From patchwork Fri Oct 30 11:18:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Schippers X-Patchwork-Id: 5530 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp1908409laa; Fri, 30 Oct 2026 04:18:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBxyi4tEDdQeFP95f3d5lUcQ9q1e2vMZQekX7RIEesFFpEr2ZceHY1d2C9t2zULmJVk/t5RpxpaKKrU=@openvpn.net X-Received: by 2002:a05:701b:2302:b0:182:9071:3249 with SMTP id a92af1059eb24-1ac5de53bdemr2272363c88.30.1793359127150; Fri, 30 Oct 2026 04:18:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793359127; cv=none; d=google.com; s=arc-20260327; b=Vn513+ErADStvXRl8eSfArjuhVmrY+LcwIhS2r/3d4Q5+eD8VoDEsaQBX7x5aEIQKg mXmk6KHNLEQFdyQlS8SMfzWwut4dt6T2WV4BfPf/KkoEXVeu4ibdDOG4PStLI9qwQeQe VU7cck8KbO/kOM2XelydKecGWsZAfWVsJrsU46ADNtV1WW3XfvcEU0Da5Lp7Le2poZdT Yuz/a74pTV79mgt3EWg1h+JZi298uRzaiMaBD8mbR/AGsAYuRkTVQ04hYOw2BW3sz6uB fFp2zuLFi/eZeoSQAqccV+AFaq8mlGgGbvIjxlEkutw0VbAE94h5q2QlQ3KsYruGw3Ad sbtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=uGIssNzs1leiCQYF9h/XnaejQg2F9Qh/Hvxsr1hgR40=; fh=mn95gaSpKV/N/kXPK2/KrHabPlzdnEwenz3R7hCEkC4=; b=XpiJWdjGngrBDGSaS+dSyzZdXFjUs2UVZ2Wur7+RpqqPBWPIx7NnsV30TM39uz+ZSY Q2d+kbnKcGfWwW+m2MSbAgtgi6DY68vPWP7Er08vTHAhGVdo7m6HIZgtZimdkR2WoyF/ QP5MCjsTNY52X/RPA3WpV5XAgF5qaKEcbz8PswZAZY3Ko07TEcLxlplCZrUBxDrAL73i YXdoqf+E1OscFlnJIt3VhmdFepk0Wp8OPaP7DXHGFgGcYl3/boI6mulVwKFwgPf8mWOh 0ad8EglICSVc2bFgQMGXjZuU0vZAkmlFy6Woszq5rReDof/uszozBXcTePcccC2lZD4M r9nA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=bKDHumn4; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=YmD72QBJ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=KB92iia7; dkim=neutral (body hash did not verify) header.i=@tu-dortmund.de header.s=unimail header.b=CzOK6NOy; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=tu-dortmund.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac19f4b0easi7266280c88.57.2026.10.30.04.18.46 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Oct 2026 04:18:47 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=bKDHumn4; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=YmD72QBJ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=KB92iia7; dkim=neutral (body hash did not verify) header.i=@tu-dortmund.de header.s=unimail header.b=CzOK6NOy; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=tu-dortmund.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post:List-Owner; bh=uGIssNzs1leiCQYF9h/XnaejQg2F9Qh/Hvxsr1hgR40=; b=bKDHumn4NzrtYynp/yDAJnt7o5 sBWUAV8zsPWOiYw7VgyTsR8VLAORQ741t1dB1jKl+1b5z3pB8tUTRO1KN+M/I00tOep7YNAp0Q4kU vWu8kKmS1I5O83yiOvgX7pSt0TprpU5p2PS+x/OeJQQRQ7EQW8k/A4duNJK4WnAtaHb4=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xMkd9-000000004jG-445V; Fri, 30 Oct 2026 11:18:43 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xMkcr-000000004hb-2D2i for openvpn-devel@lists.sourceforge.net; Fri, 30 Oct 2026 11:18:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=obFUYgXfcDeXGLdre7ly94CO2C8GymjfYXsRIZh/JBE=; b=YmD72QBJESX2Efh6ZW+JTNqhv8 mRkeVFbH6yKlAnWeVvT2CZG7DWVnnzUMAeAe9VvAD2hfUnyUusptYxtgHXtK92jnrvsBtg3pcDQFH McgKqVUXcsSWAogCZ0FXlVxRUjnlHVTT4h6f232sS7ngX9+1fdjVU7t9HRbTMffPlYRU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=obFUYgXfcDeXGLdre7ly94CO2C8GymjfYXsRIZh/JBE=; b=KB92iia7BxSx7znxB2ECnJzhwE AoK9XZo2sJl7NXB98IbfVU6aXDOgm/R5YFQ66CMI0NimaJwmqkMtq+I13h5ft74SaSzHweMqy1Jwq ylNL1Gx+hv2TgPaDcVAlJ4GjhwUNpR6/5+WTDiu+bAJKm7Up3UZ9d4ytEHt/PY1ZmVIE=; Received: from mx1.hrz.uni-dortmund.de ([129.217.128.51] helo=unimail.uni-dortmund.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xMkcm-000000007Hb-0GQB for openvpn-devel@lists.sourceforge.net; Fri, 30 Oct 2026 11:18:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tu-dortmund.de; s=unimail; t=1793359093; bh=obFUYgXfcDeXGLdre7ly94CO2C8GymjfYXsRIZh/JBE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CzOK6NOyDW4Cpa3MbiWP1cVAdRrWMkxeqOBCUytUz/ippgiSI9zf+kvcTY3GG6Tqz 5T2y2H/pvjPQojrHVwXOhL3Hs72w2TUNEA4KpvrLAxMnec+iyOreV8j6g88EBbh1dT LQVu8Q2X+iPfgqmuv+BrVp3hJxgVK/HJYG2DjWrk= Received: from simon-Latitude-5450.tu-dortmund.de ([129.217.186.53]) (authenticated bits=0) by unimail.uni-dortmund.de (8.19.0.2/8.19.0.2) with ESMTPSA id 69UBICoi016986 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 30 Oct 2026 12:18:13 +0100 (CET) From: Simon Schippers To: openvpn-devel@lists.sourceforge.net Date: Fri, 30 Oct 2026 12:18:06 +0100 Message-ID: <20261030111806.92252-1-simon.schippers@tu-dortmund.de> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261028144643.647448-1-simon.schippers@tu-dortmund.de> References: <20261028144643.647448-1-simon.schippers@tu-dortmund.de> MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: When the internal ring of a TUN/TAP device is full, the kernel silently drops packets, bypassing any qdisc. TCP then sees loss, retransmits and shrinks its congestion window. My series "tun/tap & vhost-net: apply qdisc backpressure on full ptr_ring to reduce TX drops" [1] adds IFF_BACKPRESSURE in Linux 7.3 (commit d00c7369ef24 "tun/tap & vhost-net: stop tail-drop when IFF_ [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [129.217.128.51 listed in wl.mailspike.net] 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-Headers-End: 1xMkcm-000000007Hb-0GQB Subject: [Openvpn-devel] [PATCH v2] tun: set IFF_BACKPRESSURE on Linux X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: a@unstable.cc Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880473340196609199 X-GMAIL-MSGID: 1880473340196609199 When the internal ring of a TUN/TAP device is full, the kernel silently drops packets, bypassing any qdisc. TCP then sees loss, retransmits and shrinks its congestion window. My series "tun/tap & vhost-net: apply qdisc backpressure on full ptr_ring to reduce TX drops" [1] adds IFF_BACKPRESSURE in Linux 7.3 (commit d00c7369ef24 "tun/tap & vhost-net: stop tail-drop when IFF_BACKPRESSURE is set"). It stops the TX queue instead, so the qdisc holds the packets and applies its AQM and fairness. Our paper [2] evaluated this with OpenVPN: over a 120 ms RTT link between Germany and the USA, TCP throughput without the patch was up to 36% worse, and with it no retransmissions occurred. With higher latencies, throughput without the patch can be even worse. Stopping and waking the queue costs CPU time, which reduced throughput in a synthetic test with eight iperf3 senders into a QEMU VM on a Ryzen 9 9950X [3]. With OpenVPN, the encryption is the bottleneck instead. A benchmark on the same CPU with eight iperf3 streams through OpenVPN between two network namespaces [4] gives these means over 40 runs of 30 s, with the flag off and on (drops: TX drops of the client TUN device, retr: TCP retransmits): txqueuelen off Mbit/s on Mbit/s change off drops on drops off retr on retr 500 3971 3952 -0.5% 40226 0 36624 531 5000 4005 3923 -2.1% 1358 0 658 0 The throughput difference is within the run-to-run standard deviation of 340 to 380 Mbit/s (about 9%), while the TUN drops are gone and the retransmits nearly so. The flag is therefore always set. The flag is only set when the headers define IFF_BACKPRESSURE, and older kernels ignore it. The DCO path uses no TUN device and is unaffected. [1] https://lore.kernel.org/netdev/20260803183641.96882-1-simon.schippers@tu-dortmund.de/T/#u [2] https://cni.etit.tu-dortmund.de/storages/cni-etit/r/Research/Publications/2025/Gebauer_2025_VTCFall/Gebauer_VTCFall2025_AuthorsVersion.pdf [3] https://lore.kernel.org/netdev/akVnoOYQOrt8k-Gu@karahi.librecast.net/ [4] https://github.com/simoschip2000/openvpn-bench Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Simon Schippers --- v2: - Always set the flag instead of adding a --tun-backpressure option, as discussed with Antonio. - Add OpenVPN benchmark results. src/openvpn/tun.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c index fdd13ae7e..85daefd10 100644 --- a/src/openvpn/tun.c +++ b/src/openvpn/tun.c @@ -2100,6 +2100,10 @@ open_tun(const char *dev, const char *dev_type, const char *dev_node, struct tun ifr.ifr_flags |= IFF_ONE_QUEUE; #endif +#ifdef IFF_BACKPRESSURE + ifr.ifr_flags |= IFF_BACKPRESSURE; +#endif + /* * Figure out if tun or tap device */