These are my notes on this.

If you are up on your x86 microarchitecture (I wasn’t) you might want to start with heading “Step 1:” on page 8. Many pages teach us about speculative execution. They suggest that speculation is triggered by a conditional branch whose condition is not yet available. Here for the first time we hear that whether the CPU is in privileged mode is considered a fact that it will take some time to resolve and so proceeds, speculatively, as if loading from a kernel-only-virtual-address were OK. Some time later those speculated instructions will be prevented from retiring when it is discovered that the CPU is in user mode.

I find this too vague. (My notes) What is the nature of the mechanism that ‘knows there is an interrupt to handle’? Many other instructions produce such contingencies. Does every load or store operation cause the speculator to stash a register map just in case it is necessary to return to that state? The x86 eventually notices when a user mode load operation fetches a word from kernel memory even for speculatively executed instructions. If the speculator is in user mode then there is no more reason to go on speculating past the load than when the speculator passes an unconditional jump. Speculation can manifestly be stopped as when the accessed page is not in the TLB nor even in the memory map of which the TLB is a cache. I can imagine no microarchitecture where privileged access is not known before the real speculated load. Such a load can only pollute the cache.
Is there a better time to do this than when the memory map entry from the TLB is found to match the address of the booty? (I presume the TLB entry includes the protection level of the target page; how else could protection violation be detected?) When the load command fetches the word in kernel memory it has already noticed that this is a kernel only word.

It seems the CPU mode is not part of the speculated state as are register contents. I see a strange paragraph on page 158 of Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1:

The whole section 5.5 seems alien to me. I recall studying Intel’s gate concept many decades ago and deciding I could not use it. I wonder if anyone uses it.

I know no use of system using privileged mode that allows some code to be executed in either state. Certainly not Keykos nor the VM’s I have studied.

The Wikipedia article suggests that there are no chips in the field with the TSX feature. Intel manuals suggest the feature has been available again since about 2015. The paper suggests that their particular exploit uses TSX.