As the PC developed, the simple idea of having just one set of buses (the address bus, the data bus and the control bus) which connected everything to everything was found wanting. The problem is that different parts of the system operate at different speeds and require different bus widths, so the “one size fits all” approach leads to unacceptable data transfer bottlenecks.
In order to try to reduce these bottlenecks, a number of different buses were intro- duced which were tailored to connect particular parts of the system together. In the early designs, these buses might be called, for example, theprocessor bus, theI/O (input–output)busand thememory bus.
At Fig. 4.5 we see a typical case, where the processor bus connects the processor both to the bus controller chipset and to the external cache memory (ignoring for the moment the connection to the local bus). This processor bus is a high-speed bus, which for the Pentium might have 64 data lines, 32 address lines and various control lines, and would operate at the external clock rate. For a 66 MHz motherboard clock speed, this means that the maximum transfer rate, orbandwidth, of the processor data bus would be 66 × 64 = 4224 Mbit per second.
Continuing with our example case, the memory bus is used to transfer infor- mation from the processor to the maindynamic random access memory(DRAM) chips of the system. This bus is often controlled by special memory controller chips in the bus controller chipset because the DRAM operates at a significantly slower speed than the processor. The main memory data bus will probably be the same size as the processor data bus, and this is what defines abankof memory. When adding more DRAM to a system, it has to be added, for example, 32 bits at a time if the processor has a 32 bit data bus. For 30 pin, 8 bit SIMMs (see later section on memory),
Processor External cache Main memory Bus controller chipset Processor bus
I/O bus I/O bus
Built in I/O Memory bus Expansion cards ISA MCA EISA Expansion cards Local bus
four modules will be required to be added at a time. For 72 pin, 32 bit SIMMs, then only one module is required to be added at a time.
In our example case, the I/O bus is the main bus of the system. It connects the processor, through the chipset, to all the internal I/O devices, such as the primary and secondaryIDE(Integrated Drive Electronics) controllers, the floppy disk controller, the serial and parallel ports, the video controller and, possibly, an integrated mouse port. It also connects the processor, through the chipset, to the expansion slots. Newer chipsets were designed to incorporate what is called bus mastering, a technique whereby a separate bus controller processor takes control of the bus and executes instructions independently of the main processor.
I/O bus architectures have evolved since the first PC, albeit rather slowly. The requirement has always been quite clear. In order to capitalize on the rapid improve- ments that have taken place in chip and peripheral technologies, there is a need to increase significantly the amount of data that can be transferred at one time and the speed at which it can be done. The reason for the relatively slow rate of change in this area has been the need to maintain backward compatibility with existing systems, particularly with respect to expansion cards.
The original IBM PC bus architecture used an 8 bit data bus which ran at 4.77 MHz and became known as theIndustry Standard Architecture(ISA). With the introduction of the PC AT, the ISA data bus was increased to 16 bits and this ran first at 6 MHz and then at 8 MHz. However, because of the need to support both 8 bit and 16 bit expansion cards, the industry eventually standardized on 8.33 MHz as the maximum transfer rate for both sizes of bus, and developed an expansion slot connector which would accept both kinds of cards. We rarely see ISA connector slots on motherboards today.
When the 32 bit processors became available, manufacturers started to look at extensions to the ISA bus which would permit 32 data lines. Rather than extend the ISA bus again, IBM developed a proprietary 32 bit bus to replace ISA calledMicro Channel Architecture(MCA). Because of royalty issues, MCA did not achieve wide industry acceptance and a competing 32 bit data bus architecture was established calledExtended Industry Standard Architecture(EISA) which can handle 32 bits of data at 8.33 MHz.
All three of these bus architectures (ISA, MCA and EISA) run at relatively low speed and as Graphical User Interfaces (GUIs) became prevalent, this speed restriction proved to be an unacceptable bottleneck, particularly for the graphics display. One early solution to this was to move some of the expansion card slots from the traditional I/O bus and connect them directly to the processor bus. This became known as alocal bus, and an example of this is shown in our example at Fig. 4.5. The most popular local bus design was known as theVideo Electronics Standards Associ- ation(VESA) Local Busor justVL-Busand this provided much improved perfor- mance to both the graphics and the hard disk controllers.
Several weaknesses were seen to be inherent in the VL-Bus design. In 1992 a group led by Intel produced a completely new specification for a replacement bus archi- tecture. This is known asPeripheral Component Interconnect(PCI). Whereas VL-Bus links directly into the very delicate processor bus, PCI inserts a bridge between the processor bus and the PCI local bus. This bridge also contains the memory controller that connects to the main DRAM chips. The PCI bus operates at 33 MHz and at the full data bus width of the processor. New expansion sockets that connect directly to
the PCI bus were designed and these, together with expansion sockets for updated versions of this bus, are what are likely to be found on most modern motherboards. The design also incorporates an interface to the traditional I/O bus, whether it be ISA, EISA or MCA, and so backward compatibility is maintained.
Further development of this approach led to theNorthbridgeand Southbridge chipset that we find in common use today. At Fig. 4.6 we show a typical layout diagram of a motherboard that uses these chipsets. The Northbridge chip connects via a high-speed bus, known as theFront Side Bus(FSB) directly to the processor. We have attempted, in the diagram, to give some idea of relative performance of the various buses by making the thickness of the connecting lines indicative of their transfer rates. We may note that the memory slots are connected to the Northbridge chip, as is theAccelerated Graphics Port(AGP).More recently, we may find high- performancePCI Expressslots connected to both the Northbridge and Southbridge chips. This is a very fast serial bus consisting of between 1 and 32lanes, with each lane having a transfer capability of up to 2.5 gigabits per second.
The Northbridge chip is connected to the Southbridge chip, which in turn connects to a wide variety of devices, such as the PCI expansion slots, theSerial ATA (SATA) disk interface, the Parallel ATA (PATA) disk interface, the sound system, Ethernet, the ISA bus (if one exists) and so forth. In addition, the slower speed devices, such as the parallel port (for printers), the serial communication ports, the PS2 mouse port, the floppy disks and the keyboard, are often connected to the Southbridge chips via aSuper IOchip, as shown in Fig. 4.6.
Intel then introduced the Intel Hub Architecture(IHA)3where, effectively, the Northbridge chip is replaced by the Memory Controller Hub (MCH) and the
AGP slot
PCI slots
PCI Express PCI Express slots
Memory slots AGP
Northbridge Processor
PCI bus Front side
bus Super I/O Parallel port Serial ports Keyboard PS2 mouse Floppy disks Southbridge Ethernet SATA USB Firewire ISA Sound PATA
Fig. 4.6 Northbridge and Southbridge.
Southbridge chip is replaced by theI/O Controller Hub(ICH). There is also a64 bit PCI Controller Hub(P64H). The Intel Hub Architecture is said to be much faster than the Northbridge/Southbridge design because the latter connected all the low-speed ports to the PCI bus, whereas the Intel architecture separates them out.
Finally, before leaving this section, we should mention two other technologies which are in widespread use.FireWire is a serial bus technology with very high transfer rates which has been designed largely for audio and video multimedia devices. Most modern camcorders include this interface, which is sometimes known as i.Link. The official specifications for Firewire are IEEE-1394-1995, IEEE 1394a- 2000 and IEEE 1394b (Apple Computer Inc., 2006), and it supports up to 63 devices daisy chained to a single adapter card. The second technology is that ofUniversal Serial Bus(USB) (USB, 2000), which is also a high-speed serial bus that allows for up to a theoretical maximum of 127 peripheral devices to be daisy chained from a single adapter card. The current version, USB 2.0, is up to 40 times faster than the earlier version of USB 1.1. A good technical explanation of USB can be found in Peacock (2005). With modern Microsoft Windows systems, “hot swapping4” of hard disk drives can be achieved using either Firewire or USB connections. This is of signifi- cance to the forensic analyst in that it enables the possible collection of evidence from a system that is kept running for a short while when first seized. This might be required when, for example, an encrypted container is found open on a computer that is switched on (see Chapter 7 for more details).