As BOOM will send speculative load in

> It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning > "As BOOM will send speculative load instructions to the cache…" > How would such a design not be vulnerable to Spectre? Hypothetically (I'm not familiar enough with BOOM to say whether this applies in this case or not), if the "speculation load depth" is limited to 1, then it seems it could be invulnerable? From the spectre paper, the exploit uses code like if (x < array1_size) y = array2[array1[x] * 256]; So if the speculation load depth would be limited to 1, the cpu could speculatively load array1[x], compute "array1[x] * 256", but not load "array2[array1[x] * 256]" until the branch has been resolved? Now, I don't know enough about micro-architecture to say whether such an idea makes any sense in general. Secondly, it seems Spectre is only the first on a long series of side channel attacks that target speculation, so it might be that the hypothetical "speculation load depth limited" design I envisioned above is vulnerable to some other variation of the attack.