Typical PNP devices are Super I/Os, LPC-connected TPMs and board management controllers.
PNP devices are usually connected to the LPC or eSPI bus of a system and shouldn’t be confused with PCI(e) devices that use a completely different plug and play mechanism. PNP originates in the ISA plug and play specification. Since the original ISA bus is more or less extinct, the auto-detection part of ISA PNP is mostly irrelevant nowadays. For the register offsets for different functionality, appendix A of that specification is still the main reference though.
Configuration access and config mode¶
Super I/O chips connected via LPC to the southbridge usually have their
I/O-mapped configuration interface with a size of two bytes at the base
0x4e. Other PNP devices have their configuration
interface at other addresses.
The two byte registers allow access to an indirect 256 bytes big
register space that contains the configuration. By writing the index to
the lower byte (e.g.
0x2e), you can access the register contents at
that index by reading/writing the higher byte (e.g.
To prevent accidental changes of the Super I/O (SIO) configuration, the SIOs need a configuration mode unlock sequence. After changing the configuration, the configuration mode should be left again, by sending the configuration mode lock sequence.
Logical device numbers (LDN)¶
Each PNP device can contain multiple logical devices. The bytes from
0x2f in the indirect configuration register space are common
for all LDNs, but some SIO chips require a certain LDN to be selected in
order to write certain registers in there. An LDN gets selected by
writing the LDN number to the LDN select register
0xff are specific to each LDN number.
coreboot encodes the physical LDN number in the lower byte of the LDN number.
Virtual logical device numbers¶
0x30 is the LDN enable register and since it is an 8 bit
register, it can contain up to 8 enable bits for different parts of
the functionality of that logical device. To set a certain enable bit
in one physical LDN, the concept of virtual LDNs was introduced.
Virtual LDNs share the registers of their base LDN, but allow to
specify which part of a LDN should be enabled.
coreboot encodes the enable bit number and by that the virtual LDN part in the lower 3 bits of the higher byte of the LDN number.
Starting at register address
0x60, each LDN has 2 byte wide I/O base
address registers. The size of an I/O resource is always a power of
I/O resource masks¶
The I/O resource masks encode both the size and the maximum base address of the corresponding IO resource. The number of zeros counted from the least significant bit encode the resource size. If N is the number of LSBs being zero, which can also be zero if the LSB is a one, the resource has N address bits and a size of 2**N bytes. The mask address is also the highest possible address to map the I/O region.
A typical example for an I/O resource mask is
0x07f8 which is
0b0000011111111000 in binary notation. The three LSBs are zeros here,
so it’s an eight byte I/O resource with three address offset bits
inside the resource. The highest base address it can be mapped to is
0x07f8, so the region will end at
The Super I/O datasheets typically contain the information about the
I/O resource masks. On most Super I/O chips the mask can also be found
out by writing
0xffff to the corresponding I/O base address register
and reading back the value; since the lowest and highest bits are
hard-wired to zero according to the I/O resource size and maximal
possible I/O address, this gives the mask.
Each physical LDN has up to two configurable interrupt request register
0x73. Each pair can be configured to
use a certain IRQ number. Writing 1 to 15 into the first register
selects the IRQ number generated by the corresponding IRQ source and
enables IRQ generation; writing 0 to it disables the generation of IRQs
for the source. The second register selects the IRQ type (level or edge)
and IRQ level (high or low). For LPC SIOs the IRQ type is hard-wired to
On the LPC bus a shared SERIRQ line is used to signal IRQs to the host; the IRQ number gets encoded by the number of LPC clock cycles after the start frame before the device pulls the open drain connection low.
SERIRQ can be used in two different modes: In the continuous SERIRQ mode the host continuously sends IRQ frame starts and the devices signal their IRQ request by pulling low the SERIRQ line at the right time. In quiet SERIRQ mode the host doesn’t send IRQ frame starts, so the devices have to send both the IRQ frame start and the encoded IRQ number. The quiet mode is often broken.
Each physical LDN has two legacy ISA-style DMA request channel
0x75. Those are only used for legacy devices
like parallel printer ports or floppy disk controllers.
Each device using LPC legacy DMA needs its own LDMA line to the host. Some newer chipsets have dropped the LDMA line and with that the legacy DMA capability on LPC.