PCIe Series — PCIe-19: Configuration Space — Type 1 Header — VLSI Trainers
PCIe Series · PCIe-19

Configuration Space — Type 1 Header (Bridge)

The 64-byte header used by every PCIe bridge — switch ports, root ports, and PCIe-to-PCI bridges. Primary, Secondary, and Subordinate Bus Numbers, the three address windows (I/O, Non-Prefetchable Memory, Prefetchable Memory), Secondary Status, Bridge Control, Expansion ROM, and how enumeration uses all of it.

📋 What Uses a Type 1 Header

Every PCIe bridge device uses a Type 1 configuration header. In a PCIe system, a bridge is any device that connects two bus segments — not just dedicated bridge chips. This means every switch port, every Root Complex port, and any PCIe-to-PCI or PCIe-to-PCIe-X bridge implements a Type 1 header.

Where Type 1 Headers Appear in a PCIe Topology Root Complex Each Root Port = Type 1 Switch Upstream + all Downstream Ports = Type 1 Endpoint Type 0 header PCIe-to-PCI Bridge Type 1 header on PCIe side Header Type value = 1 (bits [6:0] of Header Type register). Software reads this to know it found a bridge, not an endpoint.
Figure 1 — Type 1 header devices in a PCIe topology. Root Ports, all switch ports (upstream and downstream), and PCIe-to-PCI bridges all use Type 1 headers. When software reads Header Type [6:0] = 1 during enumeration, it knows to probe the bus downstream of this bridge and assign bus numbers.

The critical difference from Type 0: instead of six BARs for device registers, a Type 1 header dedicates that space to three address windows — ranges of I/O, non-prefetchable memory, and prefetchable memory that the bridge will forward downstream. A bridge claims any TLP whose target address falls within one of its windows and sends it on to the downstream bus.

📋 Full Type 1 Header Layout

Type 1 Configuration Header — 16 DWs (64 Bytes) Byte 3 Byte 2 Byte 1 Byte 0 DW# Device ID [15:0] Vendor ID [15:0] 00h Status [15:0] Command [15:0] 04h Class Code [23:0] (06h.04h.00h = PCIe P2P Bridge) Revision ID [7:0] 08h BIST [7:0] Header Type=01h [7:0] Latency Timer [7:0] Cache Line Size [7:0] 0Ch BAR0 — Base Address Register 0 [31:0] (optional bridge MMIO) 10h BAR1 — Base Address Register 1 [31:0] (optional bridge MMIO) 14h Secondary Latency Timer Subordinate Bus # [7:0] Secondary Bus # [7:0] Primary Bus # [7:0] 18h Secondary Status [15:0] I/O Limit [7:0] I/O Base [7:0] 1Ch Memory Limit [15:0] (NP-MMIO) Memory Base [15:0] (NP-MMIO) 20h Prefetchable Memory Limit [15:0] Prefetchable Memory Base [15:0] 24h Prefetchable Base Upper 32 Bits [31:0] (for 64-bit P-MMIO only) 28h Prefetchable Limit Upper 32 Bits [31:0] (for 64-bit P-MMIO only) 2Ch I/O Limit Upper 16 Bits [15:0] (for 32-bit I/O) I/O Base Upper 16 Bits [15:0] (for 32-bit I/O) 30h Reserved [31:8] Capabilities Pointer [7:0] 34h Expansion ROM Base Address [31:0] 38h
Figure 2 — Full Type 1 header layout, DWs 0–14 (offsets 00h–38h). DW15 (offset 3Ch): Bridge Control [31:16] / Interrupt Pin [15:8] / Interrupt Line [7:0]. The unique region (green/blue block at DW6–DW12) replaces the six BARs of Type 0 and carries bus numbers, three address windows, and Secondary Status. These registers are what enable TLP routing through the bridge.

📋 Shared Fields with Type 0

The first six doublewords (offsets 00h–0Fh) of a Type 1 header are identical to Type 0 in field name, position, and behaviour:

Class Code 06h.04h.00h is how enumeration software recognises a bridge. When software reads offset 08h bits [31:8] and gets 06_04_00h, it knows this is a PCI-to-PCI bridge. It then reads the bus number registers to learn the topology and proceeds to enumerate devices downstream of this bridge.

📋 Bus Number Registers

The four bus number registers at offset 18h are the most important registers unique to the Type 1 header. They form the basis for all configuration TLP routing through bridges.

Bus Number Registers — Four Fields at Offset 18h Primary Bus # Byte 0 (bits [7:0]) Bus number on the upstream side of bridge Secondary Bus # Byte 1 (bits [15:8]) Bus number directly downstream of bridge Subordinate Bus # Byte 2 (bits [23:16]) Highest bus number reachable downstream Secondary Latency Byte 3 (bits [31:24]) Legacy PCI latency timer — no effect PCIe Configuration TLP Routing Rule at Each Bridge Target Bus == Secondary Bus# → Type 0 Cfg TLP (device on this bus) Secondary < Target ≤ Subordinate → Type 1 Cfg TLP forwarded downstream
Figure 3 — Bus number registers at offset 18h. Four 8-bit fields in one DW. The routing rule is simple: if the target bus equals Secondary Bus#, the bridge converts the configuration TLP to Type 0 (device on the directly-attached bus). If the target is between Secondary and Subordinate (exclusive/inclusive), the bridge forwards it downstream as Type 1. If the target is outside this range, the bridge ignores it.
RegisterOffsetAccessPurpose
Primary Bus Number 18h [7:0] RW Bus number of the bus segment on the upstream side of this bridge. For a root port, Primary = 0 (the RC internal bus is always bus 0). For a switch downstream port, Primary = the bus number of the switch’s internal bus. Software writes this during enumeration.
Secondary Bus Number 18h [15:8] RW Bus number of the bus segment directly connected to the downstream side of this bridge. Devices directly attached on the downstream link have this bus number. Software writes this during enumeration — it is the “next available bus number.”
Subordinate Bus Number 18h [23:16] RW The highest bus number reachable through this bridge — any bus number from Secondary through Subordinate is reachable downstream. During depth-first scan, software temporarily writes 0xFF here. After fully enumerating the downstream subtree, it writes back the actual highest bus number found. This tells all bridges above that the range is finalised.
Secondary Latency Timer 18h [31:24] RW Legacy PCI concept — the minimum number of PCI clock cycles a bridge must grant to the secondary bus master before reclaiming the bus. Has no operational effect in PCIe (point-to-point, no shared bus). BIOS may write a value for PCI backward compatibility but PCIe bridges ignore it.

📋 Depth-First Enumeration and Bus Numbers

PCIe enumeration is performed by firmware (BIOS/UEFI) and later by the OS, scanning the topology depth-first to discover every bridge and endpoint, assigning bus numbers as it goes. Understanding the bus number registers requires understanding how this algorithm works.

Depth-First Bus Number Assignment — Worked Example Root Complex Internal Bus = 0 Root Port / Bridge A Pri=0 · Sec=1 · Sub=4 Switch DSP B Pri=1 · Sec=2 · Sub=3 Switch DSP C Pri=1 · Sec=4 · Sub=4 Endpoint Bus=2, Dev=0 Sub-Bridge D Pri=2 · Sec=3 · Sub=3 Endpoint Bus=4, Dev=0 EP Bus=3, Dev=0 Depth-first order: 1. Find Bridge A → write Sub=FF 2. Follow depth: Bridge B 3. Find EPs on Bus 2 4. Find Sub-Bridge D on Bus 2 5. Backtrack → fix B.Sub=3 6. Move to Bridge C → bus 4
Figure 4 — Depth-first bus number assignment. The algorithm always goes as deep as possible before backtracking. Subordinate Bus is initially written as FFh (all buses downstream are possible). After fully enumerating a subtree, the actual highest bus number found is written back. Bridge A’s final Subordinate = 4 covers all buses (1 through 4) reachable downstream.

The depth-first algorithm step by step

  1. Read Vendor ID at Bus 0, Dev 0, Func 0 — if valid, found the RC host bridge.
  2. Scan bus 0 for devices. Find a bridge at Bus 0, Dev 1. Read its Header Type to confirm Type 1.
  3. Assign it: Primary = 0, Secondary = 1, Subordinate = 0xFF (placeholder — unknown depth).
  4. Follow the depth: scan bus 1. Find another bridge at Bus 1, Dev 0. Assign: Primary = 1, Secondary = 2, Subordinate = 0xFF.
  5. Scan bus 2. Find an endpoint at Dev 0 (Type 0 — no further buses). Find another bridge at Dev 1. Assign: Primary = 2, Secondary = 3, Subordinate = 0xFF.
  6. Scan bus 3. Find endpoints only. No more bridges. Reached bottom of this branch.
  7. Backtrack: update Dev 1 on Bus 2 — Subordinate = 3 (highest bus found under it).
  8. Return to bus 2. No more devices. Backtrack: update bridge at Bus 1 Dev 0 — Subordinate = 3.
  9. Return to bus 1. Find another bridge at Dev 1. Assign: Primary = 1, Secondary = 4, Subordinate = 0xFF.
  10. Scan bus 4. Endpoints only. Backtrack: Subordinate = 4.
  11. Return to bus 1. No more devices. Update original bridge at Bus 0 Dev 1 — Subordinate = 4.

📋 I/O Base and Limit Registers

The I/O Base and I/O Limit registers at offset 1Ch tell the bridge which I/O address range it should forward downstream. Any I/O TLP whose address falls in [IO_BASE, IO_LIMIT] is forwarded to the secondary bus; all others pass through the bridge upstream or are rejected.

I/O Base and Limit Register Encoding I/O Base Register (offset 1Ch [7:0]) bits [7:4] = I/O Base [15:12] bits [3:0] = I/O Decode Caps Bits [3:0]: 0h = 16-bit I/O decode (max 64 KB) Bits [3:0]: 1h = 32-bit I/O decode (4 GB) Minimum alignment: 4 KB (lower 12 bits implied zero) I/O Limit Register (offset 1Ch [15:8]) bits [7:4] = I/O Limit [15:12] bits [3:0] = same caps Lower 12 bits of limit address implied to be FFFh Full Limit address = bits [15:12] concatenated with 0xFFF Maximum window granularity: 4 KB minimum
Figure 5 — I/O Base and Limit encoding. Only the upper 4 bits carry the address; the lower 12 bits are implied (0s for base, Fs for limit). This forces 4 KB alignment and a 4 KB minimum window size. For example, Base = 40h and Limit = 4Fh encodes the range 4000h–4FFFh. For 32-bit I/O, the I/O Base Upper 16 Bits and I/O Limit Upper 16 Bits registers at offset 30h extend the address to 32 bits.
RegisterOffsetAccessImplied bitsMinimum window
I/O Base 1Ch [7:0] RW Bits [11:0] = 000h (base always 4 KB aligned) 4 KB
I/O Limit 1Ch [15:8] RW Bits [11:0] = FFFh (limit always ends at 4 KB boundary − 1)
I/O Base Upper 16 30h [15:0] RW Only used when bits [3:0] of I/O Base = 1h (32-bit decode) Provides bits [31:16] of base address
I/O Limit Upper 16 30h [31:16] RW Only used when bits [3:0] of I/O Base = 1h (32-bit decode) Provides bits [31:16] of limit address
I/O space is discouraged in PCIe. Legacy I/O transactions still work for backward compatibility with old drivers and devices, but all modern PCIe-native devices should use only memory-mapped I/O (MMIO). Many systems limit I/O address space to 16 bits (0–65535), and since I/O Base/Limit registers can only specify 4 bits of the address, there can be at most 16 non-overlapping I/O windows per system, which is a severe constraint.

📋 Non-Prefetchable Memory Base and Limit

The non-prefetchable memory window at offset 20h covers MMIO regions where reads have side effects — control/status registers, hardware FIFOs, registers that clear on read. The bridge forwards any memory TLP whose address falls in [Memory_Base, Memory_Limit] downstream.

NP Memory Base/Limit — Offset 20h, 32-bit Only, 1 MB Minimum Memory Base [15:0] (NP-MMIO) bits [15:4] = Base Address [31:20] bits [3:0] = 0000 Lower 20 bits of base address implied = 0x00000 Base always aligned on a 1 MB boundary 32-bit addressing only — no 64-bit variant for NP-MMIO Memory Limit [15:0] (NP-MMIO) bits [15:4] = Limit Address [31:20] bits [3:0] = 0000 Lower 20 bits of limit address implied = 0xFFFFF Limit ends at (1 MB boundary − 1) Smallest window = 1 MB. Largest = entire 32-bit space
Figure 6 — NP Memory Base/Limit. Only the upper 12 bits are stored (address bits [31:20]). The lower 20 bits are implied: 0x00000 for base (1 MB aligned), 0xFFFFF for limit (ends at top of 1 MB region). Example: Base = F900h, Limit = F900h → covers F900_0000h–F90F_FFFFh (exactly 1 MB). Even if a downstream endpoint only claims 4 KB, the bridge must open a 1 MB window — wasting the remaining 1020 KB.

The minimum window granularity of 1 MB means bridges always waste some address space. If a downstream endpoint claims a 4 KB MMIO BAR at F900_0000h, the bridge’s window must be programmed as F900h/F900h — opening 1 MB even though only 4 KB is used. This dead space (F900_1000h–F90F_FFFFh) cannot be assigned to other endpoints on different buses because the bridge would forward those accesses incorrectly.

📋 Prefetchable Memory Base and Limit

The prefetchable memory window at offsets 24h–2Ch covers MMIO regions where reads have no side effects and write merging is permitted. GPU framebuffers, NVMe device memory, and large DMA ring buffers are typical occupants. The prefetchable window supports both 32-bit and 64-bit addressing.

RegisterOffsetWidthAccessNotes
Prefetchable Memory Base 24h [15:0] 16 bits RW Bits [15:4] store address bits [31:20]. Bits [3:0]: 0h = 32-bit prefetchable, 1h = 64-bit prefetchable (uses the Upper 32-bit registers at 28h/2Ch). Same 1 MB alignment as NP-MMIO.
Prefetchable Memory Limit 24h [31:16] 16 bits RW Same encoding as base — bits [15:4] store address bits [31:20], lower 20 implied FFFFFh. Bits [3:0] = same capability indicator as base.
Prefetchable Base Upper 32 28h 32 bits RW When the window is 64-bit (bits [3:0] of Prefetchable Base = 1h), this register holds bits [63:32] of the base address. All-zeros for 32-bit windows. A modern GPU with 24 GB of framebuffer needs a 64-bit P-MMIO window.
Prefetchable Limit Upper 32 2Ch 32 bits RW Bits [63:32] of the limit address for a 64-bit window. All-zeros for 32-bit windows. Together with the main limit register it specifies the complete 64-bit limit of the prefetchable range.
Modern GPUs require 64-bit prefetchable windows. A top-end GPU may have 24–48 GB of device memory plus large PCIe BAR regions. A 32-bit prefetchable window can only cover 4 GB total. Software that programs a 32-bit window for a device needing 64-bit space will truncate the BAR and the device will not function correctly. The 64-bit path — where bits [3:0] of Prefetchable Base = 1h and both Upper 32-bit registers carry valid address bits — is essential for any Gen 4/5/6 GPU or AI accelerator.

📋 Secondary Status Register

Offset 1Ch bits [31:16]. The Secondary Status register mirrors the Status register at offset 04h, but it reports conditions observed on the secondary (downstream) bus rather than the primary bus. It has the same bit definitions and uses the same RW1C (write-1-to-clear) sticky error bits.

BitNameAccessMeaning
2166 MHz CapableROLegacy PCI. Always 0 for PCIe-native bridges.
23Fast Back-to-Back CapableROLegacy PCI. Always 0 for PCIe-native bridges.
24Master Data Parity ErrorRW1CBridge acting as master on secondary bus received a poisoned TLP. Set when Parity Error Response Enable (Command bit 6) is set. Latches — write 1 to clear.
[26:25]DEVSEL TimingROLegacy PCI. Returns 01b (Medium) for PCIe bridges.
27Signaled Target AbortRW1CBridge sent a CA (Completer Abort) completion on the secondary bus side.
28Received Target AbortRW1CBridge received a CA completion from a downstream device.
29Received Master AbortRW1CBridge received a UR (Unsupported Request) completion from a downstream device.
30Received System ErrorRW1CBridge received an ERR_FATAL or ERR_NONFATAL message on the secondary bus.
31Detected Parity ErrorRW1CBridge received a poisoned TLP on the secondary bus regardless of Parity Error Response Enable.

The distinction between the primary Status register and the Secondary Status register matters for diagnosing errors: if an error bit is set in primary Status, the problem originated upstream of this bridge; if set in Secondary Status, the problem originated downstream. This helps narrow down error sources in multi-bridge topologies.

📋 Bridge Control Register

Offset 3Ch bits [31:16]. The Bridge Control register is the Type 1 equivalent of parts of the Command register plus bridge-specific bits. It controls the bridge’s behaviour on its secondary bus side.

Bridge Control Register — 16 bits at Offset 3Ch [31:16] 15:10 Rsvd 9 Sec Bus Reset 8 Master Abort 7 Fast B2B 6 Sec Dis Timer 5 Discard Timer St 4 Discard Timer En 3 VGA 16 2 VGA En 1 SERR Enable 0 Parity Error En Most used bits for PCIe root/switch port operation Bit 0 Parity Error Response: mirror of Command bit 6 but applied to secondary bus. Enable for AER. Bit 1 SERR Enable: forward ERR messages from secondary. Bit 9 Secondary Bus Reset: assert hot reset on downstream link.
Figure 7 — Bridge Control register bit layout. Bit 9 (Secondary Bus Reset) is the most operationally important bit — writing 1 asserts an in-band reset on the secondary bus and all downstream buses. This is how Hot Reset propagates. Bit 1 (SERR Enable) forwards error messages upstream; this must be set for AER error reporting to work across the bridge.
BitNameResetMeaning when set to 1
0Parity Error Response Enable0Bridge responds to parity errors on secondary bus. Mirror of primary Command register bit 6 but for the secondary side.
1SERR# Enable0Bridge forwards ERR_FATAL and ERR_NONFATAL messages received on the secondary bus upstream. Must be set for AER-based error propagation to the Root Complex.
2ISA Enable0Legacy ISA. When set, the bridge does not forward I/O addresses in the top 768 bytes of each 1 KB block downstream (reserves them for ISA). Not applicable in modern PCIe systems.
3VGA Enable0Bridge forwards VGA-compatible I/O (3B0h–3BFh, 3C0h–3DFh) and memory (A0000h–BFFFFh) downstream regardless of I/O and memory window settings.
4VGA 16-bit Decode0When VGA Enable is set and this bit = 1, only 16-bit I/O addresses are used for VGA decode (not full 32-bit). Legacy.
5Master Abort Mode0Legacy PCI. Controls bridge behaviour on receiving a Master Abort. Not used in PCIe.
6Secondary Bus Reset0The most important bit. When set to 1, the bridge asserts an in-band reset (Hot Reset via TS1 ordered sets) on the secondary link. All devices downstream see a reset and restart link training. Used by software to reset a downstream device without a system-wide reset. Writing 0 de-asserts the reset and recovery begins.
7Fast Back-to-Back Enable0Legacy PCI only. Has no effect in PCIe.
8Primary Discard Timer0Legacy PCI delayed transaction discard timer. Not used in PCIe.
9Secondary Discard Timer0Legacy PCI. Not used in PCIe.
10Discard Timer Status0Legacy PCI. Not used in PCIe.
11Discard Timer SERR# Enable0Legacy PCI. Not used in PCIe.
[15:12]Reserved0Must return 0 when read.

📋 BAR0 and BAR1 in Type 1

A Type 1 header has two BARs at offsets 10h and 14h — the same positions and encoding as BAR0/BAR1 in a Type 0 header. These BARs are for the bridge’s own register space — switch management registers, configuration space access ports, debug registers, or performance counters. They are separate from the downstream address windows (I/O, NP-MMIO, P-MMIO).

Many PCIe switches have their management registers accessible via a 64-bit prefetchable MMIO BAR programmed into BAR0/BAR1. Software reads and writes these to query switch status, configure QoS, and manage power. The Base/Limit registers at offsets 20h–2Ch do not cover the bridge’s own BAR space — they only define which address ranges are forwarded further downstream.

If a bridge has no internal MMIO registers, BAR0 and BAR1 are hardwired to 0 and software skips them during allocation, exactly as with unused BARs in a Type 0 header.

📋 Expansion ROM Base Address

Offset 38h. Same format as the Expansion ROM BAR in a Type 0 header. Bridges rarely have Expansion ROMs — this field is typically all zeros. When present, it usually holds bridge initialisation code that runs at POST time to configure the bridge before the OS loads.

Bit 0 is the Enable bit. Bits [10:1] are hardwired to 0 (ROM minimum alignment = 2 KB). Bits [31:11] hold the base address once programmed. Software uses the same write-all-1s sizing procedure as for Type 0 Expansion ROM.

📋 Capabilities Pointer and Interrupt

The Capabilities Pointer at offset 34h [7:0] works identically to the Type 0 version — it points to the first PCI Capability structure in the linked list. All PCIe bridges must implement at minimum the Power Management Capability and the PCIe Capability. Switches also commonly implement ACS (Access Control Services) and MSI-X for management interrupts.

Capability IDMandatory for bridges?Purpose
01hYesPower Management — D0/D1/D2/D3hot/D3cold states for the bridge
10hYesPCIe Capability — Link Control/Status, Device Control/Status, link training info
0Dh (ext)RecommendedACS — Access Control Services — prevents DMA from bypassing IOMMU via peer-to-peer
0001h (ext)RecommendedAER — Advanced Error Reporting — detailed error logging at the bridge level

Interrupt Line and Interrupt Pin at offset 3Ch [15:0] work as in Type 0. Most bridge devices do not generate interrupts themselves, so Interrupt Pin = 0 (no interrupt). Some switch management ports use an MSI-X capability for hot-plug and error notifications — these are declared via the Capabilities linked list, not via the legacy Interrupt Pin field.

📋 Disabling Unused Windows

Not every bridge will have devices downstream that use all three address windows. For windows that are not needed, software must program them in the disabled state. You cannot simply write all zeros — that would create a valid zero-address window. The correct method is to write Limit less than Base:

WindowDisabled stateWhy Base > Limit works
I/OIO Base = F0h, IO Limit = 00h (Limit < Base)Bridge sees that the limit address is lower than the base address — an impossible range — and treats it as “no I/O downstream”
Non-Prefetchable MemoryMemory Base = FFF0h, Memory Limit = 0000hSame logic — limit below base = invalid range = no NP-MMIO window
Prefetchable MemoryPref Base = FFF1h, Pref Limit = 0000h (also zero Upper 32 regs)Same — disabled. The Upper 32-bit registers must also be zeroed to prevent a wrap-around window in 64-bit space
Never leave windows uninitialized. At power-on, the contents of these registers are undefined. An uninitialized Memory Base register could accidentally forward all TLPs in a huge range downstream, corrupting unrelated devices. BIOS must initialise all windows to disabled state (Base > Limit) before enabling the bridge by setting Memory Space Enable and Bus Master Enable in the Command register.

📋 How TLP Routing Uses These Registers

When a TLP arrives at a bridge’s ingress port, the bridge makes a routing decision based on TLP type:

TLP Routing Decision at a Type 1 Bridge — All Three TLP Types Configuration TLP Target = Bus:Dev:Fn If Target Bus == Sec Bus#: Convert Type 1 → Type 0 Forward downstream If Sec < Target ≤ Sub: Keep as Type 1 Forward downstream Else: ignore (not for us) Memory TLP Target address checked against NP-MMIO window AND Prefetchable MMIO window If address in either window: Forward downstream If address in bridge’s own BAR: Consume (bridge is target) Else: ignore or UR I/O TLP Target address checked against I/O Base/Limit window If address in I/O window: Forward downstream If address in bridge’s BAR: Consume Else: ignore or UR
Figure 8 — TLP routing decisions at a Type 1 bridge. Configuration TLPs route by Bus Number (using the Primary/Secondary/Subordinate trio). Memory TLPs route by address (using NP and P-MMIO windows). I/O TLPs route by address (using I/O window). The bridge itself is also a target for TLPs addressing its own BARs — these are consumed rather than forwarded.

Completion TLPs (responses to read requests) use ID routing — they carry the Requester ID (bus/device/function) of the original requester and are forwarded upstream through bridges whose [Secondary, Subordinate] range includes the requester’s bus number.

⚡ Type 1 Header in Gen 6

The Type 1 header layout — all register positions, the bus number triple, all three address windows, Secondary Status, Bridge Control — is completely unchanged in Gen 6. Gen 6 changes only the Physical Layer. Software enumerates a Gen 6 system identically to a Gen 1 system, writes the same bus number registers, and programs the same memory windows.

What changes in the configuration space of a Gen 6 bridge is in the Extended Configuration Space (offset 100h+), not in the Type 1 header itself: a new Physical Layer 64.0 GT/s Capability structure, CXL-specific extensions for CXL 3.0 deployments, and ACS enhancements for multi-tenant SR-IOV topologies. None of these affect the Type 1 header fields described in this post.

Bridge operation is generation-agnostic. A bridge running at 64 GT/s PAM4 Gen 6 routes TLPs using the same Primary/Secondary/Subordinate comparison, the same NP-MMIO window check, and the same Secondary Bus Reset bit as a Gen 1 bridge. Firmware that programs bridges correctly for Gen 5 works identically for Gen 6.

📋 Quick Reference

Register / FieldOffsetAccessKey rule or value
Vendor/Device ID, Command, Status, Class Code (06h.04h.00h), BAR0, BAR100h–14hsame as Type 0Class Code identifies a PCIe P2P bridge. BAR0/BAR1 for bridge’s own MMIO, not downstream windows.
Primary Bus Number18h [7:0]RWBus upstream of this bridge. Root Port = 0. Written by enumeration software.
Secondary Bus Number18h [15:8]RWBus directly downstream. Devices on this bus use this number. Assigned at enumeration.
Subordinate Bus Number18h [23:16]RWHighest bus reachable downstream. Initially FFh during depth-first scan, updated after subtree completes.
Secondary Status1Ch [31:16]mixedSame bit layout as primary Status. Reports secondary bus errors. RW1C sticky bits.
I/O Base / Limit1Ch [15:0]RWBits [7:4] each = address bits [15:12]. Lower 12 implied (0s base, Fs limit). 4 KB minimum. Disable: Limit < Base.
I/O Base/Limit Upper 1630hRWUsed only for 32-bit I/O decode (bits [3:0] of I/O Base = 1h). Zero for 16-bit decode.
Memory Base / Limit (NP)20hRWAddress bits [31:20]. Lower 20 implied (0s / Fs). 1 MB minimum. 32-bit only. Disable: Limit < Base.
Prefetchable Base / Limit24hRWSame encoding as NP. Bits [3:0] = 0h (32-bit) or 1h (64-bit). Use Upper 32-bit regs at 28h/2Ch for 64-bit.
Pref Base/Limit Upper 3228h, 2ChRWAddress bits [63:32] for 64-bit P-MMIO window. Required for Gen 4/5/6 GPU with >4 GB framebuffer.
Capabilities Pointer34h [7:0]ROPoints to PCI Capability list. PM and PCIe Capability mandatory for all bridges.
Expansion ROM38hmixedUsually 0 for bridges. Same format as Type 0.
Interrupt Line / Pin3Ch [15:0]mixedUsually 0. MSI-X used for switch management interrupts if needed.
Bridge Control3Ch [31:16]RWBit 0: Parity Error Response. Bit 1: SERR Enable (forward errors). Bit 6: Secondary Bus Reset (Hot Reset downstream). All others legacy or reserved.
Config TLP routing rule——Bus == Secondary → Type 0 conversion. Secondary < Bus ≤ Subordinate → Type 1 forward. Outside → ignore.
Memory TLP routing rule——In NP-MMIO or P-MMIO window → forward. In bridge BAR → consume. Else → ignore or UR.
Disabling windows——Set Limit < Base for any unused window. Never leave uninitialized — BIOS must initialise all windows before enabling bridge.
Scroll to Top