Re: [PATCH RFC v2 13/13] net/vhost-user: add memory isolation

Connor Kite <[email protected]> writes:

> On Thu, Aug 20, 2026 at 2:02 AM Markus Armbruster <[email protected]> wrote:
>>
>>
>> Any guidance on when to enable it?
>>
> ...
>
>> Likewise.
>>
>
> In both cases, you would enable this for added security.  There's
> obviously a performance hit, but it prevents a potentially misbehaving
> vhost-user backend from reading or modifying undesired portions of
> guest memory, since data transfer occurs wholly via bounce buffers.
> This may be more useful in the generic netdev vhost user case than it
> is with the passt version, but the goal is for the mode to be
> accessible for any vhost-user device.

Work this into the commit message, please.

> Do you think guidance is needed here in net.json?  I was thinking
> that, if isolation-mode gets to a point of being merged, then
> information like this would make sense somewhere in the online
> documentation, but I'm happy to add something here as well.  I was
> just trying to be similarly short and to-the-point as the other option
> descriptions for these structs.

I think it needs to be somewhere in the user documentation.  We have so
many configuration options, and so little guidance on what to do with
them.

The doc comments in the QAPI schema are reference documentation (they go
into the "QEMU QMP Reference Manual").  Reference documentation should
be concise and to the point.  When you have more useful things to say
than fit there, you need to find nother place, and maybe link to it from
the reference docs.

I suggest to try adding brief guidance to the doc comment, and then we
see how we feel about it.