Re: [PATCH] fuse: mark DAX VMA page protections as decrypted

[Cc:  Tom Lendacky + lists]

On Mon, 27 Jul 2026 at 23:07, Punit Salian <[email protected]> wrote:
>
> In confidential computing guest environments (such as AMD SEV-SNP or
> Intel TDX), direct memory access (DAX) mappings between the guest kernel
> and host-backed FUSE/virtiofs shared memory regions must be accessed
> using shared (decrypted) page protections.
>
> Modify fuse_dax_mmap() to apply pgprot_decrypted() to vma->vm_page_prot
> when establishing FUSE DAX memory mappings. This ensures guest page
> table entries for shared DAX buffers are explicitly marked as decrypted,
> preventing memory encryption faults when accessing host-shared DAX memory.
>
> Signed-off-by: Punit Salian <[email protected]>
> ---
>  fs/fuse/dax.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c
> index a15c464c8d19..00e316a7f805 100644
> --- a/fs/fuse/dax.c
> +++ b/fs/fuse/dax.c
> @@ -826,6 +826,7 @@ int fuse_dax_mmap(struct file *file, struct vm_area_struct *vma)
>         file_accessed(file);
>         vma->vm_ops = &fuse_dax_vm_ops;
>         vm_flags_set(vma, VM_MIXEDMAP | VM_HUGEPAGE);
> +       vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
>
>         return 0;
>  }
> --

Needs review from someone understanding this technology.

Thanks,
Miklos