IEEE 802.11: admit Basic and Normal Ack DATA before queue extraction

[mgonzalezlopezudc]

HCF can exceed a TXOP after it consumes queued QoS DATA. Basic and Normal Ack outside an agreement can reach RTS or DATA without a complete exchange check. A short TXOP tail can therefore transmit a frame whose response completes after the deadline.

This PR checks the complete exchange before source extraction for transmission. The scope covers individually addressed QoS DATA through HCF. HCF retains one selected DATA mode and can use one ordinary MSDU or legal fragments. A refused continuation leaves the queued sources, sequence state, retry state, and absolute deadlines intact. If no permitted form fits a fresh TXOP, HCF stops with a diagnostic before source consumption.

This draft depends on #1364 at d841dc77db7d0b141bf31e5e215a0de9bb281957. Review the eight new commits after that revision. The upstream comparison also contains the prerequisite series until its merge. The main risks concern fragment ownership, recovery across RTS failure, and external implementations of the changed interfaces. Focused tests cover these paths. The approved fingerprints accompany their causal commits; joint verification with the separate Basic peer-permission activation remains pending.

What the admission check controls

An exchange starts with its first holder frame. Its cost includes DATA, required RTS/CTS, the applicable IFS intervals, and an immediate ACK when the policy requires one. DATA with Block Ack policy has no immediate Block Ack response. BAR and its Block Ack response retain their separate admission check.

flowchart TD
    A["Read the next eligible QoS source<br/>Keep it in the queue"] --> B["Prepare its form<br/>Retain one selected DATA mode"]
    B --> C["Calculate the complete exchange<br/>RTS / CTS when required, DATA, IFS, immediate response"]
    C --> D{"Does the form satisfy the TXOP<br/>and applicable reservation checks?"}
    D -->|Yes| E["Commit the admitted form<br/>Submit the exchange at the retained mode"]
    D -->|No| F{"Does a permitted smaller form exist?"}
    F -->|Yes| B
    F -->|No| G{"Could a permitted form use a fresh TXOP?"}
    G -->|Yes| H["End this TXOP<br/>Preserve queued sources and counters"]
    G -->|No| I["Stop with a diagnostic<br/>Preserve sources before extraction"]

Loading

Positive-limit equality is permitted. The separate TXNAV comparison remains strict. Listed initial and retransmission exceptions retain their own conditions. An accepted Basic agreement can permit the initial ordinary-MSDU exception. An initial A-MSDU cannot use that exception. A zero limit permits all fragments of one MSDU; an unrelated MSDU needs another TXOP.

The legal Basic reproduction uses non-HT peers, production infrastructure association, no aggregation, and a 1024-microsecond limit. At 24 Mbit/s under multiple protection, the old path records eighteen invalid DATA completion boundaries. Each follows earlier DATA in the same TXOP.

One reproduced continuation	Before this PR	After this PR
The TXOP starts at 1.003257 seconds and ends at 1.004281 seconds.	The third protected exchange starts at 1.004025 seconds with 256 microseconds left.	HCF checks the complete exchange before RTS.
The exchange needs 374 microseconds through DATA completion.	DATA completes 118 microseconds beyond the bound. The initial exception cannot permit this third DATA.	HCF refuses that continuation. The queued source waits for another TXOP.

All four corrected probe configurations report zero invalid boundaries and deliver all thirty source MSDUs.

Ownership across RTS and CTS

Preparation owns duplicate previews. It borrows the queued source identities. Commitment consumes each source once and transfers the same prepared packets to the committed-frame owner. An allocation identity identifies one numbered MSDU or A-MSDU locally. All fragments from that MSDU share one sequence, that allocation identity, and the source's absolute deadline.

Basic and modern no-agreement recovery need a permanent MSDU identity before an actual RTS attempt. Those paths commit after admission, immediately before RTS. Accepted Compressed preparation retains its existing commitment boundary after CTS.

An internal collision can commit one ordinary source before its channel grant. Recovery assigns its permanent identity and increments the applicable counter. Later fragment replacement retains that identity and count.

sequenceDiagram
    participant Q as Pending queue
    participant S as QoS data service
    participant H as HCF
    participant F as Committed-frame owner
    participant P as Peer
    H->>S: Prepare copies at the retained mode
    S-->>H: Preview packets and source identities
    Note over Q,S: Original sources remain queued during admission
    H->>H: Check the complete exchange
    alt Admission refusal
        H->>S: Release the unused preparation
        Note over Q,F: No extraction, sequence allocation, or retry increment
    else Basic or modern no-agreement admission
        H->>S: Commit before RTS
        S->>Q: Extract the selected source once
        S->>F: Transfer the admitted packets and deadline
        H->>P: RTS
        alt CTS arrives
            P-->>H: CTS
            H->>P: DATA at the retained mode
        else CTS does not arrive
            H->>F: Retain the committed allocation
            Note over H,F: Recovery updates that MSDU's counter
        end
    else Accepted Compressed admission
        H->>P: RTS
        P-->>H: CTS
        H->>S: Validate and commit before DATA
        S->>Q: Extract the selected sources
        S->>F: Transfer the admitted packets
        H->>P: DATA at the retained mode
    end

Loading

The fragment policy combines its configured threshold with the complete MPDU bound. Nonfinal fragments have equal even lengths, with at most sixteen fragments. A numbered source can become fragments only before its first local DATA transmission. Transmitted bodies and lengths remain fixed for retry. A capability change or expiry can cancel DATA after CTS; it cannot restore an attempted allocation as new queued sources.

Recovery and terminal conditions

The selected profile determines the retry contract. The ACK policy determines the immediate response cost. Normal Ack under an accepted Basic agreement therefore retains Basic's lifetime exemption.

Active path	Counter state	Retry-limit result
Modern QoS DATA without an accepted agreement	One cumulative MSDU count includes associated RTS failures, DATA failures, and internal collisions. Nonfinal fragment ACKs retain it.	The short limit disposes of the complete allocation.
Enabled Basic without an accepted agreement	The 2016 MSDU short and long counts remain distinct. Fragment ACKs apply the corresponding reset rule.	The applicable short or long limit disposes of the complete allocation.
Accepted Basic agreement	The same 2016 counts still increase, including associated RTS failures and internal collisions.	The accepted R1 interpretation retains the MSDU beyond retry limits. Success, lifetime expiry, or agreement disposal ends ownership.
Accepted Compressed agreement and A-MPDU	Existing agreement and member recovery retain their contracts.	This PR preserves their preparation and response boundaries.

stateDiagram-v2
    [*] --> Queued
    Queued --> Preview: HCF prepares copies
    Queued --> Committed: Internal collision commits one ordinary source
    Preview --> Queued: Admission refusal
    Preview --> Committed: Admission succeeds and service commits
    Committed --> Committed: RTS or DATA fails / update the applicable counters
    Committed --> Committed: Internal collision / update the applicable counters
    Committed --> Committed: Nonfinal fragment succeeds / retain allocation state
    Committed --> Complete: All members succeed
    Committed --> Disposed: Lifetime expires or agreement disposes of DATA
    Committed --> Disposed: Retry limit applies and its count reaches the limit
    note right of Committed
        An accepted Basic agreement suppresses
        retry-limit disposal under the accepted R1 rule.
        The absolute lifetime deadline remains unchanged.
    end note
    Complete --> [*]
    Disposed --> [*]

Loading

The Basic interpretation uses IEEE Std 802.11-2016, Clauses 10.22.2.11.1 and 10.24.3. The maintainer explicitly selected lifetime retention for associated RTS failures before and after DATA, and for internal collisions. Modern no-agreement recovery uses IEEE Std 802.11-2024, Clause 10.23.2.12.1.

Commit order and interface changes

1. The baseline commit corrects twenty inherited graphical expectations against the unchanged dependency build.
2. C1a adds the bounded fragment policy and its direct tests.
3. C1b adds reversible fragment preparation and ownership transfer.
4. C2 adds allocation-scoped retry records without production activation.
5. C3 prepares the common HCF operations while current dispatch remains selected.
6. C4 activates modern Normal Ack admission with its direct regressions and ten causal fingerprint updates.
7. C5 activates Basic admission under the accepted 2016 contract with five causal fingerprint updates.
8. C6 records the plan, user effects, reproduction, and evidence.

The changes remain within IEEE 802.11 MAC contracts, the QoS data service, fragmentation, recovery, frame sequences, and committed-frame ownership. Packet wire formats, NED parameters, and feature descriptors remain unchanged. No sealed source path changes.

External IFragmentationPolicy implementations must supply the bounded partition operation. External IOriginatorQosMacDataService implementations must supply fragment preparation, validation, and commitment. IAckHandler now exposes the existing frame-disposal operation. The migration guide explains those requirements.

Evidence and limits

Every source commit builds in debug mode and passes its selected tests. The baseline amendments preserve each original source tree and test definition. The final debug and release builds pass. Release verification covers compilation; behavioral tests use debug assertions. The source-seal check passes. The series checks cover both the eight-commit topic and the complete upstream comparison.

The global architecture, naming, and interface checks return failures with complete output identical to the dependency head. The interface report contains the same fifteen classes; the naming report contains the same twenty-three violations. These global checks remain failed. Clang-tidy covers the seven changed C++ implementation files and reports no warning on an added line.

All three Mermaid diagrams pass syntax checks. The description gate reports no note. These checks do not establish a visual rendering result. The publication record records the per-commit checks and final build hashes.

The final debug campaign passes 31 module fixtures. It includes 96 Normal Ack runs and 36 Basic runs. Four unit fixtures and the legacy fragmentation protocol test also pass. The Basic cases cover both protection classes at 6 and 24 Mbit/s, with seed zero. They check nine forced CTS losses before DATA, nine after DATA, nine ACK losses, internal collisions, expiry, fragments, fallback, and legal mixed peers. Sixteen additional runs pass with Onoe; sixteen pass with AARF. The observers verify one retained DATA decision across RTS/CTS.

The final commands run from the repository root, except the fingerprint wrapper:

make MODE=debug -j8
make MODE=release -j8
inet_run_unit_tests -m debug -f 'Ieee80211(BoundedFragmentation|SingleProtection|MultipleProtection|TxopProcedure)_.*\.test'
inet_run_module_tests -m debug -f 'Ieee80211(BasicTxopAdmission|TxopAdmission|TxopMsduRecovery|PreparedQosFragments|PreparedQosData|CompressedBlockAckAdmission|CompressedBlockAckExchange|BasicCompatibility|BlockAckVariant|BlockAckFragmentRetirement|QosRecoveryPeerIdentity|EdcaDataLifetime.*|HcfInternalCollision|HcfManagementRecovery|HcfSingleProtection|HcfMultipleProtection|SingleProtectionGroup|PreparedCancellation|AmpduAdmission|AmpduPreparation|AmpduRecovery|AmpduExchange)_.*\.test'
inet_run_protocol_tests -p inet -m debug -w wifi -f 'Legacy_Fragmentation\.test$'

The selected fingerprint command runs from tests/fingerprint:

./fingerprinttest -d -t 8 -m '((showcases/wireless/(aggregation|blockack|fragmentation|qos|txop)|examples/(adhoc/qos|wireless/(qos|mactest)))/)'

The baseline campaign checks twenty-five related rows, with DCF controls. The dependency passes all twenty-five rows after its graphical updates. C4's ten rows pass against their approved expectations. All twenty-five final rows pass against both updated CSV files, with graphical fingerprints.

Twenty-one CSV rows change. The first commit corrects twenty inherited graphical expectations. The dependency and C3 produce identical values for all twenty-five selected rows. Their event, communication, and packet-data expectations already pass. The earlier cause of the graphical drift is unknown; these values describe the pinned local environment.

C4 changes ten rows from C3. C5 changes five rows from C4. Each source commit contains its measured values and a per-row explanation. Some rows also receive the earlier graphical correction. This table lists every changed CSV row:

Directory	Configuration	Commit owners	Cause
showcases/wireless/aggregation/	NoAggregation; run 0	Graphical baseline	Only inherited graphical drift changes.
showcases/wireless/aggregation/	Aggregation; run 0	Graphical baseline, C4	C4 excludes A-MSDUs without HT capabilities.
showcases/wireless/aggregation/	VoicePriorityAggregation; run 0	Graphical baseline, C4	C4 excludes A-MSDUs without HT capabilities.
showcases/wireless/blockack/	Fragmentation; run 0	C5	C5 retains the Basic fragment group within a zero-limit TXOP.
showcases/wireless/fragmentation/	DCFfrag; run 0	Graphical baseline	Only inherited graphical drift changes.
showcases/wireless/fragmentation/	HCFfrag; run 0	Graphical baseline, C4	C4 defers the next MSDU when its exchange cannot fit.
showcases/wireless/fragmentation/	HCFfragblockack; run 0	Graphical baseline, C5	C5 applies prepared Basic admission and correct fragment reservations before BAR access.
showcases/wireless/qos/	NonQos; run 0	Graphical baseline	Only inherited graphical drift changes.
showcases/wireless/qos/	Qos; run 0	Graphical baseline, C4	C4 excludes A-MSDUs without HT capabilities.
showcases/wireless/txop/	General; run 0	Graphical baseline, C5	C5 applies prepared Basic admission and excludes non-HT A-MSDUs.
examples/adhoc/qos/	MacQos; run 0	Graphical baseline, C4	C4 applies prepared admission and excludes non-HT A-MSDUs.
examples/adhoc/qos/	MacQos; run 1	Graphical baseline, C5	C5 applies prepared Basic admission, legal frame forms, and the 2016 recovery contract.
examples/adhoc/qos/	Fragmentation	Graphical baseline	Only inherited graphical drift changes.
examples/adhoc/qos/	MsduAggregation	Graphical baseline, C4	C4 excludes A-MSDUs without HT capabilities.
examples/wireless/mactest/	MacEdca; run 0	Graphical baseline, C4	C4 sends the next fragment after SIFS within a zero-limit TXOP.
examples/wireless/mactest/	MacDcf; run 0	Graphical baseline	Only inherited graphical drift changes.
examples/wireless/qos/	MacNonQos; run 0	Graphical baseline	Only inherited graphical drift changes.
examples/wireless/qos/	MacQos; run 0	Graphical baseline, C4	C4 applies prepared admission and excludes non-HT A-MSDUs.
examples/wireless/qos/	MacQosWithoutAggregation; run 0	Graphical baseline, C4	C4 derives Retry from local ACK state.
examples/wireless/qos/	MacQosWithRtsCts; run 0	Graphical baseline, C4	C4 excludes non-HT A-MSDUs before the protected exchange.
examples/wireless/qos/	MacQosWithBlockAck; run 0	Graphical baseline, C5	C5 applies prepared Basic admission and excludes non-HT A-MSDUs.

For example, MacQosWithoutAggregation changes packet bytes without a change to event or communication fingerprints. The old AP retains the previous hop's Retry bit for its first local transmission. C4 derives Retry from local ACK state and clears that bit. Paired captures first differ at sequence 16, TID 5, at capture timestamp 1.019021 seconds.

The baseline record contains all values, commands, library hashes, traces, and capture evidence. The execution record gives the broader test map.

Basic negotiation permission remains a separate change. This PR does not enforce rejection of Basic between two HT peers. Joint refusal and cancellation verification remains pending until that activation exists. DCF, HCCA, dynamic fragmentation, new ACK policies, and MAC stop/start remain outside this change.