Early DMA attack and IOMMU setup in coreboot romstage

PDP1 · April 20, 2025, 2:13am

I own a Nitropad ns70
Firmware: Dasharo Nitrokey-v2.5.0
USB ToKey: NK3A
I am worried about an issue I just became aware of:

github.com/linuxboot/heads

Early DMA protection not enforced properly on Alderlake and Meteorlake

opened 02:40PM - 09 Mar 25 UTC

Lapushy6351

Hi, IOMMU It is used to protect against DMA attack in Dasharo + coreboot, does …this during system startup. [https://osresearch.net/Heads-threat-model/#peripheral-firmware](url) [https://docs.dasharo.com/dasharo-menu-docs/dasharo-system-features/#dasharo-security-options](url) On Clevo NV41 and Clevo NS50 models this is disabled, and I don't understand why. [https://github.com/linuxboot/heads/blob/master/config/coreboot-novacustom-nv4x_adl.config#L426](url) [https://github.com/linuxboot/heads/blob/d4c4e5699b89365a88d9d49748dbcc11b6394907/config/coreboot-nitropad-ns50.config#L426](url) @tlaurion why?

Since my Nitropad model is 12th gen. Alderlake architecture, I am concerned that this flaw might be present with the current version of Dasharo/Heads I use (v2.5.0, but I am not aware of any newer version of the firmware for this laptop)
So my question is this: has the above mentioned issue been addressed yet or should I be aware that I lack proper IOMMU configuration early in the boot process in order to twart DMA attacks?
EDIT: this here https://review.coreboot.org/c/coreboot/+/68450 seems to indicate that the issue was solved for Alderlake at least. (but it is kind of old, March 2023)
Does the current v2.5.0 firmware actually include this fix?