We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.
Graphene choosing to die on the hardware MTE hill has always seemed weird to me. It’s one feature but it excludes 99% of the phones except the Pixel. GrapheneOS has so much to offer besides it, and nowadays they could use Rust as a workaround anyway.
The software MTE support in the kernel apparently predates the hardware support of the same, based on the above link.
Admittedly I might be misunderstanding something here, my confidence level is only 65%.
p.s.: i just learned that this uses a lot of extra RAM compared to hardware MTE. there seem to be approaches to mitigate the RAM blow up, but this discussion is above my paygrade, so I have to bow out. That said, I think it is correct that the absense of hardware MTE should not be the end of the road for secure smartphone design.
Pixel has some great features and is an interesting deGoogled OS but their approach to security is just silly. It’s basically “we will not let anyone compromise on security because it could be bad PR for us”. They pretend they care about the brand but then they simply wont let majority of users use their OS. I think normal team would simply make Graphene OS available for other phones and then have some Graphene OS Extended Security version compatible only with select phones. Their purist approach only turns away potential users.
Graphene choosing to die on the hardware MTE hill has always seemed weird to me. It’s one feature but it excludes 99% of the phones except the Pixel. GrapheneOS has so much to offer besides it, and nowadays they could use Rust as a workaround anyway.
Apparently the Linux kernel can emulate MTE in software:
https://lwn.net/Articles/833353/
The software MTE support in the kernel apparently predates the hardware support of the same, based on the above link.
Admittedly I might be misunderstanding something here, my confidence level is only 65%.
p.s.: i just learned that this uses a lot of extra RAM compared to hardware MTE. there seem to be approaches to mitigate the RAM blow up, but this discussion is above my paygrade, so I have to bow out. That said, I think it is correct that the absense of hardware MTE should not be the end of the road for secure smartphone design.
Pixel has some great features and is an interesting deGoogled OS but their approach to security is just silly. It’s basically “we will not let anyone compromise on security because it could be bad PR for us”. They pretend they care about the brand but then they simply wont let majority of users use their OS. I think normal team would simply make Graphene OS available for other phones and then have some Graphene OS Extended Security version compatible only with select phones. Their purist approach only turns away potential users.