## System details

Intel Core i9-14900K, Intel UHD Graphics 770 + NVIDIA GeForce RTX 4060, ASUS ROG STRIX Z790-A GAMING WIFI II BIOS 2001, ASUS ThunderboltEX 4, Omarchy 4.0.0.r6863.ga15636b-1

## What's wrong?

`omarchy setup security thunderbolt authorization` finishes successfully, then tells me to change a firmware security level this motherboard does not have.

Status text:

```
Thunderbolt device approval is enabled.
Trusted accessories reconnect automatically; new accessories require approval.
Attention: This controller allows PCIe connections in firmware. Select user authorization in firmware settings; Omarchy cannot block its devices before their drivers load.
Firmware boot access is separate; see the Security manual before relying on pre-boot protection.
```

The same instruction is in `manual/48-security.md`: a controller in security mode `none` "bypasses software approval; select user authorization or secure authorization in its firmware settings."

## What I can actually set

Board: ASUS ROG STRIX Z790-A GAMING WIFI II, BIOS 2001 (2025-04-25).
Controller: ASUS ThunderboltEX 4 (Intel Maple Ridge JHL8540), NVM 43.83. Firmware connection manager.

VT-d is enabled, and **Control IOMMU Pre-boot Behavior** is enabled. That is the DMA-protection setting the ROG STRIX Z790 Series BIOS manual tells you to turn on. **Advanced → Thunderbolt(TM) Configuration** only offers Discrete Thunderbolt Support, wake, Thunderbolt Boot Support, DTBT Go2Sx, Windows 10 Thunderbolt Support, and the DTBT controller resource settings. There is no Security Level, User Authorization, Secure Connect, or Legacy Mode option. Section 6.8 of the [ROG STRIX Z790 Series (Intel 14th) BIOS manual](https://dlcdnets.asus.com/pub/ASUS/mb/LGA1700/ROG_STRIX_Z790-E_GAMING_WIFI/E23863_ROG_STRIX_Z790_Series_BIOS_Manual_Intel_14th_EM_V2_WEB.pdf) lists those items and does not list a security level.

Linux agrees the IOMMU path is active and that the old security level is `none`:

```
/sys/bus/thunderbolt/devices/domain0/security = none
/sys/bus/thunderbolt/devices/domain0/iommu_dma_protection = 1
/sys/bus/thunderbolt/devices/domain0/deauthorization = 0
```

The kernel documents this combination on purpose. When `iommu_dma_protection` is 1, DMA protection is done by the IOMMU and some systems ship with security level `none` because the older levels are redundant for that purpose: https://docs.kernel.org/admin-guide/thunderbolt.html

## Why the Omarchy message is wrong here

`install/helpers/thunderbolt-policy.sh` (`tb_snapshot`) already copies each domain's `IOMMU` flag into the snapshot, then emits the "Select user authorization in firmware settings" warning for every domain whose `SecurityLevel` is `none`. It never consults `IOMMU`.

The first half of the warning is true on this machine: security level `none` plus `deauthorization` 0 means firmware connects PCIe devices before Linux, and Omarchy cannot stop that before the driver loads. The prescribed fix is not. This firmware has no user-authorization mode to select. Following the message only leads to VT-d and IOMMU pre-boot behavior, which are already enabled.

The security manual already draws the right distinction elsewhere: "IOMMU memory protection stays enabled; it does not count as consent to load a device's driver." The status line throws that away and sends the user to a BIOS option that this class of add-in-card firmware does not implement.

## Expected

Keep reporting that software approval cannot block devices before their drivers load when the security level is `none`.

Do not tell the user to select user or secure authorization when the domain reports IOMMU DMA protection and the firmware does not offer those modes. Say that IOMMU DMA protection is already active, that it is not device-approval consent, and that this controller has no firmware security level to change. Pre-boot access on this board is the separate **Thunderbolt Boot Support** switch, which `Setup > Security > Thunderbolt Boot` cannot manage because it requires `user` or `secure` mode.

## Steps

1. ASUS ROG STRIX Z790-A GAMING WIFI II with ThunderboltEX 4 installed and the TB header connected. VT-d and Control IOMMU Pre-boot Behavior enabled.
2. Run `omarchy setup security thunderbolt authorization`, or `omarchy setup security thunderbolt authorization status` after it is enabled.
3. The Attention line tells you to select user authorization in firmware. The BIOS has no such setting.