diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2024-02-03 19:59:25 -0500 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2024-02-03 20:01:54 -0500 |
| commit | 83420b2b2a17113ca92d3e4dae728779572407b2 (patch) | |
| tree | dc33eeb0a8b3fd736c30288f5123c265179106a4 /static | |
| parent | d04a1d8cfa6b909701bcad65669b623d6dfb8bae (diff) | |
enable kernel BTI and use SCS in addition to PAC
Diffstat (limited to 'static')
| -rw-r--r-- | static/releases.html | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/static/releases.html b/static/releases.html index 8e53bd42..f96a93db 100644 --- a/static/releases.html +++ b/static/releases.html @@ -732,6 +732,8 @@ <li>run full explicit GC in SystemUI and system_server after locking (this is already done after unlocking to purge the lock method and derived data, but it makes sense to do it after locking too)</li> <li>kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.209</li> <li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.148</li> + <li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): enable both software Shadow Call Stack (SCS) and Pointer Authentication Code (PAC) protection for kernel return addresses instead of only using SCS when PAC is unavailable</li> + <li>kernel (Pixel 8, Pixel 8 Pro, Generic 5.15): enable Branch Target Identification (BTI) protection for the kernel in addition to Clang type-based CFI to provide coarse-grained CFI coverage for calls excluded from CFI</li> <li>kernel (Generic 6.1): apply sysrq hardening changes</li> <li>kernel (Generic 6.1): update to latest GKI LTS branch revision including update to 6.1.74</li> <li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/121.0.6167.101.2">version 121.0.6167.101.2</a></li> |