In confidential computing guest environments (such as AMD SEV-SNP or Intel TDX), direct memory access (DAX) mappings between the guest kernel and host-backed FUSE/virtiofs shared memory regions must be accessed using shared (decrypted) page protections. Modify fuse_dax_mmap() to apply pgprot_decrypted() to vma->vm_page_prot when establishing FUSE DAX memory mappings. This ensures guest page table entries for shared DAX buffers are explicitly marked as decrypted, preventing memory encryption faults when accessing host-shared DAX memory. Signed-off-by: Punit Salian --- fs/fuse/dax.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c index a15c464c8d19..00e316a7f805 100644 --- a/fs/fuse/dax.c +++ b/fs/fuse/dax.c @@ -826,6 +826,7 @@ int fuse_dax_mmap(struct file *file, struct vm_area_struct *vma) file_accessed(file); vma->vm_ops = &fuse_dax_vm_ops; vm_flags_set(vma, VM_MIXEDMAP | VM_HUGEPAGE); + vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot); return 0; } --