Thunderbolt §
Thunderbolt is a cabled expansion interface that tunnels PCIe and DisplayPort over one cable. Its defining idea is that a dock should not translate protocols: it should carry the computer’s native buses to the outside world. It is the docking-and-expansion member of the cabled external interconnect family. Thunderbolt 5 (spec finalised 2024) provides 80 Gb/s in each direction simultaneously (full duplex), with a 120 Gb/s asymmetric “Bandwidth Boost” for video-heavy setups, using PAM3 signalling.
Authoritative sources
The tunnel architecture §
Definition. A Thunderbolt link is a packet-switched fabric. Thunderbolt 1/2 used four lanes organised as two independent full-duplex 10 Gb/s channels; Thunderbolt 3/4/5 use two differential lane pairs per direction (one pair each way). Everything else — PCIe transactions, DisplayPort video, USB 3 traffic — is wrapped in small packets (“tunnels”) and multiplexed over those lanes.
Details: why tunneling instead of translation
A dock has three jobs: displays, USB devices, and (sometimes) a network or storage adapter. The naive design translates each protocol at the dock — a USB hub chip, a display scaler, a NIC. Thunderbolt instead says: the computer already has PCIe and DisplayPort inside; just carry them out.
- A GPU in an enclosure is a real PCIe device: the host’s root complex enumerates it across the cable as if it were on the motherboard — the same board-level PCIe transactions, just packetised.
- A monitor is a real DisplayPort sink: the GPU drives it directly, with no scaler in between (see DisplayPort and HDMI).
- A USB hub in the dock is a real USB 3 device behind the host’s xHCI controller (see USB).
The cost is that every device in the chain must understand the tunnel protocol, and the cable must be a switch fabric, not a wire. The benefit is that a dock adds capabilities the host never had to be designed for — which is why a 2015 laptop can drive a 2024 dock.
Example problem: the eGPU bandwidth budget
An eGPU enclosure is plugged into a Thunderbolt 4 host (40 Gb/s per direction, 32 Gb/s of it guaranteed for PCIe). The GPU uploads texture and geometry data from the host at 8 Gb/s, renders to the laptop’s internal 4K60 display — whose 12.5 Gb/s framebuffer stream must travel back across the cable — and also drives an external 4K60 monitor plugged directly into the enclosure. Does each direction of the cable fit?
Solution
Downstream (host → GPU): the 8 Gb/s of texture uploads. The external monitor’s video never crosses the cable — it is generated inside the enclosure and exits through the enclosure’s own DisplayPort connector. Upstream (GPU → host): the 12.5 Gb/s internal-display framebuffer. Both directions fit easily: 8 < 40 and 12.5 < 40, and the PCIe portion (8 + 12.5 = 20.5 Gb/s) is under the guaranteed 32 Gb/s. The instructive part is where the traffic flows: an eGPU is cheap on cable bandwidth precisely because the heaviest stream it produces (the external monitor’s pixels) never touches the cable — only the internal display’s copy-back does. That is the opposite of a dock, where the displays are the main cable load.
Topology: the daisy chain §
Definition. Thunderbolt devices chain, up to 6 devices from a single host port. Every device’s controller is a small switch: it consumes the packets addressed to it and re-forwards all other traffic to the next device downstream. Bandwidth is therefore budgeted per segment, not per cable.
Details: why per-segment budgeting matters
A point-to-point link like SATA or Ethernet over copper has exactly one load: the traffic of the device at the other end. A Thunderbolt chain has one load per segment, and the segments are not independent — every packet destined for device 3 also occupies segments 1 and 2. Two consequences:
- Placement matters. What matters is the sum of traffic on each segment, and the segment nearest the host always carries the largest sum.
- A slow device does not slow the chain’s rate, only its budget. The link still runs at full speed; the packets simply share it.
Example problem
On the chain above (Thunderbolt 4, 40 Gb/s per direction), the SSD reads at 2 GB/s, the monitor needs 12.5 Gb/s of video, and USB devices behind the dock carry 4 Gb/s downstream. What is the load on segment 1, and does it fit?
Solution
Segment 1 carries everything: downstream = 12.5 Gb/s video + 4 Gb/s USB = 16.5 Gb/s; upstream = 16 Gb/s (the SSD read, 2 GB/s = 16 Gb/s). Both fit under 40 Gb/s. Note that the SSD read does not count against downstream — full duplex budgets each direction separately. Had the SSD been behind the dock instead, its read traffic would also have occupied segment 2: placement changes which segments are stressed, never the total.
Generations §
Definition. Five generations since 2011, all speaking the same tunnel protocol; each step raised the per-direction rate or tightened the guarantees, while keeping backward compatibility through the USB-C or mini-DisplayPort connector.
| Generation | Year | Rate per direction | Signalling | Notable |
|---|---|---|---|---|
| Thunderbolt 1 | 2011 | 10 Gb/s (2 × 5) | NRZ, optical or copper | First PCIe+DP tunnel; mini DisplayPort connector |
| Thunderbolt 2 | 2013 | 20 Gb/s (aggregated) | NRZ | Channel aggregation for 4K video |
| Thunderbolt 3 | 2015 | 40 Gb/s | NRZ over USB-C | Adopted the USB-C connector; 15 W charging |
| Thunderbolt 4 | 2020 | 40 Gb/s | NRZ | Same rate, stricter contract: ≥ 32 Gb/s PCIe, dual 4K or one 8K display, 100 W charging on at least one port, wake-from-sleep, 2 m passive cables |
| Thunderbolt 5 | 2024 | 80 Gb/s (120 asymmetric) | PAM3, 25.6 GBd | 64 Gb/s of PCIe — 2× Thunderbolt 4's 32 Gb/s; 240 W PD; Bandwidth Boost to 120 Gb/s for display-heavy setups |
Details: PAM3 and the 25.6 GBd number
Thunderbolt 5’s PHY is specified at 25.6 GBaud per lane with PAM3 (3-level pulse-amplitude modulation); the data rate is derived from that symbol rate, not the other way around. Each PAM3 symbol carries log₂ 3 ≈ 1.585 bits, so the raw line rate is 25.6 × 1.585 ≈ 40.6 Gb/s per lane. Framing cannot use a fractional number of bits per symbol, so the spec maps blocks of 11 bits onto 7 trits (since 3⁷ = 2187 ≥ 2¹¹ = 2048), giving 25.6 × 11/7 ≈ 40.2 Gb/s of payload per lane — over two lanes, ≈ 80 Gb/s per direction.
PAM3 trades SNR margin for symbol rate: three levels squeezed into the same voltage swing shrink the eye, so the PHY needs stronger equalisation and forward error correction — the same trade 10GBASE-T made with PAM16, but far gentler, because a 1 m cable has far less attenuation than 100 m of twisted pair. The general rule is Shannon’s: for a fixed channel, bits per second are bought either with bandwidth (symbol rate) or with SNR (levels) — see Communication.
Example problem
Why not keep NRZ and simply double the symbol rate to 51.2 GBd to reach the same 40 Gb/s per lane?
Solution
Because the cable, not the silicon, is the constraint. A 51.2 GBd NRZ signal has its fundamental energy near 25.6 GHz, where a 2 m passive copper cable’s insertion loss is severe — the eye would close before any receiver could open it. PAM3 at 25.6 GBd needs only ~12.8 GHz of bandwidth, at the price of 10·log₁₀(3) ≈ 4.8 dB less SNR margin, which short-reach equalisation and FEC can recover. Halving the required bandwidth to buy 4.8 dB of SNR is exactly the right trade on a short, lossy copper channel — and it is the same reasoning that made Ethernet over copper adopt PAM4/PAM16 at long reach.
Power delivery §
Definition. Thunderbolt carries DC power on the same USB-C connector, on wires separate from the high-speed pairs, following the USB Power Delivery standard: 15 W mandatory at the Thunderbolt 3 launch, 100 W (20 V × 5 A) with Thunderbolt 4, and 240 W (48 V × 5 A, USB PD 3.1 “Extended Power Range”) with Thunderbolt 5.
Details: why power grew 16×
The tunnel architecture created a new class of device — the bus-powered dock — whose capability is set by its wattage. 15 W runs a hub and an SSD; 100 W runs a dock and charges the laptop through it; 240 W charges gaming laptops through the same cable that carries the display. Raising power meant raising voltage (48 V) rather than only current, because cable heating is I²R: at 240 W, 5 A at 48 V dissipates 16× less heat in the cable than 20 A at 12 V. The trade-off is connector safety: 48 V sits at the edge of the SELV (safety extra-low voltage) domain, which is why EPR cables are e-marked and explicitly rated.
Security §
Definition. Because Thunderbolt tunnels raw PCIe, a plugged-in device can issue DMA (direct memory access) — read and write system RAM without the CPU — which turns an untrusted cable into a memory-disclosure attack. Thunderbolt 3 and later mitigate this with a user-approved firmware-based connection manager, and hosts pair it with Kernel DMA Protection (the IOMMU blocks DMA from devices until the OS has authorised them).
Details: the trust problem tunnelling creates
A USB device can only ask the OS for data through a driver; a tunnelled PCIe device talks to memory directly, at hardware speed, below every OS check. This is the same power that makes an eGPU possible — it is the attack surface too (“Thunderclap”-class attacks, 2019). The defences are layered:
- Connection manager (firmware). The host’s Thunderbolt controller does not enumerate a new device until the user approves it (or a previously-approved device is recognised); “display-only” devices can be allowed without full trust.
- Kernel DMA Protection / IOMMU. Even an approved device is confined: the IOMMU maps only the memory regions the OS explicitly grants, so a malicious or compromised device cannot scan RAM.
- Per-device secure connect. One-time approval per device identity, so the approval prompt does not train users to click “always allow”.
The first-principles lesson: tunnelling a trusted, internal bus to the outside moves a trust boundary across the cable, and the security model must be rebuilt at the new boundary.
USB4 vs. Thunderbolt §
Definition. USB4 (2019) adopted Thunderbolt 3’s tunnel architecture as a standard; the difference is what is guaranteed. USB4 makes PCIe tunneling optional; Thunderbolt requires it. Thunderbolt 4/5 additionally guarantee minimum PCIe bandwidth (32 Gb/s / 64 Gb/s), 2 m passive cables, and dual-4K display support.
Details
Practically: a USB4-only host may refuse to enumerate an eGPU (no PCIe tunneling), while a Thunderbolt host must. A USB4 dock may give you USB 3 ports and a display but a slow storage path; a Thunderbolt 4 dock must give you at least 32 Gb/s of PCIe. The logos are not just branding — they are different contracts over the same physical cable.
| Guarantee | USB4 | Thunderbolt 4 | Thunderbolt 5 |
|---|---|---|---|
| PCIe tunneling | Optional | Required | Required |
| Minimum PCIe bandwidth | None | 32 Gb/s | 64 Gb/s (80 Gb/s link) |
| Displays | One (via DP tunnel) | Dual 4K or one 8K | Dual 4K or one 8K (more with Bandwidth Boost) |
| Charging | Per USB PD | 100 W on at least one port | Up to 240 W |
| 2 m passive cable | Not required | Required | Required |
Example problem
You plug an NVMe SSD enclosure, an eGPU, and a monitor into a host whose port is USB4-only (no PCIe tunneling support). What works, and at what speed?
Solution
The monitor works: USB4 mandates the DisplayPort tunnel. The SSD enclosure works, but not as a PCIe/NVMe device — it falls back to its USB 3 “bridge” mode, capped by the USB 3 tunnel (typically 10–20 Gb/s instead of the ~32 Gb/s a Thunderbolt PCIe tunnel provides). The eGPU does not work at all: without a PCIe tunnel there is no way to enumerate it. This is exactly the contract difference: same cable, same connectors, different guarantees.
Interactive: the per-segment bandwidth budget §
Both worked examples above reduce to one exercise: add up the traffic on each segment, in each direction, and compare with the link rate. Try it — note how the segment nearest the host always carries the most, and how DSC changes the displays’ share.
Quiz §
Example problem
A Thunderbolt 3 (40 Gb/s per direction) chain is wired host → NVMe drive enclosure → 4K60 monitor. The drive reads at 2 GB/s and the monitor needs 12.5 Gb/s of video. Does the segment between the host and the drive enclosure have enough downstream capacity?
Solution
The segment between host and drive carries both the drive traffic and the monitor’s video (the video must pass through the drive enclosure’s Thunderbolt controller to reach the monitor). Downstream demand: 2 GB/s = 16 Gb/s + 12.5 Gb/s = 28.5 Gb/s < 40 Gb/s. It fits, with ~11.5 Gb/s of headroom. If the drive wrote at 2 GB/s and the host read from it simultaneously, the full-duplex link would still cope, since each direction is budgeted separately. A second 4K60 display would push downstream demand to 41 Gb/s and start dropping frames — if the displays ran uncompressed. With DisplayPort’s DSC (visually lossless compression, see DisplayPort and HDMI), each 4K60 stream shrinks to roughly a third (~4 Gb/s), and both displays plus the SSD fit comfortably.