[PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Seija K.]

When a packet larger than MTU arrives in Linux from the modem, it is
discarded with -EOVERFLOW error (Babble error).

This is seen on USB3.0 and USB2.0 buses.

This is because the MRU (Max Receive Size) is not a separate entity
from the MTU (Max Transmit Size), and the received packets can be
larger than those transmitted.

Following the babble error, there was an endless supply of zero-length
URBs that were rejected with -EPROTO (increasing the rx input error
counter each time).

This is only seen on USB3.0. These continue to come ad infinitum until
the modem is shut down.

There appears to be a bug in the core USB handling code in Linux that
doesn't deal with network MTUs smaller than 1500 bytes well.

By default, the dev->hard_mtu (the real MTU) is in lockstep with
dev->rx_urb_size (essentially an MRU), and the latter is causing
trouble.

This has nothing to do with the modems; the issue can be reproduced by
getting a USB-Ethernet dongle, setting the MTU to 1430, and pinging
with size greater than 1406.

Signed-off-by: Seija Kijin <doremylover123@gmail.com>

Co-Authored-By: TarAldarion <gildeap@tcd.ie>
---
drivers/net/usb/qmi_wwan.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 554d4e2a84a4..39db53a74b5a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
struct usb_interface *intf)
}
dev->net->netdev_ops = &qmi_wwan_netdev_ops;
dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
+ /* LTE Networks don't always respect their own MTU on the receiving side;
+ * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
+ * far-end networks. Make the receive buffer large enough to accommodate
+ * them, and add four bytes so MTU does not equal MRU on network
+ * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
+ */
+ dev->rx_urb_size = ETH_DATA_LEN + 4;
err:
return status;
}
-- 
2.38.2

Re: [PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Daniele Palmas]

Hello Seija,

Il giorno mar 13 dic 2022 alle ore 18:44 Seija K.
<doremylover123@gmail.com> ha scritto:
>
> When a packet larger than MTU arrives in Linux from the modem, it is
> discarded with -EOVERFLOW error (Babble error).
>
> This is seen on USB3.0 and USB2.0 buses.
>
> This is because the MRU (Max Receive Size) is not a separate entity
> from the MTU (Max Transmit Size), and the received packets can be
> larger than those transmitted.
>
> Following the babble error, there was an endless supply of zero-length
> URBs that were rejected with -EPROTO (increasing the rx input error
> counter each time).
>
> This is only seen on USB3.0. These continue to come ad infinitum until
> the modem is shut down.
>
> There appears to be a bug in the core USB handling code in Linux that
> doesn't deal with network MTUs smaller than 1500 bytes well.
>
> By default, the dev->hard_mtu (the real MTU) is in lockstep with
> dev->rx_urb_size (essentially an MRU), and the latter is causing
> trouble.
>
> This has nothing to do with the modems; the issue can be reproduced by
> getting a USB-Ethernet dongle, setting the MTU to 1430, and pinging
> with size greater than 1406.
>
> Signed-off-by: Seija Kijin <doremylover123@gmail.com>
>
> Co-Authored-By: TarAldarion <gildeap@tcd.ie>
> ---
> drivers/net/usb/qmi_wwan.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
> index 554d4e2a84a4..39db53a74b5a 100644
> --- a/drivers/net/usb/qmi_wwan.c
> +++ b/drivers/net/usb/qmi_wwan.c
> @@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
> struct usb_interface *intf)
> }
> dev->net->netdev_ops = &qmi_wwan_netdev_ops;
> dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
> + /* LTE Networks don't always respect their own MTU on the receiving side;
> + * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
> + * far-end networks. Make the receive buffer large enough to accommodate
> + * them, and add four bytes so MTU does not equal MRU on network
> + * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
> + */
> + dev->rx_urb_size = ETH_DATA_LEN + 4;

Did you test this change with QMAP?

To support qmap dl aggregated blocks qmi_wwan relies on the
usbnet_change_mtu behavior of changing the rx_urb_size.

Thanks,
Daniele

> err:
> return status;
> }
> --
> 2.38.2

Re: [PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Seija K.]

Yes, I did.

On Tue, Dec 13, 2022 at 1:23 PM Daniele Palmas <dnlplm@gmail.com> wrote:
>
> Hello Seija,
>
> Il giorno mar 13 dic 2022 alle ore 18:44 Seija K.
> <doremylover123@gmail.com> ha scritto:
> >
> > When a packet larger than MTU arrives in Linux from the modem, it is
> > discarded with -EOVERFLOW error (Babble error).
> >
> > This is seen on USB3.0 and USB2.0 buses.
> >
> > This is because the MRU (Max Receive Size) is not a separate entity
> > from the MTU (Max Transmit Size), and the received packets can be
> > larger than those transmitted.
> >
> > Following the babble error, there was an endless supply of zero-length
> > URBs that were rejected with -EPROTO (increasing the rx input error
> > counter each time).
> >
> > This is only seen on USB3.0. These continue to come ad infinitum until
> > the modem is shut down.
> >
> > There appears to be a bug in the core USB handling code in Linux that
> > doesn't deal with network MTUs smaller than 1500 bytes well.
> >
> > By default, the dev->hard_mtu (the real MTU) is in lockstep with
> > dev->rx_urb_size (essentially an MRU), and the latter is causing
> > trouble.
> >
> > This has nothing to do with the modems; the issue can be reproduced by
> > getting a USB-Ethernet dongle, setting the MTU to 1430, and pinging
> > with size greater than 1406.
> >
> > Signed-off-by: Seija Kijin <doremylover123@gmail.com>
> >
> > Co-Authored-By: TarAldarion <gildeap@tcd.ie>
> > ---
> > drivers/net/usb/qmi_wwan.c | 7 +++++++
> > 1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
> > index 554d4e2a84a4..39db53a74b5a 100644
> > --- a/drivers/net/usb/qmi_wwan.c
> > +++ b/drivers/net/usb/qmi_wwan.c
> > @@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
> > struct usb_interface *intf)
> > }
> > dev->net->netdev_ops = &qmi_wwan_netdev_ops;
> > dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
> > + /* LTE Networks don't always respect their own MTU on the receiving side;
> > + * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
> > + * far-end networks. Make the receive buffer large enough to accommodate
> > + * them, and add four bytes so MTU does not equal MRU on network
> > + * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
> > + */
> > + dev->rx_urb_size = ETH_DATA_LEN + 4;
>
> Did you test this change with QMAP?
>
> To support qmap dl aggregated blocks qmi_wwan relies on the
> usbnet_change_mtu behavior of changing the rx_urb_size.
>
> Thanks,
> Daniele
>
> > err:
> > return status;
> > }
> > --
> > 2.38.2

Re: [PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Jakub Kicinski]

On Tue, 13 Dec 2022 12:40:52 -0500 Seija K. wrote:
> Signed-off-by: Seija Kijin <doremylover123@gmail.com>

You need to update the Author / the From field as well as the sign-off.

> 

No empty lines between tags.

> Co-Authored-By: TarAldarion <gildeap@tcd.ie>

We need sign-offs for co-authors.

Please take the "must be your real legal name" requirement seriously,
we mean it.

> diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
> index 554d4e2a84a4..39db53a74b5a 100644
> --- a/drivers/net/usb/qmi_wwan.c
> +++ b/drivers/net/usb/qmi_wwan.c
> @@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
> struct usb_interface *intf)
> }
> dev->net->netdev_ops = &qmi_wwan_netdev_ops;
> dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
> + /* LTE Networks don't always respect their own MTU on the receiving side;
> + * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
> + * far-end networks. Make the receive buffer large enough to accommodate
> + * them, and add four bytes so MTU does not equal MRU on network
> + * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
> + */
> + dev->rx_urb_size = ETH_DATA_LEN + 4;
> err:
> return status;

The patch is still pooped, please try with git send-email.

Re: [PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Daniele Palmas]

Hello Seija,

Il giorno mar 13 dic 2022 alle ore 20:55 Seija K.
<doremylover123@gmail.com> ha scritto:
> On Tue, Dec 13, 2022 at 1:23 PM Daniele Palmas <dnlplm@gmail.com> wrote:
> >
> > Did you test this change with QMAP?
> >
> > To support qmap dl aggregated blocks qmi_wwan relies on the
> > usbnet_change_mtu behavior of changing the rx_urb_size.
> >
> > Thanks,
> > Daniele
>
> Yes, I did.
>

I've applied your change and verified that the rx_urb_size can't be
changed anymore by modifying the mtu of the wwan netdevice and stays
fixed to 1504.

Just a heads-up, that this change is not working fine with qmap setup
procedure, since the URB size can't be changed anymore to the value of
the maximum dl aggregated block set through wda_set_data_format.

I know that linking MTU with the rx_urb_size is odd, but this is how
it's done currently.

Regards,
Daniele

> On Tue, Dec 13, 2022 at 1:23 PM Daniele Palmas <dnlplm@gmail.com> wrote:
> >
> > Hello Seija,
> >
> > Il giorno mar 13 dic 2022 alle ore 18:44 Seija K.
> > <doremylover123@gmail.com> ha scritto:
> > >
> > > When a packet larger than MTU arrives in Linux from the modem, it is
> > > discarded with -EOVERFLOW error (Babble error).
> > >
> > > This is seen on USB3.0 and USB2.0 buses.
> > >
> > > This is because the MRU (Max Receive Size) is not a separate entity
> > > from the MTU (Max Transmit Size), and the received packets can be
> > > larger than those transmitted.
> > >
> > > Following the babble error, there was an endless supply of zero-length
> > > URBs that were rejected with -EPROTO (increasing the rx input error
> > > counter each time).
> > >
> > > This is only seen on USB3.0. These continue to come ad infinitum until
> > > the modem is shut down.
> > >
> > > There appears to be a bug in the core USB handling code in Linux that
> > > doesn't deal with network MTUs smaller than 1500 bytes well.
> > >
> > > By default, the dev->hard_mtu (the real MTU) is in lockstep with
> > > dev->rx_urb_size (essentially an MRU), and the latter is causing
> > > trouble.
> > >
> > > This has nothing to do with the modems; the issue can be reproduced by
> > > getting a USB-Ethernet dongle, setting the MTU to 1430, and pinging
> > > with size greater than 1406.
> > >
> > > Signed-off-by: Seija Kijin <doremylover123@gmail.com>
> > >
> > > Co-Authored-By: TarAldarion <gildeap@tcd.ie>
> > > ---
> > > drivers/net/usb/qmi_wwan.c | 7 +++++++
> > > 1 file changed, 7 insertions(+)
> > >
> > > diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
> > > index 554d4e2a84a4..39db53a74b5a 100644
> > > --- a/drivers/net/usb/qmi_wwan.c
> > > +++ b/drivers/net/usb/qmi_wwan.c
> > > @@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
> > > struct usb_interface *intf)
> > > }
> > > dev->net->netdev_ops = &qmi_wwan_netdev_ops;
> > > dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
> > > + /* LTE Networks don't always respect their own MTU on the receiving side;
> > > + * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
> > > + * far-end networks. Make the receive buffer large enough to accommodate
> > > + * them, and add four bytes so MTU does not equal MRU on network
> > > + * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
> > > + */
> > > + dev->rx_urb_size = ETH_DATA_LEN + 4;
> >
> > Did you test this change with QMAP?
> >
> > To support qmap dl aggregated blocks qmi_wwan relies on the
> > usbnet_change_mtu behavior of changing the rx_urb_size.
> >
> > Thanks,
> > Daniele
> >
> > > err:
> > > return status;
> > > }
> > > --
> > > 2.38.2

Re: [PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Seija K.]

Ok, thanks.

On Wed, Dec 14, 2022 at 10:25 AM Daniele Palmas <dnlplm@gmail.com> wrote:
>
> Hello Seija,
>
> Il giorno mar 13 dic 2022 alle ore 20:55 Seija K.
> <doremylover123@gmail.com> ha scritto:
> > On Tue, Dec 13, 2022 at 1:23 PM Daniele Palmas <dnlplm@gmail.com> wrote:
> > >
> > > Did you test this change with QMAP?
> > >
> > > To support qmap dl aggregated blocks qmi_wwan relies on the
> > > usbnet_change_mtu behavior of changing the rx_urb_size.
> > >
> > > Thanks,
> > > Daniele
> >
> > Yes, I did.
> >
>
> I've applied your change and verified that the rx_urb_size can't be
> changed anymore by modifying the mtu of the wwan netdevice and stays
> fixed to 1504.
>
> Just a heads-up, that this change is not working fine with qmap setup
> procedure, since the URB size can't be changed anymore to the value of
> the maximum dl aggregated block set through wda_set_data_format.
>
> I know that linking MTU with the rx_urb_size is odd, but this is how
> it's done currently.
>
> Regards,
> Daniele
>
> > On Tue, Dec 13, 2022 at 1:23 PM Daniele Palmas <dnlplm@gmail.com> wrote:
> > >
> > > Hello Seija,
> > >
> > > Il giorno mar 13 dic 2022 alle ore 18:44 Seija K.
> > > <doremylover123@gmail.com> ha scritto:
> > > >
> > > > When a packet larger than MTU arrives in Linux from the modem, it is
> > > > discarded with -EOVERFLOW error (Babble error).
> > > >
> > > > This is seen on USB3.0 and USB2.0 buses.
> > > >
> > > > This is because the MRU (Max Receive Size) is not a separate entity
> > > > from the MTU (Max Transmit Size), and the received packets can be
> > > > larger than those transmitted.
> > > >
> > > > Following the babble error, there was an endless supply of zero-length
> > > > URBs that were rejected with -EPROTO (increasing the rx input error
> > > > counter each time).
> > > >
> > > > This is only seen on USB3.0. These continue to come ad infinitum until
> > > > the modem is shut down.
> > > >
> > > > There appears to be a bug in the core USB handling code in Linux that
> > > > doesn't deal with network MTUs smaller than 1500 bytes well.
> > > >
> > > > By default, the dev->hard_mtu (the real MTU) is in lockstep with
> > > > dev->rx_urb_size (essentially an MRU), and the latter is causing
> > > > trouble.
> > > >
> > > > This has nothing to do with the modems; the issue can be reproduced by
> > > > getting a USB-Ethernet dongle, setting the MTU to 1430, and pinging
> > > > with size greater than 1406.
> > > >
> > > > Signed-off-by: Seija Kijin <doremylover123@gmail.com>
> > > >
> > > > Co-Authored-By: TarAldarion <gildeap@tcd.ie>
> > > > ---
> > > > drivers/net/usb/qmi_wwan.c | 7 +++++++
> > > > 1 file changed, 7 insertions(+)
> > > >
> > > > diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
> > > > index 554d4e2a84a4..39db53a74b5a 100644
> > > > --- a/drivers/net/usb/qmi_wwan.c
> > > > +++ b/drivers/net/usb/qmi_wwan.c
> > > > @@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
> > > > struct usb_interface *intf)
> > > > }
> > > > dev->net->netdev_ops = &qmi_wwan_netdev_ops;
> > > > dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
> > > > + /* LTE Networks don't always respect their own MTU on the receiving side;
> > > > + * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
> > > > + * far-end networks. Make the receive buffer large enough to accommodate
> > > > + * them, and add four bytes so MTU does not equal MRU on network
> > > > + * with 1500 MTU. Otherwise, usbnet_change_mtu() will change both.
> > > > + */
> > > > + dev->rx_urb_size = ETH_DATA_LEN + 4;
> > >
> > > Did you test this change with QMAP?
> > >
> > > To support qmap dl aggregated blocks qmi_wwan relies on the
> > > usbnet_change_mtu behavior of changing the rx_urb_size.
> > >
> > > Thanks,
> > > Daniele
> > >
> > > > err:
> > > > return status;
> > > > }
> > > > --
> > > > 2.38.2

Re: [PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Greg KH]

On Tue, Dec 13, 2022 at 12:14:28PM -0500, Seija K. wrote:
> When a packet larger than MTU arrives in Linux from the modem,
> it is discarded with -EOVERFLOW error (Babble error).
> 
> This is seen on USB3.0 and USB2.0 buses.
> 
> This is because the MRU (Max Receive Size) is not a separate entity
> from the MTU (Max Transmit Size),
> and the received packets can be larger than those transmitted.
> 
> Following the babble error, there was an endless supply of zero-length URBs,
> which are rejected with -EPROTO (increasing the rx input error counter
> each time).
> 
> This is only seen on USB3.0.
> These continue to come ad infinitum until the modem is shut down.
> 
> There appears to be a bug in the core USB handling code in Linux
> that doesn't deal well with network MTUs smaller than 1500 bytes.
> 
> By default, the dev->hard_mtu (the real MTU)
> is in lockstep with dev->rx_urb_size (essentially an MRU),
> and the latter is causing trouble.
> 
> This has nothing to do with the modems,
> as the issue can be reproduced by getting a USB-Ethernet dongle,
> setting the MTU to 1430, and pinging with size greater than 1406.
> 
> Signed-off-by: Seija Kijin <doremylover123@gmail.com>
> Co-Authored-By: TarAldarion <gildeap@tcd.ie>
> 
> diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
> index 554d4e2a84a4..39db53a74b5a 100644
> --- a/drivers/net/usb/qmi_wwan.c
> +++ b/drivers/net/usb/qmi_wwan.c
> @@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
> struct usb_interface *intf)
> }
> dev->net->netdev_ops = &qmi_wwan_netdev_ops;
> dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
> + /* LTE Networks don't always respect their own MTU on receive side;
> + * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
> + * far-end network. Make the receive buffer large enough to accommodate
> + * them, and add four bytes so MTU does not equal MRU on network
> + * with 1500 MTU otherwise usbnet_change_mtu() will change both.
> + */
> + dev->rx_urb_size = ETH_DATA_LEN + 4;
> err:
> return status;
> }

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- Your patch is malformed (tabs converted to spaces, linewrapped, etc.)
  and can not be applied.  Please read the file,
  Documentation/process/email-clients.rst in order to fix this.

- It looks like you did not use your "real" name for the patch on either
  the Signed-off-by: line, or the From: line (both of which have to
  match).  Please read the kernel file,
  Documentation/process/submitting-patches.rst for how to do this
  correctly.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

[PATCH] net: Fix for packets being rejected in the xHCI controller's ring buffer

[Seija K.]

When a packet larger than MTU arrives in Linux from the modem,
it is discarded with -EOVERFLOW error (Babble error).

This is seen on USB3.0 and USB2.0 buses.

This is because the MRU (Max Receive Size) is not a separate entity
from the MTU (Max Transmit Size),
and the received packets can be larger than those transmitted.

Following the babble error, there was an endless supply of zero-length URBs,
which are rejected with -EPROTO (increasing the rx input error counter
each time).

This is only seen on USB3.0.
These continue to come ad infinitum until the modem is shut down.

There appears to be a bug in the core USB handling code in Linux
that doesn't deal well with network MTUs smaller than 1500 bytes.

By default, the dev->hard_mtu (the real MTU)
is in lockstep with dev->rx_urb_size (essentially an MRU),
and the latter is causing trouble.

This has nothing to do with the modems,
as the issue can be reproduced by getting a USB-Ethernet dongle,
setting the MTU to 1430, and pinging with size greater than 1406.

Signed-off-by: Seija Kijin <doremylover123@gmail.com>
Co-Authored-By: TarAldarion <gildeap@tcd.ie>

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 554d4e2a84a4..39db53a74b5a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -842,6 +842,13 @@ static int qmi_wwan_bind(struct usbnet *dev,
struct usb_interface *intf)
}
dev->net->netdev_ops = &qmi_wwan_netdev_ops;
dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
+ /* LTE Networks don't always respect their own MTU on receive side;
+ * e.g. AT&T pushes 1430 MTU but still allows 1500 byte packets from
+ * far-end network. Make the receive buffer large enough to accommodate
+ * them, and add four bytes so MTU does not equal MRU on network
+ * with 1500 MTU otherwise usbnet_change_mtu() will change both.
+ */
+ dev->rx_urb_size = ETH_DATA_LEN + 4;
err:
return status;
}