field values other than 0000 are used to indicate various non-ISA-compatible transfers. The supported transfers are: START = 1101, 1110 Firmware memory read and write This allows the firmware (BIOS) to be located outside the usual peripheral address space. These transfers are similar to ISA-compatible transfers, except that: There is no CTDIR field; the direction is encoded in the START field (1101 for read, 1110 for write). A chip select field of 4 bits exists to allow the selection of one firmware hub out of many. For example, a second firmware hub can be used to hold a backup BIOS in case the primary BIOS is corrupted by malware or a bad flash. The address is 28 bits. It is transferred most significant nibble first. The address is followed by a size field. Supported read/write sizes are 1, 2, and 4 bytes. Supported read-only sizes are 16 or 128 bytes. The data is transferred in one continuous burst, with no wait states. There is only one SYNC field for the whole transfer. START = 0010, 0011 Bus master DMA Up to two devices on an LPC bus can request a bus master transfer by using the LDRQ# signal to request use of the reserved DMA channel 4. In this case, the host will begin a transfer with a special START field of 0010 for bus master 0 or 0011 for bus master 1, followed immediately by two turnaround cycles to hand the bus to the device requesting the bus master DMA cycle. Following the turnaround cycles, the transfer proceeds very much like a host-initiated ISA-compatible transfer with the roles reversed: The device sends a one-cycle CTDIR field (only I/O and memory transfer types are permitted). The device sends an address (16 or 32 bits, depending on the type). It is transferred most significant nibble first. The device sends a one-cycle transfer size field, encoding 8, 16 or 32 bits. In the case of a write, the data follows. Unlike ISA-compatible DMA cycles, the data is transferred in one burst, with no more wait states. Then come two turn-around cycles while the LAD bus is handed back to the host. A variable-length SYNC field is inserted, under control of the host. In the case of a read, the data provided by the host follows. This is different from 16-bit ISA bus mastering because LPC bus mastering requires a 32-bit memory address