logoalt Hacker News

grapheneosyesterday at 5:01 PM4 repliesview on HN

Google likely cut MTE to reduce the die space required by CPU cache. It saves them money on a feature they never deployed by default and only used for a few processes as part of Android Advanced Protection Mode (AAPM) without enabling it in the Linux kernel. Their security team should have gotten it deployed by default for a large portion of the OS by now and then it would have been much harder to justify removing it. The small performance impact of asymmetric mode is irrelevant for the vast majority of the OS and it can also be used in the near zero cost asynchronous mode. We use synchronous in the kernel for security reasons but they didn't have to do that.

It's a completely different story for GrapheneOS where it means losing one of the main kernel and userspace security protections. This is one of the only ways we can significantly harden the Linux kernel with existing security features. The Linux kernel has always been a huge security liability for Android and AI models are making that much more obvious to everyone.

Google will likely end up heavily using MTE in the future. Pixel 11 devices won't be able to benefit from it. They're at the start of 7 years of updates but they won't be getting the benefit of future updates enabling MTE. Pixel 8 and later will benefit from Google likely expanding use of MTE for AAPM and eventually beginning to use it by default. It's unlikely Google will stop working on expanding MTE due to the Pixel 11 hardware decision. Multiple other OEMs are interested in MTE for devices made for businesses and governments even if Google decided it wasn't worth the cost for Pixels.


Replies

ChocolateGodyesterday at 9:41 PM

Ironically the recent CVE that's being used to root Android phones (Ghostlock) running GKI images is mitigated by MTE.

skirmishtoday at 12:23 AM

The supposed "security team" is busy fighting Google engineers connecting to internal systems to do their work. E.g. somebody figured how to control the coding AI agent from their phone -- red alert, ban all access from phones to AI for everybody (even with corporate accounts).

show 1 reply
kuschkutoday at 12:05 AM

If there will be a GrapheneOS image for the Pixel 11 without MTE, could that open the door for GrapheneOS on a lot more phones that support AOSP?

show 1 reply
prism56yesterday at 5:34 PM

Weird omission then... Seems asinine...