ieee80211: make ADDBA transactions explicit and reliable - #1147
Closed
mgonzalezlopezudc wants to merge 32 commits into
Closed
ieee80211: make ADDBA transactions explicit and reliable#1147mgonzalezlopezudc wants to merge 32 commits into
mgonzalezlopezudc wants to merge 32 commits into
Conversation
Mode-set timing previously depended on the entry that happened to sort first by bitrate. This made SIFS, slot time, receive-start delay, and PHY-specific TXOP defaults sensitive to mode ordering instead of an explicit authority. Store and validate a reference mode and operating PHY for every mode set, and make timing and TXOP consumers use those properties directly. Correct the HT and VHT receive-start delay to the standards-defined 24 microseconds at the same boundary so response timeout calculations use the right value. The focused mode-set, response-timeout, and TXOP tests cover reordered modes, invalid references, PHY-family defaults, and ACK/CTS/Block Ack timing.
Management frame decoding and Supported Rates construction did not preserve all of the information needed to describe the BSS legacy operational rates. Derived frame types, basic-rate membership, and rates beyond the primary element could be lost or inferred from mode ordering. Preserve the concrete management frame subtype during deserialization, validate Supported and Extended Supported Rates element lengths and values, and encode the basic-rate bit from an explicit legacy operational set. Derive that set from eligible mode entries and reject mode sets that cannot advertise any representable legacy operational rate. The Supported Rates and mode-set tests cover malformed encodings, primary and extended element splitting, basic membership, legacy timing, and empty-set rejection.
HT capability and operation information needs a typed, shared representation before management signalling and peer negotiation can use it consistently. Inferring dense MCS support or carrying partially modeled elements would make the advertised state diverge from the configured PHY modes. Add typed HT capability and operation values, derive exact MCS, channel-width, mandatory-rate, and short-guard-interval sets from the mode set, and keep the local advertised state in the IEEE 802.11 MIB. Add the corresponding fixed-size management elements, serializers, conversion helpers, and sparse protocol printer output. Focused tests verify capability derivation, sparse MCS sets, width and guard interval handling, byte-level codecs, validation, and diagnostic rendering.
The AP needs transaction identity to follow every locally transmitted fragment until the MAC reports terminal completion. That identity is sender-local control state, however, and must not become observable as received packet metadata at the peer. Introduce a typed management transaction tag, preserve it with the correct packet and region semantics during fragmentation, and remove it at the layered PHY receive boundary. This keeps completion correlation intact locally without leaking implementation metadata across the simulated wireless link. The focused tag and packet-domain tests exercise fragmentation preservation and confirm that the receiver retains protocol metadata but not the local tag.
Association state could be finalized without a reliable terminal result for the corresponding response. Queue eviction, retry exhaustion, RTS failure, or replacement could therefore leak an AID, commit stale HT/channel state, or emit an association notification for a response that was never acknowledged. Reserve AIDs while responses are pending and commit or release the exact transaction snapshot only after the MAC reports success or failure. Propagate synchronous completion through queue-drop callbacks, DCF/HCF retry paths, and the MAC-management bridge. Bind channel and HT Operation state to the pending response, correct marked AID wire encoding, and make authentication and peer replacement use the same ownership rules. Focused unit, module, and queueing tests cover ACK success, DCF/HCF failures, RTS timeout, queue drops, unavailable channels, reassociation snapshots, AID reuse, and exactly-once terminal notification.
Association and reassociation primitives could lose their derived type during dispatch, while detailed STA management lacked one explicit owner for pending targets, request subtypes, timers, and late responses. This made terminal confirmation and teardown behavior depend on incomplete transaction context. Preserve the concrete primitive type and model association and reassociation as correlated transactions. Track the pending AP and subtype, select the matching confirmation, reject stale or mismatched responses, and clear timers and pending state on every success, failure, timeout, restart, and teardown path. The focused primitive-dispatch test covers subtype preservation, correlation, confirmation selection, late responses, timeout, failure, and restart safety.
Stations could not consistently recover HT state from serialized discovery frames or distinguish a genuinely legacy AP from malformed or incompatible HT signalling. Installing peer state from local or incomplete information would make association results and later rate selection unreliable. Advertise typed HT capabilities and HT Operation state in discovery and association exchanges, recover the primary channel from the received wire elements, and classify absent, valid, and invalid HT responses explicitly. Build compatible requests and install negotiated peer state only when the correlated association or reassociation transaction succeeds. Focused unit and module tests cover serialized discovery, legacy fallback, invalid HT classification, ordinary and forced-RTS association, and negotiated peer-state visibility at completion.
Rate selection did not have an authoritative way to restrict individually addressed transmissions to modes supported by both the local mode set and the negotiated peer state. A nominally fast mode could therefore violate the peer's MCS, channel-width, HT Operation, or short-GI constraints. Add a deterministic peer-mode selector that intersects the exact negotiated MCS and bandwidth state with local mode membership and guard-interval support. Wire the MIB into DCF and HCF rate selection, and fall back to the mode set's fastest mandatory legacy operational mode when HT is unavailable or invalid. Focused tests cover sparse MCS sets, 20/40 MHz operation, short GI, local-mode membership, deterministic tie breaking, malformed state, and legacy fallback.
Stop, crash, restart, destruction, disassociation, and deauthentication did not share one cleanup policy. Scan timers, pending transactions, or negotiated peer state could survive a lifecycle transition, and a frame from a pending or unrelated peer could affect the current association. Centralize detailed STA timer, transaction, association, and peer-state cleanup and distinguish current and pending peers using the transmitter identity. Apply matching initialization and lifecycle ownership to simplified STA management, including AP-side peer cleanup, while retaining its reduced state machine. Focused module tests cover initialization, restart, stop, crash, destruction, scan cancellation, same- and different-peer teardown, and discovery interaction.
Disassociation commands for any noncurrent address unconditionally cleared the station's pending association timer. An agent request for an unrelated peer could therefore abort an association or reassociation to a different AP, leaving the eventual target response to be rejected as late. Correlate cancellation with the AP stored in the pending timer context while retaining the existing current-AP teardown and Disassociation frame transmission paths. Extend the focused station-management module test to cover unrelated and matching targets for both association and reassociation, successful continuation, cancellation, transmitted destinations, and late-response rejection.
Update the 37 fingerprint baselines produced by the IEEE 802.11 behavior changes on this branch: 17 example rows, 16 showcase rows, and 4 tutorial rows. Thirty detailed-infrastructure scenarios change because legacy g(mixed) management frames now encode the complete operational rate set correctly. Mandatory rates are marked basic, 24 Mbps is no longer omitted, and optional rates beyond the first eight are carried in Extended Supported Rates. The resulting Beacon, Probe, and Association frame bodies and lengths change the event and packet trajectory. The new association transaction lifecycle can also change later events by exposing AP/STA state only after a successfully acknowledged response. These legacy configurations do not emit the newly modeled HT management elements. Five ad-hoc HCF scenarios change because TXOP selection now classifies g(mixed) through its ERP operating PHY instead of its slowest mandatory DSSS mode. This changes the VI limit from 6.016 ms to 3.008 ms and the VO limit from 3.264 ms to 1.504 ms, affecting aggregation, fragmentation grouping, backoff, and subsequent transmission timing. The wireless TXOP showcase changes because peer-aware HT rate selection falls back to the 24 Mbps legacy operational rate when ad-hoc peers have no negotiated HT state. The 802.11ac Ping1 trajectory changes because the VHT PHY receive-start delay is corrected from 33 us to 24 us, moving response timeout scheduling while leaving its network-layer fingerprint unchanged. All 37 new values exactly match the calculated fingerprints from the full debug fingerprint run. A clean debug build of upstream/master at f07d0e7 reproduced the old checked-in hashes for one representative from each causal group, ruling out stale baselines or build contamination. The pre-existing expected 5 Gbps half-duplex Ethernet ERROR remains unchanged.
Reassociation tunes the station radio to the target access point. When a different-target attempt was refused or timed out, the existing association was intentionally retained, but the radio remained on the rejected target's channel and could no longer exchange traffic with the current AP. Restore assocAP.channel from the shared reassociation failure handler whenever the previous association is still active. Preserve the existing same-target disassociation behavior and avoid retuning after the old association has already been cleared. Extend Ieee80211MgmtStaDiscovery_1 to exercise production reassociation refusal and timeout handling. Assert the target-to-current channel transition, retained association, beacon timer and current peer HT state, target-state cleanup, transaction cleanup, and confirmation result codes. Pin the test seed for reproducibility.
Introduce predicate-based extraction and typed packet-removal callbacks across leaf, flow, gate, scheduler, buffer, and compound queues. Preserve provider scheduling policy and exact ownership accounting while propagating destructive drops once. Migrate HCF and DCF to the callback contract without changing their management-frame drop behavior. Tests: debug build; Ieee80211MgmtApHcfQueueDrop_1.test; PacketQueueDropCallback_1.test.
Track setup and teardown frames by transaction identity, gate pending-frame eligibility while a response is outstanding, and make HCF retry, cancellation, aggregation, and continuation paths use the same originator lifecycle. Debug build and Ieee80211MgmtApHcfQueueDrop_1.test pass. Focused transaction coverage lands after the recipient half of the protocol is introduced.
Treat duplicate requests separately from replacement negotiations, reset reorder state when agreements are replaced or torn down, and emit distinct add, change, and delete lifecycle signals. The intermediate tree builds in debug mode. Focused recipient transaction coverage lands in the following test commit; no narrower existing test exercises these new contracts.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| } | ||
| else | ||
| blockAckAgreements[id] = agreement; | ||
| scheduleInactivityTimer(agreementHandlerCallback); |
There was a problem hiding this comment.
🔴 Block Ack agreements never expire
After time zero, processReceivedAddbaRequest schedules an absolute expiry as a delay. The late callback misses its equality check, leaving agreements active indefinitely.
Prompt for agents
The Block Ack handlers compute absolute expiration timestamps, but Hcf::scheduleInactivityTimer uses rescheduleAfter and therefore interprets them as relative durations. An agreement created at time t with expiration t+d schedules the event for 2t+d. Both expiration handlers only process agreements whose expiration equals simTime(), so the late event misses them and subsequent scheduling remains late. Define the callback contract consistently as an absolute deadline and use absolute scheduling in Hcf, while ensuring removal of the last timed agreement cancels any stale inactivity event. Review both originator and recipient handler callers because they share this callback and timer.
Was this helpful? React with 👍 or 👎 to provide feedback.
Cancel every pending and in-progress management response fragment that shares the terminally failed transaction ID in DCF and HCF. Preserve the callback-owned current frame, clear sibling ACK and retry state, cover every HCF access category, and suppress recursive or bulk-removal callbacks exactly once per simulator event. Treat both DROPPED and explicit REMOVED queue departures as terminal for tagged management responses while keeping DEQUEUED as a normal handoff into transmission processing. This releases AP association state and AID reservations after single and bulk removals. Replace expired BasicReassembly map tombstones with compact 4096-bit sequence identity maps per MAC reassembly context. Preserve late-fragment rejection and non-Retry fragment-zero reuse, and clear retained identities at the explicit purge lifecycle boundary. Extend focused unit and module coverage for association and reassociation retry exhaustion through the real DCF/HCF failure paths, cross-queue sibling cancellation, ownership and transaction isolation, compound HCF removal, AP state cleanup, and multi-context reassembly expiry.
Treat a non-Retry fragment zero as the start of a new MMPDU generation when an incomplete entry already occupies the same reassembly key. Dispose of the old owned fragments before processing the replacement while preserving Retry duplicates, expired-sequence handling, and the unfragmented fast path. Normalize complete Block Ack fragment vectors into stable Fragment Number order before passing them to scalar reassembly. This prevents arrival-ordered batches such as 1,2,3,0 from being mistaken for sequence-number reuse without changing packet ownership. Extend the focused ADDBA transaction test with direct sequence-wrap replacement, Retry preservation, exact-pointer unfragmented replacement, and immediate and BAR-triggered out-of-order Block Ack cases. Verify exact reconstructed payloads, single completion, and cleanup of active state.
An inactivity-expiry DELBA may remain queued after its Block Ack agreement has been replaced. Previously these internal teardowns had no agreement identity, so transmitting a stale DELBA could remove the replacement agreement for the same peer and TID. Attach a sender-local generation tag to internally generated DELBAs in both the originator and recipient paths. Track recipient agreement generations, keep teardown generations pending across transmission retries, and retire them only after acknowledgment or terminal abort. Preserve compatibility for untagged, explicitly initiated teardowns. Route DELBA lifecycle handling in HCF according to the initiator field and cancel queued or in-progress teardown fragments only when the full initiator, peer, TID, and generation tuple matches. Keep outbound retries intact when an incoming DELBA is rejected, while accepted teardowns cancel obsolete work exactly once. Document the recipient handler API and lifecycle changes in WHATSNEW. Extend Ieee80211AddbaTransaction_1 with originator and recipient expiry, fragmentation, stale replacement, retry, acknowledgment, abort, cancellation, and policy-rejection coverage.
Association response fragments remain owned by the MAC after AP bookkeeping is cleared. Authentication restarts, deauthentication, disassociation, or shutdown could therefore leave a superseded response queued or in progress and allow it to transmit later. Add a typed management transaction cancellation contract between management and the MAC. Clear AP transaction and AID state before entering the MAC, then remove every queued or in-progress frame carrying the superseded transaction ID in both DCF and HCF. Retain active sequence-borrowed frames until an ownership-safe boundary. Cancel Tx copies that are still waiting for IFS before lower-layer handoff, while allowing already handed-down copies to finish without retries, terminal callbacks, or follow-on fragments. Add focused unit and module coverage for direct and RTS-protected frames, DCF and HCF RTS/CTS exchanges, delayed-IFS cancellation, lower-layer handoff suppression, lifecycle supersession, and successful replacement association completion.
BasicReassembly treated every non-Retry fragment 0 as the start of a new sequence-number generation. When a later fragment arrived first, this deleted the buffered data and left the frame permanently incomplete. Preserve same-key state that contains only later fragments when a fragmented frame zero arrives. Continue replacing an active generation when fragment zero is already present, or when the incoming frame is unfragmented, so the existing sequence-reuse heuristic remains intact. Update the fragmented ADDBA receive-path test and add direct BasicReassembly coverage to verify final-fragment-first reception completes with the expected header and payload without retransmission.
BasicReassembly has no receiver-visible generation identifier beyond the modulo-4096 sequence identity. When a fragmented fragment 0 collides with active same-key state, merging or immediately replacing that state can combine fragments from different sequence generations and return a hybrid frame. Fail closed by deleting the buffered and incoming fragments, quarantining the identity until its original receive deadline, and rejecting further fragmented arrivals without extending that deadline. Keep unfragmented non-Retry replacement safe because it is returned without assembly, and retain the existing expiry tombstone path for later recovery. Extend the focused ADDBA unit test with non-Retry and Retry sequence-reuse collisions using different payloads and fragment counts. Verify that no hybrid completes, quarantine expiry is fixed, late fragments are rejected, and a fresh generation reassembles to the exact expected payload.
Preserve valid out-of-order reassembly by allowing a later or final fragment and fragment 0 to join when they resolve to the same receiver-observed sequence generation. Extend each transmitter sequence-number space beyond the 12-bit wire value using the IEEE 802.11 cyclic half-space ordering. Keep baseline and individually addressed QoS sequence spaces separate, reject the exact half-space ambiguity, and retain generation-scoped expiry tombstones. When a reused raw sequence resolves to a different observed generation while matching active or expired state still exists, quarantine the entire new generation, including fragment 0. This prevents either a delayed old fragment or the real new fragment from seeding a hybrid frame. An entirely unobserved wrap remains indistinguishable and is documented as the limit of the receiver-visible metadata. Update focused reassembly coverage for final-fragment-first completion, the half-space boundary, observed wrap and stale-fragment-0 ordering, expiry, purge recovery, and exact reconstructed contents.
maxReceiveLifetime was previously enforced only after BlockAckReordering released packets to BasicReassembly. An incomplete fragmented MPDU could therefore remain in ReceiveBuffer indefinitely and continue consuming reorder-buffer capacity. Track the original reception time for each buffered sequence and keep the deadline stable as later fragments arrive. Expire only incomplete fragmented entries, decrement buffer occupancy, and leave NextExpectedSequenceNumber and the independent Block Ack scoreboard unchanged. Keep a tombstone for expired fragmented sequences so late fragments are acknowledged according to their Block Ack policy but cannot seed a hybrid reassembly. Return rejected packet ownership to RecipientQosMacDataService so every discarded packet emits exactly one OTHER_PACKET_DROP signal before deletion. Use one recipient timer for the earliest BasicReassembly or reorder-buffer deadline. Centralize the completion predicate so only contiguous fragments with exactly one terminal marker complete; contradictory terminal markers remain incomplete and expire instead of becoming timerless state. Extend the focused Addba transaction test with original-deadline, capacity-accounting, wrap/tombstone, late-drop, staggered-timer, contradictory-terminal, and valid final-fragment-first coverage.
Block Ack agreements store their expiration time as an absolute simulation timestamp, but Hcf passed that timestamp to rescheduleAfter(). Agreements created after time zero therefore fired late, failed the exact-time expiry check, and could be rescheduled forever. Make the callback contract explicitly role-aware and absolute. Hcf now keeps independent originator and recipient deadlines, schedules the shared timer at their minimum with rescheduleAt(), clamps overdue work to the current time, and cancels the timer only after both roles report no finite deadline. Expire every agreement whose deadline is at or before the current time and mark it pending teardown so repeated timer callbacks or late BlockAck, BAR, and QoS activity cannot rearm it. Reset recipient deadlines on qualifying QoS MPDUs and Basic BARs as required. If a fragmented timeout DELBA is aborted before completion, retire only its matching agreement generation and return ownership to Hcf so deletion signaling and recipient reorder cleanup still occur exactly once. Add focused unit coverage for absolute and overdue deadlines, one-shot expiry, activity resets, stale generations, aborted fragmented teardown, and cleanup. Add a module test for real Hcf shared-min scheduling, independent role clearing, and final timer cancellation.
Negative maxReceiveLifetime values produce absolute reassembly and reordering deadlines before the current simulation time. The later scheduleAt() call then fails far from the invalid configuration that caused the problem. Validate the parameter in both QoS and non-QoS recipient services before constructing BasicReassembly or BlockAckReordering. Keep zero valid, and document the nonnegative relative-duration contract in both NED declarations. Extend the focused IEEE 802.11 AddBA unit test to verify that both recipient services reject a negative lifetime while accepting the zero boundary.
Fragment-generation tombstones protected reassembly from mixing delayed and current fragments, but they could permanently reject a legitimate fragmented frame after repeated modulo-4096 sequence-number wraparound. Production Block Ack lifecycle resets also reset the reorder buffer without clearing matching reassembly state. Allow a later observed generation to retire older same-raw tombstones only when it starts with a non-Retry fragment 0 and no conflicting active generation remains. Keep the incoming generation tombstone intact so an ambiguous generation cannot clear its own quarantine. Return detached packets from IReassembly::purge(), and purge the matching originator/TID when recipient Block Ack state is reset. This lets the recipient data service emit an observable drop and delete every buffered fragment exactly once before rescheduling its receive-lifetime timer. Extend the focused ADDBA transaction test with production purge signaling, peer/TID isolation, Retry handling, long-running wrap recovery, exact-payload reconstruction, and purge ownership coverage.
BasicReassembly previously allowed each terminal fragment marker to redefine the expected fragment mask. As a result, two different terminal fragment numbers could complete or remain incomplete depending on their arrival order. Record the first observed terminal fragment number and permanently mark the reassembly entry when a different terminal number is seen. Keep the completion mask tied to a terminal fragment that was actually retained, so a discarded duplicate cannot authorize a truncated reassembly. Contradictory entries remain owned until the existing receive-lifetime expiry or purge path disposes of them. Add focused unit coverage for both terminal-marker orders, duplicate terminal markers on occupied slots, deadline preservation, blocked completion, and expiry ownership.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency
Depends on #1144 and should be reviewed and merged after it.
This branch is stacked on commit
81182d8a09fromcleanup/ht-cap-op-signalling. The ADDBA-specific change consists of the eight commits following that dependency.Motivation
Block Ack setup and teardown did not have a single transaction identity connecting control-frame creation, queue ownership, transmission attempts, responses, retries, fragmentation, and terminal completion.
This could allow stale ADDBA responses or queued DELBA frames to affect a newer peer/TID agreement, leave data ineligible after a control-frame failure, or retain recipient reorder state after renegotiation. Fragmented action frames also need to be processed only after complete reassembly while retaining the context required by the MAC.
Changes
Ieee80211AddbaTransactionTagto correlate ADDBA Request and DELBA packets with their originator transactions.Configuration and API changes
addbaResponseTimeoutandaddbaRetryBackofftoOriginatorBlockAckAgreementPolicy.dot11MaxReceiveLifetimedefault to recipient MAC data services.blockAckAgreementChangedHCF signal and statistic.IPacketQueuewith predicate extraction and lifecycle callbacks.IPacketExtractorfor providers supporting selective extraction.These queueing and Block Ack interface changes are documented in
WHATSNEW.Test coverage
The branch adds or updates focused coverage for:
MacQosWithTransactionalBlockAckexample configuration.Primary focused tests include:
tests/unit/Ieee80211AddbaTransaction_1.testtests/module/Ieee80211MgmtApHcfQueueDrop_1.testtests/queueing/PacketQueueDropCallback_1.testMacQosWithTransactionalBlockAckfingerprint scenario