Conversation

twitter.com/DanielMicay/st One of the issues appears to be a messed up merge involving the kernel's arm64 SSBS feature (developer.arm.com/docs/ddi0595/h) while upstream (unsure who exactly) was doing backporting. Other problem is a similar issue causing a conflict between SCS and KPTI.

Quote Tweet

Daniel Micay

@DanielMicay

Sep 10, 2020

Might have fixes for the side channel mitigations implemented. Going to get the release done for the Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL before looking into this further. These kernels will be identical for the branch based on Android 10 anyway.

Show this thread

Daniel Micay

@DanielMicay

SCS: Shadow Call Stack (backwards edge portion of Android's kernel CFI) KPTI: Kernel page-table isolation, not strictly required on this hardware (not enabled upstream) but still an important side channel mitigation particularly against unknown attacks

3:54 PM · Sep 10, 2020Twitter Web App

Replying to

The version of SCS submitted upstream got backported as a replacement for the original version used in Android, and a function seems to have been left out which caused a build failure when KPTI is also enabled at the same time. Still need to look into both of these issues more...

Daniel Micay

@DanielMicay

Sep 10, 2020

This is why the release is currently delayed. Upstream does not enable these features at the moment, and so they ended up breaking. They really should be enabling both and one of the other GrapheneOS developers will be filing issues upstream about this to try to get that done.