Timing the L1 cache response for speculatively fetched data that one could not normally access is just one of the problems. It's the one that it is easiest to explain, and it's also the one that the few operating system writers who were told about this tackled first. Hence it is the one that is getting the focus in many discussions.

* https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne... (https://news.ycombinator.com/item?id=16080002)

* https://dev.to/isaacandsuch/how-meltdown-works-28j2 (https://news.ycombinator.com/item?id=16085592)

One of the other problems is tricking the branch predictor into speculatively jumping into code of one's choosing.

* https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... (https://news.ycombinator.com/item?id=16079910)