Re: [PATCH RFC v2 13/13] net/vhost-user: add memory isolation

On Thu, Aug 20, 2026 at 2:02 AM Markus Armbruster <[email protected]> wrote:
>
>
> Any guidance on when to enable it?
>
...

> Likewise.
>

In both cases, you would enable this for added security.  There's
obviously a performance hit, but it prevents a potentially misbehaving
vhost-user backend from reading or modifying undesired portions of
guest memory, since data transfer occurs wholly via bounce buffers.
This may be more useful in the generic netdev vhost user case than it
is with the passt version, but the goal is for the mode to be
accessible for any vhost-user device.

Do you think guidance is needed here in net.json?  I was thinking
that, if isolation-mode gets to a point of being merged, then
information like this would make sense somewhere in the online
documentation, but I'm happy to add something here as well.  I was
just trying to be similarly short and to-the-point as the other option
descriptions for these structs.

Thanks!
Connor