Hi folks,
I have completed my port of the mATX Asus P8Z77-M Pro board to Heads firmware. I believe this is the first Intel based Desktop board with PCI-e made available as part of Heads (the other non laptops are AMD based, servers, PowerPC or not full sized eg Librem Mini)
This now offers a cost effective ‘self build’ desktop solution using attesting heads firmware, as of this commit
https://github.com/osresearch/heads/commit/e32fc91baf2e707f0ef24fed2812786a7dcdb79f
This firmware is what Nitropads, Chromebooks and Librem machines use.
The P8Z77-M Pro offers several SATA connectors (2x 6Gb, 4x 3Gb, 2x eSATA) as well as 3 full size PCI-e expansion ports. The board has a PS/2 keyboard port, as recommended for QubesOS. The board has a socketed DIP-8 ROM which allows for flashing without using SOIC clips or complex disassembly processes.
The i7-3770 is the best CPU available for the board, with VT-x & VT-d both present as recommended by QubesOS, and you can use up to 32 Gb of RAM (be careful not to use CPU variants which do not have VT-d, such as i7-3770k).
You must use a TPM v1 with this board as the ROM chip is not large enough to support the requirements for heads on a TPM v2 (just like most Lenovo systems supported by the project). If you really want to use a TPM2 there is a solution but it requires upgrading the ROM chip to W25Q128, which I an DM a procedure for if you want to try it)
You can find documentation on the board here https://osresearch.net/p8z77-m_pro-building/
This board is available in TOTP and HOTP+TOTP heads variants. Ive added a script to automatically grab the vendors ROM, extract the IFD and then apply me_cleaner to the intel ME firmware, shrink the ME region to 98k and enables HAP/AltME bit disable. With this board I also introduced to heads the option to remove the VSCC table. Intel internal documentation implies removing the VSCC table impacts the ME engines ability to write from it to the rom chips (please read the linked discussion for more info here, but basically the documentation implies this will happen, but we have no way to prove it - much like most else to do with intel ME).
I have prepared a video howto guide which I am editing, it should be ready in the coming weeks. I will be submitting a HCL later today.
Thanks to @Insurgo and rbrselow for the help in aligning the port to heads conventions and providing the reviews.
Test Platform
BOARD: Asus P8Z77-M Pro
RAM: 32Gb - 4x TimeTec DDRL3 75TT16NUL2R8-8G
CPU: Intel i7-3770
TPM: Modules tested: Asus branded TPM 1.02H & Foxconn TPM Krypton Rev 1.0
While I am a QubesOS team member, this post is my personal thoughts and does not represent and official endorsement of this platform by the QubesOS project.