PCIe Chapter 2: Reading Configuration Space and Finding Capabilities

Separate the target, configuration offset, and CPU address

Segment and BDF (Bus, Device, and Function identifier) select the Function. A byte offset then selects a Register in its 4096-byte Configuration Space: the first 256 bytes are PCI-compatible, and 0x100–0xFFF is the extended region. ECAM (Enhanced Configuration Access Mechanism) provides CPU memory-mapped configuration access. The platform supplies its physical mapping; the offset alone is only a position within the selected Function.

BDF

Bus/Device/Function

The conventional Capability list starts through the Header's Capabilities Pointer, at 0x34 for the Type 0/1 layouts used here. The Extended list starts independently at 0x100. The PCI Express Capability belongs to the conventional list; DSN belongs to the Extended list. A name containing PCIe does not establish which list to use.

Why can the same offset mean different things?

First read the selected Function’s Header Type Register at 0x0E. Bits 6:0 select the Header Layout: Figure 7-10 shows Type 0, and Figure 7-14 shows Type 1 for Root and Switch Ports. Read the bit positions across each figure and the Function-relative byte offset at the right.

For a 32-bit value at 0x18, first obtain the Header Layout of that same Function. With Type 1, interpret the corresponding bytes as Bus Numbers; with Type 0, the location belongs to the BAR area. Read the particular BAR type and field definition before interpreting it. The Bus Numbers describe the downstream discovery range; Memory Base and Limit describe a resource window. Chapter 3 explains discovery and Chapter 4 resource allocation.

Read bit 7 separately from bits 6:0. The assumed value 0x80 selects Type 0 and indicates that the Device may contain multiple Functions; further probing is needed. VF rules differ and are outside this example. Header Layout and Configuration Request Type 0/1 are separately defined classifications.

VF

Virtual Function

Reading route: Base 6.0 §7.5.1.1.9, Figure 7-8 and Table 7-7 (printed/PDF pp.924–925); Figure 7-10 (p.928); Figure 7-14 and its applicability note (p.936). Select the figure from Header Type, then read its offset and field definition.

An ID of zero is different from a Next pointer of zero

A conventional Capability normally starts with an ID in the low byte and a Next pointer in the high byte of a 16-bit read. The teaching list follows 0x40 → 0x50 → 0x70 → 0xD0 → 0, representing PM, Null, PCIe, and MSI-X.

MSI-X

Message Signaled Interrupts Extension

Extended ID = header & 0xFFFF
Version     = (header >> 16) & 0xF
Next        = (header >> 20) & 0xFFC

Next already gives a byte offset from the beginning of the Function. Read at that offset directly; DWORD alignment does not change its unit. For an unknown ID, follow a valid Header to the next entry. The course separately checks range, alignment, and revisited offsets to detect unreliable traversal; valid positions need not increase.

After finding DSN, distinguish data location from display order

Figure 7-242/Table 7-221 identify DSN as ID 0003h. Figure 7-241 then places its Lower DW and Upper DW at structure offsets +0x04 and +0x08. The example reads 0x33221100 at 0x184 and 0x77665544 at 0x188, each as 32 bits.

DW

Double Word, a four-byte unit

Register integer = (0x77665544 << 32) | 0x33221100
                 = 0x7766554433221100

Table 7-222 separately maps Register bytes to EUI-64 bytes. Written from the highest EUI byte to the lowest, the example is 00-11-22-33-44-55-66-77. These values illustrate reconstruction, not an allocated or usable product identifier. Real values must follow the IEEE company identifier and manufacturer extension rules, and the value alone does not authenticate hardware.

DSN is optional. An ordinary Multi-Function Device implementing DSN must implement it in Function 0; other Functions implementing it must return the same value. DSN therefore does not replace the Function Number in BDF (Bus, Device, and Function identifier).

BDF

Bus/Device/Function

A read value is not automatically safe to write back

Read the Attributes column with the field definition. RO restricts software writes; RW1C (write one to clear) leaves status unchanged when written as zero.

Software must preserve the read value when writing RsvdP (reserved, preserve on writes) bits, whereas RsvdZ (reserved, write zero) requires zero on writes. Reserved fields cannot all use the same update rule. A failed read is not a valid indication of absence, and a successful zero read does not prove that a meaningful Register exists there. Establish the entry point and valid result before interpreting the format.

Apply the complete query to changed values

The worked query starts at 0x100, reaches DSN at 0x180, and reads its data at 0x184 and 0x188. Next locates a different structure; a data offset locates a field in the current structure. The following variations apply that distinction.