qemu-configs: update disable_vhost_net description

Updated to better clarify this configuration option. Currently in QEMU pre 1.9 release of Kata, vhost-net is used for the virtio-net backend. This results in efficient network I/O performance, but does rely on the backend running in ring0 (host kernel). Update comment to clarify this trade-off for end-users. Fixes: #2198 Signed-off-by: Eric Ernst <[email protected]>
kata-containers · Nov 13, 2019 · 0c482b2 · 0c482b2
1 parent af73bb3
commit 0c482b2
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/cli/config/configuration-qemu-virtiofs.toml.in b/cli/config/configuration-qemu-virtiofs.toml.in
@@ -212,9 +212,10 @@ enable_iothreads = @DEFENABLEIOTHREADS@
 # Default false
 #hotplug_vfio_on_root_bus = true
 
-# If host doesn't support vhost_net, set to true. Thus we won't create vhost fds for nics.
-# Default false
+# If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
+# security (vhost-net runs ring0) for network I/O performance. 
 #disable_vhost_net = true
+
 #
 # Default entropy source.
 # The path to a host source of entropy (including a real hardware RNG)

diff --git a/cli/config/configuration-qemu.toml.in b/cli/config/configuration-qemu.toml.in
@@ -213,9 +213,10 @@ enable_iothreads = @DEFENABLEIOTHREADS@
 # Default false
 #hotplug_vfio_on_root_bus = true
 
-# If host doesn't support vhost_net, set to true. Thus we won't create vhost fds for nics.
-# Default false
+# If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
+# security (vhost-net runs ring0) for network I/O performance. 
 #disable_vhost_net = true
+
 #
 # Default entropy source.
 # The path to a host source of entropy (including a real hardware RNG)