Re: [PATCH 5/7] docs: vduse: align documentation with current uapi and driver

[Jonathan Corbet <corbet@lwn.net>]

Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com> writes:

> Update supported device IDs (block, net, fs), all six read/write message
> types, the VDUSE_VQ_INJECT_IRQ ioctl name, and VQ_SETUP group vs asid
> usage per include/uapi/linux/vduse.h.
>
> Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
> ---
>  Documentation/userspace-api/vduse.rst | 33 +++++++++++++++++----------
>  1 file changed, 21 insertions(+), 12 deletions(-)
>
> diff --git a/Documentation/userspace-api/vduse.rst b/Documentation/userspace-api/vduse.rst
> index 81479d47c8b9..d316857ca5bd 100644
> --- a/Documentation/userspace-api/vduse.rst
> +++ b/Documentation/userspace-api/vduse.rst
> @@ -11,11 +11,10 @@ to make the device emulation more secure, the emulated vDPA device's
>  control path is handled in the kernel and only the data path is
>  implemented in the userspace.
>  
> -Note that only virtio block device is supported by VDUSE framework now,
> -which can reduce security risks when the userspace process that implements
> -the data path is run by an unprivileged user. The support for other device
> -types can be added after the security issue of corresponding device driver
> -is clarified or fixed in the future.
> +Note that virtio block, network, and filesystem device types are supported
> +by the VDUSE framework. Other device types may be added after the security
> +implications of the corresponding device driver are clarified or fixed in
> +the future.

So that paragraph was somewhat impenetrable before, but I think this
change has made it worse.  What are "the security implications"?  This
has the look of a mechanical change that isn't really concerned about
what is supposed to be communicated...?

Thanks,

jon