Interestingly, Matt has invented a variant on the retpoline [1] which _intentionally_ missteers the branch predictor to prevent various speculative attacks. (Invented by my former Google manager.). It's pretty cool how much simpler a retpoline would be in aarch64, since we have explicit control over the link register rather than having to play stupid games with stacks.
(Real retpolines have a little more magic, naturally.)
(Real retpolines have a little more magic, naturally.)
[1]https://stackoverflow.com/questions/48089426/what-is-a-retpo...