Topology
Enumeration and Configuration Space
Before a driver touches a device, something has to find it, number it and give it addresses. That walk is enumeration, and it explains most of what lspci prints.
A function is addressed before it is used
A device on a PCI Express fabric is not found. It is told what it is.
Enumeration is the walk that gives every function on the fabric an address, and it runs before any driver loads: firmware and the operating system sweep the tree, number each function, and write its ranges into the system map. This page follows that walk, and stops where the documents the desk read stop.
The pieces are small. Each function carries its own configuration space, 256 bytes in the legacy PCI model, extended up to 4096 bytes starting with PCI-X 2.0 and PCI Express. A non-bridge device can implement up to six Base Address Registers, each mapping a region of 16 bytes to 2 gigabytes into I/O port or memory-mapped address space. Firmware programs those registers during the sweep, which is how a card learns where its resources sit in the system address map.
Why does a point-to-point fabric need addresses at all?
Because the wiring no longer does that work. The move away from a shared parallel bus replaced one set of lines that every device contended for with point-to-point links, each device reaching the root complex over its own link. A switch keeps the shape of a tree: one upstream port toward the root complex or another switch, and one or more downstream ports toward what sits below, which is how a single root complex port serves more slots than it has native lanes for.
Over those links the two ends send ordinary requests: configuration, I/O, or memory read and write, plus interrupts, legacy INTx or the message-based MSI and MSI-X. A request that can travel two switches deep has to name its destination, and that is the job the bus, device and function numbers do. The tree has its own page on root ports and switches.
Three numbers, sixteen bits
The address is written bus:device:function, and the widths are fixed: an 8-bit bus number, a 5-bit device number, a 3-bit function number. Multiplied out, that allows 256 buses, 32 devices on each, and 8 functions in each device, a theoretical ceiling of 65,536 addressable device functions. That ceiling is arithmetic, not a population figure, and the material read for this page gives no count for a real platform. Who assigned a given number is a matter of which firmware ran the sweep.
| Field | Width | Distinct values | What it selects |
|---|---|---|---|
| Bus number | 8 bits | 256 | up to 256 buses |
| Device number | 5 bits | 32 | up to 32 devices on a bus |
| Function number | 3 bits | 8 | up to 8 functions in a device |
What the configuration space holds
Configuration space is the register block a function exposes before any driver is involved: the software doing the walk reads identity and requirements from a device it knows nothing else about. The legacy layout is 256 bytes per function, the extension to 4096 bytes arrived with PCI-X 2.0 and PCI Express, and a multi-function device gives each function its own.
The Base Address Registers sit in that space, up to six per non-bridge device, each decoding a region of 16 bytes to 2 gigabytes into I/O port space or memory-mapped space. Firmware writes the base addresses during the sweep, and what it wrote is the first thing to read back when a function does not answer.
Where does the vocabulary run out?
Three words carry a lot of this page: enumeration, endpoint, bridge. The desk searched the PCI Express article it read on September 6, 2026 for each of them, and none is defined there. All three are in use across the ecosystem and implied by the material above, but on this page they are common industry usage rather than something the desk could trace to a document it read. The source that would define them is the base specification, which the desk has not read for this purpose.
The link comes up before the number does
A link negotiates its width during device initialization, and either end can restrict it, which is why a card wired with fewer lanes than its slot supports still comes up. The document that names the mechanism is the PHY interface specification, revision 7.1, September 2025, Intel reference number 643108. It names the Link Training and Status State Machine and the states Detect.Quiet, Polling, Configuration, Recovery, L0, L0s, L1, L2, Loopback and Disabled, and it puts two of them in motion: receiver detection in Detect.Quiet should be bypassed so the machine proceeds to Polling, and a return to Detect on a timeout should be followed by a new Polling attempt on an electrical idle exit or after 30 to 100 ms. How a link trains and what the PIPE interface is have their own pages.
The same order holds for a card inserted while the system runs: the PRSNT1# and PRSNT2# presence-detect pins are slightly shorter than the contacts around them, so the system can confirm a card is fully seated before the rest of the link is brought up. The material gives the pin mechanism, not the firmware sequence that follows.
Where each figure on this page comes from
The address widths, counts, configuration space sizes and BAR limits come from the PCI Express article read on September 6, 2026, a secondary source. The state names come from a document read directly: the PHY Interface for the PCI Express, SATA, USB 3.2, DisplayPort and USB4 Architectures Specification, revision 7.1, September 2025, Intel reference number 643108. A figure backed only by the secondary source is confirmed as published, not as primary.
Four checks to run on hardware in front of you
- Read the bus:device:function triples your system prints and confirm each field stays inside the widths in the table above.
- Count one non-bridge device's Base Address Registers against the ceiling of six.
- Check each BAR region against the 16 byte floor and the 2 gigabyte ceiling.
- On an add-in card, compare the PRSNT1# and PRSNT2# contact fingers with the ones beside them: which pair is shorter?
Common mistakes
- Treating 65,536 as a population figure. It is the arithmetic ceiling of the three address fields, not a count a platform reaches.
- Reading a switch's downstream ports as added lanes. Fan-out gives one root complex port more slots than it has native lanes for, not more lanes.
- Quoting enumeration, endpoint or bridge as defined terms. The desk could not trace any of them to a document it read.
- Describing what an LTSSM state does from recollection: the specification read for this page names the states, it does not describe them.
If you take one measurement from this page, take the order: boot a machine with firmware output visible and read the sequence in which functions receive their addresses. Then read one function's base addresses back against the ranges the system map shows free, and leave unverified any term you cannot point to a definition for.