Date: Sat, 27 Oct 2001 00:51:04 +0100
From: Alex Bligh <alex@alex.org.uk>
Reply-To: Alex Bligh <alex@alex.org.uk>
To: linux-wlan-user@lists.linux-wlan.com
cc: Alex Bligh <alex@alex.org.uk>
Subject: TX MTU problems Prism2: >1492 byte packets not transmitted, on IBM
 T23 built in Prism 2.5 WLAN

Bug summary: Inability to transmit packets > 1492 bytes on
             Prism 3873, wlan-ng-0.1.10, kernel 2.4.12-ac5

Bug details:

Firstly I hope this bug report is less bogus than the last one.

I have an IBM T23 laptop running linux 2.4.12-ac5 plus wlan-ng-0.1.10.
I have several other machines on the LAN working fine. Attached
to the aironet base station is a Cisco 2501.

This fault appears when the 2501 communicates with the IBM /ONLY/
and not (for instance) other Linux machines with Aironet drivers,
or Windows machines, all over the same LAN.

The IBM seems to have a Harris/Intersil 3873 chipset, and indeed
the Prism driver seems to find it correctly, via modprobe prism2_pci.

The problem appears to be that the card/driver will not TRANSMIT packets
between 1493 and 1500 (inclusive) bytes in length. This is
not sensible as its default MTU is 1500 bytes. As packets > 1500
bytes are fragmented, with all but the last fragment having length
1500, this means that packets larger than 1492 bytes are never
transmitted, fragmented or otherwise.

I tested this by setting up a sweep ping from the cisco router (dump
attached). In essence, I first did a sweep to a working machine, first
with DF (don't fragment) set, then without, in order to verify
that the ICMP packet size reported was indeed the true payload size.
As expected, with DF set, the sweep stopped 52 packets in (I was
sweeping from 1450 to 1550 bytes), indicating that packets of
size 1501 could not be sent (remember packet 1 is 1450), but packets
of size 1500 could be sent. Without DF set, of course, all packets
got through as they were fragmented.

I then reran the sweep test against the wlan-ng / Prism combination
on the IBM. When running with DF set, the sweep stopped 44 packets
in, i.e. the packet of length 1492 was the last successful size
sent, and 1493 byte packets were not sent successfully. No other packets
arrived. Without DF set, the sweep stopped in the same place.

This leaves 2 possibilities: firstly that the Prism card was not
receiving packets > 1492 bytes in length, or secondly that it was
not transmitting them. Analysis of the ethernet segment showed
that, on the non-DF test, the Cisco router was receiving ONLY the
second fragment of the ICMP reply from the prism box (which was
small) and not the 1500 byte first segment (this implies of course
that the prism was receiving the entire echo response packet).
This was verified as the Cisco correctly generated fragment reassembly
ICMP errors which were passed back and received by the Linux box.

Therefore I conclude that the Prism card or driver
cannot transmit >1492 byte packets.

To test this theory, I reduced the mtu on wlan0 (ifconfig wlan0 mtu 1492)
without changing the MTU on the Cisco. This means that the Cisco
will blindly send packets >1492 bytes (up to 1500) to the prism unit,
but the prism unit will fragment above this. Under these circumstances
the sweep was successfull at all ping sizes with DF not set.

I have read through the code as much as much as I can understand,
and I am slightly confused by the following line in
p80211knetdev_hard_start_xmit
        pb->ethbuflen = skb->len > 1514 ? 1514 : skb->len;

Where does the magical figure 14 come from?

I enclose details such I expect may be useful

Alex Bligh


lspci shows:

02:02.0 Network controller: Harris Semiconductor: Unknown device 3873 (rev 01)
        Subsystem: Action Tec Electronics Inc: Unknown device 0406
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR+ FastB2B-
        Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 64, cache line size 08
        Interrupt: pin A routed to IRQ 11
        Region 0: Memory at ec000000 (32-bit, prefetchable) [size=4K]
        Capabilities: [dc] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-

ifconfig shows:

araucaria:/usr/src/linux-wlan-ng-0.1.10/src# ifconfig wlan0

wlan0     Link encap:Ethernet  HWaddr 00:20:E0:89:07:1B
          inet addr:195.224.237.76  Bcast:195.224.237.79 Mask:255.255.255.240
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16985 errors:0 dropped:0 overruns:0 frame:0
          TX packets:29456 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:5885213 (5.6 Mb)  TX bytes:5216815 (4.9 Mb)
          Interrupt:11 Memory:e893f000-e8940000


dmsesg shows:

A Prism2.5 PCI device found, phymem:0xec000000, irq:11
, mem:0xe893f000
ident: nic h/w: id=0x8013 1.0.0
ident: pri f/w: id=0x15 1.0.5
ident: sta f/w: id=0x1f 1.1.1
MFI:SUP:role=0x00:id=0x01:var=0x01:b/t=1/1
CFI:SUP:role=0x00:id=0x02:var=0x02:b/t=1/1
PRI:SUP:role=0x00:id=0x03:var=0x01:b/t=1/3
STA:SUP:role=0x00:id=0x04:var=0x01:b/t=1/6
PRI-CFI:ACT:role=0x01:id=0x02:var=0x02:b/t=1/1
STA-CFI:ACT:role=0x01:id=0x02:var=0x02:b/t=1/1
STA-MFI:ACT:role=0x01:id=0x01:var=0x01:b/t=1/1
Prism2 card SN: 1241080005RM
cs: IO port probe 0x0c00-0x0cff: clean.
cs: IO port probe 0x0800-0x08ff: clean.
cs: IO port probe 0x0100-0x04ff: excluding 0x3b8-0x3df 0x4d0-0x4d7
cs: IO port probe 0x0a00-0x0aff: clean.

Test results:

Ping to a working host (aironet) from router, fragmentation
NOT allowed

amb#ping
Protocol [ip]: 
Target IP address: 195.224.237.67
Repeat count [5]: 
Datagram size [100]: 1400
Timeout in seconds [2]: 2
Extended commands [n]: y
Source address or interface: 
Type of service [0]: 
Set DF bit in IP header? [no]: y
Validate reply data? [no]: y
Data pattern [0xABCD]: 
Loose, Strict, Record, Timestamp, Verbose[none]: 
Sweep range of sizes [n]: y
Sweep min size [36]: 1450
Sweep max size [18024]: 1550
Sweep interval [1]: 
Type escape sequence to abort.
Sending 505, [1450..1550]-byte ICMP Echos to 195.224.237.67, timeout is 2 second
s:
012345678901234567890123456789012345678901234567890 [added - amb]
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...................
..
Success rate is 70 percent (51/72), round-trip min/avg/max = 8/12/16 ms

[Note failure after sweep size = 1450 + 50 bytes = 1500 bytes]

Ping to a working host (aironet) from router, fragmentation
allowed

amb#ping
Protocol [ip]: 
Target IP address: 195.224.237.67
Repeat count [5]:  
Datagram size [100]: 1450
Timeout in seconds [2]: 1
Extended commands [n]: y
Source address or interface: 
Type of service [0]: 
Set DF bit in IP header? [no]: 
Validate reply data? [no]: yes
Data pattern [0xABCD]: 
Loose, Strict, Record, Timestamp, Verbose[none]: 
Sweep range of sizes [n]: y
Sweep min size [36]: 1450
Sweep max size [18024]: 1550
Sweep interval [1]: 
Type escape sequence to abort.
Sending 505, [1450..1550]-byte ICMP Echos to 195.224.237.67, timeout is 1 second
s:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!
Success rate is 100 percent (505/505), round-trip min/avg/max = 8/13/128 ms
amb#

[Note fragmentation happens correctly]

Ping to a failing host (prism2) from router, fragmentation
NOT allowed

amb#ping
Protocol [ip]: 
Target IP address: 195.224.237.76
Repeat count [5]: 
Datagram size [100]: 1450
Timeout in seconds [2]: 
Extended commands [n]: y
Source address or interface: 
Type of service [0]: 
Set DF bit in IP header? [no]: y
Validate reply data? [no]: y
Data pattern [0xABCD]: 
Loose, Strict, Record, Timestamp, Verbose[none]: 
Sweep range of sizes [n]: y
Sweep min size [36]: 1450
Sweep max size [18024]: 1550
Sweep interval [1]: 
Type escape sequence to abort.
Sending 505, [1450..1550]-byte ICMP Echos to 195.224.237.76, timeout is 2 second
s:
012345678901234567890123456789012345678901234567890 [added - amb]
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...........................
.......
Success rate is 55 percent (43/77), round-trip min/avg/max = 12/13/16 ms
amb#

[Note failure for packets > 1492 bytes]

Ping to a failing host (prism2) from router, fragmentation
IS allowed

amb#ping
Protocol [ip]: 
Target IP address: 195.224.237.76
Repeat count [5]: 
Datagram size [100]: 1450
Timeout in seconds [2]: 
Extended commands [n]: y
Source address or interface: 
Type of service [0]: 
Set DF bit in IP header? [no]: 
Validate reply data? [no]: yes
Data pattern [0xABCD]: 
Loose, Strict, Record, Timestamp, Verbose[none]: 
Sweep range of sizes [n]: y
Sweep min size [36]: 1450
Sweep max size [18024]: 1550
Sweep interval [1]: 
Type escape sequence to abort.
Sending 505, [1450..1550]-byte ICMP Echos to 195.224.237.76, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...........................
.........
Success rate is 54 percent (43/79), round-trip min/avg/max = 12/12/16 ms
amb#

Ping to a failing host, fragmentation allowed, source host (router)
still configured to normal MTU, failing host (prism) configured
down from MTU 1500 to MTU 1492

amb#ping          
Protocol [ip]: 
Target IP address: 195.224.237.76
Repeat count [5]:               
Datagram size [100]: 1450
Timeout in seconds [2]: 
Extended commands [n]: 
Sweep range of sizes [n]: y
Sweep min size [36]: 1450
Sweep max size [18024]: 1550
Sweep interval [1]: 
Type escape sequence to abort.
Sending 505, [1450..1550]-byte ICMP Echos to 195.224.237.76, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!
Success rate is 100 percent (505/505), round-trip min/avg/max = 8/14/20 ms
amb#

This rather suggests that the prism card is incapable of sending
large packets.