Pixel 11 does not but meet the GrapheneOS safety requirements and could also be skipped
We have a partial port of GrapheneOS to the Pixel 11 sequence after per week of labor on it. We’re unable to finish the port as a consequence of lack of assist for ARM {hardware} reminiscence tagging in software program, firmware and close to actually {hardware}. It seems Google lower an necessary safety characteristic to economize.
ARM {hardware} reminiscence tagging (MTE) is utilized by GrapheneOS throughout the whole base OS together with the kernel and each normal base OS course of. It’s solely quickly disabled for just a few device-specific processes. It significantly improves safety towards practically all distant exploits and lots of native exploits.
Pixel 8 launched with {hardware} MTE assist in October 2023. We built-in it into our hardened_malloc venture and commenced utilizing it throughout the OS later that month. Android and the Pixel OS by no means began utilizing it by default. Android Advanced Protection Mode in Android 16 permits it for just a few processes.
Apple’s Memory Integrity Enforcement (MIE) is an at all times enabled characteristic on the iPhone 17. It’s merely a top quality implementation of MTE utilizing the most recent normal extensions. It makes use of MTE in essentially the most safe mode within the kernel and a big portion of userbase. They did an excellent job integrating it.
Apple’s MIE and Android 16+ AAPM do not use MTE for person put in apps except these explicitly choose in. GrapheneOS permits it for extra apps robotically and has a toggle for customers to opt-in for each person put in app. There’s a per-app toggle to opt-out for incompatible apps which is unusual.
Neither iOS or Android encourage app builders to choose into MTE and different extra aggressive security measures used within the base OS. Apple’s docs warn builders of efficiency and stability points. Our strategy permits forcing utilizing MTE in the usual allocators regardless.
Pixel 11 does have safety enhancements together with transferring to post-quantum safe verified boot (ML-DSA) and changing Samsung Shannon IMS with AOSP IMS. Titan M3 ought to considerably enhance safety towards information extraction in Before First Unlock state. It’s too unhealthy they ruined it by chopping MTE.
Pixel 11 sequence is much more costly for an incremental enchancment to the CPU, the identical underpowered GPU and diminished RAM for the Pro base fashions. They lastly caught as much as the final era of Qualcomm mobile radio. It’s overpriced, the upgrades aren’t spectacular and shedding MTE is appalling.
Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has 40% greater single threaded CPU efficiency, 80% greater multi threaded efficiency, over 100% greater GPU efficiency and a much better mobile radio. It additionally lastly has MTE. The subsequent gen is what shall be within the first Motorola with GrapheneOS.
Pixel 9a and earlier (together with Nexus units) had been the Android Open Source Project reference units. Pixel assist was faraway from AOSP with Android 16. It’s now tougher to assist Pixels than many different units and big progress in the direction of open supply firmware and driver libraries was discarded.
Compared to the inventory Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we depend on them for firmware and most driver updates. We additionally need to transfer to new kernel branches earlier. These issues could be improved with our Motorola partnership.
We strongly suggest towards shopping for Pixel 11 units. Pixel 8, 9 and 10 have a lot better total safety for GrapheneOS. Pixel 10 is cheaper with related {hardware} and MTE. Pixel 11’s Titan M3 ought to enhance BFU safety for customers with no robust passphrase, however shedding MTE craters AFU safety.
We have not decided what to do about this example. It could also be finest for us to skip the Pixel 11 sequence units. We can shift our focus fully to the upcoming Motorola units as an alternative. Pixel 10a was actually a ninth gen Pixel, so hopefully the Pixel 11a does the identical with tenth gen and contains MTE.
https://bsky.app/profile/grapheneos.org/post/3mua32q4ds22e
https://grapheneos.social/@GrapheneOS/117179231167297908
https://x.com/GrapheneOS/status/2093731615243411862
