Kernel config - enforce iommu by default in all kernel configs that switched to efifb

[JonathonHall-Purism]

The kernel configurations have IOMMU support enabled. We're not sure if this is needed for i915 graphics to work, and if so, on which devices. If disabling IOMMU support saves a significant amount of space, we should check whether it is needed on these boards.

Previously discussed in #1232

[tlaurion]

@JonathonHall-Purism this setups the IOMMU through the first kernel initialization (coreboot setuped kernel options in coreboot config), while ADD and REMOVE kernel options passed from board config kernel options are responsible to inform any overrides that are platform specific for final linux OS.

See here, was reimplemented again as needed otherwise causing problems: #1282 (comment)

[DemiMarie]

IOMMU is needed for security reasons. Linux has an option to enable early DMA protection which should be used.

[tlaurion]

To be clearer, iommu needs to be setup as early as possible but since boards are now not needing to load i915 related drivers in Heads, the kernel drivers options related to iommu for gfx can now vanish.

As a consequence, the kernel configs can now have the default iommu being enforced by default.

This will need review of all kernel configs.

For traceability of a recent example of board coreboot and kernel changed linked to switching to efifb which do not require past iommu hacks and would lead to iommu being enforced by kernel by default see 35f3b22

[tlaurion]

Done under #1522

Shows linux configs that do not have CONFIG_INTEL_IOMMU_DEFAULT_ON=y enabled:

user@heads-tests-deb12:~/heads$ find config/linux* | while read config; do grep -q "CONFIG_INTEL_IOMMU_DEFAULT_ON=y" $config || echo $config; done
config/linux-kgpe-d16_server.config
config/linux-kgpe-d16_server-whiptail.config
config/linux-kgpe-d16_workstation.config
config/linux-linuxboot.config
config/linux-talos-2.config

Which is normal because not Intel CPUS. Closing.