Linux's Thunderbolt Manager Bolt 0.8 Adds IOMMU Protection

Bolt, the Red Hat led project for managing Thunderbolt devices on Linux and their security, is out with their version 0.8 update to introduce better security for the growing number of Thunderbolt devices.

The headline feature of Bolt 0.8 is introducing IOMMU protection. The Bolt IOMMU support is for using the IOMMU unit on newer hardware and supported by newer kernels to only permit DMA access by Thunderbolt devices to assigned/safe memory regions rather than being able to access any of the system memory. This should further help tighten the Linux security around Thunderbolt and complement the other security measures that have been in place following issues like Thunderclap.

Bolt 0.8 also has a new config sub-command to read/list/write device properties, and other changes.

Moving forward, Bolt 0.9 will be working on new APIs, a terse output mode, a connecting device status, and other features. That will be followed by a buttoned up Bolt 1.0 release.

More details on Bolt 0.8 via this blog post by Red Hat's Christian Kellner.