selftests/bpf: more precise cpu_mitigations state detection

[eddyz87]

test_progs and test_verifier binaries execute unpriv tests under the following conditions:

• unpriv BPF is enabled;
• CPU mitigations are enabled (see [1] for details).

The detection of the "mitigations enabled" state is performed by unpriv_helpers.c:get_mitigations_off() via inspecting kernel boot command line, looking for a parameter "mitigations=off".

Such detection scheme won't work for certain configurations, e.g. when CONFIG_CPU_MIGITGATIONS is disabled and boot parameter is not supplied.

Miss-detection leads to test_progs executing tests meant to be run only with mitigations enabled, e.g.
verifier_and.c:known_subreg_with_unknown_reg(), and reporting false failures.

Internally, verifier sets bpf_verifier_env->bypass_spec_{v1,v4} basing on the value returned by kernel/cpu.c:cpu_mitigations_off(). This function is backed by a variable kernel/cpu.c:cpu_mitigations.

This state is not fully introspect-able via sysfs. The closest proxy is /sys/devices/system/cpu/vulnerabilities/spectre_v1, but it reports "vulnerable" state only if mitigations are disabled and current cpu is vulnerable, while verifier does not check cpu state.

There are only two ways the kernel/cpu.c:cpu_mitigations can be set:

• via boot parameter;
• via CONFIG_CPU_MIGITGATIONS option.

This commit updates unpriv_helpers.c:get_mitigations_off() to scan /proc/config.gz for CONFIG_CPU_MIGITGATIONS value in addition to boot command line check.

Tested using the following configurations:

• mitigations enabled (unpriv tests are enabled)
• mitigations disabled via boot cmdline (unpriv tests skipped)
• mitigations disabled via CONFIG_CPU_MIGITGATIONS (unpriv tests skipped)

[1] https://lore.kernel.org/bpf/[email protected]/