IEEE 802.11: fix Block Ack ADDBA transaction and agreement lifecycle - #1148
Open
mgonzalezlopezudc wants to merge 25 commits into
Open
Conversation
Mode-set timing previously depended on the entry that happened to sort first by bitrate. This made SIFS, slot time, receive-start delay, and PHY-specific TXOP defaults sensitive to mode ordering instead of an explicit authority. Store and validate a reference mode and operating PHY for every mode set, and make timing and TXOP consumers use those properties directly. Correct the HT and VHT receive-start delay to the standards-defined 24 microseconds at the same boundary so response timeout calculations use the right value. The focused mode-set, response-timeout, and TXOP tests cover reordered modes, invalid references, PHY-family defaults, and ACK/CTS/Block Ack timing.
Management frame decoding and Supported Rates construction did not preserve all of the information needed to describe the BSS legacy operational rates. Derived frame types, basic-rate membership, and rates beyond the primary element could be lost or inferred from mode ordering. Preserve the concrete management frame subtype during deserialization, validate Supported and Extended Supported Rates element lengths and values, and encode the basic-rate bit from an explicit legacy operational set. Derive that set from eligible mode entries and reject mode sets that cannot advertise any representable legacy operational rate. The Supported Rates and mode-set tests cover malformed encodings, primary and extended element splitting, basic membership, legacy timing, and empty-set rejection.
HT capability and operation information needs a typed, shared representation before management signalling and peer negotiation can use it consistently. Inferring dense MCS support or carrying partially modeled elements would make the advertised state diverge from the configured PHY modes. Add typed HT capability and operation values, derive exact MCS, channel-width, mandatory-rate, and short-guard-interval sets from the mode set, and keep the local advertised state in the IEEE 802.11 MIB. Add the corresponding fixed-size management elements, serializers, conversion helpers, and sparse protocol printer output. Focused tests verify capability derivation, sparse MCS sets, width and guard interval handling, byte-level codecs, validation, and diagnostic rendering.
The AP needs transaction identity to follow every locally transmitted fragment until the MAC reports terminal completion. That identity is sender-local control state, however, and must not become observable as received packet metadata at the peer. Introduce a typed management transaction tag, preserve it with the correct packet and region semantics during fragmentation, and remove it at the layered PHY receive boundary. This keeps completion correlation intact locally without leaking implementation metadata across the simulated wireless link. The focused tag and packet-domain tests exercise fragmentation preservation and confirm that the receiver retains protocol metadata but not the local tag.
Association state could be finalized without a reliable terminal result for the corresponding response. Queue eviction, retry exhaustion, RTS failure, or replacement could therefore leak an AID, commit stale HT/channel state, or emit an association notification for a response that was never acknowledged. Reserve AIDs while responses are pending and commit or release the exact transaction snapshot only after the MAC reports success or failure. Propagate synchronous completion through queue-drop callbacks, DCF/HCF retry paths, and the MAC-management bridge. Bind channel and HT Operation state to the pending response, correct marked AID wire encoding, and make authentication and peer replacement use the same ownership rules. Focused unit, module, and queueing tests cover ACK success, DCF/HCF failures, RTS timeout, queue drops, unavailable channels, reassociation snapshots, AID reuse, and exactly-once terminal notification.
Association and reassociation primitives could lose their derived type during dispatch, while detailed STA management lacked one explicit owner for pending targets, request subtypes, timers, and late responses. This made terminal confirmation and teardown behavior depend on incomplete transaction context. Preserve the concrete primitive type and model association and reassociation as correlated transactions. Track the pending AP and subtype, select the matching confirmation, reject stale or mismatched responses, and clear timers and pending state on every success, failure, timeout, restart, and teardown path. The focused primitive-dispatch test covers subtype preservation, correlation, confirmation selection, late responses, timeout, failure, and restart safety.
Stations could not consistently recover HT state from serialized discovery frames or distinguish a genuinely legacy AP from malformed or incompatible HT signalling. Installing peer state from local or incomplete information would make association results and later rate selection unreliable. Advertise typed HT capabilities and HT Operation state in discovery and association exchanges, recover the primary channel from the received wire elements, and classify absent, valid, and invalid HT responses explicitly. Build compatible requests and install negotiated peer state only when the correlated association or reassociation transaction succeeds. Focused unit and module tests cover serialized discovery, legacy fallback, invalid HT classification, ordinary and forced-RTS association, and negotiated peer-state visibility at completion.
Rate selection did not have an authoritative way to restrict individually addressed transmissions to modes supported by both the local mode set and the negotiated peer state. A nominally fast mode could therefore violate the peer's MCS, channel-width, HT Operation, or short-GI constraints. Add a deterministic peer-mode selector that intersects the exact negotiated MCS and bandwidth state with local mode membership and guard-interval support. Wire the MIB into DCF and HCF rate selection, and fall back to the mode set's fastest mandatory legacy operational mode when HT is unavailable or invalid. Focused tests cover sparse MCS sets, 20/40 MHz operation, short GI, local-mode membership, deterministic tie breaking, malformed state, and legacy fallback.
Stop, crash, restart, destruction, disassociation, and deauthentication did not share one cleanup policy. Scan timers, pending transactions, or negotiated peer state could survive a lifecycle transition, and a frame from a pending or unrelated peer could affect the current association. Centralize detailed STA timer, transaction, association, and peer-state cleanup and distinguish current and pending peers using the transmitter identity. Apply matching initialization and lifecycle ownership to simplified STA management, including AP-side peer cleanup, while retaining its reduced state machine. Focused module tests cover initialization, restart, stop, crash, destruction, scan cancellation, same- and different-peer teardown, and discovery interaction.
Disassociation commands for any noncurrent address unconditionally cleared the station's pending association timer. An agent request for an unrelated peer could therefore abort an association or reassociation to a different AP, leaving the eventual target response to be rejected as late. Correlate cancellation with the AP stored in the pending timer context while retaining the existing current-AP teardown and Disassociation frame transmission paths. Extend the focused station-management module test to cover unrelated and matching targets for both association and reassociation, successful continuation, cancellation, transmitted destinations, and late-response rejection.
Update the 37 fingerprint baselines produced by the IEEE 802.11 behavior changes on this branch: 17 example rows, 16 showcase rows, and 4 tutorial rows. Thirty detailed-infrastructure scenarios change because legacy g(mixed) management frames now encode the complete operational rate set correctly. Mandatory rates are marked basic, 24 Mbps is no longer omitted, and optional rates beyond the first eight are carried in Extended Supported Rates. The resulting Beacon, Probe, and Association frame bodies and lengths change the event and packet trajectory. The new association transaction lifecycle can also change later events by exposing AP/STA state only after a successfully acknowledged response. These legacy configurations do not emit the newly modeled HT management elements. Five ad-hoc HCF scenarios change because TXOP selection now classifies g(mixed) through its ERP operating PHY instead of its slowest mandatory DSSS mode. This changes the VI limit from 6.016 ms to 3.008 ms and the VO limit from 3.264 ms to 1.504 ms, affecting aggregation, fragmentation grouping, backoff, and subsequent transmission timing. The wireless TXOP showcase changes because peer-aware HT rate selection falls back to the 24 Mbps legacy operational rate when ad-hoc peers have no negotiated HT state. The 802.11ac Ping1 trajectory changes because the VHT PHY receive-start delay is corrected from 33 us to 24 us, moving response timeout scheduling while leaving its network-layer fingerprint unchanged. All 37 new values exactly match the calculated fingerprints from the full debug fingerprint run. A clean debug build of upstream/master at f07d0e7 reproduced the old checked-in hashes for one representative from each causal group, ruling out stale baselines or build contamination. The pre-existing expected 5 Gbps half-duplex Ethernet ERROR remains unchanged.
Reassociation tunes the station radio to the target access point. When a different-target attempt was refused or timed out, the existing association was intentionally retained, but the radio remained on the rejected target's channel and could no longer exchange traffic with the current AP. Restore assocAP.channel from the shared reassociation failure handler whenever the previous association is still active. Preserve the existing same-target disassociation behavior and avoid retuning after the old association has already been cleared. Extend Ieee80211MgmtStaDiscovery_1 to exercise production reassociation refusal and timeout handling. Assert the target-to-current channel transition, retained association, beacon timer and current peer HT state, target-state cleanup, transaction cleanup, and confirmation result codes. Pin the test seed for reproducibility.
Introduce IPacketExtractor so queues, gates, and schedulers can locate and remove a matching packet without bypassing the scheduling policy of the provider that owns it. This preserves priority, WRR, label, gate, and compound-queue semantics when a MAC user selects an exact frame. Replace the drop-only callback with DEQUEUED, REMOVED, and DROPPED reasons, and propagate each logical departure exactly once through leaf queues, shared buffers, and compound boundaries. DCF and HCF can now distinguish ownership transfer from terminal removal. Cover provider-directed extraction, queue and flow accounting, shared buffer ownership, nested callback suppression, reentrant removal, and destructive overflow.
Represent an originator ADDBA exchange as explicit state keyed by peer and TID, with a transaction identity carried by every request fragment. Start the exchange only after the final trigger MPDU fragment is acknowledged, so the advertised starting sequence number is valid. Match responses by dialog token, keep same-TID traffic ineligible while a request is pending, and handle response timeout, retry backoff, DELBA, and terminal cancellation without allowing stale fragments to affect a newer exchange. Keep A-MSDU selection and HCF continuation aligned with that state. Cover trigger acknowledgement, fragmented requests and teardowns, timeout and retry paths, cancellation ownership, queue eligibility, and provider-aware A-MSDU extraction.
Treat an accepted ADDBA request for an existing peer and TID as a replacement agreement. Cancel teardown state belonging to the old agreement, install the negotiated parameters, and reset the receive reordering window before frames are admitted under the new agreement. Replay the cached response for a duplicate request without resetting receive state, and preserve the current agreement when renegotiation is rejected. Emit distinct agreement-added, changed, and deleted events so the HCF lifecycle remains observable. Add recipient lifecycle coverage together with a transactional QoS example and its focused fingerprint entry.
Carry Action-frame-specific context in a local tag while transmitting fragments with a generic management header and a serialized body. Extend the serializer, dissector, fragmentation, and defragmentation paths so the original Action header can be reconstructed after all fragments arrive. Route fragmented management frames through recipient reassembly and call ADDBA or DELBA handlers only with the complete header. This prevents a partial fragment from starting, changing, or tearing down a Block Ack agreement. Cover on-air representation, out-of-order fragments, duplicates, expiration, and both QoS and non-QoS recipient dispatch.
Add an end-to-end management transaction cancellation contract from the AP through Ieee80211Mac to DCF or HCF. A terminal failure removes queued and in-progress sibling fragments across access categories and retires retry, delayed-IFS, and pending-transmission state exactly once. Keep a frame borrowed by the active frame sequence alive until a safe sequence boundary, then abort or release it through the owning component. Clear AP association state before cancellation so reentrant callbacks cannot observe or revive the superseded response. Cover DCF and HCF supersession, queue removal and overflow, delayed IFS, RTS protection, active frame sequences, and successful replacement.
Tag each locally generated DELBA with its agreement role, peer, TID, and generation. Route acknowledgement, retry exhaustion, cancellation, and abort handling back to that exact agreement instance. Track pending teardowns by generation and cancel only the matching transaction. A delayed or retried DELBA from an older agreement can no longer delete a replacement agreement that reused the same peer and TID. Cover originator and recipient teardown, replacement during an in-flight DELBA, retry and abort paths, and stale completion callbacks.
Make originator and recipient agreement handlers report absolute, role-specific inactivity deadlines. Have HCF schedule the earliest one with rescheduleAt() and expire only agreements whose recorded deadline has actually elapsed. Refresh the correct role on QoS data, BAR, and Block Ack activity, and retire the matching generation once when inactivity expires or teardown is aborted. This avoids treating an absolute timestamp as a relative delay and repeatedly rearming an already expired agreement. Cover independent originator and recipient deadlines, activity refresh, simultaneous expiry, stale generations, and terminal cleanup.
Replace the fragment-zero reset heuristic with generation-aware reassembly state. Track extended sequence generations per receive flow, preserve later-only fragments, and sort completed fragments by fragment number instead of arrival order. Quarantine half-space ambiguity, retain tombstones for retired sequences, recover when a raw sequence number is reused after wrap, and reject completion when contradictory terminal fragment numbers were observed. Stale fragments therefore cannot corrupt a newer MSDU. Cover out-of-order delivery, duplicates, ambiguous generations, sequence-number wrap, delayed stale fragments, and contradictory terminal markers.
Record an immutable receive deadline when the first fragment is retained in a Block Ack receive buffer. Return inserted, released, and expired frames explicitly so recipient services, rather than the reorder buffer, own every final drop, signal, and deletion. Drive reordering and scalar reassembly from one receive-lifetime timer. Expired late fragments remain visible to Block Ack bookkeeping but cannot seed a new reassembly context, while peer and TID reset purges every owned fragment without leaking or deleting it twice. Return ownership from IReassembly::purge(), reject negative maxReceiveLifetime values while keeping zero valid, and cover expiry, reset, wrap recovery, fragmented sequences, and timer rescheduling.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Comment on lines
+209
to
+213
| if (hasOtherGeneration) { | ||
| expiredSequenceNumbersMap[contextKey].insert(key.extendedSequenceNumber); | ||
| pruneExpiredSequenceNumbers(sequenceSpaceKey); | ||
| delete packet; | ||
| return nullptr; |
There was a problem hiding this comment.
🔴 BAR delivery crashes on rejected fragments
When addFragment rejects BAR-released fragments as generation-ambiguous, the delivery path stores null and dereferences it. The simulation aborts instead of dropping them.
Prompt for agents
BasicReassembly::addFragment can now reject and delete a fragment when another generation with the same raw sequence number exists, returning nullptr. RecipientQosMacDataService::controlFrameReceived unconditionally appends defragment(fragments) to defragmentedFrames and later dereferences every entry while handling a BAR. Update the BAR release path to treat a null reassembly result as a dropped/incomplete frame, mirroring dataFrameReceived, and preserve packet ownership and drop signaling correctly. Add coverage where BAR releases a complete reorder-buffer entry while BasicReassembly has conflicting generation state.
Was this helpful? React with 👍 or 👎 to provide feedback.
An inactivity-expired Block Ack agreement must remain installed until its generation-matched DELBA teardown completes. Previously, data-plane users treated that retained object as active, so they could continue selecting Block Ack, sending BARs, buffering frames, and producing Block Ack responses after expiry. Separate raw lifecycle lookup from active agreement lookup and use the active form throughout originator and recipient data paths. Fall back to Normal Ack, suppress BAR and Block Ack processing, discard Block-Ack-policy data without mutating reorder state, and ignore late responses once an agreement is unavailable. Release matching originator acknowledgement state for retry when an agreement expires or is removed. Also cover the race where a frame finishes transmission after expiry, while preserving the retained agreement object for generation-safe DELBA handling. Extend the ADDBA transaction tests with active-versus-expired policy, selection, teardown, reordering, late-frame, and transmission-completion cases. Remove the trailing blank line from the QoS example configuration. Validation completed in debug mode with the full build, the focused ADDBA unit test, the Block Ack inactivity-timer module test, and git diff --check.
Ignore null defragmentation results when a BAR releases buffered fragments. This prevents half-sequence-space reassembly rejections from reaching A-MSDU deaggregation and crashing the recipient data path. Resolve the recipient Block Ack timeout according to the policy contract: inherit the originator request when the recipient policy is zero, otherwise use the configured recipient override. The negotiated response value continues to drive agreement state and inactivity deadlines. Add focused production-path coverage for the exact 2048 sequence boundary, subsequent reorder progress, timeout inheritance and override, the zero/no-timeout case, expiration timing, and cached ADDBA responses.
Keep A-MSDUs intact in BasicFragmentationPolicy even when their MPDU length exceeds the configured fragmentation threshold. The basic policy does not implement the capability-gated HE dynamic fragmentation procedure, so splitting these aggregates would produce an invalid fragment sequence. Track the exact serialized A-MSDU body length in BasicMsduAggregationPolicy. Account for the 4-octet alignment padding added after each subframe that becomes non-final, leave the final subframe unpadded, accept an aggregate exactly at the configured maximum, and preserve -1 as the unlimited setting. Add focused regression coverage for oversized A-MSDUs versus ordinary QoS frames, one-, two-, and three-octet padding boundaries, exact-limit acceptance, final-subframe layout, and the unlimited size configuration.
…ansaction rework Update expected fingerprints for the 15 wireless test configurations affected by the ADDBA transaction and Block Ack rework introduced on top of a1fb671 ("queueing: add selective packet extraction"): 4e1463d ieee80211: make originator ADDBA transactions explicit cf4c79d ieee80211: reset recipient Block Ack state on renegotiation f34c6f0 ieee80211: reassemble fragmented action frames before dispatch 349a840 ieee80211: cancel superseded management transactions bb43e15 ieee80211: protect Block Ack teardown generations 089666f ieee80211: schedule Block Ack inactivity with absolute deadlines 644e5c6 ieee80211: make fragment reassembly generation-safe 3bf503f ieee80211: enforce receive lifetime during Block Ack reordering 68de8ad ieee80211: quarantine expired Block Ack agreements 15360fe ieee80211: fix recipient BAR and ADDBA timeout handling 2bccb95 ieee80211: enforce valid A-MSDU fragmentation and sizing These commits rewrite the HCF/EDCA QoS data path end to end (Hcf.cc, Dcf.cc, OriginatorQosMacDataService, QosAckHandler, OriginatorQosAckPolicy, RecipientQosMacDataService, InProgressFrames, BasicFragmentationPolicy/BasicReassembly/Fragmentation, and the FrameSequenceHandler/HcfFs/TxOpFs frame sequences), so any configuration that exercises Block Ack, A-MPDU/A-MSDU aggregation, fragmentation, or TXOP necessarily produces a different wireless event trace and thus a different fingerprint: - examples/adhoc/qos MacQos (-r 0, -r 1), examples/wireless/qos MacQos/MacQosWithRtsCts/MacQosWithBlockAck/MacQosWithTransactionalBlockAck: exercise Hcf.cc end to end, including the new explicit ADDBA transactions and BAR/ADDBA timeout handling. - showcases/wireless/blockack NoFragmentation/Fragmentation/MixedTraffic: driven by ADDBA transaction, Block Ack agreement quarantine/teardown-generation protection, and the switch from relative to absolute Block Ack inactivity deadlines. - showcases/wireless/aggregation Aggregation/VoicePriorityAggregation: driven by OriginatorQosMacDataService/QosAckHandler/InProgressFrames and the new A-MSDU fragmentation and sizing enforcement. - showcases/wireless/fragmentation HCFfrag/HCFfragblockack: driven by the generation-safe fragment reassembly and A-MSDU sizing changes in BasicFragmentationPolicy/BasicReassembly/Defragmentation/Fragmentation. - showcases/wireless/qos Qos and showcases/wireless/txop General: driven by the same Hcf.cc/FrameSequenceHandler/TxOpFs rewrite. No plain DCF-only, non-QoS, or wired-only fingerprint changed, which is consistent with only the QoS/HCF-specific code paths being modified. New fingerprints were generated by running the failing fingerprint tests and copying examples.csv.UPDATED/showcases.csv.UPDATED over the tracked CSVs; the .FAILED/.UPDATED scratch files have been removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the Block Ack agreement lifecycle by making ADDBA transactions, teardown, inactivity, reordering, and reassembly generation-safe.
Important
Depends on #1144 — merge that PR first, then rebase this one onto
master.Summary
This series closes the main correctness gaps in the IEEE 802.11 Block Ack exchange and its supporting queueing infrastructure.
Selective packet extraction (
queueing)Introduce
IPacketExtractorso queues, gates, and schedulers can locate and remove a specific packet without bypassing the scheduling policy that owns it. Replace the drop-only callback withDEQUEUED,REMOVED, andDROPPEDreasons, and propagate each logical departure exactly once through leaf queues, shared buffers, and compound boundaries.Explicit originator ADDBA transactions
Represent an originator ADDBA exchange as explicit state keyed by peer and TID, with a transaction identity carried by every request fragment. Start the exchange only after the final trigger MPDU fragment is acknowledged, so the advertised starting sequence number is valid. Match responses by dialog token, keep same-TID traffic ineligible while a request is pending, and handle response timeout, retry backoff, DELBA, and terminal cancellation without allowing stale fragments to affect a newer exchange.
Recipient renegotiation and reset
Treat an accepted ADDBA request for an existing peer and TID as a replacement agreement. Cancel teardown state belonging to the old agreement, install the negotiated parameters, and reset the receive reordering window before frames are admitted under the new agreement.
Fragmented action frame reassembly
Carry action-frame-specific context in a local tag while transmitting fragments with a generic management header. Route fragmented management frames through recipient reassembly and call ADDBA or DELBA handlers only with the complete header. This prevents a partial fragment from starting, changing, or tearing down an agreement.
Management transaction cancellation
Add an end-to-end cancellation contract from the AP through
Ieee80211Macto DCF or HCF. A terminal failure removes queued and in-progress sibling fragments and retires retry, delayed-IFS, and pending-transmission state exactly once.Generation-safe teardown
Tag each locally generated DELBA with its agreement role, peer, TID, and generation. Route acknowledgement, retry exhaustion, cancellation, and abort handling back to that exact agreement instance. A delayed or retried DELBA from an older agreement can no longer delete a replacement agreement that reused the same peer and TID.
Absolute inactivity deadlines
Make originator and recipient agreement handlers report absolute, role-specific inactivity deadlines. Refresh the correct role on QoS data, BAR, and Block Ack activity, and retire the matching generation once when inactivity expires or teardown is aborted.
Generation-aware reassembly
Replace the fragment-zero reset heuristic with generation-aware reassembly state per receive flow. Preserve later-only fragments, sort completed fragments by fragment number, and reject completion when contradictory terminal markers were observed.
Receive lifetime enforcement
Record an immutable receive deadline when the first fragment is retained in a Block Ack receive buffer. Drive reordering and scalar reassembly from one receive-lifetime timer. Expired late fragments remain visible to Block Ack bookkeeping but cannot seed a new reassembly context.
Testing
Ieee80211AddbaTransaction_1) covering trigger acknowledgement, fragmented requests and teardowns, timeout and retry paths, cancellation ownership, queue eligibility, inactivity scheduling, recipient reset, receive lifetime, and generation safety.