[Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Sergey Temerkhanov]

Rework usage of the control PF pointer in struct ice_adapter, so that
it is always has a consistent state, since it is global for an adapter.
Utilize RCU for reading the pointer value and atomic operations for
changing it. Zero out the ctrl_pf pointer when the control PF is removed.

Sergey Temerkhanov (3):
  ice: Convert ctrl_pf pointer in struct ice_adapter to RCU
  ice: Zero out the PTP control PF pointer at ice_adapter cleanup
  ice: Cache struct ice_hw pointer for split register reads

 drivers/net/ethernet/intel/ice/ice.h         | 10 ++-
 drivers/net/ethernet/intel/ice/ice_adapter.h |  2 +-
 drivers/net/ethernet/intel/ice/ice_ptp.c     | 66 +++++++++++++++++---
 drivers/net/ethernet/intel/ice/ice_ptp_hw.c  | 26 ++++++--
 4 files changed, 89 insertions(+), 15 deletions(-)

-- 
2.53.0

[Intel-wired-lan] [PATCH iwl-net v1 1/3] ice: Convert ctrl_pf pointer in struct ice_adapter to RCU

[Sergey Temerkhanov]

Use RCU to ensure the consistent state of the control PF global
pointer contained in struct ice_adapter. Enforce RCU usage on
the callers.

Fix a potential invalid pointer return due a TOCTOU issue

Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices")

Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
---
 drivers/net/ethernet/intel/ice/ice.h         | 10 +++-
 drivers/net/ethernet/intel/ice/ice_adapter.h |  2 +-
 drivers/net/ethernet/intel/ice/ice_ptp.c     | 49 ++++++++++++++++----
 drivers/net/ethernet/intel/ice/ice_ptp_hw.c  |  9 ++++
 4 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 804f5aa8e9f5..2b2787d16c33 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -40,6 +40,7 @@
 #include <linux/cpu_rmap.h>
 #include <linux/dim.h>
 #include <linux/gnss.h>
+#include <linux/rcupdate.h>
 #include <net/pkt_cls.h>
 #include <net/pkt_sched.h>
 #include <net/tc_act/tc_mirred.h>
@@ -1145,14 +1146,19 @@ static inline bool ice_pf_src_tmr_owned(struct ice_pf *pf)
  * ice_get_primary_hw - Get pointer to primary ice_hw structure
  * @pf: pointer to PF structure
  *
+ * The function must be called from an RCU read-side critical section.
+ * hw is embedded in struct ice_pf, so it is protected by the RCU.
+ *
  * Return: A pointer to ice_hw structure with access to timesync
  * register space.
  */
 static inline struct ice_hw *ice_get_primary_hw(struct ice_pf *pf)
 {
-	if (!pf->adapter->ctrl_pf)
+	struct ice_pf *ctrl_pf = rcu_dereference(pf->adapter->ctrl_pf);
+
+	if (!ctrl_pf)
 		return &pf->hw;
 	else
-		return &pf->adapter->ctrl_pf->hw;
+		return &ctrl_pf->hw;
 }
 #endif /* _ICE_H_ */
diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.h b/drivers/net/ethernet/intel/ice/ice_adapter.h
index e95266c7f20b..349d49d57f11 100644
--- a/drivers/net/ethernet/intel/ice/ice_adapter.h
+++ b/drivers/net/ethernet/intel/ice/ice_adapter.h
@@ -42,7 +42,7 @@ struct ice_adapter {
 	/* For access to GLCOMM_QTX_CNTX_CTL register */
 	spinlock_t txq_ctx_lock;
 
-	struct ice_pf *ctrl_pf;
+	struct ice_pf __rcu *ctrl_pf;
 	struct ice_port_list ports;
 	u64 index;
 };
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 36e2223c37b8..1114a862c27b 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -4,6 +4,7 @@
 #include "ice.h"
 #include "ice_lib.h"
 #include "ice_trace.h"
+#include <linux/rcupdate.h>
 
 static const char ice_pin_names[][64] = {
 	"SDP0",
@@ -54,11 +55,35 @@ static const struct ice_ptp_pin_desc ice_pin_desc_dpll[] = {
 	{  SDP3, {  3, -1 }, { 0, 0 }},
 };
 
+/**
+ * ice_get_ctrl_pf - Get the control PF for a given PF
+ * @pf: The PF pointer to look up at
+ *
+ * The control PF is the PF which owns the PTP clock for the adapter.
+ * Only the control PF is allowed to perform certain operations on the
+ * PTP clock such as adjusting the time or configuring the pins.
+ *
+ * This function must be called from an RCU read-side critical section.
+ *
+ * Return: Pointer to the control PF, or NULL if not found
+ */
 static struct ice_pf *ice_get_ctrl_pf(struct ice_pf *pf)
 {
-	return !pf->adapter ? NULL : pf->adapter->ctrl_pf;
+	return !pf->adapter ? NULL : rcu_dereference(pf->adapter->ctrl_pf);
 }
 
+/**
+ * ice_get_ctrl_ptp - Get the PTP structure for the control PF
+ * @pf: The PF pointer to look up at
+ *
+ * The control PF is the PF which owns the PTP clock for the adapter.
+ * Only the control PF is allowed to perform certain operations on the
+ * PTP clock such as adjusting the time or configuring the pins.
+ *
+ * This function must be called from an RCU read-side critical section.
+ *
+ * Return: Pointer to the PTP structure of the control PF, or NULL if not found
+ */
 static struct ice_ptp *ice_get_ctrl_ptp(struct ice_pf *pf)
 {
 	struct ice_pf *ctrl_pf = ice_get_ctrl_pf(pf);
@@ -207,6 +232,8 @@ u64 ice_ptp_read_src_clk_reg(struct ice_pf *pf,
 	u32 hi, lo, lo2;
 	u8 tmr_idx;
 
+	guard(rcu)();
+
 	if (!ice_is_primary(hw))
 		hw = ice_get_primary_hw(pf);
 
@@ -3074,18 +3101,19 @@ void ice_ptp_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type)
 
 static void ice_ptp_setup_adapter(struct ice_pf *pf)
 {
-	pf->adapter->ctrl_pf = pf;
+	rcu_assign_pointer(pf->adapter->ctrl_pf, pf);
 }
 
 static int ice_ptp_setup_pf(struct ice_pf *pf)
 {
-	struct ice_ptp *ctrl_ptp = ice_get_ctrl_ptp(pf);
 	struct ice_ptp *ptp = &pf->ptp;
 
-	if (!ctrl_ptp) {
-		dev_info(ice_pf_to_dev(pf),
-			 "PTP unavailable: no controlling PF\n");
-		return -EOPNOTSUPP;
+	scoped_guard(rcu) {
+		if (!ice_get_ctrl_ptp(pf)) {
+			dev_info(ice_pf_to_dev(pf),
+				 "PTP unavailable: no controlling PF\n");
+			return -EOPNOTSUPP;
+		}
 	}
 
 	if (pf->hw.mac_type == ICE_MAC_UNKNOWN)
@@ -3121,11 +3149,16 @@ static void ice_ptp_cleanup_pf(struct ice_pf *pf)
  */
 int ice_ptp_clock_index(struct ice_pf *pf)
 {
-	struct ice_ptp *ctrl_ptp = ice_get_ctrl_ptp(pf);
+	struct ice_ptp *ctrl_ptp;
 	struct ptp_clock *clock;
 
+	guard(rcu)();
+
+	ctrl_ptp = ice_get_ctrl_ptp(pf);
+
 	if (!ctrl_ptp)
 		return -1;
+
 	clock = ctrl_ptp->clock;
 
 	return clock ? ptp_clock_index(clock) : -1;
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
index a1ec5d617aa0..892bcc50e82f 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright (C) 2021, Intel Corporation. */
 
+#include <linux/cleanup.h>
 #include <linux/delay.h>
 #include <linux/iopoll.h>
 #include "ice_common.h"
@@ -351,6 +352,8 @@ void ice_ptp_src_cmd(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd)
 	struct ice_pf *pf = container_of(hw, struct ice_pf, hw);
 	u32 cmd_val = ice_ptp_tmr_cmd_to_src_reg(hw, cmd);
 
+	guard(rcu)();
+
 	if (!ice_is_primary(hw))
 		hw = ice_get_primary_hw(pf);
 
@@ -369,6 +372,8 @@ static void ice_ptp_exec_tmr_cmd(struct ice_hw *hw)
 {
 	struct ice_pf *pf = container_of(hw, struct ice_pf, hw);
 
+	guard(rcu)();
+
 	if (!ice_is_primary(hw))
 		hw = ice_get_primary_hw(pf);
 
@@ -1983,6 +1988,8 @@ static int ice_read_phy_and_phc_time_eth56g(struct ice_hw *hw, u8 port,
 		zo = rd32(hw, GLTSYN_SHTIME_0(tmr_idx));
 		lo = rd32(hw, GLTSYN_SHTIME_L(tmr_idx));
 	} else {
+		guard(rcu)();
+
 		zo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_0(tmr_idx));
 		lo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_L(tmr_idx));
 	}
@@ -2152,6 +2159,8 @@ int ice_start_phy_timer_eth56g(struct ice_hw *hw, u8 port)
 		lo = rd32(hw, GLTSYN_INCVAL_L(tmr_idx));
 		hi = rd32(hw, GLTSYN_INCVAL_H(tmr_idx));
 	} else {
+		guard(rcu)();
+
 		lo = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_L(tmr_idx));
 		hi = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_H(tmr_idx));
 	}
-- 
2.53.0

[Intel-wired-lan] [PATCH iwl-net v1 2/3] ice: Zero out the PTP control PF pointer at ice_adapter cleanup

[Sergey Temerkhanov]

Zero out the ctrl_pf pointer in ice_adapter when the control PF is removed.
This prevents potential dangling pointer dereference when accessing
PTP-related structures from other PFs of the same adapter.

Fixes: e800654e85b5b ("ice: Use ice_adapter for PTP shared data instead of auxdev")

Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reported-by: Frederick Lawler <fred@cloudflare.com>
Closes: https://lkml.indiana.edu/2507.3/01388.html
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
---
 drivers/net/ethernet/intel/ice/ice_ptp.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 1114a862c27b..68e87e267825 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -3104,6 +3104,18 @@ static void ice_ptp_setup_adapter(struct ice_pf *pf)
 	rcu_assign_pointer(pf->adapter->ctrl_pf, pf);
 }
 
+static void ice_ptp_cleanup_adapter(struct ice_pf *pf)
+{
+	/* Zero out adapter->ctrl_pf pointer when the ctrl_pf itself
+	 * is being removed to prevent any secondary PFs from accessing
+	 * it after it is deleted.
+	 */
+	if (cmpxchg(&pf->adapter->ctrl_pf,
+		    (struct ice_pf __rcu *)pf, NULL) ==
+			(struct ice_pf __rcu *)pf)
+		synchronize_rcu();
+}
+
 static int ice_ptp_setup_pf(struct ice_pf *pf)
 {
 	struct ice_ptp *ptp = &pf->ptp;
@@ -3384,6 +3396,8 @@ void ice_ptp_init(struct ice_pf *pf)
 err_clean_pf:
 	mutex_destroy(&ptp->port.ps_lock);
 	ice_ptp_cleanup_pf(pf);
+
+	ice_ptp_cleanup_adapter(pf);
 err_exit:
 	/* If we registered a PTP clock, release it */
 	if (pf->ptp.clock) {
@@ -3412,6 +3426,7 @@ void ice_ptp_release(struct ice_pf *pf)
 	if (pf->ptp.state != ICE_PTP_READY) {
 		mutex_destroy(&pf->ptp.port.ps_lock);
 		ice_ptp_cleanup_pf(pf);
+		ice_ptp_cleanup_adapter(pf);
 		if (pf->ptp.clock) {
 			ptp_clock_unregister(pf->ptp.clock);
 			pf->ptp.clock = NULL;
@@ -3426,6 +3441,8 @@ void ice_ptp_release(struct ice_pf *pf)
 
 	ice_ptp_cleanup_pf(pf);
 
+	ice_ptp_cleanup_adapter(pf);
+
 	ice_ptp_release_tx_tracker(pf, &pf->ptp.port.tx);
 
 	ice_ptp_disable_all_extts(pf);
-- 
2.53.0

[Intel-wired-lan] [PATCH iwl-net v1 3/3] ice: Cache struct ice_hw pointer for split register reads

[Sergey Temerkhanov]

Cache the primary ice_hw pointer to ensure consistency between
calls (both parts of a value will be read from the same NAC).
ice_get_primary_hw() will never return NULL, but during the
ctrl_pf cleanup there may be a case when one call will return
the pointer to the ctrl_pf->hw and the subsequent one - to the
pf->hw which generally are not the same.
Struct ice_hw is embedded in the struct ice_pf so it is protected
by the same critical section - no additional synchronization is
needed.

Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices")

Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
---
 drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
index 892bcc50e82f..95238224b59a 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c
@@ -4,6 +4,7 @@
 #include <linux/cleanup.h>
 #include <linux/delay.h>
 #include <linux/iopoll.h>
+#include "ice.h"
 #include "ice_common.h"
 #include "ice_ptp_hw.h"
 #include "ice_ptp_consts.h"
@@ -1988,10 +1989,14 @@ static int ice_read_phy_and_phc_time_eth56g(struct ice_hw *hw, u8 port,
 		zo = rd32(hw, GLTSYN_SHTIME_0(tmr_idx));
 		lo = rd32(hw, GLTSYN_SHTIME_L(tmr_idx));
 	} else {
+		struct ice_hw *pri_hw;
+
 		guard(rcu)();
 
-		zo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_0(tmr_idx));
-		lo = rd32(ice_get_primary_hw(pf), GLTSYN_SHTIME_L(tmr_idx));
+		pri_hw = ice_get_primary_hw(pf);
+
+		zo = rd32(pri_hw, GLTSYN_SHTIME_0(tmr_idx));
+		lo = rd32(pri_hw, GLTSYN_SHTIME_L(tmr_idx));
 	}
 	*phc_time = (u64)lo << 32 | zo;
 
@@ -2159,10 +2164,14 @@ int ice_start_phy_timer_eth56g(struct ice_hw *hw, u8 port)
 		lo = rd32(hw, GLTSYN_INCVAL_L(tmr_idx));
 		hi = rd32(hw, GLTSYN_INCVAL_H(tmr_idx));
 	} else {
+		struct ice_hw *pri_hw;
+
 		guard(rcu)();
 
-		lo = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_L(tmr_idx));
-		hi = rd32(ice_get_primary_hw(pf), GLTSYN_INCVAL_H(tmr_idx));
+		pri_hw = ice_get_primary_hw(pf);
+
+		lo = rd32(pri_hw, GLTSYN_INCVAL_L(tmr_idx));
+		hi = rd32(pri_hw, GLTSYN_INCVAL_H(tmr_idx));
 	}
 	incval = (u64)hi << 32 | lo;
 
-- 
2.53.0

Re: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Temerkhanov, Sergey]

The patches are based on the https://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue.git dev-queue branch

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
> Sergey Temerkhanov
> Sent: Monday, May 4, 2026 1:01 PM
> To: intel-wired-lan@lists.osuosl.org
> Subject: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage
> in struct ice_adapter
> 
> Rework usage of the control PF pointer in struct ice_adapter, so that it is
> always has a consistent state, since it is global for an adapter.
> Utilize RCU for reading the pointer value and atomic operations for changing it.
> Zero out the ctrl_pf pointer when the control PF is removed.
> 
> Sergey Temerkhanov (3):
>   ice: Convert ctrl_pf pointer in struct ice_adapter to RCU
>   ice: Zero out the PTP control PF pointer at ice_adapter cleanup
>   ice: Cache struct ice_hw pointer for split register reads
> 
>  drivers/net/ethernet/intel/ice/ice.h         | 10 ++-
>  drivers/net/ethernet/intel/ice/ice_adapter.h |  2 +-
>  drivers/net/ethernet/intel/ice/ice_ptp.c     | 66 +++++++++++++++++---
>  drivers/net/ethernet/intel/ice/ice_ptp_hw.c  | 26 ++++++--
>  4 files changed, 89 insertions(+), 15 deletions(-)
> 
> --
> 2.53.0

Re: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Frederick Lawler via Intel-wired-lan]

Hi Sergey,

On Mon, May 04, 2026 at 11:00:55AM +0000, Sergey Temerkhanov wrote:
> Rework usage of the control PF pointer in struct ice_adapter, so that
> it is always has a consistent state, since it is global for an adapter.
> Utilize RCU for reading the pointer value and atomic operations for
> changing it. Zero out the ctrl_pf pointer when the control PF is removed.
> 

I'd like to test this series, but I'm having a hard time backporting to
6.18. Is there any prior work I might need to pull in?

Best,
Fred

Re: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Jacob Keller]

On 5/4/2026 4:00 AM, Sergey Temerkhanov wrote:
> Rework usage of the control PF pointer in struct ice_adapter, so that
> it is always has a consistent state, since it is global for an adapter.
> Utilize RCU for reading the pointer value and atomic operations for
> changing it. Zero out the ctrl_pf pointer when the control PF is removed.
> 
> Sergey Temerkhanov (3):
>   ice: Convert ctrl_pf pointer in struct ice_adapter to RCU
>   ice: Zero out the PTP control PF pointer at ice_adapter cleanup
>   ice: Cache struct ice_hw pointer for split register reads
> 
>  drivers/net/ethernet/intel/ice/ice.h         | 10 ++-
>  drivers/net/ethernet/intel/ice/ice_adapter.h |  2 +-
>  drivers/net/ethernet/intel/ice/ice_ptp.c     | 66 +++++++++++++++++---
>  drivers/net/ethernet/intel/ice/ice_ptp_hw.c  | 26 ++++++--
>  4 files changed, 89 insertions(+), 15 deletions(-)
> 

What base tree did you apply this to? It doesn't apply directly to net,
net-next, or either the tip of dev-queue for iwl-net or iwl-next.

It looks like you have this in your context:

>  static void ice_ptp_setup_adapter(struct ice_pf *pf)
>  {
> -	pf->adapter->ctrl_pf = pf;
> +	rcu_assign_pointer(pf->adapter->ctrl_pf, pf);
>  }
>  


But the ice_ptp_setup_adapter() function has other logic that has been
there since its existence?

Could you please rebase and make a v2 which applies cleanly to the
current tree? I don't want to make a mistake while attempting to resolve
conflicts for a change with this big of a scope.

Thanks,
Jake

Re: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Temerkhanov, Sergey]

> -----Original Message-----
> 
> But the ice_ptp_setup_adapter() function has other logic that has been there
> since its existence?

There used to be a timer ownership check that got removed in commit
ba694e66889c0ad15b06ae60175e1e958a0691c1 ("ice: remove redundant checks from PTP init")
in late February.

> 
> Could you please rebase and make a v2 which applies cleanly to the current
> tree? I don't want to make a mistake while attempting to resolve conflicts for a
> change with this big of a scope.

The changeset got rebased without any conflicts on top of commit
5c0d2ac5900d689d422a31cd45073175150c0a39 ("ixgbe: E610: do not fill EEE lp_advertised from local PHY caps")
Sending a rebased v2 series.

Regards,
Sergey

Re: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Temerkhanov, Sergey]

> I'd like to test this series, but I'm having a hard time backporting to 6.18. Is
> there any prior work I might need to pull in?

It sufficed to cherry-pick the commit
ba694e66889c0ad15b06ae60175e1e958a0691c1 ("ice: remove redundant checks from PTP init")
from the https://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue.git repository on top
of the v6.18.28 tag to successfully run 'git am' on the subject series.

Regards,
Sergey

Re: [Intel-wired-lan] [PATCH iwl-net v1 0/3] Rework ctrl_pf pointer usage in struct ice_adapter

[Frederick Lawler via Intel-wired-lan]

On Fri, May 08, 2026 at 11:33:12AM +0000, Temerkhanov, Sergey wrote:
> 
> 
> > I'd like to test this series, but I'm having a hard time backporting to 6.18. Is
> > there any prior work I might need to pull in?
> 
> It sufficed to cherry-pick the commit
> ba694e66889c0ad15b06ae60175e1e958a0691c1 ("ice: remove redundant checks from PTP init")
> from the https://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue.git repository on top
> of the v6.18.28 tag to successfully run 'git am' on the subject series.
> 
> Regards,
> Sergey

Managed to backport to 6.18.27, and ran the reproducer from [1] and
abuse echo "1" | tee /sys/.../reset in a loop with ethtool querying
the device information. Seems OK to me.

[1]: https://lore.kernel.org/all/aIKWoZzEPoa1omlw@CMGLRV3/
Tested-by: Frederick Lawler <fred@cloudflare.com>

Thanks again,
Fred