Re: [PATCH] x86/bugs: Only log missing retpoline when it's actually the missing mitigation

[Pawan Gupta]

On Wed, Aug 26, 2026 at 05:22:28PM -0500, Kim Phillips wrote:
> spectre_v2_select_retpoline() unconditionally emits
> 
>   "Kernel not compiled with retpoline; no mitigation available!"
> 
> when the kernel lacks retpoline support, before returning SPECTRE_V2_NONE
> to its callers.  SPECTRE_V2_NONE is not the final answer, though:
> spectre_v2_update_mitigation() runs afterwards and can still upgrade the
> mitigation.
> 
> On an Intel CPU affected by RETBleed, built with
> CONFIG_MITIGATION_IBRS_ENTRY=y and CONFIG_MITIGATION_RETPOLINE=n, and
> booted with spectre_v2=auto, retbleed_select_mitigation() picks
> RETBLEED_MITIGATION_IBRS, and spectre_v2_update_mitigation() then promotes
> SPECTRE_V2_NONE to SPECTRE_V2_IBRS.  The boot log claims no mitigation is
> available immediately before reporting "Spectre V2 : Mitigation: IBRS",
> and sysfs reports the machine as mitigated.  The message is alarming and
> simply wrong.
> 
> Drop the pr_err from the helper and emit it once from
> spectre_v2_update_mitigation(), after the final mitigation is known, so it
> only fires when the system really is left unmitigated.  Guard it on
> !IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) so it fires only when retpoline
> truly cannot be built in, and restrict it to the cases where retpoline was
> the implied choice: SPECTRE_V2_CMD_FORCE, or SPECTRE_V2_CMD_AUTO when
> should_mitigate_vuln(X86_BUG_SPECTRE_V2) indicates a mitigation was
> actually intended.
> 
> Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
> Cc: stable@xxxxxxxxxx
> Signed-off-by: Kim Phillips <kim.phillips@xxxxxxx>
> Assisted-by: ClaudeCode:claude-opus-4-7
> ---
>  arch/x86/kernel/cpu/bugs.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index 82436b3534fa..46c68feef339 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -1956,10 +1956,8 @@ early_param("spectre_v2", spectre_v2_parse_cmdline);
>  
>  static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
>  {
> -	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)) {
> -		pr_err("Kernel not compiled with retpoline; no mitigation available!");

The claim "No mitigation available" is really the problem. And, it is
redundant here because the final mitigation state is anyways printed in
spectre_v2_update_mitigation().

How about just change the message to:

	pr_err("Kernel not compiled with retpoline");

It stays accurate here, telling retpoline mitigation was attempted.

> +	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE))
>  		return SPECTRE_V2_NONE;
> -	}
>  
>  	return SPECTRE_V2_RETPOLINE;
>  }
> @@ -2247,6 +2245,13 @@ static void __init spectre_v2_update_mitigation(void)
>  		}
>  	}
>  
> +	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) &&
> +	    spectre_v2_enabled == SPECTRE_V2_NONE &&
> +	    (spectre_v2_cmd == SPECTRE_V2_CMD_FORCE ||
> +	     (spectre_v2_cmd == SPECTRE_V2_CMD_AUTO &&
> +	      should_mitigate_vuln(X86_BUG_SPECTRE_V2))))
> +		pr_err("Kernel not compiled with retpoline; no mitigation available!");
> +

With the above message tweak, this check can be dropped.

>  	if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
>  		pr_info("%s\n", spectre_v2_strings[spectre_v2_enabled]);
>  }