From ec154a975f27c6d98206f57fa4345cc608022f20 Mon Sep 17 00:00:00 2001 From: Daniel Samson <12231216+daniel-samson@users.noreply.github.com> Date: Sat, 1 Aug 2026 10:05:59 +0100 Subject: [PATCH] =?UTF-8?q?docs:=20security=20track=20live=20state=20?= =?UTF-8?q?=E2=80=94=20H2=20green=20at=20112?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/security-track-plan.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md index 70e53ec..dd8df3c 100644 --- a/docs/security-track-plan.md +++ b/docs/security-track-plan.md @@ -36,11 +36,11 @@ plain `main` checkout always tells the truth about where the work is.** | | | |---|---| -| Working on | **H2** — SMEP (group 4) | -| Branch carrying it | `feat/security-group-4` (cut next) | +| Working on | **HS** — SYSRET canonical-RIP guard | +| Branch carrying it | `feat/security-group-4` (pushed to origin) | | On `main` | everything through P4c — groups 1, 2 and 3 merged | -| Awaiting merge | nothing | -| Suite | 111 cases, all passing | +| Awaiting merge | H2 — lands with the group 4 merge | +| Suite | 112 cases, all passing | | Last updated | 2026-08-01 | A checkbox below means the phase met its definition of green and was @@ -80,7 +80,7 @@ group boundary. nobody holds. New `badge-scope` case, two processes of one fixture, every refusal paired with a control; suite 111/111) - [x] **merge** group 3 → main, push -- [ ] **H2** — SMEP on every core +- [x] **H2** — SMEP on every core (shared CPUID helper; CR4 bit 20 set in the per-CPU bring-up both the BSP and every AP run, asserted per core by the smp case; ring-0-executes-user-pages audit clean incl. the pre-paging window on the loader's tables; fail-open with a posture line; `-cpu max` added to the harness since QEMU's default model has neither bit; new `fault-smep` case; suite 112/112) - [ ] **HS** — SYSRET canonical-RIP guard - [ ] **H3** — SMAP + boot-patched `clac`; `-cpu max` in the harness; negative tests - [ ] **merge** group 4 → main, push