I have understood that Spectre works mainly by exploiting the branch predictor state. Bounds check bypass and branch target injection are two faces of the same coin, the interaction of speculative execution with the branch predictor.
Now, immediately when hearing this I thought we need an instruction to clear the branch predictor state. Such an instruction could be used when switching context from user space to kernel space or vice versa or between two user space processes.
Apparently I am not alone in this. Mark has an excellent answer to the question Just how bad is Spectre? and Mark proposes the same thing. This has also been proposed at Real World Tech discussion forums.
Is this however a complete fix to Spectre? What about VMs such as JVMs that need to run untrusted code in the same user space process that runs also trusted code? Could the instruction help in securing such VMs?