First mATX Intel Desktop added to Heads firmware

Hi folks,
I have completed my port of the mATX Asus P8Z77-M Pro board to Heads firmware. I believe this is the first Intel based Desktop board with PCI-e made available as part of Heads (the other non laptops are AMD based, servers, PowerPC or not full sized eg Librem Mini)

This now offers a cost effective ‘self build’ desktop solution using attesting heads firmware, as of this commit
https://github.com/osresearch/heads/commit/e32fc91baf2e707f0ef24fed2812786a7dcdb79f

This firmware is what Nitropads, Chromebooks and Librem machines use.

The P8Z77-M Pro offers several SATA connectors (2x 6Gb, 4x 3Gb, 2x eSATA) as well as 3 full size PCI-e expansion ports. The board has a PS/2 keyboard port, as recommended for QubesOS. The board has a socketed DIP-8 ROM which allows for flashing without using SOIC clips or complex disassembly processes.

The i7-3770 is the best CPU available for the board, with VT-x & VT-d both present as recommended by QubesOS, and you can use up to 32 Gb of RAM (be careful not to use CPU variants which do not have VT-d, such as i7-3770k).

You must use a TPM v1 with this board as the ROM chip is not large enough to support the requirements for heads on a TPM v2 (just like most Lenovo systems supported by the project). If you really want to use a TPM2 there is a solution but it requires upgrading the ROM chip to W25Q128, which I an DM a procedure for if you want to try it)

You can find documentation on the board here https://osresearch.net/p8z77-m_pro-building/

This board is available in TOTP and HOTP+TOTP heads variants. Ive added a script to automatically grab the vendors ROM, extract the IFD and then apply me_cleaner to the intel ME firmware, shrink the ME region to 98k and enables HAP/AltME bit disable. With this board I also introduced to heads the option to remove the VSCC table. Intel internal documentation implies removing the VSCC table impacts the ME engines ability to write from it to the rom chips (please read the linked discussion for more info here, but basically the documentation implies this will happen, but we have no way to prove it - much like most else to do with intel ME).

I have prepared a video howto guide which I am editing, it should be ready in the coming weeks. I will be submitting a HCL later today.

Thanks to @Insurgo and rbrselow for the help in aligning the port to heads conventions and providing the reviews.

Test Platform
BOARD: Asus P8Z77-M Pro
RAM: 32Gb - 4x TimeTec DDRL3 75TT16NUL2R8-8G
CPU: Intel i7-3770
TPM: Modules tested: Asus branded TPM 1.02H & Foxconn TPM Krypton Rev 1.0

While I am a QubesOS team member, this post is my personal thoughts and does not represent and official endorsement of this platform by the QubesOS project.

8 Likes

Exciting! Fantastic work.

Do you think a desktop PC might create the opportunity to create even stronger tamper-evident mechanisms? I know Mullvad has a guide on how to use glitter & nail polish, but in a compliment to HEADS model of physical security, does this open up an even more robust avenue for custom PC tower that has strong tamper-evident qualities?

1 Like

Thanks :wink: Theres more to come yet!

I use tamper evident systems on mine, keep an eye out for links to my upcoming guide.wont be long, i got a sec conference to present at this weekend which is taking priority, so ill try to finish the guides during the evenings next week

2 Likes

Good job!

Would it be possible to port heads to the Z690?

2 Likes

You must be psychic :wink:

Its a WiP and it only boots to console for now, there is a whole heap of validation and other stuff to do yet. Graphics being a big one. And there is the whole question around just using ME in HAP disabled mode. And Ive got to figure out how to get a dTPM working, then get that added to coreboot. its a bunch of work that will get chipped away at.

2 Likes

That’s great news, being able to use heads would be a big improvement to the Z690

2 Likes

Excellent work!

Off-topic, personal reflection

For the last three years I had the illusion I could get away with a desktop, but those times are over now. In my youth I once traveled with a desktop tower … lol

Any news on the Thinkpad W530?

1 Like

2 posts were split to a new topic: Desktop computers

I forgot all about that all my thinkpads have been gathering dust. I did try the 530 before i came to the airport with latest version of the build, and even doing the nvram edit for dual graphics I still couldnt get the external display working at boot

but… it has been pretty stable across the board for heads + swraid + qubes. before i put it to one side and got on with desktops again…

1 Like

I know it’s been awhile since anyone commented on this thread, but I plan on reproducing the ASUS P8Z77-M Pro build (more of a project than anything just to learn). I can’t find any of these motherboards being sold from anywhere that looks reputable enough to check my ‘supply chain validation’ box . I’m seeing nothing that’s manufacturer refurbished… Anyone got a reputable place to purchase these from?

thanks in advance