Spectre variant 2 is not fundamental to speculative execution. It can be fixed by tagging the indirect branch predictions with the full virtual address and the ASID, and flushing it together with the TLB.

Any idea what will be the solution? Keep more speculative data in the pipeline? Performance penalties on security faults? Complex rollback?

you could certainly extend the unused transactional support to do a chandy-lamport thing, with the difference that when you run out of space isolated cache versions, you just can't speculate any more.

it would be a lot of machinery

you could also do latency hiding with smt instead of trying to fight it head-on with speculation. ultimately probably more productive, but either the compiler or the programming model or the user has to expose that concurrency.

If all speculation used a separate cache that is only committed on retirement, that should keep the side channels at bay.