BOLTCTL(1) bolt Manual BOLTCTL(1)
NAME
boltctl - control the thunderbolt device manager
SYNOPSIS
boltctl authorize DEVICE
boltctl config
boltctl domains
boltctl enroll DEVICE
boltctl forget DEVICE
boltctl info DEVICE
boltctl list
boltctl monitor
boltctl power
DESCRIPTION
boltctl is the command line interface to interact with boltd, the system
daemon that manages Thunderbolt 3(TM) devices. It can be used to query
the state of devices as well as manage them.
Devices can be globally identified via their unique identifier (uuid).
All commands that take a DEVICE identifier expect this unique id.
If no command is given, it is equivalent to boltctl list.
OPTIONS
--version
Print version information and exit.
-U | --uuid {full | short | alias | N}
Control how UUIDs are printed. Since they are somewhat sensitive
data it is not advisable to share them publicly in full length.
Instead short or alias can and should be used when sharing the
output of boltctl.
full
Print all UUIDs in full length.
short
Truncate all UUIDs so only the first 13 characters are printed.
alias
All UUIDs are replaced by a random string that is derived from
the UUID, therefore the devices can be uniquely identified
without revealing the original UUID.
N
If a integer N is specified, all UUIDs are truncated to only
show up to N.
COMMANDS
authorize [-F | --first-time] DEVICE
Authorize a currently unauthorized device identified via its unique id
(uuid) DEVICE. If a key is stored in the database it will be used, given
the security level of the domain supports secure device connection. Use
boltctl list to find out the uuid of a device.
-F | --first-time
Normally, when attempting to authorize an already authorized device
boltctl will do nothing and return a successful status code. When
using this option, the attempt will fail and result in a negative
exit code if the device is already authorized.
config --describe [global|domain|device]
List global, domain, or all (if nothing is specified) properties. The
format is 3 columns: permission, name, description. Permission indicates
if the property is only readable or can also be written.
config KEY [VALUE]
Get or set, if VALUE is specified, a global property.
config <domain|device>.KEY TARGET [VALUE]
Get or set, if VALUE is specified, a domain or device property, where
TARGET is the unique id of the domain or the device.
domains [-v | --verbose]
List all currently active Thunderbolt domains. A Thunderbolt domain
represents the Thunderbolt controller hardware. There will be one domain
(and host device) for each Thunderbolt controller present in the system.
The security property shows the security level of the controller. If
iommu support is active (see the boltd man page) it will be indicated by
a +iommu suffix for "secure" or "user" mode, or just plain iommu in case
the security level is "none" (sl0). bootacl shows the used and total
slots of the boot access control list (BootACL) and the content of all
non-empty entries. NB: if BootACL is unsupported it will show 0 for both
(0/0). The online property shows if the thunderbolt controller is
currently powered by the firmware. NB: if the controller is currently
offline the BootACL list will reflect what boltd estimates the list will
look like once the controller is back online and local changes have been
synchronized to the controller. This might not be accurate if the list
was modified in the meantime, e.g. from a different installation or OS.
enroll [--policy policy] DEVICE
Authorize and record the device with the unique id DEVICE in the
database. If the domain supports secure connection a new key will be
generated and stored in the database alongside the device name and
vendor name. The key, if created, will be used in the future to securely
authorize the device.
--policy {default | auto | manual}
Specify the policy to be used for the newly enrolled device.
default
Use the global default policy of the daemon; this can be
changed, but is normally also auto.
auto
Automatically authorize this device whenever it is connected.
manual
Do not automatically authorize the device; instead require
manual authorization via boltctl authorize.
forget DEVICE
Remove the information about the device with the unique id DEVICE from
the database. This includes the key, if one was previously generated. If
you pass --all instead of the DEVICE all devices are removed instead of
just one.
info DEVICE
Display information about the device with the unique id DEVICE.
list [-a | --all]
List and print information about all connected and stored devices.
-a | --all
Normally, the only the device type that will be shown is
peripherals. Therefore the device that represents the host itself
will be omitted. Using this option will instead include all device
types in the list.
monitor
Listen for and show changes in connected devices.
power [-t | --timeout seconds] [-q | --query]
Power up the Thunderbolt controller. If the Thunderbolt controller is
not in "native enumeration mode" it can be completely powered down by
the host firmware/BIOS. On supported systems there is an interface to
"force" power the thunderbolt controller. If supported this command will
request the daemon to do so. The daemon will keep track of all client
requests and will release the force power override when the last request
is released.
-t | --timeout seconds
Release the force power request after the specified amount of
seconds and exit.
-q | --query
Query the current force power status of the daemon.
AUTHOR
Written by Christian Kellner <ckellner@redhat.com>.
bolt 0.9.8 05/29/2024 BOLTCTL(1)
Generated by dwww version 1.16 on Sat Oct 3 06:49:07 CEST 2026.