[Gabrielcarvfer]

Allowed conformance testing of ns-3 mesh

---

Summary by cubic

Adds Linux WiFi support to DCE: kernel (LKL) nodes can now run mac80211 radios on ns-3 WiFi PHYs, so Linux 802.11s mesh points and ns-3 mesh points can share one channel and be compared frame by frame. Along the way, the deprecated libos (Linux 4.4) and FreeBSD kernel stacks are removed in favor of the Linux Kernel Library (LKL, Linux 6.12), and DCE grows real applications inside the simulation.

New Features

• LklWifiDevice and LklWifiHelper give kernel nodes a mac80211 radio on an ns-3 WifiPhy with legacy, HT, VHT and HE single user rates, A-MPDU aggregation and Block Acks; the radio passes control frames and ACK SNR to the kernel and no longer stalls simulated time on pending interrupts.
• dce-lkl-mesh runs Linux and ns-3 dot11s mesh points on one channel with pcap outputs; dce-lkl-wifi-litmus exercises ns-3 wifi behaviors against Linux; dce-lkl-boot and dce-lkl-p2p cover kernel boot and TCP/UDP between kernels.
• Real applications run inside the simulation: dce-wifi-video streams real ffmpeg video over 802.11n, and dce-x11-hello, dce-browser and dce-browser-nr run X11/GTK4 clients and unmodified Chromium/Brave in windows on the host display.
• New DCE support for those: AF_UNIX host socket passthrough, per-task thread-local storage, loading unmodified PIE executables, eventfd/epoll/futex, local socket SCM_RIGHTS, and crash handling that ends only the offending process.

Migration

• ns3::LinuxSocketFdFactory now means LKL; --with-lkl replaces --enable-kernel-stack.
• FreeBSD stack, libos kernel, and their examples, helpers, and documentation are removed.
• utils/build_lkl.sh builds LKL (pinned Linux 6.12 commit plus patches); utils/build_kernel_deps.sh builds the kernel programs, iw, and the extra example programs.

^{Written for commit 37fdd1d. Summary will update on new commits.}

[cubic-dev-ai]

40 issues found across 112 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="utils/build_kernel_deps.sh">

<violation number="1" location="utils/build_kernel_deps.sh:27">
P2: Git tags are mutable, and `fetch_git` does not verify a commit hash for these sources. Pin each git source to a commit SHA, as `QUAGGA_MODULE_REV` already does, so the build is reproducible and the source is verified.</violation>
</file>

<file name="example/dce-iperf.cc">

<violation number="1" location="example/dce-iperf.cc:66">
P2: Removing the freebsd branch means `--stack=freebsd` silently skips stack setup and falls through to address assignment on nodes with no IP stack. Consider rejecting unknown stack names explicitly, e.g. `NS_ABORT_MSG` or `NS_LOG_ERROR` plus `return 0` in an `else` branch.</violation>

<violation number="2" location="example/dce-iperf.cc:66">
P3: `dce-iperf` now uses the LKL build flag, but its fallback still tells users to build the removed dce-linux module. Report the required `--with-lkl` configuration instead.</violation>
</file>

<file name="utils/lkl-patches/0004-lkl-show_stack-stop-at-the-first-frame-outside-of-th.patch">

<violation number="1" location="utils/lkl-patches/0004-lkl-show_stack-stop-at-the-first-frame-outside-of-th.patch:35">
P2: This `arch/lkl` fix to `show_stack()` ships without a focused test. Add a test that exercises a walk ending at a non-kernel return address and at a non-increasing `next_frame`, so a regression is caught.</violation>
</file>

<file name="model/linux/linux-socket-impl.cc">

<violation number="1" location="model/linux/linux-socket-impl.cc:362">
P2: `m_sendBlocked` is updated only by `Send`, but `SendTo` uses `Sendmsg` and leaves the flag clear on EAGAIN. Track EAGAIN from `SendTo` too, otherwise unwritable datagram or raw sockets can spin on zero-delay `NotifySend` callbacks.</violation>

<violation number="2" location="model/linux/linux-socket-impl.cc:643">
P3: The FIONREAD ioctl runs on every POLLIN event, but `pending` only matters when a hangup or error bit is set. Move the ioctl inside that condition so ordinary data notifications skip the extra fake-task round trip and syscall.</violation>
</file>

<file name="test/test-signal.cc">

<violation number="1" location="test/test-signal.cc:40">
P3: `g_sent` is shared between threads through a plain `volatile bool`, which is a data race under the C++ memory model. Use `std::atomic<bool>` (or `__atomic` builtins) for the flag, or drop the flag and rely on `pthread_join`.</violation>
</file>

<file name="doc/source/dce-user-kernel.rst">

<violation number="1" location="doc/source/dce-user-kernel.rst:14">
P2: This overstates the naming rule. Loopback devices get no kernel device, and `LklWifiDevice` radios become `wlan<n>`, not `sim<n>`. Qualify the sentence, e.g. 'every ns-3 NetDevice except loopback becomes a kernel device: `sim<n>`, or `wlan<n>` for an `LklWifiDevice`'.</violation>

<violation number="2" location="doc/source/dce-user-kernel.rst:150">
P3: `Run` is not a public DCE API and this page does not define it. Replace these calls with `DceApplicationHelper` or define the helper so the Wi-Fi example is copyable.</violation>
</file>

<file name="example/dce-iperf-emulation.cc">

<violation number="1" location="example/dce-iperf-emulation.cc:84">
P2: Removing the `freebsd` branch leaves no `else` for unrecognized stack names. `--stack=freebsd` now skips stack setup and runs the DCE iperf apps on nodes with no DceManager, so it fails later with no clear error. Add an `else` that calls `NS_FATAL_ERROR` on an unknown stack name.</violation>
</file>

<file name="model/lkl/lkl-kernel.cc">

<violation number="1" location="model/lkl/lkl-kernel.cc:490">
P2: The `stat()` call on the source file is inside `NS_ASSERT_MSG`, so it is skipped in builds where assertions are compiled out. `src` is then read uninitialized in the freshness check. Move the call out of the assertion and assert only on its result.</violation>
</file>

<file name="model/unix-datagram-socket-fd.cc">

<violation number="1" location="model/unix-datagram-socket-fd.cc:205">
P2: `MSG_PEEK` bypasses `ICMP6_FILTER`, so a blocked ICMPv6 type is still returned to callers that peek. Apply the filter to peeking reads without repeatedly returning the same blocked packet.</violation>

<violation number="2" location="model/unix-datagram-socket-fd.cc:255">
P3: After this change `ipv4` is never used in this block. Remove the `Ptr<Ipv4> ipv4 = node->GetObject<Ipv4> ();` declaration above, since the interface index now comes straight from the tag.</violation>
</file>

<file name="model/lkl/lkl-kernel.h">

<violation number="1" location="model/lkl/lkl-kernel.h:55">
P3: `GetTlsKeys()` and `GetPages()` expose the internal containers by mutable reference, but they are only used for insert, erase and lookup inside lkl-kernel.cc. Replace them with narrow methods such as AddTlsKey/RemoveTlsKey and AddPage/RemovePage, or keep the containers private.</violation>
</file>

<file name="test/ipv4-dce-routing-test.cc">

<violation number="1" location="test/ipv4-dce-routing-test.cc:34">
P3: The `Local` callback ignores its `iif` argument, so the test never checks the interface reported for local multicast delivery. Record `iif` and assert it equals `inIf` so the new `lcb` call is verified end to end.</violation>
</file>

<file name=".github/workflows/build-and-test.yml">

<violation number="1" location=".github/workflows/build-and-test.yml:50">
P2: The new apt-get list still lacks `patch`, `autoconf`, `automake` and `libtool`. `build_kernel_deps.sh` calls `patch` to apply the iperf/iputils patches and runs `autogen.sh` for libnl, which needs those autotools. Add them to the install list, or the kernel-deps step will fail on a cache miss.</violation>
</file>

<file name="helper/lkl-wifi-helper.cc">

<violation number="1" location="helper/lkl-wifi-helper.cc:80">
P3: `AssignStreams` silently skips non-LKL devices, while `EnablePcap` aborts on them. Use the same abort here so a wrong device container fails loudly instead of leaving streams unassigned.</violation>
</file>

<file name="utils/lkl-patches/0005-lkl-update-jiffies-on-interrupts-while-the-tick-is-s.patch">

<violation number="1" location="utils/lkl-patches/0005-lkl-update-jiffies-on-interrupts-while-the-tick-is-s.patch:4">
P2: This `arch/lkl` fix has no upstream tracking. Add a `TOUPSTREAM` line to the commit message, as patches 0003 and 0004 do. Also add a focused test that checks timers armed from interrupts during a stopped tick do not expire early.

(Based on your team's feedback about upstreaming LKL fixes with tests.)</violation>
</file>

<file name="model/kernel-socket-fd.h">

<violation number="1" location="model/kernel-socket-fd.h:14">
P3: The class comment overstates what `KernelSocketFd` does. Several operations are emulated in DCE or return errors without making a kernel call, and the blocking variants wait in DCE. Reword it to say most operations map to kernel system calls and that some are emulated.</violation>
</file>

<file name="example/dce-lkl-mesh.cc">

<violation number="1" location="example/dce-lkl-mesh.cc:45">
P2: This example cannot fail its conformance run when `iw`, `ip`, or `ping` exits nonzero: `Finished` only logs the status and `main` always returns 0. Track nonzero child statuses and return failure.</violation>

<violation number="2" location="example/dce-lkl-mesh.cc:168">
P2: The ping start times are hard-coded at 5 + 6*i seconds, but `stop` defaults to 30 s. With more than 4 nodes, the later pings start late or after the simulation has stopped, so they are silently cut off or never run. Derive the stop time from the node count, or abort/warn when the schedule does not fit in `stop`.</violation>

<violation number="3" location="example/dce-lkl-mesh.cc:168">
P2: `--linux=0` is accepted but this loop unconditionally accesses `linuxNodes.Get (0)`, so the example aborts instead of handling the invalid topology. Reject zero Linux nodes after parsing.</violation>
</file>

<file name="test/dce-manager-test.cc">

<violation number="1" location="test/dce-manager-test.cc:279">
P1: The linux-stack gate now searches for `liblkl.so`, but `DoRun` still loads `liblinux.so` for the same `LinuxSocketFdFactory`. When only `liblkl.so` is present, the gate passes and every linux-stack test then fails to load its library. Change the `Library` value in the linux branch of `DoRun` to `liblkl.so` as well.</violation>
</file>

<file name="example/dce-mptcp-handoff-v6.cc">

<violation number="1" location="example/dce-mptcp-handoff-v6.cc:70">
P3: The per-address counter includes TCP/MPTCP headers and pure ACKs, not just payload. Either rename the output to reflect L4 bytes, or count only the TCP payload if the intent is goodput.</violation>
</file>

<file name="model/kernel-socket-fd-factory.cc">

<violation number="1" location="model/kernel-socket-fd-factory.cc:582">
P2: For non-Mac48 addresses, `RxFromDevice` no longer converts Mac64Address the way the previous code did. Broadcast destinations now become the kernel device's own MAC, and the source becomes all zeros. Restrict the fallback to LTE devices, or keep the Mac64-to-Mac48 conversion for other device types.</violation>
</file>

<file name="model/linux/linux-socket-impl.h">

<violation number="1" location="model/linux/linux-socket-impl.h:88">
P2: This header change leaves the checked-in Python binding definitions stale. `bindings/modulegen__gcc_LP64.py` and `bindings/modulegen__gcc_ILP32.py` still declare `m_kernsock` as `ns3::KernelSocketFd *`. Regenerate the bindings, or update those two `add_instance_attribute` lines to `ns3::UnixFd *`.</violation>

<violation number="2" location="model/linux/linux-socket-impl.h:120">
P3: The comment is inaccurate: the flag stays set after a later successful send and is only cleared by `Poll()` on a POLLOUT notification. Reword it to say it records an EAGAIN not yet followed by a writable notification.</violation>
</file>

<file name="example/dce-lkl-p2p.cc">

<violation number="1" location="example/dce-lkl-p2p.cc:41">
P3: This comment is inaccurate. `tcp-server` reads a fixed 100 x 10240 bytes and ignores EOF, so say that instead of "until the end of the connection".</violation>

<violation number="2" location="example/dce-lkl-p2p.cc:124">
P3: With `--loopback --stop`, the UDP server and client still run on the single node. The non-stop branch skips UDP when `loopback` is set, so guard the stop branch's UDP calls the same way.</violation>

<violation number="3" location="example/dce-lkl-p2p.cc:125">
P3: The header says every program must exit with status 0, but the `--stop` clients are not checked. Pass `check` (drop the `false`) so the clients are counted, or correct the header.</violation>
</file>

<file name="model/dce-signal.cc">

<violation number="1" location="model/dce-signal.cc:134">
P2: The new `sigwaitSet` wait only works if the sender wakes this thread. `UtilsSendSignal` in `model/utils.cc` returns after waking the first eligible blocked thread, so a sigwait-ing thread later in `process->threads` can be skipped and hang. Prefer threads with the signal in `sigwaitSet` in a first pass before the existing candidate check.</violation>
</file>

<file name="model/unix-socket-fd.cc">

<violation number="1" location="model/unix-socket-fd.cc:413">
P2: The new IPV6_JOIN_GROUP/IPV6_LEAVE_GROUP handling has no test. Add a test that joins and leaves a group on a valid interface, on interface 0, and on an out-of-range interface index.</violation>

<violation number="2" location="model/unix-socket-fd.cc:432">
P2: `ipv6mr_interface == 0` is treated as "all interfaces", but Linux resolves 0 by route lookup and returns ENODEV when no route exists. Resolve the interface the way Linux does, or return ENODEV for 0. Correct the "0 means all interfaces" comment either way.</violation>

<violation number="3" location="model/unix-socket-fd.cc:452">
P2: Joined groups are never tracked per socket, so they are not dropped when the socket is closed. Linux drops a socket's memberships on close. Record the joins per socket and remove them in `ClearSocket()` or the destructor.</violation>

<violation number="4" location="model/unix-socket-fd.cc:563">
P3: The getsockopt path does not check the socket type, unlike setsockopt. On a non-raw socket it returns a PASSALL filter instead of ENOPROTOOPT. Add the same `GetInstanceTypeId` check here.</violation>
</file>

<file name="example/dce-iperf-heterogeneous-multihop.cc">

<violation number="1" location="example/dce-iperf-heterogeneous-multihop.cc:165">
P3: `dce-iperf-heterogeneous-multihop` now uses the LKL build flag, but its fallback still directs users to the removed dce-linux module. Report the required `--with-lkl` configuration instead.</violation>
</file>

<file name="model/kernel-socket-fd.cc">

<violation number="1" location="model/kernel-socket-fd.cc:37">
P2: Stopping a DCE process can destroy this object without closing its LKL descriptor, because cleanup may run outside the node task. That leaks the kernel socket and its epoll registration; defer the close to the factory's kernel task during cleanup instead of silently leaving `m_fd` open.</violation>
</file>

<file name="model/dce.cc">

<violation number="1" location="model/dce.cc:458">
P2: The `optind <= 1` reset mistakes an in-progress short-option cluster for a fresh parse. Switching processes during `-ab` makes the original process return `a` twice; preserve the hidden cluster cursor or use a reentrant/process-local parser.</violation>
</file>

<file name="utils/lkl-patches/0002-lkl-stop-the-tick-while-the-host-is-idle.patch">

<violation number="1" location="utils/lkl-patches/0002-lkl-stop-the-tick-while-the-host-is-idle.patch:121">
P3: The new nohz state machine has no focused regression test. Add a deterministic LKL test that exercises idle entry and wakeup across simulated time, including a failed syscall, and verifies timer delivery.</violation>
</file>

<file name="model/lkl-wifi-device.cc">

<violation number="1" location="model/lkl-wifi-device.cc:132">
P3: `SetPhy` snapshots `CwMin` into `m_cw`, so per-device `CwMin` changes after installation do not affect the first access. Initialize the current window when a new queue/backoff begins while preserving the exponential window across retries.</violation>
</file>

<sub>Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: The linux-stack gate now searches for liblkl.so, but DoRun still loads liblinux.so for the same LinuxSocketFdFactory. When only liblkl.so is present, the gate passes and every linux-stack test then fails to load its library. Change the Library value in the linux branch of DoRun to liblkl.so as well.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At test/dce-manager-test.cc, line 279:

<comment>The linux-stack gate now searches for `liblkl.so`, but `DoRun` still loads `liblinux.so` for the same `LinuxSocketFdFactory`. When only `liblkl.so` is present, the gate passes and every linux-stack test then fails to load its library. Change the `Library` value in the linux branch of `DoRun` to `liblkl.so` as well.</comment>

<file context>
@@ -264,7 +276,7 @@ DceManagerTestSuite::DceManagerTestSuite ()
   TypeId tid;
   bool kern_linux = TypeId::LookupByNameFailSafe ("ns3::LinuxSocketFdFactory", &tid);
-  std::string filePath = SearchExecFile ("DCE_PATH", "liblinux.so", 0);
+  std::string filePath = SearchExecFile ("DCE_PATH", "liblkl.so", 0);
   if (kern_linux && (filePath.length () > 0))
     {
</file context>

[cubic-dev-ai]

P2: Git tags are mutable, and fetch_git does not verify a commit hash for these sources. Pin each git source to a commit SHA, as QUAGGA_MODULE_REV already does, so the build is reproducible and the source is verified.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At utils/build_kernel_deps.sh, line 27:

<comment>Git tags are mutable, and `fetch_git` does not verify a commit hash for these sources. Pin each git source to a commit SHA, as `QUAGGA_MODULE_REV` already does, so the build is reproducible and the source is verified.</comment>

<file context>
@@ -0,0 +1,198 @@
+SRC="${DEPS_DIR}/src"
+JOBS="${JOBS:-$(nproc)}"
+
+IPROUTE2_REV="v6.12.0" # matches LKL's kernel; has "ip mptcp"
+LIBNL_REV="libnl3_10_0"
+IW_REV="v6.9"
</file context>

[cubic-dev-ai]

P2: Removing the freebsd branch means --stack=freebsd silently skips stack setup and falls through to address assignment on nodes with no IP stack. Consider rejecting unknown stack names explicitly, e.g. NS_ABORT_MSG or NS_LOG_ERROR plus return 0 in an else branch.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/dce-iperf.cc, line 66:

<comment>Removing the freebsd branch means `--stack=freebsd` silently skips stack setup and falls through to address assignment on nodes with no IP stack. Consider rejecting unknown stack names explicitly, e.g. `NS_ABORT_MSG` or `NS_LOG_ERROR` plus `return 0` in an `else` branch.</comment>

<file context>
@@ -63,7 +63,7 @@ int main (int argc, char *argv[])
   else if (stack == "linux")
     {
-#ifdef KERNEL_STACK
+#ifdef LINUX_STACK
       dceManager.SetNetworkStack ("ns3::LinuxSocketFdFactory", "Library", StringValue ("liblinux.so"));
       dceManager.Install (nodes);
</file context>

[cubic-dev-ai]

P2: This arch/lkl fix to show_stack() ships without a focused test. Add a test that exercises a walk ending at a non-kernel return address and at a non-increasing next_frame, so a regression is caught.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At utils/lkl-patches/0004-lkl-show_stack-stop-at-the-first-frame-outside-of-th.patch, line 35:

<comment>This `arch/lkl` fix to `show_stack()` ships without a focused test. Add a test that exercises a walk ending at a non-kernel return address and at a non-increasing `next_frame`, so a regression is caught.</comment>

<file context>
@@ -0,0 +1,46 @@
++		 * frame pointers: stop at the first frame outside of the
++		 * kernel, and on frames that do not go up the stack.
++		 */
++		if (!__kernel_text_address(addr))
++			break;
+ 		printk("%s #%02d [<0x%016lx>] %pS\n",
</file context>

[cubic-dev-ai]

P2: This overstates the naming rule. Loopback devices get no kernel device, and LklWifiDevice radios become wlan<n>, not sim<n>. Qualify the sentence, e.g. 'every ns-3 NetDevice except loopback becomes a kernel device: sim<n>, or wlan<n> for an LklWifiDevice'.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At doc/source/dce-user-kernel.rst, line 14:

<comment>This overstates the naming rule. Loopback devices get no kernel device, and `LklWifiDevice` radios become `wlan<n>`, not `sim<n>`. Qualify the sentence, e.g. 'every ns-3 NetDevice except loopback becomes a kernel device: `sim<n>`, or `wlan<n>` for an `LklWifiDevice`'.</comment>

<file context>
@@ -1,237 +1,92 @@
-This document describes how to retrieve, configure, compile and use this custom kernel in DCE.
-As an example, it shows how to enable an in-tree but optional protocol - Stream Control Transmission Protocol (SCTP) - and an out of tree protocol: Multipath TCP (MPTCP).
-Although other protocols may not adapt these patterns as-is, you will see what's needed to implement for your purpose.
+Each node gets its own kernel; every ns-3 NetDevice of the node becomes a
+kernel network device named ``sim<n>``, and the sockets of DCE
+applications are kernel sockets.
</file context>

[cubic-dev-ai]

P3: dce-iperf-heterogeneous-multihop now uses the LKL build flag, but its fallback still directs users to the removed dce-linux module. Report the required --with-lkl configuration instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/dce-iperf-heterogeneous-multihop.cc, line 165:

<comment>`dce-iperf-heterogeneous-multihop` now uses the LKL build flag, but its fallback still directs users to the removed dce-linux module. Report the required `--with-lkl` configuration instead.</comment>

<file context>
@@ -162,7 +162,7 @@ main (int argc, char *argv[])
   ns3stack.Install (routersR);
 
-#ifdef KERNEL_STACK
+#ifdef LINUX_STACK
   LinuxStackHelper linuxStack;
 #endif
</file context>

[cubic-dev-ai]

P3: dce-iperf now uses the LKL build flag, but its fallback still tells users to build the removed dce-linux module. Report the required --with-lkl configuration instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/dce-iperf.cc, line 66:

<comment>`dce-iperf` now uses the LKL build flag, but its fallback still tells users to build the removed dce-linux module. Report the required `--with-lkl` configuration instead.</comment>

<file context>
@@ -63,7 +63,7 @@ int main (int argc, char *argv[])
   else if (stack == "linux")
     {
-#ifdef KERNEL_STACK
+#ifdef LINUX_STACK
       dceManager.SetNetworkStack ("ns3::LinuxSocketFdFactory", "Library", StringValue ("liblinux.so"));
       dceManager.Install (nodes);
</file context>

[cubic-dev-ai]

P3: Run is not a public DCE API and this page does not define it. Replace these calls with DceApplicationHelper or define the helper so the Wi-Fi example is copyable.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At doc/source/dce-user-kernel.rst, line 150:

<comment>`Run` is not a public DCE API and this page does not define it. Replace these calls with `DceApplicationHelper` or define the helper so the Wi-Fi example is copyable.</comment>

<file context>
@@ -244,19 +99,70 @@ You need first to add to your *DCE_PATH* the path to the previously compiled *li
+    NetDeviceContainer devices = wifi.Install (phy, nodes);
+    LklWifiHelper::EnablePcap (phy, "lkl-wifi", devices);
+    ...
+    Run (node, Seconds (0.5), "iw", "dev wlan0 set type mp");
+    LinuxStackHelper::RunIp (node, Seconds (0.6), "link set wlan0 up");
+    Run (node, Seconds (0.7), "iw", "dev wlan0 mesh join mesh freq 5500");
</file context>

Suggested change

	Run (node, Seconds (0.5), "iw", "dev wlan0 set type mp");
	LinuxStackHelper::RunIp (node, Seconds (0.6), "link set wlan0 up");
	Run (node, Seconds (0.7), "iw", "dev wlan0 mesh join mesh freq 5500");
	DceApplicationHelper iw;
	iw.SetBinary ("iw");
	iw.SetStackSize (1 << 16);
	iw.ResetArguments ();
	iw.ParseArguments ("dev wlan0 set type mp");
	ApplicationContainer apps = iw.Install (node);
	apps.Start (Seconds (0.5));
	LinuxStackHelper::RunIp (node, Seconds (0.6), "link set wlan0 up");
	iw.ResetArguments ();
	iw.ParseArguments ("dev wlan0 mesh join mesh freq 5500");
	apps = iw.Install (node);
	apps.Start (Seconds (0.7));

[cubic-dev-ai]

P3: The new nohz state machine has no focused regression test. Add a deterministic LKL test that exercises idle entry and wakeup across simulated time, including a failed syscall, and verifies timer delivery.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At utils/lkl-patches/0002-lkl-stop-the-tick-while-the-host-is-idle.patch, line 121:

<comment>The new nohz state machine has no focused regression test. Add a deterministic LKL test that exercises idle entry and wakeup across simulated time, including a failed syscall, and verifies timer delivery.</comment>

<file context>
@@ -0,0 +1,222 @@
++ * loop would, so that an idle kernel gets no timer interrupts until its
++ * next timer actually expires.
++ */
++static bool idle_host_nohz;
++
++static void idle_host_enter(void)
</file context>

[cubic-dev-ai]

P3: SetPhy snapshots CwMin into m_cw, so per-device CwMin changes after installation do not affect the first access. Initialize the current window when a new queue/backoff begins while preserving the exponential window across retries.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At model/lkl-wifi-device.cc, line 132:

<comment>`SetPhy` snapshots `CwMin` into `m_cw`, so per-device `CwMin` changes after installation do not affect the first access. Initialize the current window when a new queue/backoff begins while preserving the exponential window across retries.</comment>

<file context>
@@ -0,0 +1,629 @@
+  NS_LOG_FUNCTION (this << phy << carrier);
+  m_phy = phy;
+  m_carrier = carrier;
+  m_cw = m_cwMin;
+  m_phy->SetReceiveOkCallback (MakeCallback (&LklWifiDevice::Receive, this));
+}
</file context>

[cubic-dev-ai]

7 issues found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="utils/lkl-patches/0006-lkl-add-a-mac80211-radio-whose-frames-are-carried-by.patch">

<violation number="1" location="utils/lkl-patches/0006-lkl-add-a-mac80211-radio-whose-frames-are-carried-by.patch:233">
P3: The rate-status fix in `lkl_wifi_tx_status()` and the `FIF_CONTROL` filter change are arch/lkl behavior fixes with no focused test. Add a KUnit test under arch/lkl for the per-rate attempt spreading and the control-frame filter, following `pci_test.c`. Also track both fixes for upstream LKL submission.</violation>
</file>

<file name="example/dce-lkl-wifi-litmus.cc">

<violation number="1" location="example/dce-lkl-wifi-litmus.cc:418">
P2: The address remains configured across `ip link set wlan0 down/up`, so this second `ip addr add` fails with `RTNETLINK answers: File exists`. Use `ip addr replace` or remove the address before adding it.</violation>

<violation number="2" location="example/dce-lkl-wifi-litmus.cc:628">
P3: An invalid `--standard` value silently selects AX, so a typo runs the wrong PHY scenario. Validate that the value is exactly `n`, `ac`, or `ax` before selecting `wifiStd`.</violation>

<violation number="3" location="example/dce-lkl-wifi-litmus.cc:805">
P2: The default `rate` run stops at 20 seconds, but its downlink and `lkl-sniff` run through 21 seconds. Increase the rate scenario’s stop time or derive these workloads from `stop` so the advertised transfer completes.</violation>
</file>

<file name="example/lkl-sniff.cc">

<violation number="1" location="example/lkl-sniff.cc:102">
P2: A failed pcap open leaves `pcap` null, then the next `fwrite` uses it and can crash. Check `fopen` and report the error before writing the header.</violation>

<violation number="2" location="example/lkl-sniff.cc:123">
P2: The monitor capture buffer cannot hold a maximum-size LKL frame plus its radiotap header, and the pcap path hides truncation by using `n` for both lengths. Increase the buffer or allocate it on the heap and preserve the original length when truncation occurs.</violation>

<violation number="3" location="example/lkl-sniff.cc:143">
P2: The pcap timestamps use `CLOCK_MONOTONIC`, so readers interpret time-since-boot as a Unix timestamp and show the capture at the wrong date. Use `CLOCK_REALTIME` for record timestamps while keeping monotonic time for the capture deadline.</violation>
</file>

<sub>Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The address remains configured across ip link set wlan0 down/up, so this second ip addr add fails with RTNETLINK answers: File exists. Use ip addr replace or remove the address before adding it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/dce-lkl-wifi-litmus.cc, line 418:

<comment>The address remains configured across `ip link set wlan0 down/up`, so this second `ip addr add` fails with `RTNETLINK answers: File exists`. Use `ip addr replace` or remove the address before adding it.</comment>

<file context>
@@ -0,0 +1,811 @@
+          Run (l1, Seconds (7.1), "ip", "link set wlan0 address 02:00:00:00:02:02");
+          Run (l1, Seconds (7.2), "ip", "link set wlan0 up");
+          Run (l1, Seconds (7.3), "iw", "dev wlan0 connect litmus 5180");
+          Run (l1, Seconds (7.4), "ip", "addr add 10.1.1.2/24 dev wlan0");
+          Run (l1, Seconds (9.0), "iw", "dev wlan0 link");
+          Run (l1, Seconds (9.5), "ping", "-c 10 -i 0.2 10.1.1.100");
</file context>

Suggested change

	Run (l1, Seconds (7.4), "ip", "addr add 10.1.1.2/24 dev wlan0");
	Run (l1, Seconds (7.4), "ip", "addr replace 10.1.1.2/24 dev wlan0");

[cubic-dev-ai]

P2: The default rate run stops at 20 seconds, but its downlink and lkl-sniff run through 21 seconds. Increase the rate scenario’s stop time or derive these workloads from stop so the advertised transfer completes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/dce-lkl-wifi-litmus.cc, line 805:

<comment>The default `rate` run stops at 20 seconds, but its downlink and `lkl-sniff` run through 21 seconds. Increase the rate scenario’s stop time or derive these workloads from `stop` so the advertised transfer completes.</comment>

<file context>
@@ -0,0 +1,811 @@
+      NS_FATAL_ERROR ("Unknown scenario " << scenario);
+    }
+
+  Simulator::Stop (Seconds (stop));
+  Simulator::Run ();
+  std::cout << "litmus " << scenario << " completed at " << Simulator::Now ().GetSeconds () << "s"
</file context>

[cubic-dev-ai]

P2: The monitor capture buffer cannot hold a maximum-size LKL frame plus its radiotap header, and the pcap path hides truncation by using n for both lengths. Increase the buffer or allocate it on the heap and preserve the original length when truncation occurs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/lkl-sniff.cc, line 123:

<comment>The monitor capture buffer cannot hold a maximum-size LKL frame plus its radiotap header, and the pcap path hides truncation by using `n` for both lengths. Increase the buffer or allocate it on the heap and preserve the original length when truncation occurs.</comment>

<file context>
@@ -0,0 +1,174 @@
+  // type, source, destination, protocol -> frames, bytes
+  std::map<std::tuple<int, std::string, std::string, int>, std::pair<uint64_t, uint64_t> > counts;
+  uint64_t frames = 0;
+  uint8_t buf[4096];
+  double end = Now () + duration;
+  while (Now () < end)
</file context>

[cubic-dev-ai]

P2: The pcap timestamps use CLOCK_MONOTONIC, so readers interpret time-since-boot as a Unix timestamp and show the capture at the wrong date. Use CLOCK_REALTIME for record timestamps while keeping monotonic time for the capture deadline.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/lkl-sniff.cc, line 143:

<comment>The pcap timestamps use `CLOCK_MONOTONIC`, so readers interpret time-since-boot as a Unix timestamp and show the capture at the wrong date. Use `CLOCK_REALTIME` for record timestamps while keeping monotonic time for the capture deadline.</comment>

<file context>
@@ -0,0 +1,174 @@
+      frames++;
+      if (pcap)
+        {
+          double t = Now ();
+          uint32_t record[4] = {(uint32_t)t, (uint32_t)((t - (uint32_t)t) * 1e6),
+                                (uint32_t)n, (uint32_t)n};
</file context>

[cubic-dev-ai]

P2: A failed pcap open leaves pcap null, then the next fwrite uses it and can crash. Check fopen and report the error before writing the header.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/lkl-sniff.cc, line 102:

<comment>A failed pcap open leaves `pcap` null, then the next `fwrite` uses it and can crash. Check `fopen` and report the error before writing the header.</comment>

<file context>
@@ -0,0 +1,174 @@
+  FILE *pcap = 0;
+  if (argc > 3)
+    {
+      pcap = fopen (argv[3], "w");
+      // Global header: radiotap (127), the link type of monitor interfaces.
+      uint32_t header[6] = {0xa1b2c3d4, 0x00040002, 0, 0, 65535, 127};
</file context>

[cubic-dev-ai]

P3: The rate-status fix in lkl_wifi_tx_status() and the FIF_CONTROL filter change are arch/lkl behavior fixes with no focused test. Add a KUnit test under arch/lkl for the per-rate attempt spreading and the control-frame filter, following pci_test.c. Also track both fixes for upstream LKL submission.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At utils/lkl-patches/0006-lkl-add-a-mac80211-radio-whose-frames-are-carried-by.patch, line 233:

<comment>The rate-status fix in `lkl_wifi_tx_status()` and the `FIF_CONTROL` filter change are arch/lkl behavior fixes with no focused test. Add a KUnit test under arch/lkl for the per-rate attempt spreading and the control-frame filter, following `pci_test.c`. Also track both fixes for upstream LKL submission.</comment>

<file context>
@@ -226,6 +230,7 @@ index 000000000..bc45e09d9
 +			rate->count = 0;
 +			continue;
 +		}
++		rate->count = counts[i];
 +		if (rate->count > attempts || i == IEEE80211_TX_MAX_RATES - 1)
 +			rate->count = attempts;
</file context>

[cubic-dev-ai]

P3: An invalid --standard value silently selects AX, so a typo runs the wrong PHY scenario. Validate that the value is exactly n, ac, or ax before selecting wifiStd.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At example/dce-lkl-wifi-litmus.cc, line 628:

<comment>An invalid `--standard` value silently selects AX, so a typo runs the wrong PHY scenario. Validate that the value is exactly `n`, `ac`, or `ax` before selecting `wifiStd`.</comment>

<file context>
@@ -0,0 +1,811 @@
+    {
+      // An ns-3 AP and a Linux STA of the same standard, on a spectrum
+      // channel (per-20 MHz CCA, for the secondary channel).
+      WifiStandard wifiStd = standard == "n" ? WIFI_STANDARD_80211n
+        : standard == "ac" ? WIFI_STANDARD_80211ac : WIFI_STANDARD_80211ax;
+      std::string settings = standard == "n" ? "{38, 40, BAND_5GHZ, 0}" : "{42, 80, BAND_5GHZ, 0}";
</file context>