title: What is a retpoline and how does it work?
body: <p>In order to mitigate against kernel or cross-process memory disclosure (the <a href="https://spectreattack.com/spectre.pdf" rel="noreferrer">Spectre</a> attack), <a href="https://lkml.org/lkml/2018/1/3/780" rel="noreferrer">the Linux kernel<sup>1</sup> will be compiled with a new option</a>, <code>-mindirect-branch=thunk-extern</code> introduced to <code>gcc</code> to perform indirect calls through a so-called <em>retpoline</em>.</p>
  
  <p>This appears to be a newly invented term as a Google search turns up only very recent use (generally all in 2018).</p>
  
  <p>What is a retpoline and how does it prevent the recent kernel information disclosure attacks?</p>
  
  <hr>
  
  <p><sup>1</sup> It's not Linux specific, however - similar or identical construct seems to be used as part of the <a href="https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd6533e9" rel="noreferrer">mitigation strategies</a> on other OSes.</p>