Re: [PATCH RFC v2 13/13] net/vhost-user: add memory isolation

[Stefan Hajnoczi <stefanha@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2002 bytes --]

On Fri, Aug 21, 2026 at 07:54:26AM +0200, Markus Armbruster wrote:
> Connor Kite <connorkite@gmail.com> writes:
> 
> > On Thu, Aug 20, 2026 at 2:02 AM Markus Armbruster <armbru@redhat.com> wrote:
> >>
> >>
> >> Any guidance on when to enable it?
> >>
> > ...
> >
> >> Likewise.
> >>
> >
> > In both cases, you would enable this for added security.  There's
> > obviously a performance hit, but it prevents a potentially misbehaving
> > vhost-user backend from reading or modifying undesired portions of
> > guest memory, since data transfer occurs wholly via bounce buffers.
> > This may be more useful in the generic netdev vhost user case than it
> > is with the passt version, but the goal is for the mode to be
> > accessible for any vhost-user device.
> 
> Work this into the commit message, please.
> 
> > Do you think guidance is needed here in net.json?  I was thinking
> > that, if isolation-mode gets to a point of being merged, then
> > information like this would make sense somewhere in the online
> > documentation, but I'm happy to add something here as well.  I was
> > just trying to be similarly short and to-the-point as the other option
> > descriptions for these structs.
> 
> I think it needs to be somewhere in the user documentation.  We have so
> many configuration options, and so little guidance on what to do with
> them.
> 
> The doc comments in the QAPI schema are reference documentation (they go
> into the "QEMU QMP Reference Manual").  Reference documentation should
> be concise and to the point.  When you have more useful things to say
> than fit there, you need to find nother place, and maybe link to it from
> the reference docs.
> 
> I suggest to try adding brief guidance to the doc comment, and then we
> see how we feel about it.
> 

Here is the vhost-user documentation:
docs/system/devices/virtio/vhost-user.rst

You could add a section to this document explaining the memory isolation
feature.

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]