Engineering:Low Pin Count

From HandWiki
Short description: Low-bandwidth computer motherboard bus
Low Pin Count
Low Pin Count
Year created1998
Created byIntel
SupersedesIndustry Standard Architecture
Superseded byEnhanced Serial Peripheral Interface Bus (2016)
Width in bits4
Speed33 MHz
StyleParallel
Hotplugging interfaceno
External interfaceno
Low Pin Count interface Winbond chip
Trusted Platform Module installed on a motherboard, and using the LPC bus

The Low Pin Count (LPC) bus is a computer bus used on IBM-compatible personal computers to connect low-bandwidth devices to the CPU, such as the BIOS ROM (BIOS ROM was moved to the Serial Peripheral Interface (SPI) bus in 2006[1]), "legacy" I/O devices (integrated into Super I/O, Embedded Controller, CPLD, and/or IPMI chip), and Trusted Platform Module (TPM).[2] "Legacy" I/O devices usually include serial and parallel ports, PS/2 keyboard, PS/2 mouse, and floppy disk controller.

Most PC motherboards with an LPC bus have either a Platform Controller Hub (PCH) or a southbridge chip, which acts as the host and controls the LPC bus. All other devices connected to the physical wires of the LPC bus are peripherals.

Overview

A diagram showing the LPC bus connecting the southbridge, the flash ROM, and the Super I/O chip

The LPC bus was introduced by Intel in 1998 as a software-compatible substitute for the Industry Standard Architecture (ISA) bus. It resembles ISA to software, although physically it is quite different. The ISA bus has a 16-bit data bus and a 24-bit address bus that can be used for both 16-bit I/O port addresses and 24-bit memory addresses; both run at speeds up to 8.33 MHz. The LPC bus uses a heavily multiplexed four-bit-wide bus operating at four times the clock speed (33.3 MHz) to transfer addresses and data with similar performance.

LPC's main advantage is that the basic bus requires only seven signals, greatly reducing the number of pins required on peripheral chips. An integrated circuit using LPC will need 30 to 72 fewer pins than its ISA equivalent. It is also easier to route on modern motherboards, which are often quite crowded. The clock rate was chosen to match that of PCI in order to further ease integration. Also, LPC is intended to be a motherboard-only bus. There is no standardized connector in common use, though Intel defines one for use for debug modules,[3] and few LPC peripheral daughterboards are available, including Trusted Platform Modules (TPMs) with a TPM daughterboard whose pinout is proprietary to the motherboard vendor[2] as well as POST cards for displaying BIOS diagnostic codes and proprietary cards such as RS-232 and Parallel port devices for industrial use.[4] Device discovery is not supported; since only motherboard devices or specific models of TPM are connected, the host firmware (BIOS, UEFI) image will include a static description of any devices and their I/O addresses expected to be present on a particular motherboard.

Signals

The LPC specification defines seven mandatory signals required for bidirectional data transfer:

  • LCLK: 33.3 MHz clock, provided by the host. May be connected to the conventional PCI clock (PCICLK), thereby not requiring a dedicated pin on the host (south bridge).
  • LRESET#: Active-low bus reset. May be connected to PCIRST#.
  • LFRAME#: This active-low signal indicates the beginning of an LPC bus transaction. Driven by the host only.
  • LAD[3:0]: These four bidirectional signals carry multiplexed address, data, and other information. Like the previous two control signals, these signals have weak pull-up resistors on them, so they will remain in the all-ones state if not actively driven by a device.

There are six additional signals defined, which are optional for LPC devices that do not require their functionality, but support for the first two is mandatory for the host:

  • LDRQ#: DMA/bus master request. This is an output from a device that wants to perform direct memory access, either via the Intel 8237 compatible DMA controller, or the LPC-specific bus master protocol. The host must provide one corresponding input pin per device that needs it (minimum two).
  • SERIRQ: Serialized Intel 8259 compatible interrupt signal.[5] One line is shared by all LPC devices and the host.
  • CLKRUN#: Open-collector signal used to restart the clock in systems that can stop it for power management. Not required if the host does not stop the clock. May be connected to the equivalent PCI signal.
  • LPME#: Open-collector power management event, to wake the system from a sleep state. Equivalent to the PCI bus PME# signal.
  • LPCPD#: Optional output from the host to warn the LPC device that power is about to be removed and it should not make any interrupt or DMA requests.
  • LSMI#: System management interrupt request. This is only required if an LPC device needs to trigger an SMI# in response to a bus access (e.g. to perform software emulation of a missing hardware peripheral). Otherwise, the slower SERIRQ protocol can be used to request an SMI.

Timing and performance

The LPC bus derives its electrical conventions from those of conventional PCI. In particular, it shares the restriction that two idle cycles are required to "turn around" any bus signal so that a different device is "speaking". In the first, the bus is actively driven high. In the second, the bus is undriven and held high by the pull-up resistors. A new device may begin sending data over the bus on the third cycle. LPC operations spend a large fraction of their time performing such turn-arounds.

As mentioned, the LPC bus is designed to have performance similar to the ISA bus. The exact data transfer rates depend on the type of bus access (I/O, memory, DMA, firmware) performed and by the speed of the host and the LPC device. All bus cycles spend a majority of their time in overhead rather than data transfer - except the 128-byte firmware read cycle, in which 256 of the 273 clock ticks consumed by this cycle actually are used to transfer data to get a throughput of 15.63 MB/s.[6] The next fastest bus cycle, the 32-bit ISA-style DMA write cycle that is defined in this standard, can transfer up to 6.67 MB/s because only 8 out of 20 clock ticks used in this bus cycle actually transfer data while the rest of the cycles are overhead.[6]

One of the slowest bus cycles is a simple memory read or write, where only 2 of the 17 clock ticks (plus any wait states imposed by the device) transfer data, for a transfer rate of 1.96 MB/s.

Applications

Intel designed the LPC bus so that the system BIOS image could be stored in a single flash memory chip directly connected to the LPC bus. Intel also made it possible to put operating system images and software applications on a single flash memory chip directly connected to the LPC bus, as an alternative to a Parallel ATA port.[7]

A CPLD or FPGA can implement an LPC host or peripheral.[8]

The original Xbox game console has an LPC debug port that can be used to force the Xbox to boot new code.[9][10]

ISA-compatible operation

All LPC bus transactions are initiated by the host briefly driving LFRAME# low, for one cycle at least. During the last cycle with LFRAME# low (referred to as the START field), the host drives LAD[3:0] to all-zeros to indicate an ISA-compatible transaction will follow.[6] During the first cycle with LFRAME# high again, the host drives a "cycle type/direction" (CTDIR) field: three bits indicating the type (I/O, memory, or DMA) and direction (read from device, or write to device) of the transfer to follow. This is usually followed by the transfer address field. The size of the address depends on the type of cycle:

  • For I/O access, the address is 16 bits, transferred most-significant nibble first over 4 cycles.
  • For system memory access, the address is 32 bits, transferred most-significant nibble first over 8 cycles.
  • ISA-style DMA accesses do not have an address per se, but a two clock cycles transfer a nibble containing the DMA channel number, and a second nibble giving the transfer size. The memory address is programmed into the ISA-style DMA controller in the chipset or the CPU outside of the LPC bus. See the section on DMA below.

ISA-compatible reads and writes

Memory and I/O accesses are allowed as single-byte accesses only.

For a write, the address described above is followed by the data field, 8 bits transferred with the least significant nibble first over two cycles.

Following this, the host turns the bus over to the device. This turn-around takes two cycles, and operates the same way as the conventional PCI bus control signals: for one cycle, the host drives the LAD lines high (1111). During the second cycle, the host ceases to drive the lines, although they remain high due to the pull-up resistors. The device may drive the lines beginning with the third cycle.

Following any turn-around to the device is a minimum of one SYNC cycle. The number is variable, under the control of the device to add as many wait states as it needs. The bit patterns 0101 and 0110 indicate that the sync cycles will continue. The wait ends when the device drives a pattern of 0000 (ready) or 1010 (error) on the LAD bus for one cycle.

In the case of reads, this is followed by 8 bits of data, transferred least significant nibble first over two cycles, the same as for a write.

The device then turns the bus around to the host again (taking another two cycles), and the transfer is complete; the host may send the START field of another transfer on the next cycle.

If the host attempts a transfer to an unused address, no device will drive the SYNC cycles and the host will see 1111 on the LAD bus. After seeing three cycles of 1111 (two cycles are allowed, in addition to the two turn-around cycles, for a slow device to decode the address and begin driving SYNC patterns), the host will abort the operation.

ISA-compatible DMA

The Platform Controller Hub (PCH) chip or the southbridge chip acts as the host and controls the LPC bus. It also acts as the central DMA controller for devices on that bus if the memory controller is in the chipset. In CPUs that contain their own memory controller(s), the DMA controller is located in the CPU. For compatibility with software originally written for systems with the ISA bus, the DMA controller contains the circuit equivalents of "legacy" onboard peripherals of the IBM PC/AT architecture, such as the two programmable interrupt controllers, the programmable interval timer, and two ISA DMA controllers, which are all involved in "ISA-style DMA".

ISA-compatible DMA uses an Intel 8237-compatible DMA controller on the host, which keeps track of the location and length of the memory buffer, as well as the direction of the transfer. The device simply requests service from a given DMA channel number, and the host performs a DMA access on the LPC bus.

DMA requests are made using the device's LDRQ# signal. Normally high, a device can indicate a transition on an ISA-compatible DRQ line by sending a 6-bit request: a 0 start bit, the 3-bit DMA channel number (most significant bit first), one bit of new request level (almost always 1, indicating that a DMA transfer is requested), and a final 1 stop bit. The host then performs a DMA cycle. DMA cycles are named based on the memory access, so a "read" is a transfer from memory to the device, and a "write" is a transfer from the device to memory.

The "address" consists of two cycles: a 3-bit channel number and 1-bit terminal count indication (the ISA bus's TC pin, or the 8237's EOP# output), followed by a 2-bit transfer size.

By default, DMA channels 0–3 perform 8-bit transfers, and channel 5–7 perform 16-bit transfers; but an LPC-specific extension allows 1-, 2-, or 4-byte transfers on any channel. When a multi-byte transfer is performed, each byte has its own SYNC field, as described below. DMA transfers allow an additional SYNC field value: a pattern of 1001 indicates that the device is ready with the current byte, and also wishes to transfer more bytes. The standard "ready" pattern of 0000 indicates that this is the last byte.

A normal SYNC "ready" pattern of 0000 (or an error pattern of 1010) requests that the host stop DMA after the immediately following byte until the device makes another DMA request via the LDRQ# signal. A pattern of 1001 indicates that the host should consider he device's DMA request still active; the host will continue with any remaining bytes in this transfer or start another transfer, as appropriate, without a separate request via LDRQ#.

For a DMA write, where data is transferred from the device, the SYNC field is followed by the 8 bits of data and another SYNC field, until the host-specified length for this transfer is reached, or the device stops the transfer. A two-cycle turnaround field completes the transaction. For a DMA read, where data is transferred to the device, the SYNC field is followed by a turnaround, and the data—turnaround—sync—turnaround sequence repeats for each byte transferred.

Serialized interrupts

Serialized interrupts are transmitted over a single shared SERIRQ line with the help of the clock. A time slot is dedicated to each interrupt request, with the initial synchronization being done by the host.[5] As a simplified example:

  • The host drives the SERIRQ line low for eight clocks, then high for another, and lets the bus float for a final turnaround cycle.
  • If a device needs to request IRQ#6, it waits for 6×3=18 clocks, then drives SERIRQ low for a clock and high for another.

The devices can synchronize at the first step because the line can only be driven low for two or more consecutive clocks by the host: no other device drives it low for more than one clock. The host recognizes the sources of the interrupts by watching the line while counting the number of clocks: if it sees the SERIRQ line being driven low at the eighteenth clock, then IRQ 18/3=6 is asserted.

The above is the continuous mode, where the host initiates the protocol. In the quiet mode, a device requests interruption by driving SERIRQ low for a clock. The host then continues driving the line low for the other seven clocks. From this point on, the protocol is the same. In both modes, the number of clocks of the initial synchronization pulse may range from four to eight.

At the beginning, the protocol works in continuous mode. At the end of each complete bus transaction (after the host has driven SERIRQ low and then waited for all devices to send interrupt requests) the host sends a final message: it drives the SERIRQ line low for two or three clocks depending on the mode that will be used in the next transaction.

The advantage of using serialized interrupts over the traditional mechanism is that only the single SERIRQ line is necessary (apart from the clock, which is present anyway), not a line for each interrupt level.

LPC non-ISA cycles

START field values other than 0000 are used to indicate various non-ISA-compatible transfers.[6] The supported transfers are:

START = 1101, 1110
Firmware memory read and write
This allows the firmware (BIOS) to be located outside the usual peripheral address space. These transfers are similar to ISA-compatible transfers, except that:
  • There is no CTDIR field; the direction is encoded in the START field (1101 for read, 1110 for write).
  • A chip select field of 4 bits exists to allow the selection of one firmware hub out of many. For example, a second firmware hub can be used to hold a backup BIOS in case the primary BIOS is corrupted by malware or a bad flash.
  • The address is 28 bits. It is transferred most significant nibble first.
  • The address is followed by a size field. Supported read/write sizes are 1, 2, and 4 bytes. Supported read-only sizes are 16 or 128 bytes.
  • The data is transferred in one continuous burst, with no wait states. There is only one SYNC field for the whole transfer.
START = 0010, 0011
Bus master DMA
Up to two devices on an LPC bus can request a bus master transfer by using the LDRQ# signal to request use of the reserved DMA channel 4. In this case, the host will begin a transfer with a special START field of 0010 for bus master 0 or 0011 for bus master 1, followed immediately by two turnaround cycles to hand the bus to the device requesting the bus master DMA cycle. Following the turnaround cycles, the transfer proceeds very much like a host-initiated ISA-compatible transfer with the roles reversed:
  • The device sends a one-cycle CTDIR field (only I/O and memory transfer types are permitted).
  • The device sends an address (16 or 32 bits, depending on the type). It is transferred most significant nibble first.
  • The device sends a one-cycle transfer size field, encoding 8, 16 or 32 bits.
  • In the case of a write, the data follows. Unlike ISA-compatible DMA cycles, the data is transferred in one burst, with no more wait states.
  • Then come two turn-around cycles while the LAD bus is handed back to the host.
  • A variable-length SYNC field is inserted, under control of the host.
  • In the case of a read, the data provided by the host follows.
  • This is different from 16-bit ISA bus mastering because LPC bus mastering requires a 32-bit memory address when performing a memory transfer, does not use an ISA-style DMA channel, and can support 8, 16, or 32-bit transfers; while 16-bit ISA bus mastering requires a 24-bit memory address when performing a memory transfer, requires the use of an ISA-style DMA channel, and cannot perform 32-bit transfers.[11]
START = 1111
Transaction abort
At any time, although typically in response to an error by the device during a SYNC field, the host may abort the current transaction by driving LFRAME# low without waiting for the current transaction to end. It must hold it low for at least 4 cycles, then return it high with a special START field value of 1111. This performs a soft reset of the LPC bus and leaves the bus idle until the next transfer is commenced by driving LFRAME# low again.
START = 0101
TPM Locality access
Recent Trusted Platform Module specifications define special TPM-Read cycles and TPM-Write cycles that are based on the I/O Read and the I/O Write cycles.[12] These cycles use a START field with the formerly-reserved value of 0101 and place a 16-bit memory address offset in the address field.[12] These cycles are used when using a TPM's locality facility.[12]

Supported peripherals

The LPC bus specification limits what type of peripherals may be connected to it. It only allows devices that belong to the following classes of devices: super I/O devices, nonvolatile BIOS memory, firmware hubs, audio devices, and embedded controllers. Furthermore, each class is restricted on which bus cycles are allowed for each class.[6]

Super I/O devices and audio devices are allowed to accept I/O cycles, accept ISA-style third-party DMA cycles, and generate bus master cycles. Generic-application memory devices like nonvolatile BIOS memory and LPC flash devices are allowed to accept memory cycles. Firmware hubs are allowed to accept firmware memory cycles. Embedded controllers are allowed to accept I/O cycles and generate bus master cycles. Some ISA cycles that were deemed not useful to these classes were removed. They include host-initiated two-byte memory cycles and host-initiated two-byte I/O cycles. These removed transfer types could be initiated by the host on ISA buses but not on LPC buses. The host would have to simulate two-byte cycles by splitting them up into two one-byte cycles. The ISA bus has a similar concept because the original 8-bit ISA bus required 16-bit cycles to be split up. Therefore, the 16-bit ISA bus automatically split 16-bit cycles into 8-bit cycles for the benefit of 8-bit ISA peripherals unless the ISA device being targeted by a 16-bit memory or I/O cycle asserted a signal that told the bus that it could accept the requested 16-bit transfer without assistance from an ISA cycle splitter.[11] ISA-style bus mastering has been replaced in the LPC bus with a bus mastering protocol that does not rely on the ISA-style DMA controllers at all. This was done in order to remove ISA's limit on what type of bus master cycles a device is allowed to initiate on which DMA channel. The ISA-style bus cycles that were inherited by LPC from ISA are one-byte host-initiated I/O bus cycles, one-byte host-initiated memory cycles, and one- or two-byte host-initiated ISA-style DMA cycles.[6]

However, some non-ISA bus cycles were added. Cycles that were added to improve the performance of devices beside firmware hubs include LPC-style one-, two-, and four-byte bus master memory cycles; one-, two-, and four-byte bus master I/O cycles; and 32-bit third-party DMA which conforms to all of the restrictions of ISA-style third-party DMA except for the fact that it can do 32-bit transfers. Any device that is allowed to accept traditional ISA-style DMA is also allowed to use this 32-bit ISA-style DMA. The host could initiate 32-bit ISA-style DMA cycles, while peripherals could initiate bus master cycles. Firmware hubs consumed firmware cycles that were designed just for firmware hubs so that firmware addresses and normal memory-mapped I/O addresses could overlap without conflict. Firmware memory reads could read 1, 2, 4, 16, or 128 bytes at once. Firmware memory writes could write one, two or four bytes at once.[6]

See also

References

  1. ↑ https://images.slideplayer.com/26/8671671/slides/slide_5.jpg [bare URL image file]
  2. ↑ 2.0 2.1 Johannes Winter (2011). "A Hijacker's Guide to the LPC bus". tugraz.at. https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=59565. 
  3. ↑ https://web.archive.org/web/20170604011724/https://www.usbid.com/datasheets/usbid/2000/2000-q1/lpc_mod_spec72.pdf
  4. ↑ https://www.dfi.com/product/index/349#specification
  5. ↑ 5.0 5.1 Serialized IRQ Support For PCI Systems (Revision 6.0; September 1, 1995)
  6. ↑ 6.0 6.1 6.2 6.3 6.4 6.5 6.6 "Intel Chipsets Low Pin Count Interface Specification" (in en). Intel. http://www.intel.com/design/chipsets/industry/lpc.htm. 
  7. ↑ Dagan, Sharon (2002-05-03). "Flash Storage Alternatives for the Low-Pin-Count (LPC) Bus". EE Times. http://www.eetimes.com/document.asp?doc_id=1255061. 
  8. ↑ "LPC Bus Controller. Reference Design RD1049" (in en) (PDF). Lattice Semiconductor. http://www.latticesemi.com/~/media/Documents/ReferenceDesigns/LPCLowPinCountBusControllerReferenceDesignDocumentation.ashx. 
  9. ↑ Huang, Andrew (2003). Hacking the Xbox: An Introduction to Reverse Engineering. pp. 48, 151. ISBN 1-59327-029-1. https://www.nostarch.com/xboxfree. 
  10. ↑ O. Theis. "Modding the XBox". section "Details of the LPC".
  11. ↑ 11.0 11.1 Intel Corp. (2003-04-25), "Chapter 12: ISA Bus", PC Architecture for Technicians: Level 1, http://faculty.chemeketa.edu/csekafet/elt256/pcarch-full_isa-bus.pdf, retrieved 2015-01-27 
  12. ↑ 12.0 12.1 12.2 "TCG PC Client Platform TPM Profile (PTP) Specification". Trusted Computing Group. January 26, 2015. pp. 29, 123–124. https://trustedcomputinggroup.org/wp-content/uploads/PC-Client-Specific-Platform-TPM-Profile-for-TPM-2-0-v43-150126.pdf. .

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Engineering:Low_Pin_Count&oldid=3256180"