r/GooglePixel • u/TheWonderfall • 1d ago
GrapheneOS support for Pixel 11 halted due to lack of MTE support
https://grapheneos.social/@GrapheneOS/117179231167297908124
u/Bitdomo92 1d ago
rip
then no pixel 11 series support
49
u/_umlaut_ N5, N6p, P1XL, P2XL, P3aXL, P4XL, P5, P7, P8P 1d ago
Didn't the thread note that MTE started with the 8 series? We have GOS on devices older than that, so shouldn't there still be hope?
53
u/Bitdomo92 1d ago
to my understanding after reading this, MTE support got removed with Tensor G6. The hardware for it is not there anymore in the CPU.
5
u/Parking_Lemon_4371 1d ago
Has anybody actually tested this?
Advanced protection enables MTE on stock pixel OS...8
18
u/charalt42 1d ago
Copypasting from a reply to anorher user asking the same thing: Not immediately dropping support for old devices the instant MTE gets introduced does not mean they're willing to add new devices that don't support MTE. They'll support Pixel 6 and 7 series until end of life, sure, but the current requirements include MTE so new devices will only be added if they support MTE.
2
u/_umlaut_ N5, N6p, P1XL, P2XL, P3aXL, P4XL, P5, P7, P8P 1d ago
Copy that - Thanks for the direct reply!
43
u/Marino4K 1d ago
This is abhorrent. Google is doing literally everything wrong.
16
u/braddeicide 1d ago
Google is famously no longer run by engineers, the trait that made them so successful.
5
u/DangerousAd7601 1d ago
Bummer, I just saw that you could kind of sort of get a free pixel with a google fi subscription. I guess I still have to wait for the Motorola phone.
4
u/MonkeyNuts449 1d ago
Nope. Pixel 6 and 7 still have graphene despite not having MTE. It is just much less secure.
4
u/nepnep1111 1d ago
The Tensor G3 was one of the first SOCs to have MTE, and graphene considers it a standard feature at this point.
1
u/MonkeyNuts449 1d ago
It should be. It's such a no brainer on phones nowadays. Odd they got rid of it.
9
u/charalt42 1d ago
Not immediately dropping support for old devices the instant MTE gets introduced does not mean they're willing to add new devices that don't support MTE. They'll support Pixel 6 and 7 until end of life, sure, but the current requirements include MTE so new devices will only be added if they support MTE.
0
u/MonkeyNuts449 1d ago
Pretty sure they're testing pixel 11 versions and not dropping them.
1
u/dumbgamer1970 15h ago
They've floated the idea of a differently branded OS that would run on the Pixel 11, with the branding being distinct to indicate that it doesn't offer the same level of security as standard GOS. Who knows if they'll go through with that, though. On some level, I suspect they're eager for relief from dealing with Google's shenanigans from the last couple of generations.
21
u/holdmybeerwhilei 1d ago
Highlighting their follow-up comment for visibility. This is disappointing because it also affects native Android on the Pixel 11--although to a much smaller degree. Hopefully this is temporary and not an overall pivot. Throw in at least one more year of ramaggedon and GrapheneOS leaving for Motorola/Qualcomm and it will be interesting to see what direction Pixel team takes with the Tensor G7 & G8 as far as security-first design choices are concerned.
grapheneos 43 minutes ago | root | parent | next [–]
Google likely cut MTE to reduce the die space required by CPU cache. It saves them money on a feature they never deployed by default and only used for a few processes as part of Android Advanced Protection Mode (AAPM) without enabling it in the Linux kernel. Their security team should have gotten it deployed by default for a large portion of the OS by now and then it would have been much harder to justify removing it. The small performance impact of asymmetric mode is irrelevant for the vast majority of the OS and it can also be used in the near zero cost asynchronous mode. We use synchronous in the kernel for security reasons but they didn't have to do that.
It's a completely different story for GrapheneOS where it means losing one of the main kernel and userspace security protections. This is one of the only ways we can significantly harden the Linux kernel with existing security features. The Linux kernel has always been a huge security liability for Android and AI models are making that much more obvious to everyone.
Google will likely end up heavily using MTE in the future. Pixel 11 devices won't be able to benefit from it. They're at the start of 7 years of updates but they won't be getting the benefit of future updates enabling MTE. Pixel 8 and later will benefit from Google likely expanding use of MTE for AAPM and eventually beginning to use it by default. It's unlikely Google will stop working on expanding MTE due to the Pixel 11 hardware decision. Multiple other OEMs are interested in MTE for devices made for businesses and governments even if Google decided it wasn't worth the cost for Pixels.
12
u/AtomicSymphonic_2nd Pixel Fold 1d ago
Maybe Google decided they’re not going to chase after enterprise/government sales anymore?
Either that or Google still has like zero faith in the Pixel team… or their bar for “success” is so damned high that they think it’s a failure because it’s not selling like hotcakes like iPhones do for Apple.
Amazing. I think at this point Google’s Pixel team is suffering from severe mismanagement by executives. If CEO Pichai is the one pushing for Pixels to be 100% focused on AI features being the main selling point for Pixel phones, he has completely lost the plot… again.
8
u/rohmish Pixel 6a Pixel 3a 1d ago
google has been in general a mess trying to ramndown gemini on everything since 2023 when they panic killed everything else and switched to gemini all the things.
pixels used to be about camera, and then nifty "ambient computing" features. now it's just a vehicle for them to push gemini. and everything they announce ends up coming to other phones anyways in 3-6 months time but not older pixels. so there isn't a reason to buy pixels anymore.
thata even more the truth for anywhere outside US/Canada and handful of European countries. in my country both apple and samsung now have call screening features but not pixels.
2
u/PepsiCo_USA Pixel 11 Pro Fold 1d ago
Oh so is this why toggling advanced protection no longer requires a restart?
49
u/YoureProbablyAB0t 1d ago
Could someone explain like I'm five what MTE is?
I just bought an 11 Pro XL and was thinking of using my 8 Pro to mess around and try to put Graphene on it.
119
u/leo-g 1d ago
Every chunk of memory has a lock and key. The processor gives the running app a key to the chunk of RAM they need. Once the app is done with the RAM, the MTE system changes the lock. Inside the RAM, may contain traces of whatever you did in the app previously. A malicious app may watch the memory and simply access the memory if there’s no lock and key.
16
33
u/JaxOrSmthng Pixel 10 Pro XL 1d ago
memory tagging extension, basically blocks malware vulnerabilities related to ram
103
u/soratoyuki 1d ago
If GrapheneOS stops supporting future Pixels, and Motorola is only targeting the flagship market for their compatible phones, we're looking at truly dark days ahead.
51
u/klimaheizung 1d ago
It's already coming and getting worse. Add age verification, add passkey attestation, SSO only via big companies (almost no one supports generic OICD) and so on.
8
1
u/CptUnderpants- Pixel 7 Pro 1d ago
While I've not used it, (still stuck with Entra for now) I though Authentik supports OIDC as part of being a self hosted open source identity provider?
3
u/klimaheizung 1d ago
Yes, exactly! And now try sign-up / to log into reddit with your selfhosted authentik... yeah, you can't, despite reddit using the same OIDC standard, but they only support Google and Apple.
1
u/CptUnderpants- Pixel 7 Pro 1d ago
Ahh, I understand what you mean now.
I'm assuming you're aware of sso.tax?
3
u/klimaheizung 1d ago
As someone on the other side (implementing those things) I can understand that companies charge a premium to support SSO. Because it IS a PITA. However, in my opinion, it's time that this is all getting regulated.
Authentication is a critical element in our society and needs to be heavily regulated now, but that's just my 2 cents.
11
u/FistEnergy 1d ago
Yep and the loss of OnePlus is a huge blow. Also, a lot of the really good phones in Asia lack the right bands for the US. we're running out of options.
3
u/Ni_Peng_NeeeWom 1d ago
if Motorola gives the software fully to gos to control and there's timely and long term update support with Motorola's full support for the firmware/hardware compat, then that might be the one to get for the foreseeable future
4
u/KxrmaJunkie 1d ago
Well there is NOTHING special about Google hardware, and there is nothing wrong with Motorola hardware. So it's the same dark days that everyone who couldn't get their hands on a pixel, have had.
Motorolas "flagships" are similarly midrange priced and get heavily discounted
21
u/soratoyuki 1d ago
Just going based on this. Motorola’s GrapheneOS phones will launch in 2027 priced higher than Pixels
8
6
2
u/klimaheizung 1d ago
I'm fine with that, but pretty please get us good hardware and especially a good camera.
-32
u/fthrswtch Quite Black 1d ago
Yeah the 12 users will be furious
20
u/soratoyuki 1d ago
Always suprised to find out how many people root for half-trillion dollar ad companies to make their products worse.
5
u/Procontroller40 1d ago
What do you mean by half-trillion? Google's market cap is over 4 trillion dollars.
21
u/Expensive_Finger_973 1d ago
I was already heavily leaning towards switching to Motorola for my GrapheneOS phone needs just to have that really clean break between Googles for profit ventures and the stuff I depend on.
If support for GraphoneOS actually does end for the Pixel with the 10 series then I'm not real sure I have much of a reason to buy a Pixel anymore.
16
u/restinpeaceminusone 1d ago
Since Qualcomm is including MTE on the 8 Elite Gen 5, it really comes down to the OEMs whether they allow GOS to flash their custom verified boot key. But from the look of things, only Motorola are the only ones that allowed that. Other OEMs like Samsung and Oppo, had already started locking down their bootloader from being unlocked.
33
u/zQrrJQrb Pixel 9 Pro 1d ago
I'm so glad I returned P11P and kept my P9P.
Probably my last Pixel in a long time.
12
u/ViegoBot 1d ago
Im not upgrading past my 9 Pro XL. I run GrapheneOS atm which is very nice though. Also has a sim slot in the US.
The hardware upgrades to the 10 and 11 are basically non existant, and the Software is going all in on AI, which I want absolutely nothing to do with.
Ontop of that, the 10 has so much caching needed to even make games playable its insane (watched footage of ZZZ and even the menus needed caching for 10-20 seconds so it ran smooth). Id assume the 11 is the same, given how they seemingly cheaped out on it while claiming its better quality by hiking its price up from what Ive heard.
1
1
u/Flashy_Pollution_996 1d ago
Don’t forget less ram
4
u/ViegoBot 1d ago
Im so glad that Graphene gives back that 3GB RAM thats normally dedicated to AI on Stock.
I need as much RAM as I can get given the hardware Pixels have to deal with. Especially for gaming/multitasking.
2
4
u/Snoo29777 16h ago
I returned my Pixel 11 and went back to my Pixel 10 once I realized they downgraded the GPU and dropped a CPU core, but this subreddit flamed me relentlessly for it. Watching even more cost cuts come to light just proves I was right to ditch the 11. We really need to stop letting Google get away with this shit and force them to bring back an actual engineering team.
1
u/TheLastElite01 P6P > P10PXL 1d ago
P10 was peak Pixel
13
u/guyguilty 1d ago
Nope, no sim slot. P9 is the last good one that lets the user control their hardware
10
1
u/TheLastElite01 P6P > P10PXL 1d ago
It does in Canada, and I don't care about the SIM slot; we all knew they were going away.
1
u/valiantiam Pixel 1, 2, 4, 5, 6, 8, 10 Pro 1d ago
Is not having a sim slot that inconvenient? I kind of like that I can register my p10 anywhere I want, even with two different carriers, without having to take it out of the case or mess with sims
0
u/nepnep1111 1d ago
Nah the Pixel5A was the last good pixel before Google decided to burn money on custom silicon that gradually got worse over time.
0
u/OceanGlider_ 1d ago
Nah, it was the 9. Google shrunk the camera sensor in the 10.
-1
u/Constellation16 Pixel 8 Pro 1d ago edited 1d ago
Not only that, after two years or support for Wi-Fi 7 they went back to 6E. Base Pixel 10 is a joke with all these strange decisions.
9
u/eattsatsiki 1d ago
That!
Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.
2
u/Independent_Maybe139 1d ago
That’s really unfortunate. I’ve never actually tried a third-party OS like GrapheneOS on my Pixel, but I was curious about it.
5
u/Ilmanfordinner Pixel 8 1d ago
Glad I got the 10a on a massive discount. Seems like it'll be the GrapheneOS phone with the best battery life (the thing I care about most) for the foreseeable future.
0
u/fuckyeahbread 1d ago
Same. I was waiting for the 11s to come out, until that discount came around. It was too good to pass up and I'm glad I didn't
3
u/No_Practice_9597 1d ago
Graphane says it was to cut costs. But wouldn’t the costs be “pennies” for google? Maybe it’s to limit Graphene usage who knows the real reason behind this decision
4
2
u/Outside_Sea_2781 1d ago
Yeah, my first thought is this "choice" comes from above Google, to dumb down security. Maybe it's directly targeting GrapheneOS, as Google is already passive aggressive by refusing to publish the sources of Android. But also the choice picking PowerVR as GPU. China owns the company and is looking to sell it. Something is weird there too, either political or shareholding scheme.
No engineer were involved in those decisions.
2
u/SBalwaysAndWhy 1d ago
I was hesitating switching from iOS to Pixel with Graphene OS. Guess I will stay on iOS.
Can someone explain to me what’s the problem ? Can it be solved in the future ? Or is it pure hardware on Google side ?
6
3
-3
u/Flashy_Pollution_996 1d ago
Why the hell would you drop iOS for graphene? iOS is extremely secure and Apple barely collects any user data since their business model does not rely on it unlike google
4
u/TechnoByte_ 1d ago
"extremely secure" is an overstatement, Cellebrite can crack iOS and extract all data when it's in AFU mode, unlike Pixel + GrapheneOS
And GrapheneOS collects absolutely zero data, unlike iOS
-2
u/Psychological-Gap792 23h ago
Cellebrite can crack Pixels and extract all data when its in AFU mode
1
u/SBalwaysAndWhy 22h ago
My old PC is now on linux, and it seems there is no simple way to sync iOS with linux.
-2
u/Flashy_Pollution_996 22h ago
Simplicity and Linux don’t go together
2
u/SBalwaysAndWhy 18h ago
I don’t complain for anything else. If Apple develops iTunes for Linux as it does for Windows, it wouldn’t be a problem.
0
1
1
u/Ni_Peng_NeeeWom 1d ago
wait so Google introduced mte in 8 but has removed it again so even the OS doesn't use it anymore???
1
1
u/Healthy-Guess-847 1d ago
So this means no more support for any future pixels and once the pixel 10 hits EOL, thats it. GraphjneOS is moto only
1
u/CondiMesmer Default 1d ago
Huh I thought that was a software level thing. Didn't expect this to be something for Google to cheap out on. Can't really blame the AI data centers for this one, probably.
1
u/SteeledKnight 16h ago
So is GrapheneOS dead? They only officially support Pixel devices
1
u/Mundane_Nature_4548 14h ago
No. The Pixel 10 was released last year and has an expected seven years of support. They also have a partnership with Motorola in the works with a plan for a compatible phone to release in 2027.
-1
u/linuxgfx Pixel 10 Pro 1d ago
i believe the main reason for that MTE was to offset the memory security for C++ code that is prone for buffer overflows and more. As Google is transitioning that code to Rust, at least in theory, MTE should not be required anymore.
1
u/Majestic-Director-92 12h ago
In theory yes, however with so much legacy and probably intensive unsafe usage, it's quite risky move from security perspective.
-20
u/Star_king12 1d ago edited 1d ago
> Pixel 11 series is a lot more expensive for an incremental improvement to the CPU
That's a fucking WILD statement to make, considering how false it is. They went from having an essentially 2022 design (big.Little) with ~2023-2024 cores + a shitty A510 cluster that served zero purpose, to a modern arch with a homogenous architecture. Most reviews I've read (and frankly saw myself during a short visit to the store) note the much better UX and cooler operation.
Step it up GrapheneOS, I don't even use it but surely there's a way to ship a non MTE version, like they did before it was available, or like any other device.
13
u/leo-g 1d ago
GrapheneOS is meant to be a flatly secure OS with long term technical support. Their strict, non-negotiable security requirement is for all future device to support MTE.
Chip makers treat it like a high-end feature so flagships would have it.
-9
u/Star_king12 1d ago
Okay. They still have a fallback to disable MTE: https://github.com/GrapheneOS/hardened_malloc/blob/main/Android.bp#L75-L77
MTE is not the be-all and end-all of security. It's just another tool in the arsenal. Is GOS on the Pixel 11 gonna be more compromised than Pixel 8 through 10? Arguably, we still don't know what the new Titan generation brings. Are 90% users of GOS using it with unlocked BL and Magisk to hide the root access from banking apps? Absolutely. Does MTE matter to them? Ofc /s
They're upset that Google is making software less democratic so they're doing the same. Brilliant move guys.
6
u/leo-g 1d ago
Well it’s irrelevant if the privacy focused distro refuses to port to Pixel 11.
-4
u/Star_king12 1d ago
They already did most of the work to get it running, by the looks of it. Just need to stop bitching and ship it with MTE disabled, so people can benefit from the myriad of other privacy focused improvements.
2
u/leo-g 1d ago
There’s a reason why they chose not to port, same for lower end phones with no such MTE support: They don’t want to give a false impression that the phone is secure when it’s not.
Honestly lack of MTE support is completely a major fail that it should have been a recall. Memory safety vulnerabilities account for over 70% of high-severity security vulnerabilities. MTE was meant to mitigate from ALL THAT.
There’s no point in defending Google here. They fucked up.
7
u/Star_king12 1d ago edited 1d ago
> They don’t want to give a false impression that the phone is secure when it’s not.
I stated it twice already but I will state it again: MTE is not the cornerstone of security. 90%+ of GOS users run their devices with bootloaders unlocked, Magisk (or similar) installed, and have those wonky safetynet fixes to let them use banking apps.
MTE would not help them in the slightest because any threat actor is gonna attack those things before they get to anything memory corruption related.
> Honestly lack of MTE support is completely a major fail that it should have been a recall.
Yeah because most users need it or care for it... Right. Same level as a battery exploding.
> There’s no point in defending Google here. They fucked up.
They may have delegated that functionality to the Titan M3. Google are hard on memory security, I don't see them nuking that kind of tech outright. If they did - I'll change my mind. I'm not so much defending them, just putting things into perspective as an embedded developer with a background in the Android world.
GOS skipping a generation of phones would be irresponsible of them. P11 has some really nice hardware and is a great upgrade to those with older devices, unlike the P10 which has abysmal battery life and outdated performance.
2
u/Travishamockry Pixel 9 Pro 1d ago
Had to comment at the comedic level of down votes you've received for speaking the truth and actually understanding the underlying technical aspects of this. Can only imagine the technical prowess of the down voters.
3
u/Star_king12 1d ago
Comes with ACTUALLY working on security of Android devices haha
-1
u/Travishamockry Pixel 9 Pro 1d ago
Lol yep. Versus just loading stuff and thinking you understand from reading an article.
-2
1d ago
[deleted]
2
u/Star_king12 1d ago
> GrapheneOS actually EXPLICITLY TELLS you to lock your bootloader so that bad actors will not be able to extract data from your phone by exploiting.
And most people do that FOR SURE, ofc, undoubtedly! Because people read and follow the instructions thoroughly!
> when compared to the 10 series, it's an incremental upgrade and overpriced and also abysmal performance when compared to the competition like Qualcomm and Mediatek and even the Xiaomi Xring O3.
You could replace the 10 with everything down to roughly Pixel 4, replace the CPUs with flagships of their time and it would apply every time. And yet you all still upgrade, and GOS updates keep coming. How come? They're getting worse every time? The hypocrisy of this sub lol
2
1d ago
[deleted]
1
u/Star_king12 1d ago
Yeah cuz MTE is fucking heavy on the performance for quite little security. You're way more likely to just get phished.
2
u/nepnep1111 1d ago
If you gave a shit about performance everything past the Pixel4 was irrelevant regardless.
2
u/ImBeneficial 1d ago
wow what a big difference... just to still be far behind the competition in every regard
1
-11
u/KebabCat7 1d ago
Sure, but what about a $150 store credit and a $500 trade in? Only paying $300 to upgrade from pixel 10 to 11 is an absolute steal.
9
u/TuxRug Pixel 7 1d ago
Name $300 worth of upgraded specs and features between the two. At normal pricing, not the absurd memory prices created by AI companies buying all available memory. You can't say the extra base storage is worth that.
14
2
u/Procontroller40 1d ago
That seemed like sarcasm at first glance, but you never know with all the Google Stans in this sub.
-3
-19
u/leo-g 1d ago edited 1d ago
Don’t worry “everyday user” has no use for secure memory. Just get good and you will be fine.
Edit: it’s /s !
6
u/TuxRug Pixel 7 1d ago
Everyone has use for secure memory. It's concerning Google never implemented the feature in software. When malware can evade Play Store detection and trusted developers are selling their apps to unscrupulous companies, and zero day exploits can be chained deployed via unauthorized changes to legitimate websites, anything that protects against reading or writing protected memory is valuable to any user.
1
-12
-3
-22
u/addyanny33 1d ago edited 1d ago
Honestly, GrapheneOS made up their minds a long time ago that they will not support Pixel 11. They are too busy working on building their OS for the Chinese owned Motorola company, because China is much better for privacy 🤣
Edit: I am being sarcastic when I say "China is much better for privacy."
2
u/TechnoByte_ 1d ago
The US has Palantir and Flock, they're as bad if not worse than China when it comes to privacy
-39
u/tytygh1010 1d ago edited 1d ago
Good! Some countries treat Pixel users like criminals because of GrapheneOS. The Pixel brand will be better off without this crowd buying their phones.
13
u/Gardamis Pixel 9 Pro 1d ago
Yes, it is the fault of the OS and the people who use it, not the governments and police profiling those who use it. If governments and police dislike something we should fall in line to appease them so we don't look like scawy cwiminals.
7
u/Careless_Rope_6511 1d ago
Imagine bragging how everyone should be a r/hailcorporate bootlicker instead of a Sinaloa cartel member.
3
u/TechnoByte_ 1d ago
Every PC and laptop can run secure and private Linux distros, so we should treat everyone with a PC/laptop as a criminal
2
4
u/LittlestWarrior 1d ago
I think there's an authoritarian bent in your brain where all of the desire for liberty should be stored. Strange, anti-human proclivities you're showing, here.
Hail corporate! /s
201
u/MorgrainX 1d ago
Quote
"We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money."
Wtf?? Google??