On Sat, Oct 31, 2026 at 11:10:04AM -0700, Shakeel Butt wrote:
A vhost task is a user worker: a thread of a user process that runs only
kernel code. It never returns to userspace, so it never runs the work
that is queued for the way back. resume_user_mode_work() does that work
when TIF_NOTIFY_RESUME is set. For a vhost task this means:
- memory.high is handled at the wrong time. When a charge goes over
memory.high, the task counts the pages, and should reclaim, and sleep
if needed, on its way back to userspace. A vhost task only reclaims
when more than a batch of pages has built up and the charge can block.
Then it reclaims and sleeps in the middle of the charge, maybe while
it holds a lock. vhost-scsi, for example, can fault in guest memory
while it holds vq->mutex. If the charges can't block, nothing is done
at all, and the count keeps growing.
- Block cgroup throttling never runs. blkcg_schedule_throttle() asks for
it, but only resume_user_mode_work() acts on it.
- Task work queued with TWA_RESUME, like a deferred fput() or a NUMA
balancing scan, waits until the task gets a signal or exits.
io_uring workers had the same problem, and io_run_task_work() calls
resume_user_mode_work() for them. Do the same in vhost_task_fn(): if
TIF_NOTIFY_RESUME is set, call resume_user_mode_work() at the top of the
loop. That is between work items, no locks are held there, and the task
is running. Passing a NULL regs is fine, io_uring and KVM already do it.
This covers every user of vhost_task_create(): the vhost workers and
KVM's NX huge page recovery thread.
Tested in a VM with a version of tools/virtio/vhost_net_test that puts
each RX buffer on a new page, so the vhost worker faults in, and
charges, 256M while its cgroup has memory.high=64M. Before, all 285
calls to __mem_cgroup_handle_over_high() came from try_charge_memcg(),
inside handle_rx() with vq->mutex held. After, all 589 came from
vhost_task_fn(). memory.peak stayed at 64M, and the run took about the
same time (0.66s before, 0.67s after). A lockdep kernel showed no
warnings.
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Is this different from:
Message-ID: [ref]
quoted hunk ↗ jump to hunk
---
kernel/vhost_task.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c
index 3717885a5992..f0ab21aa2a1c 100644
--- a/kernel/vhost_task.c
+++ b/kernel/vhost_task.c
@@ -7,6 +7,7 @@
#include <linux/sched/task.h>
#include <linux/sched/vhost_task.h>
#include <linux/sched/signal.h>
+#include <linux/resume_user_mode.h>
enum vhost_task_flags {
VHOST_TASK_FLAGS_STOP,@@ -38,6 +39,14 @@ static int vhost_task_fn(void *data)
break;
}
+ /*
+ * A vhost task never returns to userspace. Do the work that
+ * would run on the way back, like memory.high reclaim, here
+ * between work items, while no locks are held.
+ */
+ if (test_thread_flag(TIF_NOTIFY_RESUME))
+ resume_user_mode_work(NULL);
+
/* mb paired w/ vhost_task_stop */
set_current_state(TASK_INTERRUPTIBLE);
--
2.53.0-Meta