This patch series implements a memory isolation mode in vhost-user. The
purpose of this mode is to provide the option of additional security by
eliminating direct access of guest memory by vhost-user devices.
At a high level this works by:

1. Adding qdev and qapi properties required to enable isolation mode for
   various devices.
2. Allocating an isolation memory region in an anonymous file and mapping it
   to host memory.  This isolation region will hold the bounce buffers and
   vrings necessary to move data.
3. Using a vhost-iova-tree to allocate and track the mapping between
   guest regions and their corresponding bounce buffers in the isolation
   memory.
4. Creating shadow virtqueues to intercept request notifications.  As
   kick and call events are received by an svq, it copies buffer
   contents and descriptors between isolation and guest memory before
   notifying the backend or guest.   

Note: This project is currently in a partially functional state. For
example, in testing vhost-user-input and a keyboard, keystrokes may
register correctly or be double counted depending on the combination
of backend daemon and guest OS used. However, the desire is to make
this work public at this stage for comment on the overall
approach.

Signed-off-by: Connor Kite <connorkite@gmail.com>
---
ConKite (2):
      vhost-user: Consolidate chardev property definitions
      vhost-user: Add memory-isolation qdev property to vhost-user devices

Connor Kite (13):
      backends/cryptodev-vhost-user: add memory isolation bool
      net/vhost-user: add memory isolation
      vhost-user: add memory_isolation to VhostUserState
      util/iova-tree: g_tree_foreach wrapper
      hw/virtio: iova_tree_foreach wrapper
      hw/virtio/vhost-shadow-virtqueue: used handler
      hw/virtio/vhost-shadow-virtqueue: specified vring placement
      hw/virtio/vhost-shadow-virtqueue: range boundary in translation
      hw/virtio/vhost-user: create isolation region
      hw/virtio/vhost-user: send isolation regions to device
      hw/virtio/vhost-user: add shadow virtqueues and eventfd intercepts
      hw/virtio/vhost-user: handle data movement with shadow vqs
      hw/virtio/vhost-user: shadow vq cleanup

 backends/cryptodev-vhost-user.c      |  24 +-
 backends/vhost-user.c                |   4 +-
 hw/block/vhost-user-blk.c            |   4 +-
 hw/display/vhost-user-gpu.c          |   4 +-
 hw/scsi/vhost-user-scsi.c            |   4 +-
 hw/virtio/vhost-iova-tree.c          |  15 ++
 hw/virtio/vhost-iova-tree.h          |   3 +
 hw/virtio/vhost-shadow-virtqueue.c   |  30 ++-
 hw/virtio/vhost-shadow-virtqueue.h   |  17 ++
 hw/virtio/vhost-stub.c               |   3 +-
 hw/virtio/vhost-user-base.c          |  13 +-
 hw/virtio/vhost-user-fs.c            |   4 +-
 hw/virtio/vhost-user-gpio.c          |   4 -
 hw/virtio/vhost-user-i2c.c           |   5 -
 hw/virtio/vhost-user-input.c         |   5 -
 hw/virtio/vhost-user-rng.c           |   5 -
 hw/virtio/vhost-user-rtc.c           |   4 -
 hw/virtio/vhost-user-scmi.c          |   4 +-
 hw/virtio/vhost-user-snd.c           |   1 -
 hw/virtio/vhost-user-spi.c           |   5 -
 hw/virtio/vhost-user-test-device.c   |   1 -
 hw/virtio/vhost-user-vsock.c         |   4 +-
 hw/virtio/vhost-user.c               | 441 ++++++++++++++++++++++++++++++++++-
 include/hw/virtio/vhost-user-base.h  |   1 +
 include/hw/virtio/vhost-user-blk.h   |   1 +
 include/hw/virtio/vhost-user-fs.h    |   1 +
 include/hw/virtio/vhost-user-scmi.h  |   1 +
 include/hw/virtio/vhost-user-vsock.h |   1 +
 include/hw/virtio/vhost-user.h       |   6 +-
 include/hw/virtio/virtio-gpu.h       |   1 +
 include/hw/virtio/virtio-scsi.h      |   1 +
 include/qemu/iova-tree.h             |  13 ++
 include/system/vhost-user-backend.h  |   3 +-
 net/passt.c                          |  16 +-
 net/vhost-user.c                     |  11 +-
 qapi/net.json                        |  15 +-
 qapi/qom.json                        |   6 +-
 util/iova-tree.c                     |   5 +
 38 files changed, 622 insertions(+), 64 deletions(-)
---
base-commit: 006a22cb26998998385b104db1ff9466ef2f3153
change-id: 20260604-vhost-user-isolated-memory-070ed4833ee7

Best regards,
-- 
Connor Kite <connorkite@gmail.com>

On 7/23/26 18:29, ConKite wrote:
> This patch series implements a memory isolation mode in vhost-user. The
> purpose of this mode is to provide the option of additional security by
> eliminating direct access of guest memory by vhost-user devices.
> At a high level this works by:
> 
> 1. Adding qdev and qapi properties required to enable isolation mode for
>    various devices.
> 2. Allocating an isolation memory region in an anonymous file and mapping it
>    to host memory.  This isolation region will hold the bounce buffers and
>    vrings necessary to move data.
> 3. Using a vhost-iova-tree to allocate and track the mapping between
>    guest regions and their corresponding bounce buffers in the isolation
>    memory.
> 4. Creating shadow virtqueues to intercept request notifications.  As
>    kick and call events are received by an svq, it copies buffer
>    contents and descriptors between isolation and guest memory before
>    notifying the backend or guest.   
> 
> Note: This project is currently in a partially functional state. For
> example, in testing vhost-user-input and a keyboard, keystrokes may
> register correctly or be double counted depending on the combination
> of backend daemon and guest OS used. However, the desire is to make
> this work public at this stage for comment on the overall
> approach.

Thank you so much for the work!  I'm very excited about it.

I do have a few questions:

1. Is this dependent on the specific vhost-user device type?  In other
   words, does this code need to be specific to vhost-user-blk/net/etc
   devices?

2. What kind of performance penalty is there for isolation?  The use
   of shadow virtqueues seems relatively complex.

3. Does it make sense to have device-type-specific code to validate
   data sent back by the server?  This could protect drivers that
   trust virtio devices. 
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

On 2026/07/24 7:29, ConKite wrote:
> This patch series implements a memory isolation mode in vhost-user. The
> purpose of this mode is to provide the option of additional security by
> eliminating direct access of guest memory by vhost-user devices.
> At a high level this works by:
> 
> 1. Adding qdev and qapi properties required to enable isolation mode for
>     various devices.
> 2. Allocating an isolation memory region in an anonymous file and mapping it
>     to host memory.  This isolation region will hold the bounce buffers and
>     vrings necessary to move data.
> 3. Using a vhost-iova-tree to allocate and track the mapping between
>     guest regions and their corresponding bounce buffers in the isolation
>     memory.
> 4. Creating shadow virtqueues to intercept request notifications.  As
>     kick and call events are received by an svq, it copies buffer
>     contents and descriptors between isolation and guest memory before
>     notifying the backend or guest.
> 
> Note: This project is currently in a partially functional state. For
> example, in testing vhost-user-input and a keyboard, keystrokes may
> register correctly or be double counted depending on the combination
> of backend daemon and guest OS used. However, the desire is to make
> this work public at this stage for comment on the overall
> approach.

I guess this intends to achieve something similar to IOMMU and also 
Linux's swiotlb for the VMM (please correct me if I'm wrong):

 > Other edge case scenarios arise for bounce buffers. For example, when
 > IOMMU mappings are set up for a DMA operation to/from a device that is
 > considered “untrusted”, the device should be given access only to the
 > memory containing the data being transferred. But if that memory
 > occupies only part of an IOMMU granule, other parts of the granule may
 > contain unrelated kernel data. Since IOMMU access control is
 > per-granule, the untrusted device can gain access to the unrelated
 > kernel data. This problem is solved by bounce buffering the DMA
 > operation and ensuring that unused portions of the bounce buffers do
 > not contain any unrelated kernel data.

https://docs.kernel.org/next/core-api/swiotlb.html#usage-scenarios

It would be nice if the security property this feature provides is 
explicitly stated, ideally as documentation.

I also hope this could fix vhost-user for TCG:
https://gitlab.com/qemu-project/qemu/-/work_items/2092

Perhaps the memory isolation should be enabled by default for TCG.

Implementation-wise, there are rough edges as you stated. Some of them 
can be fixed by more closely following what vhost-user does for the 
non-isolated case and what vhost-vdpa does with shadow virtqueues.

Regards,
Akihiko Odaki

> 
> Signed-off-by: Connor Kite <connorkite@gmail.com>
> ---
> ConKite (2):
>        vhost-user: Consolidate chardev property definitions
>        vhost-user: Add memory-isolation qdev property to vhost-user devices
> 
> Connor Kite (13):
>        backends/cryptodev-vhost-user: add memory isolation bool
>        net/vhost-user: add memory isolation
>        vhost-user: add memory_isolation to VhostUserState
>        util/iova-tree: g_tree_foreach wrapper
>        hw/virtio: iova_tree_foreach wrapper
>        hw/virtio/vhost-shadow-virtqueue: used handler
>        hw/virtio/vhost-shadow-virtqueue: specified vring placement
>        hw/virtio/vhost-shadow-virtqueue: range boundary in translation
>        hw/virtio/vhost-user: create isolation region
>        hw/virtio/vhost-user: send isolation regions to device
>        hw/virtio/vhost-user: add shadow virtqueues and eventfd intercepts
>        hw/virtio/vhost-user: handle data movement with shadow vqs
>        hw/virtio/vhost-user: shadow vq cleanup
> 
>   backends/cryptodev-vhost-user.c      |  24 +-
>   backends/vhost-user.c                |   4 +-
>   hw/block/vhost-user-blk.c            |   4 +-
>   hw/display/vhost-user-gpu.c          |   4 +-
>   hw/scsi/vhost-user-scsi.c            |   4 +-
>   hw/virtio/vhost-iova-tree.c          |  15 ++
>   hw/virtio/vhost-iova-tree.h          |   3 +
>   hw/virtio/vhost-shadow-virtqueue.c   |  30 ++-
>   hw/virtio/vhost-shadow-virtqueue.h   |  17 ++
>   hw/virtio/vhost-stub.c               |   3 +-
>   hw/virtio/vhost-user-base.c          |  13 +-
>   hw/virtio/vhost-user-fs.c            |   4 +-
>   hw/virtio/vhost-user-gpio.c          |   4 -
>   hw/virtio/vhost-user-i2c.c           |   5 -
>   hw/virtio/vhost-user-input.c         |   5 -
>   hw/virtio/vhost-user-rng.c           |   5 -
>   hw/virtio/vhost-user-rtc.c           |   4 -
>   hw/virtio/vhost-user-scmi.c          |   4 +-
>   hw/virtio/vhost-user-snd.c           |   1 -
>   hw/virtio/vhost-user-spi.c           |   5 -
>   hw/virtio/vhost-user-test-device.c   |   1 -
>   hw/virtio/vhost-user-vsock.c         |   4 +-
>   hw/virtio/vhost-user.c               | 441 ++++++++++++++++++++++++++++++++++-
>   include/hw/virtio/vhost-user-base.h  |   1 +
>   include/hw/virtio/vhost-user-blk.h   |   1 +
>   include/hw/virtio/vhost-user-fs.h    |   1 +
>   include/hw/virtio/vhost-user-scmi.h  |   1 +
>   include/hw/virtio/vhost-user-vsock.h |   1 +
>   include/hw/virtio/vhost-user.h       |   6 +-
>   include/hw/virtio/virtio-gpu.h       |   1 +
>   include/hw/virtio/virtio-scsi.h      |   1 +
>   include/qemu/iova-tree.h             |  13 ++
>   include/system/vhost-user-backend.h  |   3 +-
>   net/passt.c                          |  16 +-
>   net/vhost-user.c                     |  11 +-
>   qapi/net.json                        |  15 +-
>   qapi/qom.json                        |   6 +-
>   util/iova-tree.c                     |   5 +
>   38 files changed, 622 insertions(+), 64 deletions(-)
> ---
> base-commit: 006a22cb26998998385b104db1ff9466ef2f3153
> change-id: 20260604-vhost-user-isolated-memory-070ed4833ee7
> 
> Best regards,