On Sat, Oct 31, 2026 at 11:10:04AM -0700, Shakeel Butt wrote:
> A vhost task is a user worker: a thread of a user process that runs only
> kernel code. It never returns to userspace, so it never runs the work
> that is queued for the way back. resume_user_mode_work() does that work
> when TIF_NOTIFY_RESUME is set. For a vhost task this means:
>
> - memory.high is handled at the wrong time. When a charge goes over
> memory.high, the task counts the pages, and should reclaim, and sleep
> if needed, on its way back to userspace. A vhost task only reclaims
> when more than a batch of pages has built up and the charge can block.
> Then it reclaims and sleeps in the middle of the charge, maybe while
> it holds a lock. vhost-scsi, for example, can fault in guest memory
> while it holds vq->mutex. If the charges can't block, nothing is done
> at all, and the count keeps growing.
>
> - Block cgroup throttling never runs. blkcg_schedule_throttle() asks for
> it, but only resume_user_mode_work() acts on it.
>
> - Task work queued with TWA_RESUME, like a deferred fput() or a NUMA
> balancing scan, waits until the task gets a signal or exits.
>
> io_uring workers had the same problem, and io_run_task_work() calls
> resume_user_mode_work() for them. Do the same in vhost_task_fn(): if
> TIF_NOTIFY_RESUME is set, call resume_user_mode_work() at the top of the
> loop. That is between work items, no locks are held there, and the task
> is running. Passing a NULL regs is fine, io_uring and KVM already do it.
>
> This covers every user of vhost_task_create(): the vhost workers and
> KVM's NX huge page recovery thread.
>
> Tested in a VM with a version of tools/virtio/vhost_net_test that puts
> each RX buffer on a new page, so the vhost worker faults in, and
> charges, 256M while its cgroup has memory.high=64M. Before, all 285
> calls to __mem_cgroup_handle_over_high() came from try_charge_memcg(),
> inside handle_rx() with vq->mutex held. After, all 589 came from
> vhost_task_fn(). memory.peak stayed at 64M, and the run took about the
> same time (0.66s before, 0.67s after). A lockdep kernel showed no
> warnings.
>
> Signed-off-by: Shakeel Butt <[email protected]>
Is this different from:
Message-ID:
<as8p251mb00012469e6ecbea2b7d87bb0c8...@as8p251mb0001.eurp251.prod.outlook.com>
> ---
> kernel/vhost_task.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c
> index 3717885a5992..f0ab21aa2a1c 100644
> --- a/kernel/vhost_task.c
> +++ b/kernel/vhost_task.c
> @@ -7,6 +7,7 @@
> #include <linux/sched/task.h>
> #include <linux/sched/vhost_task.h>
> #include <linux/sched/signal.h>
> +#include <linux/resume_user_mode.h>
>
> enum vhost_task_flags {
> VHOST_TASK_FLAGS_STOP,
> @@ -38,6 +39,14 @@ static int vhost_task_fn(void *data)
> break;
> }
>
> + /*
> + * A vhost task never returns to userspace. Do the work that
> + * would run on the way back, like memory.high reclaim, here
> + * between work items, while no locks are held.
> + */
> + if (test_thread_flag(TIF_NOTIFY_RESUME))
> + resume_user_mode_work(NULL);
> +
> /* mb paired w/ vhost_task_stop */
> set_current_state(TASK_INTERRUPTIBLE);
>
> --
> 2.53.0-Meta
