Once a PCIe function’s Base Address Registers (BARs) are programmed by system software, the device knows exactly which memory and IO address ranges it owns and will claim any transactions targeting those locations. However, because PCI Express utilizes independent, point-to-point links rather than a shared bus, the bridges and switches upstream need a way to know which specific address ranges live beneath them. If they don’t know what is downstream, they cannot properly forward Transaction Layer Packets (TLPs) to the correct destination.
This routing intelligence is handled by the Base and Limit registers.
The Three Sets of Base and Limit Registers
Every bridge (which includes all Switch ports and Root Complex ports) uses a Type 1 Configuration Header. To accurately route traffic from its primary (upstream) interface to its secondary (downstream) interface, the Type 1 header implements three distinct sets of Base and Limit registers. These correspond to the three types of address spaces that might exist below the bridge:
- Prefetchable Memory space (P-MMIO)
- Non-Prefetchable Memory space (NP-MMIO)
- IO space
Memory Ranges (P-MMIO and NP-MMIO)
The memory base and limit registers define the starting (base) and ending (limit) memory addresses located beneath the bridge.
To save configuration space, these registers do not store the entire 32-bit address. Instead, they only hold the upper 12 bits (bits [31:20]) of the address. The hardware implies the lower 20 bits—automatically assuming all 0s for the base address and all Fs for the limit address.
This creates a significant routing rule: the smallest memory range a bridge can forward is 1MB (because the lower 20 bits are fixed).
- The Consequence: If an endpoint requests a tiny 4KB block of NP-MMIO, the switch port directly above it must still be programmed to forward a full 1MB window. The leftover 1020KB of that window is entirely wasted; it cannot be assigned to any other endpoint elsewhere in the system because the switch port will blindly swallow any traffic targeting it.
(Note: While NP-MMIO is strictly restricted to 32-bit addresses, the P-MMIO range can support 64-bit addresses by utilizing an additional pair of Upper 32-Bit Base and Limit registers.)
IO Address Range
The IO Base and Limit registers function using the same concept but store bits [15:12] of a 16-bit IO address. Because the lower 12 bits are implied (all 0s for base, all Fs for limit), the smallest IO window a bridge can forward is 4KB.
This 4KB minimum granularity is extremely restrictive in x86 (Intel-compatible) systems. Because x86 processors only support a total of 16 bits (64KB) of IO address space, dividing that 64KB space into mandatory 4KB chunks means a system can mathematically only support a maximum of 16 different IO address ranges behind bridges.
Handling Unused Address Spaces
Not every PCIe device requests all three types of address spaces. In fact, modern PCIe endpoints rarely request legacy IO space.
If no devices downstream require IO space, how does system software tell the bridge not to forward IO traffic? Software cannot simply program the IO Base and Limit registers to all 0s. Because the hardware implies the lower bits, setting the registers to zero would actually create a perfectly valid 4KB forwarding window starting at address 0000h.
To solve this, system software intentionally programs the Limit register with a lower address than the Base register (for example, setting the Base to 00h and the Limit to F0h). Whenever a bridge sees a limit address that is mathematically lower than its base address, it recognizes it as an invalid setting. This serves as the official signal to the bridge that absolutely no functions downstream own that specific type of address space. This invalidation trick is valid for all three sets of Base/Limit registers.
Bridge BARs vs. Base and Limit Registers
When studying Type 1 headers, it is critical to distinguish between the bridge’s own BARs and its Base/Limit registers.
Type 1 headers contain two BARs of their own. A bridge’s Base/Limit registers do not include the addresses owned by that bridge’s own BARs. The BARs claim addresses that are meant for the internal operation of the bridge itself, whereas the Base and Limit registers exclusively represent the address ranges of the functions living completely downstream of the bridge.