GP2 timestamps are u32 microsecond values and NSEC_PER_USEC is 1000L, so
on 32-bit five conversions are computed in 32-bit arithmetic and truncated
before being assigned to u64.  A GP2 value above U32_MAX / 1000, i.e.
4.295 s, wraps; GP2 wraps every 2^32 us, so almost its whole range is
affected.

The same files already cast four other conversions, so this is just the
remaining ones:

	gp2_ns = iwl_mvm_ptp_get_adj_time(mvm, (u64)gp2 * NSEC_PER_USEC);

Changes since v1:

 - Added the generated-code evidence below instead of "Found by code
   inspection"
 - Rebased on iwlwifi-next; no code change
 - v1 was sent with the wrong From: address

On i386, iwl_mld_ptp_get_adj_time() changes from a 32-bit product to a
32x32->64 one:

	before: imul   $0x3e8,0x17d8(%eax),%ecx
	after:  mull   0x17d8(%ebx)

0x3e8 is NSEC_PER_USEC.  A standalone _Static_assert() replica confirms the
arithmetic: with gp2 = 4294968 us, the current form gives 704 ns on 32-bit
instead of 4294968000.

mvm/ptp.c:219 already uses a u64 gp2 and is left alone.  The
wrap_counter * IWL_PTP_GP2_WRAP * NSEC_PER_USEC products are fine because
IWL_PTP_GP2_WRAP is 0x100000000ULL.

Built for x86-64 and i386 with IWLMVM=m and IWLMLD=m; checkpatch --strict
is clean on both patches.

v1: https://patch.msgid.link/20260805082515.4136842-1-zhanxusheng@xiaomi.com

Zhan Xusheng (2):
  wifi: iwlwifi: mvm: Fix GP2 to nanoseconds overflow on 32-bit
  wifi: iwlwifi: mld: Fix GP2 to nanoseconds overflow on 32-bit

 drivers/net/wireless/intel/iwlwifi/mld/ptp.c  | 5 +++--
 drivers/net/wireless/intel/iwlwifi/mvm/ptp.c  | 4 ++--
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 4 +++-
 3 files changed, 8 insertions(+), 5 deletions(-)


base-commit: 90e281bd4ea3d19dd6b5af1923551648e477bd26
-- 
2.43.0