GrapheneOS project: pixel 11 no longer supports hardware memory tagging (MTE); GrapheneOS might skip the the whole pixel 11 series
-
I was so disappointed with my pixel 10. It's kept a pixel 7 alive for years (great phone) and only swapped when the battery swelled. The 10 was no better and potentially worse, I replaced the battery on the 7 myself and lamented it's loss to my son (he gets my cast offs). Such a good line of phones that's clearly peaked.
Writing this from my 7... hoping to get another one or two years out of it.
-
Simple solution: wait until they announce support before buying a new phone. Short of your current one breaking or no longer updating, you don't need a new phone right now, you can wait.
If you do need one right now because of one of those reasons, sucks, but just buy the most recent one that is currently supported (the 10) or buy one that will EOL sooner than you'd like (maybe an 8 or 9, used/cheap) while you wait for the new one (the 11).
Hopefully the resale price on the 11 tanks (it won't) then.
-
So no reason to buy a Pixel at all any more? Midrange performance, poor battery life, middling cameras, AI bloated software, all at flagship prices. Its one saving grace was Graphene support and that's now gone too.
Just in time to move on to Motorola...
Graphene choosing to die on the hardware MTE hill has always seemed weird to me. It's one feature but it excludes 99% of the phones except the Pixel. GrapheneOS has so much to offer besides it, and nowadays they could use Rust as a workaround anyway.
-
My understanding is that while the older Pixel phones had MTE capability, it was off by default and could only be enabled under the dev settings. Google did not enable it by default because Android depends heavily on vendor board support packages, proprietary SOC drivers, and HAL modules. Google felt that driver code quality from 3rd-parties is not clean enough to enable kernel-level MTE without risking bootloops and spontaneous reboots. Even worse for C++ apps, which often read slightly past their allocated memory blocks.
Instead, Google rewrote critical core Android system daemons using Rust. Like the keystore, Bluetooth stack, DNS resolver, and others. I believe using Rust essentially makes MTE unnecessary.
Also full synchronous MTE mode has high CPU/memory bus penalties (could be 5-10% under heavy memory loads).
Google probably decided that since hardly anyone used MTE anyway on earlier Pixel devices, they could use the space in the chip for other uses.
The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.
It's not an on/off kind of thing, MTE is a set of ARM extensions. Either the api to use them is clearly documented or, as in the pixel 11's case, Google started to not document their implementation.
We know this matches their plan to obscure the AOSP code to eventually lock out anyone else from using their base.
GOS is not in a position to reverse-engineer api calls on what was formally documented hardware.
Instead, Google rewrote critical core Android system daemons using Rust. Like the keystore, Bluetooth stack, DNS resolver, and others. I believe using Rust essentially makes MTE unnecessary.
No. Rust being "memory safe" doesn't mean rust apps can't abuse speculation or buffer under/overruns.
The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.
Read the BlueSky posts, Google didn't force app devs to opt into MTE, so no one did.
Google probably decided that since hardly anyone used MTE anyway on earlier Pixel devices, they could use the space in the chip for other uses.
"Space in the chips"? Again, see the Bluesky posts.
Google is very clearly shifting over to a completely walled garden, because, same as Apple, it isn't about the hardware performance and capabilities, it's about control.
-
I was so disappointed with my pixel 10. It's kept a pixel 7 alive for years (great phone) and only swapped when the battery swelled. The 10 was no better and potentially worse, I replaced the battery on the 7 myself and lamented it's loss to my son (he gets my cast offs). Such a good line of phones that's clearly peaked.
I upgraded my pixel 6 to a 9 and this phone is much worse in most ways. I fail to understand how one of the richest companies in the world puts out worse products over time and thinks it's alright
-
It's not an on/off kind of thing, MTE is a set of ARM extensions. Either the api to use them is clearly documented or, as in the pixel 11's case, Google started to not document their implementation.
We know this matches their plan to obscure the AOSP code to eventually lock out anyone else from using their base.
GOS is not in a position to reverse-engineer api calls on what was formally documented hardware.
Instead, Google rewrote critical core Android system daemons using Rust. Like the keystore, Bluetooth stack, DNS resolver, and others. I believe using Rust essentially makes MTE unnecessary.
No. Rust being "memory safe" doesn't mean rust apps can't abuse speculation or buffer under/overruns.
The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.
Read the BlueSky posts, Google didn't force app devs to opt into MTE, so no one did.
Google probably decided that since hardly anyone used MTE anyway on earlier Pixel devices, they could use the space in the chip for other uses.
"Space in the chips"? Again, see the Bluesky posts.
Google is very clearly shifting over to a completely walled garden, because, same as Apple, it isn't about the hardware performance and capabilities, it's about control.
It's an on/off kind of thing: https://outflux.net/blog/archives/2023/10/26/enable-mte-on-pixel-8/
https://developer.android.com/ndk/guides/arm-mte -
Well, we had a good run. It was nice while it lasted...
Probably for the best. As they said, it frees them up to focus on Motorola devices, a company that's actively working with them.
-
So no reason to buy a Pixel at all any more? Midrange performance, poor battery life, middling cameras, AI bloated software, all at flagship prices. Its one saving grace was Graphene support and that's now gone too.
Just in time to move on to Motorola...
I originally bought Pixels because they were the opposite of what they are now. Bloat-free devices (other than Google apps) that just provided the tools I needed to do things, while having excellent hardware security. Now it's basically GeminiOS, and they're solving the problem they created by throwing out security.
Every Pixel event for the past several years has been almost entirely about Gemini. A software feature. Which just goes to show that they have no hardware features.
-
My understanding is that while the older Pixel phones had MTE capability, it was off by default and could only be enabled under the dev settings. Google did not enable it by default because Android depends heavily on vendor board support packages, proprietary SOC drivers, and HAL modules. Google felt that driver code quality from 3rd-parties is not clean enough to enable kernel-level MTE without risking bootloops and spontaneous reboots. Even worse for C++ apps, which often read slightly past their allocated memory blocks.
Instead, Google rewrote critical core Android system daemons using Rust. Like the keystore, Bluetooth stack, DNS resolver, and others. I believe using Rust essentially makes MTE unnecessary.
Also full synchronous MTE mode has high CPU/memory bus penalties (could be 5-10% under heavy memory loads).
Google probably decided that since hardly anyone used MTE anyway on earlier Pixel devices, they could use the space in the chip for other uses.
The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.
I think you misunderstand what is being said.
The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.
That's not what they're saying. They're saying Graphene without MTE is less secure, which isn't something they want.
Which you can read from their post here
We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.
-
Graphene choosing to die on the hardware MTE hill has always seemed weird to me. It's one feature but it excludes 99% of the phones except the Pixel. GrapheneOS has so much to offer besides it, and nowadays they could use Rust as a workaround anyway.
Apparently the Linux kernel can emulate MTE in software:
https://lwn.net/Articles/833353/
The software MTE support in the kernel apparently predates the hardware support of the same, based on the above link.
Admittedly I might be misunderstanding something here, my confidence level is only 65%.
-
R relay@relay.fedi.agency shared this topic
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login