Re: [PATCH] fuse: mark DAX VMA page protections as decrypted

[Michael Roth]

On Wed, Aug 19, 2026 at 05:03:10PM +0200, Gupta, Pankaj wrote:
> Hi Punit,
> > > > > In confidential computing guest environments (such as AMD SEV-SNP or
> > > > > Intel TDX), direct memory access (DAX) mappings between the
> > > > > guest kernel
> > > > > and host-backed FUSE/virtiofs shared memory regions must be accessed
> > > > > using shared (decrypted) page protections.
> > > > > 
> > > > > Modify fuse_dax_mmap() to apply pgprot_decrypted() to
> > > > > vma->vm_page_prot
> > > > > when establishing FUSE DAX memory mappings. This ensures guest page
> > > > > table entries for shared DAX buffers are explicitly marked
> > > > > as decrypted,
> > > > > preventing memory encryption faults when accessing
> > > > > host-shared DAX memory.
> 
> 
> I started testing this on my AMD system with QEMU and am still working
> through the configuration details.
> 
> Did you happen to test this with QEMU under SEV or SEV-SNP as well? If so,
> would you mind sharing your setup steps or
> 
> the QEMU/virtio-fs configuration you used?
> 
> 
> The error I am facing is: device 'vhost-user-fs-pci' does not support
> ACCESS_PLATFORM when it is enabled.
> 
> But under SEV-SNP ACCESS_PLATFORM(iommu_platform) is globally enabled and
> when I manually disable it, guest says:
> 
> [    8.788217] virtiofs virtio0: device must provide
> VIRTIO_F_ACCESS_PLATFORM

I'm not sure what the real solution should be for this, but does this
hack for QEMU avoid the error?

  https://github.com/AMDESE/qemu/commit/63f103e35f5f3735d10f7618584bd8bb208e2c28

Thanks,

Mike

> 
> Did you observe something similar or there are additional virtiofsd settings
> i need to use?
> 
> Thanks,
> Pankaj
> 
>