How does a PCIe device know that its 4K configuration space is mapped to memory address?
Taking the Base Address Registers as an example, these are either 32bit or 64bit (combined BAR0/BAR1, etc.) registers which as the name suggests are initialised with an address which points to the start (base) of a memory, set by root complex (RC) during initialisation.
How do you set the length though? There is no length register. Instead your device hardwires enough LSBs in the register to zero. The first thing the RC does is write to all BARs in all devices a value of 0xFFFF-FFFF-FFFF-FFFF. It then reads back the BAR values, which in the case of say a 256 byte BAR would read back 0xFFFF-FFFF-FFFF-FF00 because the lower 8 bits are masked by your device to always be zero. For a 64kB bar it would read back with 0000 at the end. For a 4GB bar it would read back with 00000000 at the end.
The RC will then assign an address to the BAR which is guaranteed to be aligned to at least the size of the BAR (a 256 byte BAR will never be assigned an address that isn't aligned to at least 256 bytes - usually it will be aligned to 4kB or the page size if smaller than it).
This address is a physical address within the system. Whenever another device (e.g. CPU) need to access the memory your BAR describes, it uses this address to do so. When a TLP is sent to your device, the lower bits will be the address within the memory, and the upper bits will always equal the BAR value. To work out which BAR was being addressed, you simply mask enough LSBs (8 for a 256byte memory) and compare the resulting value against the BAR value to see if it matches.

For configuration information, all PCIe devices support a &quot;PCI Compatible&quot; configuration space of 256 bytes which are always located as the first bytes within the device - the RC can simply send a read request to address 0 ofthe device to access this configuration space. No special setup required, all devices must have it. This space includes details such as supported link speed, lane widths, error information, link training statuses, and device capabilities.
PCIe devices require more space than this compatible header to provide additional configuration and capability information. To acheive this, the configuration header includes an 8-bit address field called the &quot;Capabilities Pointer&quot; which stores an additional set of PCIe specific capabilities, again within the first 256 bytes of the devices address space.
Device manufacturers then want even more space to add their own custom configuration and capabilities information to inform their drivers how to operate and what features are available. This is acheived using a linked list approach. The PCIe capabilities block has a field called the &quot;Next capabilities pointer&quot; which gives the memory offset within the device for the first manufacturer specific capabilities structure. Each capabilities structure has a pointer to the next allowing them to be placed anywhere within the first 4kB address space within the device.
The configuration space is typically accessed using configuration read and write TLPs. If the CPU supports ECAM (Enhanced Config Access Mechanism), the configuration information can be accessed by software without requiring an understanding of the configuration space through the CPU treating the configuration space as a flat memory map across all devices. Each device is given an address within this space whereby the address used by software has the bus, device, and function address information embedded within it.