GrapheneOS Update: Pixel 11 Drops Hardware Memory Tagging (MTE)

The GrapheneOS team recently shared a critical update via their official Bluesky account regarding the compatibility of their privacy-focused operating system with the latest Google hardware.

The Porting Attempt

After dedicating a full week of development effort, the team managed to achieve a partial port of GrapheneOS to the Pixel 11 series. However, the project has hit a definitive wall.

"We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware."

Project Status Tracker

Initial research
Partial port implementation
~~Full OS stability~~ $\rightarrow$ Blocked
Final release

The Technical Breakdown

The primary obstacle is the absence of MTE (Memory Tagging Extension). This ARM feature is vital for detecting and preventing memory corruption bugs.

Comparison of Security Expectations:

Feature	Expected in Pixel 11	Actual Status
ARM Architecture	Yes	Yes
Hardware MTE	Yes	No
Firmware Support	Yes	No

The Logic of the Failure

The following diagram illustrates the decision path taken by the GrapheneOS developers:

Security Implications

The removal of MTE increases the attack surface for memory-safety vulnerabilities. In conceptual terms, the security strength ( $S$ ) can be viewed as a function of available hardware mitigations ( $m$ ):

$S \approx \sum_{i=1}^{n} m_i$

When $m_{MTE} = 0$ , the overall security posture is significantly diminished.

Final Verdict

GrapheneOS suggests that this omission was not an accident but a financial decision. It appears that Google opted to ~~prioritize security~~ save money by stripping out this essential hardware feature.

Technical Log Snippet

# Attempting to initialize MTE...
# Error: MTE_NOT_SUPPORTED
# Checking firmware version...
# Result: MTE_DISABLED_IN_FIRMWARE
# Status: FATAL_HARDWARE_MISSING