tuxedo-keyboard VS coreboot

I can't really confirm if it's the place to look at, but the tuxedo control center works in pair with their kernel module https://github.com/tuxedocomputers/tuxedo-keyboard

As the name wrongly imply, it is not just about controlling the keyboard. At least on my laptop (an aura15 gen 2), a whole chunk of the control center is not available when the module is not loaded. Not sure if it will help but you might want to look into this module as well for your investigation.

I also found an open source tool from a competitor Tuxedo Laptops which also resell Clevo models: https://github.com/tuxedocomputers/tuxedo-keyboard which maybe ill be able to use to confirm I am doing the right sorta thing.

This merge commit fixes the build issue on 6.2.

maybe this helps.

- tuxedo-keyboard -dkms from the AUR

Github issue for charging limits with Stellaris series: https://github.com/tuxedocomputers/tuxedo-keyboard/issues/145

> Show me a FLOSS implementation of this standard and you will have a point

I've had a point from my first comment and it hasn't changed in validity. It's just taking time to convince you, but I think I'm making progress :)

I referenced several open implementations in my last reply, an a cursory search reveals more [1] [2]. Besides, this still doesn't help you trust the hardware, even if that hardware is entirely open like some sort of RISC chip. Can you verify every step in the supply chain? At every stage of assembly? No? Or, assuming a trusted device, can you be 100% confident something wasn't added, a simple keylogger? Most keyboards can be removed from laptops without leaving a trace, so can screen casings, speakers, batteries, etc. Plenty of places to hide something tiny.

> At the moment, I would have to trust a megacorporation obeying NSA,

That's less likely than the software you use having been compromised, for example by introducing an obfuscated bug, or MitMing as you perform a software update (many software update mechanisms have notoriously weak security, search some defcon talks on the subject).

> Your threat model may vary.

No, what I'm saying applies to all threat models, and I challenge you to name one to disprove that.

Secure boot is an open standard and can be implemented in a trustworthy and secure way, you just need to put in the work to do so. It's entirely possible to do so.

Of course if you are putting in all that work, if you are that at risk, you would need to switch your software stack entirely as well and use something like seL4 as a starting point.

[1] https://github.com/prplfoundation/prpl-secure-boot

[2] https://www.coreboot.org/

Why BIOS (did you mean UEFI?) when it runs the best boot loader, which is Coreboot¹. Many users would love to re-flash their bios/uefi for it, if it’s supported.

1: https://www.coreboot.org/

Coreboot is 0.6% C++.

NovaCustom ; some models come with Dasharo a coreboot distribution.

You can also use Mr. Chromebox Script to install Coreboot on your chromebook to get a UEFI BIOS on your Chromebook and then you can go an install either a linux distro or even Windows if you want. It's a pretty straightforward process and also reversable if you want to go back to just using ChromeOS.

Some models are available with Dasharo a [coreboot]https://www.coreboot.org/) distribution.

why no haswell_ult_dmi_registers for broadwell? in https://github.com/coreboot/coreboot/blob/master/util/inteltool/pcie.c

use croshfirmware.sh from https://github.com/coreboot/coreboot/tree/master/util/chromeos

There may be other protections to restrict SPI flash access for security reasons (so you might not be able to flash your custom firmware in the OS), but worst case you can use a HW flasher (or maybe USB flashback). Still, this doesn't address the elephant in the room - platform initialization code might be open-sourced, but that isn't everything. You'll still need to figure out the board-specific stuff (the Super I/O chip, chipset GPIOs, other peripherals, etc.). Using coreboot as an example, Intel provides the Firmware Support Package blob to handle platform initialization. I think AGESA is somewhat similar to this, though Intel publicly releases the binaries for use in coreboot/etc. Thanks to the FSP, coreboot has support for recent Intel chipsets. However, there is only support for two recent consumer boards: the MSI PRO Z690-A WiFi DDR4 and DDR5.