[PATCH] x86/bugs: Only log missing retpoline when it's actually the missing mitigation

[PATCH] x86/bugs: Only log missing retpoline when it's actually the missing mitigation

[Kim Phillips]

spectre_v2_select_retpoline() unconditionally emits

  "Kernel not compiled with retpoline; no mitigation available!"

when the kernel lacks retpoline support, before returning SPECTRE_V2_NONE
to its callers.  SPECTRE_V2_NONE is not the final answer, though:
spectre_v2_update_mitigation() runs afterwards and can still upgrade the
mitigation.

On an Intel CPU affected by RETBleed, built with
CONFIG_MITIGATION_IBRS_ENTRY=y and CONFIG_MITIGATION_RETPOLINE=n, and
booted with spectre_v2=auto, retbleed_select_mitigation() picks
RETBLEED_MITIGATION_IBRS, and spectre_v2_update_mitigation() then promotes
SPECTRE_V2_NONE to SPECTRE_V2_IBRS.  The boot log claims no mitigation is
available immediately before reporting "Spectre V2 : Mitigation: IBRS",
and sysfs reports the machine as mitigated.  The message is alarming and
simply wrong.

Drop the pr_err from the helper and emit it once from
spectre_v2_update_mitigation(), after the final mitigation is known, so it
only fires when the system really is left unmitigated.  Guard it on
!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) so it fires only when retpoline
truly cannot be built in, and restrict it to the cases where retpoline was
the implied choice: SPECTRE_V2_CMD_FORCE, or SPECTRE_V2_CMD_AUTO when
should_mitigate_vuln(X86_BUG_SPECTRE_V2) indicates a mitigation was
actually intended.

Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
Cc: stable@kernel.org
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Assisted-by: ClaudeCode:claude-opus-4-7
---
 arch/x86/kernel/cpu/bugs.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 82436b3534fa..46c68feef339 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1956,10 +1956,8 @@ early_param("spectre_v2", spectre_v2_parse_cmdline);
 
 static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
 {
-	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)) {
-		pr_err("Kernel not compiled with retpoline; no mitigation available!");
+	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE))
 		return SPECTRE_V2_NONE;
-	}
 
 	return SPECTRE_V2_RETPOLINE;
 }
@@ -2247,6 +2245,13 @@ static void __init spectre_v2_update_mitigation(void)
 		}
 	}
 
+	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) &&
+	    spectre_v2_enabled == SPECTRE_V2_NONE &&
+	    (spectre_v2_cmd == SPECTRE_V2_CMD_FORCE ||
+	     (spectre_v2_cmd == SPECTRE_V2_CMD_AUTO &&
+	      should_mitigate_vuln(X86_BUG_SPECTRE_V2))))
+		pr_err("Kernel not compiled with retpoline; no mitigation available!");
+
 	if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
 		pr_info("%s\n", spectre_v2_strings[spectre_v2_enabled]);
 }

base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
-- 
2.43.0

Re: [PATCH] x86/bugs: Only log missing retpoline when it's actually the missing mitigation

[Pawan Gupta]

On Wed, Aug 26, 2026 at 05:22:28PM -0500, Kim Phillips wrote:
> spectre_v2_select_retpoline() unconditionally emits
> 
>   "Kernel not compiled with retpoline; no mitigation available!"
> 
> when the kernel lacks retpoline support, before returning SPECTRE_V2_NONE
> to its callers.  SPECTRE_V2_NONE is not the final answer, though:
> spectre_v2_update_mitigation() runs afterwards and can still upgrade the
> mitigation.
> 
> On an Intel CPU affected by RETBleed, built with
> CONFIG_MITIGATION_IBRS_ENTRY=y and CONFIG_MITIGATION_RETPOLINE=n, and
> booted with spectre_v2=auto, retbleed_select_mitigation() picks
> RETBLEED_MITIGATION_IBRS, and spectre_v2_update_mitigation() then promotes
> SPECTRE_V2_NONE to SPECTRE_V2_IBRS.  The boot log claims no mitigation is
> available immediately before reporting "Spectre V2 : Mitigation: IBRS",
> and sysfs reports the machine as mitigated.  The message is alarming and
> simply wrong.
> 
> Drop the pr_err from the helper and emit it once from
> spectre_v2_update_mitigation(), after the final mitigation is known, so it
> only fires when the system really is left unmitigated.  Guard it on
> !IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) so it fires only when retpoline
> truly cannot be built in, and restrict it to the cases where retpoline was
> the implied choice: SPECTRE_V2_CMD_FORCE, or SPECTRE_V2_CMD_AUTO when
> should_mitigate_vuln(X86_BUG_SPECTRE_V2) indicates a mitigation was
> actually intended.
> 
> Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
> Cc: stable@kernel.org
> Signed-off-by: Kim Phillips <kim.phillips@amd.com>
> Assisted-by: ClaudeCode:claude-opus-4-7
> ---
>  arch/x86/kernel/cpu/bugs.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index 82436b3534fa..46c68feef339 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -1956,10 +1956,8 @@ early_param("spectre_v2", spectre_v2_parse_cmdline);
>  
>  static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
>  {
> -	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)) {
> -		pr_err("Kernel not compiled with retpoline; no mitigation available!");

The claim "No mitigation available" is really the problem. And, it is
redundant here because the final mitigation state is anyways printed in
spectre_v2_update_mitigation().

How about just change the message to:

	pr_err("Kernel not compiled with retpoline");

It stays accurate here, telling retpoline mitigation was attempted.

> +	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE))
>  		return SPECTRE_V2_NONE;
> -	}
>  
>  	return SPECTRE_V2_RETPOLINE;
>  }
> @@ -2247,6 +2245,13 @@ static void __init spectre_v2_update_mitigation(void)
>  		}
>  	}
>  
> +	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) &&
> +	    spectre_v2_enabled == SPECTRE_V2_NONE &&
> +	    (spectre_v2_cmd == SPECTRE_V2_CMD_FORCE ||
> +	     (spectre_v2_cmd == SPECTRE_V2_CMD_AUTO &&
> +	      should_mitigate_vuln(X86_BUG_SPECTRE_V2))))
> +		pr_err("Kernel not compiled with retpoline; no mitigation available!");
> +

With the above message tweak, this check can be dropped.

>  	if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
>  		pr_info("%s\n", spectre_v2_strings[spectre_v2_enabled]);
>  }