From 8115eea00edab2921e233ea851c3b77191937ebd Mon Sep 17 00:00:00 2001 From: Kavi <15661106+kdaula@users.noreply.github.com> Date: Mon, 2 Nov 2026 19:46:24 -0500 Subject: [PATCH] 9p/xen: grant each ring page by its own frame The data pages of a ring are granted as the first page's frame plus the page index. That holds for auto-translated guests, whose grant frames are pseudo-physical. A PV guest grants machine frames, and alloc_pages_exact() only promises pseudo-physical contiguity. When the pages are not machine-contiguous the backend maps the frames that follow the first one. Some of those are other pages of the guest, so requests read as garbage, and some cannot be granted at all, so the mapping fails. A freshly built PV guest is usually machine-contiguous within a 2 MiB block, which hid this. A PV guest restored from a snapshot gets its frames one page at a time, so its first request on ring 0 after the restore arrives as a malformed frame and the mount hangs. Look up the frame of each page instead. Signed-off-by: Kavi Daula --- net/9p/trans_xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index bb25fa7c41b96d..9dd94710feafef 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -696,8 +696,8 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev, goto out; } for (; i < (1 << order); i++) { - ret = gnttab_grant_foreign_access( - dev->otherend_id, virt_to_gfn(bytes) + i, 0); + ret = gnttab_grant_foreign_access(dev->otherend_id, + virt_to_gfn(bytes + i * XEN_PAGE_SIZE), 0); if (ret < 0) goto out; ring->intf->ref[i] = ret;