[PATCH v3 0/2] wifi: iwlwifi: Fix GP2 to nanoseconds overflow on 32-bit

[PATCH v3 0/2] wifi: iwlwifi: Fix GP2 to nanoseconds overflow on 32-bit

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

Both drivers multiply a u32 GP2 microsecond timestamp by NSEC_PER_USEC
without widening first.  On 32-bit the product truncates for any GP2
value above 4.295 s, and the truncated value is fed back into the
wraparound detector, which records a false GP2 wraparound and adds
about 71.6 minutes to every later PHC timestamp, cumulatively.

Six sites, three per driver:

  mvm/ptp.c   scale_update_gp2 in iwl_mvm_ptp_get_adj_time()
  mvm/ptp.c   gp2 in iwl_mvm_ptp_adjfine()
  mvm/rxmq.c  gp2_on_air_rise in iwl_mvm_rx_he()
  mld/ptp.c   scale_update_gp2 in iwl_mld_ptp_get_adj_time()
  mld/ptp.c   gp2 in iwl_mld_ptp_adjfine()
  mld/rx.c    gp2_on_air_rise in iwl_mld_rx_fill_status()

iwl_mvm_ptp_gettime() holds its GP2 read in a u64 and
iwl_mld_phc_get_crosstimestamp() casts, so those two are already right.

Changes since v2:

 - mvm: added scale_update_gp2 and the adjfine() site.  v2 only
   covered mvm/rxmq.c.
 - mld: added the iwl_mld_rx_fill_status() site.  v2 only covered
   mld/ptp.c while claiming parity with the mvm fix.  Reported by the
   netdev Sashiko review bot.
 - mld: iwl_mld_ptp_get_crosstimestamp() in the v2 changelog does not
   exist; the function is iwl_mld_phc_get_crosstimestamp().
 - both: state the wraparound consequence with the numbers.

No Cc: stable.  The affected intersection is 32-bit plus iwlwifi plus
PTP, so that call belongs to the maintainers.

v2: https://patch.msgid.link/20261001050103.860584-1-zhanxusheng@xiaomi.com

Zhan Xusheng (2):
  wifi: iwlwifi: mvm: Fix GP2 to nanoseconds overflow on 32-bit
  wifi: iwlwifi: mld: Fix GP2 to nanoseconds overflow on 32-bit

 drivers/net/wireless/intel/iwlwifi/mld/ptp.c  | 5 +++--
 drivers/net/wireless/intel/iwlwifi/mld/rx.c   | 2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ptp.c  | 5 +++--
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 4 +++-
 4 files changed, 10 insertions(+), 6 deletions(-)


base-commit: d6d3455d8751854e0d1820f14184682e23ac4475
-- 
2.43.0

[PATCH v3 1/2] wifi: iwlwifi: mvm: Fix GP2 to nanoseconds overflow on 32-bit

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

A GP2 timestamp is a u32 in microseconds and NSEC_PER_USEC is 1000L, so
three multiplications are evaluated in 32 bits and truncate for any GP2
value above 4.295 s:

	u64 last_gp2_ns = mvm->ptp_data.scale_update_gp2 * NSEC_PER_USEC;
	iwl_mvm_ptp_get_adj_time(mvm, gp2 * NSEC_PER_USEC);
	iwl_mvm_ptp_get_adj_time(mvm, phy_data->gp2_on_air_rise * NSEC_PER_USEC);

iwl_mvm_ptp_get_adj_time() passes its argument back to
iwl_mvm_ptp_update_new_read() in microseconds, which treats a backwards
step of at least IWL_PTP_WRAP_THRESHOLD_USEC as a GP2 wraparound and
bumps wrap_counter.  A gp2 of 10 s truncates to a 32-bit product of
1410065408 ns, i.e. 1410065 us, an 8589935 us step back, so the 5000 us
threshold is passed and a wraparound is recorded.  Each spurious
wraparound adds IWL_PTP_GP2_WRAP microseconds, about 71.6 minutes, to
every later timestamp, and the error accumulates.

iwl_mvm_ptp_gettime() already holds its GP2 read in a u64.  Cast the
three u32 sources before multiplying.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Fixes: a2f49f7d52a9 ("wifi: iwlwifi: mvm: implement PHC clock adjustments")
Fixes: 0e49e940d1bc ("wifi: iwlwifi: mvm: add an option to use ptp clock for rx timestamp")
---
 drivers/net/wireless/intel/iwlwifi/mvm/ptp.c  | 5 +++--
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 4 +++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index 49dcb1388007b..c64d6327e76f1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
@@ -47,7 +47,8 @@ static void iwl_mvm_ptp_update_new_read(struct iwl_mvm *mvm, u32 gp2)
 u64 iwl_mvm_ptp_get_adj_time(struct iwl_mvm *mvm, u64 base_time_ns)
 {
 	struct ptp_data *data = &mvm->ptp_data;
-	u64 last_gp2_ns = mvm->ptp_data.scale_update_gp2 * NSEC_PER_USEC;
+	u64 last_gp2_ns = (u64)mvm->ptp_data.scale_update_gp2 *
+			  NSEC_PER_USEC;
 	u64 res;
 	u64 diff;
 
@@ -259,7 +260,7 @@ static int iwl_mvm_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
 	 */
 	gp2 = iwl_mvm_get_systime(mvm);
 	data->scale_update_adj_time_ns =
-		iwl_mvm_ptp_get_adj_time(mvm, gp2 * NSEC_PER_USEC);
+		iwl_mvm_ptp_get_adj_time(mvm, (u64)gp2 * NSEC_PER_USEC);
 	data->scale_update_gp2 = gp2;
 	data->wrap_counter = 0;
 	data->delta = 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 7f0b4f5daa214..7a9a63a76f382 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -2017,7 +2017,9 @@ static void iwl_mvm_rx_fill_status(struct iwl_mvm *mvm,
 
 	if (mvm->rx_ts_ptp && mvm->monitor_on) {
 		u64 adj_time =
-			iwl_mvm_ptp_get_adj_time(mvm, phy_data->gp2_on_air_rise * NSEC_PER_USEC);
+			iwl_mvm_ptp_get_adj_time(mvm,
+						 (u64)phy_data->gp2_on_air_rise *
+						 NSEC_PER_USEC);
 
 		rx_status->mactime = div64_u64(adj_time, NSEC_PER_USEC);
 		rx_status->flag |= RX_FLAG_MACTIME_IS_RTAP_TS64;
-- 
2.43.0

[PATCH v3 2/2] wifi: iwlwifi: mld: Fix GP2 to nanoseconds overflow on 32-bit

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

Same problem as the mvm driver, in three places.  A GP2 timestamp is a
u32 in microseconds and NSEC_PER_USEC is 1000L, so on 32-bit

	u64 scale_time_gp2_ns = mld->ptp_data.scale_update_gp2 * NSEC_PER_USEC;
	iwl_mld_ptp_get_adj_time(mld, gp2 * NSEC_PER_USEC);
	iwl_mld_ptp_get_adj_time(mld, phy_data->gp2_on_air_rise * NSEC_PER_USEC);

are evaluated in 32 bits and truncate for any GP2 value above 4.295 s.

The last one matters most.  iwl_mld_ptp_get_adj_time() passes its
argument back to iwl_mld_ptp_update_new_read() in microseconds, which
treats a backwards step of at least IWL_PTP_WRAP_THRESHOLD_USEC as a GP2
wraparound and bumps wrap_counter.  A gp2 of 10 s truncates to a 32-bit
product of 1410065408 ns, i.e. 1410065 us, an 8589935 us step back, so
the 5000 us threshold is passed and a wraparound is recorded.  Each
spurious wraparound adds IWL_PTP_GP2_WRAP microseconds, about 71.6
minutes, to every later timestamp, and the error accumulates.

iwl_mld_ptp_gettime() and iwl_mld_phc_get_crosstimestamp() in ptp.c
already cast to u64 before multiplying.  Do the same in the three
remaining places.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
---
 drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 5 +++--
 drivers/net/wireless/intel/iwlwifi/mld/rx.c  | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
index 1ac85d6ce1d79..41ba49f525845 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
@@ -59,7 +59,8 @@ static void iwl_mld_ptp_update_new_read(struct iwl_mld *mld, u32 gp2)
 u64 iwl_mld_ptp_get_adj_time(struct iwl_mld *mld, u64 base_time_ns)
 {
 	struct ptp_data *data = &mld->ptp_data;
-	u64 scale_time_gp2_ns = mld->ptp_data.scale_update_gp2 * NSEC_PER_USEC;
+	u64 scale_time_gp2_ns = (u64)mld->ptp_data.scale_update_gp2 *
+				NSEC_PER_USEC;
 	u64 res;
 	u64 diff;
 	s64 scaled_diff;
@@ -159,7 +160,7 @@ static int iwl_mld_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
 
 	spin_lock_bh(&data->lock);
 	data->scale_update_adj_time_ns =
-		iwl_mld_ptp_get_adj_time(mld, gp2 * NSEC_PER_USEC);
+		iwl_mld_ptp_get_adj_time(mld, (u64)gp2 * NSEC_PER_USEC);
 	data->scale_update_gp2 = gp2;
 
 	/* scale_update_adj_time_ns now relects the configured delta, the
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/rx.c b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
index 269439d789f46..33c8cfa95962e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
@@ -1526,7 +1526,7 @@ static void iwl_mld_rx_fill_status(struct iwl_mld *mld, int link_id,
 		if (mld->monitor.ptp_time) {
 			u64 adj_time =
 				iwl_mld_ptp_get_adj_time(mld,
-							 phy_data->gp2_on_air_rise *
+							 (u64)phy_data->gp2_on_air_rise *
 							 NSEC_PER_USEC);
 
 			rx_status->mactime = div64_u64(adj_time, NSEC_PER_USEC);
-- 
2.43.0

Re: [PATCH v3 0/2] wifi: iwlwifi: Fix GP2 to nanoseconds overflow on 32-bit

[Zhan Xusheng]

Hi Miri,

Gentle ping on this series. Both patches still apply to v7.4-rc1, and
the six multiplications are unchanged there.

One correction to 2/2: the mld/rx.c site came in later than the
sub-driver itself, so 2/2 should also carry

Fixes: f1699ad5857d ("wifi: iwlwifi: mld: add debugfs for using ptp clock time for monitor interface")

I can send a v4 with that if you prefer.

Thanks,
Zhan Xusheng