We study communication over control systems, where a controller-encoder selects inputs to a dynamical system in order to simultaneously regulate the system and convey a message to an observer that has access to the system's output measurements. This setup reflects implicit communication, as the controller embeds a message in the control signal. The capacity of a control system is the maximal reliable rate of the embedded message subject to a closed-loop control-cost constraint. We focus on linear quadratic Gaussian (LQG) control systems, in which the dynamical system is given by a state-space model with Gaussian noise, and the control cost is a quadratic function of the system inputs and system states. Our main result is a convex optimization upper bound on the capacity of LQG systems. In the case of scalar systems, we prove that the upper bound yields the exact LQG system capacity. The upper bound also recovers all known results, including LQG control, feedback capacity of Gaussian channels with memory, and the LQG system capacity with a state-feedback. For vector LQG control systems, we provide a sufficient condition for tightness of the upper bound, based on the Riccati equation. Numerical simulations indicate the upper bound tightness in all tested examples, suggesting that the upper bound may be equal to the LQG system capacity in the vector case as well.