At first, if a PCIe Switch supports Access Control Services(ACS) and the host software configures the Switch to redirect a P2P transaction to upstream, the Switch forwards the transaction towards Root Complex. So there is a case that a P2P transaction is forwarded to upstream.
If the Switch does not support ACS or the host software disables ACS, the PCIe Switch will forward a P2P transaction to downstream directly. I think this routing is mandatory because the internal bridges of the PCI Switch should perform as conventional PCI-PCI bridges.
Here are some references:
If you can access the latest PCIe Specification, you can read about ACS capability in the spec. But if you are not a member, you can read the ECN of ACS because it is public, which will also be helpful. PDF
Intel provides the useful document that describes why ACS is required.
Here VMware requests that the PCIe Switch must support ACS to use PCI Passthrough.