grapheneos on single-board computers

silversquirl

hi! i'm interested in trying to run graphene on a single-board computer, ideally in desktop mode (and/or TV mode if graphene supports that? i know there are some android TV builds for SBCs based on lineageos)
has anyone tried this? what boards should i be looking at? i'm struggling to find ones that support any hardware security features, let alone the comprehensive selection graphene can make use of on pixels.

i did see that the hikey and hikey 960 used to be officially supported - are those still good choices, or are there better boards out there now?

ofc, i don't expect any level of official support for this usecase, it's mostly me being curious and wanting to play around :)

Johnnyloans

silversquirl

This goal is not possible so I would look for another OS for a SBC unless your curiosity brings you to changing GOS so it would work.

Mandatory disclaimer: I know it wouldn't be gos anymore without the HW or security features.

silversquirl

Johnnyloans I know it wouldn't be gos anymore without the HW or security features.

well, yes, hence why i'm asking for recommendations of boards that do have hardware security features :)

traveller you'd better off getting a cheap second hand [...] Pixel device, IMO.

i have an old pixel i can experiment on, but i'm particularly interested in seeing how usable graphene is for non-mobile usecases, specifically big-screen and/or desktop usage.

a mini-PC or similar would work too, but it tends to be much easier to find ARM SBCs than ARM mini PCs, and afaik graphene doesn't support x86 at all? certainly i'm not aware of any x86 processors with memory tagging, and i believe the only x86 processors that support hardware attestation nowadays are high-end Xeons.

traveller

Not an expert in any way, but when I was looking for a similar thing, I discovered that most SBCs cannot run modern AOSPs because of being lazy with support of the latest device trees. At best they do support Android but with the version of few generations back: SBCs are mainly supported on Linux (and even there it often needs special kernel, etc).
Also the last time I tried (on android), desktop mode really sucked and was buggy (and was only a development test feature).
If you'd like to experiment with Graphene/aosp builds, you'd better off getting a cheap second hand (but still supported with updates) Pixel device, IMO.

de0u

silversquirl i'm asking for recommendations of boards that do have hardware security features :) [...] i'm not aware of any x86 processors with memory tagging, and i believe the only x86 processors that support hardware attestation nowadays are high-end Xeons.

If the question is: Which ARM SBCs might have "serious" hardware security features (MTE, hardware secure element, verified boot), it's possible somebody here might happen to know, but it's also possible there aren't any, or that the question might be more fruitfully posed on an ARM SBC enthusiast forum.

How about a Microsoft Surface? I think these days they all have some sort of verified boot. Maybe in a year or so they'll have the same Qualcomm SoC that the GrapheneOS projects is hoping will show up in the 2027 Motorola devices?