[LTP] [PATCH v1 08/31] testcases: sysfs: Add sys_cpu_vulnerabilities01

[Cyril Hrubis]

A test for /sys/devices/system/cpu/vulnerabilities/* files.

Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
---
 runtest/sysfs                                 |  1 +
 .../sysfs/devices/system/cpu/.gitignore       |  1 +
 .../system/cpu/sys_cpu_vulnerabilities01.c    | 85 +++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 testcases/kernel/sysfs/devices/system/cpu/sys_cpu_vulnerabilities01.c

diff --git a/runtest/sysfs b/runtest/sysfs
index b1daab68f..663c1d203 100644
--- a/runtest/sysfs
+++ b/runtest/sysfs
@@ -4,3 +4,4 @@ sys_clocksource01 sys_clocksource01
 sys_node01 sys_node01
 sys_cpu_topology01 sys_cpu_topology01
 sys_cpu_topology02 sys_cpu_topology02
+sys_cpu_vulnerabilities01 sys_cpu_vulnerabilities01
diff --git a/testcases/kernel/sysfs/devices/system/cpu/.gitignore b/testcases/kernel/sysfs/devices/system/cpu/.gitignore
index a688a9b50..3ae5f494f 100644
--- a/testcases/kernel/sysfs/devices/system/cpu/.gitignore
+++ b/testcases/kernel/sysfs/devices/system/cpu/.gitignore
@@ -1,2 +1,3 @@
 /sys_cpu_topology01
 /sys_cpu_topology02
+/sys_cpu_vulnerabilities01
diff --git a/testcases/kernel/sysfs/devices/system/cpu/sys_cpu_vulnerabilities01.c b/testcases/kernel/sysfs/devices/system/cpu/sys_cpu_vulnerabilities01.c
new file mode 100644
index 000000000..ae1bb8b7c
--- /dev/null
+++ b/testcases/kernel/sysfs/devices/system/cpu/sys_cpu_vulnerabilities01.c
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2026 Cyril Hrubis <chrubis@suse.cz>
+ */
+
+/*\
+ * Sanity checks for the CPU vulnerability reports exported under
+ * /sys/devices/system/cpu/vulnerabilities/.
+ *
+ * Each file describes the status of one hardware vulnerability. The kernel
+ * always prints a human readable status that starts with one of a few known
+ * prefixes. The test verifies that every vulnerability file:
+ *
+ * - is non-empty
+ * - starts with one of the known status prefixes (Not affected, Vulnerable,
+ *   Mitigation:, Unknown, Processor vulnerable)
+ *
+ * The test skips with TCONF when the vulnerabilities directory is not present,
+ * which is the case on architectures that do not report them.
+ */
+
+#include <string.h>
+#include <dirent.h>
+#include <unistd.h>
+#include "tst_test.h"
+#include "tst_sysfs_assert.h"
+
+#define VULN "/sys/devices/system/cpu/vulnerabilities"
+
+static const char *const known_prefixes[] = {
+	"Not affected",
+	"Vulnerable",
+	"Mitigation:",
+	"Unknown",
+	"Processor vulnerable",
+};
+
+static void check_vuln(const char *name)
+{
+	char status[256] = "";
+	unsigned int i;
+
+	TST_SYSFS_READ_STR(status, sizeof(status), VULN "/%s", name);
+
+	if (status[0] == '\0') {
+		tst_res(TFAIL, "%s/%s is empty", VULN, name);
+		return;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(known_prefixes); i++) {
+		if (!strncmp(status, known_prefixes[i],
+			     strlen(known_prefixes[i]))) {
+			tst_res(TPASS, "%s: '%s'", name, status);
+			return;
+		}
+	}
+
+	tst_res(TFAIL, "%s has unexpected status '%s'", name, status);
+}
+
+static void do_test(void)
+{
+	DIR *d;
+	struct dirent *ent;
+
+	if (access(VULN, F_OK)) {
+		tst_res(TCONF, VULN " is not available");
+		return;
+	}
+
+	d = SAFE_OPENDIR(VULN);
+
+	while ((ent = SAFE_READDIR(d))) {
+		if (ent->d_name[0] == '.')
+			continue;
+
+		check_vuln(ent->d_name);
+	}
+
+	SAFE_CLOSEDIR(d);
+}
+
+static struct tst_test test = {
+	.test_all = do_test,
+};
-- 
2.54.0