[betafive]

Has anyone looked at using VTd to secure Thunderbolt devices from the system bus?

[amluto]

That wouldn't help. This attack happens long before the OS loads, and EFI explicitly executes code from the option ROM, so DMA isn't even involved.