Docking, Thunderbolt and USB4

What is it?

This roadmap owns external expansion: USB-C docks, Thunderbolt and USB4 topology, the security policy that decides whether a device plugged into a Thunderbolt port may reach memory, display alt-mode hand-off, the eGPU boundary, dock power and wake events, hot-plug storms and a report of external DMA risk. It does not write the drivers for the devices inside a dock; it owns the fabric and the policy around them. Nothing in it has shipped.

What happens with a dock today?

Very little. The pieces a dock needs are missing or partial:

USB hubs are not enumerated, so devices behind a USB-C dock's hub are invisible; only root-port devices work (USB Stack).
PCIe hot-plug is not implemented (Hot-Plug and Surprise Removal), so a Thunderbolt device that appears after boot is never enumerated.
There is no IOMMU driver (Security Hardware and DMA Safety), so nothing could stop an external PCIe device from writing anywhere in memory.
Only one screen is driven (GPU and Display Drivers), so an alt-mode display on a dock is not used.

Hot-plug exists only for single ports. On an xHCI controller with MSI, a root-port connect enumerates the new device and a disconnect is only logged, with the device slot not released. That enumeration runs inside the interrupt handler on the event ring the foreground USB code also polls, so a hot-plug during USB storage I/O can swallow that I/O's completion and block the CPU for the whole enumeration; the fix, deferring enumeration to a worker, is owned by Hot-Plug Interrupt Handling (USB Stack). The AHCI interrupt handler detects insertion and removal through ahci_hotplug.c (logging Port N: hot-plug insertion detected), and the VirtIO block driver has hot-plug and surprise-removal functions (blk.h) that nothing calls yet. None of these is a dock topology.

How will it work?

A topology tree. An expansion_node_t represents each dock, port and tunnelled bus, and the USB, PCIe, display, audio and network devices behind a dock hang under its physical node, so Device Manager can show the dock as one thing with its ports, authorisation, bandwidth and child health.

Security before PCIe. Thunderbolt and USB4 can tunnel PCIe, which gives a plugged-in device direct memory access. The planned security levels are disabled, user-authorised, secure-connect and internal-only, and external PCIe tunnelling is never authorised without an active IOMMU. Tunnelled devices stay blocked until authorised and are revoked and surprise-removed safely on unplug. Devices blocked for want of an IOMMU or by policy appear in an external DMA risk report, and denials are recorded in BlackBox.

Displays, eGPUs and power. Alt-mode display changes are passed to the display stack, and eGPU support has a defined boundary with a safe failure. Dock power buttons, lid-like events and wake sources are surfaced as events.

Storms. Docking can attach dozens of devices at once. Attach and detach bursts are coalesced, and child drivers probe only after the fabric settles.

flowchart LR
    D[Dock or TBT/USB4 port] --> N[expansion_node_t tree]
    N --> U[USB children]
    N --> P[Tunnelled PCIe]
    N --> V[Alt-mode display]
    P --> A{Authorised and IOMMU on?}
    A -- yes --> E[Enumerate device]
    A -- no --> R[Blocked: DMA risk report + BlackBox]

What are its interfaces?

None yet. The planned surface is the expansion_node_t topology, the Thunderbolt security level setting, device authorisation, Device Manager topology details and the external DMA risk report.

How do I use it?

You cannot yet. Connect disks to SATA ports and other devices to a root USB port, before booting.

What is not implemented yet?

Everything:

Topology and classification (External Expansion Topology Model, USB-C Dock and Hub Classification).
Security (Thunderbolt/USB4 Security Policy, PCIe Tunneling Authorization, External DMA Risk Report), which needs the IOMMU driver.
Displays and power (Display Alt-mode and eGPU Boundary, Dock Power and Wake Events).
Robustness, diagnostics and certification (Hot-Plug Storm Resilience, Device Manager Topology, Certification Matrix).

How does it compare with Windows 11 and Linux?

Windows 11 manages Thunderbolt through its USB4 and Thunderbolt drivers and relies on Kernel DMA Protection, which uses the IOMMU to block external devices until they are trusted. Linux's thunderbolt driver exposes security levels in sysfs, with the bolt daemon handling authorisation. Impossible OS plans the same IOMMU-first rule plus a single external DMA risk report, and has no dock or Thunderbolt support today.