From: Dexuan Cui <[email protected]> Sent: Friday, August 28, 2026 2:23 PM > > This basically reverts the Feb 2021 change: > commit 96854bbda24f ("hv_netvsc: Restrict configurations on isolated guests") > > In Feb 2021, PCI device assignment for CoCo VMs on Hyper-V was not > supported: if the host offered a PCI VF NIC device to the VM, the VM > couldn't handle it properly, so the 2021 commit was made to tell the host > "I'm unable to handle SR-IOV NICs, so please don't offer a VF to me". > If the host offers a VF NIC to the VM anyway, the change to > netvsc_receive_inband() ignores the VF NIC. > > Since Mar 2023, the VM is able to support PCI device assignment due to > commit 2c6ba4216844 ("PCI: hv: Enable PCI pass-thru devices in Confidential > VMs") > and related commits, so hv_netvsc can functionally work with a VF NIC, but > we haven't advertised the SR-IOV capability because the MANA NIC driver > (drivers/net/ethernet/microsoft/mana/) hadn't been hardened, so a > malicious MANA NIC might be able to attack the VM. > > Recently, we have finished hardening the MANA driver, so we can safely > use the MANA NIC in a CoCo VM now. Note: currently the MANA driver in a > CoCo VM still uses bounce buffering (i.e. shared decrypted memory) > for DMA. In the future, it will be able to use private encrypted > memory for DMA with the help of TDISP. > > Now, advertises the SR-IOV capability for CoCo VMs. > > Note: for MANA to work properly for CoCo VMs, the following earlier > commits are also required: > commit 2e2a83b4998a ("net: mana: Validate the packet length reported by the > NIC") > commit c72a0f09c57f ("net: mana: Sync page pool RX frags for CPU") > > Note: the host might offer a VF NIC device that's not MANA -- in that > case, if the corresponding VF NIC driver isn't hardened for CoCo VMs, > the driver should be blacklisted in CoCo VMs. > > Signed-off-by: Dexuan Cui <[email protected]> > --- > drivers/net/hyperv/netvsc.c | 10 ++-------- > 1 file changed, 2 insertions(+), 8 deletions(-) > > diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c > index 5cd084e5696c..fc6548b16c91 100644 > --- a/drivers/net/hyperv/netvsc.c > +++ b/drivers/net/hyperv/netvsc.c > @@ -625,10 +625,7 @@ static int negotiate_nvsp_ver(struct hv_device *device, > init_packet->msg.v2_msg.send_ndis_config.capability.ieee8021q = 1; > > if (nvsp_ver >= NVSP_PROTOCOL_VERSION_5) { > - if (hv_is_isolation_supported()) > - netdev_info(ndev, "SR-IOV not advertised by guests on > the host supporting isolation\n"); > - else > - > init_packet->msg.v2_msg.send_ndis_config.capability.sriov = 1; > + init_packet->msg.v2_msg.send_ndis_config.capability.sriov = 1; > > /* Teaming bit is needed to receive link speed updates */ > init_packet->msg.v2_msg.send_ndis_config.capability.teaming = 1; > @@ -1665,10 +1662,7 @@ static void netvsc_receive_inband(struct net_device > *ndev, > break; > > case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION: > - if (hv_is_isolation_supported()) > - netdev_err(ndev, "Ignore VF_ASSOCIATION msg from the > host supporting isolation\n"); > - else > - netvsc_send_vf(ndev, nvmsg, msglen); > + netvsc_send_vf(ndev, nvmsg, msglen); > break; > } > }
Nice to see this getting enabled! Reviewed-by: Michael Kelley <[email protected]>
