When your CPU issues a non-posted PCIe transaction — a memory read, a configuration read, an I/O read — it's asking a question and expecting an answer. That answer is called a Completion TLP (Transaction Layer Packet). But what happens if the device never answers? The CPU can't wait forever. That's what the Completion Timeout (CTO) mechanism exists to handle.

Every PCIe device with a Root Port or Endpoint has a Completion Timeout Value register in its PCI Express Capability structure. The default range specified by the spec is 50µs to 50ms, but the actual programmable ranges are grouped in four tiers:

• Range A: 50µs – 10ms
• Range B: 10ms – 250ms
• Range C: 250ms – 4s
• Range D: 4s – 64s

Most consumer systems default to somewhere between 50ms and 50ms (typical Range B setting). Enterprise NICs and NVMe drives often program Range A for aggressive detection of stuck transactions.

What happens when a timeout fires? The Root Complex synthesizes a fake "Unsupported Request" completion internally, then delivers it to the CPU's load buffer. The pending load — which has been sitting in the Load Queue holding an ROB slot for potentially tens of milliseconds — finally retires. But the data returned is all-ones (0xFFFFFFFF). This is the classic signature of a dead PCIe device: your MMIO read returns all F's.

Real-world example: You hot-unplug an NVMe drive while a read is in flight. The kernel's NVMe driver issued an MMIO read to the doorbell register. The device is gone. Fifty milliseconds later, the CTO fires. The load returns 0xFFFFFFFF. The driver interprets this as "device removed" (because no valid register would ever read all-ones) and unwinds the I/O with an -EIO error to userspace. Meanwhile, an Advanced Error Reporting (AER) log entry is generated and the OS eventually issues a surprise-removal notification.

Rule of thumb: If you see a Linux kernel log spam of "PCIe Bus Error: severity=Corrected, type=Data Link Layer" followed by MMIO reads returning 0xFFFFFFFF, that's a device that stopped answering completions — either it's dying, its link retrained, or it's stuck in a reset. The CTO is what turned a hang into a bounded failure.

Without the CTO, a broken device would permanently stall an ROB slot, eventually filling the reorder buffer and hanging the core. The completion timeout is what turns "infinite hang" into "50ms latency spike plus a clean error path."