RE: [PATCH net-next] hv_netvsc: Advertise the SR-IOV capability for CoCo VMs

[Haiyang Zhang]

> -----Original Message-----
> From: Dexuan Cui <decui@xxxxxxxxxxxxx>
> Sent: Friday, August 28, 2026 5:23 PM
> To: KY Srinivasan <kys@xxxxxxxxxxxxx>; Haiyang Zhang
> <haiyangz@xxxxxxxxxxxxx>; wei.liu@xxxxxxxxxx; Dexuan Cui
> <DECUI@xxxxxxxxxxxxx>; Long Li <longli@xxxxxxxxxxxxx>;
> andrew+netdev@xxxxxxx; davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx;
> kuba@xxxxxxxxxx; pabeni@xxxxxxxxxx; linux-hyperv@xxxxxxxxxxxxxxx;
> netdev@xxxxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx
> Subject: [PATCH net-next] hv_netvsc: Advertise the SR-IOV capability for
> CoCo VMs
> 
> This basically reverts the Feb 2021 change:
> commit 96854bbda24f ("hv_netvsc: Restrict configurations on isolated
> guests")
> 
> In Feb 2021, PCI device assignment for CoCo VMs on Hyper-V was not
> supported: if the host offered a PCI VF NIC device to the VM, the VM
> couldn't handle it properly, so the 2021 commit was made to tell the host
> "I'm unable to handle SR-IOV NICs, so please don't offer a VF to me".
> If the host offers a VF NIC to the VM anyway, the change to
> netvsc_receive_inband() ignores the VF NIC.
> 
> Since Mar 2023, the VM is able to support PCI device assignment due to
> commit 2c6ba4216844 ("PCI: hv: Enable PCI pass-thru devices in
> Confidential VMs")
> and related commits, so hv_netvsc can functionally work with a VF NIC, but
> we haven't advertised the SR-IOV capability because the MANA NIC driver
> (drivers/net/ethernet/microsoft/mana/) hadn't been hardened, so a
> malicious MANA NIC might be able to attack the VM.
> 
> Recently, we have finished hardening the MANA driver, so we can safely
> use the MANA NIC in a CoCo VM now. Note: currently the MANA driver in a
> CoCo VM still uses bounce buffering (i.e. shared decrypted memory)
> for DMA. In the future, it will be able to use private encrypted
> memory for DMA with the help of TDISP.
> 
> Now, advertises the SR-IOV capability for CoCo VMs.
> 
> Note: for MANA to work properly for CoCo VMs, the following earlier
> commits are also required:
> commit 2e2a83b4998a ("net: mana: Validate the packet length reported by
> the NIC")
> commit c72a0f09c57f ("net: mana: Sync page pool RX frags for CPU")
> 
> Note: the host might offer a VF NIC device that's not MANA -- in that
> case, if the corresponding VF NIC driver isn't hardened for CoCo VMs,
> the driver should be blacklisted in CoCo VMs.
> 
> Signed-off-by: Dexuan Cui <decui@xxxxxxxxxxxxx>

Reviewed-by: Haiyang Zhang <haiyangz@xxxxxxxxxxxxx>