Topology
Enumeration and Configuration Space
Before a driver touches a device, something has to find it, number it and give it addresses. That walk is enumeration, and it explains most of what lspci prints.
A function is addressed before it is used
A device on a PCI Express fabric is not found. It is told what it is.
Enumeration is the walk that gives every function on the fabric an address, and it runs before any driver loads: firmware and the operating system sweep the tree, number each function, and write its ranges into the system map. This page follows that walk, and stops where the documents the desk read stop. Before the walk can start, each link has to come up: the counted run of states that precedes it is described in the sequence read as counts.
The pieces are small. Each function carries its own configuration space, 256 bytes in the legacy PCI model, extended up to 4096 bytes starting with PCI-X 2.0 and PCI Express. A non-bridge device can implement up to six Base Address Registers, each mapping a region of 16 bytes to 2 gigabytes into I/O port or memory-mapped address space. Firmware programs those registers during the sweep, which is how a card learns where its resources sit in the system address map.
Why does a point-to-point fabric need addresses at all?
Because the wiring no longer does that work. The move away from a shared parallel bus replaced one set of lines that every device contended for with point-to-point links, each device reaching the root complex over its own link. A switch keeps the shape of a tree: one upstream port toward the root complex or another switch, and one or more downstream ports toward what sits below, which is how a single root complex port serves more slots than it has native lanes for. The shared bus this replaced, and the parts of it the paperwork kept, are set out in the account of the transition.
Over those links the two ends send ordinary requests: configuration, I/O, or memory read and write, plus interrupts, legacy INTx or the message-based MSI and MSI-X. A request that can travel two switches deep has to name its destination, and that is the job the bus, device and function numbers do. The tree has its own page on root ports and switches.
Three numbers, sixteen bits
The address is written bus:device:function, and the widths are fixed: an 8-bit bus number, a 5-bit device number, a 3-bit function number. Multiplied out, that allows 256 buses, 32 devices on each, and 8 functions in each device, a theoretical ceiling of 65,536 addressable device functions. That ceiling is arithmetic, not a population figure, and the material read for this page gives no count for a real platform. Who assigned a given number is a matter of which firmware ran the sweep.
| Field | Width | Distinct values | What it selects |
|---|---|---|---|
| Bus number | 8 bits | 256 | up to 256 buses |
| Device number | 5 bits | 32 | up to 32 devices on a bus |
| Function number | 3 bits | 8 | up to 8 functions in a device |
What the configuration space holds
Configuration space is the register block a function exposes before any driver is involved: the software doing the walk reads identity and requirements from a device it knows nothing else about. The legacy layout is 256 bytes per function, the extension to 4096 bytes arrived with PCI-X 2.0 and PCI Express, and a multi-function device gives each function its own.
The Base Address Registers sit in that space, up to six per non-bridge device, each decoding a region of 16 bytes to 2 gigabytes into I/O port space or memory-mapped space. Firmware writes the base addresses during the sweep, and what it wrote is the first thing to read back when a function does not answer. When the function is absent rather than mute, the question becomes who ordered the link down, a question the page on deliberate stops answers separately.
Where does the vocabulary run out?
Three words carry a lot of this page: enumeration, endpoint, bridge. The desk searched the PCI Express article it read on September 6, 2026 for each of them, and none is defined there. All three are in use across the ecosystem and implied by the material above, but on this page they are common industry usage rather than something the desk could trace to a document it read. The source that would define them is the base specification, which the desk has not read for this purpose.
The link comes up before the number does
A link negotiates its width during device initialization, and either end can restrict it, which is why a card wired with fewer lanes than its slot supports still comes up. The document that names the mechanism is the PHY interface specification, revision 7.1, September 2025, Intel reference number 643108. It names the Link Training and Status State Machine and the states Detect.Quiet, Polling, Configuration, Recovery, L0, L0s, L1, L2, Loopback and Disabled, and it puts two of them in motion: receiver detection in Detect.Quiet should be bypassed so the machine proceeds to Polling, and a return to Detect on a timeout should be followed by a new Polling attempt on an electrical idle exit or after 30 to 100 ms. How a link trains and what the PIPE interface is have their own pages.
The same order holds for a card inserted while the system runs: the PRSNT1# and PRSNT2# presence-detect pins are slightly shorter than the contacts around them, so the system can confirm a card is fully seated before the rest of the link is brought up. The material gives the pin mechanism, not the firmware sequence that follows.
Enumeration assigns bus, device and function numbers and sizes the memory and I/O apertures a device requests, but the configuration header holds more than those base address registers. Behind it sit the capability lists, where a function declares optional features and points to the structures that describe them. Reading those structures is a separate exercise from walking the bus, and it rewards a slower pass through the specification. A newer page at the same desk, on capability registers, follows that thread and covers what a device says about itself.
Enumeration walks the bus, assigns addresses, and sizes each BAR, but the configuration space it reads also carries the fields that name a device: vendor and device IDs, class code, revision, and subsystem identifiers. Those registers are what software matches against a driver, so a walk that stops at address assignment leaves half the picture unread. The newer page on identity fields at the identity fields desk covers the nameplate registers in the same sourced, revision-noted style as the rest of the reading desk. Read it after this page to see how a device announces what it is.
Enumeration begins before any driver binds: the host walks the bus, assigns addresses, and inspects each function's configuration space to learn what is present. The base address registers, the class code, and the capability list are read in that order, and each read shapes the next step of the walk. A later page examines that walk as an inspection, treating configuration space as the record the host reads first and the assumptions it makes along the way. Readers who want that view can continue with what the host reads first, which follows the same subject from the host's side of the link.
Where each figure on this page comes from
The address widths, counts, configuration space sizes and BAR limits come from the PCI Express article read on September 6, 2026, a secondary source. The state names come from a document read directly: the PHY Interface for the PCI Express, SATA, USB 3.2, DisplayPort and USB4 Architectures Specification, revision 7.1, September 2025, Intel reference number 643108. A figure backed only by the secondary source is confirmed as published, not as primary.
Four checks to run on hardware in front of you
- Read the bus:device:function triples your system prints and confirm each field stays inside the widths in the table above.
- Count one non-bridge device's Base Address Registers against the ceiling of six.
- Check each BAR region against the 16 byte floor and the 2 gigabyte ceiling.
- On an add-in card, compare the PRSNT1# and PRSNT2# contact fingers with the ones beside them: which pair is shorter?
Common mistakes
- Treating 65,536 as a population figure. It is the arithmetic ceiling of the three address fields, not a count a platform reaches.
- Reading a switch's downstream ports as added lanes. Fan-out gives one root complex port more slots than it has native lanes for, not more lanes.
- Quoting enumeration, endpoint or bridge as defined terms. The desk could not trace any of them to a document it read.
- Describing what an LTSSM state does from recollection: the specification read for this page names the states, it does not describe them.
If you take one measurement from this page, take the order: boot a machine with firmware output visible and read the sequence in which functions receive their addresses. Then read one function's base addresses back against the ranges the system map shows free, and leave unverified any term you cannot point to a definition for. That reading-back habit, done across a whole delivery rather than a single register, is what the sign-off list turns into an acceptance.