Your IOMMU needs to be programmed, just like your MMU. Programming is provided by the OS and driver. Early IOMMU configuration is provided by the firmware. Check mate.
> It can't improve the security of firmware directly, but it can certainly improve the isolation of it by auditing and improving IOMMU configuration