[PATCH] wifi: iwlwifi: mvm: handle SEC_UNKNOWN in non-AMPDU rx path
From: Mike Bommarito <hidden>
Date: 2026-05-23 14:25:13
Also in:
lkml
Subsystem:
intel wireless wifi link (iwlwifi), the rest · Maintainers:
Miri Korenblit, Linus Torvalds
iwl_mvm_rx_crypto() does not handle IWL_RX_MPDU_STATUS_SEC_UNKNOWN explicitly in the non-AMPDU path: the switch's default case fires "Unhandled alg: 0x71b" for what the firmware documents as a benign condition (a cipher class not enumerated in the RX status field, or frames arriving before key install). On a Meteor Lake laptop with an AX210 this produced 152 warnings across ~43.5 hours of normal use; net_ratelimit spaced them out but did not silence them. The AMPDU sibling path at the top of the function already handles this status explicitly. Add an explicit SEC_UNKNOWN case that breaks to the final return 0 (passing the frame undecrypted to mac80211, matching the default's effective behavior), with a dev_info_once() so the condition stays observable at default log levels without per-frame spam, and an IWL_DEBUG_DROP per occurrence mirroring the AMPDU handler. Behavior for every other status value is unchanged. Link: https://lore.kernel.org/all/0e1a890d2896791d7291f0174cc0e96832d7ed33.camel@intel.com/ (local) Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Mike Bommarito <redacted> --- Historical context (for reviewers, not the changelog) The same warning was reported on Intel 9260 in 2019 [1]. Emmanuel Grumbach acknowledged then that "this print is harmless really", attributed it to a deprecated firmware flag, and suggested two fixes: "remove the warning message entirely or limit it to unicast packets only -- this has been merged in our internal repository and it will be upstreamed following the regular process." The unicast restriction is now in tree (the default case guards on !is_multicast_ether_addr() && net_ratelimit()), but the remove-the-warning half never landed upstream. This patch is the narrower of Grumbach's two suggestions: only IWL_RX_MPDU_STATUS_SEC_UNKNOWN is special-cased, the existing default-case warning is preserved for genuinely unknown status values. Test data Pre-patch baseline on Framework Laptop 13 (Intel Core Ultra 5 125H, AX210, Linux 7.1-rc4): 152 "Unhandled alg: 0x71b" entries in dmesg across ~43.5 hours of mixed use, plus a burst of three within 70 ms during a single re-association: [162152.782317] iwlwifi 0000:aa:00.0: Unhandled alg: 0x71b [162152.813440] iwlwifi 0000:aa:00.0: Unhandled alg: 0x71b [162152.844499] iwlwifi 0000:aa:00.0: Unhandled alg: 0x71b Status decoding: 0x71b & 0x700 == SEC_UNKNOWN; low bits are informational and vary between frames. Post-patch: module rebuilt + reloaded. Triggered scans and nmcli reconnect cycles until a SEC_UNKNOWN frame was received. The new switch case fired its dev_info_once exactly once: iwlwifi 0000:aa:00.0: RX SEC_UNKNOWN (status=0x707) Zero "Unhandled alg" warnings observed during the same window. A CONFIG_IWLWIFI_DEBUG=y build with IWL_DL_DROP enabled would additionally show one IWL_DEBUG_DROP per qualifying frame; the test kernel had CONFIG_IWLWIFI_DEBUG=n so those entries are absent but the dev_info_once carries the per-controller signature. drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 7f0b4f5daa21..f36e99c90ee3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c@@ -494,6 +494,19 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta, return 0; case RX_MPDU_RES_STATUS_SEC_CMAC_GMAC_ENC: break; + case IWL_RX_MPDU_STATUS_SEC_UNKNOWN: + /* + * Firmware-indicated unknown cipher; the AMPDU case is + * already handled at the top of this function. For + * non-AMPDU frames this is valid (cipher not enumerated + * by the RX status field, or frame before key install). + * Pass undecrypted to mac80211. + */ + dev_info_once(mvm->dev, + "RX SEC_UNKNOWN (status=0x%x)\n", status); + IWL_DEBUG_DROP(mvm, + "RX SEC_UNKNOWN (status=0x%x)\n", status); + break; default: /* * Sometimes we can get frames that were not decrypted
--
2.53.0