mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
Dexuan Cui
d0ec95a8a4
This basically reverts the Feb 2021 change: commit96854bbda2("hv_netvsc: Restrict configurations on isolated guests") In Feb 2021, PCI device assignment for CoCo VMs on Hyper-V was not supported: if the host offered a PCI VF NIC device to the VM, the VM couldn't handle it properly, so the 2021 commit was made to tell the host "I'm unable to handle SR-IOV NICs, so please don't offer a VF to me". If the host offers a VF NIC to the VM anyway, the change to netvsc_receive_inband() ignores the VF NIC. Since Mar 2023, the VM is able to support PCI device assignment due to commit2c6ba42168("PCI: hv: Enable PCI pass-thru devices in Confidential VMs") and related commits, so hv_netvsc can functionally work with a VF NIC, but we haven't advertised the SR-IOV capability because the MANA NIC driver (drivers/net/ethernet/microsoft/mana/) hadn't been hardened, so a malicious MANA NIC might be able to attack the VM. Recently, we have finished hardening the MANA driver, so we can safely use the MANA NIC in a CoCo VM now. Note: currently the MANA driver in a CoCo VM still uses bounce buffering (i.e. shared decrypted memory) for DMA. In the future, it will be able to use private encrypted memory for DMA with the help of TDISP. Now, advertises the SR-IOV capability for CoCo VMs. Note: for MANA to work properly for CoCo VMs, the following earlier commits are also required: commit2e2a83b499("net: mana: Validate the packet length reported by the NIC") commitc72a0f09c5("net: mana: Sync page pool RX frags for CPU") Note: the host might offer a VF NIC device that's not MANA -- in that case, if the corresponding VF NIC driver isn't hardened for CoCo VMs, the driver should be blacklisted in CoCo VMs. Signed-off-by: Dexuan Cui <decui@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: David S. Miller <davem@davemloft.net>