Re: [PATCH] fuse: mark DAX VMA page protections as decrypted

[Gupta, Pankaj]

Hi Punit,
> > > > In confidential computing guest environments (such as AMD SEV-SNP or
> > > > Intel TDX), direct memory access (DAX) mappings between the guest 
> > > > kernel
> > > > and host-backed FUSE/virtiofs shared memory regions must be accessed
> > > > using shared (decrypted) page protections.
> > > >
> > > > Modify fuse_dax_mmap() to apply pgprot_decrypted() to 
> > > > vma->vm_page_prot
> > > > when establishing FUSE DAX memory mappings. This ensures guest page
> > > > table entries for shared DAX buffers are explicitly marked as 
> > > > decrypted,
> > > > preventing memory encryption faults when accessing host-shared DAX 
> > > > memory.


I started testing this on my AMD system with QEMU and am still working 
through the configuration details.

Did you happen to test this with QEMU under SEV or SEV-SNP as well? If 
so, would you mind sharing your setup steps or

the QEMU/virtio-fs configuration you used?


The error I am facing is: device 'vhost-user-fs-pci' does not support 
ACCESS_PLATFORM when it is enabled.

But under SEV-SNP ACCESS_PLATFORM(iommu_platform) is globally enabled 
and when I manually disable it, guest says:

[    8.788217] virtiofs virtio0: device must provide 
VIRTIO_F_ACCESS_PLATFORM

Did you observe something similar or there are additional virtiofsd 
settings i need to use?

Thanks,
Pankaj