I found that I can do
board.mb.socket_pci_conf[0].read 0 2
To read from Bus 0, Device 0, Function 0, Offset 0, 2 bytes. But I haven't been able to find the right way to encode arbitrary BDFOs. (And after offset 0x1FFF it starts saying that there's nothing mapped, so I can't simply uses a BDF * 0x1000 calculation)
I also can see things like "board.mb.nb.ioxapic" in the Object Browser, but it would be much easier if I could just specify addresses for registers exactly as described in the datasheet, instead of having to figure out how they were translated to human-named devices.
Are you looking for the control registers of the devices or the PCI Conf space?
The addresses used to access the hardware control registers are the physical addresses where the PCI devices get mapped to. The precise mapping depends on the hardware setup and software decisions, and some PCIe devices might move in the memory map if you add additional PCIe cards to the system.
Thus, the advice is to boot the target system and then inspect the memory maps to find where each set of control registers and other BARs got mapped in physical memory.
In general, to access registers from the command line, the it is better to rely on the named banks and named registers. Addresses are good for software, but for inspection and control it is better to go with names.