Low Pin Count

Signals

LPC control signals are active-low, as indicated by the "#" symbol in their names. Signals are divided into three categories:

• Unidirectional. These are driven from a single source at all times.
• Open-collector. These are low-speed signals which are pulled up (to the inactive state) by the host when not in use, and may be pulled down by any device.
• Bidirectional. These high-speed signals are actively driven high for one cycle whenever a device is done using them, after which weak pull-up resistors hold them high until another device begins using them.

The LPC specification defines seven mandatory signals required for bidirectional data transfer:

• LCLK (unidirectional, from host): 33.3 MHz clock. May be connected to the conventional PCI clock (PCICLK), thereby not requiring a dedicated pin on the host (south bridge). Like PCI, other signals are driven after the falling edge of LCLK, and received after the rising edge.
• LRESET# (open-collector): Active-low bus reset. May be connected to PCIRST#.
• LFRAME# (unidirectional, from host): This active-low signal indicates the beginning of an LPC bus transaction. Only the host may initiate bus transactions.
• LAD[3:0] (bidirectional): These four bidirectional signals carry multiplexed address, data, and other information.

There are six additional signals defined, which are optional for LPC devices that do not require their functionality, but support for the first two is mandatory for the host:

• LDRQ# (unidirectional, from device): DMA/bus master request. This is an output from a device that wants to perform direct memory access, either via the Intel 8237 compatible DMA controller, or the LPC-specific bus master protocol. The host must provide one corresponding input pin per device that needs it (minimum two).
• SERIRQ (bidirectional): Serialized Intel 8259 compatible interrupt signal. ^[6] One line is shared by all LPC devices and the host. Like the LAD lines, this has a weak pull-up which will maintain it high if no device is driving it.
• CLKRUN# (open-collector): Signal used to restart the clock in systems that can stop it for power management. Not required if the host does not stop the clock. May be connected to the equivalent PCI signal.
• LPME# (open-collector): Power management event, to wake the system from a sleep state. Equivalent to the PCI bus PME# signal.
• LSMI# (open-collector): System management interrupt request. This is only required if an LPC device needs to trigger an SMI# in response to a bus access (e.g. to perform software emulation of a missing hardware peripheral). Otherwise, the slower SERIRQ protocol can be used to request an SMI.
• LPCPD# (unidirectional, from host): Optional output from the host to warn the LPC device that power is about to be removed and it should not make any interrupt or DMA requests.

Timing and performance

The LPC bus derives its electrical conventions from those of conventional PCI. In particular, it shares the restriction that two idle cycles are required to "turn around" any bus signal so that a different device is "speaking". In the first, the bus is actively driven high. In the second, the bus is undriven and held high by the pull-up resistors. A new device may begin sending data over the bus on the third cycle. LPC operations spend a large fraction of their time performing such turn-arounds.

As mentioned, the LPC bus is designed to have performance similar to the ISA bus. The exact data transfer rates depend on the type of bus access (I/O, memory, DMA, firmware) performed and by the speed of the host and the LPC device. All bus cycles spend a majority of their time in overhead rather than data transfer—except the 16- and 128-byte firmware read cycles, which have 17 cycles of overhead but 32 and 256 cycles (respectively) of data transfer, achieving throughputs of 10.88 and 15.63 MB/s. ^[7] The next fastest bus cycle defined in the standard, the 32-bit ISA-style DMA write cycle, spends only 8 of 20 total clock cycles transferring data (the other 12 cycles are overhead), achieving up to 6.67 MB/s. ^[7]

One of the slowest bus cycles is a simple memory read or write, where only 2 of the 17 clock cycles (plus any wait states imposed by the device) transfer data, for a transfer rate of 1.96 MB/s.

Transaction structure

LPC transactions begin on a low-to-high transition of LFRAME#. While LFRAME# is low, the host places a 4-bit START code on the LAD lines. The code sent on the last cycle before LFRAME# transitions high defines the following bus transaction.

Normally, the host only holds LFRAME# low for a single clock cycle, for efficiency. An exception is the abort transaction, which may begin even in the middle of another operation. The host pulls LFRAME# low for a minimum of four clock cycles, during which any devices must cease to drive the LAD bus. On the fourth cycle, the host drives LAD high (to 1111). Upon the high-to-low transition of LFRAME#, the bus is reset to an idle state.

In almost all other cases, LPC transactions use the following general structure:

• START code
• Transaction type and address from host
• Data from host (if a write)
• Bus turnaround (2 cycles)
• SYNC from device (1 or more cycles)
• Data from device (if a read)
• Bus turnaround (2 cycles)

DMA transfers differ somewhat. § ISA-compatible DMA may have multiple SYNC and data phases. § Bus master DMA has a bus turnaround immediately following the START code and no final turnaround,

The SYNC phase allows the device to insert wait states in the transaction. There are six possible SYNC values, all with even parity (even Hamming weight). Three of them end the SYNC phase, while the other three cause the host to wait for another SYNC nibble:

• 0000: Ready. The device is ready to proceed with the transaction. For DMA cycles, this also clears the DMA request (DREQ) signal.
• 0011: (not used)
• 0101: Short wait. Another SYNC cycle follows. At most 8 short wait cycles are permitted.
• 0110: Long wait. Like short wait, but the wait may be long (e.g. Enhanced Parallel Port operations)
• 1001: Ready more. A DMA-only code that signals "Ready" and the device requests additional DMA cycles (DREQ remains asserted).
• 1010: Error. The device is ready to proceed, but there was some serious error (such as a parity error) with the transfer. This is equivalent to the ISA bus IOCHK# or PCI bus SERR# signals. In the case of a read, data follows but is likely to be corrupted.
• 1100: (not used)
• 1111: Device not present. If no device responds to the transaction, the host will see this code and can abort the transaction. To accommodate slow devices, up to 2 cycles of this code are permitted before the transaction is aborted.

Applications

Intel designed the LPC bus so that the system BIOS image could be stored in a single flash memory chip directly connected to the LPC bus. Intel also made it possible to put operating system images and software applications on a single flash memory chip directly connected to the LPC bus, as an alternative to a Parallel ATA port. ^[8]

A CPLD or FPGA can implement an LPC host or peripheral. ^[9]

The original Xbox game console has an LPC debug port that can be used to force the Xbox to boot new code. ^{[10] [11]}

ISA-compatible reads and writes

Memory and I/O accesses are allowed as single-byte accesses only, and operate as described in § Transactoin structure:: address, data from host if write, turnaround, SYNC, data from device if read.

If the host attempts a transfer to an unused address, no device will drive the SYNC cycles and the host will see 1111 on the LAD bus. After seeing three cycles of 1111 (two cycles are allowed, in addition to the two turn-around cycles, for a slow device to decode the address and begin driving SYNC patterns), the host will abort the operation.

ISA-compatible DMA

The Platform Controller Hub (PCH) chip or the southbridge chip acts as the host and controls the LPC bus. It also acts as the central DMA controller for devices on that bus if the memory controller is in the chipset. In CPUs that contain their own memory controller(s), the DMA controller is located in the CPU. For compatibility with software originally written for systems with the ISA bus, the DMA controller contains the circuit equivalents of "legacy" onboard peripherals of the IBM PC/AT architecture, such as the two programmable interrupt controllers, the programmable interval timer, and two ISA DMA controllers, which are all involved in "ISA-style DMA".

ISA-compatible DMA uses an Intel 8237-compatible DMA controller on the host, which keeps track of the location and length of the memory buffer, as well as the direction of the transfer. The device simply requests service from a given DMA channel number, and the host performs a DMA access on the LPC bus.

The request is made by a virtual ISA-compatible DMA request (DRQ) line, which is emulated using the device's LDRQ# signal to indicate transitions on the emulated DRQ line. This is done with 6-bit requests on the LDRQ# signal: a 0 start bit, the 3-bit DMA channel number (most significant bit first), one bit of new request level (almost always 1, indicating that a DMA transfer is requested), and a final 1 stop bit. The host responds by performing a DMA cycle at the next available opportunity. DMA cycles are named based on the direction of memory access, so a "read" is a transfer to the LPC device, and a "write" is a transfer from the LPC device.

The "address" consists of 6 bits sent as two nibbles: a 3-bit channel number and 1-bit terminal count indication (the ISA bus's TC pin, or the 8237's EOP# output), followed by a 2-bit transfer size.

By default, DMA channels 0–3 perform 8-bit transfers, and channels 5–7 perform 16-bit transfers; but an LPC-specific extension allows 1-, 2-, or 4-byte transfers on any channel. When a multi-byte transfer is performed, each byte has its own SYNC field, as described below.

A normal SYNC "ready" pattern of 0000 (or an error pattern of 1010) also causes a deassertion of the corresponding emulated DMA request signal; the host will stop DMA after the immediately following byte until the device makes another DMA request via the LDRQ# signal. A SYNC pattern of 1001 indicates that the host should consider he device's DMA request still active; the host will continue with any remaining bytes in this transfer or start another transfer, as appropriate, without a separate request via LDRQ#.

For a DMA write, where data is transferred from the device, the SYNC field is followed by the 8 bits of data and another SYNC field, until the host-specified length for this transfer is reached, or the device stops the transfer. A two-cycle turnaround field completes the transaction. For a DMA read, where data is transferred to the device, the SYNC field is followed by a turnaround, and the data—turnaround—sync—turnaround sequence repeats for each byte transferred.

Serialized interrupts

Interrupts are transmitted over a single shared SERIRQ line using the "serialized interrupts for PCI" protocol originally developed for the PCI bus. ^[6] The host periodically sends interrupt packets, within which each interrupt request is assigned a 1-clock time slot, separated by 2-clock turnaround cycles. The initial synchronization is done by the host. As a simplified example:

• The host drives the SERIRQ line low for four to eight clocks, followed by a 2-clock turnaround cycle: SERIRQ is driven high for 1 clock, then floats high for the second turnaround clock.
• If a device needs to request IRQ#6, it waits for 6×3=18 clocks, then drives SERIRQ low for one clock and high for another.

The devices can recognize the beginning of the frame because only the host will ever drive the line low for more than one cycle. The host identifies the interrupt by counting the number of clocks cycles: if it sees the SERIRQ line driven low at the eighteenth clock, then IRQ 18/3=6 is asserted.

The number of interrupt slots is system-specific, with 17 being a typical number: 16 ISA-compatible interrupts (IRQ0–IRQ15), plus NMI.

After the final interrupt slot, the host appends a "stop" signal consisting of two or three low cycles followed by two turnaround cycles.

In "continuous" mode, the host periodically initiates a new packet. There is also a "quiet" mode in which a device requests a new packet by driving SERIRQ low for one clock cycle. The host then continues driving the line low for the other seven clocks. From this point on, the protocol is the same.

The mode is controlled by the length of the host's stop signal at the end of each packet. If it consists of three clocks of low signal, continuous mode follows and only the host may begin a new packet. If the stop signal consists of two low clocks, quiet mode follows and any device may initiate an interrupt packet.

START = 1101, 1110: Firmware memory read and write

This allows the firmware (BIOS) to be located outside the usual peripheral address space. These transfers are similar to ISA-compatible transfers, except that:

• There is no CTDIR field; the direction is encoded in the START field (1101 for read, 1110 for write).
• The first 4 address bits are defined as a device select (IDSEL) field to allow the selection of one firmware hub out of many. For example, a second firmware hub can be used to hold a backup BIOS in case the primary BIOS is corrupted by malware or a bad flash.
• The remaining 28 address bits define the address within the device, most significant nibble first.
• The address is followed by a size field. Supported read/write sizes are 1, 2, and 4 bytes. Sizes of 16 and 128 bytes are supported for read only.
• The data is transferred in one continuous burst, with no wait states. There is only one SYNC field for the whole transfer.

START = 0010, 0011: Bus master DMA

Up to two devices on an LPC bus can request a bus master transfer by using the LDRQ# signal to request use of the reserved DMA channel 4. In this case, the host will begin a transfer with a special START field of 0010 for bus master 0 or 0011 for bus master 1, followed immediately by two turnaround cycles to hand the bus to the device requesting the bus master DMA cycle. Following the turnaround cycles, the transfer proceeds very much like a host-initiated ISA-compatible transfer with the roles reversed:

• The device sends a one-cycle CTDIR field (only I/O and memory transfer types are permitted).
• The device sends an address (16 or 32 bits, depending on the type). It is transferred most significant nibble first.
• The device sends a one-cycle transfer size field, encoding 8, 16 or 32 bits.
• In the case of a write, the data follows. Unlike ISA-compatible DMA cycles, the data is transferred in one burst, with no more wait states.
• Then come two turn-around cycles while the LAD bus is handed back to the host.
• A variable-length SYNC field is inserted, under control of the host.
• In the case of a read, the data provided by the host follows.

This differs from 16-bit ISA bus mastering because LPC bus mastering requires a 32-bit memory address when performing a memory transfer, does not use an ISA-style DMA channel, and can support 8, 16, or 32-bit transfers; while 16-bit ISA bus mastering requires a 24-bit memory address when performing a memory transfer, requires the use of an ISA-style DMA channel, and cannot perform 32-bit transfers. ^[12]

START = 0101: TPM Locality access

Recent Trusted Platform Module specifications define special TPM-Read cycles and TPM-Write cycles that are based on the I/O Read and the I/O Write cycles. ^[13] These cycles use a START field with the formerly-reserved value of 0101, followed by a CTDIR nibble and 16-bit I/O address just like an ISA-compatible write. ^[13] These cycles are used when using a TPM's locality facility. ^[13]