How to activate DMA protection, memory encryption and so on.?

[Mercyletter]

Describe the question
how to activate DMA protection, memory encryption and so on.

fwupd version information
Please provide the version of the daemon and client if applicable to your current installation of fwupd.

$ fwupdmgr --version
compile   com.hughsie.libxmlb           0.3.14
compile   com.hughsie.libjcat           0.1.13
compile   org.freedesktop.fwupd         1.9.6
runtime   org.freedesktop.fwupd-efi     1.4
compile   org.freedesktop.gusb          0.4.5
runtime   com.hughsie.libjcat           0.1.13
runtime   org.freedesktop.gusb          0.4.5
runtime   org.freedesktop.fwupd         1.9.6
runtime   org.kernel                    6.5.8-200.fc38.x86_64

Fedora 38 output:

Device Safety Report

======================


Report details

  Generated date: 2023-10-30 16:34:08

  Version of fwupd 1.9.6


System details

  Hardware model: Gigabyte Technology Co., Ltd. B450M DS3H V2

  Processor: AMD Ryzen 9 3900 12-Core Processor

  OS: Fedora Linux 38 (Workstation Edition)

  Security Level: HSI:INVALID:missing-data


HSI-1 Tests

  UEFI Boot Service Variables: Correct (Locked)

  UEFI Platform Key: Correct (Valid)

  TPM v2.0: Correct (Found)

  BIOS Firmware updates: Correct (Enabled)

  UEFI Secure Boot: Correct (Enabled)

  TPM Platform Configuration: Successful (Valid)


HSI-2 Tests

  TPM rebuild: OK (Valid)

  IOMMU Device Protection: OK (Enabled)


HSI-3 Tests

  Pre-boot DMA Protection: Failed (Not Enabled)

  Suspend to RAM: Failed (Enabled)

  Suspend to Sleep: Failed (Not Enabled)


HSI-4 Tests

  Encrypted RAM: Failed (Not Supported)


Runtime Tests

  Firmware Updater Check: Successful (Not Poisoned)

  Linux Swap:                     Successful (Encrypted)

  Linux Kernel Check:                  Failed (Poisoned)

  Linux Kernel Locked: Successful (Enabled)


Computer security events

  2023-10-30 15:00:38 Linux kernel locked Correct (Not enabled → Enabled)

  2023-10-30 15:00:38 UEFI Secure Boot Correct (Not Enabled → Enabled)

  2023-10-30 14:23:06 TPM v2.0 Correct (Not found → Found)

  2023-10-30 08:32:09 UEFI Secure Boot Failed (Enabled → Not Enabled)

  2023-10-30 08:32:09 Kernel Verification LinuFailed (Not Poisoned → Poisoned)

  2023-10-30 08:32:09 Locked Linux Kernel Failed (Enabled → Not Enabled)

  2023-10-30 06:58:54 Linux Kernel Verification Succeeded (Poisoned → Not Poisoned)

  2023-10-30 06:58:54 Linux kernel locked Correct (Not enabled → Enabled)

  2023-10-30 06:58:54 UEFI Secure Boot Correct (Not Enabled → Enabled)

  2023-10-29 20:59:31 UEFI Secure Boot Failed (Enabled → Not Enabled)

  2023-10-29 20:59:31 Kernel Verification LinuFailed (Not Poisoned → Poisoned)

  2023-10-29 20:59:31 Locked Linux Kernel Failed (Enabled → Not Enabled)

  2023-10-29 18:57:11 Linux Kernel Verification Successful (Poisoned → Not Poisoned)

  2023-10-29 18:57:11 Locked Linux Kernel Correct (Not Enabled → Enabled)

  2023-10-29 18:57:11 UEFI Secure Boot Correct (Not Enabled → Enabled)

  2023-10-26 15:05:06 Kernel LinuFailed Kernel Verification (Not Poisoned → Poisoned)


For information on the contents of this report, see https://fwupd.github.io/hsi.html

Thanks a lot.

All the best.

[superm1]

In the link you see in that report you can see what you can do.

Pre-boot DMA Protection: Failed (Not Enabled)

https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu

[Mercyletter]

Thanks, I have iommu activated in the bios. What am I doing wrong?

All the best.

[superm1]

Thanks, I have iommu activated in the bios. What am I doing wrong?

All the best.

Nothing. It's up to the OEM to do the other bits for it for pre-boot protections.