Harden RSSI connection negotiation

[bengineerd]

Description

Harden RSSI connection parameter negotiation and retry timeout handling.

RssiConnFsm previously converted peer-provided maxOutsSeg and maxSegSize values into integer window/buffer state before checking that those values were legal. A peer SYN or SYN+ACK with zero outstanding segments, an undersized segment size, or zero timeout fields could therefore produce illegal local state or simulation range errors instead of following the normal RSSI negotiation/reject path.

The retry wait states also incremented timeoutCntr before testing for the retransmission timeout boundary. Since the counter range is constrained to 0 .. RETRANS_TOUT_G * SAMPLES_PER_TIME_C, the exact timeout edge could drive the next-state value past the declared range.

This changes RssiConnFsm to validate peer parameters before accepting or negotiating them, clamp negotiated window and buffer sizes to legal local implementation ranges, and saturate the retry timeout counter at the timeout threshold. The connection FSM regression is ungated now that these cases pass.

Details

This fix is necessary because connection parameters are protocol inputs. The FSM should either accept a legal peer proposal, propose local parameters from the server side, or reject/reset from the client side. It should not rely on downstream integer range constraints to catch illegal protocol values.

This has usually worked until now because normal peers advertise nonzero window and timeout fields and segment sizes that match the local configuration. The failure mode appears with directed tests that inject out-of-range SYN/SYN+ACK parameters, or with very small timeout generics where the retry counter reaches its declared boundary exactly.

The relevant protocol intent is:

• SYN and SYN+ACK carry the connection parameter proposal/response.
• Version, checksum-enable, and timeout-unit are compatibility fields that must match for this SURF RSSI profile.
• Outstanding-segment count, segment size, and timeout fields must be usable local values before the connection can open.
• Missing SYN/SYN+ACK/ACK responses should cause bounded retransmission attempts and then close, not counter overflow.

The Rogue RSSI controller follows the same broad model:

• the closed/wait-for-SYN state consumes SYN/SYN+ACK parameters and moves either toward SYN+ACK or sequence ACK in Controller.cpp;
• when no peer response arrives, the active opener generates SYN frames from local configured parameters after the retry period in Controller.cpp;
• the SYN+ACK response is generated from the current negotiated/local parameter record in Controller.cpp;
• the background state machine waits on elapsed time rather than incrementing a bounded RTL counter, so it does not have the hardware counter-overflow failure mode fixed here in Controller.cpp.

So this PR keeps the RTL behavior aligned with the intended RSSI connection flow while making the hardware-specific integer and counter bounds explicit.

Validation:

./.venv/bin/python -B -m pytest -q -p no:cacheprovider tests/protocols/rssi/test_RssiConnFsm.py
2 passed
./.venv/bin/python -B -m pytest -q -p no:cacheprovider tests/protocols/rssi
4 passed, 19 skipped
./.venv/bin/vsg -c vsg-linter.yml -f protocols/rssi/v1/rtl/RssiConnFsm.vhd protocols/rssi/v1/wrappers/RssiConnFsmWrapper.vhd
0 violations
git diff --check
clean