Thunderbolt

Thunderbolt is a hardware interface protocol developed jointly by Intel and Apple. Its defining feature is protocol tunneling: it multiplexes several independent protocols — PCIe (Peripheral Component Interconnect Express), DisplayPort, USB, and power delivery — over a single physical cable. Instead of requiring separate cables for display output, data transfer, charging, and peripheral connectivity, Thunderbolt carries all of them simultaneously over one connection.

History and versions

Thunderbolt 1 (2011)

The first version debuted on Apple’s MacBook Pro in early 2011. It provided two 10 Gbps (gigabits per second) channels for a total of 20 Gbps, using copper cabling and the Mini DisplayPort (Mini DP) physical connector. Thunderbolt 1 was expensive: each endpoint required a dedicated Thunderbolt controller chip (initially the Intel Light Ridge), which added significant cost to both the host device and peripherals. Adoption outside Apple’s ecosystem was minimal.

Thunderbolt 2 (2013)

Thunderbolt 2 retained the same 20 Gbps aggregate bandwidth and Mini DisplayPort connector but introduced channel bonding — the ability to combine both 10 Gbps channels into a single 20 Gbps logical channel. In Thunderbolt 1, each channel was independent, so a single data stream was limited to 10 Gbps even if the other channel was idle. Channel bonding removed this limitation, allowing a single protocol (e.g., DisplayPort carrying a 4K 60 Hz video stream) to use the full 20 Gbps.

Thunderbolt 3 (2015)

Thunderbolt 3 was the inflection point for mainstream adoption. Key changes:

• USB-C connector: Thunderbolt 3 switched from Mini DisplayPort to the USB Type-C (USB-C) physical connector. This was a major shift — the same port and cable could now carry Thunderbolt, USB, DisplayPort, and power delivery, and a Thunderbolt 3 port was backward-compatible with USB devices.
• 40 Gbps bandwidth: doubled from Thunderbolt 2.
• PCIe 3.0 x4 tunneling: the PCIe allocation increased substantially, enabling practical use cases like External GPUs (eGPUs).
• Power delivery: up to 100 W via USB-PD (USB Power Delivery), allowing a single cable to charge the laptop while carrying data and video.

Starting with Ice Lake (10th generation, 2019), Intel integrated the Thunderbolt 3 controller directly into the CPU die. This eliminated the need for a separate controller chip on the motherboard, dramatically reducing cost and encouraging adoption by PC OEMs (Original Equipment Manufacturers) beyond Apple.

Thunderbolt 4 (2020)

Thunderbolt 4 maintains the same 40 Gbps bandwidth as Thunderbolt 3 but raises the minimum requirements that a device must meet to carry the Thunderbolt 4 certification:

Requirement	Thunderbolt 3	Thunderbolt 4
PCIe tunneling bandwidth	16 Gbps (minimum)	32 Gbps (mandatory)
Wake-from-sleep	Optional	Mandatory
DMA protection (Intel VT-d / IOMMU)	Optional	Mandatory
Support for two 4K displays or one 8K display	Not required	Mandatory
Daisy-chain hub support	Not required	Mandatory

In short, Thunderbolt 4 is “guaranteed good Thunderbolt 3.” A TB3 port might meet all TB4 requirements, or it might cut corners on PCIe bandwidth or DMA protection. A TB4 port cannot cut those corners.

Thunderbolt 5 (2024)

Thunderbolt 5 is the current generation. Key specifications:

• 80 Gbps baseline: achieved via PAM-3 signaling (Pulse Amplitude Modulation with 3 levels — a signaling technique that encodes more data per symbol compared to the NRZ/Non-Return-to-Zero encoding used in earlier versions, by using three voltage levels instead of two) across 4 lanes at 20 Gbps each.
• 120 Gbps Bandwidth Boost: an asymmetric mode that allocates 3 lanes to the transmit (TX) direction and 1 lane to receive (RX). This yields 3 x ~40 Gbps = ~120 Gbps in the dominant direction. The asymmetric mode is useful for display-heavy workloads where most data flows from the host to the display, with little data flowing back.
• USB-C connector: unchanged from TB3/TB4.

See External GPUs (eGPUs) for a detailed bandwidth comparison showing how Thunderbolt 5’s usable PCIe bandwidth (~64 Gbps) approaches OCuLink (Optical-Copper Link) performance.

How tunneling works

Tunneling is the core mechanism that distinguishes Thunderbolt from a simple PCIe or USB cable. Understanding it requires knowing what sits at each end of the cable.

Architecture

[CPU] <--PCIe--> [Thunderbolt Controller] <--TB Link (USB-C cable)--> [Thunderbolt Controller] <--PCIe/DP/USB--> [Device(s)]

The Thunderbolt controller sits between the CPU’s PCIe root complex (the top of the PCIe hierarchy inside the CPU, which initiates all PCIe transactions) and the USB-C port. On the device side, a second Thunderbolt controller performs the reverse operation.

Multiplexing process

1. Ingress: The host-side Thunderbolt controller receives data from three sources simultaneously:

   • PCIe TLPs (Transaction Layer Packets — the fundamental data units in PCIe, carrying memory read/write requests and completions) from the CPU’s PCIe root complex.
   • DisplayPort video streams from the GPU or integrated graphics via the DisplayPort Alternate Mode interface.
   • USB packets from the USB host controller.

2. Encapsulation: The controller wraps each sub-protocol’s data into Thunderbolt transport frames. Each frame contains a header that identifies which sub-protocol the payload belongs to (PCIe, DisplayPort, or USB), along with routing information for daisy-chained topologies.

3. Time-division multiplexing (TDM): The controller interleaves transport frames from all sub-protocols onto the single physical link using TDM — each sub-protocol gets time slices on the cable, similar to how a CPU scheduler gives time slices to threads. The allocation is dynamic: if no DisplayPort stream is active, that bandwidth is reassigned to PCIe and USB.

4. Egress: The device-side Thunderbolt controller receives the multiplexed stream, inspects each frame’s header, demultiplexes the sub-protocols, and routes each to its destination: PCIe TLPs go to the downstream PCIe bus (e.g., to an eGPU), DisplayPort data goes to a monitor, USB packets go to a USB hub or device.

Analogy

This is analogous to VLANs (Virtual Local Area Networks) on a network switch: a single physical Ethernet cable carries frames tagged for multiple logical networks, and the switch at each end routes frames to the correct network based on the VLAN tag. In Thunderbolt, the “VLAN tag” is the sub-protocol identifier in the transport frame header.

Bandwidth sharing

Because all sub-protocols share the same physical link via TDM, bandwidth is a zero-sum game. If DisplayPort is consuming 14 Gbps for a 1440p 165 Hz stream and USB is consuming 4 Gbps, only ~22 Gbps of a Thunderbolt 3/4 link’s 40 Gbps remains for PCIe.

See External GPUs (eGPUs) for a worked bandwidth calculation showing exactly how this sharing affects eGPU performance.

Thunderbolt vs USB4

The relationship between Thunderbolt and USB4 is a frequent source of confusion because they share a common origin but differ in what they guarantee.

How USB4 came to exist

In 2019, Intel donated the Thunderbolt 3 protocol specification to the USB-IF (USB Implementers Forum — the industry body that governs USB standards). The USB-IF used this specification as the foundation for USB4, released the same year. USB4 is therefore architecturally based on Thunderbolt 3’s tunneling approach.

Key differences

Feature	USB4	Thunderbolt 4
PCIe tunneling	Optional — vendors may omit it	Mandatory
Minimum PCIe bandwidth	Not specified	32 Gbps
DMA protection	Optional	Mandatory (IOMMU-based)
Minimum display support	One display	Two 4K or one 8K
Wake-from-sleep	Optional	Mandatory
Bandwidth	40 Gbps (USB4 v1), 80 Gbps (USB4 v2)	40 Gbps (TB4), 80/120 Gbps (TB5)

Thunderbolt 4 is a strict superset of USB4: every TB4 port is a valid USB4 port, but the reverse is not true. A USB4 port may implement only the mandatory subset of the USB4 spec, which does not include PCIe tunneling.

USB4 Version 2.0 (2022)

USB4 v2 raises bandwidth to 80 Gbps, matching Thunderbolt 5’s baseline. It also supports the same asymmetric 120 Gbps mode. However, the same optional-vs-mandatory distinction applies: a USB4 v2 port is not guaranteed to support PCIe tunneling.

Practical impact

• A Thunderbolt port (identified by the lightning bolt icon next to the USB-C connector) always supports PCIe tunneling, DMA protection, and display output. It will work with eGPUs, Thunderbolt docks, and high-speed storage.
• A USB4 port without the Thunderbolt logo may or may not support PCIe tunneling. It depends on the specific host controller and the vendor’s implementation choices. Always check the laptop’s specifications before assuming eGPU or NVME enclosure compatibility.

DMA protection

The threat

Thunderbolt’s PCIe tunneling gives connected devices Direct Memory Access to the host CPU’s physical memory. This is the same access level that an internally installed PCIe card has. A malicious device plugged into a Thunderbolt port could exploit this to:

• Read arbitrary host memory (extracting encryption keys, passwords, or other secrets).
• Write to arbitrary host memory (injecting code, modifying kernel data structures).
• Bypass the OS’s security model entirely, since DMA operates below the level of the CPU’s privilege rings.

This is not theoretical. The Thunderclap attack (published in 2019 by researchers at the University of Cambridge and Rice University) demonstrated practical exploitation: a malicious Thunderbolt device could read and write host memory on macOS, Linux, Windows, and FreeBSD systems that lacked DMA protection.

The mitigation

IOMMU-based DMA protection (see IOMMU) restricts Thunderbolt devices to specific memory regions that the OS has explicitly mapped for them. When a Thunderbolt device issues a DMA request, the IOMMU intercepts it and checks whether the target physical address is in the device’s permitted set. If not, the request is blocked and a fault is raised.

On Intel systems, this is implemented via Intel VT-d (Virtualization Technology for Directed I/O). On AMD systems, the equivalent is AMD-Vi (AMD I/O Virtualization Technology).

Thunderbolt 4 made IOMMU-based DMA protection mandatory. On Thunderbolt 3 systems, DMA protection depends on whether the OS and firmware enable it — many early TB3 systems shipped with it disabled by default.

Security levels

Thunderbolt firmware also exposes configurable security levels that control device authorization independently of IOMMU:

• None: All devices are allowed without user approval.
• User authorization: The OS prompts the user before allowing a new Thunderbolt device.
• Secure connect: Devices must be approved and the connection is cryptographically verified on subsequent reconnections.
• USB-only: Thunderbolt PCIe tunneling is disabled entirely; only USB functionality is allowed through the port. This eliminates the DMA attack surface at the cost of losing Thunderbolt functionality.

Checking DMA protection status

• Linux: dmesg | grep -i dmar shows Intel VT-d/DMAR (DMA Remapping) initialization. If IOMMU is active, you will see messages like DMAR: IOMMU enabled.
• Windows: Device Manager > System devices > look for “Kernel DMA Protection.” Alternatively, run msinfo32 and check “Kernel DMA Protection: On/Off” under System Summary.
• macOS: DMA protection has been enabled by default on Apple Silicon Macs and on Intel Macs with T2 security chips.

How to check if your device has Thunderbolt

Physical inspection

Look for the lightning bolt icon printed or engraved next to USB-C ports. A plain USB-C port (without the icon) may be USB 3.x, USB4, or only USB 2.0 — the connector shape alone does not indicate Thunderbolt support.

Software verification

• Linux: cat /sys/bus/thunderbolt/devices/*/device_name lists connected Thunderbolt controllers and devices. The boltctl list command (from the bolt package) provides a more user-friendly listing with security level and authorization status.
• macOS: Apple menu > About This Mac > System Report (or System Information) > Thunderbolt. This shows the controller model, port count, and connected devices.
• Windows: Device Manager > System devices > look for entries named “Thunderbolt Controller” or “Thunderbolt(TM) Controller.”

Framework laptops

Framework laptops are a common case where the distinction between Thunderbolt and USB4 matters in practice:

• Framework 13 (Intel, 11th/12th/13th gen): 2 of the 4 expansion card slots support Thunderbolt 4. The other 2 are USB-C only (USB 3.2 or USB4 depending on generation).
• Framework 16 (AMD Ryzen 7040/8040 series): All ports are USB4, not Thunderbolt. AMD does not license Thunderbolt (it is an Intel technology). Whether these USB4 ports support PCIe tunneling depends on the AMD platform firmware — AMD’s USB4 implementation supports PCIe tunneling on some configurations but it is not guaranteed to behave identically to Thunderbolt.
• Framework 13 (AMD Ryzen 7040): USB4, same caveats as Framework 16.

Daisy-chaining

Thunderbolt supports daisy-chaining: connecting multiple devices in a linear chain through a single host port. Each Thunderbolt device has two Thunderbolt ports (an upstream “in” port and a downstream “out” port). The host connects to the first device’s “in” port; the first device’s “out” port connects to the second device’s “in” port; and so on, up to 6 devices in a single chain.

[Laptop TB port] --> [Device 1 IN|OUT] --> [Device 2 IN|OUT] --> [Device 3 IN|OUT] --> ...

All devices in the chain share the host port’s total bandwidth. A chain of a Thunderbolt dock, two monitors, and an external SSD on a Thunderbolt 3 port would split 40 Gbps across all of them.

This is unique to Thunderbolt. USB does not support daisy-chaining — USB devices connect through hubs in a tree (star) topology, and each hub adds latency and protocol overhead. Thunderbolt’s daisy-chain topology avoids the hub overhead but means that a single slow or bandwidth-heavy device in the chain can reduce available bandwidth for devices downstream of it.

See also

• External GPUs (eGPUs) — covers Thunderbolt bandwidth impact on eGPU performance with worked calculations
• NVME — NVMe SSDs use the same PCIe protocol that Thunderbolt tunnels; external NVMe enclosures connect via Thunderbolt
• IOMMU — the hardware mechanism behind Thunderbolt’s DMA protection
• Direct Memory Access — the memory access technique that makes Thunderbolt’s security model important