Re: [PATCH] fuse: mark DAX VMA page protections as decrypted

On 8/18/26 06:38, Miklos Szeredi wrote:
> [Cc:  Tom Lendacky + lists]

Adding @Pankaj Gupta to take a look.

Thanks,
Tom

> 
> On Mon, 27 Jul 2026 at 23:07, Punit Salian <[email protected]> wrote:
>>
>> In confidential computing guest environments (such as AMD SEV-SNP or
>> Intel TDX), direct memory access (DAX) mappings between the guest kernel
>> and host-backed FUSE/virtiofs shared memory regions must be accessed
>> using shared (decrypted) page protections.
>>
>> Modify fuse_dax_mmap() to apply pgprot_decrypted() to vma->vm_page_prot
>> when establishing FUSE DAX memory mappings. This ensures guest page
>> table entries for shared DAX buffers are explicitly marked as decrypted,
>> preventing memory encryption faults when accessing host-shared DAX memory.
>>
>> Signed-off-by: Punit Salian <[email protected]>
>> ---
>>  fs/fuse/dax.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c
>> index a15c464c8d19..00e316a7f805 100644
>> --- a/fs/fuse/dax.c
>> +++ b/fs/fuse/dax.c
>> @@ -826,6 +826,7 @@ int fuse_dax_mmap(struct file *file, struct vm_area_struct *vma)
>>         file_accessed(file);
>>         vma->vm_ops = &fuse_dax_vm_ops;
>>         vm_flags_set(vma, VM_MIXEDMAP | VM_HUGEPAGE);
>> +       vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
>>
>>         return 0;
>>  }
>> --
> 
> Needs review from someone understanding this technology.
> 
> Thanks,
> Miklos