01Memory-Based Property Definition

Base 2.4 · Figure 34 · Memory-Based Property Definition

§3.1.4 · Printed pages 54 · PDF 80

01.1 · UseUse this table to locate the transport-specific area after controller properties. PCIe doorbells begin at offset 1000h relative to the register base, not host physical address 1000h.

01.2 · Fields and relationshipsOFST is a byte offset, Size gives occupied space, and T means transport-defined. Variable does not imply a fixed 4 KiB region. Individual SQ/CQ doorbells also depend on CAP.DSTRD.

SQ

Submission Queue

01.3 · Interpretation and exampleFor an illustrative BAR base of 80000000h, the doorbell region begins at 80001000h. Locate queue 2 using PCIe Figures 5 and 6; writing its queue ID at the region start is not equivalent.

Search terms: MMIO · doorbell · OFST

MMIO

Memory-Mapped I/O, mapped device-register access

02Offset 0h: CAP – Controller Capabilities

Base 2.4 · Figure 36 · Offset 0h: CAP – Controller Capabilities

§3.1.4.1 · Printed pages 55–58 · PDF 81–84

02.1 · UseRead CAP before choosing queue sizes, memory pages or readiness timeouts. It reports capabilities, not the current CC configuration; advertised support does not mean a function is enabled.

02.2 · Fields and relationshipsFrequently used groups are MQES bits 15:0 (maximum entries minus one), CQR bit 16 (contiguous I/O queue requirement), DSTRD bits 35:32 (2^(2+DSTRD) byte stride), and MPSMIN/MPSMAX bits 51:48/55:52 (page-size exponents). CSS bits 44:37, NSSRS bit 36 and CRMS bits 60:59 describe command sets, subsystem reset and ready modes. TO bits 31:24 uses 500 ms units.

02.3 · Interpretation and exampleFor example, MQES=03FFh allows 1024 entries while DSTRD=1 means an 8-byte stride. Neither raw value is a byte count. Check CC.MPS for the selected page size and combine CC.CRIME, CRTO and initialization rules for readiness.

Search terms: CAP · MQES · MPSMIN · MPSMAX · DSTRD · TO · CRMS · CSS

03Offset 14h: CC – Controller Configuration

Base 2.4 · Figure 41 · Offset 14h: CC – Controller Configuration

§3.1.4.5 · Printed pages 60–63 · PDF 86–89

03.1 · UseWhen advertised capabilities look adequate but initialization fails, inspect what the host actually programmed in CC. It combines enablement, command-set selection, page size, entry sizes and shutdown notification.

03.2 · Fields and relationshipsEN bit 0 enables the controller; CSS bits 6:4 selects command sets; MPS bits 10:7 specifies 2^(12+MPS) bytes; AMS bits 13:11 selects arbitration; SHN bits 15:14 requests shutdown. IOSQES bits 19:16 and IOCQES bits 23:20 are entry-size exponents. CRIME bit 24 selects the ready mode at enablement.

03.3 · Interpretation and exampleIOSQES=6 and IOCQES=4 mean 64-byte SQEs and 16-byte CQEs, not queue depths. Clearing EN from one to zero initiates Controller Reset. Fields such as MPS and CSS have disabled-state update requirements; this is not an unrestricted live configuration register.

Search terms: CC · EN · MPS · IOSQES · IOCQES · SHN · CRIME

04Offset 1Ch: CSTS – Controller Status

Base 2.4 · Figure 42 · Offset 1Ch: CSTS – Controller Status

§3.1.4.6 · Printed pages 63–65 · PDF 89–91

04.1 · UseCC describes the host request; CSTS describes the controller response. Compare them when enablement stalls, completions disappear or shutdown remains incomplete.

04.2 · Fields and relationshipsRDY bit 0 indicates readiness to process submission entries. CFS bit 1 reports a fatal error that could not be communicated through an appropriate CQ. SHST bits 3:2 encodes shutdown progress; ST bit 6 distinguishes controller and subsystem shutdown. NSSRO bit 4 and PP bit 5 report reset occurrence and processing pause.

04.3 · Interpretation and exampleSHST=10b means shutdown completed, not that an ordinary I/O succeeded. The usable scope of RDY=1 depends on the ready mode: media-independent readiness does not establish readiness of every namespace medium.

Search terms: CSTS · RDY · CFS · SHST · ST

05Offset 20h: NSSR – NVM Subsystem Reset

Base 2.4 · Figure 43 · Offset 20h: NSSR – NVM Subsystem Reset

§3.1.4.7 · Printed pages 66 · PDF 92

05.1 · UseUse this table to recognize a request for NVM Subsystem Reset in a trace. CAP.NSSRS advertises support. Its scope differs from clearing one controller’s CC.EN.

05.2 · Fields and relationshipsAt offset 20h, NSSRC bits 31:0 initiates the reset only when written with 4E564D65h. Other values have no such functional effect. Reads return zero, not the last requested value.

05.3 · Interpretation and exampleA trace containing a write of 4E564D65h followed by a zero readback is consistent with the definition; it does not show that the write was lost. Determine completion and reset scope using status and §3.7.1.

Search terms: NSSR · NSSRC · NSSRS · 4E564D65h

06Offset 24h: AQA – Admin Queue Attributes

Base 2.4 · Figure 44 · Offset 24h: AQA – Admin Queue Attributes

§3.1.4.8 · Printed pages 66 · PDF 92

06.1 · UseInspect AQA when Admin commands cannot be submitted or completions reclaimed. It holds queue entry counts, not buffer byte capacities.

06.2 · Fields and relationshipsASQS bits 11:0 and ACQS bits 27:16 encode submission and completion depths minus one. The intervening and upper bits are reserved. Each queue has 2 to 4096 entries; enabling with either size field zero produces undefined results.

06.3 · Interpretation and exampleTwo Admin queues of 64 entries use ASQS=63 and ACQS=63, giving AQA=003F003Fh. Equal depths do not imply equal buffer sizes because SQ and CQ entries have different sizes.

Search terms: AQA · ASQS · ACQS · queue depth

07Offset 28h: ASQ – Admin Submission Queue Base Address

Base 2.4 · Figure 45 · Offset 28h: ASQ – Admin Submission Queue Base Address

§3.1.4.9 · Printed pages 66 · PDF 92

07.1 · UseThis table tells where the controller fetches Admin commands. ASQ is the Admin Submission Queue base, not the next command address or SQ tail.

07.2 · Fields and relationshipsASQB bits 63:12 stores the upper 52 bits of the physical address; bits 11:0 are reserved zero. The complete address must also align to the page size selected by CC.MPS, so clearing 12 low bits is only the minimum requirement.

07.3 · Interpretation and exampleWith CC.MPS=1, pages are 8 KiB. Address 00101000h is 4 KiB-aligned but does not meet that configuration. Check AQA and the allocated memory extent before correlating SQ doorbell writes.

Search terms: ASQ · ASQB · Admin SQ · alignment

08Offset 30h: ACQ – Admin Completion Queue Base Address

Base 2.4 · Figure 46 · Offset 30h: ACQ – Admin Completion Queue Base Address

§3.1.4.10 · Printed pages 67 · PDF 93

08.1 · UseCheck ACQ when an Admin command was fetched but the host is waiting at the wrong completion address. Commands submitted through Admin SQ complete in this Admin CQ.

08.2 · Fields and relationshipsACQB bits 63:12 contains the upper address bits; the low 12 bits are reserved. Alignment follows CC.MPS. Admin CQ is associated with interrupt vector 0, not an arbitrary I/O CQ vector.

08.3 · Interpretation and exampleA correct ACQ base does not make every entry new. The consumer must check the CQE phase tag and update the CQ head doorbell. ACQ itself does not advance by 16 after each completion.

Search terms: ACQ · ACQB · Admin CQ · interrupt vector 0

09Offset 68h: CRTO – Controller Ready Timeouts

Base 2.4 · Figure 57 · Offset 68h: CRTO – Controller Ready Timeouts

§3.1.4.21 · Printed pages 73 · PDF 99

09.1 · UseUse CRTO to separate readiness for commands independent of media from readiness of all required media. First identify which condition an initialization timeout is testing.

09.2 · Fields and relationshipsCRIMT bits 31:16 and CRWMT bits 15:0 both use 500 ms units. CRIMT applies to supported and enabled media-independent readiness. CRWMT covers the controller and required media becoming ready and must not be smaller than CRIMT.

09.3 · Interpretation and exampleCRIMT=4 and CRWMT=20 mean 2 seconds and 10 seconds. Availability of some Admin commands after 2 seconds does not imply that namespace reads should already succeed. Check CC.CRIME and the command’s media dependency.

Search terms: CRTO · CRIMT · CRWMT · ready timeout

10Offset (1000h + ((2y) * (4 << CAP.DSTRD))): SQyTDBL – Submission Queue y Tail Doorbell

PCIe Transport 1.4 · Figure 5 · Offset (1000h + ((2y) * (4 << CAP.DSTRD))): SQyTDBL – Submission Queue y Tail Doorbell

§3.1.2.1 · Printed pages 10 · PDF 10

10.1 · UseAfter placing commands in an SQ, the host writes its new tail through this doorbell. Here y is the queue ID and the offset is relative to the register base, not the SQ buffer.

10.2 · Fields and relationshipsThe address is 1000h+(2y)×(4<<CAP.DSTRD). SQT occupies bits 15:0; bits 31:16 are reserved. The value is the new ring index; derive the number of added commands from the change while accounting for wraparound.

10.3 · Interpretation and exampleWith DSTRD=1 and y=2, the offset is 1020h. For a 64-entry SQ, advancing tail from 62 to 1 adds 3 entries. Writing 1 does not mean one new command.

Search terms: SQyTDBL · SQT · DSTRD · tail · wrap

11Offset (1000h + ((2y + 1) * (4 << CAP.DSTRD))): CQyHDBL – Completion Queue y Head Doorbell

PCIe Transport 1.4 · Figure 6 · Offset (1000h + ((2y + 1) * (4 << CAP.DSTRD))): CQyHDBL – Completion Queue y Head Doorbell

§3.1.2.2 · Printed pages 10–11 · PDF 10–11

11.1 · UseAfter consuming CQEs, the host updates the CQ head doorbell to release positions for controller reuse. This does not submit commands or read the current head.

11.2 · Fields and relationshipsIts offset is 1000h+(2y+1)×(4<<CAP.DSTRD). CQH occupies bits 15:0, with reserved upper bits. Calculate released entries from the new head with wraparound. Doorbell readback is vendor-specific and unsuitable as a status query.

11.3 · Interpretation and exampleFor DSTRD=1, queue 2 uses CQ offset 1028h, eight bytes after SQ offset 1020h. Consuming completions without returning space can leave the controller without reusable CQ positions.

Search terms: CQyHDBL · CQH · head · wrap

12Offset 04h: CMD - Command

PCIe Transport 1.4 · Figure 12 · Offset 04h: CMD - Command

§3.8.1.2 · Printed pages 17 · PDF 17

12.1 · UseStart with this PCI configuration table when a device enumerates but register access or host-data transfers fail. PCI CMD is neither an NVMe command nor NVMe CC.

12.2 · Fields and relationshipsCommon checks are BME bit 2 (Bus Master Enable), MSE bit 1 (Memory Space Enable) and IOSE bit 0. Bit 10 is Interrupt Disable. Interpret the remaining fields according to their PCI roles.

12.3 · Interpretation and exampleAn assigned BAR does not establish that BME and MSE are enabled. Check PCI configuration before queue addresses. Confusing PCI CMD offsets with NVMe CC accesses a different register space.

Search terms: PCI CMD · BME · MSE · IOSE · MMIO · DMA

MMIO

Memory-Mapped I/O, mapped device-register access

DMA

Direct Memory Access, device access to memory

13Offset 10h: MLBAR (BAR0) – Memory Register Base Address, lower 32-bits

PCIe Transport 1.4 · Figure 20 · Offset 10h: MLBAR (BAR0) – Memory Register Base Address, lower 32-bits

§3.8.1.10 · Printed pages 19 · PDF 19

13.1 · UseUse BAR0 to find the NVMe register mapping and determine whether BAR1 supplies upper address bits. Low bits also contain attributes rather than address data.

13.2 · Fields and relationshipsBA bits 31:14 holds the programmable portion of the lower 32 address bits; bits 13:4 are reserved. PF bit 3 indicates non-prefetchable space, TP bits 2:1 gives the mapping type and RTE bit 0 selects memory space. Larger apertures may make additional address bits read-only.

PF

Physical Function

13.3 · Interpretation and exampleRemove attributes and check TP before assembling the address. Using only BAR0 truncates a 64-bit mapping above 4 GiB; treating every following BAR as an upper half without checking type is also incorrect.

Search terms: BAR0 · MLBAR · BA · TP · PF · RTE

PF

Physical Function

14Offset 14h: MUBAR (BAR1) – Memory Register Base Address, upper 32-bits

PCIe Transport 1.4 · Figure 21 · Offset 14h: MUBAR (BAR1) – Memory Register Base Address, upper 32-bits

§3.8.1.11 · Printed pages 19 · PDF 19

14.1 · UseOnce a 64-bit register mapping is established, BAR1 supplies its upper 32 bits. Together with BAR0 it forms one address, not a second NVMe register area.

14.2 · Fields and relationshipsBA bits 31:0 corresponds directly to full-address bits 63:32. BAR0 still supplies the low address and attributes. Platform and bridge resource allocation also constrains usable addresses.

14.3 · Interpretation and exampleAn upper value 1 and lower address portion 80000000h form 0000000180000000h. Dropping the upper half accesses 80000000h instead, a 4 GiB difference.

Search terms: BAR1 · MUBAR · BA · 64-bit address

15Offset MSIXCAP + 2h: MXC – MSI-X Message Control

PCIe Transport 1.4 · Figure 44 · Offset MSIXCAP + 2h: MXC – MSI-X Message Control

§3.8.4.2 · Printed pages 24–25 · PDF 24–25

15.1 · UseWhen a CQ contains completions but interrupts are absent, check MSI-X enablement, the function-wide mask and available vector count.

15.2 · Fields and relationshipsMXE bit 15 enables MSI-X, FM bit 14 masks all vectors and TS bits 10:0 encodes table entries minus one. MSI enable must be clear for MSI-X use. Clearing FM leaves each vector’s own mask effective.

MSI

Message Signaled Interrupt

15.3 · Interpretation and exampleTS=3 means four vectors, not that vector 3 is enabled. Changing FM from one to zero does not clear individual vector masks. Correlate the table with the CQ’s interrupt-vector assignment.

Search terms: MSI-X · MXE · FM · TS · interrupt

16Offset MSIXCAP + 4h: MTAB – MSI-X Table Offset / Table BIR

PCIe Transport 1.4 · Figure 45 · Offset MSIXCAP + 4h: MTAB – MSI-X Table Offset / Table BIR

§3.8.4.3 · Printed pages 25 · PDF 25

16.1 · UseTo inspect MSI-X vector configuration, locate the table by selecting its BAR and adding its offset. The BAR index and byte displacement are separate fields.

16.2 · Fields and relationshipsTBIR bits 2:0 selects the BAR; TO bits 31:3 holds an 8-byte-aligned offset. Clear the low three bits before adding the offset to the BAR base. A64-bit BAR is identified by its lower Dword BAR.

16.3 · Interpretation and exampleMTAB=00002004h means TBIR=4 and offset 2000h: BAR4’s mapped base plus 2000h, not BAR0 plus 2004h. Use the table’s permitted BIR encodings.

Search terms: MTAB · TBIR · TO · MSI-X

17Offset MSIXCAP + 8h: MPBA – MSI-X PBA Offset / PBA BIR

PCIe Transport 1.4 · Figure 46 · Offset MSIXCAP + 8h: MPBA – MSI-X PBA Offset / PBA BIR

§3.8.4.4 · Printed pages 25 · PDF 25

17.1 · UseThis register locates the Pending Bit Array used to inspect pending interrupt state. PBA and the MSI-X table are different structures and need not share an offset.

17.2 · Fields and relationshipsPBIR bits 2:0 selects a BAR; PBAO bits 31:3 supplies an 8-byte-aligned offset. The calculation resembles MTAB but the values may differ. These are location fields, not the per-vector pending bits themselves.

17.3 · Interpretation and exampleMPBA=00003000h locates PBA at BAR0’s mapped base plus 3000h. Inspect CQ memory to determine completed commands; a pending bit does not replace their individual completion statuses.

Search terms: MPBA · PBA · PBIR · PBAO · pending

18Offset PXCAP + 12h: PXLS – PCI Express Link Status

PCIe Transport 1.4 · Figure 55 · Offset PXCAP + 12h: PXLS – PCI Express Link Status

§3.8.5.8 · Printed pages 29 · PDF 29

18.1 · UseWhen bandwidth is below expectation, inspect negotiated link speed and width here. Maximum advertised capability is not the current negotiated result.

18.2 · Fields and relationshipsNLW bits 9:4 is Negotiated Link Width; CLS bits 3:0 is the Current Link Speed encoding. Both are undefined while the link is down. SCC bit 12 describes use of the platform’s common reference clock, not link speed.

18.3 · Interpretation and exampleNLW=2 means the active link is x 2 even if the product supports x 4. Decode CLS using the applicable PCIe speed encoding; this table does not fully define that external encoding, so the raw code is not a GT/s value.

Search terms: PXLS · NLW · CLS · SCC · link speed · link width

19Offset AERCAP + 4: AERUCES – AER Uncorrectable Error Status Register

PCIe Transport 1.4 · Figure 60 · Offset AERCAP + 4: AERUCES – AER Uncorrectable Error Status Register

§3.8.6.2 · Printed pages 31–32 · PDF 31–32

19.1 · UseUse this register for uncorrectable PCIe transaction or link errors. Here AER means Advanced Error Reporting, not NVMe Asynchronous Event Request.

19.2 · Fields and relationshipsCommon bits are CTS bit 14 (Completion Timeout), UCS bit 16 (Unexpected Completion), MTS bit 18 (Malformed TLP), URES bit 20 (Unsupported Request) and DLPES bit 4 (Data Link Protocol Error). TLP means transaction-layer packet. Multiple bits can be set; separate mask and severity registers control reporting and severity.

19.3 · Interpretation and exampleCTS=1 records a PCIe completion timeout but does not identify the failed NVMe CID. Preserve status and header logs before correlating time, queues and CQEs. Save the original status before error recovery so it remains available for correlation.

CID

Command Identifier, unique among outstanding commands in one SQ

Search terms: AERUCES · CTS · URES · MTS · UCS · DLPES · PCIe AER

20Offset AERCAP + 10h: AERCES – AER Correctable Error Status Register

PCIe Transport 1.4 · Figure 63 · Offset AERCAP + 10h: AERCES – AER Correctable Error Status Register

§3.8.6.5 · Printed pages 33 · PDF 33

20.1 · UseInspect correctable errors when the link operates but performance or stability degrades. Correctable describes recovery of that error class, not whether its frequency matters.

20.2 · Fields and relationshipsRES bit 0 is Receiver Error; BTS bit 6 / BDS bit 7 are Bad TLP/Bad DLLP; RRS bit 8 is replay-number rollover; RTS bit 12 is Replay Timer Timeout. These are status bits, not occurrence counters. AERCEM controls their masks separately.

20.3 · Interpretation and exampleSeeing RTS=1 in two snapshots without an intervening clear does not establish two timeouts. Frequency analysis needs sampling times, clear operations and reproduction conditions, correlated with link status.

Search terms: AERCES · RES · BTS · BDS · RTS · RRS · correctable