Thanks for your response and suggestions. Luckily I don’t need the SD card reader and would rather completely disable it to protect against any DMA attack before the kernel initializes IOMMU. The problem is that I don’t know how to prevent the controller from initializing at all, short of actually desoldering the chip from the mainboard, which is risky.
Regarding the EC, are you aware of any working libre replacement for the EC on any Lenovo Thinkpad? -- coreboot mailing list: coreboot@coreboot.org https://mail.coreboot.org/mailman/listinfo/coreboot
