Re: [PATCH] fuse: mark DAX VMA page protections as decrypted

["Gupta, Pankaj" <pankaj.gupta@amd.com>]

Hi Punit,
>>>> In confidential computing guest environments (such as AMD SEV-SNP or
>>>> Intel TDX), direct memory access (DAX) mappings between the guest 
>>>> kernel
>>>> and host-backed FUSE/virtiofs shared memory regions must be accessed
>>>> using shared (decrypted) page protections.
>>>>
>>>> Modify fuse_dax_mmap() to apply pgprot_decrypted() to 
>>>> vma->vm_page_prot
>>>> when establishing FUSE DAX memory mappings. This ensures guest page
>>>> table entries for shared DAX buffers are explicitly marked as 
>>>> decrypted,
>>>> preventing memory encryption faults when accessing host-shared DAX 
>>>> memory.


I started testing this on my AMD system with QEMU and am still working 
through the configuration details.

Did you happen to test this with QEMU under SEV or SEV-SNP as well? If 
so, would you mind sharing your setup steps or

the QEMU/virtio-fs configuration you used?


The error I am facing is: device 'vhost-user-fs-pci' does not support 
ACCESS_PLATFORM when it is enabled.

But under SEV-SNP ACCESS_PLATFORM(iommu_platform) is globally enabled 
and when I manually disable it, guest says:

[    8.788217] virtiofs virtio0: device must provide 
VIRTIO_F_ACCESS_PLATFORM

Did you observe something similar or there are additional virtiofsd 
settings i need to use?

Thanks,
Pankaj