On Fri, Aug 21, 2026 at 07:54:26AM +0200, Markus Armbruster wrote: > Connor Kite <[email protected]> writes: > > > On Thu, Aug 20, 2026 at 2:02 AM Markus Armbruster <[email protected]> wrote: > >> > >> > >> Any guidance on when to enable it? > >> > > ... > > > >> Likewise. > >> > > > > In both cases, you would enable this for added security. There's > > obviously a performance hit, but it prevents a potentially misbehaving > > vhost-user backend from reading or modifying undesired portions of > > guest memory, since data transfer occurs wholly via bounce buffers. > > This may be more useful in the generic netdev vhost user case than it > > is with the passt version, but the goal is for the mode to be > > accessible for any vhost-user device. > > Work this into the commit message, please. > > > Do you think guidance is needed here in net.json? I was thinking > > that, if isolation-mode gets to a point of being merged, then > > information like this would make sense somewhere in the online > > documentation, but I'm happy to add something here as well. I was > > just trying to be similarly short and to-the-point as the other option > > descriptions for these structs. > > I think it needs to be somewhere in the user documentation. We have so > many configuration options, and so little guidance on what to do with > them. > > The doc comments in the QAPI schema are reference documentation (they go > into the "QEMU QMP Reference Manual"). Reference documentation should > be concise and to the point. When you have more useful things to say > than fit there, you need to find nother place, and maybe link to it from > the reference docs. > > I suggest to try adding brief guidance to the doc comment, and then we > see how we feel about it. >
Here is the vhost-user documentation: docs/system/devices/virtio/vhost-user.rst You could add a section to this document explaining the memory isolation feature. Stefan
signature.asc
Description: PGP signature
