mirror of
https://github.com/ruvnet/RuView.git
synced 2026-10-21 22:22:33 -05:00
rUv
aac4155584
* feat(bfi): add validated capture and bounded research tooling * fix(deps): patch Wasmtime for RUSTSEC-2026-0316
146 lines
8.2 KiB
Markdown
146 lines
8.2 KiB
Markdown
# BFI acceptance evidence
|
||
|
||
For the later decoder speedup, additional validated HE widths and higher-traffic
|
||
trials, see [optimization evidence](OPTIMIZATION.md). The runs below document the
|
||
initial acceptance and its negative repeats.
|
||
|
||
## Result: first capture/decode/rate acceptance passed
|
||
|
||
**MEASURED, September 29, 2026 local time (September 30 UTC):** an Archer BE550
|
||
and an associated iPhone 17 produced 21 complete HE beamforming reports captured
|
||
by an MT7927. Every quantized angle, selected MIMO control field, and signed SNR
|
||
matched the independent tshark 4.2.2 dissector. A second reviewer checked the
|
||
capture independently. The coordinator reproduced the comparison through the CLI.
|
||
|
||
This establishes the first hardware acceptance test for the format below.
|
||
**Sustained sampling, production BFLD ingestion, and movement sensing remain
|
||
unvalidated.** The next equal-duration capture and the final runner validation
|
||
both produced no reports.
|
||
|
||
## Validated real report format and rate
|
||
|
||
| Measurement | Result |
|
||
|---|---|
|
||
| Feedback | HE single-user, 2 rows × 2 columns, 80 MHz, Ng=4, codebook 1 |
|
||
| Frequency | Primary 5180 MHz; center 5210 MHz; verified before and after |
|
||
| Complete reports | 21, all from the intended client to the AP |
|
||
| Independent comparison | 21/21 matched; 250 angle pairs/report; 10,500 angle values total |
|
||
| Capture duration | 45.033401777 seconds |
|
||
| Captured unique report rate | 0.466320535 reports/second over the full capture |
|
||
| Between-report gaps within the burst | Median 0.2347655 s; p95 1.330627 s; maximum 1.559962 s |
|
||
| Report burst span | 7.516041 seconds, entirely within the traffic interval |
|
||
| Retry/deduplication | Distinct sequence numbers, no Retry bits, no discarded duplicates |
|
||
| Median report signal | −82 dBm in the first reported antenna sample |
|
||
| Capture integrity | No truncation, timestamp regressions, or indicated bad FCS |
|
||
| Kernel drops | 0; this does not measure RF or firmware losses |
|
||
| Restoration | Original Wi-Fi association and wired management verified |
|
||
|
||
The first report arrived 4.039 seconds into the capture and the last at 11.555
|
||
seconds. The remaining 33.479 seconds contained no reports. The gap statistics
|
||
above exclude these leading and trailing empty intervals.
|
||
|
||
The reports were unprotected Action No Ack frames with complete, unsegmented
|
||
payloads. Captured and original packet lengths both equaled 422 bytes. FCS bytes
|
||
were absent, so no independent CRC verification is claimed. The oracle checks
|
||
angles, selected controls and SNR; frequency-axis labels and matrix correctness
|
||
are separate checks. Matrix elements have a synthetic closed-form 2×2 test.
|
||
|
||
Traffic was bounded ordinary UDP downlink to the verified own-network client:
|
||
1,200-byte datagrams at 250 packets/second for 30 seconds (7,500 packets, 9 MB),
|
||
starting after the PCAP header appeared. No acknowledgment from a UDP application
|
||
is claimed. A preceding link diagnostic independently received AP-to-client HE
|
||
data and client acknowledgments.
|
||
|
||
## Environment and driver scope
|
||
|
||
- Linux `6.17.0-20-generic`, matching headers, GCC 13.3.0.
|
||
- MT7927 with `mediatek-mt7927/2.10` source, the two adapted upstream monitor
|
||
fixes, and the separate experimental aggregate RX-filter band mirror.
|
||
- Existing firmware build `20250606201037`; no firmware upgrade was applied.
|
||
- BE550 v1 firmware `1.0.12 Build 20240902 rel.22993(4341)`, AP mode,
|
||
fixed 5 GHz channel 36, 80 MHz, Wi-Fi 6 association, OFDMA/MU-MIMO enabled.
|
||
- Installed driver files and DKMS registration were preserved. Trial modules
|
||
were loaded in memory; module reload or reboot returns to the installed driver.
|
||
|
||
The [patches, build procedure and rollback](driver/README.md) are included.
|
||
Received signal conditions varied between runs, so these observations do not
|
||
isolate the experimental patch's causal benefit. No persistent driver deployment
|
||
or claim of general MT7927 monitor compatibility is made.
|
||
|
||
## Trial history and repeatability
|
||
|
||
| Trial | Duration | Packets | Complete BFI reports | Interpretation |
|
||
|---|---:|---:|---:|---|
|
||
| Two upstream fixes, beacon control | 10.028991 s | 90 | 0 | Target beacons received |
|
||
| Two upstream fixes, management | 45.017814 s | 428 | 0 | Phone later found on another band |
|
||
| Confirmed 5 GHz client, management | 45.015680 s | 425 | 0 | Beacons only |
|
||
| Two upstream fixes, link diagnostic | 20.022820 s | 1,798 | 0 | Client BlockAck received; no target downlink data |
|
||
| Additional RX-filter experiment, link diagnostic | 20.027742 s | 1,635 | 0 | 450 target downlink HE QoS frames received |
|
||
| Validated management capture | 45.033402 s | 473 | 21 | All reports independently matched |
|
||
| Same settings and traffic, repeat | 45.029207 s | 451 | 0 | Sustained sampling not established |
|
||
| Reproducible runner validation | 45.027231 s | 446 | 0 | Traffic timing and cleanup verified |
|
||
|
||
All listed runs reported zero kernel drops and restored Wi-Fi. The 22 HE triggers
|
||
in the second link diagnostic were Basic or Buffer Status Report Poll triggers;
|
||
none requested beamforming feedback. Advertised beamformer capability and such
|
||
triggers are not counted as valid reports.
|
||
|
||
The final hardware run used `run_trial_linux.py`, including its expected-client
|
||
checks, explicit Ethernet selection and active-capture marker. It sent 7,380
|
||
datagrams (8,856,000 bytes) over 30.002116 seconds, averaging 245.982650 packets
|
||
per second. The complete traffic interval fell inside capture. The marker was
|
||
removed and Wi-Fi restoration verified. This validates the runner's observed
|
||
operation; its empty report set is another negative BFI observation.
|
||
|
||
Earlier original-driver captures produced no target packets. One separate broad
|
||
diagnostic briefly received packets without retaining them, and one setup attempt
|
||
failed with `EBUSY` without creating a capture. Neither counts as BFI evidence.
|
||
The setup failure was followed by a correction that verifies NetworkManager
|
||
release before changing interface type.
|
||
|
||
## Reproduce and audit
|
||
|
||
Follow [README.md](README.md) and the driver build/rollback procedure. Use the
|
||
verified own-network addresses in private commands. Retain the capture manifest,
|
||
traffic interval, original connection state, loaded module source versions and
|
||
source hashes with the raw PCAP outside Git.
|
||
The README includes the bounded synchronized traffic runner. Capture manifests
|
||
now also record the original connection UUID for recovery; this metadata field
|
||
was added after the measured runs, which verified that UUID internally.
|
||
|
||
```bash
|
||
python3 tools/bfi/bfi_decode.py /private/path/capture.pcap \
|
||
--ap <own-ap-bssid> --duration <manifest-capture-seconds> --kernel-drops 0
|
||
python3 tools/bfi/compare_tshark.py /private/path/capture.pcap \
|
||
--ap <own-ap-bssid> --max-reports 64
|
||
```
|
||
|
||
The successful real capture returns `DECODED_REPORTS` and `MATCH`, with 21 reports
|
||
compared. The repeat returns `NO_FEEDBACK_REPORTS` and `NO_SUPPORTED_REPORTS`;
|
||
an empty report set does not pass. JSON comparison results and receipts were
|
||
retained beside both private captures. Source-level decoding success always
|
||
retains `requires_independent_capture_verification`; a checked artifact does not
|
||
validate unrelated future input.
|
||
|
||
Capture SHA-256:
|
||
|
||
- Validated: `461035ba62b8f0d1de18abb694240c5bd074eeeb522c02e866f47b95569e6344`
|
||
- Repeat: `f9fda1665dbd503c4d92b4758a140b520f64da37ab5f08b56fe82ce58cb9b402`
|
||
- Runner validation: `f5b6579d4ae1c756fbd9d39479f2659c2f79f8fa613da1a1377f32b6bc179f43`
|
||
- Beacon control: `586f6990c6c44426452a00275a0d0ef623a29fb908615265f2f22af0672f1427`
|
||
- First management capture: `1cce229395e7c8e40007d48bbd9247cf484a763b45b5a27397644cd2c848d1cf`
|
||
|
||
## Software validation
|
||
|
||
The unit tests use **SYNTHETIC** packet fixtures and mocked hardware commands.
|
||
Run the command in [README.md](README.md#validation) for the current test count.
|
||
Coverage includes a separately derived nonzero cross-byte angle vector, matrix
|
||
elements, FCS/truncation rejection, unsupported formats, rate accounting,
|
||
interruption cleanup, and restoration races.
|
||
|
||
`compare_tshark.py --self-test` also matched four **SYNTHETIC** literal fixtures
|
||
against Ubuntu tshark 4.2.2: VHT and HE with both SU codebooks, every integer angle,
|
||
selected MIMO controls, and signed SNR endpoints. VHT fixtures contained 62 angle
|
||
pairs and HE fixtures 250. These synthetic checks do not extend the real-radio
|
||
claim beyond the captured HE format above.
|