I meant that only in the “I’m not sure all code at Google has been rebuilt and had retpoline enabled” sense. We said in the article: > By December, all Google

I meant that only in the “I’m not sure all code at Google has been rebuilt and had retpoline enabled” sense. We said in the article: > By December, all Google Cloud Platform (GCP) services had protections in place for all known variants of the vulnerability. which means all the bits of the stacks across all our GCP products (i.e., not just our host kernels and GCE’s hypervisor but also say App Engine sandboxes). KPTI for kernels plus recompiling any sensitive thing (kernel, hypervisor, etc.) with a retpoline capable compiler. We’re not holding back secrets. Just trying to get the patches out while keeping blog posts relatively parseable by the general public. Note that no matter how disruptive kernel or other changes are, live migration always makes them “zero downtime migration”. The key here is that using retpoline to protect systems software against Variant 2 results in much lower overhead than other proposed mitigation strategies, particularly on older hardware but even a bit on Skylake.