Access PCI Configuration Space

PCI configuration space

PCI devices expose 256 bytes (or 4 KB extended) of configuration registers per function. Access via I/O ports 0xCF8 (address) and 0xCFC (data) with enable bit set. For example, to read vendor/device ID of bus 0 dev 0 fn 0, write 0x80000000 to 0xCF8 and read 0xCFC.

Config cycle

nasmCopy
Loading…

• Bus/dev/fn/offset packed into the address port
• BAR registers: Tell you MMIO and I/O ranges to map
• Command register: Enable I/O and memory space decode
• Enumerate functions 0-7 per device; read header type for multifunction bit

BAR decoding

After reading vendor/device IDs, read command register bit 1 and 2 to see if I/O and memory space are enabled. BAR0 low bits encode whether the region is I/O or memory and whether it is 32- or 64-bit. QEMU exposes host bridges on bus 0; plug-in devices appear on higher slot numbers. Config reads return 0xFFFFFFFF for nonexistent functions; mask with size probe writes to discover BAR lengths.

Why for this exercise

You will scan PCI buses and print vendor/device IDs using config port I/O. This exercise requires building the 0xCF8 address dword and interpreting the first config dword as vendor plus device identifiers.