[PATCH 1/2] wifi: iwlwifi: mvm: Fix GP2 to nanoseconds overflow on 32-bit
From: Zhan Xusheng <hidden>
Date: 2026-08-05 08:26:48
Also in:
linux-wireless, lkml
Subsystem:
intel wireless wifi link (iwlwifi), the rest · Maintainers:
Miri Korenblit, Linus Torvalds
GP2 is a free-running 32-bit microsecond hardware counter. The PTP code
converts a u32 GP2 value to nanoseconds as:
gp2 * NSEC_PER_USEC
NSEC_PER_USEC is a plain 'long' (1000L), so on 32-bit builds this
multiplication is evaluated in 32-bit arithmetic and overflows once the
GP2 value exceeds ~4.29 million microseconds (~4.3 s). GP2 wraps only
every 2^32 microseconds (~71.5 min), so the product is truncated for
almost the entire counter range, producing bogus PTP timestamps.
Neighbouring conversions already cast to u64 first (e.g.
(u64)gp2 * NSEC_PER_USEC); these sites just missed the cast. Cast to u64
so the multiplication is performed in 64-bit, matching the existing call
sites. 64-bit builds are unaffected.
Fixes: a2f49f7d52a9 ("wifi: iwlwifi: mvm: implement PHC clock adjustments")
Fixes: 0e49e940d1bc ("wifi: iwlwifi: mvm: add an option to use ptp clock for rx timestamp")
Signed-off-by: Zhan Xusheng <redacted>
---
drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 4 ++--
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index 49dcb1388007..5f33e2f8fb2a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c@@ -47,7 +47,7 @@ static void iwl_mvm_ptp_update_new_read(struct iwl_mvm *mvm, u32 gp2) u64 iwl_mvm_ptp_get_adj_time(struct iwl_mvm *mvm, u64 base_time_ns) { struct ptp_data *data = &mvm->ptp_data; - u64 last_gp2_ns = mvm->ptp_data.scale_update_gp2 * NSEC_PER_USEC; + u64 last_gp2_ns = (u64)mvm->ptp_data.scale_update_gp2 * NSEC_PER_USEC; u64 res; u64 diff;
@@ -259,7 +259,7 @@ static int iwl_mvm_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm) */ gp2 = iwl_mvm_get_systime(mvm); data->scale_update_adj_time_ns = - iwl_mvm_ptp_get_adj_time(mvm, gp2 * NSEC_PER_USEC); + iwl_mvm_ptp_get_adj_time(mvm, (u64)gp2 * NSEC_PER_USEC); data->scale_update_gp2 = gp2; data->wrap_counter = 0; data->delta = 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 7f0b4f5daa21..7c21cd89db93 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c@@ -2016,8 +2016,8 @@ static void iwl_mvm_rx_fill_status(struct iwl_mvm *mvm, rx_status->device_timestamp = phy_data->gp2_on_air_rise; if (mvm->rx_ts_ptp && mvm->monitor_on) { - u64 adj_time = - iwl_mvm_ptp_get_adj_time(mvm, phy_data->gp2_on_air_rise * NSEC_PER_USEC); + u64 gp2_ns = (u64)phy_data->gp2_on_air_rise * NSEC_PER_USEC; + u64 adj_time = iwl_mvm_ptp_get_adj_time(mvm, gp2_ns); rx_status->mactime = div64_u64(adj_time, NSEC_PER_USEC); rx_status->flag |= RX_FLAG_MACTIME_IS_RTAP_TS64;
--
2.43.0