1. Introduction
The header of a Transaction Layer Packet (TLP)** is the most critical section of the PCI Express data path** — it defines what kind of transaction is being performed, where it is going, and how it should be handled.
Unlike older PCI buses, where control signals were transmitted on dedicated lines, PCIe Encodes all control information within the packet header itself.
Every TLP starts with a header of 3 or 4 doublewords (DW) (12 or 16 bytes). The exact size depends on the addressing mode (32-bit or 64-bit) and whether the TLP carries data.
2. TLP Format Classification
Each packet begins with two key fields: Format (Fmt) and Type.
Together, they tell the receiver what kind of transaction the packet represents and whether data is present.
| Fmt Field (2 bits) | Type Field (5 bits) | Meaning |
| 00 | 00000 | Memory Read (no data) |
| 10 | 00000 | Memory Write (with data) |
| 00 | 00100 | I/O Read |
| 10 | 00100 | I/O Write |
| 00 | 00101 | Configuration Read Type 0 |
| 10 | 00101 | Configuration Write Type 0 |
| 00 | 00110 | Configuration Read Type 1 |
| 10 | 00110 | Configuration Write Type 1 |
| 00 / 10 | 01100 – 01111 | Message packets |
| 00 | 01010 | Completion (no data) |
| 10 | 01010 | Completion (with data) |
💡 Quick Tip:
Fmt defines presence of data and address width, while Type defines transaction intent (memory, config, message, completion, etc.).
3. TLP Header Field Breakdown
Let’s examine the common fields present in all TLP headers:
| Field Name | Width | Purpose |
| Fmt (Format) | 2 bits | Specifies header format (3DW/4DW) and whether data payload exists |
| Type | 5 bits | Identifies the transaction type (Memory, I/O, Config, Message, Completion) |
| Traffic Class (TC) | 3 bits | Defines priority/virtual channel for Quality of Service (QoS) |
| TD (TLP Digest) | 1 bit | Indicates presence of End-to-End CRC (ECRC) |
| EP (Error Poisoned) | 1 bit | Marks packet as containing poisoned data |
| Attr | 2 bits | Specifies caching, ordering, and ID-based ordering attributes |
| Length | 10 bits | Indicates number of doublewords (DW) in payload (0–1024 DWs) |
| Requester ID | 16 bits | Identifies source of the transaction |
| Tag | 8 bits | Uniquely identifies the request (used to match completions) |
| Last BE / First BE | 4 + 4 bits | Byte Enable masks for partial data writes |
| Address (32 or 64 bits) | Variable | Target memory or I/O address |
4. Header Format Variations
(A) 3-DW Header (32-bit address, no data)
Used for small requests, such as Memory Reads, I/O Reads/Writes, or Configuration Accesses.
DW0: [Fmt, Type, TC, TD, EP, Attr, Length]
DW1: [Requester ID, Tag, Last BE, First BE]
DW2: [Address (31:2), Reserved]
(B) 4-DW Header (64-bit address, no data)
Used when addressing memory beyond 4 GB.
DW0: [Fmt, Type, TC, TD, EP, Attr, Length]
DW1: [Requester ID, Tag, Last BE, First BE]
DW2: [Address (63:32)]
DW3: [Address (31:2), Reserved]
(C) 3-DW or 4-DW Header (with data)
Same as above, but followed by one or more data doublewords (payload).
5. Special Fields Explained
Traffic Class (TC)
Used to separate transactions into different Virtual Channels (VCs) for Quality of Service.
Example: Isochronous traffic can be assigned a higher TC for guaranteed latency.
TLP Digest (TD)
If set, an ECRC follows the data payload.
- Set to 1 → Digest present
- Set to 0 → No digest
This optional ECRC gives end-to-end integrity across multiple hops, beyond link-level reliability.
Error Poison (EP)
If a device detects a corrupted payload but must still forward it (e.g., for diagnostics), it sets EP = 1.
Receivers treat this as poisoned data and prevent its use.
Attributes (Attr[1:0])
- 00 – No Snoop = Disabled, Relaxed Ordering = Disabled
- 01 – No Snoop = Disabled, Relaxed Ordering = Enabled
- 10 – No Snoop = Enabled, Relaxed Ordering = Disabled
- 11 – Both Enabled
These bits influence transaction ordering and caching rules.
6. Byte Enables (BE)
Each TLP specifies which bytes in the first and last doubleword are valid using First BE and Last BE fields.
Example:
A 3-DW header with First BE = 1100b and Last BE = 1111b means:
- The first doubleword only uses the upper 2 bytes.
- The last doubleword uses all 4 bytes.
This supports unaligned memory writes without requiring byte-level transfers.
7. Addressing
- 32-bit (3-DW) TLPs use only the lower 32 bits of the address field.
- 64-bit (4-DW) TLPs include an extra word for upper address bits.
Address bits [1:0] are always zero since PCIe transfers operate on doubleword boundaries (4 bytes).
8. Example – Memory Write TLP (3 DW Header)
Let’s decode a typical 3DW Memory Write TLP header:
| Field | Value | Meaning |
| Fmt | 10b | With Data, 3DW |
| Type | 00000b | Memory Write |
| TC | 000b | Default Traffic Class |
| TD | 0 | No ECRC |
| EP | 0 | Not poisoned |
| Attr | 00 | Default ordering |
| Length | 4 | 4 DW payload (16 bytes) |
| Requester ID | 0008h | Function #8 |
| Tag | 05h | Unique request ID |
| First BE | 1111 | Full data valid |
| Last BE | 0000 | Not used (single DW) |
| Address | 0x0008_1000 | Target memory address |
This would write 16 bytes starting at 0x0008_1000.
9. Hardware Design Perspective
From a hardware design point of view:
- The TLP header decoder is often implemented as a combinational parser using the Fmt/Type bits to select field extraction paths.
- The ECRC generator/checker is part of the TLP assembly logic in the Transaction Layer.
- For verification, TLP header templates are pre-defined in UVM testbenches to validate encoding correctness.
10. Key Takeaways
- The TLP header is the brain of each transaction, encoding all essential control information.
- The Fmt and Type fields together identify packet structure and purpose.
- Features like Byte Enables, Attributes, and Traffic Class enable flexibility and fine-grained flow control.
- Understanding header formats is essential before studying Completions, Flow Control, and Ordering.