We were reading the wrong address. Since we are using PEX4 we needed offset 270000, so in u-boot the CRS0 address is 0xfe270f14 as mentioned above. In Linux you add an extra f so 0xffe270f14. When booted the LTSSM state is 0x11 as expected.
0xffe270f14 90000044 00FF0000 00000000 00008000
The difficulty now is trying to read that register while Link Training. It seems this is not possible using CodeWarrior Tap so we are attempting to create some code to do it and log the LTSSM register transitions.
Thanks,
Vinny