Early DMA protection not enforced properly on Alderlake and Meteorlake
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 6
Description
Hi,
IOMMU It is used to protect against DMA attack in Dasharo + coreboot, does this during system startup.
https://osresearch.net/Heads-threat-model/#peripheral-firmware
https://docs.dasharo.com/dasharo-menu-docs/dasharo-system-features/#dasharo-security-options
On Clevo NV41 and Clevo NS50 models this is disabled, and I don't understand why.
https://github.com/linuxboot/heads/blob/master/config/coreboot-novacustom-nv4x_adl.config#L426
@tlaurion why?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the IOMMU and DMA-protection sections in the linked Dasharo and Heads documentation, then compare config/coreboot-novacustom-nv4x_adl.config and config/coreboot-nitropad-ns50.config around line 426. Trace why protection is disabled on Clevo NV41 and NS50, and make the result explain whether the settings should be enabled for Alder Lake and Meteor Lake.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100