> -----Original Message-----
> From: Dexuan Cui <[email protected]>
> Sent: Friday, August 28, 2026 5:23 PM
> To: KY Srinivasan <[email protected]>; Haiyang Zhang
> <[email protected]>; [email protected]; Dexuan Cui
> <[email protected]>; Long Li <[email protected]>;
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]
> Cc: [email protected]
> Subject: [PATCH net-next] hv_netvsc: Advertise the SR-IOV capability for
> CoCo VMs
>
> This basically reverts the Feb 2021 change:
> commit 96854bbda24f ("hv_netvsc: Restrict configurations on isolated
> guests")
>
> In Feb 2021, PCI device assignment for CoCo VMs on Hyper-V was not
> supported: if the host offered a PCI VF NIC device to the VM, the VM
> couldn't handle it properly, so the 2021 commit was made to tell the host
> "I'm unable to handle SR-IOV NICs, so please don't offer a VF to me".
> If the host offers a VF NIC to the VM anyway, the change to
> netvsc_receive_inband() ignores the VF NIC.
>
> Since Mar 2023, the VM is able to support PCI device assignment due to
> commit 2c6ba4216844 ("PCI: hv: Enable PCI pass-thru devices in
> Confidential VMs")
> and related commits, so hv_netvsc can functionally work with a VF NIC, but
> we haven't advertised the SR-IOV capability because the MANA NIC driver
> (drivers/net/ethernet/microsoft/mana/) hadn't been hardened, so a
> malicious MANA NIC might be able to attack the VM.
>
> Recently, we have finished hardening the MANA driver, so we can safely
> use the MANA NIC in a CoCo VM now. Note: currently the MANA driver in a
> CoCo VM still uses bounce buffering (i.e. shared decrypted memory)
> for DMA. In the future, it will be able to use private encrypted
> memory for DMA with the help of TDISP.
>
> Now, advertises the SR-IOV capability for CoCo VMs.
>
> Note: for MANA to work properly for CoCo VMs, the following earlier
> commits are also required:
> commit 2e2a83b4998a ("net: mana: Validate the packet length reported by
> the NIC")
> commit c72a0f09c57f ("net: mana: Sync page pool RX frags for CPU")
>
> Note: the host might offer a VF NIC device that's not MANA -- in that
> case, if the corresponding VF NIC driver isn't hardened for CoCo VMs,
> the driver should be blacklisted in CoCo VMs.
>
> Signed-off-by: Dexuan Cui <[email protected]>
Reviewed-by: Haiyang Zhang <[email protected]>
