[PATCH] vhost_task: do the return-to-userspace work between work items

[PATCH] vhost_task: do the return-to-userspace work between work items

[Shakeel Butt]

A vhost task is a user worker: a thread of a user process that runs only
kernel code. It never returns to userspace, so it never runs the work
that is queued for the way back. resume_user_mode_work() does that work
when TIF_NOTIFY_RESUME is set. For a vhost task this means:

- memory.high is handled at the wrong time. When a charge goes over
  memory.high, the task counts the pages, and should reclaim, and sleep
  if needed, on its way back to userspace. A vhost task only reclaims
  when more than a batch of pages has built up and the charge can block.
  Then it reclaims and sleeps in the middle of the charge, maybe while
  it holds a lock. vhost-scsi, for example, can fault in guest memory
  while it holds vq->mutex. If the charges can't block, nothing is done
  at all, and the count keeps growing.

- Block cgroup throttling never runs. blkcg_schedule_throttle() asks for
  it, but only resume_user_mode_work() acts on it.

- Task work queued with TWA_RESUME, like a deferred fput() or a NUMA
  balancing scan, waits until the task gets a signal or exits.

io_uring workers had the same problem, and io_run_task_work() calls
resume_user_mode_work() for them. Do the same in vhost_task_fn(): if
TIF_NOTIFY_RESUME is set, call resume_user_mode_work() at the top of the
loop. That is between work items, no locks are held there, and the task
is running. Passing a NULL regs is fine, io_uring and KVM already do it.

This covers every user of vhost_task_create(): the vhost workers and
KVM's NX huge page recovery thread.

Tested in a VM with a version of tools/virtio/vhost_net_test that puts
each RX buffer on a new page, so the vhost worker faults in, and
charges, 256M while its cgroup has memory.high=64M. Before, all 285
calls to __mem_cgroup_handle_over_high() came from try_charge_memcg(),
inside handle_rx() with vq->mutex held. After, all 589 came from
vhost_task_fn(). memory.peak stayed at 64M, and the run took about the
same time (0.66s before, 0.67s after). A lockdep kernel showed no
warnings.

Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
---
 kernel/vhost_task.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c
index 3717885a5992..f0ab21aa2a1c 100644
--- a/kernel/vhost_task.c
+++ b/kernel/vhost_task.c
@@ -7,6 +7,7 @@
 #include <linux/sched/task.h>
 #include <linux/sched/vhost_task.h>
 #include <linux/sched/signal.h>
+#include <linux/resume_user_mode.h>
 
 enum vhost_task_flags {
 	VHOST_TASK_FLAGS_STOP,
@@ -38,6 +39,14 @@ static int vhost_task_fn(void *data)
 				break;
 		}
 
+		/*
+		 * A vhost task never returns to userspace. Do the work that
+		 * would run on the way back, like memory.high reclaim, here
+		 * between work items, while no locks are held.
+		 */
+		if (test_thread_flag(TIF_NOTIFY_RESUME))
+			resume_user_mode_work(NULL);
+
 		/* mb paired w/ vhost_task_stop */
 		set_current_state(TASK_INTERRUPTIBLE);
 
-- 
2.53.0-Meta

Re: [PATCH] vhost_task: do the return-to-userspace work between work items

[Michael S. Tsirkin]

On Sat, Oct 31, 2026 at 11:10:04AM -0700, Shakeel Butt wrote:
> A vhost task is a user worker: a thread of a user process that runs only
> kernel code. It never returns to userspace, so it never runs the work
> that is queued for the way back. resume_user_mode_work() does that work
> when TIF_NOTIFY_RESUME is set. For a vhost task this means:
> 
> - memory.high is handled at the wrong time. When a charge goes over
>   memory.high, the task counts the pages, and should reclaim, and sleep
>   if needed, on its way back to userspace. A vhost task only reclaims
>   when more than a batch of pages has built up and the charge can block.
>   Then it reclaims and sleeps in the middle of the charge, maybe while
>   it holds a lock. vhost-scsi, for example, can fault in guest memory
>   while it holds vq->mutex. If the charges can't block, nothing is done
>   at all, and the count keeps growing.
> 
> - Block cgroup throttling never runs. blkcg_schedule_throttle() asks for
>   it, but only resume_user_mode_work() acts on it.
> 
> - Task work queued with TWA_RESUME, like a deferred fput() or a NUMA
>   balancing scan, waits until the task gets a signal or exits.
> 
> io_uring workers had the same problem, and io_run_task_work() calls
> resume_user_mode_work() for them. Do the same in vhost_task_fn(): if
> TIF_NOTIFY_RESUME is set, call resume_user_mode_work() at the top of the
> loop. That is between work items, no locks are held there, and the task
> is running. Passing a NULL regs is fine, io_uring and KVM already do it.
> 
> This covers every user of vhost_task_create(): the vhost workers and
> KVM's NX huge page recovery thread.
> 
> Tested in a VM with a version of tools/virtio/vhost_net_test that puts
> each RX buffer on a new page, so the vhost worker faults in, and
> charges, 256M while its cgroup has memory.high=64M. Before, all 285
> calls to __mem_cgroup_handle_over_high() came from try_charge_memcg(),
> inside handle_rx() with vq->mutex held. After, all 589 came from
> vhost_task_fn(). memory.peak stayed at 64M, and the run took about the
> same time (0.66s before, 0.67s after). A lockdep kernel showed no
> warnings.
> 
> Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>

Is this different from:

Message-ID: <AS8P251MB00012469E6ECBEA2B7D87BB0C86C2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM>


> ---
>  kernel/vhost_task.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c
> index 3717885a5992..f0ab21aa2a1c 100644
> --- a/kernel/vhost_task.c
> +++ b/kernel/vhost_task.c
> @@ -7,6 +7,7 @@
>  #include <linux/sched/task.h>
>  #include <linux/sched/vhost_task.h>
>  #include <linux/sched/signal.h>
> +#include <linux/resume_user_mode.h>
>  
>  enum vhost_task_flags {
>  	VHOST_TASK_FLAGS_STOP,
> @@ -38,6 +39,14 @@ static int vhost_task_fn(void *data)
>  				break;
>  		}
>  
> +		/*
> +		 * A vhost task never returns to userspace. Do the work that
> +		 * would run on the way back, like memory.high reclaim, here
> +		 * between work items, while no locks are held.
> +		 */
> +		if (test_thread_flag(TIF_NOTIFY_RESUME))
> +			resume_user_mode_work(NULL);
> +
>  		/* mb paired w/ vhost_task_stop */
>  		set_current_state(TASK_INTERRUPTIBLE);
>  
> -- 
> 2.53.0-Meta

Re: [PATCH] vhost_task: do the return-to-userspace work between work items

[Shakeel Butt]

On Sat, Oct 31, 2026 at 02:15:40PM -0400, Michael S. Tsirkin wrote:
> On Sat, Oct 31, 2026 at 11:10:04AM -0700, Shakeel Butt wrote:
> > A vhost task is a user worker: a thread of a user process that runs only
> > kernel code. It never returns to userspace, so it never runs the work
> > that is queued for the way back. resume_user_mode_work() does that work
> > when TIF_NOTIFY_RESUME is set. For a vhost task this means:
> > 
> > - memory.high is handled at the wrong time. When a charge goes over
> >   memory.high, the task counts the pages, and should reclaim, and sleep
> >   if needed, on its way back to userspace. A vhost task only reclaims
> >   when more than a batch of pages has built up and the charge can block.
> >   Then it reclaims and sleeps in the middle of the charge, maybe while
> >   it holds a lock. vhost-scsi, for example, can fault in guest memory
> >   while it holds vq->mutex. If the charges can't block, nothing is done
> >   at all, and the count keeps growing.
> > 
> > - Block cgroup throttling never runs. blkcg_schedule_throttle() asks for
> >   it, but only resume_user_mode_work() acts on it.
> > 
> > - Task work queued with TWA_RESUME, like a deferred fput() or a NUMA
> >   balancing scan, waits until the task gets a signal or exits.
> > 
> > io_uring workers had the same problem, and io_run_task_work() calls
> > resume_user_mode_work() for them. Do the same in vhost_task_fn(): if
> > TIF_NOTIFY_RESUME is set, call resume_user_mode_work() at the top of the
> > loop. That is between work items, no locks are held there, and the task
> > is running. Passing a NULL regs is fine, io_uring and KVM already do it.
> > 
> > This covers every user of vhost_task_create(): the vhost workers and
> > KVM's NX huge page recovery thread.
> > 
> > Tested in a VM with a version of tools/virtio/vhost_net_test that puts
> > each RX buffer on a new page, so the vhost worker faults in, and
> > charges, 256M while its cgroup has memory.high=64M. Before, all 285
> > calls to __mem_cgroup_handle_over_high() came from try_charge_memcg(),
> > inside handle_rx() with vq->mutex held. After, all 589 came from
> > vhost_task_fn(). memory.peak stayed at 64M, and the run took about the
> > same time (0.66s before, 0.67s after). A lockdep kernel showed no
> > warnings.
> > 
> > Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
> 
> Is this different from:
> 
> Message-ID: <AS8P251MB00012469E6ECBEA2B7D87BB0C86C2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM>

Oh wow, it is same but somewhat for different reasons. I am fine that patch, I
will comment on it.