[PATCH 0/2] PCI: BAR resize rollback fixes

[PATCH 0/2] PCI: BAR resize rollback fixes

[Ilpo Järvinen]

Hi all,

This series fixes two issue in BAR resize rollback found by
Ville Syrjälä <ville.syrjala@linux.intel.com>.

Ilpo Järvinen (2):
  PCI: Fix BAR resize rollback path overwriting ret
  PCI: Fix Resizable BAR restore order

 drivers/pci/rebar.c     | 18 +-----------------
 drivers/pci/setup-bus.c | 23 +++++++++++++++++++----
 2 files changed, 20 insertions(+), 21 deletions(-)


base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
-- 
2.39.5

[PATCH 1/2] PCI: Fix BAR resize rollback path overwriting ret

[Ilpo Järvinen]

The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize
rollback path") added BAR rollback to
pci_do_resource_release_and_resize() in case of resize failure.

On the rollback, pci_claim_resource() is called which can fail and the
code is prepared for that possibility. pci_claim_resource()'s return
value, however, overwrites the original value of ret so
pci_claim_resource() will return incorrect value in the end (as
pci_claim_resource() normally succeeds, in practice ret will be 0).

Fix the issue by directly calling pci_claim_resource() inside the if ().

Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
Cc: stable@vger.kernel.org
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
---
 drivers/pci/setup-bus.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 6e90f46f52af..9c374feafc77 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2556,8 +2556,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 
 		restore_dev_resource(dev_res);
 
-		ret = pci_claim_resource(dev, i);
-		if (ret)
+		if (pci_claim_resource(dev, i))
 			continue;
 
 		if (i < PCI_BRIDGE_RESOURCES) {
-- 
2.39.5

[PATCH 2/2] PCI: Fix Resizable BAR restore order

[Ilpo Järvinen]

The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize
rollback path") changed BAR resize to layer rebar code and resource
setup/restore code cleanly. Unfortunately, it did not consider how the
value of the BAR Size field impacts the read-only bits in the Base
Address Register (PCIe7 spec, sec. 7.8.6.3). That is, it very much
matters in which order the BAR Size and Base Address Register are
restored.

Post-337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback
path") during BAR resize rollback, pci_do_resource_release_and_resize()
attempts to restore the old address to the BAR that was resized, but it
can fail to setup the address correctly if the address has too low bits
set that collide with the bits that are still read-only. As a result,
kernel's resource and BAR will be out-of-sync.

Fix this by restoring BAR Size before rolling back the resource
changes and restoring the BAR.

Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
Cc: stable@vger.kernel.org
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
---
 drivers/pci/rebar.c     | 18 +-----------------
 drivers/pci/setup-bus.c | 20 ++++++++++++++++++--
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/drivers/pci/rebar.c b/drivers/pci/rebar.c
index ecdebdeb2dff..39f8cf3b70d5 100644
--- a/drivers/pci/rebar.c
+++ b/drivers/pci/rebar.c
@@ -295,7 +295,6 @@ int pci_resize_resource(struct pci_dev *dev, int resno, int size,
 			int exclude_bars)
 {
 	struct pci_host_bridge *host;
-	int old, ret;
 
 	/* Check if we must preserve the firmware's resource assignment */
 	host = pci_find_host_bridge(dev->bus);
@@ -308,21 +307,6 @@ int pci_resize_resource(struct pci_dev *dev, int resno, int size,
 	if (!pci_rebar_size_supported(dev, resno, size))
 		return -EINVAL;
 
-	old = pci_rebar_get_current_size(dev, resno);
-	if (old < 0)
-		return old;
-
-	ret = pci_rebar_set_size(dev, resno, size);
-	if (ret)
-		return ret;
-
-	ret = pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
-	if (ret)
-		goto error_resize;
-	return 0;
-
-error_resize:
-	pci_rebar_set_size(dev, resno, old);
-	return ret;
+	return pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
 }
 EXPORT_SYMBOL(pci_resize_resource);
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 9c374feafc77..a61d38777cdc 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2504,12 +2504,20 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	struct resource *b_win, *r;
 	LIST_HEAD(saved);
 	unsigned int i;
-	int ret = 0;
+	int old, ret;
 
 	b_win = pbus_select_window(bus, res);
 	if (!b_win)
 		return -EINVAL;
 
+	old = pci_rebar_get_current_size(pdev, resno);
+	if (old < 0)
+		return old;
+
+	ret = pci_rebar_set_size(pdev, resno, size);
+	if (ret)
+		return ret;
+
 	pci_dev_for_each_resource(pdev, r, i) {
 		if (i >= PCI_BRIDGE_RESOURCES)
 			break;
@@ -2542,7 +2550,15 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
 	return ret;
 
 restore:
-	/* Revert to the old configuration */
+	/*
+	 * Revert to the old configuration.
+	 *
+	 * BAR Size must be restored first because it affects the read-only
+	 * bits in BAR (the old address might not be restorable otherwise
+	 * due to low address bits).
+	 */
+	pci_rebar_set_size(pdev, resno, old);
+
 	list_for_each_entry(dev_res, &saved, list) {
 		struct resource *res = dev_res->res;
 		struct pci_dev *dev = dev_res->dev;
-- 
2.39.5

Re: [PATCH 0/2] PCI: BAR resize rollback fixes

[Ville Syrjälä]

On Wed, Jan 21, 2026 at 03:14:15PM +0200, Ilpo Järvinen wrote:
> Hi all,
> 
> This series fixes two issue in BAR resize rollback found by
> Ville Syrjälä <ville.syrjala@linux.intel.com>.
> 
> Ilpo Järvinen (2):
>   PCI: Fix BAR resize rollback path overwriting ret
>   PCI: Fix Resizable BAR restore order

Thanks.

Looks to be working fine now:
 i915 0000:03:00.0: BAR 2 [mem 0x4030000000-0x403fffffff 64bit pref]: releasing
 pcieport 0000:02:01.0: bridge window [mem 0x4030000000-0x403fffffff 64bit pref]: releasing
 pcieport 0000:01:00.0: bridge window [mem 0x4030000000-0x403fffffff 64bit pref]: releasing
 pcieport 0000:00:01.0: bridge window [mem 0x4030000000-0x40407fffff 64bit pref]: was not released (still contains assigned resources)
 pcieport 0000:00:01.0: Assigned bridge window [mem 0x4030000000-0x40407fffff 64bit pref] to [bus 01-04] cannot fit 0x200000000 required for 0000:02:01.0 bridging to [bus 03]
 pcieport 0000:02:01.0: bridge window [mem size 0x200000000 64bit pref] to [bus 03] requires relaxed alignment rules
 pcieport 0000:00:01.0: Assigned bridge window [mem 0x4030000000-0x40407fffff 64bit pref] to [bus 01-04] cannot fit 0x200000000 required for 0000:01:00.0 bridging to [bus 02-04]
 pcieport 0000:01:00.0: bridge window [mem size 0x200000000 64bit pref] to [bus 02-04] requires relaxed alignment rules
 pcieport 0000:01:00.0: bridge window [mem size 0x200000000 64bit pref]: can't assign; no space
 pcieport 0000:01:00.0: bridge window [mem size 0x200000000 64bit pref]: failed to assign
 pcieport 0000:01:00.0: bridge window [mem size 0x200000000 64bit pref]: can't assign; no space
 pcieport 0000:01:00.0: bridge window [mem size 0x200000000 64bit pref]: failed to assign
 pcieport 0000:02:01.0: bridge window [mem size 0x200000000 64bit pref]: can't assign; no space
 pcieport 0000:02:01.0: bridge window [mem size 0x200000000 64bit pref]: failed to assign
 pcieport 0000:02:01.0: bridge window [mem size 0x200000000 64bit pref]: can't assign; no space
 pcieport 0000:02:01.0: bridge window [mem size 0x200000000 64bit pref]: failed to assign
 i915 0000:03:00.0: BAR 2 [mem size 0x200000000 64bit pref]: can't assign; no space
 i915 0000:03:00.0: BAR 2 [mem size 0x200000000 64bit pref]: failed to assign
 i915 0000:03:00.0: BAR 2 [mem size 0x200000000 64bit pref]: can't assign; no space
 i915 0000:03:00.0: BAR 2 [mem size 0x200000000 64bit pref]: failed to assign
 pcieport 0000:00:01.0: PCI bridge to [bus 01-04]
 pcieport 0000:00:01.0:   bridge window [mem 0x57000000-0x583fffff]
 pcieport 0000:00:01.0:   bridge window [mem 0x4030000000-0x40407fffff 64bit pref]
 pcieport 0000:01:00.0: PCI bridge to [bus 02-04]
 pcieport 0000:01:00.0:   bridge window [mem 0x57000000-0x583fffff]
 pcieport 0000:01:00.0:   bridge window [mem 0x4030000000-0x403fffffff 64bit pref]
 pcieport 0000:02:01.0: PCI bridge to [bus 03]
 pcieport 0000:02:01.0:   bridge window [mem 0x57000000-0x581fffff]
 pcieport 0000:02:01.0:   bridge window [mem 0x4030000000-0x403fffffff 64bit pref]
 i915 0000:03:00.0: BAR 2 [mem 0x4030000000-0x403fffffff 64bit pref]: old value restored
 i915 0000:03:00.0: [drm] Failed to resize BAR2 to 8192M (-28)
 i915 0000:03:00.0: [drm] Using a reduced BAR size of 256MiB. Consider enabling 'Resizable BAR' or similar, if available in the BIOS.

For the series:
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>

> 
>  drivers/pci/rebar.c     | 18 +-----------------
>  drivers/pci/setup-bus.c | 23 +++++++++++++++++++----
>  2 files changed, 20 insertions(+), 21 deletions(-)
> 
> 
> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> -- 
> 2.39.5

-- 
Ville Syrjälä
Intel

Re: [PATCH 0/2] PCI: BAR resize rollback fixes

[Bjorn Helgaas]

On Wed, Jan 21, 2026 at 03:14:15PM +0200, Ilpo Järvinen wrote:
> Hi all,
> 
> This series fixes two issue in BAR resize rollback found by
> Ville Syrjälä <ville.syrjala@linux.intel.com>.
> 
> Ilpo Järvinen (2):
>   PCI: Fix BAR resize rollback path overwriting ret
>   PCI: Fix Resizable BAR restore order
> 
>  drivers/pci/rebar.c     | 18 +-----------------
>  drivers/pci/setup-bus.c | 23 +++++++++++++++++++----
>  2 files changed, 20 insertions(+), 21 deletions(-)

Applied to pci/for-linus for v6.19, thanks, Ilpo.

Re: [PATCH 1/2] PCI: Fix BAR resize rollback path overwriting ret

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 1850 bytes --]

On Wed, 21 Jan 2026, Ilpo Järvinen wrote:

> The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize
> rollback path") added BAR rollback to
> pci_do_resource_release_and_resize() in case of resize failure.
> 
> On the rollback, pci_claim_resource() is called which can fail and the
> code is prepared for that possibility. pci_claim_resource()'s return
> value, however, overwrites the original value of ret so
> pci_claim_resource() will return incorrect value in the end (as

Hi Bjorn,

I noticed this should have been:

"pci_do_resource_release_and_resize() will return incorrect value in the 
end ..."

(used a wrong function name).

Could you please adjust the commit message in your tree if it's not too 
late yet?

I'm sorry about the extra hassle.

--
 i.

> pci_claim_resource() normally succeeds, in practice ret will be 0).
> 
> Fix the issue by directly calling pci_claim_resource() inside the if ().
> 
> Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
> Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
> Cc: stable@vger.kernel.org
> Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> ---
>  drivers/pci/setup-bus.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
> index 6e90f46f52af..9c374feafc77 100644
> --- a/drivers/pci/setup-bus.c
> +++ b/drivers/pci/setup-bus.c
> @@ -2556,8 +2556,7 @@ int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size
>  
>  		restore_dev_resource(dev_res);
>  
> -		ret = pci_claim_resource(dev, i);
> -		if (ret)
> +		if (pci_claim_resource(dev, i))
>  			continue;
>  
>  		if (i < PCI_BRIDGE_RESOURCES) {
> 

Re: [PATCH 1/2] PCI: Fix BAR resize rollback path overwriting ret

[Bjorn Helgaas]

On Thu, Jan 22, 2026 at 12:07:40PM +0200, Ilpo Järvinen wrote:
> On Wed, 21 Jan 2026, Ilpo Järvinen wrote:
> 
> > The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize
> > rollback path") added BAR rollback to
> > pci_do_resource_release_and_resize() in case of resize failure.
> > 
> > On the rollback, pci_claim_resource() is called which can fail and the
> > code is prepared for that possibility. pci_claim_resource()'s return
> > value, however, overwrites the original value of ret so
> > pci_claim_resource() will return incorrect value in the end (as
> 
> Hi Bjorn,
> 
> I noticed this should have been:
> 
> "pci_do_resource_release_and_resize() will return incorrect value in the 
> end ..."
> 
> (used a wrong function name).
> 
> Could you please adjust the commit message in your tree if it's not too 
> late yet?

Updated, thanks!