When the kernel is compiled without CONFIG_MITIGATION_RETPOLINE, spectre_v2_select_retpoline() returns SPECTRE_V2_NONE, leaving SNP hosts with AutoIBRS completely unmitigated against Spectre v2 in the default/auto case. Since SNP CPUs have AutoIBRS available, fall back to SPECTRE_V2_EIBRS rather than leaving the system unmitigated. The preceding commit already enables AutoIBRS (and sets X86_FEATURE_IBRS_ENHANCED) on SNP parts, so no additional feature-bit fixup is needed here; only the mitigation selection changes when retpoline is unavailable. Fixes: acaa4b5c4c85 ("x86/speculation: Do not enable Automatic IBRS if SEV-SNP is enabled") Cc: stable@kernel.org Signed-off-by: Kim Phillips Assisted-by: ClaudeCode:claude-opus-4-7 --- arch/x86/kernel/cpu/bugs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index a813a98ac5bd..6a036b509f0b 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -2204,6 +2204,15 @@ static void __init spectre_v2_select_mitigation(void) } spectre_v2_enabled = spectre_v2_select_retpoline(); + /* + * If retpoline is unavailable (e.g. built without + * CONFIG_MITIGATION_RETPOLINE), fall back to eIBRS on + * AutoIBRS-capable parts rather than leaving SNP hosts + * unmitigated. + */ + if (spectre_v2_enabled == SPECTRE_V2_NONE && + boot_cpu_has(X86_FEATURE_AUTOIBRS)) + spectre_v2_enabled = SPECTRE_V2_EIBRS; break; case SPECTRE_V2_CMD_RETPOLINE_LFENCE: -- 2.43.0