3 ms·

> as far as I can tell GrapheneOS doesn't have the patch, yet. That's not correct. Android 13 QPR2 Beta 1 came out on December 12th. This included backports of

by strcat 4y ago

> as far as I can tell GrapheneOS doesn't have the patch, yet. That's not correct. Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. > the most recent mention on their releases page is for the 2022120300 release: That's not the most recent mention on our releases page. This is the most recent relevant change: > full 2023-01-05 security patch level Here is a previous Mali GPU driver update: > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to QPR2 Beta 2 release Here is another previous Mali GPU driver update: > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to r38p1 along with other changes included in the QPR2 Beta 1 including a bunch of security fixes previously neglected upstream (GrapheneOS will continue applying further updates downstream) Looking at the version number is not enough. ARM makes separate security patches available to their partners. Google is primarily shipping the backported security patches and gradually upgrades the driver version. The reason for this is that there are massive changes to the Mali GPU kernel driver for the Tensor SoC GPU. This is why GrapheneOS can't simply update it to r41p0 immediately because there are a massive number of complex synchronization, GPU command quality of service and other changes conflicting with newer releases. It makes the most sense to apply the standalone security patches. Unfortunately, ARM doesn't publish the standalone security patches for the public and we need to obtain them from a vendor choosing to include and ship them since they have to publish the code.

ylk 4y ago
Thanks for clarifying. My confusion stemmed from the fact that the bug is supposed to affect pixel 6 devices, which aren’t listed in the QPR2 updates but were explicitly mentioned in the update to r37p0.
- strcat 4y ago
  We were unable to update the Pixel 6 devices to r38p1 due to more changes being required beyond the kernel driver update. The security patches were shipped regardless, and that also happened upstream for AOSP and the stock Pixel OS for the January update. All of the security fixes first shipped with QPR2 Beta 1 on December 12 which we shipped on December 14th were then shipped in the AOSP / stock Pixel OS January stable release despite it still using r36p0. The security patches are available without updating the major release, at least if you're either an ARM partner or an ARM partner has published an update with the patches and therefore released them. In our case, we can't get the standalone security patches directly from ARM but we can ship the kernel backports as soon as they're in an Android quarterly or major release beta. We can't necessarily ship the major releases of the driver just because they're in a quarterly or major release since they can depend on other changes which is what happened with the Pixel 6. It crashes without updating the userspace driver, not just the kernel driver, and updating the userspace driver seems to require other changes. It's not blocking any security patches though.

by strcat 4y ago

ylk 4y ago

Thanks for clarifying. My confusion stemmed from the fact that the bug is supposed to affect pixel 6 devices, which aren’t listed in the QPR2 updates but were explicitly mentioned in the update to r37p0.

strcat 4y ago
We were unable to update the Pixel 6 devices to r38p1 due to more changes being required beyond the kernel driver update. The security patches were shipped regardless, and that also happened upstream for AOSP and the stock Pixel OS for the January update. All of the security fixes first shipped with QPR2 Beta 1 on December 12 which we shipped on December 14th were then shipped in the AOSP / stock Pixel OS January stable release despite it still using r36p0. The security patches are available without updating the major release, at least if you're either an ARM partner or an ARM partner has published an update with the patches and therefore released them. In our case, we can't get the standalone security patches directly from ARM but we can ship the kernel backports as soon as they're in an Android quarterly or major release beta. We can't necessarily ship the major releases of the driver just because they're in a quarterly or major release since they can depend on other changes which is what happened with the Pixel 6. It crashes without updating the userspace driver, not just the kernel driver, and updating the userspace driver seems to require other changes. It's not blocking any security patches though.