| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/14 13:37 | flow | patch-triage |
2mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch series introduces a new PCIe driver for Nebula-matrix m18110/m18000 (SNIC s1000) series network interface cards. This hardware is a vendor-specific SmartNIC/ASIC that is not emulated in standard QEMU or GCE virtual environments, making the driver code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/14 13:37 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 6cac87f551af6462c516527ad541d6529cc40fef\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Sep 14 13:37:26 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/networking/device_drivers/ethernet/index.rst b/Documentation/networking/device_drivers/ethernet/index.rst\nindex d9980c84487a5..403ae9c2b06a9 100644\n--- a/Documentation/networking/device_drivers/ethernet/index.rst\n+++ b/Documentation/networking/device_drivers/ethernet/index.rst\n@@ -48,6 +48,7 @@ Contents:\n meta/fbnic\n microsoft/netvsc\n mucse/rnpgbe\n+ nebula-matrix/nbl\n netronome/nfp\n pensando/ionic\n pensando/ionic_rdma\ndiff --git a/Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst b/Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst\nnew file mode 100644\nindex 0000000000000..5540291cf3766\n--- /dev/null\n+++ b/Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst\n@@ -0,0 +1,28 @@\n+.. SPDX-License-Identifier: GPL-2.0\n+\n+================================================================\n+Linux Base Driver for Nebula-matrix m18110-NIC/m18000-NIC family\n+================================================================\n+\n+Overview:\n+=========\n+The m18110-NIC/m18000-NIC (marketed as SNIC s1000) is a series\n+of network interface cards for the Data Center Area.\n+\n+This driver provides the core infrastructure for m18110/m18000-NIC\n+devices, including:\n+\n+- PCI device enumeration and resource (BAR) management\n+- Firmware command interface via PF mailbox\n+- Channel-based communication between driver and firmware\n+- Device initialization and teardown\n+\n+Support\n+=======\n+\n+For more information about m18110-NIC/m18000-NIC, please visit the following URL:\n+https://www.nebula-matrix.com/snic_s1000_en\n+\n+If an issue is identified with the released source code on the supported kernel\n+with a supported adapter, email the specific information related to the issue to\n+open@nebula-matrix.com.\ndiff --git a/MAINTAINERS b/MAINTAINERS\nindex 460cb72688450..ab55ba0da0a25 100644\n--- a/MAINTAINERS\n+++ b/MAINTAINERS\n@@ -18654,6 +18654,16 @@ F:\tDocumentation/devicetree/bindings/hwmon/nuvoton,nct7363.yaml\n F:\tDocumentation/hwmon/nct7363.rst\n F:\tdrivers/hwmon/nct7363.c\n \n+NEBULA-MATRIX ETHERNET DRIVER (nebula-matrix)\n+M:\tIllusion Wang \u003cillusion.wang@nebula-matrix.com\u003e\n+M:\tDimon Zhao \u003cdimon.zhao@nebula-matrix.com\u003e\n+M:\tAlvin Wang \u003calvin.wang@nebula-matrix.com\u003e\n+M:\tSam Chen \u003csam.chen@nebula-matrix.com\u003e\n+L:\tnetdev@vger.kernel.org\n+S:\tMaintained\n+F:\tDocumentation/networking/device_drivers/ethernet/nebula-matrix/\n+F:\tdrivers/net/ethernet/nebula-matrix/\n+\n NETCONSOLE\n M:\tBreno Leitao \u003cleitao@debian.org\u003e\n S:\tMaintained\ndiff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig\nindex 8581ccba1505e..c2b0161d0beca 100644\n--- a/drivers/net/ethernet/Kconfig\n+++ b/drivers/net/ethernet/Kconfig\n@@ -130,6 +130,7 @@ config FEALNX\n \n source \"drivers/net/ethernet/ni/Kconfig\"\n source \"drivers/net/ethernet/natsemi/Kconfig\"\n+source \"drivers/net/ethernet/nebula-matrix/Kconfig\"\n source \"drivers/net/ethernet/netronome/Kconfig\"\n source \"drivers/net/ethernet/8390/Kconfig\"\n source \"drivers/net/ethernet/nvidia/Kconfig\"\ndiff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile\nindex 2b1153d35b52b..a306dae23bcb8 100644\n--- a/drivers/net/ethernet/Makefile\n+++ b/drivers/net/ethernet/Makefile\n@@ -67,6 +67,7 @@ obj-$(CONFIG_NET_VENDOR_MUCSE) += mucse/\n obj-$(CONFIG_NET_VENDOR_MYRI) += myricom/\n obj-$(CONFIG_FEALNX) += fealnx.o\n obj-$(CONFIG_NET_VENDOR_NATSEMI) += natsemi/\n+obj-$(CONFIG_NET_VENDOR_NEBULA_MATRIX) += nebula-matrix/\n obj-$(CONFIG_NET_VENDOR_NETRONOME) += netronome/\n obj-$(CONFIG_NET_VENDOR_NI) += ni/\n obj-$(CONFIG_NET_VENDOR_NVIDIA) += nvidia/\ndiff --git a/drivers/net/ethernet/nebula-matrix/Kconfig b/drivers/net/ethernet/nebula-matrix/Kconfig\nnew file mode 100644\nindex 0000000000000..dd0e91d14131f\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/Kconfig\n@@ -0,0 +1,32 @@\n+# SPDX-License-Identifier: GPL-2.0\n+#\n+# Nebula-matrix network device configuration\n+#\n+\n+config NET_VENDOR_NEBULA_MATRIX\n+\tbool \"Nebula-matrix devices\"\n+\tdefault y\n+\thelp\n+\t If you have a network (Ethernet) card belonging to this class, say Y.\n+\t Note that the answer to this question doesn't directly affect the\n+\t kernel: saying N will just cause the configurator to skip all\n+\t the questions about Nebula-matrix cards. If you say Y, you will be asked\n+\t for your specific card in the following questions.\n+\n+if NET_VENDOR_NEBULA_MATRIX\n+\n+config NBL\n+\ttristate \"Nebula-matrix Ethernet Controller m18110/m18000 support\"\n+\tdepends on PCI \u0026\u0026 (64BIT || COMPILE_TEST) \u0026\u0026 !CPU_BIG_ENDIAN\n+\thelp\n+\t This driver provides the core infrastructure for Nebula-matrix\n+\t Ethernet Controller m18110/m18000 Family of devices, including\n+\t PCI enumeration, firmware mailbox and channel communication.\n+\n+\t More specific information on configuring the driver is in\n+\t \u003cfile:Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst\u003e.\n+\n+\t To compile this driver as a module, choose M here. The module\n+\t will be called nbl.\n+\n+endif # NET_VENDOR_NEBULA_MATRIX\ndiff --git a/drivers/net/ethernet/nebula-matrix/Makefile b/drivers/net/ethernet/nebula-matrix/Makefile\nnew file mode 100644\nindex 0000000000000..42cdf2db8f0cf\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/Makefile\n@@ -0,0 +1,6 @@\n+# SPDX-License-Identifier: GPL-2.0\n+#\n+# Makefile for the Nebula-matrix network device drivers.\n+#\n+\n+obj-$(CONFIG_NBL) += nbl/\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/Makefile b/drivers/net/ethernet/nebula-matrix/nbl/Makefile\nnew file mode 100644\nindex 0000000000000..71fbe3ee7e620\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/Makefile\n@@ -0,0 +1,15 @@\n+# SPDX-License-Identifier: GPL-2.0\n+# Copyright (c) 2026 Nebula Matrix Limited.\n+\n+obj-$(CONFIG_NBL) := nbl.o\n+\n+nbl-objs +=\tnbl_common/nbl_common.o \\\n+\t\tnbl_channel/nbl_channel.o \\\n+\t\tnbl_hw/nbl_hw_leonis/nbl_hw_leonis.o \\\n+\t\tnbl_hw/nbl_hw_leonis/nbl_resource_leonis.o \\\n+\t\tnbl_hw/nbl_resource.o \\\n+\t\tnbl_hw/nbl_interrupt.o \\\n+\t\tnbl_hw/nbl_chip.o \\\n+\t\tnbl_core/nbl_dispatch.o \\\n+\t\tnbl_core/nbl_dev.o \\\n+\t\tnbl_main.o\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.c\nnew file mode 100644\nindex 0000000000000..090a17b00dbbe\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.c\n@@ -0,0 +1,1331 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/delay.h\u003e\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/mutex.h\u003e\n+#include \u003clinux/bitfield.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \u003clinux/bits.h\u003e\n+#include \u003clinux/dma-mapping.h\u003e\n+#include \u003clinux/atomic.h\u003e\n+#include \u003clinux/wait.h\u003e\n+#include \"nbl_channel.h\"\n+\n+static int nbl_chan_add_msg_handler(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t u16 msg_type, nbl_chan_resp func,\n+\t\t\t\t void *priv)\n+{\n+\tstruct nbl_chan_msg_node_data handler = { 0 };\n+\tint ret;\n+\n+\thandler.func = func;\n+\thandler.priv = priv;\n+\tret = nbl_common_alloc_hash_node(chan_mgt-\u003ehandle_hash_tbl, \u0026msg_type,\n+\t\t\t\t\t \u0026handler, NULL);\n+\n+\treturn ret;\n+}\n+\n+static int nbl_chan_init_msg_handler(struct nbl_channel_mgt *chan_mgt)\n+{\n+\tstruct nbl_common_info *common = chan_mgt-\u003ecommon;\n+\tstruct nbl_hash_tbl_key tbl_key = { 0 };\n+\n+\ttbl_key.dev = common-\u003edev;\n+\ttbl_key.key_size = sizeof(u16);\n+\ttbl_key.data_size = sizeof(struct nbl_chan_msg_node_data);\n+\ttbl_key.bucket_size = NBL_CHAN_HANDLER_TBL_BUCKET_SIZE;\n+\n+\tchan_mgt-\u003ehandle_hash_tbl = nbl_common_init_hash_table(\u0026tbl_key);\n+\tif (!chan_mgt-\u003ehandle_hash_tbl)\n+\t\treturn -ENOMEM;\n+\n+\treturn 0;\n+}\n+\n+static void nbl_chan_remove_msg_handler(struct nbl_channel_mgt *chan_mgt)\n+{\n+\tif (!chan_mgt-\u003ehandle_hash_tbl)\n+\t\treturn;\n+\tnbl_common_remove_hash_table(chan_mgt-\u003ehandle_hash_tbl);\n+\tchan_mgt-\u003ehandle_hash_tbl = NULL;\n+}\n+\n+static void nbl_chan_init_queue_param(struct nbl_chan_info *chan_info,\n+\t\t\t\t u16 num_txq_entries, u16 num_rxq_entries,\n+\t\t\t\t u16 txq_buf_size, u16 rxq_buf_size)\n+{\n+\tchan_info-\u003enum_txq_entries = num_txq_entries;\n+\tchan_info-\u003enum_rxq_entries = num_rxq_entries;\n+\tchan_info-\u003etxq_buf_size = txq_buf_size;\n+\tchan_info-\u003erxq_buf_size = rxq_buf_size;\n+\tatomic_set(\u0026chan_info-\u003einflight_tx_cnt, 0);\n+\tWRITE_ONCE(chan_info-\u003eshutdn, false);\n+\tWRITE_ONCE(chan_info-\u003eactive, false);\n+\tWRITE_ONCE(chan_info-\u003ewait_head_index, 0);\n+\tmemset(chan_info-\u003estate, 0, sizeof(chan_info-\u003estate));\n+\tinit_waitqueue_head(\u0026chan_info-\u003einflight_wait);\n+}\n+\n+static int nbl_chan_init_tx_queue(struct nbl_common_info *common,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_chan_ring *txq = \u0026chan_info-\u003etxq;\n+\tstruct device *dev = common-\u003edev;\n+\tsize_t size =\n+\t\tchan_info-\u003enum_txq_entries * sizeof(struct nbl_chan_tx_desc);\n+\tu16 i;\n+\n+\ttxq-\u003edesc.tx_desc =\n+\t\tdmam_alloc_coherent(dev, size, \u0026txq-\u003edma, GFP_KERNEL);\n+\tif (!txq-\u003edesc.tx_desc)\n+\t\treturn -ENOMEM;\n+\n+\tchan_info-\u003ewait = devm_kcalloc(dev, chan_info-\u003enum_txq_entries,\n+\t\t\t\t sizeof(*chan_info-\u003ewait), GFP_KERNEL);\n+\tif (!chan_info-\u003ewait)\n+\t\treturn -ENOMEM;\n+\tfor (i = 0; i \u003c chan_info-\u003enum_txq_entries; i++) {\n+\t\tinit_waitqueue_head(\u0026chan_info-\u003ewait[i].wait_queue);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].status, NBL_MBX_STATUS_IDLE);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].acked, 0);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].ack_data, NULL);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].ack_data_len, 0);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].ack_err, 0);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].msg_type, 0);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].msg_index, 0);\n+\t\tWRITE_ONCE(chan_info-\u003ewait[i].dstid, 0);\n+\t}\n+\n+\ttxq-\u003ebuf = devm_kcalloc(dev, chan_info-\u003enum_txq_entries,\n+\t\t\t\tsizeof(*txq-\u003ebuf), GFP_KERNEL);\n+\tif (!txq-\u003ebuf)\n+\t\treturn -ENOMEM;\n+\n+\treturn 0;\n+}\n+\n+static int nbl_chan_init_rx_queue(struct nbl_common_info *common,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_chan_ring *rxq = \u0026chan_info-\u003erxq;\n+\tstruct device *dev = common-\u003edev;\n+\tsize_t size =\n+\t\tchan_info-\u003enum_rxq_entries * sizeof(struct nbl_chan_rx_desc);\n+\n+\trxq-\u003edesc.rx_desc =\n+\t\tdmam_alloc_coherent(dev, size, \u0026rxq-\u003edma, GFP_KERNEL);\n+\tif (!rxq-\u003edesc.rx_desc) {\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"Allocate DMA for chan rx descriptor ring failed\\n\");\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\trxq-\u003ebuf = devm_kcalloc(dev, chan_info-\u003enum_rxq_entries,\n+\t\t\t\tsizeof(*rxq-\u003ebuf), GFP_KERNEL);\n+\tif (!rxq-\u003ebuf)\n+\t\treturn -ENOMEM;\n+\n+\treturn 0;\n+}\n+\n+static int nbl_chan_init_queue(struct nbl_common_info *common,\n+\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tint err;\n+\n+\terr = nbl_chan_init_tx_queue(common, chan_info);\n+\tif (err)\n+\t\treturn err;\n+\n+\terr = nbl_chan_init_rx_queue(common, chan_info);\n+\n+\treturn err;\n+}\n+\n+static void nbl_chan_config_queue(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info, bool tx)\n+{\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_hw_mgt *p = chan_mgt-\u003ehw_ops_tbl-\u003epriv;\n+\tstruct nbl_chan_ring *ring;\n+\tdma_addr_t addr;\n+\tint size_bwid;\n+\n+\tif (tx)\n+\t\tring = \u0026chan_info-\u003etxq;\n+\telse\n+\t\tring = \u0026chan_info-\u003erxq;\n+\taddr = ring-\u003edma;\n+\tif (tx) {\n+\t\tsize_bwid = ilog2(chan_info-\u003enum_txq_entries);\n+\t\thw_ops-\u003econfig_mailbox_txq(p, addr, size_bwid);\n+\t} else {\n+\t\tsize_bwid = ilog2(chan_info-\u003enum_rxq_entries);\n+\t\thw_ops-\u003econfig_mailbox_rxq(p, addr, size_bwid);\n+\t}\n+}\n+\n+static int nbl_chan_alloc_all_tx_bufs(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_chan_ring *txq = \u0026chan_info-\u003etxq;\n+\tstruct device *dev = chan_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_buf *buf;\n+\tu16 i;\n+\n+\tfor (i = 0; i \u003c chan_info-\u003enum_txq_entries; i++) {\n+\t\tbuf = \u0026txq-\u003ebuf[i];\n+\t\tbuf-\u003eva = dmam_alloc_coherent(dev, chan_info-\u003etxq_buf_size,\n+\t\t\t\t\t \u0026buf-\u003epa, GFP_KERNEL);\n+\t\tif (!buf-\u003eva) {\n+\t\t\tdev_err_ratelimited(dev,\n+\t\t\t\t\t \"Allocate buffer for chan tx queue failed\\n\");\n+\t\t\treturn -ENOMEM;\n+\t\t}\n+\t}\n+\n+\ttxq-\u003enext_to_clean = 0;\n+\ttxq-\u003enext_to_use = 0;\n+\ttxq-\u003etail_ptr = 0;\n+\n+\treturn 0;\n+}\n+\n+static void nbl_chan_cfg_qinfo_map_table(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t\t u8 bus, u8 devid)\n+{\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_hw_mgt *p = chan_mgt-\u003ehw_ops_tbl-\u003epriv;\n+\tu32 pf_mask = 0;\n+\tu8 func_id;\n+\n+\t/*\n+\t * k_pf_mask rule: bit N == 0 means PF#N enabled, bit N == 1 masked out.\n+\t * Program mailbox QINFO entry for each hardware-active PF func_id.\n+\t *\n+\t * Note: This loop iterates over raw hardware PF func_id.\n+\t * Upper resource initialization nbl_res_init_pf_num() enforces\n+\t * product constraints: only 1/2/4 contiguous PFs(PF0 / PF0~1 / PF0~3)\n+\t * are allowed. Non-contiguous or unsupported PF count will be rejected\n+\t * before reaching this function.\n+\t */\n+\thw_ops-\u003eget_host_pf_mask(p, \u0026pf_mask);\n+\tfor (func_id = 0; func_id \u003c NBL_MAX_PF; func_id++) {\n+\t\tif (!(pf_mask \u0026 (1 \u003c\u003c func_id)))\n+\t\t\thw_ops-\u003ecfg_mailbox_qinfo(p, func_id, bus,\n+\t\t\t\t\t\t devid, func_id);\n+\t}\n+}\n+\n+static int nbl_chan_alloc_all_rx_bufs(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_chan_ring *rxq = \u0026chan_info-\u003erxq;\n+\tstruct device *dev = chan_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_rx_desc *desc;\n+\tstruct nbl_chan_buf *buf;\n+\tu16 i;\n+\n+\tfor (i = 0; i \u003c chan_info-\u003enum_rxq_entries; i++) {\n+\t\tbuf = \u0026rxq-\u003ebuf[i];\n+\t\tbuf-\u003eva = dmam_alloc_coherent(dev, chan_info-\u003erxq_buf_size,\n+\t\t\t\t\t \u0026buf-\u003epa, GFP_KERNEL);\n+\t\tif (!buf-\u003eva) {\n+\t\t\tdev_err_ratelimited(dev,\n+\t\t\t\t\t \"Allocate buffer for chan rx queue failed\\n\");\n+\t\t\tgoto err;\n+\t\t}\n+\t}\n+\n+\tdesc = rxq-\u003edesc.rx_desc;\n+\t/*\n+\t * Initially leave one RX descriptor unused so that\n+\t * next_to_clean and next_to_use can distinguish an empty\n+\t * ring from a full ring.\n+\t *\n+\t * The unused slot is replenished as RX descriptors are\n+\t * consumed and recycled.\n+\t */\n+\tfor (i = 0; i \u003c chan_info-\u003enum_rxq_entries - 1; i++) {\n+\t\tbuf = \u0026rxq-\u003ebuf[i];\n+\t\tdesc[i].buf_addr = cpu_to_le64(buf-\u003epa);\n+\t\tdesc[i].buf_len = cpu_to_le32(chan_info-\u003erxq_buf_size);\n+\t\tdesc[i].flags = cpu_to_le16(BIT(NBL_CHAN_RX_DESC_AVAIL));\n+\t}\n+\n+\trxq-\u003enext_to_clean = 0;\n+\trxq-\u003enext_to_use = chan_info-\u003enum_rxq_entries - 1;\n+\trxq-\u003etail_ptr = chan_info-\u003enum_rxq_entries - 1;\n+\n+\treturn 0;\n+err:\n+\treturn -ENOMEM;\n+}\n+\n+static int nbl_chan_alloc_all_bufs(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tint err;\n+\n+\terr = nbl_chan_alloc_all_tx_bufs(chan_mgt, chan_info);\n+\tif (err)\n+\t\treturn err;\n+\terr = nbl_chan_alloc_all_rx_bufs(chan_mgt, chan_info);\n+\n+\treturn err;\n+}\n+\n+static void nbl_chan_stop_queue(struct nbl_channel_mgt *chan_mgt)\n+{\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\n+\thw_ops-\u003estop_mailbox_rxq(chan_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\thw_ops-\u003estop_mailbox_txq(chan_mgt-\u003ehw_ops_tbl-\u003epriv);\n+}\n+\n+static int nbl_chan_teardown_queue(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t u8 chan_type)\n+{\n+\tstruct nbl_chan_info *chan_info = chan_mgt-\u003echan_info[chan_type];\n+\tstruct nbl_chan_waitqueue_head *wait_head;\n+\tstruct work_struct *task;\n+\tint ret = 0;\n+\tu16 i;\n+\n+\tif (!READ_ONCE(chan_info-\u003eactive)) {\n+\t\tdev_warn(chan_mgt-\u003ecommon-\u003edev, \"channel not active, skip duplicate teardown\\n\");\n+\t\treturn 0;\n+\t}\n+\t/*\n+\t * Step1:\n+\t * block new sender\n+\t */\n+\tmutex_lock(\u0026chan_info-\u003estate_lock);\n+\tWRITE_ONCE(chan_info-\u003eshutdn, true);\n+\ttask = READ_ONCE(chan_info-\u003eclean_task);\n+\tWRITE_ONCE(chan_info-\u003eclean_task, NULL);\n+\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+\t/*\n+\t * Step2:\n+\t * abort pending ACK waiters\n+\t */\n+\n+\tmutex_lock(\u0026chan_info-\u003epending_lock);\n+\tfor (i = 0; i \u003c chan_info-\u003enum_txq_entries; i++) {\n+\t\twait_head = \u0026chan_info-\u003ewait[i];\n+\t\t/* Only wake threads that are actually waiting */\n+\t\tif (READ_ONCE(wait_head-\u003estatus) == NBL_MBX_STATUS_WAITING) {\n+\t\t\t/* Update all status fields first */\n+\t\t\tWRITE_ONCE(wait_head-\u003estatus, NBL_MBX_STATUS_TIMEOUT);\n+\t\t\tWRITE_ONCE(wait_head-\u003eack_err, (s32)-EIO);\n+\t\t\t/* Ensure status visible before acked flag */\n+\t\t\tsmp_wmb();\n+\t\t\tWRITE_ONCE(wait_head-\u003eacked, 1);\n+\t\t\twake_up(\u0026wait_head-\u003ewait_queue);\n+\t\t}\n+\t}\n+\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t/*\n+\t * Step3:\n+\t * wait all sender exit\n+\t *\n+\t * Drain strategy mirrors mlx5 command interface teardown:\n+\t * set shutdown flag first, abort all pending waiters, then\n+\t * block until inflight_tx_cnt reaches zero.\n+\t *\n+\t * A timeout here is treated as an exceptional condition rather\n+\t * than a fatal error, following the same rationale as mlx5:\n+\t * - shutdn is already set, so every sender path observes it\n+\t * at its next checkpoint and exits;\n+\t * - interrupt-driven senders have a 3s ACK wait\n+\t * (NBL_CHAN_ACK_WAIT_TIME); polling senders re-check shutdn\n+\t * on every 1-1.2ms iteration, so both exit promptly after\n+\t * shutdown is signaled rather than running to full timeout;\n+\t * - timeout is treated as an exceptional condition; callers\n+\t * must not access queue resources while an inflight sender\n+\t * may still be active;\n+\t * - in that hardware-dead case proceeding with teardown cannot\n+\t * make the situation worse, and avoids hanging rmmod forever.\n+\t */\n+\tret = wait_event_timeout(chan_info-\u003einflight_wait,\n+\t\t\t\t atomic_read(\u0026chan_info-\u003einflight_tx_cnt) == 0,\n+\t\t\t\t msecs_to_jiffies(5000));\n+\n+\tif (!ret) {\n+\t\tdev_warn(chan_mgt-\u003ecommon-\u003edev,\n+\t\t\t \"teardown: inflight tx drain timeout\\n\");\n+\t\tret = -ETIMEDOUT;\n+\t} else {\n+\t\tret = 0;\n+\t}\n+\n+\t/* After all TX drained, stop hardware queue */\n+\tnbl_chan_stop_queue(chan_mgt);\n+\n+\t/* All send paths drained, safely cancel cleanup work */\n+\tif (task)\n+\t\tcancel_work_sync(task);\n+\tWRITE_ONCE(chan_info-\u003eactive, false);\n+\treturn ret;\n+}\n+\n+static int nbl_chan_setup_queue(struct nbl_channel_mgt *chan_mgt, u8 chan_type)\n+{\n+\tstruct nbl_chan_info *chan_info = chan_mgt-\u003echan_info[chan_type];\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = chan_mgt-\u003ecommon;\n+\tstruct nbl_chan_ring *rxq = \u0026chan_info-\u003erxq;\n+\tint err;\n+\n+\tif (READ_ONCE(chan_info-\u003eactive)) {\n+\t\tdev_warn(common-\u003edev, \"channel already active, reject duplicate setup\\n\");\n+\t\treturn -EBUSY;\n+\t}\n+\tnbl_chan_init_queue_param(chan_info, NBL_CHAN_QUEUE_LEN,\n+\t\t\t\t NBL_CHAN_QUEUE_LEN, NBL_CHAN_BUF_LEN,\n+\t\t\t\t NBL_CHAN_BUF_LEN);\n+\terr = nbl_chan_init_queue(common, chan_info);\n+\tif (err)\n+\t\treturn err;\n+\terr = nbl_chan_alloc_all_bufs(chan_mgt, chan_info);\n+\tif (err)\n+\t\treturn err;\n+\tnbl_chan_config_queue(chan_mgt, chan_info, true); /* tx */\n+\tnbl_chan_config_queue(chan_mgt, chan_info, false); /* rx */\n+\tnbl_chan_update_tail_ptr(hw_ops, chan_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t rxq-\u003etail_ptr, NBL_MB_RX_QID);\n+\tWRITE_ONCE(chan_info-\u003eactive, true);\n+\treturn 0;\n+}\n+\n+static bool nbl_chan_txq_full(struct nbl_chan_ring *txq,\n+\t\t\t u16 num_entries)\n+{\n+\treturn NBL_NEXT_ID(txq-\u003enext_to_use, num_entries - 1) ==\n+\t txq-\u003enext_to_clean;\n+}\n+\n+static int nbl_chan_update_txqueue(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info,\n+\t\t\t\t struct nbl_chan_tx_param *param)\n+{\n+\tstruct nbl_chan_ring *txq = \u0026chan_info-\u003etxq;\n+\tstruct nbl_chan_tx_desc *tx_desc;\n+\tstruct nbl_chan_buf *tx_buf;\n+\n+\tif (nbl_chan_txq_full(txq, chan_info-\u003enum_txq_entries))\n+\t\treturn -EBUSY;\n+\tif (param-\u003earg_len \u003e NBL_CHAN_BUF_LEN - sizeof(*tx_desc))\n+\t\treturn -EINVAL;\n+\ttx_desc =\n+\t\tNBL_CHAN_TX_RING_TO_DESC(txq, txq-\u003enext_to_use);\n+\ttx_buf =\n+\t\tNBL_CHAN_TX_RING_TO_BUF(txq, txq-\u003enext_to_use);\n+\ttx_desc-\u003edstid = cpu_to_le16(param-\u003edstid);\n+\ttx_desc-\u003emsg_type = cpu_to_le16(param-\u003emsg_type);\n+\ttx_desc-\u003emsgid = cpu_to_le16(param-\u003emsgid);\n+\n+\t/*\n+\t * srcid field is filled by mailbox hardware after peer receives this\n+\t * packet, driver producer never writes srcid; reused descriptor slots\n+\t * will contain stale srcid value temporarily until hardware overwrites\n+\t * it.\n+\t */\n+\tif (param-\u003earg_len \u003e NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN) {\n+\t\tif (param-\u003earg)\n+\t\t\tmemcpy(tx_buf-\u003eva, param-\u003earg, param-\u003earg_len);\n+\t\ttx_desc-\u003ebuf_addr = cpu_to_le64(tx_buf-\u003epa);\n+\t\ttx_desc-\u003ebuf_len = cpu_to_le16(param-\u003earg_len);\n+\t\ttx_desc-\u003edata_len = 0;\n+\t\tmemset(tx_desc-\u003edata, 0, sizeof(tx_desc-\u003edata));\n+\t} else {\n+\t\tmemset(tx_desc-\u003edata, 0, sizeof(tx_desc-\u003edata));\n+\t\tmemset(\u0026tx_desc-\u003ebuf_addr, 0, sizeof(tx_desc-\u003ebuf_addr));\n+\t\tif (param-\u003earg \u0026\u0026 param-\u003earg_len \u003e 0)\n+\t\t\tmemcpy(tx_desc-\u003edata, param-\u003earg, param-\u003earg_len);\n+\t\ttx_desc-\u003ebuf_len = 0;\n+\t\ttx_desc-\u003edata_len = cpu_to_le16(param-\u003earg_len);\n+\t}\n+\t/* Ensure descriptor data visible to device before AVAIL flag */\n+\tdma_wmb();\n+\ttx_desc-\u003eflags = cpu_to_le16(BIT(NBL_CHAN_TX_DESC_AVAIL));\n+\n+\ttxq-\u003enext_to_use =\n+\t\tNBL_NEXT_ID(txq-\u003enext_to_use, chan_info-\u003enum_txq_entries - 1);\n+\ttxq-\u003etail_ptr++;\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * Quiesce the TX mailbox queue and reclaim all outstanding\n+ * descriptors. Called from the timeout path of nbl_chan_kick_tx_ring()\n+ * with txq_lock held.\n+ *\n+ * The device failed to fetch/complete the current descriptor within the\n+ * polling window. We assert QUEUE_RST to stop further DMA fetches,\n+ * reclaim every descriptor between next_to_clean and next_to_use,\n+ * reset the software tail_ptr counter to match the hardware reset state,\n+ * and re-enable the queue so subsequent sends can proceed.\n+ */\n+static void nbl_chan_quiesce_and_reclaim_tx(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_hw_mgt *hw_priv = chan_mgt-\u003ehw_ops_tbl-\u003epriv;\n+\tstruct nbl_chan_ring *txq = \u0026chan_info-\u003etxq;\n+\tstruct nbl_chan_tx_desc *tx_desc;\n+\n+\t/* Assert QUEUE_RST to stop hardware fetching new descriptors */\n+\thw_ops-\u003estop_mailbox_txq(hw_priv);\n+\thw_ops-\u003eflush_write(hw_priv);\n+\n+\t/*\n+\t * Reclaim all outstanding descriptors between next_to_clean and\n+\t * next_to_use. Under txq_lock there is at most one in-flight\n+\t * descriptor, but iterate the full range for robustness.\n+\t */\n+\twhile (txq-\u003enext_to_clean != txq-\u003enext_to_use) {\n+\t\ttx_desc = NBL_CHAN_TX_RING_TO_DESC(txq,\n+\t\t\t\t\t\t txq-\u003enext_to_clean);\n+\t\tWRITE_ONCE(tx_desc-\u003eflags, 0);\n+\t\ttxq-\u003enext_to_clean =\n+\t\t\tNBL_NEXT_ID(txq-\u003enext_to_clean,\n+\t\t\t\t chan_info-\u003enum_txq_entries - 1);\n+\t}\n+\n+\t/*\n+\t * Hardware tail_ptr counter is cleared by QUEUE_RST. Reset\n+\t * software counter to match so the next doorbell update does\n+\t * not produce a false 16-bit wrap delta.\n+\t */\n+\ttxq-\u003etail_ptr = 0;\n+\ttxq-\u003enext_to_use = 0;\n+\ttxq-\u003enext_to_clean = 0;\n+\n+\t/* Re-enable queue with current ring base and size */\n+\tnbl_chan_config_queue(chan_mgt, chan_info, true);\n+}\n+\n+static int nbl_chan_kick_tx_ring(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_chan_ring *txq = \u0026chan_info-\u003etxq;\n+\tstruct device *dev = chan_mgt-\u003ecommon-\u003edev;\n+\tint max_retries = NBL_CHAN_TX_WAIT_TIMES;\n+\tstruct nbl_chan_tx_desc *tx_desc;\n+\tint retry_count = 0;\n+\tu16 msg_type;\n+\n+\tnbl_chan_update_tail_ptr(hw_ops, chan_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t txq-\u003etail_ptr, NBL_MB_TX_QID);\n+\n+\ttx_desc = NBL_CHAN_TX_RING_TO_DESC(txq, txq-\u003enext_to_clean);\n+\t/*\n+\t * Poll for HW to mark descriptor as USED.\n+\t * Mailbox is a low-speed control channel for management commands.\n+\t * We avoid enabling dedicated per-TX interrupt for single control\n+\t * message to reduce interrupt overhead, so use bounded polling\n+\t * with small delay instead.\n+\t */\n+\twhile (retry_count \u003c max_retries) {\n+\t\tif (READ_ONCE(chan_info-\u003eshutdn))\n+\t\t\treturn -ESHUTDOWN;\n+\n+\t\tif (le16_to_cpu(READ_ONCE(tx_desc-\u003eflags)) \u0026\n+\t\t BIT(NBL_CHAN_TX_DESC_USED)) {\n+\t\t\t /*\n+\t\t\t * Order reads of other device-written descriptor\n+\t\t\t * fields after observing USED. Matches the RX side\n+\t\t\t * pattern in nbl_chan_clean_queue().\n+\t\t\t */\n+\t\t\tdma_rmb();\n+\t\t\tbreak;\n+\t\t}\n+\n+\t\tretry_count++;\n+\t\tif (retry_count == max_retries) {\n+\t\t\tmsg_type = le16_to_cpu(READ_ONCE(tx_desc-\u003emsg_type));\n+\t\t\tdev_err_ratelimited(dev, \"chan send msg type: %d timeout\\n\",\n+\t\t\t\t\t msg_type);\n+\t\t\t/*\n+\t\t\t * Device failed to complete this descriptor.\n+\t\t\t * Quiesce the queue, reclaim the timed-out\n+\t\t\t * descriptor, and re-enable so future sends can\n+\t\t\t * proceed instead of stalling the ring full.\n+\t\t\t */\n+\t\t\tnbl_chan_quiesce_and_reclaim_tx(chan_mgt,\n+\t\t\t\t\t\t\tchan_info);\n+\t\t\treturn -ETIMEDOUT;\n+\t\t}\n+\t\tusleep_range(NBL_CHAN_TX_WAIT_US, NBL_CHAN_TX_WAIT_US_MAX);\n+\t}\n+\n+\ttxq-\u003enext_to_clean = txq-\u003enext_to_use;\n+\n+\treturn 0;\n+}\n+\n+static void nbl_chan_recv_ack_msg(void *priv, u16 srcid, u16 msgid, void *data,\n+\t\t\t\t u32 data_len)\n+{\n+\tstruct nbl_channel_mgt *chan_mgt = (struct nbl_channel_mgt *)priv;\n+\tstruct nbl_chan_waitqueue_head *wait_head = NULL;\n+\tstruct device *dev = chan_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_info *chan_info =\n+\t\tchan_mgt-\u003echan_info[NBL_CHAN_TYPE_MAILBOX];\n+\tu16 w_dstid, w_msgtype, w_msgidx;\n+\tu32 *payload = data;\n+\tu16 ack_msgtype = 0;\n+\tu16 ack_msgid = 0;\n+\tu32 ack_datalen;\n+\tvoid *ack_data;\n+\tu32 copy_len;\n+\tint w_status;\n+\ts32 raw_err;\n+\n+\tif (READ_ONCE(chan_info-\u003eshutdn))\n+\t\treturn;\n+\tif (data_len \u003e NBL_CHAN_BUF_LEN ||\n+\t data_len \u003c NBL_CHAN_ACK_HEAD_LEN * sizeof(u32)) {\n+\t\tdev_err_ratelimited(dev, \"Invalid ACK data_len: %u\\n\",\n+\t\t\t\t data_len);\n+\t\treturn;\n+\t}\n+\tack_datalen = data_len - NBL_CHAN_ACK_HEAD_LEN * sizeof(u32);\n+\tack_msgtype = le16_to_cpu(*(__le16 *)(payload + NBL_CHAN_MSG_TYPE_POS));\n+\tack_msgid = le16_to_cpu(*(__le16 *)(payload + NBL_CHAN_MSG_ID_POS));\n+\tif (FIELD_GET(NBL_CHAN_MSGID_LOC_MASK, ack_msgid) \u003e=\n+\t chan_info-\u003enum_txq_entries) {\n+\t\tdev_err_ratelimited(dev, \"chan recv msg id: %u err\\n\",\n+\t\t\t\t ack_msgid);\n+\t\treturn;\n+\t}\n+\twait_head =\n+\t\t\u0026chan_info-\u003ewait[FIELD_GET(NBL_CHAN_MSGID_LOC_MASK, ack_msgid)];\n+\n+\tmutex_lock(\u0026chan_info-\u003epending_lock);\n+\n+\t/* Cache repeated READ_ONCE values */\n+\tw_dstid = READ_ONCE(wait_head-\u003edstid);\n+\tw_status = READ_ONCE(wait_head-\u003estatus);\n+\tw_msgtype = READ_ONCE(wait_head-\u003emsg_type);\n+\tw_msgidx = READ_ONCE(wait_head-\u003emsg_index);\n+\n+\tif (srcid != w_dstid) {\n+\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\tdev_err_ratelimited(dev, \"ACK srcid=%u != dstid=%u, rejecting\\n\",\n+\t\t\t\t srcid, w_dstid);\n+\t\treturn;\n+\t}\n+\tif (w_status != NBL_MBX_STATUS_WAITING) {\n+\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"Skip ack invalid status, wait msgtype:%u idx:%u status:%d ack msgtype:%u msgid:%u datalen:%u\\n\",\n+\t\t\t\t w_msgtype, w_msgidx, w_status,\n+\t\t\t\t ack_msgtype, ack_msgid, ack_datalen);\n+\t\treturn;\n+\t}\n+\n+\tif (w_msgtype != ack_msgtype) {\n+\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"Skip ack msgtype mismatch, wait msgtype:%u idx:%u ack msgtype:%u msgid:%u\\n\",\n+\t\t\t\t w_msgtype, w_msgidx, ack_msgtype,\n+\t\t\t\t ack_msgid);\n+\t\treturn;\n+\t}\n+\tif (FIELD_GET(NBL_CHAN_MSGID_INDEX_MASK, ack_msgid) != w_msgidx) {\n+\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"Stale ACK: expected index=%u, got msgid=%u\\n\",\n+\t\t\t\t w_msgidx, ack_msgid);\n+\t\treturn;\n+\t}\n+\n+\traw_err = (s32)le32_to_cpu(*(__le32 *)\u0026payload[NBL_CHAN_ACK_RET_POS]);\n+\tif (raw_err \u003e 0 || raw_err \u003c -MAX_ERRNO)\n+\t\traw_err = -EREMOTEIO;\n+\n+\tWRITE_ONCE(wait_head-\u003eack_err, raw_err);\n+\n+\tcopy_len = min_t(u32, READ_ONCE(wait_head-\u003eack_data_len), ack_datalen);\n+\tif (READ_ONCE(wait_head-\u003eack_err) \u003e= 0 \u0026\u0026 copy_len \u003e 0) {\n+\t\tack_data = READ_ONCE(wait_head-\u003eack_data);\n+\t\tif (!ack_data) {\n+\t\t\tdev_err_ratelimited(dev, \"ACK payload dropped: ack_data is NULL\\n\");\n+\t\t\tWRITE_ONCE(wait_head-\u003eack_data_len, 0);\n+\t\t\tgoto ack_done;\n+\t\t}\n+\t\tmemcpy((char *)ack_data,\n+\t\t payload + NBL_CHAN_ACK_HEAD_LEN, copy_len);\n+\t\tWRITE_ONCE(wait_head-\u003eack_data_len, (u16)copy_len);\n+\t} else {\n+\t\tWRITE_ONCE(wait_head-\u003eack_data_len, 0);\n+\t}\n+ack_done:\n+\t/* Guarantee payload data finished before acked flag visible */\n+\tsmp_wmb();\n+\tWRITE_ONCE(wait_head-\u003eacked, 1);\n+\tWRITE_ONCE(wait_head-\u003estatus, NBL_MBX_STATUS_ACKD);\n+\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\twake_up(\u0026wait_head-\u003ewait_queue);\n+}\n+\n+static void nbl_chan_recv_msg(struct nbl_channel_mgt *chan_mgt, void *data)\n+{\n+\tstruct device *dev = chan_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_msg_node_data *msg_handler;\n+\tu16 msg_type, payload_len, srcid, msgid;\n+\tstruct nbl_chan_info *chan_info =\n+\t\tchan_mgt-\u003echan_info[NBL_CHAN_TYPE_MAILBOX];\n+\tstruct nbl_chan_tx_desc *tx_desc;\n+\tvoid *payload;\n+\tsize_t avail_space;\n+\tu16 data_len_fw;\n+\n+\tif (READ_ONCE(chan_info-\u003eshutdn))\n+\t\treturn;\n+\n+\ttx_desc = data;\n+\tmsg_type = le16_to_cpu(READ_ONCE(tx_desc-\u003emsg_type));\n+\tdev_dbg(dev, \"recv msg_type: %d\\n\", msg_type);\n+\n+\tsrcid = le16_to_cpu(READ_ONCE(tx_desc-\u003esrcid));\n+\tmsgid = le16_to_cpu(READ_ONCE(tx_desc-\u003emsgid));\n+\n+\tif (msg_type \u003e= NBL_CHAN_MSG_MAILBOX_MAX)\n+\t\treturn;\n+\n+\tdata_len_fw = le16_to_cpu(READ_ONCE(tx_desc-\u003edata_len));\n+\tif (data_len_fw) {\n+\t\tpayload_len = data_len_fw;\n+\n+\t\tif (payload_len \u003e NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN) {\n+\t\t\tdev_err_ratelimited(dev,\n+\t\t\t\t\t \"data_len=%u exceeds embedded buffer size=%u\\n\",\n+\t\t\t\t\t payload_len,\n+\t\t\t\t\t NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN);\n+\t\t\treturn;\n+\t\t}\n+\t\t/* Small pkt: payload stored inside descriptor data[] array */\n+\t\tpayload = tx_desc-\u003edata;\n+\t} else {\n+\t\tpayload_len = le16_to_cpu(READ_ONCE(tx_desc-\u003ebuf_len));\n+\n+\t\tavail_space = NBL_CHAN_BUF_LEN - sizeof(*tx_desc);\n+\t\tif (payload_len \u003e avail_space) {\n+\t\t\tdev_err_ratelimited(dev,\n+\t\t\t\t\t \"buf_len=%u exceeds external buffer size=%zu\\n\",\n+\t\t\t\t\t payload_len, avail_space);\n+\t\t\treturn;\n+\t\t}\n+\t\t/* Large pkt: payload follows immediately after tx_desc */\n+\t\tpayload = tx_desc + 1;\n+\t}\n+\n+\tmsg_handler = nbl_common_get_hash_node(chan_mgt-\u003ehandle_hash_tbl,\n+\t\t\t\t\t \u0026msg_type);\n+\tif (!msg_handler || !msg_handler-\u003efunc) {\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"No handler for msg_type: %u (srcid=%u, msgid=%u)\\n\",\n+\t\t\t\t msg_type, srcid, msgid);\n+\t\treturn;\n+\t}\n+\n+\tmsg_handler-\u003efunc(msg_handler-\u003epriv, srcid, msgid, payload,\n+\t\t\t payload_len);\n+}\n+\n+static void nbl_chan_advance_rx_ring(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info,\n+\t\t\t\t struct nbl_chan_ring *rxq)\n+{\n+\tstruct nbl_hw_ops *hw_ops = chan_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_chan_rx_desc *rx_desc;\n+\tstruct nbl_chan_buf *rx_buf;\n+\tu16 next_to_use;\n+\n+\tnext_to_use = rxq-\u003enext_to_use;\n+\trx_desc = NBL_CHAN_RX_RING_TO_DESC(rxq, next_to_use);\n+\trx_buf = NBL_CHAN_RX_RING_TO_BUF(rxq, next_to_use);\n+\n+\t/*\n+\t * Recycle the RX descriptor at next_to_use. The initial\n+\t * unused slot is intentionally recycled after the first\n+\t * RX descriptor is consumed, allowing the ring to become\n+\t * fully populated while next_to_clean tracks the consumer.\n+\t */\n+\trx_desc-\u003ebuf_addr = cpu_to_le64(rx_buf-\u003epa);\n+\trx_desc-\u003ebuf_len = cpu_to_le32(chan_info-\u003erxq_buf_size);\n+\n+\t/*\n+\t * DMA Write Memory Barrier:\n+\t * Ensures all previous DMA-mapped writes (buffer address/length)\n+\t * are completed before the descriptor flags are updated.\n+\t * This prevents hardware from seeing a partially updated descriptor\n+\t * where flags are set but buffer info isn't ready yet.\n+\t */\n+\tdma_wmb();\n+\n+\trx_desc-\u003eflags = cpu_to_le16(BIT(NBL_CHAN_RX_DESC_AVAIL));\n+\n+\trxq-\u003enext_to_use++;\n+\tif (rxq-\u003enext_to_use == chan_info-\u003enum_rxq_entries)\n+\t\trxq-\u003enext_to_use = 0;\n+\trxq-\u003etail_ptr++;\n+\n+\tnbl_chan_update_tail_ptr(hw_ops, chan_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t rxq-\u003etail_ptr, NBL_MB_RX_QID);\n+}\n+\n+static void nbl_chan_clean_queue(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t struct nbl_chan_info *chan_info)\n+{\n+\tstruct nbl_common_info *common = chan_mgt-\u003ecommon;\n+\tstruct nbl_chan_ring *rxq = \u0026chan_info-\u003erxq;\n+\tstruct device *dev = chan_mgt-\u003ecommon-\u003edev;\n+\tu32 budget = NBL_CHAN_RX_CLEAN_BUDGET;\n+\tstruct nbl_chan_rx_desc *rx_desc;\n+\tstruct nbl_chan_buf *rx_buf;\n+\tstruct work_struct *task;\n+\tbool more_work = false;\n+\tu16 next_to_clean;\n+\tu16 flags;\n+\n+\tnext_to_clean = rxq-\u003enext_to_clean;\n+\trx_desc = NBL_CHAN_RX_RING_TO_DESC(rxq, next_to_clean);\n+\trx_buf = NBL_CHAN_RX_RING_TO_BUF(rxq, next_to_clean);\n+\twhile (le16_to_cpu(READ_ONCE(rx_desc-\u003eflags)) \u0026\n+\t BIT(NBL_CHAN_RX_DESC_USED)) {\n+\t\tflags = le16_to_cpu(READ_ONCE(rx_desc-\u003eflags));\n+\n+\t\tif (READ_ONCE(chan_info-\u003eshutdn))\n+\t\t\tbreak;\n+\t\tif (!(flags \u0026 BIT(NBL_CHAN_RX_DESC_WRITE)))\n+\t\t\tdev_dbg(dev,\n+\t\t\t\t\"mailbox rx flag 0x%x missing NBL_CHAN_RX_DESC_WRITE\\n\",\n+\t\t\t\tflags);\n+\n+\t\t/* Make sure hardware written descriptor visible to CPU */\n+\t\tdma_rmb();\n+\t\tnbl_chan_recv_msg(chan_mgt, rx_buf-\u003eva);\n+\t\tnbl_chan_advance_rx_ring(chan_mgt, chan_info, rxq);\n+\t\tnext_to_clean++;\n+\t\tif (next_to_clean == chan_info-\u003enum_rxq_entries)\n+\t\t\tnext_to_clean = 0;\n+\t\trx_desc = NBL_CHAN_RX_RING_TO_DESC(rxq, next_to_clean);\n+\t\trx_buf = NBL_CHAN_RX_RING_TO_BUF(rxq, next_to_clean);\n+\t\tif (--budget == 0) {\n+\t\t\tmore_work = true;\n+\t\t\tbreak;\n+\t\t}\n+\t\tcond_resched();\n+\t}\n+\trxq-\u003enext_to_clean = next_to_clean;\n+\n+\tmutex_lock(\u0026chan_info-\u003estate_lock);\n+\t/* Prevent queue_work after teardown clears clean_task */\n+\tif (READ_ONCE(chan_info-\u003eshutdn)) {\n+\t\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+\t\treturn;\n+\t}\n+\tif (common-\u003ewq \u0026\u0026 more_work) {\n+\t\ttask = READ_ONCE(chan_info-\u003eclean_task);\n+\t\tif (task)\n+\t\t\tqueue_work(common-\u003ewq, task);\n+\t}\n+\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+}\n+\n+static void nbl_chan_clean_queue_subtask(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t\t u8 chan_type)\n+{\n+\tstruct nbl_chan_info *chan_info = chan_mgt-\u003echan_info[chan_type];\n+\n+\tnbl_chan_clean_queue(chan_mgt, chan_info);\n+}\n+\n+static int nbl_chan_get_msg_id(struct nbl_chan_info *chan_info,\n+\t\t\t u16 *msgid)\n+{\n+\tint search_loc = READ_ONCE(chan_info-\u003ewait_head_index), i;\n+\tstruct nbl_chan_waitqueue_head *wait = NULL;\n+\tint status;\n+\tint next;\n+\n+\tlockdep_assert_held(\u0026chan_info-\u003epending_lock);\n+\tfor (i = 0; i \u003c chan_info-\u003enum_txq_entries; i++) {\n+\t\twait = \u0026chan_info-\u003ewait[search_loc];\n+\t\tstatus = READ_ONCE(wait-\u003estatus);\n+\t\tif (status == NBL_MBX_STATUS_IDLE ||\n+\t\t status == NBL_MBX_STATUS_TIMEOUT) {\n+\t\t\tWRITE_ONCE(wait-\u003emsg_index,\n+\t\t\t\t NBL_NEXT_ID(wait-\u003emsg_index,\n+\t\t\t\t\t NBL_CHAN_MSG_INDEX_MAX));\n+\n+\t\t\t*msgid = FIELD_PREP(NBL_CHAN_MSGID_INDEX_MASK,\n+\t\t\t\t\t wait-\u003emsg_index) |\n+\t\t\t\t FIELD_PREP(NBL_CHAN_MSGID_LOC_MASK,\n+\t\t\t\t\t search_loc);\n+\n+\t\t\t/* Advance starting search position for next caller */\n+\t\t\tnext = NBL_NEXT_ID(search_loc,\n+\t\t\t\t\t chan_info-\u003enum_txq_entries - 1);\n+\t\t\tWRITE_ONCE(chan_info-\u003ewait_head_index, next);\n+\t\t\treturn 0;\n+\t\t}\n+\n+\t\tsearch_loc = NBL_NEXT_ID(search_loc,\n+\t\t\t\t\t chan_info-\u003enum_txq_entries - 1);\n+\t}\n+\n+\t/*\n+\t * All tx slots are occupied. May happen under high transmit load\n+\t * or delayed remote ACK responses. Caller should retry later.\n+\t */\n+\treturn -EAGAIN;\n+}\n+\n+static void nbl_chan_reset_wait_head(struct nbl_chan_info *chan_info,\n+\t\t\t\t struct nbl_chan_waitqueue_head *wait_head)\n+{\n+\tlockdep_assert_held(\u0026chan_info-\u003epending_lock);\n+\n+\tWRITE_ONCE(wait_head-\u003eacked, 0);\n+\tWRITE_ONCE(wait_head-\u003estatus, NBL_MBX_STATUS_IDLE);\n+\tWRITE_ONCE(wait_head-\u003eack_data, NULL);\n+\tWRITE_ONCE(wait_head-\u003eack_data_len, 0);\n+\tWRITE_ONCE(wait_head-\u003eack_err, 0);\n+\tWRITE_ONCE(wait_head-\u003emsg_type, 0);\n+\tWRITE_ONCE(wait_head-\u003edstid, 0);\n+}\n+\n+static int nbl_chan_send_msg(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t struct nbl_chan_send_info *chan_send)\n+{\n+\tstruct nbl_common_info *common = chan_mgt-\u003ecommon;\n+\tstruct nbl_chan_waitqueue_head *wait_head = NULL;\n+\tstruct nbl_chan_tx_param tx_param = { 0 };\n+\tint i = NBL_CHAN_TX_WAIT_ACK_TIMES;\n+\tstruct nbl_chan_info *chan_info =\n+\t\tchan_mgt-\u003echan_info[NBL_CHAN_TYPE_MAILBOX];\n+\tstruct device *dev = common-\u003edev;\n+\tstruct work_struct *task;\n+\tu16 msgid = 0;\n+\tint ret;\n+\n+\tif (chan_send-\u003eresp_len \u003e NBL_CHAN_BUF_LEN) {\n+\t\tdev_err_ratelimited(dev, \"resp_len %zu exceeds max %d\\n\",\n+\t\t\t\t chan_send-\u003eresp_len, NBL_CHAN_BUF_LEN);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tmutex_lock(\u0026chan_info-\u003estate_lock);\n+\tif (READ_ONCE(chan_info-\u003eshutdn)) {\n+\t\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+\t\treturn -ESHUTDOWN;\n+\t}\n+\tatomic_inc(\u0026chan_info-\u003einflight_tx_cnt);\n+\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+\n+\ttx_param.msg_type = chan_send-\u003emsg_type;\n+\ttx_param.arg = chan_send-\u003earg;\n+\ttx_param.arg_len = chan_send-\u003earg_len;\n+\ttx_param.dstid = chan_send-\u003edstid;\n+\ttx_param.msgid = msgid;\n+\tif (chan_send-\u003eack) {\n+\t\tmutex_lock(\u0026chan_info-\u003epending_lock);\n+\n+\t\tret = nbl_chan_get_msg_id(chan_info, \u0026msgid);\n+\t\tif (ret) {\n+\t\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\t\tdev_err_ratelimited(dev,\n+\t\t\t\t\t \"Channel tx wait head full, send msgtype:%u to dstid:%u failed\\n\",\n+\t\t\t\t\t chan_send-\u003emsg_type,\n+\t\t\t\t\t chan_send-\u003edstid);\n+\t\t\tgoto out_clean_inflight;\n+\t\t}\n+\t\twait_head =\n+\t\t\t\u0026chan_info-\u003ewait[FIELD_GET(NBL_CHAN_MSGID_LOC_MASK,\n+\t\t\t\t\t\t msgid)];\n+\t\tWRITE_ONCE(wait_head-\u003eacked, 0);\n+\t\tWRITE_ONCE(wait_head-\u003eack_data, chan_send-\u003eresp);\n+\t\tWRITE_ONCE(wait_head-\u003eack_data_len, chan_send-\u003eresp_len);\n+\t\tWRITE_ONCE(wait_head-\u003emsg_type, chan_send-\u003emsg_type);\n+\t\tWRITE_ONCE(wait_head-\u003emsg_index,\n+\t\t\t FIELD_GET(NBL_CHAN_MSGID_INDEX_MASK, msgid));\n+\t\tWRITE_ONCE(wait_head-\u003edstid, chan_send-\u003edstid);\n+\n+\t\tWRITE_ONCE(wait_head-\u003estatus, NBL_MBX_STATUS_WAITING);\n+\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\n+\t\ttx_param.msgid = msgid;\n+\t}\n+\n+\tmutex_lock(\u0026chan_info-\u003etxq_lock);\n+\tret = nbl_chan_update_txqueue(chan_mgt, chan_info, \u0026tx_param);\n+\tif (ret) {\n+\t\tmutex_unlock(\u0026chan_info-\u003etxq_lock);\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"Channel tx queue full, send msgtype:%u to dstid:%u failed\\n\",\n+\t\t\t\t chan_send-\u003emsg_type, chan_send-\u003edstid);\n+\t\tif (wait_head)\n+\t\t\tgoto out_clear_wait_slot;\n+\t\tgoto out_clean_inflight;\n+\t}\n+\n+\tret = nbl_chan_kick_tx_ring(chan_mgt, chan_info);\n+\tmutex_unlock(\u0026chan_info-\u003etxq_lock);\n+\tif (ret) {\n+\t\tif (wait_head)\n+\t\t\tgoto out_clear_wait_slot;\n+\t\tgoto out_clean_inflight;\n+\t}\n+\n+\tif (!chan_send-\u003eack) {\n+\t\tret = 0;\n+\t\tgoto out_clean_inflight;\n+\t}\n+\n+\tif (test_bit(NBL_CHAN_IRQ_RDY, chan_info-\u003estate)) {\n+\t\twhile (!READ_ONCE(wait_head-\u003eacked)) {\n+\t\t\t/*\n+\t\t\t * avoids long task blocking when interrupt mode is\n+\t\t\t * disabled mid-wait. Cannot guarantee subsequent ACK\n+\t\t\t * delivery after interrupt mask off, only prevents\n+\t\t\t * infinite blocking. Spurious timeout is possible.\n+\t\t\t */\n+\t\t\tret = wait_event_timeout(wait_head-\u003ewait_queue,\n+\t\t\t\t\t\t READ_ONCE(wait_head-\u003eacked) ||\n+\t\t\t\t\t\t READ_ONCE(chan_info-\u003eshutdn) ||\n+\t\t\t\t\t\t !test_bit(NBL_CHAN_IRQ_RDY,\n+\t\t\t\t\t\t\t chan_info-\u003estate),\n+\t\t\t\t\t\t NBL_CHAN_ACK_WAIT_TIME);\n+\n+\t\t\tif (READ_ONCE(chan_info-\u003eshutdn)) {\n+\t\t\t\tret = -ESHUTDOWN;\n+\t\t\t\tgoto out_clear_wait_slot;\n+\t\t\t}\n+\t\t\tif (!test_bit(NBL_CHAN_IRQ_RDY, chan_info-\u003estate)) {\n+\t\t\t\tret = -EIO;\n+\t\t\t\tgoto out_clear_wait_slot;\n+\t\t\t}\n+\t\t\tif (ret == 0) {\n+\t\t\t\tmutex_lock(\u0026chan_info-\u003epending_lock);\n+\t\t\t\tif (READ_ONCE(wait_head-\u003estatus) ==\n+\t\t\t\t NBL_MBX_STATUS_WAITING) {\n+\t\t\t\t\tWRITE_ONCE(wait_head-\u003estatus,\n+\t\t\t\t\t\t NBL_MBX_STATUS_TIMEOUT);\n+\t\t\t\t\tWRITE_ONCE(wait_head-\u003eacked, 0);\n+\t\t\t\t\tWRITE_ONCE(wait_head-\u003eack_data, NULL);\n+\t\t\t\t\tWRITE_ONCE(wait_head-\u003eack_data_len, 0);\n+\t\t\t\t\t/*\n+\t\t\t\t\t * Ensure all status/ack slot\n+\t\t\t\t\t * updates are visible before subsequent\n+\t\t\t\t\t * readers observe acked == 0\n+\t\t\t\t\t */\n+\t\t\t\t\tsmp_wmb();\n+\t\t\t\t}\n+\t\t\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\t\t\tdev_err_ratelimited(dev,\n+\t\t\t\t\t\t \"Channel waiting ack failed, message type: %d, msg id: %u\\n\",\n+\t\t\t\t\t\t chan_send-\u003emsg_type, msgid);\n+\t\t\t\tret = -ETIMEDOUT;\n+\t\t\t\t/*\n+\t\t\t\t * TIMEOUT slots can be reused by another\n+\t\t\t\t * sender. The current sender no longer\n+\t\t\t\t * owns the slot after transitioning it to\n+\t\t\t\t * TIMEOUT.\n+\t\t\t\t */\n+\t\t\t\tgoto out_clean_inflight;\n+\t\t\t}\n+\n+\t\t\tif (READ_ONCE(wait_head-\u003eacked))\n+\t\t\t\tbreak;\n+\t\t}\n+\t\tif (READ_ONCE(wait_head-\u003eacked)) {\n+\t\t\t/*\n+\t\t\t * Load ordering: observe acked flag before\n+\t\t\t * reading ACK payload metadata.\n+\t\t\t */\n+\t\t\tsmp_rmb();\n+\t\t\tchan_send-\u003eack_len = READ_ONCE(wait_head-\u003eack_data_len);\n+\t\t\tret = READ_ONCE(wait_head-\u003eack_err);\n+\t\t}\n+\t} else {\n+\t\t/* Polling path for synchronous ACK */\n+\t\twhile (i--) {\n+\t\t\tif (READ_ONCE(chan_info-\u003eshutdn)) {\n+\t\t\t\tret = -ESHUTDOWN;\n+\t\t\t\tgoto out_clear_wait_slot;\n+\t\t\t}\n+\n+\t\t\tmutex_lock(\u0026chan_info-\u003estate_lock);\n+\t\t\ttask = READ_ONCE(chan_info-\u003eclean_task);\n+\t\t\tif (common-\u003ewq \u0026\u0026 task \u0026\u0026\n+\t\t\t !READ_ONCE(chan_info-\u003eshutdn) \u0026\u0026\n+\t\t\t !work_pending(task))\n+\t\t\t\tqueue_work(common-\u003ewq, task);\n+\t\t\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+\t\t\tif (READ_ONCE(wait_head-\u003eacked)) {\n+\t\t\t\t/*\n+\t\t\t\t * Guarantee load order: observe acked\n+\t\t\t\t * flag before reading ack payload metadata.\n+\t\t\t\t */\n+\t\t\t\tsmp_rmb();\n+\t\t\t\tchan_send-\u003eack_len =\n+\t\t\t\t\tREAD_ONCE(wait_head-\u003eack_data_len);\n+\t\t\t\tret = READ_ONCE(wait_head-\u003eack_err);\n+\t\t\t\tgoto out_clear_wait_slot;\n+\t\t\t}\n+\n+\t\t\tusleep_range(NBL_CHAN_TX_WAIT_ACK_US_MIN,\n+\t\t\t\t NBL_CHAN_TX_WAIT_ACK_US_MAX);\n+\t\t\tcond_resched();\n+\t\t}\n+\t\tmutex_lock(\u0026chan_info-\u003epending_lock);\n+\t\tif (READ_ONCE(wait_head-\u003estatus) == NBL_MBX_STATUS_ACKD) {\n+\t\t\t/* Ensure status load completes before ack payload/err\n+\t\t\t * loads.\n+\t\t\t */\n+\t\t\tsmp_rmb();\n+\t\t\tchan_send-\u003eack_len = READ_ONCE(wait_head-\u003eack_data_len);\n+\t\t\tret = READ_ONCE(wait_head-\u003eack_err);\n+\t\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\t\tgoto out_clear_wait_slot;\n+\t\t}\n+\t\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\t\tdev_err_ratelimited(dev,\n+\t\t\t\t \"Channel polling ack failed, message type: %d msg id: %u\\n\",\n+\t\t\t\t chan_send-\u003emsg_type, msgid);\n+\t\tret = -ETIMEDOUT;\n+\t}\n+\n+out_clear_wait_slot:\n+\tmutex_lock(\u0026chan_info-\u003epending_lock);\n+\tnbl_chan_reset_wait_head(chan_info, wait_head);\n+\tmutex_unlock(\u0026chan_info-\u003epending_lock);\n+\n+out_clean_inflight:\n+\tmutex_lock(\u0026chan_info-\u003estate_lock);\n+\tif (atomic_dec_and_test(\u0026chan_info-\u003einflight_tx_cnt))\n+\t\twake_up(\u0026chan_info-\u003einflight_wait);\n+\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+\treturn ret;\n+}\n+\n+static int nbl_chan_send_ack(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t struct nbl_chan_ack_info *chan_ack)\n+{\n+\tsize_t head_len = NBL_CHAN_ACK_HEAD_LEN * sizeof(u32);\n+\tsize_t data_len = chan_ack-\u003edata_len;\n+\tstruct nbl_chan_send_info chan_send;\n+\t__le32 *tmp;\n+\tsize_t len;\n+\tint ret;\n+\n+\tif (data_len \u003e\n+\t NBL_CHAN_BUF_LEN - sizeof(struct nbl_chan_tx_desc) - head_len)\n+\t\treturn -EINVAL;\n+\n+\tlen = head_len + data_len;\n+\ttmp = kzalloc(len, GFP_KERNEL);\n+\tif (!tmp)\n+\t\treturn -ENOMEM;\n+\n+\t*(__le16 *)\u0026tmp[NBL_CHAN_MSG_TYPE_POS] =\n+\t\tcpu_to_le16(chan_ack-\u003emsg_type);\n+\t*(__le16 *)\u0026tmp[NBL_CHAN_MSG_ID_POS] = cpu_to_le16(chan_ack-\u003emsgid);\n+\ttmp[NBL_CHAN_ACK_RET_POS] = cpu_to_le32(chan_ack-\u003eerr);\n+\tif (chan_ack-\u003edata \u0026\u0026 chan_ack-\u003edata_len)\n+\t\tmemcpy(\u0026tmp[NBL_CHAN_ACK_HEAD_LEN], chan_ack-\u003edata,\n+\t\t chan_ack-\u003edata_len);\n+\n+\tnbl_chan_fill_send_info(\u0026chan_send, chan_ack-\u003edstid, NBL_CHAN_MSG_ACK,\n+\t\t\t\ttmp, len, NULL, 0, 0);\n+\tret = nbl_chan_send_msg(chan_mgt, \u0026chan_send);\n+\tkfree(tmp);\n+\n+\treturn ret;\n+}\n+\n+static int nbl_chan_register_msg(struct nbl_channel_mgt *chan_mgt, u16 msg_type,\n+\t\t\t\t nbl_chan_resp func, void *callback)\n+{\n+\treturn nbl_chan_add_msg_handler(chan_mgt, msg_type, func, callback);\n+}\n+\n+static bool nbl_chan_check_queue_exist(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t u8 chan_type)\n+{\n+\tstruct nbl_chan_info *chan_info = chan_mgt-\u003echan_info[chan_type];\n+\n+\treturn chan_info ? true : false;\n+}\n+\n+static void nbl_chan_register_chan_task(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t\tu8 chan_type, struct work_struct *task)\n+{\n+\tstruct nbl_chan_info *chan_info = chan_mgt-\u003echan_info[chan_type];\n+\n+\tmutex_lock(\u0026chan_info-\u003estate_lock);\n+\tif (!READ_ONCE(chan_info-\u003eshutdn))\n+\t\tWRITE_ONCE(chan_info-\u003eclean_task, task);\n+\tmutex_unlock(\u0026chan_info-\u003estate_lock);\n+}\n+\n+static void nbl_chan_set_queue_state(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t enum nbl_chan_state state, u8 chan_type,\n+\t\t\t\t u8 set)\n+{\n+\tstruct nbl_chan_info *chan_info = chan_mgt-\u003echan_info[chan_type];\n+\tint i;\n+\n+\tif (set)\n+\t\tset_bit(state, chan_info-\u003estate);\n+\telse\n+\t\tclear_bit(state, chan_info-\u003estate);\n+\t/*\n+\t * When clearing IRQ_RDY, wake all per-slot wait queues so\n+\t * sleeping senders observe the condition immediately and\n+\t * return -EIO instead of waiting out the 3s timeout and\n+\t * reporting -ETIMEDOUT.\n+\t */\n+\tif (!set \u0026\u0026 state == NBL_CHAN_IRQ_RDY) {\n+\t\tfor (i = 0; i \u003c chan_info-\u003enum_txq_entries; i++)\n+\t\t\twake_up_all(\u0026chan_info-\u003ewait[i].wait_queue);\n+\t}\n+}\n+\n+static struct nbl_channel_ops chan_ops = {\n+\t.send_msg\t\t\t= nbl_chan_send_msg,\n+\t.send_ack\t\t\t= nbl_chan_send_ack,\n+\t.register_msg\t\t\t= nbl_chan_register_msg,\n+\t.unregister_all_msg\t\t= nbl_chan_remove_msg_handler,\n+\t.cfg_chan_qinfo_map_table\t= nbl_chan_cfg_qinfo_map_table,\n+\t.check_queue_exist\t\t= nbl_chan_check_queue_exist,\n+\t.setup_queue\t\t\t= nbl_chan_setup_queue,\n+\t.teardown_queue\t\t\t= nbl_chan_teardown_queue,\n+\t.clean_queue_subtask\t\t= nbl_chan_clean_queue_subtask,\n+\t.register_chan_task\t\t= nbl_chan_register_chan_task,\n+\t.set_queue_state\t\t= nbl_chan_set_queue_state,\n+};\n+\n+static struct nbl_channel_mgt *\n+nbl_chan_setup_chan_mgt(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl = adapter-\u003eintf.hw_ops_tbl;\n+\tstruct nbl_common_info *common = \u0026adapter-\u003ecommon;\n+\tstruct device *dev = \u0026adapter-\u003epdev-\u003edev;\n+\tstruct nbl_channel_mgt *chan_mgt;\n+\tstruct nbl_chan_info *mailbox;\n+\tint ret;\n+\n+\tchan_mgt = devm_kzalloc(dev, sizeof(*chan_mgt), GFP_KERNEL);\n+\tif (!chan_mgt)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\tchan_mgt-\u003ecommon = common;\n+\tchan_mgt-\u003ehw_ops_tbl = hw_ops_tbl;\n+\n+\tmailbox = devm_kzalloc(dev, sizeof(*mailbox), GFP_KERNEL);\n+\tif (!mailbox)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\tmailbox-\u003echan_type = NBL_CHAN_TYPE_MAILBOX;\n+\tchan_mgt-\u003echan_info[NBL_CHAN_TYPE_MAILBOX] = mailbox;\n+\n+\tret = nbl_chan_init_msg_handler(chan_mgt);\n+\tif (ret)\n+\t\treturn ERR_PTR(ret);\n+\tret = devm_mutex_init(common-\u003edev, \u0026mailbox-\u003etxq_lock);\n+\tif (ret)\n+\t\treturn ERR_PTR(ret);\n+\tret = devm_mutex_init(common-\u003edev, \u0026mailbox-\u003estate_lock);\n+\tif (ret)\n+\t\treturn ERR_PTR(ret);\n+\tret = devm_mutex_init(common-\u003edev, \u0026mailbox-\u003epending_lock);\n+\tif (ret)\n+\t\treturn ERR_PTR(ret);\n+\treturn chan_mgt;\n+}\n+\n+static struct nbl_channel_ops_tbl *\n+nbl_chan_setup_ops(struct device *dev, struct nbl_channel_mgt *chan_mgt)\n+{\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl;\n+\tint ret;\n+\n+\tchan_ops_tbl = devm_kzalloc(dev, sizeof(*chan_ops_tbl), GFP_KERNEL);\n+\tif (!chan_ops_tbl)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\tif (!chan_ops.send_msg || !chan_ops.send_ack ||\n+\t !chan_ops.register_msg || !chan_ops.unregister_all_msg ||\n+\t !chan_ops.cfg_chan_qinfo_map_table ||\n+\t !chan_ops.check_queue_exist || !chan_ops.setup_queue ||\n+\t !chan_ops.teardown_queue || !chan_ops.clean_queue_subtask ||\n+\t !chan_ops.register_chan_task || !chan_ops.set_queue_state)\n+\t\treturn ERR_PTR(-EINVAL);\n+\n+\tchan_ops_tbl-\u003eops = \u0026chan_ops;\n+\tchan_ops_tbl-\u003epriv = chan_mgt;\n+\n+\tret = nbl_chan_register_msg(chan_mgt, NBL_CHAN_MSG_ACK,\n+\t\t\t\t nbl_chan_recv_ack_msg, chan_mgt);\n+\tif (ret)\n+\t\treturn ERR_PTR(ret);\n+\n+\treturn chan_ops_tbl;\n+}\n+\n+int nbl_chan_init_common(struct nbl_adapter *adap)\n+{\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl;\n+\tstruct device *dev = \u0026adap-\u003epdev-\u003edev;\n+\tstruct nbl_channel_mgt *chan_mgt;\n+\tint ret;\n+\n+\tchan_mgt = nbl_chan_setup_chan_mgt(adap);\n+\tif (IS_ERR(chan_mgt)) {\n+\t\tret = PTR_ERR(chan_mgt);\n+\t\tgoto exit;\n+\t}\n+\n+\tchan_ops_tbl = nbl_chan_setup_ops(dev, chan_mgt);\n+\tif (IS_ERR(chan_ops_tbl)) {\n+\t\tret = PTR_ERR(chan_ops_tbl);\n+\t\tgoto cleanup_mgt;\n+\t}\n+\n+\tadap-\u003eintf.channel_ops_tbl = chan_ops_tbl;\n+\tadap-\u003ecore.chan_mgt = chan_mgt;\n+\tret = nbl_common_create_wq(\u0026adap-\u003ecommon);\n+\tif (ret)\n+\t\tgoto cleanup_mgt;\n+\treturn 0;\n+\n+cleanup_mgt:\n+\tnbl_chan_remove_msg_handler(chan_mgt);\n+exit:\n+\treturn ret;\n+}\n+\n+void nbl_chan_remove_common(struct nbl_adapter *adap)\n+{\n+\tstruct nbl_channel_mgt *chan_mgt = adap-\u003ecore.chan_mgt;\n+\n+\tif (!chan_mgt)\n+\t\treturn;\n+\tnbl_common_destroy_wq(\u0026adap-\u003ecommon);\n+\t/*\n+\t * All channel queues shall be torn down earlier in remove path\n+\t * to drain inflight tx workers and stop hardware before destroying\n+\t * message handler hash table.\n+\t */\n+\tnbl_chan_remove_msg_handler(chan_mgt);\n+\tadap-\u003ecore.chan_mgt = NULL;\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.h\nnew file mode 100644\nindex 0000000000000..403a4d22111ba\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.h\n@@ -0,0 +1,171 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_CHANNEL_H_\n+#define _NBL_CHANNEL_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+#include \"../nbl_include/nbl_include.h\"\n+#include \"../nbl_include/nbl_def_channel.h\"\n+#include \"../nbl_include/nbl_def_hw.h\"\n+#include \"../nbl_include/nbl_def_common.h\"\n+#include \"../nbl_core.h\"\n+\n+#define NBL_CHAN_TX_RING_TO_DESC(tx_ring, i) \\\n+\t(\u0026((((tx_ring)-\u003edesc.tx_desc))[i]))\n+#define NBL_CHAN_RX_RING_TO_DESC(rx_ring, i) \\\n+\t(\u0026((((rx_ring)-\u003edesc.rx_desc))[i]))\n+#define NBL_CHAN_TX_RING_TO_BUF(tx_ring, i) (\u0026(((tx_ring)-\u003ebuf)[i]))\n+#define NBL_CHAN_RX_RING_TO_BUF(rx_ring, i) (\u0026(((rx_ring)-\u003ebuf)[i]))\n+\n+#define NBL_CHAN_TX_WAIT_US\t\t\t100\n+#define NBL_CHAN_TX_WAIT_US_MAX\t\t\t120\n+#define NBL_CHAN_TX_WAIT_TIMES\t\t\t100\n+#define NBL_CHAN_TX_WAIT_ACK_US_MIN\t\t1000\n+#define NBL_CHAN_TX_WAIT_ACK_US_MAX\t\t1200\n+#define NBL_CHAN_TX_WAIT_ACK_TIMES\t\t5000\n+#define NBL_CHAN_QUEUE_LEN\t\t\t256\n+#define NBL_CHAN_BUF_LEN\t\t\t4096\n+#define NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN\t16\n+\n+#define NBL_CHAN_TX_DESC_AVAIL\t\t\t0\n+#define NBL_CHAN_TX_DESC_USED\t\t\t1\n+#define NBL_CHAN_RX_DESC_WRITE\t\t\t1\n+#define NBL_CHAN_RX_DESC_AVAIL\t\t\t3\n+#define NBL_CHAN_RX_DESC_USED\t\t\t4\n+\n+#define NBL_CHAN_ACK_HEAD_LEN\t\t\t3\n+#define NBL_CHAN_ACK_RET_POS\t\t\t2\n+#define NBL_CHAN_MSG_ID_POS\t\t\t1\n+#define NBL_CHAN_MSG_TYPE_POS\t\t\t0\n+\n+#define NBL_CHAN_ACK_WAIT_TIME\t\t\t(3 * HZ)\n+#define NBL_CHAN_RX_CLEAN_BUDGET\t\t64\n+#define NBL_CHAN_HANDLER_TBL_BUCKET_SIZE\t512\n+\n+enum {\n+\tNBL_MB_RX_QID = 0,\n+\tNBL_MB_TX_QID = 1,\n+};\n+\n+enum {\n+\tNBL_MBX_STATUS_IDLE = 0,\n+\tNBL_MBX_STATUS_WAITING,\n+\tNBL_MBX_STATUS_ACKD,\n+\tNBL_MBX_STATUS_TIMEOUT,\n+};\n+\n+struct nbl_chan_tx_param {\n+\tenum nbl_chan_msg_type msg_type;\n+\tvoid *arg;\n+\tsize_t arg_len;\n+\tu16 dstid;\n+\tu16 msgid;\n+};\n+\n+struct nbl_chan_buf {\n+\tvoid *va;\n+\tdma_addr_t pa;\n+\tsize_t size;\n+};\n+\n+struct nbl_chan_tx_desc {\n+\t__le16 flags;\n+\t__le16 srcid;\n+\t__le16 dstid;\n+\t__le16 data_len;\n+\t__le16 buf_len;\n+\t__le64 buf_addr;\n+\t__le16 msg_type;\n+\tu8 data[NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN];\n+\t__le16 msgid;\n+\tu8 rsv[26];\n+} __packed;\n+\n+struct nbl_chan_rx_desc {\n+\t__le16 flags;\n+\t__le32 buf_len;\n+\t__le16 buf_id;\n+\t__le64 buf_addr;\n+} __packed;\n+\n+union nbl_chan_desc_ptr {\n+\tstruct nbl_chan_tx_desc *tx_desc;\n+\tstruct nbl_chan_rx_desc *rx_desc;\n+};\n+\n+struct nbl_chan_ring {\n+\tunion nbl_chan_desc_ptr desc;\n+\tstruct nbl_chan_buf *buf;\n+\tu16 next_to_use;\n+\tu16 tail_ptr; /* hardware does modulo ring size internally */\n+\tu16 next_to_clean;\n+\tdma_addr_t dma;\n+};\n+\n+#define NBL_CHAN_MSG_INDEX_MAX 63\n+\n+#define NBL_CHAN_MSGID_INDEX_MASK GENMASK(5, 0)\n+#define NBL_CHAN_MSGID_LOC_MASK GENMASK(13, 6)\n+\n+static inline void nbl_chan_update_tail_ptr(struct nbl_hw_ops *hw_ops,\n+\t\t\t\t\t void *hw_priv, u32 tail_ptr, u8 qid)\n+{\n+\thw_ops-\u003eupdate_mailbox_queue_tail_ptr(hw_priv, tail_ptr, qid);\n+}\n+\n+struct nbl_chan_waitqueue_head {\n+\tstruct wait_queue_head wait_queue;\n+\tchar *ack_data;\n+\tint acked;\n+\ts32 ack_err;\n+\tu16 ack_data_len;\n+\tu16 msg_type;\n+\tint status;\n+\tu8 msg_index;\n+\tu16 dstid;\n+};\n+\n+struct nbl_chan_info {\n+\twait_queue_head_t inflight_wait;\n+\tstruct nbl_chan_ring txq;\n+\tstruct nbl_chan_ring rxq;\n+\tstruct nbl_chan_waitqueue_head *wait;\n+\t/*\n+\t *Protects access to the TX queue (txq) and related metadata.\n+\t *This mutex ensures exclusive access when updating the TX queue\n+\t */\n+\tstruct mutex txq_lock;\n+\t/* Guards channel state bitmap, active and shutdn flags */\n+\tstruct mutex state_lock;\n+\t/* Guards pending requests and pending work list operations */\n+\tstruct mutex pending_lock;\n+\tstruct work_struct *clean_task;\n+\tu16 wait_head_index;\n+\tu16 num_txq_entries;\n+\tu16 num_rxq_entries;\n+\tu16 txq_buf_size;\n+\tu16 rxq_buf_size;\n+\tDECLARE_BITMAP(state, NBL_CHAN_STATE_NBITS);\n+\tu8 chan_type;\n+\tatomic_t inflight_tx_cnt;\n+\tbool shutdn;\n+\tbool active;\n+};\n+\n+struct nbl_chan_msg_node_data {\n+\tnbl_chan_resp func;\n+\tvoid *priv;\n+};\n+\n+struct nbl_channel_mgt {\n+\tstruct nbl_common_info *common;\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl;\n+\tstruct nbl_chan_info *chan_info[NBL_CHAN_TYPE_MAX];\n+\tstruct nbl_hash_tbl_mgt *handle_hash_tbl;\n+};\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.c\nnew file mode 100644\nindex 0000000000000..597c11ed7fd8a\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.c\n@@ -0,0 +1,231 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/jhash.h\u003e\n+#include \"nbl_common.h\"\n+\n+void nbl_common_destroy_wq(struct nbl_common_info *common)\n+{\n+\tif (!common || !common-\u003ewq)\n+\t\treturn;\n+\n+\tdestroy_workqueue(common-\u003ewq);\n+\tcommon-\u003ewq = NULL;\n+}\n+\n+int nbl_common_create_wq(struct nbl_common_info *common)\n+{\n+\tchar wq_name[32];\n+\n+\tsnprintf(wq_name, sizeof(wq_name), \"nbl_wq_%s\", pci_name(common-\u003epdev));\n+\tcommon-\u003ewq = alloc_workqueue(wq_name, WQ_UNBOUND, 0);\n+\tif (!common-\u003ewq) {\n+\t\tdev_err(common-\u003edev, \"Failed to alloc workqueue %s\\n\", wq_name);\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+/**\n+ * nbl_common_func_id_to_rel_pf_id - convert absolute PF id to relative PF id\n+ * @common: common device info\n+ * @pf_id: absolute PF identifier\n+ * @rel_pf_id: output relative pf id\n+ *\n+ * Leonis uses fixed mgt_pf = 0. Support future non-zero management PF.\n+ *\n+ * Return: 0 on success, -EINVAL on invalid arguments.\n+ */\n+int nbl_common_func_id_to_rel_pf_id(struct nbl_common_info *common, u32 pf_id,\n+\t\t\t\t u32 *rel_pf_id)\n+{\n+\tif (!rel_pf_id)\n+\t\treturn -EINVAL;\n+\n+\tif (pf_id \u003c common-\u003emgt_pf)\n+\t\treturn -EINVAL;\n+\t*rel_pf_id = pf_id - common-\u003emgt_pf;\n+\treturn 0;\n+}\n+\n+static u32 nbl_common_calc_hash_key(void *key, u32 key_size, u32 bucket_size)\n+{\n+\tu32 hash;\n+\n+\tif (bucket_size == 0 || bucket_size == 1)\n+\t\treturn 0;\n+\n+\thash = jhash(key, key_size, 0);\n+\n+\t/* Use bitmask if bucket_size is a power of 2 */\n+\tif ((bucket_size \u0026 (bucket_size - 1)) == 0)\n+\t\treturn hash \u0026 (bucket_size - 1);\n+\treturn hash % bucket_size;\n+}\n+\n+/**\n+ * nbl_common_init_hash_table - initialize per-device hash table\n+ * @key: hash table creation parameters\n+ *\n+ * Return: allocated tbl mgt pointer, NULL on failure.\n+ */\n+struct nbl_hash_tbl_mgt *\n+nbl_common_init_hash_table(struct nbl_hash_tbl_key *key)\n+{\n+\tstruct nbl_hash_tbl_mgt *tbl_mgt;\n+\tu32 bucket_size;\n+\tu32 i;\n+\n+\ttbl_mgt = devm_kzalloc(key-\u003edev, sizeof(*tbl_mgt), GFP_KERNEL);\n+\tif (!tbl_mgt)\n+\t\treturn NULL;\n+\n+\tbucket_size = key-\u003ebucket_size;\n+\ttbl_mgt-\u003ehash = devm_kcalloc(key-\u003edev, bucket_size,\n+\t\t\t\t sizeof(struct hlist_head), GFP_KERNEL);\n+\tif (!tbl_mgt-\u003ehash)\n+\t\treturn NULL;\n+\n+\ttbl_mgt-\u003ebucket_locks = devm_kcalloc(key-\u003edev, bucket_size,\n+\t\t\t\t\t sizeof(spinlock_t), GFP_KERNEL);\n+\tif (!tbl_mgt-\u003ebucket_locks)\n+\t\treturn NULL;\n+\n+\tfor (i = 0; i \u003c bucket_size; i++) {\n+\t\tINIT_HLIST_HEAD(\u0026tbl_mgt-\u003ehash[i]);\n+\t\tspin_lock_init(\u0026tbl_mgt-\u003ebucket_locks[i]);\n+\t}\n+\n+\tmemcpy(\u0026tbl_mgt-\u003etbl_key, key, sizeof(tbl_mgt-\u003etbl_key));\n+\ttbl_mgt-\u003enode_num = 0;\n+\n+\treturn tbl_mgt;\n+}\n+\n+/**\n+ * nbl_common_alloc_hash_node - insert handler node into hash table\n+ * @tbl_mgt: hash table manager\n+ * @key: match key (msg_type)\n+ * @data: handler callback info\n+ * @out_data: optional pointer to return allocated data ptr\n+ *\n+ * Caller context: process context for dynamic registration, init path safe.\n+ * Protected by per-bucket spin_lock_bh to avoid race with concurrent lookup.\n+ *\n+ * Return: 0 on success, -ENOMEM on allocation failure.\n+ */\n+int nbl_common_alloc_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key,\n+\t\t\t void *data, void **out_data)\n+{\n+\tstruct nbl_hash_entry_node *hash_node;\n+\tu16 data_size;\n+\tu16 node_size;\n+\tu32 hash_val;\n+\tu16 key_size;\n+\n+\tnode_size = sizeof(*hash_node);\n+\thash_node = kzalloc(node_size, GFP_KERNEL);\n+\tif (!hash_node)\n+\t\treturn -ENOMEM;\n+\n+\tkey_size = tbl_mgt-\u003etbl_key.key_size;\n+\thash_node-\u003ekey = kzalloc(key_size, GFP_KERNEL);\n+\tif (!hash_node-\u003ekey)\n+\t\tgoto alloc_key_failed;\n+\n+\tdata_size = tbl_mgt-\u003etbl_key.data_size;\n+\thash_node-\u003edata = kzalloc(data_size, GFP_KERNEL);\n+\tif (!hash_node-\u003edata)\n+\t\tgoto alloc_data_failed;\n+\n+\tmemcpy(hash_node-\u003ekey, key, key_size);\n+\tmemcpy(hash_node-\u003edata, data, data_size);\n+\n+\thash_val = nbl_common_calc_hash_key(key, key_size,\n+\t\t\t\t\t tbl_mgt-\u003etbl_key.bucket_size);\n+\n+\tspin_lock_bh(\u0026tbl_mgt-\u003ebucket_locks[hash_val]);\n+\thlist_add_head(\u0026hash_node-\u003enode, tbl_mgt-\u003ehash + hash_val);\n+\ttbl_mgt-\u003enode_num++;\n+\tspin_unlock_bh(\u0026tbl_mgt-\u003ebucket_locks[hash_val]);\n+\n+\tif (out_data)\n+\t\t*out_data = hash_node-\u003edata;\n+\n+\treturn 0;\n+\n+alloc_data_failed:\n+\tkfree(hash_node-\u003ekey);\n+alloc_key_failed:\n+\tkfree(hash_node);\n+\treturn -ENOMEM;\n+}\n+\n+/**\n+ * nbl_common_get_hash_node - lookup handler from hash table\n+ * @tbl_mgt: hash table manager\n+ * @key: lookup key\n+ *\n+ * All accessors use spin_lock_bh so that process-context holders\n+ * disable softirq and cannot deadlock against a concurrent softirq\n+ * caller (e.g. NAPI RX path). Safe in both process and softirq\n+ * context.\n+ *\n+ * Return: attached handler data if found, NULL otherwise.\n+ */\n+void *nbl_common_get_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key)\n+{\n+\tstruct nbl_hash_entry_node *hash_node;\n+\tstruct hlist_head *head;\n+\tvoid *data = NULL;\n+\tu32 hash_val;\n+\tu16 key_size;\n+\n+\tkey_size = tbl_mgt-\u003etbl_key.key_size;\n+\thash_val = nbl_common_calc_hash_key(key, key_size,\n+\t\t\t\t\t tbl_mgt-\u003etbl_key.bucket_size);\n+\thead = tbl_mgt-\u003ehash + hash_val;\n+\n+\tspin_lock_bh(\u0026tbl_mgt-\u003ebucket_locks[hash_val]);\n+\thlist_for_each_entry(hash_node, head, node) {\n+\t\tif (!memcmp(hash_node-\u003ekey, key, key_size)) {\n+\t\t\tdata = hash_node-\u003edata;\n+\t\t\tbreak;\n+\t\t}\n+\t}\n+\tspin_unlock_bh(\u0026tbl_mgt-\u003ebucket_locks[hash_val]);\n+\n+\treturn data;\n+}\n+\n+/*\n+ * Free all hash nodes in the table.\n+ */\n+void nbl_common_remove_hash_table(struct nbl_hash_tbl_mgt *tbl_mgt)\n+{\n+\tstruct nbl_hash_entry_node *hash_node;\n+\tstruct hlist_node *safe_node;\n+\tstruct hlist_head *head;\n+\tu32 i;\n+\n+\tif (!tbl_mgt)\n+\t\treturn;\n+\n+\tfor (i = 0; i \u003c tbl_mgt-\u003etbl_key.bucket_size; i++) {\n+\t\thead = tbl_mgt-\u003ehash + i;\n+\n+\t\tspin_lock_bh(\u0026tbl_mgt-\u003ebucket_locks[i]);\n+\t\thlist_for_each_entry_safe(hash_node, safe_node, head, node) {\n+\t\t\thlist_del(\u0026hash_node-\u003enode);\n+\t\t\ttbl_mgt-\u003enode_num--;\n+\t\t\tkfree(hash_node-\u003ekey);\n+\t\t\tkfree(hash_node-\u003edata);\n+\t\t\tkfree(hash_node);\n+\t\t}\n+\t\tspin_unlock_bh(\u0026tbl_mgt-\u003ebucket_locks[i]);\n+\t}\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.h\nnew file mode 100644\nindex 0000000000000..159421e53902c\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.h\n@@ -0,0 +1,32 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_COMMON_H_\n+#define _NBL_COMMON_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+#include \"../nbl_include/nbl_include.h\"\n+#include \"../nbl_include/nbl_def_common.h\"\n+\n+struct nbl_hash_tbl_mgt {\n+\tstruct nbl_hash_tbl_key tbl_key;\n+\tstruct hlist_head *hash;\n+\t/**\n+\t * bucket_locks: per-bucket spinlock array\n+\t * Each hash bucket corresponds to an independent spinlock.\n+\t * Protects concurrent hash list modification\n+\t */\n+\tspinlock_t *bucket_locks;\n+\tu16 node_num;\n+};\n+\n+struct nbl_hash_entry_node {\n+\tstruct hlist_node node;\n+\tvoid *key;\n+\tvoid *data;\n+};\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core.h\nnew file mode 100644\nindex 0000000000000..56872c8ca9a7e\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core.h\n@@ -0,0 +1,45 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_CORE_H_\n+#define _NBL_CORE_H_\n+\n+#include \u003clinux/pci.h\u003e\n+#include \"nbl_include/nbl_include.h\"\n+#include \"nbl_include/nbl_def_common.h\"\n+\n+enum {\n+\tNBL_CAP_HAS_NET_BIT,\n+};\n+\n+struct nbl_interface {\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl;\n+\tstruct nbl_resource_ops_tbl *resource_ops_tbl;\n+\tstruct nbl_dispatch_ops_tbl *dispatch_ops_tbl;\n+\tstruct nbl_channel_ops_tbl *channel_ops_tbl;\n+};\n+\n+struct nbl_core {\n+\tstruct nbl_hw_mgt *hw_mgt;\n+\tstruct nbl_resource_mgt *res_mgt;\n+\tstruct nbl_dispatch_mgt *disp_mgt;\n+\tstruct nbl_dev_mgt *dev_mgt;\n+\tstruct nbl_channel_mgt *chan_mgt;\n+};\n+\n+struct nbl_adapter {\n+\tstruct pci_dev *pdev;\n+\tstruct nbl_core core;\n+\tstruct nbl_interface intf;\n+\tstruct nbl_common_info common;\n+};\n+\n+struct nbl_adapter *nbl_core_init(struct pci_dev *pdev,\n+\t\t\t\t struct nbl_init_param *param);\n+void nbl_core_remove(struct nbl_adapter *adapter);\n+int nbl_core_start(struct nbl_adapter *adapter);\n+void nbl_core_stop(struct nbl_adapter *adapter);\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c\nnew file mode 100644\nindex 0000000000000..e9b0576de0f30\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c\n@@ -0,0 +1,571 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \"nbl_dev.h\"\n+\n+static void nbl_dev_clean_mailbox_schedule(struct nbl_dev_mgt *dev_mgt);\n+\n+/* ---------- Interrupt config ---------- */\n+static irqreturn_t nbl_dev_clean_mailbox(int irq __always_unused, void *data)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = (struct nbl_dev_mgt *)data;\n+\n+\tnbl_dev_clean_mailbox_schedule(dev_mgt);\n+\treturn IRQ_HANDLED;\n+}\n+\n+static void nbl_dev_init_msix_cnt(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\n+\t/* mailbox vector allocated in nbl_dev_start() via\n+\t * nbl_dev_init_interrupt_scheme(); nbl_dev_request_mailbox_irq()\n+\t * only attaches the irq handler to pre-allocated vectors.\n+\t */\n+\tmsix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].num = 1;\n+}\n+\n+static int nbl_dev_request_mailbox_irq(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\tstruct nbl_common_info *common = dev_mgt-\u003ecommon;\n+\tu16 lvec;\n+\tint irq_num;\n+\tint err;\n+\n+\tif (!msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].num)\n+\t\treturn 0;\n+\n+\tlvec = msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;\n+\tirq_num = pci_irq_vector(common-\u003epdev, lvec);\n+\tif (irq_num \u003c 0) {\n+\t\tdev_err(common-\u003edev, \"Failed to get mailbox IRQ vector: %d\\n\",\n+\t\t\tirq_num);\n+\t\treturn irq_num;\n+\t}\n+\n+\tsnprintf(dev_common-\u003emailbox_name, sizeof(dev_common-\u003emailbox_name),\n+\t\t \"nbl_mailbox@pci:%s\", pci_name(common-\u003epdev));\n+\terr = request_irq(irq_num, nbl_dev_clean_mailbox, 0,\n+\t\t\t dev_common-\u003emailbox_name, dev_mgt);\n+\tif (err)\n+\t\treturn err;\n+\n+\treturn 0;\n+}\n+\n+static void nbl_dev_free_mailbox_irq(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\tstruct nbl_common_info *common = dev_mgt-\u003ecommon;\n+\tu16 lvec;\n+\tint irq_num;\n+\n+\tif (!msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].num)\n+\t\treturn;\n+\n+\tlvec = msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;\n+\tirq_num = pci_irq_vector(common-\u003epdev, lvec);\n+\tif (irq_num \u003e= 0)\n+\t\tfree_irq(irq_num, dev_mgt);\n+}\n+\n+static int nbl_dev_enable_mailbox_irq(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\tu16 lvec;\n+\tint ret;\n+\n+\tif (!msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].num)\n+\t\treturn 0;\n+\n+\tlvec = msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;\n+\t/*\n+\t * Enable sequence: perform set_mailbox_irq RPC in polling mode first.\n+\t * Only set NBL_CHAN_IRQ_RDY after RPC succeeds, mirroring disable path.\n+\t * This avoids waiting for an interrupt which has not been armed yet.\n+\t */\n+\tret = disp_ops-\u003eset_mailbox_irq(dev_mgt-\u003edisp_ops_tbl-\u003epriv,\n+\t\t\t\t\tlvec, true);\n+\tif (ret)\n+\t\treturn ret;\n+\tchan_ops-\u003eset_queue_state(dev_mgt-\u003echan_ops_tbl-\u003epriv,\n+\t\t\t\t NBL_CHAN_IRQ_RDY,\n+\t\t\t\t NBL_CHAN_TYPE_MAILBOX, true);\n+\treturn 0;\n+}\n+\n+static int nbl_dev_disable_mailbox_irq(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\tu16 lvec;\n+\n+\tif (!msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].num)\n+\t\treturn 0;\n+\n+\tlvec = msix_info-\u003eserv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;\n+\t/*\n+\t * Disable sequence invariant: update software state first, then mask\n+\t * hardware interrupt. Must not reverse the order.\n+\t *\n+\t * If hardware interrupt is masked before clearing INTERRUPT_READY,\n+\t * the hardware may still transmit outstanding ACK packets for in-flight\n+\t * messages. Subsequent switch to polling mode discards pending ACK\n+\t * processing, triggering \"Channel waiting ack failed\" and \"Skip ack\n+\t * with invalid status\" errors.\n+\t *\n+\t * By entering polling mode first, any late hardware interrupts are\n+\t * ignored without pending ACK expectations, then hardware interrupt\n+\t * can be safely disabled.\n+\t *\n+\t * This helper is invoked in two paths:\n+\t * 1. Error unwind path of nbl_dev_start(): followed immediately by\n+\t * nbl_dev_free_mailbox_irq() and full channel teardown. No new mailbox\n+\t * interrupts can fire afterwards, and subsequent cancel_work_sync()\n+\t * drains pending cleanup work before resources are released.\n+\t * 2. Normal device stop path nbl_dev_stop(): free_irq() blocks until\n+\t * any in-flight hardirq handler completes and prevents new interrupts.\n+\t * cancel_work_sync() then waits for any already running mailbox cleanup\n+\t * work to finish, or cancels queued but unstarted work items before\n+\t * final channel destruction. No stuck descriptors linger in either\n+\t * scenario.\n+\t */\n+\tchan_ops-\u003eset_queue_state(dev_mgt-\u003echan_ops_tbl-\u003epriv,\n+\t\t\t\t NBL_CHAN_IRQ_RDY,\n+\t\t\t\t NBL_CHAN_TYPE_MAILBOX, false);\n+\n+\treturn disp_ops-\u003eset_mailbox_irq(dev_mgt-\u003edisp_ops_tbl-\u003epriv,\n+\t\t\t\t\t lvec, false);\n+}\n+\n+static int nbl_dev_cfg_msix_map(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\tbool mask_en = msix_info-\u003eserv_info[NBL_MSIX_NET_TYPE].hw_self_mask_en;\n+\tu16 msix_net_num = msix_info-\u003eserv_info[NBL_MSIX_NET_TYPE].num;\n+\tu16 msix_not_net_num = 0;\n+\tint err, i;\n+\n+\tmsix_info-\u003eserv_info[NBL_MSIX_NET_TYPE].base_vector_id = 0;\n+\t/*\n+\t * Calculate base_vector_id for each MSIX service type.\n+\t * This relies on NBL_MSIX_TYPE enum being ordered sequentially,\n+\t * starting from NBL_MSIX_NET_TYPE.\n+\t */\n+\tfor (i = NBL_MSIX_NET_TYPE + 1; i \u003c NBL_MSIX_TYPE_MAX; i++)\n+\t\tmsix_info-\u003eserv_info[i].base_vector_id =\n+\t\t\tmsix_info-\u003eserv_info[i - 1].base_vector_id +\n+\t\t\tmsix_info-\u003eserv_info[i - 1].num;\n+\n+\tfor (i = 0; i \u003c NBL_MSIX_TYPE_MAX; i++) {\n+\t\tif (i == NBL_MSIX_NET_TYPE)\n+\t\t\tcontinue;\n+\t\tmsix_not_net_num += msix_info-\u003eserv_info[i].num;\n+\t}\n+\n+\terr = disp_ops-\u003ecfg_msix_map(dev_mgt-\u003edisp_ops_tbl-\u003epriv,\n+\t\t\t\t msix_net_num, msix_not_net_num,\n+\t\t\t\t mask_en);\n+\n+\treturn err;\n+}\n+\n+static int nbl_dev_destroy_msix_map(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\n+\treturn disp_ops-\u003edestroy_msix_map(dev_mgt-\u003edisp_ops_tbl-\u003epriv);\n+}\n+\n+static int nbl_dev_init_interrupt_scheme(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dev_common *dev_common = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_msix_info *msix_info = \u0026dev_common-\u003emsix_info;\n+\tstruct nbl_common_info *common = dev_mgt-\u003ecommon;\n+\tint needed = 0;\n+\tint err;\n+\tint i;\n+\n+\tfor (i = 0; i \u003c NBL_MSIX_TYPE_MAX; i++)\n+\t\tneeded += msix_info-\u003eserv_info[i].num;\n+\n+\terr = pci_alloc_irq_vectors(common-\u003epdev, needed, needed,\n+\t\t\t\t PCI_IRQ_MSIX | PCI_IRQ_AFFINITY);\n+\tif (err \u003c 0) {\n+\t\tdev_err(common-\u003edev,\n+\t\t\t\"pci_alloc_irq_vectors failed, err = %d\\n\", err);\n+\t\treturn err;\n+\t}\n+\tif (err != needed) {\n+\t\tdev_err(common-\u003edev, \"pci_alloc_irq_vectors got %d vecs, need %d\\n\",\n+\t\t\terr, needed);\n+\t\treturn -ENOSPC;\n+\t}\n+\treturn 0;\n+}\n+\n+static void nbl_dev_clear_interrupt_scheme(struct nbl_dev_mgt *dev_mgt)\n+{\n+\t/*\n+\t * pcim_enable_device() is used in nbl_probe().\n+\t * pci_alloc_irq_vectors() registers pcim_msi_release devres callback,\n+\t * which invokes pci_free_irq_vectors() automatically on device detach.\n+\t * Do NOT call pci_free_irq_vectors() explicitly here to avoid\n+\t * double-free.\n+\t */\n+}\n+\n+/* ---------- Channel config ---------- */\n+static void nbl_dev_setup_chan_qinfo(struct nbl_dev_mgt *dev_mgt, u8 chan_type)\n+{\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_channel_mgt *priv = dev_mgt-\u003echan_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = dev_mgt-\u003ecommon;\n+\n+\tif (!chan_ops-\u003echeck_queue_exist(priv, chan_type))\n+\t\treturn;\n+\n+\tchan_ops-\u003ecfg_chan_qinfo_map_table(priv, common-\u003ehw_bus, common-\u003edevid);\n+}\n+\n+static int nbl_dev_setup_chan_queue(struct nbl_dev_mgt *dev_mgt, u8 chan_type)\n+{\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_channel_mgt *priv = dev_mgt-\u003echan_ops_tbl-\u003epriv;\n+\tint ret = 0;\n+\n+\tif (chan_ops-\u003echeck_queue_exist(priv, chan_type))\n+\t\tret = chan_ops-\u003esetup_queue(priv, chan_type);\n+\n+\treturn ret;\n+}\n+\n+static int nbl_dev_remove_chan_queue(struct nbl_dev_mgt *dev_mgt, u8 chan_type)\n+{\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_channel_mgt *priv = dev_mgt-\u003echan_ops_tbl-\u003epriv;\n+\tint ret = 0;\n+\n+\tif (chan_ops-\u003echeck_queue_exist(priv, chan_type))\n+\t\tret = chan_ops-\u003eteardown_queue(priv, chan_type);\n+\n+\treturn ret;\n+}\n+\n+static void nbl_dev_register_chan_task(struct nbl_dev_mgt *dev_mgt,\n+\t\t\t\t u8 chan_type, struct work_struct *task)\n+{\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\n+\tif (chan_ops-\u003echeck_queue_exist(dev_mgt-\u003echan_ops_tbl-\u003epriv, chan_type))\n+\t\tchan_ops-\u003eregister_chan_task(dev_mgt-\u003echan_ops_tbl-\u003epriv,\n+\t\t\t\t\t chan_type, task);\n+}\n+\n+/* ---------- Tasks config ---------- */\n+static void nbl_dev_clean_mailbox_task(struct work_struct *work)\n+{\n+\tstruct nbl_dev_common *common_dev =\n+\t\tcontainer_of(work, struct nbl_dev_common, clean_mbx_task);\n+\tstruct nbl_dev_mgt *dev_mgt = common_dev-\u003edev_mgt;\n+\tstruct nbl_channel_ops *chan_ops = dev_mgt-\u003echan_ops_tbl-\u003eops;\n+\n+\tchan_ops-\u003eclean_queue_subtask(dev_mgt-\u003echan_ops_tbl-\u003epriv,\n+\t\t\t\t NBL_CHAN_TYPE_MAILBOX);\n+}\n+\n+static void nbl_dev_clean_mailbox_schedule(struct nbl_dev_mgt *dev_mgt)\n+{\n+\tstruct nbl_dev_common *common_dev = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_common_info *common = dev_mgt-\u003ecommon;\n+\n+\tqueue_work(common-\u003ewq, \u0026common_dev-\u003eclean_mbx_task);\n+}\n+\n+/* ---------- Dev init process ---------- */\n+static int nbl_dev_setup_common_dev(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = adapter-\u003ecore.dev_mgt;\n+\tstruct nbl_dev_common *common_dev;\n+\tint ret;\n+\n+\tcommon_dev = devm_kzalloc(\u0026adapter-\u003epdev-\u003edev, sizeof(*common_dev),\n+\t\t\t\t GFP_KERNEL);\n+\tif (!common_dev)\n+\t\treturn -ENOMEM;\n+\tcommon_dev-\u003edev_mgt = dev_mgt;\n+\n+\tret = nbl_dev_setup_chan_queue(dev_mgt, NBL_CHAN_TYPE_MAILBOX);\n+\tif (ret)\n+\t\tgoto err_cleanup;\n+\n+\tINIT_WORK(\u0026common_dev-\u003eclean_mbx_task, nbl_dev_clean_mailbox_task);\n+\tnbl_dev_register_chan_task(dev_mgt, NBL_CHAN_TYPE_MAILBOX,\n+\t\t\t\t \u0026common_dev-\u003eclean_mbx_task);\n+\t/*\n+\t * VSI/ETH identity fetch moved to nbl_dev_start().\n+\t * This avoids cross-PF probe race when manager PF is not ready.\n+\t */\n+\tdev_mgt-\u003ecommon_dev = common_dev;\n+\tnbl_dev_init_msix_cnt(dev_mgt);\n+\n+\treturn 0;\n+err_cleanup:\n+\tcancel_work_sync(\u0026common_dev-\u003eclean_mbx_task);\n+\tnbl_dev_remove_chan_queue(dev_mgt, NBL_CHAN_TYPE_MAILBOX);\n+\tnbl_dev_register_chan_task(dev_mgt, NBL_CHAN_TYPE_MAILBOX, NULL);\n+\treturn ret;\n+}\n+\n+static void nbl_dev_remove_common_dev(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = adapter-\u003ecore.dev_mgt;\n+\tstruct nbl_dev_common *common_dev = dev_mgt-\u003ecommon_dev;\n+\n+\tif (!common_dev)\n+\t\treturn;\n+\tcancel_work_sync(\u0026common_dev-\u003eclean_mbx_task);\n+\tnbl_dev_remove_chan_queue(dev_mgt, NBL_CHAN_TYPE_MAILBOX);\n+\tnbl_dev_register_chan_task(dev_mgt, NBL_CHAN_TYPE_MAILBOX, NULL);\n+}\n+\n+static int nbl_dev_setup_ctrl_dev(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = adapter-\u003ecore.dev_mgt;\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\tint ret;\n+\n+\tret = disp_ops-\u003einit_module(dev_mgt-\u003edisp_ops_tbl-\u003epriv);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tnbl_dev_setup_chan_qinfo(dev_mgt, NBL_CHAN_TYPE_MAILBOX);\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * Tear down control device: deinit_module sets driver_status=false\n+ * to notify firmware to clean all per-PF hardware state (including\n+ * qinfo registers). The qinfo map programmed in setup_ctrl_dev is\n+ * not explicitly cleared; firmware handles it on driver_status change.\n+ *\n+ * NOTE: Firmware clears chip-global qinfo routing entries when control PF\n+ * deinit runs. MUST unbind all sibling non-control PFs on the same chip\n+ * BEFORE unbinding the control PF. Unbinding control PF while siblings are\n+ * still bound will leave those sibling PFs with broken mailbox RPC,\n+ * causing RPC ACK timeouts. This operation sequence is NOT supported.\n+ */\n+static void nbl_dev_remove_ctrl_dev(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = adapter-\u003ecore.dev_mgt;\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\n+\tdisp_ops-\u003edeinit_module(dev_mgt-\u003edisp_ops_tbl-\u003epriv);\n+}\n+\n+static struct nbl_dev_mgt *nbl_dev_setup_dev_mgt(struct nbl_common_info *common)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt;\n+\n+\tdev_mgt = devm_kzalloc(common-\u003edev, sizeof(*dev_mgt), GFP_KERNEL);\n+\tif (!dev_mgt)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\tdev_mgt-\u003ecommon = common;\n+\treturn dev_mgt;\n+}\n+\n+int nbl_dev_init(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_common_info *common = \u0026adapter-\u003ecommon;\n+\tstruct nbl_dispatch_ops_tbl *disp_ops_tbl =\n+\t\tadapter-\u003eintf.dispatch_ops_tbl;\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl =\n+\t\tadapter-\u003eintf.channel_ops_tbl;\n+\tstruct nbl_dev_mgt *dev_mgt;\n+\tint ret;\n+\n+\tdev_mgt = nbl_dev_setup_dev_mgt(common);\n+\tif (IS_ERR(dev_mgt)) {\n+\t\tret = PTR_ERR(dev_mgt);\n+\t\treturn ret;\n+\t}\n+\n+\tdev_mgt-\u003edisp_ops_tbl = disp_ops_tbl;\n+\tdev_mgt-\u003echan_ops_tbl = chan_ops_tbl;\n+\tadapter-\u003ecore.dev_mgt = dev_mgt;\n+\n+\t/*\n+\t * Chip hardware initialization is completed by firmware at power-up.\n+\t * Only driver functional table/register config follows here, safe to\n+\t * access hardware registers before ctrl dev setup.\n+\t */\n+\tret = nbl_dev_setup_common_dev(adapter);\n+\tif (ret)\n+\t\tgoto setup_err;\n+\n+\tif (common-\u003ehas_ctrl) {\n+\t\tret = nbl_dev_setup_ctrl_dev(adapter);\n+\t\tif (ret)\n+\t\t\tgoto setup_ctrl_dev_fail;\n+\t}\n+\n+\treturn 0;\n+setup_ctrl_dev_fail:\n+\tnbl_dev_remove_common_dev(adapter);\n+setup_err:\n+\treturn ret;\n+}\n+\n+/*\n+ * Teardown order: Stop mailbox channel and drain all inflight DMA first,\n+ * then invoke deinit_module to notify firmware.\n+ *\n+ * This intentionally breaks strict init/teardown mirror symmetry due to\n+ * hardware constraint: firmware may perform asynchronous global hardware\n+ * cleanup once driver_status=false is set. We must guarantee no ongoing\n+ * mailbox DMA before deinit_module to avoid invalid DMA write.\n+ *\n+ * Init order: create mailbox(common_dev) → ctrl dev init\n+ * Teardown order: destroy mailbox(common_dev) → ctrl dev deinit\n+ */\n+void nbl_dev_remove(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_common_info *common = \u0026adapter-\u003ecommon;\n+\n+\tnbl_dev_remove_common_dev(adapter);\n+\tif (common-\u003ehas_ctrl)\n+\t\tnbl_dev_remove_ctrl_dev(adapter);\n+}\n+\n+/* ---------- Dev start process ---------- */\n+int nbl_dev_start(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = adapter-\u003ecore.dev_mgt;\n+\tstruct nbl_dispatch_ops *disp_ops = dev_mgt-\u003edisp_ops_tbl-\u003eops;\n+\tstruct nbl_dispatch_mgt *priv = dev_mgt-\u003edisp_ops_tbl-\u003epriv;\n+\tstruct nbl_dev_common *common_dev = dev_mgt-\u003ecommon_dev;\n+\tstruct nbl_common_info *common = dev_mgt-\u003ecommon;\n+\tint cleanup_ret;\n+\tint ret;\n+\n+\tret = nbl_dev_cfg_msix_map(dev_mgt);\n+\tif (ret)\n+\t\tgoto err_destroy_map;\n+\n+\t/* Fetch VSI/ETH identity after cfg_msix_map */\n+\tret = disp_ops-\u003eget_vsi_id(priv, NBL_VSI_DATA, \u0026common-\u003evsi_id);\n+\tif (ret)\n+\t\tgoto err_destroy_map;\n+\tret = disp_ops-\u003eget_eth_id(priv, common-\u003evsi_id, \u0026common-\u003eeth_num,\n+\t\t\t\t \u0026common-\u003eeth_id, \u0026common-\u003elogic_eth_id);\n+\tif (ret)\n+\t\tgoto err_destroy_map;\n+\n+\tret = nbl_dev_init_interrupt_scheme(dev_mgt);\n+\tif (ret)\n+\t\tgoto err_destroy_map;\n+\n+\tret = nbl_dev_request_mailbox_irq(dev_mgt);\n+\tif (ret)\n+\t\tgoto err_destroy_map;\n+\n+\tret = nbl_dev_enable_mailbox_irq(dev_mgt);\n+\tif (ret)\n+\t\tgoto err_disable_irq;\n+\n+\treturn 0;\n+\n+err_disable_irq:\n+\tcleanup_ret = nbl_dev_disable_mailbox_irq(dev_mgt);\n+\tif (cleanup_ret)\n+\t\tdev_err(dev_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"rollback: disable mailbox IRQ failed: %d\\n\",\n+\t\t\tcleanup_ret);\n+\tnbl_dev_free_mailbox_irq(dev_mgt);\n+err_destroy_map:\n+\t/*\n+\t * Destroy device-side MSI-X map BEFORE releasing kernel-side\n+\t * vectors. This masks all hardware vectors and clears the\n+\t * pcompleter map entry, so no MSI-X message can fire after\n+\t * vector release.\n+\t *\n+\t * For non-control PFs this is a polling-mode mailbox RPC\n+\t * (IRQ_RDY already cleared by disable above, or never set).\n+\t * If the RPC fails the device may remain armed.\n+\t *\n+\t * This is best-effort teardown: we still release kernel vectors\n+\t * even if remote RPC fails. The hardware entry will be reclaimed\n+\t * by firmware on chip reset.\n+\t *\n+\t * Note: pci_clear_master() runs in nbl_probe() core_start_err path,\n+\t * Also pci_clear_master() on non-control PF\n+\t * cannot stop DMA using the manager PF's BDF; this is a known\n+\t * limitation. Stale hardware entries will be reclaimed by firmware\n+\t * on chip reset.\n+\t */\n+\tcleanup_ret = nbl_dev_destroy_msix_map(dev_mgt);\n+\tif (cleanup_ret)\n+\t\tdev_err(dev_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"rollback: destroy MSI-X map failed: %d\\n\",\n+\t\t\tcleanup_ret);\n+\tnbl_dev_clear_interrupt_scheme(dev_mgt);\n+\n+\tcancel_work_sync(\u0026common_dev-\u003eclean_mbx_task);\n+\treturn ret;\n+}\n+\n+void nbl_dev_stop(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_dev_mgt *dev_mgt = adapter-\u003ecore.dev_mgt;\n+\tstruct nbl_dev_common *common_dev = dev_mgt-\u003ecommon_dev;\n+\tint ret;\n+\n+\tret = nbl_dev_disable_mailbox_irq(dev_mgt);\n+\tif (ret)\n+\t\tdev_err(dev_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"Failed to disable mailbox IRQ: %d\\n\", ret);\n+\tnbl_dev_free_mailbox_irq(dev_mgt);\n+\n+\t/*\n+\t * Destroy hardware MSI-X map BEFORE releasing kernel-side\n+\t * vectors. Masks all device vectors and clears pcompleter\n+\t * map entry first.\n+\t *\n+\t * This is best-effort teardown: if destroy_msix_map RPC fails,\n+\t * hardware MSI-X map remains valid. We proceed to release\n+\t * kernel vectors anyway. Hardware stale entries rely on\n+\t * firmware cleanup on chip reset.\n+\t *\n+\t * pci_clear_master() on non-control PF cannot stop DMA using manager\n+\t * PF's BDF.\n+\t */\n+\tret = nbl_dev_destroy_msix_map(dev_mgt);\n+\tif (ret)\n+\t\tdev_err(dev_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"Failed to destroy MSI-X map: %d\\n\", ret);\n+\n+\tnbl_dev_clear_interrupt_scheme(dev_mgt);\n+\n+\t/*\n+\t * destroy_msix_map() sends ack-requested messages which may\n+\t * requeue clean_mbx_task via polling send path. Drain work\n+\t * after the operation.\n+\t */\n+\tcancel_work_sync(\u0026common_dev-\u003eclean_mbx_task);\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.h\nnew file mode 100644\nindex 0000000000000..24e890fd89874\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.h\n@@ -0,0 +1,55 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEV_H_\n+#define _NBL_DEV_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+#include \"../nbl_include/nbl_include.h\"\n+#include \"../nbl_include/nbl_def_channel.h\"\n+#include \"../nbl_include/nbl_def_hw.h\"\n+#include \"../nbl_include/nbl_def_resource.h\"\n+#include \"../nbl_include/nbl_def_dispatch.h\"\n+#include \"../nbl_include/nbl_def_dev.h\"\n+#include \"../nbl_include/nbl_def_common.h\"\n+#include \"../nbl_core.h\"\n+\n+#define NBL_STRING_NAME_LEN\t\t\t32\n+\n+enum nbl_msix_serv_type {\n+\tNBL_MSIX_NET_TYPE,\n+\tNBL_MSIX_MAILBOX_TYPE,\n+\tNBL_MSIX_TYPE_MAX\n+};\n+\n+struct nbl_msix_serv_info {\n+\tchar irq_name[NBL_STRING_NAME_LEN];\n+\tu16 num;\n+\tu16 base_vector_id;\n+\t/* true: hw report msix, hw need to mask actively */\n+\tbool hw_self_mask_en;\n+};\n+\n+struct nbl_msix_info {\n+\tstruct nbl_msix_serv_info serv_info[NBL_MSIX_TYPE_MAX];\n+};\n+\n+struct nbl_dev_common {\n+\tstruct nbl_dev_mgt *dev_mgt;\n+\tstruct nbl_msix_info msix_info;\n+\tchar mailbox_name[NBL_STRING_NAME_LEN];\n+\t/* for ctrl-dev/net-dev mailbox recv msg */\n+\tstruct work_struct clean_mbx_task;\n+};\n+\n+struct nbl_dev_mgt {\n+\tstruct nbl_common_info *common;\n+\tstruct nbl_dispatch_ops_tbl *disp_ops_tbl;\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl;\n+\tstruct nbl_dev_common *common_dev;\n+};\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.c\nnew file mode 100644\nindex 0000000000000..7254ed10d478f\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.c\n@@ -0,0 +1,695 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/mutex.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \"nbl_dispatch.h\"\n+\n+static int nbl_disp_chan_get_vsi_id_req(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t\t\tu16 type, u16 *vsi_id)\n+{\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tstruct nbl_chan_param_get_vsi_id result = { 0 };\n+\tstruct nbl_chan_param_get_vsi_id param = { 0 };\n+\tstruct nbl_chan_send_info chan_send = {0};\n+\tint ret;\n+\n+\tparam.type = cpu_to_le16(type);\n+\n+\tnbl_chan_fill_send_info(\u0026chan_send, common-\u003emgt_pf,\n+\t\t\t\tNBL_CHAN_MSG_GET_VSI_ID,\n+\t\t\t\t\u0026param, sizeof(param), \u0026result,\n+\t\t\t\tsizeof(result), 1);\n+\tret = chan_ops-\u003esend_msg(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_send);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tswitch (ret) {\n+\tcase NBL_CHAN_RESP_OK:\n+\t\tbreak;\n+\tcase NBL_CHAN_RESP_UNIMPLEMENTED:\n+\t\treturn -EOPNOTSUPP;\n+\tcase NBL_CHAN_RESP_ERR:\n+\t\treturn -EREMOTEIO;\n+\tcase NBL_CHAN_RESP_PERM_DENY:\n+\t\treturn -EPERM;\n+\tdefault:\n+\t\treturn -EREMOTEIO;\n+\t}\n+\tif (chan_send.ack_len != sizeof(result)) {\n+\t\tdev_err(disp_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"get_vsi_id: short ACK, ack_len=%u expected %zu\\n\",\n+\t\t\tchan_send.ack_len, sizeof(result));\n+\t\treturn -EREMOTEIO;\n+\t}\n+\t*vsi_id = le16_to_cpu(result.vsi_id);\n+\treturn 0;\n+}\n+\n+static void nbl_disp_chan_get_vsi_id_resp(void *priv, u16 src_id, u16 msg_id,\n+\t\t\t\t\t void *data, u32 data_len)\n+{\n+\tstruct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct device *dev = disp_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_param_get_vsi_id result = { 0 };\n+\tstruct nbl_chan_param_get_vsi_id param = { 0 };\n+\tstruct nbl_chan_ack_info chan_ack;\n+\tint err = NBL_CHAN_RESP_OK;\n+\tu16 vsi_id = 0;\n+\tu32 rel_pf_id;\n+\tint ret;\n+\n+\tret = nbl_common_func_id_to_rel_pf_id(disp_mgt-\u003ecommon, src_id,\n+\t\t\t\t\t \u0026rel_pf_id);\n+\tif (ret) {\n+\t\terr = NBL_CHAN_RESP_PERM_DENY;\n+\t\tgoto ack_out;\n+\t}\n+\tif (data_len \u003c sizeof(param)) {\n+\t\terr = NBL_CHAN_RESP_ERR;\n+\t\tgoto ack_out;\n+\t}\n+\tmemcpy(\u0026param, data, sizeof(param));\n+\n+\tif (res_ops-\u003eget_vsi_id) {\n+\t\tret = res_ops-\u003eget_vsi_id(p, src_id, le16_to_cpu(param.type),\n+\t\t\t\t\t \u0026vsi_id);\n+\t\tif (ret)\n+\t\t\terr = NBL_CHAN_RESP_ERR;\n+\t} else {\n+\t\terr = NBL_CHAN_RESP_UNIMPLEMENTED;\n+\t}\n+\n+\tresult.vsi_id = cpu_to_le16(vsi_id);\n+ack_out:\n+\tnbl_chan_fill_ack_info(\u0026chan_ack, src_id,\n+\t\t\t NBL_CHAN_MSG_GET_VSI_ID, msg_id, err,\n+\t\t\t \u0026result, sizeof(result));\n+\tret = chan_ops-\u003esend_ack(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_ack);\n+\tif (ret)\n+\t\tdev_err(dev,\n+\t\t\t\"channel send ack failed with ret: %d, msg_type: %d\\n\",\n+\t\t\tret, NBL_CHAN_MSG_GET_VSI_ID);\n+}\n+\n+static int nbl_disp_chan_get_eth_id_req(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t\t\tu16 vsi_id, u8 *eth_num, u8 *eth_id,\n+\t\t\t\t\tu8 *logic_eth_id)\n+{\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tstruct nbl_chan_param_get_eth_id result = { 0 };\n+\tstruct nbl_chan_param_get_eth_id param = { 0 };\n+\tstruct nbl_chan_send_info chan_send = {0};\n+\tint ret;\n+\n+\tparam.vsi_id = cpu_to_le16(vsi_id);\n+\n+\tnbl_chan_fill_send_info(\u0026chan_send, common-\u003emgt_pf,\n+\t\t\t\tNBL_CHAN_MSG_GET_ETH_ID,\n+\t\t\t\t\u0026param, sizeof(param), \u0026result,\n+\t\t\t\tsizeof(result), 1);\n+\tret = chan_ops-\u003esend_msg(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_send);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tswitch (ret) {\n+\tcase NBL_CHAN_RESP_OK:\n+\t\tbreak;\n+\tcase NBL_CHAN_RESP_UNIMPLEMENTED:\n+\t\treturn -EOPNOTSUPP;\n+\tcase NBL_CHAN_RESP_ERR:\n+\t\treturn -EREMOTEIO;\n+\tcase NBL_CHAN_RESP_PERM_DENY:\n+\t\treturn -EPERM;\n+\tdefault:\n+\t\treturn -EREMOTEIO;\n+\t}\n+\tif (chan_send.ack_len != sizeof(result)) {\n+\t\tdev_err(disp_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"get_eth_id: short ACK, ack_len=%u expected %zu\\n\",\n+\t\t\tchan_send.ack_len, sizeof(result));\n+\t\treturn -EREMOTEIO;\n+\t}\n+\t*eth_num = result.eth_num;\n+\t*eth_id = result.eth_id;\n+\t*logic_eth_id = result.logic_eth_id;\n+\n+\treturn 0;\n+}\n+\n+static void nbl_disp_chan_get_eth_id_resp(void *priv, u16 src_id, u16 msg_id,\n+\t\t\t\t\t void *data, u32 data_len)\n+{\n+\tstruct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_chan_param_get_eth_id result = { 0 };\n+\tstruct nbl_chan_param_get_eth_id param = { 0 };\n+\tstruct device *dev = disp_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_ack_info chan_ack;\n+\tint err = NBL_CHAN_RESP_OK;\n+\tu32 rel_pf_id;\n+\tint ret;\n+\n+\tret = nbl_common_func_id_to_rel_pf_id(disp_mgt-\u003ecommon, src_id,\n+\t\t\t\t\t \u0026rel_pf_id);\n+\tif (ret) {\n+\t\terr = NBL_CHAN_RESP_PERM_DENY;\n+\t\tgoto ack_out;\n+\t}\n+\tif (data_len \u003c sizeof(param)) {\n+\t\terr = NBL_CHAN_RESP_ERR;\n+\t\tgoto ack_out;\n+\t}\n+\tmemcpy(\u0026param, data, sizeof(param));\n+\n+\tif (res_ops-\u003eget_eth_id) {\n+\t\tret = res_ops-\u003eget_eth_id(p, src_id, le16_to_cpu(param.vsi_id),\n+\t\t\t\t\t \u0026result.eth_num, \u0026result.eth_id,\n+\t\t\t\t\t \u0026result.logic_eth_id);\n+\t\tif (ret)\n+\t\t\terr = NBL_CHAN_RESP_ERR;\n+\t} else {\n+\t\terr = NBL_CHAN_RESP_UNIMPLEMENTED;\n+\t}\n+ack_out:\n+\tnbl_chan_fill_ack_info(\u0026chan_ack, src_id,\n+\t\t\t NBL_CHAN_MSG_GET_ETH_ID, msg_id, err,\n+\t\t\t \u0026result, sizeof(result));\n+\tret = chan_ops-\u003esend_ack(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_ack);\n+\tif (ret)\n+\t\tdev_err(dev,\n+\t\t\t\"channel send ack failed with ret: %d, msg_type: %d\\n\",\n+\t\t\tret, NBL_CHAN_MSG_GET_ETH_ID);\n+}\n+\n+static void nbl_disp_deinit_module(struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\n+\tif (res_ops-\u003edeinit_module)\n+\t\tres_ops-\u003edeinit_module(p);\n+}\n+\n+static int nbl_disp_init_module(struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\n+\tif (res_ops-\u003einit_module)\n+\t\treturn res_ops-\u003einit_module(p);\n+\treturn -EOPNOTSUPP;\n+}\n+\n+static int nbl_disp_cfg_msix_map(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t\t u16 num_net_msix, u16 num_others_msix,\n+\t\t\t\t bool net_msix_mask_en)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tint ret;\n+\n+\tif (!res_ops-\u003ecfg_msix_map)\n+\t\treturn -EOPNOTSUPP;\n+\tmutex_lock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\tret = res_ops-\u003ecfg_msix_map(p, common-\u003emgt_pf, num_net_msix,\n+\t\t\t\t\t num_others_msix, net_msix_mask_en);\n+\tmutex_unlock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\treturn ret;\n+}\n+\n+static int\n+nbl_disp_chan_cfg_msix_map_req(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t u16 num_net_msix, u16 num_others_msix,\n+\t\t\t bool net_msix_mask_en)\n+{\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tstruct nbl_chan_param_cfg_msix_map param = { 0 };\n+\tstruct nbl_chan_send_info chan_send = {0};\n+\tint ret;\n+\n+\tparam.num_net_msix = cpu_to_le16(num_net_msix);\n+\tparam.num_others_msix = cpu_to_le16(num_others_msix);\n+\tparam.msix_mask_en = cpu_to_le16(!!net_msix_mask_en);\n+\n+\tnbl_chan_fill_send_info(\u0026chan_send, common-\u003emgt_pf,\n+\t\t\t\tNBL_CHAN_MSG_CONFIGURE_MSIX_MAP,\n+\t\t\t\t\u0026param, sizeof(param),\n+\t\t\t\tNULL, 0, 1);\n+\tret = chan_ops-\u003esend_msg(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_send);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tswitch (ret) {\n+\tcase NBL_CHAN_RESP_OK:\n+\t\tbreak;\n+\tcase NBL_CHAN_RESP_UNIMPLEMENTED:\n+\t\treturn -EOPNOTSUPP;\n+\tcase NBL_CHAN_RESP_PERM_DENY:\n+\t\treturn -EPERM;\n+\tcase NBL_CHAN_RESP_ERR:\n+\t\treturn -EREMOTEIO;\n+\tdefault:\n+\t\treturn -EREMOTEIO;\n+\t}\n+\treturn 0;\n+}\n+\n+/*\n+ * Precondition: caller must disable mailbox IRQ_RDY and switch send_msg\n+ * to polling path before issuing cfg_msix_map RPC.\n+ * The responder will disable mailbox MSIX routing during resource ops,\n+ * so ACK cannot rely on interrupt wakeup.\n+ */\n+static void nbl_disp_chan_cfg_msix_map_resp(void *priv, u16 src_id, u16 msg_id,\n+\t\t\t\t\t void *data, u32 data_len)\n+{\n+\tstruct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct device *dev = disp_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_param_cfg_msix_map param = { 0 };\n+\tstruct nbl_chan_ack_info chan_ack;\n+\tint err = NBL_CHAN_RESP_OK;\n+\tu32 rel_pf_id;\n+\tint ret;\n+\n+\tret = nbl_common_func_id_to_rel_pf_id(disp_mgt-\u003ecommon, src_id,\n+\t\t\t\t\t \u0026rel_pf_id);\n+\tif (ret) {\n+\t\terr = NBL_CHAN_RESP_PERM_DENY;\n+\t\tgoto ack_out;\n+\t}\n+\tif (data_len \u003c sizeof(param)) {\n+\t\terr = NBL_CHAN_RESP_ERR;\n+\t\tgoto ack_out;\n+\t}\n+\tmemcpy(\u0026param, data, sizeof(param));\n+\n+\tif (res_ops-\u003ecfg_msix_map) {\n+\t\tmutex_lock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\t\tret = res_ops-\u003ecfg_msix_map(p, src_id,\n+\t\t\t\t\t le16_to_cpu(param.num_net_msix),\n+\t\t\t\t\t le16_to_cpu(param.num_others_msix),\n+\t\t\t\t\t !!le16_to_cpu(param.msix_mask_en));\n+\t\tmutex_unlock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\t\tif (ret)\n+\t\t\terr = NBL_CHAN_RESP_ERR;\n+\t} else {\n+\t\terr = NBL_CHAN_RESP_UNIMPLEMENTED;\n+\t}\n+ack_out:\n+\tnbl_chan_fill_ack_info(\u0026chan_ack, src_id,\n+\t\t\t NBL_CHAN_MSG_CONFIGURE_MSIX_MAP, msg_id,\n+\t\t\t err, NULL, 0);\n+\tret = chan_ops-\u003esend_ack(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_ack);\n+\tif (ret)\n+\t\tdev_err(dev,\n+\t\t\t\"channel send ack failed with ret: %d, msg_type: %d\\n\",\n+\t\t\tret, NBL_CHAN_MSG_CONFIGURE_MSIX_MAP);\n+}\n+\n+static int nbl_disp_chan_destroy_msix_map_req(struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tstruct nbl_chan_send_info chan_send = {0};\n+\tint ret;\n+\n+\tnbl_chan_fill_send_info(\u0026chan_send, common-\u003emgt_pf,\n+\t\t\t\tNBL_CHAN_MSG_DESTROY_MSIX_MAP,\n+\t\t\t\tNULL, 0, NULL, 0, 1);\n+\tret = chan_ops-\u003esend_msg(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_send);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tswitch (ret) {\n+\tcase NBL_CHAN_RESP_OK:\n+\t\tbreak;\n+\tcase NBL_CHAN_RESP_UNIMPLEMENTED:\n+\t\treturn -EOPNOTSUPP;\n+\tcase NBL_CHAN_RESP_PERM_DENY:\n+\t\treturn -EPERM;\n+\tcase NBL_CHAN_RESP_ERR:\n+\t\treturn -EREMOTEIO;\n+\tdefault:\n+\t\treturn -EREMOTEIO;\n+\t}\n+\treturn 0;\n+}\n+\n+/*\n+ * Precondition: caller must disable mailbox IRQ_RDY and switch send_msg\n+ * to polling path before issuing destroy_msix_map.\n+ * The responder will disable mailbox MSIX routing during resource ops,\n+ * so ACK cannot rely on interrupt wakeup.\n+ */\n+static void nbl_disp_chan_destroy_msix_map_resp(void *priv, u16 src_id,\n+\t\t\t\t\t\tu16 msg_id, void *data,\n+\t\t\t\t\t\tu32 data_len)\n+{\n+\tstruct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct device *dev = disp_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_ack_info chan_ack;\n+\tint err = NBL_CHAN_RESP_OK;\n+\tu32 rel_pf_id;\n+\tint ret;\n+\n+\tret = nbl_common_func_id_to_rel_pf_id(disp_mgt-\u003ecommon, src_id,\n+\t\t\t\t\t \u0026rel_pf_id);\n+\tif (ret) {\n+\t\terr = NBL_CHAN_RESP_PERM_DENY;\n+\t\tgoto ack_out;\n+\t}\n+\tif (res_ops-\u003edestroy_msix_map) {\n+\t\tmutex_lock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\t\tret = res_ops-\u003edestroy_msix_map(p, src_id);\n+\t\tmutex_unlock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\t\tif (ret)\n+\t\t\terr = NBL_CHAN_RESP_ERR;\n+\t} else {\n+\t\terr = NBL_CHAN_RESP_UNIMPLEMENTED;\n+\t}\n+ack_out:\n+\tnbl_chan_fill_ack_info(\u0026chan_ack, src_id,\n+\t\t\t NBL_CHAN_MSG_DESTROY_MSIX_MAP, msg_id,\n+\t\t\t err, NULL, 0);\n+\tret = chan_ops-\u003esend_ack(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_ack);\n+\tif (ret)\n+\t\tdev_err(dev,\n+\t\t\t\"channel send ack failed with ret: %d, msg_type: %d\\n\",\n+\t\t\tret, NBL_CHAN_MSG_DESTROY_MSIX_MAP);\n+}\n+\n+static int nbl_disp_chan_set_mailbox_irq_req(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t\t\t u16 vector_id, bool en_msix)\n+{\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_chan_param_set_mailbox_irq param = { 0 };\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tstruct nbl_chan_send_info chan_send = {0};\n+\tint ret;\n+\n+\tparam.vector_id = cpu_to_le16(vector_id);\n+\tparam.en_msix = !!en_msix;\n+\n+\tnbl_chan_fill_send_info(\u0026chan_send, common-\u003emgt_pf,\n+\t\t\t\tNBL_CHAN_MSG_MAILBOX_SET_IRQ,\n+\t\t\t\t\u0026param, sizeof(param), NULL, 0, 1);\n+\tret = chan_ops-\u003esend_msg(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_send);\n+\tif (ret \u003c 0)\n+\t\treturn ret;\n+\tswitch (ret) {\n+\tcase NBL_CHAN_RESP_OK:\n+\t\tbreak;\n+\tcase NBL_CHAN_RESP_UNIMPLEMENTED:\n+\t\treturn -EOPNOTSUPP;\n+\tcase NBL_CHAN_RESP_ERR:\n+\t\treturn -EREMOTEIO;\n+\tcase NBL_CHAN_RESP_PERM_DENY:\n+\t\treturn -EPERM;\n+\tdefault:\n+\t\treturn -EREMOTEIO;\n+\t}\n+\treturn 0;\n+}\n+\n+static void nbl_disp_chan_set_mailbox_irq_resp(void *priv, u16 src_id,\n+\t\t\t\t\t u16 msg_id, void *data,\n+\t\t\t\t\t u32 data_len)\n+{\n+\tstruct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_chan_param_set_mailbox_irq param = { 0 };\n+\tstruct device *dev = disp_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_chan_ack_info chan_ack;\n+\tint err = NBL_CHAN_RESP_OK;\n+\tu16 vector_id;\n+\tu32 rel_pf_id;\n+\tbool en_msix;\n+\tint ret;\n+\n+\tret = nbl_common_func_id_to_rel_pf_id(disp_mgt-\u003ecommon, src_id,\n+\t\t\t\t\t \u0026rel_pf_id);\n+\tif (ret) {\n+\t\terr = NBL_CHAN_RESP_PERM_DENY;\n+\t\tgoto ack_out;\n+\t}\n+\tif (data_len \u003c sizeof(param)) {\n+\t\terr = NBL_CHAN_RESP_ERR;\n+\t\tgoto ack_out;\n+\t}\n+\tmemcpy(\u0026param, data, sizeof(param));\n+\tvector_id = le16_to_cpu(param.vector_id);\n+\ten_msix = !!param.en_msix;\n+\n+\tif (res_ops-\u003eset_mailbox_irq) {\n+\t\tmutex_lock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\t\tret = res_ops-\u003eset_mailbox_irq(p, src_id, vector_id, en_msix);\n+\t\tmutex_unlock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\t\tif (ret)\n+\t\t\terr = NBL_CHAN_RESP_ERR;\n+\t} else {\n+\t\terr = NBL_CHAN_RESP_UNIMPLEMENTED;\n+\t}\n+\n+ack_out:\n+\tnbl_chan_fill_ack_info(\u0026chan_ack, src_id,\n+\t\t\t NBL_CHAN_MSG_MAILBOX_SET_IRQ, msg_id,\n+\t\t\t err, NULL, 0);\n+\tret = chan_ops-\u003esend_ack(disp_mgt-\u003echan_ops_tbl-\u003epriv, \u0026chan_ack);\n+\tif (ret)\n+\t\tdev_err(dev,\n+\t\t\t\"channel send ack failed with ret: %d, msg_type: %d\\n\",\n+\t\t\tret, NBL_CHAN_MSG_MAILBOX_SET_IRQ);\n+}\n+\n+static int nbl_disp_destroy_msix_map(struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tint ret;\n+\n+\tif (!res_ops-\u003edestroy_msix_map)\n+\t\treturn -EOPNOTSUPP;\n+\tmutex_lock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\tret = res_ops-\u003edestroy_msix_map(p, common-\u003emgt_pf);\n+\tmutex_unlock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\treturn ret;\n+}\n+\n+static int nbl_disp_set_mailbox_irq(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t\t u16 vector_id, bool en_msix)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\tint ret;\n+\n+\tif (!res_ops-\u003eset_mailbox_irq)\n+\t\treturn -EOPNOTSUPP;\n+\tmutex_lock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\tret = res_ops-\u003eset_mailbox_irq(p, common-\u003emgt_pf, vector_id, en_msix);\n+\tmutex_unlock(\u0026disp_mgt-\u003eops_mutex_lock);\n+\treturn ret;\n+}\n+\n+static int nbl_disp_get_vsi_id(struct nbl_dispatch_mgt *disp_mgt, u16 type,\n+\t\t\t u16 *vsi_id)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\n+\tif (res_ops-\u003eget_vsi_id)\n+\t\treturn res_ops-\u003eget_vsi_id(p, common-\u003emgt_pf, type, vsi_id);\n+\treturn -EOPNOTSUPP;\n+}\n+\n+static int nbl_disp_get_eth_id(struct nbl_dispatch_mgt *disp_mgt, u16 vsi_id,\n+\t\t\t u8 *eth_num, u8 *eth_id, u8 *logic_eth_id)\n+{\n+\tstruct nbl_resource_ops *res_ops = disp_mgt-\u003eres_ops_tbl-\u003eops;\n+\tstruct nbl_resource_mgt *p = disp_mgt-\u003eres_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = disp_mgt-\u003ecommon;\n+\n+\tif (res_ops-\u003eget_eth_id)\n+\t\treturn res_ops-\u003eget_eth_id(p, common-\u003emgt_pf, vsi_id,\n+\t\t\t\t\t eth_num, eth_id, logic_eth_id);\n+\treturn -EOPNOTSUPP;\n+}\n+\n+static int nbl_disp_setup_msg(struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_channel_ops *chan_ops = disp_mgt-\u003echan_ops_tbl-\u003eops;\n+\tstruct nbl_channel_mgt *p = disp_mgt-\u003echan_ops_tbl-\u003epriv;\n+\tint ret = 0;\n+\tint _ret;\n+\n+\t_ret = chan_ops-\u003eregister_msg(p, NBL_CHAN_MSG_CONFIGURE_MSIX_MAP,\n+\t\t\t\t nbl_disp_chan_cfg_msix_map_resp,\n+\t\t\t\t disp_mgt);\n+\tif (_ret \u003c 0 \u0026\u0026 !ret)\n+\t\tret = _ret;\n+\n+\t_ret = chan_ops-\u003eregister_msg(p, NBL_CHAN_MSG_DESTROY_MSIX_MAP,\n+\t\t\t\t nbl_disp_chan_destroy_msix_map_resp,\n+\t\t\t\t disp_mgt);\n+\tif (_ret \u003c 0 \u0026\u0026 !ret)\n+\t\tret = _ret;\n+\n+\t_ret = chan_ops-\u003eregister_msg(p, NBL_CHAN_MSG_MAILBOX_SET_IRQ,\n+\t\t\t\t nbl_disp_chan_set_mailbox_irq_resp,\n+\t\t\t\t disp_mgt);\n+\tif (_ret \u003c 0 \u0026\u0026 !ret)\n+\t\tret = _ret;\n+\n+\t_ret = chan_ops-\u003eregister_msg(p, NBL_CHAN_MSG_GET_VSI_ID,\n+\t\t\t\t nbl_disp_chan_get_vsi_id_resp,\n+\t\t\t\t disp_mgt);\n+\tif (_ret \u003c 0 \u0026\u0026 !ret)\n+\t\tret = _ret;\n+\n+\t_ret = chan_ops-\u003eregister_msg(p, NBL_CHAN_MSG_GET_ETH_ID,\n+\t\t\t\t nbl_disp_chan_get_eth_id_resp,\n+\t\t\t\t disp_mgt);\n+\tif (_ret \u003c 0 \u0026\u0026 !ret)\n+\t\tret = _ret;\n+\n+\treturn ret;\n+}\n+\n+static void nbl_disp_set_ctrl_bit(struct nbl_dispatch_mgt *disp_mgt, u32 lvl)\n+{\n+\tset_bit(lvl, disp_mgt-\u003ectrl_lvl);\n+}\n+\n+static void nbl_disp_refresh_ctrl_ops(struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_dispatch_ops *disp_ops = disp_mgt-\u003edisp_ops_tbl-\u003eops;\n+\n+\tmemset(disp_ops, 0, sizeof(*disp_ops));\n+\tif (test_bit(NBL_DISP_CTRL_LVL_MGT, disp_mgt-\u003ectrl_lvl)) {\n+\t\tdisp_ops-\u003einit_module = nbl_disp_init_module;\n+\t\tdisp_ops-\u003edeinit_module = nbl_disp_deinit_module;\n+\t\tdisp_ops-\u003ecfg_msix_map = nbl_disp_cfg_msix_map;\n+\t\tdisp_ops-\u003edestroy_msix_map = nbl_disp_destroy_msix_map;\n+\t\tdisp_ops-\u003eset_mailbox_irq = nbl_disp_set_mailbox_irq;\n+\t\tdisp_ops-\u003eget_vsi_id = nbl_disp_get_vsi_id;\n+\t\tdisp_ops-\u003eget_eth_id = nbl_disp_get_eth_id;\n+\t} else if (test_bit(NBL_DISP_CTRL_LVL_NET, disp_mgt-\u003ectrl_lvl)) {\n+\t\tdisp_ops-\u003ecfg_msix_map =\n+\t\t\tnbl_disp_chan_cfg_msix_map_req;\n+\t\tdisp_ops-\u003edestroy_msix_map = nbl_disp_chan_destroy_msix_map_req;\n+\t\tdisp_ops-\u003eset_mailbox_irq = nbl_disp_chan_set_mailbox_irq_req;\n+\t\tdisp_ops-\u003eget_vsi_id = nbl_disp_chan_get_vsi_id_req;\n+\t\tdisp_ops-\u003eget_eth_id = nbl_disp_chan_get_eth_id_req;\n+\t}\n+}\n+\n+static struct nbl_dispatch_mgt *\n+nbl_disp_setup_disp_mgt(struct nbl_common_info *common)\n+{\n+\tstruct nbl_dispatch_mgt *disp_mgt;\n+\tstruct device *dev = common-\u003edev;\n+\tint err;\n+\n+\tdisp_mgt = devm_kzalloc(dev, sizeof(*disp_mgt), GFP_KERNEL);\n+\tif (!disp_mgt)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\tdisp_mgt-\u003ecommon = common;\n+\terr = devm_mutex_init(common-\u003edev, \u0026disp_mgt-\u003eops_mutex_lock);\n+\tif (err)\n+\t\treturn ERR_PTR(err);\n+\treturn disp_mgt;\n+}\n+\n+static struct nbl_dispatch_ops_tbl *\n+nbl_disp_setup_ops(struct device *dev, struct nbl_dispatch_mgt *disp_mgt)\n+{\n+\tstruct nbl_dispatch_ops_tbl *disp_ops_tbl;\n+\tstruct nbl_dispatch_ops *disp_ops;\n+\n+\tdisp_ops_tbl = devm_kzalloc(dev, sizeof(*disp_ops_tbl), GFP_KERNEL);\n+\tif (!disp_ops_tbl)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\tdisp_ops = devm_kzalloc(dev, sizeof(*disp_ops), GFP_KERNEL);\n+\tif (!disp_ops)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\tdisp_ops_tbl-\u003eops = disp_ops;\n+\tdisp_ops_tbl-\u003epriv = disp_mgt;\n+\n+\treturn disp_ops_tbl;\n+}\n+\n+int nbl_disp_init(struct nbl_adapter *adapter)\n+{\n+\tstruct nbl_common_info *common = \u0026adapter-\u003ecommon;\n+\tstruct nbl_dispatch_ops_tbl *disp_ops_tbl;\n+\tstruct nbl_resource_ops_tbl *res_ops_tbl =\n+\t\tadapter-\u003eintf.resource_ops_tbl;\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl =\n+\t\tadapter-\u003eintf.channel_ops_tbl;\n+\tstruct device *dev = \u0026adapter-\u003epdev-\u003edev;\n+\tstruct nbl_dispatch_mgt *disp_mgt;\n+\tint ret;\n+\n+\tdisp_mgt = nbl_disp_setup_disp_mgt(common);\n+\tif (IS_ERR(disp_mgt)) {\n+\t\tret = PTR_ERR(disp_mgt);\n+\t\treturn ret;\n+\t}\n+\n+\tdisp_ops_tbl = nbl_disp_setup_ops(dev, disp_mgt);\n+\tif (IS_ERR(disp_ops_tbl)) {\n+\t\tret = PTR_ERR(disp_ops_tbl);\n+\t\treturn ret;\n+\t}\n+\n+\tdisp_mgt-\u003eres_ops_tbl = res_ops_tbl;\n+\tdisp_mgt-\u003echan_ops_tbl = chan_ops_tbl;\n+\tdisp_mgt-\u003edisp_ops_tbl = disp_ops_tbl;\n+\tadapter-\u003ecore.disp_mgt = disp_mgt;\n+\tadapter-\u003eintf.dispatch_ops_tbl = disp_ops_tbl;\n+\n+\tret = nbl_disp_setup_msg(disp_mgt);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tif (common-\u003ehas_ctrl)\n+\t\tnbl_disp_set_ctrl_bit(disp_mgt, NBL_DISP_CTRL_LVL_MGT);\n+\n+\tif (common-\u003ehas_net)\n+\t\tnbl_disp_set_ctrl_bit(disp_mgt, NBL_DISP_CTRL_LVL_NET);\n+\tnbl_disp_refresh_ctrl_ops(disp_mgt);\n+\treturn 0;\n+}\n+\n+void nbl_disp_remove(struct nbl_adapter *adapter)\n+{\n+\t/*\n+\t * All dispatch objects are allocated via devm.\n+\t * Dispatch message handlers are not explicitly unregistered here.\n+\t * Safety relies on dev layer shutting down mailbox channel queue\n+\t * before nbl_res_remove_leonis(), so responders cannot run after\n+\t * resource layer is torn down. Channel layer nbl_chan_remove_common()\n+\t * finalizes cleanup at device teardown.\n+\t */\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.h\nnew file mode 100644\nindex 0000000000000..8549048f76e95\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.h\n@@ -0,0 +1,25 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DISPATCH_H_\n+#define _NBL_DISPATCH_H_\n+#include \"../nbl_include/nbl_include.h\"\n+#include \"../nbl_include/nbl_def_channel.h\"\n+#include \"../nbl_include/nbl_def_resource.h\"\n+#include \"../nbl_include/nbl_def_dispatch.h\"\n+#include \"../nbl_include/nbl_def_common.h\"\n+#include \"../nbl_core.h\"\n+\n+struct nbl_dispatch_mgt {\n+\tstruct nbl_common_info *common;\n+\tstruct nbl_resource_ops_tbl *res_ops_tbl;\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl;\n+\tstruct nbl_dispatch_ops_tbl *disp_ops_tbl;\n+\tDECLARE_BITMAP(ctrl_lvl, NBL_DISP_CTRL_LVL_MAX);\n+\t/* use for the caller not in interrupt */\n+\tstruct mutex ops_mutex_lock;\n+};\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.c\nnew file mode 100644\nindex 0000000000000..419eb6392ada1\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.c\n@@ -0,0 +1,32 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/device.h\u003e\n+#include \"nbl_chip.h\"\n+\n+void nbl_res_chip_deinit_module(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\n+\tif (!common-\u003ehas_ctrl)\n+\t\treturn;\n+\thw_ops-\u003edeinit_module(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+}\n+\n+int nbl_res_chip_init_module(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct nbl_hw_ops *hw_ops;\n+\tu8 eth_speed, eth_num;\n+\tstruct nbl_hw_mgt *p;\n+\n+\tif (!common-\u003ehas_ctrl)\n+\t\treturn -EINVAL;\n+\teth_speed = res_mgt-\u003eresource_info-\u003eboard_info.eth_speed;\n+\teth_num = res_mgt-\u003eresource_info-\u003eboard_info.eth_num;\n+\thw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tp = res_mgt-\u003ehw_ops_tbl-\u003epriv;\n+\treturn hw_ops-\u003einit_module(p, eth_speed, eth_num);\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.h\nnew file mode 100644\nindex 0000000000000..d14093ba916c9\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.h\n@@ -0,0 +1,12 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_CHIP_H_\n+#define _NBL_CHIP_H_\n+\n+#include \"nbl_resource.h\"\n+int nbl_res_chip_init_module(struct nbl_resource_mgt *res_mgt);\n+void nbl_res_chip_deinit_module(struct nbl_resource_mgt *res_mgt);\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.c\nnew file mode 100644\nindex 0000000000000..aaf6d25e8ae23\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.c\n@@ -0,0 +1,1172 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \u003clinux/bits.h\u003e\n+#include \u003clinux/io.h\u003e\n+#include \u003clinux/spinlock.h\u003e\n+#include \u003clinux/bitfield.h\u003e\n+#include \"nbl_hw_leonis.h\"\n+\n+static void nbl_hw_read_mbx_regs(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 *data,\n+\t\t\t\t u32 len)\n+{\n+\tu32 i;\n+\n+\tif (len % 4)\n+\t\treturn;\n+\tif (reg \u003e= (u64)hw_mgt-\u003emailbox_bar_size ||\n+\t reg + len \u003e (u64)hw_mgt-\u003emailbox_bar_size) {\n+\t\tdev_err_once(hw_mgt-\u003ecommon-\u003edev,\n+\t\t\t \"mbx read out of range: reg=0x%llx len=%u bar_size=%pa\\n\",\n+\t\t\t reg, len, \u0026hw_mgt-\u003emailbox_bar_size);\n+\t\treturn;\n+\t}\n+\tfor (i = 0; i \u003c len / 4; i++)\n+\t\tdata[i] = nbl_mbx_rd32(hw_mgt, reg + i * sizeof(u32));\n+}\n+\n+static void nbl_hw_write_mbx_regs(struct nbl_hw_mgt *hw_mgt, u64 reg,\n+\t\t\t\t const u32 *data, u32 len)\n+{\n+\tu32 i;\n+\n+\tif (len % 4)\n+\t\treturn;\n+\tif (reg \u003e= (u64)hw_mgt-\u003emailbox_bar_size ||\n+\t reg + len \u003e (u64)hw_mgt-\u003emailbox_bar_size) {\n+\t\tdev_err_once(hw_mgt-\u003ecommon-\u003edev,\n+\t\t\t \"mbx write out of range: reg=0x%llx len=%u bar_size=%pa\\n\",\n+\t\t\t reg, len, \u0026hw_mgt-\u003emailbox_bar_size);\n+\t\treturn;\n+\t}\n+\tfor (i = 0; i \u003c len / 4; i++)\n+\t\tnbl_mbx_wr32(hw_mgt, reg + i * sizeof(u32), data[i]);\n+}\n+\n+static void nbl_hw_rd_regs(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 *data,\n+\t\t\t u32 len)\n+{\n+\tu32 size = len / 4;\n+\tu32 i;\n+\n+\tif (len % 4)\n+\t\treturn;\n+\tfor (i = 0; i \u003c size; i++)\n+\t\tdata[i] = rd32(hw_mgt-\u003ehw_addr, reg + i * sizeof(u32));\n+}\n+\n+static void nbl_hw_wr_regs(struct nbl_hw_mgt *hw_mgt, u64 reg, const u32 *data,\n+\t\t\t u32 len)\n+{\n+\tu32 size = len / 4;\n+\tu32 i;\n+\n+\tif (len % 4)\n+\t\treturn;\n+\tfor (i = 0; i \u003c size; i++)\n+\t\twr32(hw_mgt-\u003ehw_addr, reg + i * sizeof(u32), data[i]);\n+}\n+\n+static void nbl_hw_rd_regs_lock(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 *data,\n+\t\t\t\tu32 len)\n+{\n+\tu32 size = len / 4;\n+\tu32 i;\n+\n+\tif (len % 4)\n+\t\treturn;\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\n+\tfor (i = 0; i \u003c size; i++)\n+\t\tdata[i] = rd32(hw_mgt-\u003ehw_addr, reg + i * sizeof(u32));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static void nbl_hw_wr_regs_lock(struct nbl_hw_mgt *hw_mgt, u64 reg,\n+\t\t\t\tconst u32 *data, u32 len)\n+{\n+\tu32 size = len / 4;\n+\tu32 i;\n+\n+\tif (len % 4)\n+\t\treturn;\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tfor (i = 0; i \u003c size; i++)\n+\t\twr32(hw_mgt-\u003ehw_addr, reg + i * sizeof(u32), data[i]);\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+/*\n+ * Registers reset to zero after cold boot / FLR / bus reset. Firmware\n+ * programs valid values before driver probe, so zero is only seen on\n+ * hardware fault or register read failure. Initialize data=0 to guard\n+ * against nbl_hw_read_mbx_regs() early-return on bounds-check failure.\n+ */\n+static void nbl_hw_get_fw_eth_map(struct nbl_hw_mgt *hw_mgt, u32 *eth_map)\n+{\n+\tu32 data = 0;\n+\n+\tnbl_hw_read_mbx_regs(hw_mgt, NBL_FW_BOARD_DW6_OFFSET, \u0026data,\n+\t\t\t sizeof(data));\n+\t*eth_map = FIELD_GET(NBL_FW_BOARD_DW6_ETH_BITMAP_MASK, data);\n+}\n+\n+static u32 nbl_hw_get_quirks(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tu32 quirks = 0;\n+\n+\t/*\n+\t * Read quirk bits from mailbox register.\n+\t * All supported firmware implement the quirk ABI,\n+\t * firmware always populates NBL_LEONIS_QUIRKS_OFFSET.\n+\t * Value ~0U indicates no active quirks.\n+\t */\n+\tnbl_hw_read_mbx_regs(hw_mgt, NBL_LEONIS_QUIRKS_OFFSET, \u0026quirks,\n+\t\t\t sizeof(u32));\n+\n+\tif (quirks == ~0u)\n+\t\treturn 0;\n+\n+\treturn quirks;\n+}\n+\n+static void nbl_configure_dped_checksum(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tu32 data = 0;\n+\n+\t/* DPED dped_l4_ck_cmd_40 for sctp */\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_DPED_L4_CK_CMD_40_ADDR, \u0026data, sizeof(data));\n+\tdata |= FIELD_PREP(NBL_DPED_L4_CK_CMD_40_EN_MASK, 1);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_DPED_L4_CK_CMD_40_ADDR, \u0026data, sizeof(data));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static void nbl_dped_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_wr32(hw_mgt, NBL_DPED_VLAN_OFFSET, 0xC);\n+\tnbl_hw_wr32(hw_mgt, NBL_DPED_DSCP_OFFSET_0, 0x8);\n+\tnbl_hw_wr32(hw_mgt, NBL_DPED_DSCP_OFFSET_1, 0x4);\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\t/* dped checksum offload */\n+\tnbl_configure_dped_checksum(hw_mgt);\n+}\n+\n+static void nbl_uped_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tu32 hw_edit = 0;\n+\n+\t/* V4 TCP: l3_len = 0 */\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V4_TCP_IDX),\n+\t\t \u0026hw_edit, sizeof(hw_edit));\n+\thw_edit \u0026= ~NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK;\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V4_TCP_IDX),\n+\t\t \u0026hw_edit, sizeof(hw_edit));\n+\n+\t/* V6 TCP: l3_len = 1 */\n+\tnbl_hw_rd_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V6_TCP_IDX),\n+\t\t \u0026hw_edit, sizeof(hw_edit));\n+\thw_edit = (hw_edit \u0026 ~NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK) |\n+\t\t FIELD_PREP(NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK, 1);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V6_TCP_IDX),\n+\t\t \u0026hw_edit, sizeof(hw_edit));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static int nbl_shaping_eth_init(struct nbl_hw_mgt *hw_mgt, u8 eth_id, u8 speed)\n+{\n+\tstruct nbl_shaping_dvn_dport_u dvn_dport = { 0 };\n+\tstruct nbl_shaping_dport_u dport = { 0 };\n+\tu32 rate, half_rate;\n+\tu32 depth;\n+\tu64 low_val, high_val;\n+\n+\tswitch (speed) {\n+\tcase NBL_FW_PORT_SPEED_100G:\n+\t\trate = 100000;\n+\t\tbreak;\n+\tcase NBL_FW_PORT_SPEED_50G:\n+\t\trate = 50000;\n+\t\tbreak;\n+\tcase NBL_FW_PORT_SPEED_25G:\n+\t\trate = 25000;\n+\t\tbreak;\n+\tcase NBL_FW_PORT_SPEED_10G:\n+\t\trate = 10000;\n+\t\tbreak;\n+\tdefault:\n+\t\tdev_err(hw_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"Unsupported port speed %u for eth%u\\n\", speed, eth_id);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\thalf_rate = rate / 2;\n+\tdepth = max_t(u32, rate * 2, NBL_LR_LEONIS_NET_BUCKET_DEPTH);\n+\n+\t/* 1. clear valid first\n+\t * dport and dvn_dport are zero-initialised above, so VALID=0 already\n+\t */\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DPORT_REG(eth_id), dport.data,\n+\t\t sizeof(dport));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DVN_DPORT_REG(eth_id),\n+\t\t dvn_dport.data, sizeof(dvn_dport));\n+\n+\t/* 2. write config words (valid=0, safe) */\n+\tlow_val = FIELD_PREP(NBL_DPORT_CIR_MASK, rate) |\n+\t\t FIELD_PREP(NBL_DPORT_PIR_MASK, rate) |\n+\t\t FIELD_PREP(NBL_DPORT_DEPTH_MASK, depth) |\n+\t\t FIELD_PREP(NBL_DPORT_CBS_MASK_LOW, depth \u0026 0x3F);\n+\thigh_val = FIELD_PREP(NBL_DPORT_CBS_MASK_HIGH, depth \u003e\u003e 6) |\n+\t\t FIELD_PREP(NBL_DPORT_PBS_MASK, depth);\n+\t/* Fixed split, independent of host endian */\n+\tdport.data[0] = lower_32_bits(low_val);\n+\tdport.data[1] = upper_32_bits(low_val);\n+\tdport.data[2] = lower_32_bits(high_val);\n+\tdport.data[3] = upper_32_bits(high_val);\n+\n+\tlow_val = FIELD_PREP(NBL_DPORT_CIR_MASK, half_rate) |\n+\t\t FIELD_PREP(NBL_DPORT_PIR_MASK, rate) |\n+\t\t FIELD_PREP(NBL_DPORT_DEPTH_MASK, depth) |\n+\t\t FIELD_PREP(NBL_DPORT_CBS_MASK_LOW, depth \u0026 0x3F);\n+\thigh_val = FIELD_PREP(NBL_DPORT_CBS_MASK_HIGH, depth \u003e\u003e 6) |\n+\t\t FIELD_PREP(NBL_DPORT_PBS_MASK, depth);\n+\tdvn_dport.data[0] = lower_32_bits(low_val);\n+\tdvn_dport.data[1] = upper_32_bits(low_val);\n+\tdvn_dport.data[2] = lower_32_bits(high_val);\n+\tdvn_dport.data[3] = upper_32_bits(high_val);\n+\n+\tnbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DPORT_REG(eth_id), dport.data,\n+\t\t sizeof(dport));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DVN_DPORT_REG(eth_id),\n+\t\t dvn_dport.data, sizeof(dvn_dport));\n+\n+\t/* 3. commit: set valid last */\n+\tlow_val = FIELD_PREP(NBL_DPORT_VALID_MASK, 1);\n+\tdport.data[0] |= lower_32_bits(low_val);\n+\n+\tlow_val = FIELD_PREP(NBL_DPORT_VALID_MASK, 1);\n+\tdvn_dport.data[0] |= lower_32_bits(low_val);\n+\n+\tnbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DPORT_REG(eth_id), dport.data,\n+\t\t sizeof(dport));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DVN_DPORT_REG(eth_id),\n+\t\t dvn_dport.data, sizeof(dvn_dport));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\treturn 0;\n+}\n+\n+static int nbl_shaping_init(struct nbl_hw_mgt *hw_mgt, u8 speed)\n+{\n+#define NBL_SHAPING_FLUSH_INTERVAL 128\n+\tstruct nbl_shaping_net_u net_shaping = { 0 };\n+\tu32 eth_bitmap = 0;\n+\tu32 psha_en = 0;\n+\tint ret;\n+\tint i;\n+\n+\tnbl_hw_get_fw_eth_map(hw_mgt, \u0026eth_bitmap);\n+\tfor (i = 0; i \u003c NBL_MAX_ETHERNET; i++) {\n+\t\tif (!(eth_bitmap \u0026 BIT(i)))\n+\t\t\tcontinue;\n+\t\tret = nbl_shaping_eth_init(hw_mgt, i, speed);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n+\tpsha_en = eth_bitmap \u0026 GENMASK(3, 0);\n+\tpsha_en = FIELD_PREP(NBL_DSCH_PSHA_EN_MASK, psha_en);\n+\tnbl_hw_wr_regs_lock(hw_mgt, NBL_DSCH_PSHA_EN_ADDR, \u0026psha_en,\n+\t\t\t sizeof(psha_en));\n+\n+\tfor (i = 0; i \u003c NBL_MAX_FUNC; i++) {\n+\t\tnbl_hw_wr_regs_lock(hw_mgt, NBL_SHAPING_NET_REG(i),\n+\t\t\t\t net_shaping.data,\n+\t\t\t\t sizeof(net_shaping));\n+\t\tif ((i + 1) % NBL_SHAPING_FLUSH_INTERVAL == 0)\n+\t\t\tnbl_flush_writes(hw_mgt);\n+\t}\n+\tnbl_flush_writes(hw_mgt);\n+\treturn 0;\n+}\n+\n+static void nbl_dsch_qid_max_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tu32 quanta = 0;\n+\n+\tquanta = FIELD_PREP(NBL_DSCH_VN_QUANTA_H_QUA_MASK, NBL_HOST_QUANTA) |\n+\t\t FIELD_PREP(NBL_DSCH_VN_QUANTA_E_QUA_MASK, NBL_ECPU_QUANTA);\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_DSCH_VN_QUANTA_ADDR, \u0026quanta,\n+\t\t sizeof(quanta));\n+\tnbl_hw_wr32(hw_mgt, NBL_DSCH_HOST_QID_MAX, NBL_MAX_QUEUE_ID);\n+\n+\tnbl_hw_wr32(hw_mgt, NBL_DVN_ECPU_QUEUE_NUM, 0);\n+\tnbl_hw_wr32(hw_mgt, NBL_UVN_ECPU_QUEUE_NUM, 0);\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static int nbl_ustore_init(struct nbl_hw_mgt *hw_mgt, u8 eth_num)\n+{\n+\tu32 eth_bitmap = 0;\n+\tu32 drop_th = 0;\n+\tu32 pkt_len = 0;\n+\tint i;\n+\n+\t/*\n+\t * eth_num is validated in the resource layer:\n+\t * nbl_res_init_pf_num() requires 1/2/4 PFs, and\n+\t * nbl_res_ctrl_dev_setup_eth_info() requires max_pf == eth_num.\n+\t * This is a defensive check only; if it triggers, the resource\n+\t * layer validation was bypassed, which is a bug.\n+\t */\n+\tif (WARN_ON(eth_num != 1 \u0026\u0026 eth_num != 2 \u0026\u0026 eth_num != 4))\n+\t\treturn -EINVAL;\n+\t/* Read current packet length config\n+\t *(to preserve other fields while updating 'min')\n+\t */\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_USTORE_PKT_LEN_ADDR, \u0026pkt_len,\n+\t\t sizeof(pkt_len));\n+\t/* min arp packet length 42 (14 + 28) */\n+\tpkt_len \u0026= ~NBL_USTORE_PKT_LEN_MIN_MASK;\n+\tpkt_len |= FIELD_PREP(NBL_USTORE_PKT_LEN_MIN_MASK, 42);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_USTORE_PKT_LEN_ADDR, \u0026pkt_len,\n+\t\t sizeof(pkt_len));\n+\n+\tdrop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_EN_MASK, 1);\n+\tif (eth_num == 1)\n+\t\tdrop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK,\n+\t\t\t\t NBL_USTORE_SINGLE_ETH_DROP_TH);\n+\telse if (eth_num == 2)\n+\t\tdrop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK,\n+\t\t\t\t NBL_USTORE_DUAL_ETH_DROP_TH);\n+\telse\n+\t\tdrop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK,\n+\t\t\t\t NBL_USTORE_QUAD_ETH_DROP_TH);\n+\tnbl_hw_get_fw_eth_map(hw_mgt, \u0026eth_bitmap);\n+\tfor (i = 0; i \u003c NBL_MAX_ETHERNET; i++) {\n+\t\tif (!(eth_bitmap \u0026 BIT(i)))\n+\t\t\tcontinue;\n+\t\tnbl_hw_wr_regs(hw_mgt, NBL_USTORE_PORT_DROP_TH_REG_ARR(i),\n+\t\t\t \u0026drop_th, sizeof(drop_th));\n+\t}\n+\n+\t/* Clear port drop/truncate counters by reading them\n+\t * (hardware has read-to-clear behavior for these registers)\n+\t */\n+\tfor (i = 0; i \u003c NBL_MAX_ETHERNET; i++) {\n+\t\tif (!(eth_bitmap \u0026 BIT(i)))\n+\t\t\tcontinue;\n+\t\tnbl_hw_rd32(hw_mgt, NBL_USTORE_BUF_PORT_DROP_PKT(i));\n+\t\tnbl_hw_rd32(hw_mgt, NBL_USTORE_BUF_PORT_TRUN_PKT(i));\n+\t}\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\treturn 0;\n+}\n+\n+static void nbl_dstore_init(struct nbl_hw_mgt *hw_mgt, u8 speed)\n+{\n+\tu32 eth_bitmap = 0;\n+\tu32 drop_th = 0;\n+\tu32 fc_th = 0;\n+\tu32 bp_th = 0;\n+\tint i;\n+\n+\tfor (i = 0; i \u003c NBL_DSTORE_PORT_DROP_TH_DEPTH; i++) {\n+\t\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\t\tnbl_hw_rd_regs(hw_mgt, NBL_DSTORE_PORT_DROP_TH_REG(i), \u0026drop_th,\n+\t\t\t sizeof(drop_th));\n+\t\tdrop_th \u0026= ~NBL_DSTORE_PORT_DROP_EN_MASK;\n+\t\tnbl_hw_wr_regs(hw_mgt, NBL_DSTORE_PORT_DROP_TH_REG(i), \u0026drop_th,\n+\t\t\t sizeof(drop_th));\n+\t\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\t}\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_DSTORE_DISC_BP_TH, \u0026bp_th, sizeof(bp_th));\n+\tbp_th |= FIELD_PREP(NBL_DSTORE_DISC_BP_TH_EN_MASK, 1);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_DSTORE_DISC_BP_TH, \u0026bp_th, sizeof(bp_th));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\n+\tnbl_hw_get_fw_eth_map(hw_mgt, \u0026eth_bitmap);\n+\tfor (i = 0; i \u003c NBL_MAX_ETHERNET; i++) {\n+\t\tif (!(eth_bitmap \u0026 BIT(i)))\n+\t\t\tcontinue;\n+\t\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\t\tnbl_hw_rd_regs(hw_mgt, NBL_DSTORE_D_DPORT_FC_TH_REG(i), \u0026fc_th,\n+\t\t\t sizeof(fc_th));\n+\t\tfc_th \u0026= ~(NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK |\n+\t\t\t NBL_DSTORE_D_DPORT_FC_XON_TH_MASK);\n+\t\tif (speed == NBL_FW_PORT_SPEED_100G) {\n+\t\t\tfc_th |=\n+\t\t\t\tFIELD_PREP(NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK,\n+\t\t\t\t\t NBL_DSTORE_DROP_XOFF_TH_100G) |\n+\t\t\t\tFIELD_PREP(NBL_DSTORE_D_DPORT_FC_XON_TH_MASK,\n+\t\t\t\t\t NBL_DSTORE_DROP_XON_TH_100G);\n+\t\t} else {\n+\t\t\tfc_th |=\n+\t\t\t\tFIELD_PREP(NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK,\n+\t\t\t\t\t NBL_DSTORE_DROP_XOFF_TH) |\n+\t\t\t\tFIELD_PREP(NBL_DSTORE_D_DPORT_FC_XON_TH_MASK,\n+\t\t\t\t\t NBL_DSTORE_DROP_XON_TH);\n+\t\t}\n+\n+\t\tfc_th |= FIELD_PREP(NBL_DSTORE_D_DPORT_FC_FC_EN_MASK, 1);\n+\t\tnbl_hw_wr_regs(hw_mgt, NBL_DSTORE_D_DPORT_FC_TH_REG(i), \u0026fc_th,\n+\t\t\t sizeof(fc_th));\n+\t\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\t}\n+}\n+\n+static void nbl_dvn_descreq_num_cfg(struct nbl_hw_mgt *hw_mgt, u8 descreq_num)\n+{\n+\tu8 split_ring_num = (descreq_num \u003e\u003e 3) \u0026 0x1;\n+\tu8 ring_num = descreq_num \u0026 0x7;\n+\tu32 num_cfg;\n+\tu32 reg_val;\n+\n+\tnbl_hw_rd_regs_lock(hw_mgt, NBL_DVN_DESCREQ_NUM_CFG, \u0026reg_val,\n+\t\t\t sizeof(reg_val));\n+\n+\tnum_cfg = FIELD_PREP(NBL_DVN_DESCREQ_NUM_CFG_AVRING_DESREQ_NUM_CFG_MASK,\n+\t\t\t split_ring_num) |\n+\t\t FIELD_PREP(NBL_DVN_DESCREQ_NUM_CFG_PACKED_L1_NUM_MASK,\n+\t\t\t ring_num);\n+\treg_val \u0026= ~(NBL_DVN_DESCREQ_NUM_CFG_AVRING_DESREQ_NUM_CFG_MASK |\n+\t\tNBL_DVN_DESCREQ_NUM_CFG_PACKED_L1_NUM_MASK);\n+\treg_val |= num_cfg;\n+\tnbl_hw_wr_regs_lock(hw_mgt, NBL_DVN_DESCREQ_NUM_CFG, \u0026reg_val,\n+\t\t\t sizeof(reg_val));\n+}\n+\n+static void nbl_dvn_init(struct nbl_hw_mgt *hw_mgt, u8 speed)\n+{\n+\tu32 timeout = 0;\n+\tu32 ro_flag = 0;\n+\n+\ttimeout = FIELD_PREP(NBL_DVN_DESC_WR_MERGE_TIMEOUT_CFG_CYCLE_MASK,\n+\t\t\t DEFAULT_DVN_DESC_WR_MERGE_TIMEOUT_MAX);\n+\tnbl_hw_wr_regs_lock(hw_mgt, NBL_DVN_DESC_WR_MERGE_TIMEOUT, \u0026timeout,\n+\t\t\t sizeof(timeout));\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_DVN_DIF_REQ_RD_RO_FLAG, \u0026ro_flag,\n+\t\t sizeof(ro_flag));\n+\tif (pcie_relaxed_ordering_enabled(hw_mgt-\u003ecommon-\u003epdev)) {\n+\t\tro_flag |=\n+\t\t\tFIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DESC_RO_EN_MASK,\n+\t\t\t\t 1) |\n+\t\t\tFIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DATA_RO_EN_MASK,\n+\t\t\t\t 1) |\n+\t\t\tFIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_AVRING_RO_EN_MASK,\n+\t\t\t\t 1);\n+\t} else {\n+\t\tro_flag \u0026=\n+\t\t\t~(FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DESC_RO_EN_MASK,\n+\t\t\t\t 1) |\n+\t\t\tFIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DATA_RO_EN_MASK,\n+\t\t\t\t 1) |\n+\t\t\tFIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_AVRING_RO_EN_MASK,\n+\t\t\t\t 1));\n+\t}\n+\tnbl_hw_wr_regs(hw_mgt, NBL_DVN_DIF_REQ_RD_RO_FLAG, \u0026ro_flag,\n+\t\t sizeof(ro_flag));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\tif (speed == NBL_FW_PORT_SPEED_100G)\n+\t\tnbl_dvn_descreq_num_cfg(hw_mgt,\n+\t\t\t\t\tDEFAULT_DVN_100G_DESCREQ_NUMCFG);\n+\telse\n+\t\tnbl_dvn_descreq_num_cfg(hw_mgt, DEFAULT_DVN_DESCREQ_NUMCFG);\n+}\n+\n+static void nbl_uvn_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tu16 wr_timeout = NBL_UVN_DESC_WR_TIMEOUT_VAL;\n+\tu32 timeout = NBL_UVN_DESC_RD_WAIT_TICKS;\n+\tu32 prefetch_init = 0;\n+\tbool ro_enabled;\n+\tu32 flag = 0;\n+\tu32 mask = 0;\n+\tu32 quirks;\n+\tu32 reg_val;\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_wr32(hw_mgt, NBL_UVN_DESC_RD_WAIT, timeout);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_UVN_DESC_WR_TIMEOUT,\n+\t\t \u0026reg_val, sizeof(reg_val));\n+\treg_val \u0026= ~NBL_UVN_DESC_WR_TIMEOUT_NUM_MASK;\n+\treg_val |= FIELD_PREP(NBL_UVN_DESC_WR_TIMEOUT_NUM_MASK, wr_timeout);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UVN_DESC_WR_TIMEOUT, \u0026reg_val,\n+\t\t sizeof(reg_val));\n+\tro_enabled = pcie_relaxed_ordering_enabled(hw_mgt-\u003ecommon-\u003epdev);\n+\n+\tnbl_hw_rd_regs(hw_mgt, NBL_UVN_DIF_REQ_RO_FLAG, \u0026flag, sizeof(flag));\n+\tif (ro_enabled) {\n+\t\tflag |= FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_AVAIL_RD_MASK, 1) |\n+\t\tFIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_RD_MASK, 1) |\n+\t\tFIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_PKT_WR_MASK, 1);\n+\t\tflag \u0026= ~FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_WR_MASK, 1);\n+\t} else {\n+\t\tflag \u0026= ~(FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_AVAIL_RD_MASK, 1) |\n+\t\t\t FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_RD_MASK, 1) |\n+\t\t\t FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_PKT_WR_MASK, 1) |\n+\t\t\t FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_WR_MASK, 1));\n+\t}\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UVN_DIF_REQ_RO_FLAG, \u0026flag, sizeof(flag));\n+\n+\tnbl_hw_rd_regs(hw_mgt, NBL_UVN_QUEUE_ERR_MASK, \u0026mask, sizeof(mask));\n+\tmask |= FIELD_PREP(NBL_UVN_QUEUE_ERR_MASK_DIF_ERR_MASK, 1);\n+\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UVN_QUEUE_ERR_MASK, \u0026mask, sizeof(mask));\n+\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\tquirks = nbl_hw_get_quirks(hw_mgt);\n+\t/*\n+\t * sel=0: use configured num; sel=1: use internal calc (max 32)\n+\t * Default is sel=1, unless NBL_QUIRK_UVN_PREFETCH_ALIGN is set,\n+\t * in which case override to sel=0.\n+\t */\n+\tnbl_hw_rd_regs_lock(hw_mgt, NBL_UVN_DESC_PREFETCH_INIT,\n+\t\t\t \u0026reg_val, sizeof(reg_val));\n+\tprefetch_init =\n+\t\tFIELD_PREP(NBL_UVN_DESC_PREFETCH_INIT_NUM_MASK,\n+\t\t\t NBL_UVN_DESC_PREFETCH_NUM) |\n+\t\tFIELD_PREP(NBL_UVN_DESC_PREFETCH_INIT_SEL_MASK,\n+\t\t\t (quirks \u0026 NBL_QUIRK_UVN_PREFETCH_ALIGN) ? 0 : 1);\n+\treg_val \u0026= ~(NBL_UVN_DESC_PREFETCH_INIT_NUM_MASK |\n+\t\tNBL_UVN_DESC_PREFETCH_INIT_SEL_MASK);\n+\treg_val |= prefetch_init;\n+\tnbl_hw_wr_regs_lock(hw_mgt, NBL_UVN_DESC_PREFETCH_INIT,\n+\t\t\t \u0026reg_val, sizeof(reg_val));\n+}\n+\n+static void nbl_uqm_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tu32 que_type = 0;\n+\tu32 cnt = 0;\n+\tint i;\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_FWD_DROP_CNT, \u0026cnt, sizeof(cnt));\n+\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_PKT_CNT, \u0026cnt, sizeof(cnt));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_PKT_SLICE_CNT, \u0026cnt, sizeof(cnt));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_PKT_LEN_ADD_CNT, \u0026cnt, sizeof(cnt));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_HEAD_PNTR_ADD_CNT, \u0026cnt,\n+\t\t sizeof(cnt));\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_WEIGHT_ADD_CNT, \u0026cnt, sizeof(cnt));\n+\n+\tfor (i = 0; i \u003c NBL_UQM_PORT_DROP_DEPTH; i++) {\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_UQM_PORT_DROP_PKT_CNT + (sizeof(cnt) * i),\n+\t\t\t \u0026cnt, sizeof(cnt));\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_UQM_PORT_DROP_PKT_SLICE_CNT +\n+\t\t\t\t (sizeof(cnt) * i),\n+\t\t\t \u0026cnt, sizeof(cnt));\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_UQM_PORT_DROP_PKT_LEN_ADD_CNT +\n+\t\t\t\t (sizeof(cnt) * i),\n+\t\t\t \u0026cnt, sizeof(cnt));\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_UQM_PORT_DROP_HEAD_PNTR_ADD_CNT +\n+\t\t\t\t (sizeof(cnt) * i),\n+\t\t\t \u0026cnt, sizeof(cnt));\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_UQM_PORT_DROP_WEIGHT_ADD_CNT +\n+\t\t\t\t (sizeof(cnt) * i),\n+\t\t\t \u0026cnt, sizeof(cnt));\n+\t}\n+\n+\tfor (i = 0; i \u003c NBL_UQM_DPORT_DROP_DEPTH; i++)\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_UQM_DPORT_DROP_CNT + (sizeof(cnt) * i), \u0026cnt,\n+\t\t\t sizeof(cnt));\n+\t/* bit0: 0=bp mode, 1=drop mode, resv bit1-31 */\n+\tnbl_hw_wr_regs(hw_mgt, NBL_UQM_QUE_TYPE, \u0026que_type, sizeof(que_type));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static int nbl_dp_init(struct nbl_hw_mgt *hw_mgt, u8 speed, u8 eth_num)\n+{\n+\tint ret;\n+\n+\tnbl_dped_init(hw_mgt);\n+\tnbl_uped_init(hw_mgt);\n+\tret = nbl_shaping_init(hw_mgt, speed);\n+\tif (ret)\n+\t\treturn ret;\n+\tnbl_dsch_qid_max_init(hw_mgt);\n+\tret = nbl_ustore_init(hw_mgt, eth_num);\n+\tif (ret)\n+\t\treturn ret;\n+\tnbl_dstore_init(hw_mgt, speed);\n+\tnbl_dvn_init(hw_mgt, speed);\n+\tnbl_uvn_init(hw_mgt);\n+\tnbl_uqm_init(hw_mgt);\n+\treturn 0;\n+}\n+\n+static void nbl_host_padpt_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\t/* padpt flow control register */\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_CPLH_UP,\n+\t\t NBL_HOST_PADPT_CFG_FC_CPLH_UP_VAL);\n+\tnbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_PD_DN,\n+\t\t NBL_HOST_PADPT_CFG_FC_PD_DN_VAL);\n+\tnbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_PH_DN,\n+\t\t NBL_HOST_PADPT_CFG_FC_PH_DN_VAL);\n+\tnbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_NPH_DN,\n+\t\t NBL_HOST_PADPT_CFG_FC_NPH_DN_VAL);\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static void nbl_intf_init(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tnbl_host_padpt_init(hw_mgt);\n+}\n+\n+static void nbl_hw_set_driver_status(struct nbl_hw_mgt *hw_mgt, bool active)\n+{\n+\tu32 status;\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tstatus = nbl_hw_rd32(hw_mgt, NBL_DRIVER_STATUS_REG);\n+\n+\tstatus \u0026= ~BIT(NBL_DRIVER_STATUS_BIT);\n+\tstatus |= FIELD_PREP(BIT(NBL_DRIVER_STATUS_BIT), active);\n+\n+\tnbl_hw_wr32(hw_mgt, NBL_DRIVER_STATUS_REG, status);\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+/*\n+ * Setting driver status to false notifies firmware to clean up per-PF\n+ * hardware state such as qinfo registers.\n+ *\n+ * Note: firmware does NOT automatically revert chip-wide registers\n+ * configured in this init flow. Those chip-wide settings remain valid\n+ * until chip reset or explicitly cleared by driver.\n+ *\n+ * For normal successful probe, driver will reset these chip-wide\n+ * resources in subsequent deinit. For failed probe before\n+ * driver_status is set to true, hardware may stay in partial\n+ * programmed state. We validate all input parameters before touching\n+ * hardware registers to avoid this scenario.\n+ */\n+static void nbl_hw_deinit_module(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tnbl_hw_set_driver_status(hw_mgt, false);\n+\t/* ensure registers written */\n+\tnbl_flush_writes(hw_mgt);\n+\t/*\n+\t * Firmware cleanup is asynchronous: there is no cleanup-complete\n+\t * status register in the current hardware revision. The posted\n+\t * write flush above only ensures driver_status reaches the chip;\n+\t * firmware may still be performing per-PF state cleanup when this\n+\t * function returns.\n+\t *\n+\t * Caller must ensure no new DMA is initiated after this point.\n+\t * The mailbox channel is stopped by nbl_chan_teardown_queue()\n+\t * before this function is called, so no in-flight mailbox DMA\n+\t * remains.\n+\t */\n+}\n+\n+static bool nbl_hw_eth_speed_valid(u8 speed)\n+{\n+\tswitch (speed) {\n+\tcase NBL_FW_PORT_SPEED_10G:\n+\tcase NBL_FW_PORT_SPEED_25G:\n+\tcase NBL_FW_PORT_SPEED_50G:\n+\tcase NBL_FW_PORT_SPEED_100G:\n+\t\treturn true;\n+\tdefault:\n+\t\treturn false;\n+\t}\n+}\n+\n+static bool nbl_hw_eth_num_valid(u8 eth_num)\n+{\n+\treturn eth_num == 1 || eth_num == 2 || eth_num == 4;\n+}\n+\n+/*\n+ * Full chip hardware initialization is handled by firmware.\n+ * This function only configures driver-level table entries and registers.\n+ */\n+static int nbl_hw_init_module(struct nbl_hw_mgt *hw_mgt, u8 eth_speed,\n+\t\t\t u8 eth_num)\n+{\n+\tint ret;\n+\n+\tif (!nbl_hw_eth_speed_valid(eth_speed)) {\n+\t\tdev_err(hw_mgt-\u003ecommon-\u003edev, \"Invalid eth_speed %u\\n\",\n+\t\t\teth_speed);\n+\t\treturn -EINVAL;\n+\t}\n+\tif (!nbl_hw_eth_num_valid(eth_num)) {\n+\t\tdev_err(hw_mgt-\u003ecommon-\u003edev, \"Invalid eth_num %u\\n\", eth_num);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tret = nbl_dp_init(hw_mgt, eth_speed, eth_num);\n+\tif (ret)\n+\t\treturn ret;\n+\tnbl_intf_init(hw_mgt);\n+\tnbl_hw_set_driver_status(hw_mgt, true);\n+\t/* ensure registers written */\n+\tnbl_flush_writes(hw_mgt);\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * nbl_hw_set_mailbox_irq - read-modify-write NBL_MAILBOX_QINFO_MAP_REG_ARR\n+ *\n+ * The full RMW sequence is wrapped by reg_lock, so concurrent register\n+ * access from different CPUs is already serialized safely.\n+ * nbl_hw_cfg_mailbox_qinfo() overwrites the entire register during init,\n+ * which unconditionally clears MSIX_IDX and MSIX_IDX_VALID bits, disabling\n+ * mailbox MSIX interrupt routing for this PF.\n+ */\n+static void nbl_hw_set_mailbox_irq(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t\t bool en_msix, u16 gvec)\n+{\n+\tu32 data = 0;\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id), \u0026data,\n+\t\t sizeof(data));\n+\tdata \u0026= ~(NBL_MAILBOX_QINFO_MAP_MSIX_IDX_MASK |\n+\t\t NBL_MAILBOX_QINFO_MAP_MSIX_IDX_VALID_MASK);\n+\tif (en_msix)\n+\t\tdata |= FIELD_PREP(NBL_MAILBOX_QINFO_MAP_MSIX_IDX_MASK,\n+\t\t\t\t gvec) |\n+\t\t\tFIELD_PREP(NBL_MAILBOX_QINFO_MAP_MSIX_IDX_VALID_MASK,\n+\t\t\t\t 1);\n+\n+\tnbl_hw_wr_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id), \u0026data,\n+\t\t sizeof(data));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_flush_writes(hw_mgt);\n+}\n+\n+static void nbl_hw_cfg_msix_map(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t\tbool valid, dma_addr_t dma_addr, u8 bus,\n+\t\t\t\tu8 devid, u8 function)\n+{\n+\tstruct nbl_function_msix_map function_msix_map;\n+\n+\tmemset(\u0026function_msix_map, 0, sizeof(function_msix_map));\n+\tif (valid) {\n+\t\tfunction_msix_map.data[0] = lower_32_bits(dma_addr);\n+\t\tfunction_msix_map.data[1] = upper_32_bits(dma_addr);\n+\t\t/* use ctrl dev's bdf, because the dma memory was\n+\t\t * allocated by it\n+\t\t */\n+\t\tfunction_msix_map.data[2] =\n+\t\t\tFIELD_PREP(NBL_FUNCTION_MSIX_MAP_FUNCTION_MASK,\n+\t\t\t\t function) |\n+\t\t\tFIELD_PREP(NBL_FUNCTION_MSIX_MAP_DEVID_MASK, devid) |\n+\t\t\tFIELD_PREP(NBL_FUNCTION_MSIX_MAP_BUS_MASK, bus) |\n+\t\t\tFIELD_PREP(NBL_FUNCTION_MSIX_MAP_VALID_MASK, 1);\n+\t} else {\n+\t\t/*\n+\t\t * reg_lock prevents concurrent CPU writes to the same\n+\t\t * function's MSIX entry, but cannot synchronize hardware DMA\n+\t\t * reads. Upper layer uses two-stage destruction + sync sleep\n+\t\t * to avoid torn hardware read of partial MSIX entry.\n+\t\t * Keep valid live dma address here, only clear VALID flag.\n+\t\t */\n+\t\tfunction_msix_map.data[0] = lower_32_bits(dma_addr);\n+\t\tfunction_msix_map.data[1] = upper_32_bits(dma_addr);\n+\t\tfunction_msix_map.data[2] = 0;\n+\t}\n+\n+\tnbl_hw_wr_regs_lock(hw_mgt,\n+\t\t\t NBL_PCOMPLETER_FUNCTION_MSIX_MAP_REG_ARR(func_id),\n+\t\t\t function_msix_map.data, sizeof(function_msix_map));\n+}\n+\n+static void nbl_hw_cfg_msix_info(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t\t bool valid, u16 interrupt_id, u8 bus,\n+\t\t\t\t u8 devid, u8 function, bool msix_mask_en)\n+{\n+\tu32 host_msix_fid = 0;\n+\tstruct nbl_host_msix_info msix_info;\n+\n+\tmemset(\u0026msix_info, 0, sizeof(msix_info));\n+\tif (valid) {\n+\t\thost_msix_fid =\n+\t\t\tFIELD_PREP(NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_FID_MASK,\n+\t\t\t\t func_id) |\n+\t\t\tFIELD_PREP(NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_VLD_MASK,\n+\t\t\t\t 1);\n+\n+\t\tmsix_info.data[1] =\n+\t\t\tFIELD_PREP(NBL_HOST_MSIX_INFO_FUNCTION_MASK, function) |\n+\t\t\tFIELD_PREP(NBL_HOST_MSIX_INFO_DEVID_MASK, devid) |\n+\t\t\tFIELD_PREP(NBL_HOST_MSIX_INFO_BUS_MASK, bus) |\n+\t\t\tFIELD_PREP(NBL_HOST_MSIX_INFO_VALID_MASK, 1);\n+\n+\t\tif (msix_mask_en)\n+\t\t\tmsix_info.data[1] |=\n+\t\t\tFIELD_PREP(NBL_HOST_MSIX_INFO_MSIX_MASK_EN_MASK, 1);\n+\t}\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\t/*\n+\t * Programming order rule:\n+\t * Enable: PADPT_HOST_MSIX_INFO -\u003e PCOMPLETER_HOST_MSIX_FID_TABLE\n+\t * Teardown: reverse order, clear FID VLD first to avoid inconsistent\n+\t * state\n+\t */\n+\tif (valid) {\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_PADPT_HOST_MSIX_INFO_REG_ARR(interrupt_id),\n+\t\t\t msix_info.data, sizeof(msix_info));\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_PCOMPLETER_HOST_MSIX_FID_TABLE(interrupt_id),\n+\t\t\t \u0026host_msix_fid, sizeof(host_msix_fid));\n+\t} else {\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_PCOMPLETER_HOST_MSIX_FID_TABLE(interrupt_id),\n+\t\t\t \u0026host_msix_fid, sizeof(host_msix_fid));\n+\t\tnbl_hw_wr_regs(hw_mgt,\n+\t\t\t NBL_PADPT_HOST_MSIX_INFO_REG_ARR(interrupt_id),\n+\t\t\t msix_info.data, sizeof(msix_info));\n+\t}\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+static void nbl_hw_update_mailbox_queue_tail_ptr(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t\t\t u16 tail_ptr, u8 txrx)\n+{\n+\t/* local_qid 0 and 1 denote rx and tx queue respectively */\n+\tu32 local_qid = txrx;\n+\tu32 value = ((u32)tail_ptr \u003c\u003c 16) | local_qid;\n+\n+\t/* wmb for doorbell */\n+\twmb();\n+\tnbl_mbx_wr32(hw_mgt, NBL_MAILBOX_NOTIFY_ADDR, value);\n+}\n+\n+static void nbl_hw_config_mailbox_rxq(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t dma_addr_t dma_addr, int size_bwid)\n+{\n+\tstruct nbl_mailbox_qinfo_cfg_table cfg_tbl;\n+\n+\tmemset(\u0026cfg_tbl, 0, sizeof(cfg_tbl));\n+\tcfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);\n+\tnbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR,\n+\t\t\t cfg_tbl.data, sizeof(cfg_tbl));\n+\n+\tcfg_tbl.data[0] = lower_32_bits(dma_addr);\n+\tcfg_tbl.data[1] = upper_32_bits(dma_addr);\n+\tcfg_tbl.data[2] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_SIZE_BWID_MASK,\n+\t\t\t\t size_bwid);\n+\tcfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 0) |\n+\t\t\t FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_EN_MASK, 1);\n+\tnbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR,\n+\t\t\t cfg_tbl.data, sizeof(cfg_tbl));\n+}\n+\n+static void nbl_hw_config_mailbox_txq(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t dma_addr_t dma_addr, int size_bwid)\n+{\n+\tstruct nbl_mailbox_qinfo_cfg_table cfg_tbl;\n+\n+\tmemset(\u0026cfg_tbl, 0, sizeof(cfg_tbl));\n+\tcfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);\n+\tnbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR,\n+\t\t\t cfg_tbl.data, sizeof(cfg_tbl));\n+\n+\tcfg_tbl.data[0] = lower_32_bits(dma_addr);\n+\tcfg_tbl.data[1] = upper_32_bits(dma_addr);\n+\tcfg_tbl.data[2] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_SIZE_BWID_MASK,\n+\t\t\t\t size_bwid);\n+\tcfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 0) |\n+\t\t\t FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_EN_MASK, 1);\n+\tnbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR,\n+\t\t\t cfg_tbl.data, sizeof(cfg_tbl));\n+}\n+\n+static void nbl_hw_stop_mailbox_rxq(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tstruct nbl_mailbox_qinfo_cfg_table cfg_tbl;\n+\n+\tmemset(\u0026cfg_tbl, 0, sizeof(cfg_tbl));\n+\tcfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);\n+\tnbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR,\n+\t\t\t cfg_tbl.data, sizeof(cfg_tbl));\n+}\n+\n+static void nbl_hw_stop_mailbox_txq(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tstruct nbl_mailbox_qinfo_cfg_table cfg_tbl;\n+\n+\tmemset(\u0026cfg_tbl, 0, sizeof(cfg_tbl));\n+\tcfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);\n+\tnbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR,\n+\t\t\t cfg_tbl.data, sizeof(cfg_tbl));\n+}\n+\n+static void nbl_hw_get_host_pf_mask(struct nbl_hw_mgt *hw_mgt, u32 *pf_mask)\n+{\n+\tnbl_hw_rd_regs_lock(hw_mgt, NBL_PCIE_HOST_K_PF_MASK_REG, pf_mask,\n+\t\t\t sizeof(*pf_mask));\n+}\n+\n+static void nbl_hw_get_real_bus(struct nbl_hw_mgt *hw_mgt, u8 *bus)\n+{\n+\tu32 data = 0;\n+\n+\tnbl_hw_rd_regs_lock(hw_mgt, NBL_PCIE_HOST_TL_CFG_BUSDEV, \u0026data,\n+\t\t\t sizeof(data));\n+\t*bus = FIELD_GET(NBL_PCIE_BUS_MASK, data);\n+}\n+\n+static void nbl_hw_cfg_mailbox_qinfo(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t\t u8 bus, u8 devid, u8 function)\n+{\n+\tu32 data = 0;\n+\n+\tspin_lock(\u0026hw_mgt-\u003ereg_lock);\n+\tnbl_hw_rd_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id),\n+\t\t \u0026data, sizeof(data));\n+\tdata \u0026= ~(NBL_MAILBOX_QINFO_MAP_FUNCTION_MASK |\n+\t\t NBL_MAILBOX_QINFO_MAP_DEVID_MASK |\n+\t\t NBL_MAILBOX_QINFO_MAP_BUS_MASK);\n+\tdata |= FIELD_PREP(NBL_MAILBOX_QINFO_MAP_FUNCTION_MASK, function) |\n+\t FIELD_PREP(NBL_MAILBOX_QINFO_MAP_DEVID_MASK, devid) |\n+\t FIELD_PREP(NBL_MAILBOX_QINFO_MAP_BUS_MASK, bus);\n+\tnbl_hw_wr_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id),\n+\t\t \u0026data, sizeof(data));\n+\tspin_unlock(\u0026hw_mgt-\u003ereg_lock);\n+}\n+\n+/*\n+ * Registers reset to zero after cold boot / FLR / bus reset. Firmware\n+ * programs valid values before driver probe, so zero is only seen on\n+ * hardware fault or register read failure. Initialize data=0 to guard\n+ * against nbl_hw_read_mbx_regs() early-return on bounds-check failure.\n+ */\n+static void nbl_hw_get_board_info(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t struct nbl_board_port_info *board_info)\n+{\n+\tu32 data = 0;\n+\n+\tnbl_hw_read_mbx_regs(hw_mgt, NBL_FW_BOARD_DW3_OFFSET, \u0026data,\n+\t\t\t sizeof(data));\n+\tboard_info-\u003eeth_num = FIELD_GET(NBL_FW_BOARD_DW3_PORT_NUM_MASK, data);\n+\tboard_info-\u003eeth_speed =\n+\t\tFIELD_GET(NBL_FW_BOARD_DW3_PORT_SPEED_MASK, data);\n+\tboard_info-\u003ep4_version =\n+\t\tFIELD_GET(NBL_FW_BOARD_DW3_P4_VERSION_MASK, data);\n+}\n+\n+static struct nbl_hw_ops hw_ops = {\n+\t.init_module = nbl_hw_init_module,\n+\t.deinit_module = nbl_hw_deinit_module,\n+\n+\t.cfg_msix_map = nbl_hw_cfg_msix_map,\n+\t.cfg_msix_info = nbl_hw_cfg_msix_info,\n+\t.flush_write = nbl_flush_writes,\n+\n+\t.update_mailbox_queue_tail_ptr = nbl_hw_update_mailbox_queue_tail_ptr,\n+\t.config_mailbox_rxq = nbl_hw_config_mailbox_rxq,\n+\t.config_mailbox_txq = nbl_hw_config_mailbox_txq,\n+\t.stop_mailbox_rxq = nbl_hw_stop_mailbox_rxq,\n+\t.stop_mailbox_txq = nbl_hw_stop_mailbox_txq,\n+\t.get_host_pf_mask = nbl_hw_get_host_pf_mask,\n+\t.get_real_bus = nbl_hw_get_real_bus,\n+\n+\t.cfg_mailbox_qinfo = nbl_hw_cfg_mailbox_qinfo,\n+\t.set_mailbox_irq = nbl_hw_set_mailbox_irq,\n+\n+\t.get_fw_eth_map = nbl_hw_get_fw_eth_map,\n+\t.get_board_info = nbl_hw_get_board_info,\n+};\n+\n+/* Structure starts here, adding an op should not modify anything below */\n+static struct nbl_hw_mgt *nbl_hw_setup_hw_mgt(struct nbl_common_info *common)\n+{\n+\tstruct device *dev = common-\u003edev;\n+\tstruct nbl_hw_mgt *hw_mgt;\n+\n+\thw_mgt = devm_kzalloc(dev, sizeof(*hw_mgt), GFP_KERNEL);\n+\tif (!hw_mgt)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\thw_mgt-\u003ecommon = common;\n+\n+\treturn hw_mgt;\n+}\n+\n+static struct nbl_hw_ops_tbl *nbl_hw_setup_ops(struct nbl_common_info *common,\n+\t\t\t\t\t struct nbl_hw_mgt *hw_mgt)\n+{\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl;\n+\tstruct device *dev;\n+\n+\tdev = common-\u003edev;\n+\thw_ops_tbl = devm_kzalloc(dev, sizeof(*hw_ops_tbl), GFP_KERNEL);\n+\tif (!hw_ops_tbl)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\tif (!hw_ops.cfg_msix_map || !hw_ops.cfg_msix_info ||\n+\t !hw_ops.flush_write || !hw_ops.update_mailbox_queue_tail_ptr ||\n+\t !hw_ops.config_mailbox_rxq || !hw_ops.config_mailbox_txq ||\n+\t !hw_ops.stop_mailbox_rxq || !hw_ops.stop_mailbox_txq ||\n+\t !hw_ops.get_host_pf_mask || !hw_ops.get_real_bus ||\n+\t !hw_ops.cfg_mailbox_qinfo || !hw_ops.set_mailbox_irq ||\n+\t !hw_ops.get_fw_eth_map || !hw_ops.get_board_info ||\n+\t !hw_ops.init_module || !hw_ops.deinit_module)\n+\t\treturn ERR_PTR(-EINVAL);\n+\thw_ops_tbl-\u003eops = \u0026hw_ops;\n+\thw_ops_tbl-\u003epriv = hw_mgt;\n+\n+\treturn hw_ops_tbl;\n+}\n+\n+static int nbl_pcim_request_selected_bars(struct pci_dev *pdev, u32 mask,\n+\t\t\t\t\t const char *name)\n+{\n+\tint bar;\n+\tint ret;\n+\n+\tfor (bar = 0; bar \u003c PCI_STD_NUM_BARS; bar++) {\n+\t\tif (!(mask \u0026 BIT(bar)))\n+\t\t\tcontinue;\n+\t\tret = pcim_request_region(pdev, bar, name);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n+\treturn 0;\n+}\n+\n+int nbl_hw_init_leonis(struct nbl_adapter *adapter)\n+{\n+\tresource_size_t expect_sz = NBL_MEM_BAR_TOTAL_SIZE;\n+\tstruct nbl_common_info *common = \u0026adapter-\u003ecommon;\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl = NULL;\n+\tstruct pci_dev *pdev = common-\u003epdev;\n+\tstruct nbl_hw_mgt *hw_mgt = NULL;\n+\tresource_size_t bar_len;\n+\tresource_size_t hw_size;\n+\tu32 bar_mask;\n+\tint ret;\n+\n+\thw_mgt = nbl_hw_setup_hw_mgt(common);\n+\tif (IS_ERR(hw_mgt)) {\n+\t\tret = PTR_ERR(hw_mgt);\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\tbar_mask = BIT(NBL_MEMORY_BAR) | BIT(NBL_MAILBOX_BAR);\n+\tret = nbl_pcim_request_selected_bars(pdev, bar_mask, NBL_DRIVER_NAME);\n+\tif (ret) {\n+\t\tdev_err(\u0026pdev-\u003edev,\n+\t\t\t\"Request memory bar failed, err = %d\\n\",\n+\t\t\tret);\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\n+\tbar_len = pci_resource_len(pdev, NBL_MEMORY_BAR);\n+\tif (!(pci_resource_flags(pdev, NBL_MEMORY_BAR) \u0026 IORESOURCE_MEM)) {\n+\t\tdev_err(\u0026pdev-\u003edev, \"MEMORY BAR is not memory resource\\n\");\n+\t\tret = -EINVAL;\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\tif (common-\u003ehas_ctrl) {\n+\t\t/*\n+\t\t * Hardware layout: MEMORY BAR total size is 64M.\n+\t\t * The tail NBL_RDMA_NOTIFY_LEN bytes of the 64M BAR are\n+\t\t * reserved exclusively for RDMA notify hardware.\n+\t\t * Ethernet driver must avoid mapping this reserved tail\n+\t\t * to prevent x86 PAT aliasing conflict between eth net\n+\t\t * mapping and RDMA driver WC mapping. Mapping starts\n+\t\t * at BAR offset 0.\n+\t\t *\n+\t\t * Skip trailing NBL_RDMA_NOTIFY_LEN bytes at BAR tail.\n+\t\t * Round size down to page boundary to avoid ioremap\n+\t\t * rounding up and accidentally including RDMA reserved\n+\t\t * region when PAGE_SIZE \u003e 8KiB.\n+\t\t */\n+\t\tif (bar_len \u003c NBL_MEM_BAR_TOTAL_SIZE) {\n+\t\t\tdev_err(\u0026pdev-\u003edev,\n+\t\t\t\t\"MEMORY BAR len %pa smaller than expected %pa\\n\",\n+\t\t\t\t\u0026bar_len, \u0026expect_sz);\n+\t\t\tret = -EINVAL;\n+\t\t\tgoto setup_mgt_fail;\n+\t\t}\n+\t\thw_size = PAGE_ALIGN_DOWN(NBL_MEM_BAR_TOTAL_SIZE -\n+\t\t\t\t\t NBL_RDMA_NOTIFY_LEN);\n+\t\thw_mgt-\u003ehw_addr =\n+\t\t\tpcim_iomap(pdev, NBL_MEMORY_BAR,\n+\t\t\t\t hw_size);\n+\t} else {\n+\t\tif (bar_len \u003c NBL_REG_NET_ONLY_LEN) {\n+\t\t\tdev_err(\u0026pdev-\u003edev,\n+\t\t\t\t\"MEMORY BAR len %pa too small for net only reg space\\n\",\n+\t\t\t\t\u0026bar_len);\n+\t\t\tret = -EINVAL;\n+\t\t\tgoto setup_mgt_fail;\n+\t\t}\n+\t\thw_size = NBL_REG_NET_ONLY_LEN;\n+\t\thw_mgt-\u003ehw_addr = pcim_iomap(pdev, NBL_MEMORY_BAR,\n+\t\t\t\t\t hw_size);\n+\t}\n+\tif (!hw_mgt-\u003ehw_addr) {\n+\t\tdev_err(\u0026pdev-\u003edev, \"MEMORY BAR pcim_iomap failed\\n\");\n+\t\tret = -EIO;\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\n+\tbar_len = pci_resource_len(pdev, NBL_MAILBOX_BAR);\n+\tif (!(pci_resource_flags(pdev, NBL_MAILBOX_BAR) \u0026 IORESOURCE_MEM)) {\n+\t\tdev_err(\u0026pdev-\u003edev, \"MAILBOX BAR is not memory resource\\n\");\n+\t\tret = -EINVAL;\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\tif (bar_len \u003c NBL_BAR2_MAX_LEN) {\n+\t\tdev_err(\u0026pdev-\u003edev, \"MAILBOX BAR length %pa too small\\n\",\n+\t\t\t\u0026bar_len);\n+\t\tret = -EINVAL;\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\thw_mgt-\u003emailbox_bar_hw_addr = pcim_iomap(pdev, NBL_MAILBOX_BAR,\n+\t\t\t\t\t\t bar_len);\n+\tif (!hw_mgt-\u003emailbox_bar_hw_addr) {\n+\t\tdev_err(\u0026pdev-\u003edev, \"MAILBOX BAR pcim_iomap failed\\n\");\n+\t\tret = -EIO;\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\n+\thw_mgt-\u003emailbox_bar_size = bar_len;\n+\tspin_lock_init(\u0026hw_mgt-\u003ereg_lock);\n+\n+\thw_ops_tbl = nbl_hw_setup_ops(common, hw_mgt);\n+\tif (IS_ERR(hw_ops_tbl)) {\n+\t\tret = PTR_ERR(hw_ops_tbl);\n+\t\tgoto setup_mgt_fail;\n+\t}\n+\tadapter-\u003eintf.hw_ops_tbl = hw_ops_tbl;\n+\tadapter-\u003ecore.hw_mgt = hw_mgt;\n+\n+\treturn 0;\n+\n+setup_mgt_fail:\n+\treturn ret;\n+}\n+\n+void nbl_hw_remove_leonis(struct nbl_adapter *adapter)\n+{\n+\t/* All BAR mappings \u0026 PCI regions are managed by pcim/devres,\n+\t * no manual iounmap / release required\n+\t */\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.h\nnew file mode 100644\nindex 0000000000000..99711f18ddc3a\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.h\n@@ -0,0 +1,334 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_HW_LEONIS_H_\n+#define _NBL_HW_LEONIS_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+#include \"../../nbl_include/nbl_include.h\"\n+#include \"../nbl_hw_reg.h\"\n+\n+#define NBL_DRIVER_STATUS_REG\t\t\t0x1300444\n+#define NBL_DRIVER_STATUS_BIT\t\t\t16\n+\n+/* ---------- REG BASE ADDR ---------- */\n+/* Interface modules base addr */\n+#define NBL_INTF_HOST_PCOMPLETER_BASE\t\t0x00f08000\n+#define NBL_INTF_HOST_PADPT_BASE\t\t0x00f4c000\n+#define NBL_INTF_HOST_MAILBOX_BASE\t\t0x00fb0000\n+#define NBL_INTF_HOST_PCIE_BASE\t\t\t0X01504000\n+/* DP modules base addr */\n+#define NBL_DP_USTORE_BASE\t\t\t0x00104000\n+#define NBL_DP_UQM_BASE\t\t\t\t0x00114000\n+#define NBL_DP_UPED_BASE\t\t\t0x0015c000\n+#define NBL_DP_UVN_BASE\t\t\t\t0x00244000\n+#define NBL_DP_DSCH_BASE\t\t\t0x00404000\n+#define NBL_DP_SHAPING_BASE\t\t\t0x00504000\n+#define NBL_DP_DVN_BASE\t\t\t\t0x00514000\n+#define NBL_DP_DSTORE_BASE\t\t\t0x00704000\n+#define NBL_DP_DPED_BASE\t\t\t0x0075c000\n+/* -------- MAILBOX BAR2 ----- */\n+#define NBL_MAILBOX_NOTIFY_ADDR\t\t\t0x00000000\n+#define NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR\t0x10\n+#define NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR\t0x20\n+\n+/* -------- MAILBOX -------- */\n+\n+/* mailbox BAR qinfo_cfg_table */\n+#define MAILBOX_QINFO_CFG_TABLE_DWLEN\t4\n+/* data[2] */\n+#define NBL_MAILBOX_QINFO_CFG_QUEUE_SIZE_BWID_MASK\tGENMASK(3, 0)\n+/* data[3] */\n+#define NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK\t\tBIT(0)\n+#define NBL_MAILBOX_QINFO_CFG_QUEUE_EN_MASK\t\tBIT(1)\n+#define NBL_MAILBOX_QINFO_CFG_DIF_ERR_MASK\t\tBIT(2)\n+#define NBL_MAILBOX_QINFO_CFG_PTR_ERR_MASK\t\tBIT(3)\n+struct nbl_mailbox_qinfo_cfg_table {\n+\tu32 data[MAILBOX_QINFO_CFG_TABLE_DWLEN];\n+};\n+\n+/* -------- MAILBOX BAR0 ----- */\n+/* mailbox qinfo_map_table */\n+#define NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id) \\\n+\t(NBL_INTF_HOST_MAILBOX_BASE + 0x00001000 + (func_id) * sizeof(u32))\n+\n+/* MAILBOX qinfo_map_table */\n+#define NBL_MAILBOX_QINFO_MAP_FUNCTION_MASK\t\tGENMASK(2, 0)\n+#define NBL_MAILBOX_QINFO_MAP_DEVID_MASK\t\tGENMASK(7, 3)\n+#define NBL_MAILBOX_QINFO_MAP_BUS_MASK\t\t\tGENMASK(15, 8)\n+#define NBL_MAILBOX_QINFO_MAP_MSIX_IDX_MASK\t\tGENMASK(28, 16)\n+#define NBL_MAILBOX_QINFO_MAP_MSIX_IDX_VALID_MASK\tBIT(29)\n+\n+/* -------- HOST_PCIE -------- */\n+#define NBL_PCIE_HOST_K_PF_MASK_REG (NBL_INTF_HOST_PCIE_BASE + 0x00001004)\n+#define NBL_PCIE_HOST_TL_CFG_BUSDEV (NBL_INTF_HOST_PCIE_BASE + 0x11040)\n+\n+#define NBL_PCIE_BUS_MASK\tGENMASK(12, 5)\n+\n+/* -------- HOST_PADPT -------- */\n+#define NBL_HOST_PADPT_HOST_CFG_FC_PD_DN (NBL_INTF_HOST_PADPT_BASE + 0x00000160)\n+#define NBL_HOST_PADPT_HOST_CFG_FC_PH_DN (NBL_INTF_HOST_PADPT_BASE + 0x00000164)\n+#define NBL_HOST_PADPT_HOST_CFG_FC_NPH_DN \\\n+\t(NBL_INTF_HOST_PADPT_BASE + 0x0000016C)\n+#define NBL_HOST_PADPT_HOST_CFG_FC_CPLH_UP \\\n+\t(NBL_INTF_HOST_PADPT_BASE + 0x00000170)\n+\n+#define NBL_HOST_PADPT_CFG_FC_CPLH_UP_VAL 0x10400\n+#define NBL_HOST_PADPT_CFG_FC_PD_DN_VAL 0x10080\n+#define NBL_HOST_PADPT_CFG_FC_PH_DN_VAL 0x10010\n+#define NBL_HOST_PADPT_CFG_FC_NPH_DN_VAL 0x10010\n+/* host_padpt host_msix_info */\n+#define NBL_PADPT_HOST_MSIX_INFO_REG_ARR(vector_id) \\\n+\t(NBL_INTF_HOST_PADPT_BASE + 0x00010000 + \\\n+\t (vector_id) * sizeof(struct nbl_host_msix_info))\n+\n+#define NBL_HOST_MSIX_INFO_DWLEN\t2\n+/* data[0] */\n+#define NBL_HOST_MSIX_INFO_INTRL_PNUM_MASK GENMASK(15, 0)\n+#define NBL_HOST_MSIX_INFO_INTRL_RATE_MASK GENMASK(31, 16)\n+/* data[1] */\n+#define NBL_HOST_MSIX_INFO_FUNCTION_MASK GENMASK(2, 0)\n+#define NBL_HOST_MSIX_INFO_DEVID_MASK GENMASK(7, 3)\n+#define NBL_HOST_MSIX_INFO_BUS_MASK GENMASK(15, 8)\n+#define NBL_HOST_MSIX_INFO_VALID_MASK BIT(16)\n+#define NBL_HOST_MSIX_INFO_MSIX_MASK_EN_MASK BIT(17)\n+struct nbl_host_msix_info {\n+\tu32 data[NBL_HOST_MSIX_INFO_DWLEN];\n+};\n+\n+/* -------- HOST_PCOMPLETER -------- */\n+/* pcompleter_host pcompleter_host_virtio_qid_map_table */\n+#define NBL_PCOMPLETER_FUNCTION_MSIX_MAP_REG_ARR(i) \\\n+\t(NBL_INTF_HOST_PCOMPLETER_BASE + 0x00004000 + \\\n+\t (i) * sizeof(struct nbl_function_msix_map))\n+#define NBL_PCOMPLETER_HOST_MSIX_FID_TABLE(i) \\\n+\t(NBL_INTF_HOST_PCOMPLETER_BASE + 0x0003a000 + (i) * sizeof(u32))\n+\n+#define NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_FID_MASK GENMASK(9, 0)\n+#define NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_VLD_MASK BIT(10)\n+\n+#define NBL_FUNC_MSIX_MAP_DWLEN\t\t4\n+/* data[2] */\n+#define NBL_FUNCTION_MSIX_MAP_FUNCTION_MASK GENMASK(2, 0)\n+#define NBL_FUNCTION_MSIX_MAP_DEVID_MASK GENMASK(7, 3)\n+#define NBL_FUNCTION_MSIX_MAP_BUS_MASK GENMASK(15, 8)\n+#define NBL_FUNCTION_MSIX_MAP_VALID_MASK BIT(16)\n+struct nbl_function_msix_map {\n+\tu32 data[NBL_FUNC_MSIX_MAP_DWLEN];\n+};\n+\n+/* ---------- DPED ---------- */\n+#define NBL_DPED_VLAN_OFFSET\t\t(NBL_DP_DPED_BASE + 0x000003F4)\n+#define NBL_DPED_DSCP_OFFSET_0\t\t(NBL_DP_DPED_BASE + 0x000003F8)\n+#define NBL_DPED_DSCP_OFFSET_1\t\t(NBL_DP_DPED_BASE + 0x000003FC)\n+/* DPED hw_edt_prof/ UPED hw_edt_prof */\n+\n+#define NBL_DPED_L4_CK_CMD_40_ADDR\t(NBL_DP_DPED_BASE + 0x00000338)\n+\n+#define NBL_DPED_L4_CK_CMD_40_EN_MASK\t\tBIT(31)\n+\n+/* ---------- UPED ---------- */\n+/* UPED uped_hw_edt_prof */\n+#define NBL_UPED_HW_EDT_PROF_TABLE(i) \\\n+\t(NBL_DP_UPED_BASE + 0x00001000 + (i) * sizeof(u32))\n+#define NBL_UPED_V4_TCP_IDX\t\t5\n+#define NBL_UPED_V6_TCP_IDX\t\t6\n+#define NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK GENMASK(3, 2)\n+\n+/* ---------- DSCH ---------- */\n+#define NBL_DSCH_PSHA_EN_MASK GENMASK(3, 0)\n+/* DSCH dsch maxqid */\n+#define NBL_DSCH_HOST_QID_MAX (NBL_DP_DSCH_BASE + 0x00000118)\n+#define NBL_DSCH_VN_QUANTA_ADDR (NBL_DP_DSCH_BASE + 0x00000134)\n+\n+#define NBL_MAX_QUEUE_ID\t0x7ff\n+#define NBL_HOST_QUANTA\t\t0x8000\n+#define NBL_ECPU_QUANTA\t\t0x1000\n+\n+#define NBL_DSCH_VN_QUANTA_H_QUA_MASK GENMASK(15, 0)\n+#define NBL_DSCH_VN_QUANTA_E_QUA_MASK GENMASK(31, 16)\n+\n+/* ---------- DVN ---------- */\n+/* DVN dvn_queue_table */\n+#define NBL_DVN_ECPU_QUEUE_NUM\t\t\t(NBL_DP_DVN_BASE + 0x0000041C)\n+#define NBL_DVN_DESCREQ_NUM_CFG\t\t\t(NBL_DP_DVN_BASE + 0x00000430)\n+#define NBL_DVN_DESC_WR_MERGE_TIMEOUT\t\t(NBL_DP_DVN_BASE + 0x00000480)\n+#define NBL_DVN_DIF_REQ_RD_RO_FLAG\t\t(NBL_DP_DVN_BASE + 0x0000045C)\n+\n+#define DEFAULT_DVN_DESCREQ_NUMCFG\t\t0x03\n+#define DEFAULT_DVN_100G_DESCREQ_NUMCFG\t\t0x07\n+\n+#define DEFAULT_DVN_DESC_WR_MERGE_TIMEOUT_MAX\t0x3FF\n+\n+/* spilit ring descreq_num 0:8,1:16 */\n+#define NBL_DVN_DESCREQ_NUM_CFG_AVRING_DESREQ_NUM_CFG_MASK BIT(0)\n+/* packet ring descreq_num\n+ * 0:8,1:12,2:16;3:20,4:24,5:26;6:32,7:32\n+ */\n+#define NBL_DVN_DESCREQ_NUM_CFG_PACKED_L1_NUM_MASK GENMASK(6, 4)\n+\n+#define NBL_DVN_DESC_WR_MERGE_TIMEOUT_CFG_CYCLE_MASK GENMASK(9, 0)\n+\n+#define NBL_DVN_DIF_REQ_RD_RO_FLAG_DESC_RO_EN_MASK BIT(0)\n+#define NBL_DVN_DIF_REQ_RD_RO_FLAG_DATA_RO_EN_MASK BIT(1)\n+#define NBL_DVN_DIF_REQ_RD_RO_FLAG_AVRING_RO_EN_MASK BIT(2)\n+\n+/* ---------- UVN ---------- */\n+/* UVN uvn_queue_table */\n+\n+#define NBL_UVN_DESC_RD_WAIT\t\t\t(NBL_DP_UVN_BASE + 0x0000020C)\n+#define NBL_UVN_QUEUE_ERR_MASK\t\t\t(NBL_DP_UVN_BASE + 0x00000224)\n+#define NBL_UVN_ECPU_QUEUE_NUM\t\t\t(NBL_DP_UVN_BASE + 0x0000023C)\n+#define NBL_UVN_DESC_WR_TIMEOUT\t\t\t(NBL_DP_UVN_BASE + 0x00000214)\n+#define NBL_UVN_DIF_REQ_RO_FLAG\t\t\t(NBL_DP_UVN_BASE + 0x00000250)\n+#define NBL_UVN_DESC_PREFETCH_INIT\t\t(NBL_DP_UVN_BASE + 0x00000204)\n+#define NBL_UVN_DESC_PREFETCH_NUM\t\t4\n+\n+#define NBL_UVN_DIF_REQ_RO_FLAG_AVAIL_RD_MASK BIT(0)\n+#define NBL_UVN_DIF_REQ_RO_FLAG_DESC_RD_MASK BIT(1)\n+#define NBL_UVN_DIF_REQ_RO_FLAG_PKT_WR_MASK BIT(2)\n+#define NBL_UVN_DIF_REQ_RO_FLAG_DESC_WR_MASK BIT(3)\n+\n+#define NBL_UVN_DESC_WR_TIMEOUT_NUM_MASK GENMASK(14, 0)\n+\n+#define NBL_UVN_QUEUE_ERR_MASK_DIF_ERR_MASK BIT(5)\n+\n+#define NBL_UVN_DESC_PREFETCH_INIT_NUM_MASK GENMASK(7, 0)\n+#define NBL_UVN_DESC_PREFETCH_INIT_SEL_MASK BIT(16)\n+\n+#define NBL_UVN_DESC_WR_TIMEOUT_VAL 0x12c\n+/* 200us = 200000ns / 1.67ns per tick = 119760 ticks */\n+#define NBL_UVN_DESC_RD_WAIT_TICKS 119760\n+\n+/* -------- USTORE -------- */\n+#define NBL_USTORE_PKT_LEN_ADDR (NBL_DP_USTORE_BASE + 0x00000108)\n+#define NBL_USTORE_PORT_DROP_TH_REG_ARR(port_id) \\\n+\t(NBL_DP_USTORE_BASE + 0x00000150 + (port_id) * sizeof(u32))\n+#define NBL_USTORE_BUF_PORT_DROP_PKT(eth_id) \\\n+\t(NBL_DP_USTORE_BASE + 0x00002500 + (eth_id) * sizeof(u32))\n+#define NBL_USTORE_BUF_PORT_TRUN_PKT(eth_id) \\\n+\t(NBL_DP_USTORE_BASE + 0x00002540 + (eth_id) * sizeof(u32))\n+\n+#define NBL_USTORE_SINGLE_ETH_DROP_TH\t\t0xC80\n+#define NBL_USTORE_DUAL_ETH_DROP_TH\t\t0x640\n+#define NBL_USTORE_QUAD_ETH_DROP_TH\t\t0x320\n+\n+/* USTORE pkt_len */\n+#define NBL_USTORE_PKT_LEN_MIN_MASK GENMASK(6, 0)\n+\n+/* USTORE port_drop_th */\n+#define NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK GENMASK(11, 0)\n+#define NBL_USTORE_PORT_DROP_TH_EN_MASK BIT(31)\n+\n+/* UQM*/\n+#define NBL_UQM_QUE_TYPE\t\t\t(NBL_DP_UQM_BASE + 0x0000013c)\n+#define NBL_UQM_DROP_PKT_CNT\t\t\t(NBL_DP_UQM_BASE + 0x000009C0)\n+#define NBL_UQM_DROP_PKT_SLICE_CNT\t\t(NBL_DP_UQM_BASE + 0x000009C4)\n+#define NBL_UQM_DROP_PKT_LEN_ADD_CNT\t\t(NBL_DP_UQM_BASE + 0x000009C8)\n+#define NBL_UQM_DROP_HEAD_PNTR_ADD_CNT\t\t(NBL_DP_UQM_BASE + 0x000009CC)\n+#define NBL_UQM_DROP_WEIGHT_ADD_CNT\t\t(NBL_DP_UQM_BASE + 0x000009D0)\n+#define NBL_UQM_PORT_DROP_PKT_CNT\t\t(NBL_DP_UQM_BASE + 0x000009D4)\n+#define NBL_UQM_PORT_DROP_PKT_SLICE_CNT\t\t(NBL_DP_UQM_BASE + 0x000009F4)\n+#define NBL_UQM_PORT_DROP_PKT_LEN_ADD_CNT\t(NBL_DP_UQM_BASE + 0x00000A14)\n+#define NBL_UQM_PORT_DROP_HEAD_PNTR_ADD_CNT\t(NBL_DP_UQM_BASE + 0x00000A34)\n+#define NBL_UQM_PORT_DROP_WEIGHT_ADD_CNT\t(NBL_DP_UQM_BASE + 0x00000A54)\n+#define NBL_UQM_FWD_DROP_CNT\t\t\t(NBL_DP_UQM_BASE + 0x00000A80)\n+#define NBL_UQM_DPORT_DROP_CNT\t\t\t(NBL_DP_UQM_BASE + 0x00000B74)\n+\n+#define NBL_UQM_PORT_DROP_DEPTH\t\t\t6\n+#define NBL_UQM_DPORT_DROP_DEPTH\t\t16\n+\n+/* --------- SHAPING --------- */\n+\n+/* Shaping rate unit: 1 = 1 Mbit/s.\n+ * e.g. 100000 = 100 Gbit/s, 25000 = 25 Gbit/s.\n+ */\n+#define NBL_LR_LEONIS_NET_BUCKET_DEPTH\t\t9600\n+#define NBL_SHAPING_DPORT_ADDR (NBL_DP_SHAPING_BASE + 0x700)\n+#define NBL_SHAPING_DPORT_DWLEN 4\n+#define NBL_SHAPING_DPORT_REG(r) \\\n+\t(NBL_SHAPING_DPORT_ADDR + (NBL_SHAPING_DPORT_DWLEN * 4) * (r))\n+#define NBL_SHAPING_DVN_DPORT_ADDR (NBL_DP_SHAPING_BASE + 0x750)\n+#define NBL_SHAPING_DVN_DPORT_DWLEN 4\n+#define NBL_SHAPING_DVN_DPORT_REG(r) \\\n+\t(NBL_SHAPING_DVN_DPORT_ADDR + (NBL_SHAPING_DVN_DPORT_DWLEN * 4) * (r))\n+#define NBL_DSCH_PSHA_EN_ADDR (NBL_DP_DSCH_BASE + 0x00000314)\n+#define NBL_SHAPING_NET_ADDR (NBL_DP_SHAPING_BASE + 0x1800)\n+#define NBL_SHAPING_NET_DWLEN 4\n+#define NBL_SHAPING_NET_REG(r) \\\n+\t(NBL_SHAPING_NET_ADDR + (NBL_SHAPING_NET_DWLEN * 4) * (r))\n+\n+#define NBL_DPORT_VALID_MASK\t\tGENMASK_ULL(0, 0)\n+#define NBL_DPORT_DEPTH_MASK\t\tGENMASK_ULL(19, 1)\n+#define NBL_DPORT_CIR_MASK\t\tGENMASK_ULL(38, 20)\n+#define NBL_DPORT_PIR_MASK\t\tGENMASK_ULL(57, 39)\n+#define NBL_DPORT_CBS_MASK_LOW\t\tGENMASK_ULL(63, 58)\n+#define NBL_DPORT_CBS_MASK_HIGH\t\tGENMASK_ULL(14, 0)\n+#define NBL_DPORT_PBS_MASK\t\tGENMASK_ULL(35, 15)\n+\n+/* SHAPING shaping_net */\n+struct nbl_shaping_net_u {\n+\tu32 data[NBL_SHAPING_NET_DWLEN];\n+};\n+\n+struct nbl_shaping_dport_u {\n+\tu32 data[NBL_SHAPING_DPORT_DWLEN];\n+};\n+\n+struct nbl_shaping_dvn_dport_u {\n+\tu32 data[NBL_SHAPING_DVN_DPORT_DWLEN];\n+};\n+\n+/* -------- DSTORE -------- */\n+#define NBL_DSTORE_D_DPORT_FC_TH_ADDR (NBL_DP_DSTORE_BASE + 0x00000600)\n+#define NBL_DSTORE_D_DPORT_FC_TH_DEPTH 5\n+#define NBL_DSTORE_D_DPORT_FC_TH_WIDTH 32\n+#define NBL_DSTORE_D_DPORT_FC_TH_DWLEN 1\n+\n+#define NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK GENMASK(10, 0)\n+#define NBL_DSTORE_D_DPORT_FC_XON_TH_MASK GENMASK(26, 16)\n+#define NBL_DSTORE_D_DPORT_FC_FC_EN_MASK BIT(31)\n+\n+#define NBL_DSTORE_D_DPORT_FC_TH_REG(r) \\\n+\t(NBL_DSTORE_D_DPORT_FC_TH_ADDR + \\\n+\t (NBL_DSTORE_D_DPORT_FC_TH_DWLEN * 4) * (r))\n+#define NBL_DSTORE_PORT_DROP_TH_ADDR (NBL_DP_DSTORE_BASE + 0x00000150)\n+#define NBL_DSTORE_PORT_DROP_TH_DEPTH 6\n+#define NBL_DSTORE_PORT_DROP_TH_WIDTH 32\n+#define NBL_DSTORE_PORT_DROP_TH_DWLEN 1\n+\n+#define NBL_DSTORE_PORT_DROP_EN_MASK BIT(31)\n+\n+#define NBL_DSTORE_DROP_XOFF_TH\t\t\t0xC8\n+#define NBL_DSTORE_DROP_XON_TH\t\t\t0x64\n+\n+#define NBL_DSTORE_DROP_XOFF_TH_100G\t\t0x1F4\n+#define NBL_DSTORE_DROP_XON_TH_100G\t\t0x12C\n+\n+#define NBL_DSTORE_DISC_BP_TH (NBL_DP_DSTORE_BASE + 0x00000630)\n+\n+#define NBL_DSTORE_DISC_BP_TH_EN_MASK BIT(31)\n+\n+#define NBL_DSTORE_PORT_DROP_TH_REG(r) \\\n+\t(NBL_DSTORE_PORT_DROP_TH_ADDR + \\\n+\t (NBL_DSTORE_PORT_DROP_TH_DWLEN * 4) * (r))\n+\n+#define NBL_FW_BOARD_CONFIG\t\t\t0x200\n+#define NBL_FW_BOARD_DW3_OFFSET\t\t\t(NBL_FW_BOARD_CONFIG + 12)\n+#define NBL_FW_BOARD_DW6_OFFSET\t\t\t(NBL_FW_BOARD_CONFIG + 24)\n+\n+#define NBL_FW_BOARD_DW3_PORT_TYPE_MASK BIT(0)\n+#define NBL_FW_BOARD_DW3_PORT_NUM_MASK GENMASK(7, 1)\n+#define NBL_FW_BOARD_DW3_PORT_SPEED_MASK GENMASK(9, 8)\n+#define NBL_FW_BOARD_DW3_GPIO_TYPE_MASK GENMASK(12, 10)\n+#define NBL_FW_BOARD_DW3_P4_VERSION_MASK GENMASK(13, 13)\n+\n+#define NBL_FW_BOARD_DW6_LANE_BITMAP_MASK GENMASK(7, 0)\n+#define NBL_FW_BOARD_DW6_ETH_BITMAP_MASK GENMASK(15, 8)\n+\n+#define NBL_LEONIS_QUIRKS_OFFSET\t0x00000140\n+#define NBL_BAR2_MAX_LEN\t\t0x300\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.c\nnew file mode 100644\nindex 0000000000000..c6f8afc3a7235\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.c\n@@ -0,0 +1,365 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \u003clinux/bits.h\u003e\n+#include \"nbl_resource_leonis.h\"\n+\n+static struct nbl_resource_ops res_ops = {\n+\t.get_vsi_id = nbl_res_func_id_to_vsi_id,\n+\t.get_eth_id = nbl_res_get_eth_id,\n+\t.cfg_msix_map = nbl_res_intr_cfg_msix_map,\n+\t.destroy_msix_map = nbl_res_intr_destroy_msix_map,\n+\t.set_mailbox_irq = nbl_res_intr_set_mailbox_irq,\n+\t.init_module = nbl_res_chip_init_module,\n+\t.deinit_module = nbl_res_chip_deinit_module,\n+};\n+\n+static struct nbl_resource_mgt *\n+nbl_res_setup_res_mgt(struct nbl_common_info *common)\n+{\n+\tstruct nbl_resource_info *resource_info;\n+\tstruct nbl_resource_mgt *res_mgt;\n+\tstruct device *dev = common-\u003edev;\n+\n+\tres_mgt = devm_kzalloc(dev, sizeof(*res_mgt), GFP_KERNEL);\n+\tif (!res_mgt)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\tres_mgt-\u003ecommon = common;\n+\n+\tresource_info =\n+\t\tdevm_kzalloc(dev, sizeof(*resource_info), GFP_KERNEL);\n+\tif (!resource_info)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\tres_mgt-\u003eresource_info = resource_info;\n+\n+\treturn res_mgt;\n+}\n+\n+static struct nbl_resource_ops_tbl *\n+nbl_res_setup_ops(struct device *dev, struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_resource_ops_tbl *res_ops_tbl;\n+\n+\tres_ops_tbl = devm_kzalloc(dev, sizeof(*res_ops_tbl), GFP_KERNEL);\n+\tif (!res_ops_tbl)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\tif (!res_ops.get_vsi_id || !res_ops.get_eth_id ||\n+\t !res_ops.cfg_msix_map || !res_ops.destroy_msix_map ||\n+\t !res_ops.set_mailbox_irq || !res_ops.init_module ||\n+\t !res_ops.deinit_module)\n+\t\treturn ERR_PTR(-EINVAL);\n+\tres_ops_tbl-\u003eops = \u0026res_ops;\n+\tres_ops_tbl-\u003epriv = res_mgt;\n+\n+\treturn res_ops_tbl;\n+}\n+\n+static int nbl_res_ctrl_dev_setup_eth_info(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct device *dev = res_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_eth_info *eth_info;\n+\tu32 eth_bitmap = 0, eth_id;\n+\tu32 eth_num = 0;\n+\tu32 fw_port_num;\n+\tint i;\n+\n+\teth_info = devm_kzalloc(dev, sizeof(*eth_info), GFP_KERNEL);\n+\tif (!eth_info)\n+\t\treturn -ENOMEM;\n+\n+\tres_mgt-\u003eresource_info-\u003eeth_info = eth_info;\n+\n+\tfw_port_num = res_mgt-\u003eresource_info-\u003eboard_info.eth_num;\n+\n+\thw_ops-\u003eget_fw_eth_map(res_mgt-\u003ehw_ops_tbl-\u003epriv, \u0026eth_bitmap);\n+\tif (eth_bitmap \u0026 ~((1 \u003c\u003c NBL_MAX_ETHERNET) - 1)) {\n+\t\tdev_err(dev, \"FW reported invalid eth_bitmap 0x%x\\n\",\n+\t\t\teth_bitmap);\n+\t\treturn -EINVAL;\n+\t}\n+\tif (fw_port_num != hweight32(eth_bitmap)) {\n+\t\tdev_err(dev, \"FW inconsistency: port_num=%u, bitmap=0x%x\\n\",\n+\t\t\tfw_port_num, eth_bitmap);\n+\t\treturn -EINVAL;\n+\t}\n+\t/*\n+\t * Firmware is ready before probe. Valid port counts are 1/2/4;\n+\t * 0 (invalid config), 3 (unsupported topology), and \u003e4 (exceeds\n+\t * hardware max) are all rejected with -EINVAL.\n+\t */\n+\tif (fw_port_num == 0 || fw_port_num == 3 ||\n+\t fw_port_num \u003e NBL_MAX_ETHERNET) {\n+\t\tdev_err(dev, \"FW reports %u Ethernet ports, unsupported (valid: 1/2/4)\\n\",\n+\t\t\tfw_port_num);\n+\t\treturn -EINVAL;\n+\t}\n+\teth_info-\u003eeth_num = fw_port_num;\n+\t/* Intentional design constraint: each PF maps to exactly one\n+\t * Ethernet port. This couples PF identity to port identity\n+\t * and is required by nbl_res_get_eth_id() which indexes\n+\t * eth_info-\u003eeth_id[] by relative PF id.\n+\t */\n+\tif (res_mgt-\u003ecommon-\u003emax_pf != eth_info-\u003eeth_num) {\n+\t\tdev_err(dev, \"Invalid PF-to-port topology: max_pf=%u, eth_num=%u\\n\",\n+\t\t\tres_mgt-\u003ecommon-\u003emax_pf, eth_info-\u003eeth_num);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\t/*\n+\t * Any subset of valid bitmap bits is accepted (e.g. 0/1, 0/2,\n+\t * 1/3, etc.). Firmware only needs to report the correct count\n+\t * of active ports; no hard-coded fixed bit positions required.\n+\t */\n+\tfor (i = 0; i \u003c NBL_MAX_ETHERNET; i++) {\n+\t\tif ((1 \u003c\u003c i) \u0026 eth_bitmap) {\n+\t\t\tset_bit(i, eth_info-\u003eeth_bitmap);\n+\t\t\teth_info-\u003eeth_id[eth_num] = i;\n+\t\t\teth_info-\u003elogic_eth_id[i] = eth_num;\n+\t\t\teth_num++;\n+\t\t}\n+\t}\n+\n+\tfor (i = 0; i \u003c res_mgt-\u003ecommon-\u003emax_pf; i++) {\n+\t\teth_id = eth_info-\u003eeth_id[i];\n+\t\teth_info-\u003epf_bitmap[eth_id] |= BIT(i);\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int nbl_res_ctrl_dev_sriov_info_init(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_hw_mgt *p = res_mgt-\u003ehw_ops_tbl-\u003epriv;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct nbl_sriov_info *sriov_info;\n+\tstruct device *dev = common-\u003edev;\n+\tu8 hw_bus = 0;\n+\tu16 function;\n+\tu16 func_id;\n+\n+\thw_ops-\u003eget_real_bus(p, \u0026hw_bus);\n+\tif (common-\u003efunction + common-\u003emax_pf \u003e NBL_MAX_PF) {\n+\t\tdev_err(dev, \"PF count exceeds available function space\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\tsriov_info = devm_kcalloc(dev, common-\u003emax_pf,\n+\t\t\t\t sizeof(*sriov_info), GFP_KERNEL);\n+\tif (!sriov_info)\n+\t\treturn -ENOMEM;\n+\n+\tres_mgt-\u003eresource_info-\u003esriov_info = sriov_info;\n+\t/*\n+\t * common-\u003ehw_bus supplies bus number for channel mailbox QINFO mapping.\n+\t * Execution order guarantee: this assignment runs before\n+\t * cfg_chan_qinfo_map_table(), only executed\n+\t * on control PF path.\n+\t */\n+\tcommon-\u003ehw_bus = hw_bus;\n+\n+\tfor (func_id = 0; func_id \u003c common-\u003emax_pf; func_id++) {\n+\t\tsriov_info = res_mgt-\u003eresource_info-\u003esriov_info + func_id;\n+\t\tfunction = common-\u003efunction + func_id;\n+\t\tsriov_info-\u003ebdf = PCI_DEVID(common-\u003ehw_bus,\n+\t\t\t\t\t PCI_DEVFN(common-\u003edevid, function));\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int nbl_res_ctrl_dev_vsi_info_init(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_eth_info *eth_info = res_mgt-\u003eresource_info-\u003eeth_info;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct device *dev = common-\u003edev;\n+\tstruct nbl_vsi_info *vsi_info;\n+\tint i;\n+\n+\tvsi_info = devm_kzalloc(dev, sizeof(*vsi_info), GFP_KERNEL);\n+\tif (!vsi_info)\n+\t\treturn -ENOMEM;\n+\n+\tres_mgt-\u003eresource_info-\u003evsi_info = vsi_info;\n+\t/*\n+\t * case 1 one port(1pf)\n+\t * pf0 (NBL_VSI_SERV_PF_DATA_TYPE) vsi is 0\n+\t * case 2 two port(2pf)\n+\t * pf0,pf1(NBL_VSI_SERV_PF_DATA_TYPE) vsi is 0,512\n+\t * case 3 four port(4pf)\n+\t * pf0,pf1,pf2,pf3(NBL_VSI_SERV_PF_DATA_TYPE) vsi is 0,256,512,768\n+\t */\n+\n+\tvsi_info-\u003enum = eth_info-\u003eeth_num;\n+\t/*\n+\t * eth_num can be 1/2/4:\n+\t * - 2/4 ports use dedicated gap constants;\n+\t * - 1 port falls back to NBL_DEFAULT_VSI_ID_GAP (1024).\n+\t * All three values produce valid base_id offsets.\n+\t */\n+\tfor (i = 0; i \u003c vsi_info-\u003enum; i++) {\n+\t\tvsi_info-\u003eserv_info[i][NBL_VSI_SERV_PF_DATA_TYPE].base_id =\n+\t\t\ti * nbl_vsi_id_gap(vsi_info-\u003enum);\n+\t\tvsi_info-\u003eserv_info[i][NBL_VSI_SERV_PF_DATA_TYPE].num = 1;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int nbl_res_init_pf_num(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tu32 exp_contiguous_mask = 0;\n+\tu32 pf_mask = 0;\n+\tu32 pf_num = 0;\n+\tint i;\n+\n+\thw_ops-\u003eget_host_pf_mask(res_mgt-\u003ehw_ops_tbl-\u003epriv, \u0026pf_mask);\n+\n+\t/*\n+\t * k_pf_mask register rule:\n+\t * bit N == 0 -\u003e PF#N enabled; bit N == 1 -\u003e PF#N masked out.\n+\t * Hardware constraint: bit0 is PF0's mask bit; driver requires\n+\t * PF0 enabled as management PF, so bit0 must be clear.\n+\t * All-zero pf_mask means all PF0~PF7 are enabled, which is unsupported\n+\t * by the driver\n+\t *\n+\t * Product firmware constraint: only 3 valid configurations supported:\n+\t * 1 PF (PF0 only): pf_num = 1, mask = 0xfe\n+\t * 2 PFs (PF0,PF1): pf_num = 2, mask = 0xfc\n+\t * 4 PFs (PF0~PF3): pf_num = 4, mask = 0xf0\n+\t * No other PF count or sparse/non-contiguous PF layout is allowed.\n+\t */\n+\tfor (i = 0; i \u003c NBL_MAX_PF; i++) {\n+\t\tif (!(pf_mask \u0026 (1 \u003c\u003c i)))\n+\t\t\tpf_num++;\n+\t}\n+\n+\t/*\n+\t * Sanity check: enabled PFs must be contiguous starting from PF0.\n+\t * Current resource framework uses relative PF id, sparse PF layout\n+\t * will cause mismatch between resource layer and hardware func_id.\n+\t */\n+\tfor (i = 0; i \u003c pf_num; i++)\n+\t\texp_contiguous_mask |= BIT(i);\n+\tif ((pf_mask \u0026 exp_contiguous_mask) != 0) {\n+\t\tdev_err(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"pf_mask 0x%08x: non-contiguous enabled PF, unsupported\\n\",\n+\t\t\tpf_mask);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\t/* Only allow product-specified PF count: 1 / 2 / 4 */\n+\tif (pf_num != 1 \u0026\u0026 pf_num != 2 \u0026\u0026 pf_num != 4) {\n+\t\tdev_err(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\"Invalid pf_num=%u (mask=0x%08x), only 1/2/4 PFs supported\\n\",\n+\t\t\tpf_num, pf_mask);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tres_mgt-\u003ecommon-\u003emax_pf = pf_num;\n+\n+\treturn 0;\n+}\n+\n+static void nbl_res_init_board_info(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\n+\thw_ops-\u003eget_board_info(res_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t \u0026res_mgt-\u003eresource_info-\u003eboard_info);\n+}\n+\n+static int nbl_res_start(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tint ret = 0;\n+\n+\tif (common-\u003ehas_ctrl) {\n+\t\tnbl_res_init_board_info(res_mgt);\n+\n+\t\tret = nbl_res_init_pf_num(res_mgt);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = nbl_res_ctrl_dev_sriov_info_init(res_mgt);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = nbl_res_ctrl_dev_setup_eth_info(res_mgt);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = nbl_res_ctrl_dev_vsi_info_init(res_mgt);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = nbl_intr_mgt_start(res_mgt);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+int nbl_res_init_leonis(struct nbl_adapter *adap)\n+{\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl = adap-\u003eintf.channel_ops_tbl;\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl = adap-\u003eintf.hw_ops_tbl;\n+\tstruct nbl_common_info *common = \u0026adap-\u003ecommon;\n+\tstruct nbl_resource_ops_tbl *res_ops_tbl;\n+\tstruct device *dev = \u0026adap-\u003epdev-\u003edev;\n+\tstruct nbl_resource_mgt *res_mgt;\n+\tint ret;\n+\n+\tres_mgt = nbl_res_setup_res_mgt(common);\n+\tif (IS_ERR(res_mgt)) {\n+\t\tret = PTR_ERR(res_mgt);\n+\t\treturn ret;\n+\t}\n+\tres_mgt-\u003echan_ops_tbl = chan_ops_tbl;\n+\tres_mgt-\u003ehw_ops_tbl = hw_ops_tbl;\n+\n+\tret = nbl_res_start(res_mgt);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tres_ops_tbl = nbl_res_setup_ops(dev, res_mgt);\n+\tif (IS_ERR(res_ops_tbl)) {\n+\t\tret = PTR_ERR(res_ops_tbl);\n+\t\treturn ret;\n+\t}\n+\tadap-\u003eintf.resource_ops_tbl = res_ops_tbl;\n+\tadap-\u003ecore.res_mgt = res_mgt;\n+\n+\treturn 0;\n+}\n+\n+void nbl_res_remove_leonis(struct nbl_adapter *adap)\n+{\n+\tstruct nbl_resource_mgt *res_mgt = adap-\u003ecore.res_mgt;\n+\tstruct nbl_common_info *common = \u0026adap-\u003ecommon;\n+\n+\tif (!res_mgt)\n+\t\treturn;\n+\n+\t/*\n+\t * Tear down all MSI-X maps before devres releases the coherent\n+\t * tables.\tThis is critical on the control PF, which may hold\n+\t * maps for remote PFs that are still bound.\n+\t */\n+\tif (common-\u003ehas_ctrl \u0026\u0026 res_mgt-\u003eintr_mgt)\n+\t\tnbl_intr_mgt_stop(res_mgt);\n+\n+\t/* Note:\n+\t * per-function interrupts arrays (kcalloc) are freed by\n+\t * nbl_intr_mgt_stop().\n+\t * MSIX coherent tables are explicitly freed by dmam_free_coherent()\n+\t * inside the intr destroy path, before nbl_intr_mgt_stop() returns.\n+\t * intr_mgt itself (devm_kzalloc) is released by devres after this\n+\t * function returns\n+\t */\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.h\nnew file mode 100644\nindex 0000000000000..f1cb0f23240b0\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.h\n@@ -0,0 +1,12 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_RESOURCE_LEONIS_H_\n+#define _NBL_RESOURCE_LEONIS_H_\n+\n+#include \"../nbl_resource.h\"\n+#include \"../nbl_interrupt.h\"\n+#include \"../nbl_chip.h\"\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_reg.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_reg.h\nnew file mode 100644\nindex 0000000000000..795f29bfb47a9\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_reg.h\n@@ -0,0 +1,75 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_HW_REG_H_\n+#define _NBL_HW_REG_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+#include \"../nbl_include/nbl_def_channel.h\"\n+#include \"../nbl_include/nbl_def_hw.h\"\n+#include \"../nbl_include/nbl_def_common.h\"\n+#include \"../nbl_core.h\"\n+\n+#define NBL_MEMORY_BAR\t\t\t\t0\n+#define NBL_MAILBOX_BAR\t\t\t\t2\n+#define NBL_RDMA_NOTIFY_LEN\t\t\t(8ULL \u003c\u003c 10)\n+#define NBL_REG_NET_ONLY_LEN\t\t\t(8ULL \u003c\u003c 10)\n+#define NBL_HW_DUMMY_REG\t\t\t0x1300904\n+/*\n+ * PCI MEMORY BAR total size: 64MiB.\n+ */\n+#define NBL_MEM_BAR_TOTAL_SIZE\t\t\t(64ULL \u003c\u003c 20)\n+\n+struct nbl_hw_mgt {\n+\tstruct nbl_common_info *common;\n+\tu8 __iomem *hw_addr;\n+\tu8 __iomem *mailbox_bar_hw_addr;\n+\tresource_size_t mailbox_bar_size;\n+\tspinlock_t reg_lock; /* Protect reg access */\n+};\n+\n+static inline u32 rd32(u8 __iomem *addr, u64 reg)\n+{\n+\treturn readl(addr + reg);\n+}\n+\n+static inline void wr32(u8 __iomem *addr, u64 reg, u32 value)\n+{\n+\twritel(value, addr + reg);\n+}\n+\n+static inline void nbl_hw_wr32(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 value)\n+{\n+\twr32(hw_mgt-\u003ehw_addr, reg, value);\n+}\n+\n+static inline u32 nbl_hw_rd32(struct nbl_hw_mgt *hw_mgt, u64 reg)\n+{\n+\treturn rd32(hw_mgt-\u003ehw_addr, reg);\n+}\n+\n+static inline void nbl_mbx_wr32(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 value)\n+{\n+\twritel(value, hw_mgt-\u003emailbox_bar_hw_addr + reg);\n+}\n+\n+/*\n+ * Only call this when has_ctrl=true, which maps enough space\n+ * (bar_len - 8192) to cover NBL_HW_DUMMY_REG (0x1300904).\n+ * The flow/design guarantees this is only called in the\n+ * has_ctrl path.\n+ */\n+static inline void nbl_flush_writes(struct nbl_hw_mgt *hw_mgt)\n+{\n+\tnbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);\n+}\n+\n+static inline u32 nbl_mbx_rd32(struct nbl_hw_mgt *hw_mgt, u64 reg)\n+{\n+\treturn readl(hw_mgt-\u003emailbox_bar_hw_addr + reg);\n+}\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.c\nnew file mode 100644\nindex 0000000000000..6ad65f6e1c615\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.c\n@@ -0,0 +1,591 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/delay.h\u003e\n+#include \u003clinux/dma-mapping.h\u003e\n+#include \u003clinux/bitfield.h\u003e\n+#include \"nbl_interrupt.h\"\n+\n+#define NBL_MSIX_DMA_SYNC_MIN_US\t1000 /* us */\n+#define NBL_MSIX_DMA_SYNC_MAX_US\t1200 /* us */\n+\n+/*\n+ * Release global vector IDs back to intr_net_bmap / intr_other_bmap.\n+ * Caller must hold intr_mgt-\u003elock.\n+ */\n+static void nbl_intr_release_bitmap(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t u16 *vec_buf, u16 cnt)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tu16 bit;\n+\tu16 i;\n+\n+\tlockdep_assert_held(\u0026intr_mgt-\u003elock);\n+\n+\tif (!vec_buf || cnt == 0)\n+\t\treturn;\n+\n+\tfor (i = 0; i \u003c cnt; i++) {\n+\t\tu16 intr_index = vec_buf[i];\n+\n+\t\tif (intr_index \u003e= NBL_NET_INTR_BASE) {\n+\t\t\tbit = intr_index - NBL_NET_INTR_BASE;\n+\t\t\tif (bit \u003c NBL_MAX_NET_INTERRUPT)\n+\t\t\t\tclear_bit(bit, intr_mgt-\u003eintr_net_bmap);\n+\t\t\telse\n+\t\t\t\tdev_warn(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\t\t \"invalid net intr index %u\\n\",\n+\t\t\t\t\t intr_index);\n+\t\t} else {\n+\t\t\tif (intr_index \u003c NBL_MAX_OTHER_INTERRUPT)\n+\t\t\t\tclear_bit(intr_index,\n+\t\t\t\t\t intr_mgt-\u003eintr_other_bmap);\n+\t\t\telse\n+\t\t\t\tdev_warn(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\t\t \"invalid other intr index %u\\n\",\n+\t\t\t\t\t intr_index);\n+\t\t}\n+\t}\n+}\n+\n+/*\n+ * Internal (unlocked) mailbox IRQ bind. Caller must hold\n+ * intr_mgt-\u003elock. The disable path does not require a configured\n+ * MSI-X map because the hardware op ignores gvec when\n+ * en_msix=false.\n+ */\n+static int __nbl_res_intr_set_mailbox_irq(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t\t u16 func_id, u16 vector_id,\n+\t\t\t\t\t bool en_msix)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct device *dev = common-\u003edev;\n+\tu16 gvec;\n+\n+\tlockdep_assert_held(\u0026intr_mgt-\u003elock);\n+\n+\tif (func_id \u003e= NBL_MAX_FUNC) {\n+\t\tdev_err(dev, \"func_id %u out of range\\n\", func_id);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (!en_msix) {\n+\t\thw_ops-\u003eset_mailbox_irq(res_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t\tfunc_id, false, 0);\n+\t\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\t\treturn 0;\n+\t}\n+\n+\tif (!intr_mgt-\u003efunc_intr_res[func_id].interrupts) {\n+\t\tdev_err(dev, \"func %u MSIX map not configured\\n\", func_id);\n+\t\treturn -ENODEV;\n+\t}\n+\n+\tif (vector_id \u003e= intr_mgt-\u003efunc_intr_res[func_id].num_interrupts) {\n+\t\tdev_err(dev, \"vector_id %u out of range (max %u)\\n\",\n+\t\t\tvector_id,\n+\t\t\tintr_mgt-\u003efunc_intr_res[func_id].num_interrupts - 1);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tgvec = intr_mgt-\u003efunc_intr_res[func_id].interrupts[vector_id];\n+\thw_ops-\u003eset_mailbox_irq(res_mgt-\u003ehw_ops_tbl-\u003epriv, func_id,\n+\t\t\t\ten_msix, gvec);\n+\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * Internal (unlocked) MSI-X map teardown prepare phase: only hardware register\n+ * operations. Caller must hold intr_mgt-\u003elock.\n+ */\n+static int\n+__nbl_res_intr_prepare_destroy_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t\tu16 func)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tu16 *interrupts;\n+\tu16 intr_num, i;\n+\tint ret;\n+\n+\tlockdep_assert_held(\u0026intr_mgt-\u003elock);\n+\n+\tif (func \u003e= NBL_MAX_FUNC) {\n+\t\tdev_err(res_mgt-\u003ecommon-\u003edev, \"Invalid func_id %u\\n\", func);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tinterrupts = intr_mgt-\u003efunc_intr_res[func].interrupts;\n+\tif (!interrupts)\n+\t\treturn 0;\n+\n+\tintr_num = intr_mgt-\u003efunc_intr_res[func].num_interrupts;\n+\n+\t/* Step 0: disable mailbox IRQ routing before tearing down map */\n+\tret = __nbl_res_intr_set_mailbox_irq(res_mgt, func, 0, false);\n+\tif (ret) {\n+\t\tdev_err(res_mgt-\u003ecommon-\u003edev, \"disable mailbox irq failed, func=%u ret=%d\\n\",\n+\t\t\tfunc, ret);\n+\t\treturn ret;\n+\t}\n+\n+\t/* Step 1: invalidate each MSIX info entry in hardware first */\n+\tfor (i = 0; i \u003c intr_num; i++) {\n+\t\thw_ops-\u003ecfg_msix_info(res_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t func, false, interrupts[i],\n+\t\t\t\t 0, 0, 0, false);\n+\t}\n+\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\n+\t/* Stage1 tear down: retain DMA address, only clear VALID bit */\n+\thw_ops-\u003ecfg_msix_map(res_mgt-\u003ehw_ops_tbl-\u003epriv, func,\n+\t\t\t false,\n+\t\t\t intr_mgt-\u003efunc_intr_res[func].msix_map_table.dma,\n+\t\t\t 0, 0, 0);\n+\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\n+\t/* Stage2: zero MSIX map entry */\n+\thw_ops-\u003ecfg_msix_map(res_mgt-\u003ehw_ops_tbl-\u003epriv, func,\n+\t\t\t false, 0, 0, 0, 0);\n+\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * __nbl_res_intr_complete_destroy_msix_map - release vector bitmap, DMA memory\n+ * and interrupt buffer after global hardware quiesce. No hardware register ops.\n+ *\n+ * Caller must hold intr_mgt-\u003elock.\n+ */\n+static int\n+__nbl_res_intr_complete_destroy_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t\t u16 func_id)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tstruct device *dev = res_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_msix_map_table *msix_map_table;\n+\tu16 *interrupts;\n+\tu16 intr_num;\n+\n+\tlockdep_assert_held(\u0026intr_mgt-\u003elock);\n+\n+\tif (func_id \u003e= NBL_MAX_FUNC) {\n+\t\tdev_err(dev, \"Invalid func_id %u\\n\", func_id);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tinterrupts = intr_mgt-\u003efunc_intr_res[func_id].interrupts;\n+\tif (!interrupts)\n+\t\treturn 0;\n+\n+\tintr_num = intr_mgt-\u003efunc_intr_res[func_id].num_interrupts;\n+\tmsix_map_table = \u0026intr_mgt-\u003efunc_intr_res[func_id].msix_map_table;\n+\n+\tnbl_intr_release_bitmap(res_mgt, interrupts, intr_num);\n+\n+\tif (msix_map_table-\u003ebase_addr) {\n+\t\tdma_free_coherent(dev, msix_map_table-\u003esize,\n+\t\t\t\t msix_map_table-\u003ebase_addr,\n+\t\t\t\t msix_map_table-\u003edma);\n+\t\tmsix_map_table-\u003ebase_addr = NULL;\n+\t\tmsix_map_table-\u003edma = 0;\n+\t\tmsix_map_table-\u003esize = 0;\n+\t}\n+\n+\tkfree(interrupts);\n+\tintr_mgt-\u003efunc_intr_res[func_id].interrupts = NULL;\n+\tintr_mgt-\u003efunc_intr_res[func_id].num_interrupts = 0;\n+\tintr_mgt-\u003efunc_intr_res[func_id].num_net_interrupts = 0;\n+\n+\treturn 0;\n+}\n+\n+/*\n+ * Internal (unlocked) MSI-X map teardown. Caller must hold\n+ * intr_mgt-\u003elock on entry.\n+ * This is used for single function synchronous destroy path.\n+ */\n+static int __nbl_res_intr_destroy_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t\t u16 func_id)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tint ret;\n+\n+\tlockdep_assert_held(\u0026intr_mgt-\u003elock);\n+\n+\tret = __nbl_res_intr_prepare_destroy_msix_map(res_mgt, func_id);\n+\tif (ret)\n+\t\treturn ret;\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\tusleep_range(NBL_MSIX_DMA_SYNC_MIN_US, NBL_MSIX_DMA_SYNC_MAX_US);\n+\tmutex_lock(\u0026intr_mgt-\u003elock);\n+\n+\treturn __nbl_res_intr_complete_destroy_msix_map(res_mgt, func_id);\n+}\n+\n+int nbl_res_intr_destroy_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t u16 func_id)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tint ret;\n+\n+\tif (!intr_mgt)\n+\t\treturn -EINVAL;\n+\n+\tmutex_lock(\u0026intr_mgt-\u003elock);\n+\tret = __nbl_res_intr_destroy_msix_map(res_mgt, func_id);\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\n+\treturn ret;\n+}\n+\n+/**\n+ * nbl_res_intr_cfg_msix_map - allocate \u0026 program MSI-X mapping table\n+ * @res_mgt: resource management instance\n+ * @func_id: target function identifier\n+ * @num_net_msix: required net data interrupt vectors\n+ * @num_others_msix: required control interrupt vectors\n+ * @net_msix_mask_en: enable mask for net interrupt entries\n+ *\n+ * Allocate interrupt vectors; MSIX coherent DMA table is allocated once\n+ * per function on first configuration, entries are updated in-place on\n+ * subsequent reconfigurations. No free/realloc of DMA table on vector\n+ * count changes. This removes the DMA table free/realloc cycle,\n+ * per-reconfig timed sleep and the in-flight DMA race window.\n+ *\n+ * Serialization: this function takes intr_mgt-\u003elock internally to\n+ * protect the global vector bitmaps and per-function state against\n+ * concurrent callers.\n+ *\n+ * Return: 0 on success, negative errno on failure\n+ */\n+int nbl_res_intr_cfg_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t u16 func_id, u16 num_net_msix,\n+\t\t\t u16 num_others_msix,\n+\t\t\t bool net_msix_mask_en)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tstruct nbl_hw_ops *hw_ops = res_mgt-\u003ehw_ops_tbl-\u003eops;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct nbl_msix_map_table *official_tbl;\n+\tstruct nbl_msix_map *msix_map_entries;\n+\tstruct device *dev = common-\u003edev;\n+\tu16 requested, intr_index;\n+\tu8 bus, devid, function;\n+\tbool entry_masked = false;\n+\tu16 *tmp_interrupts = NULL;\n+\tu16 allocated_cnt = 0;\n+\tu16 *old_interrupts;\n+\tu16 old_num;\n+\tint ret = 0;\n+\tu16 gvec;\n+\tu16 i, j;\n+\n+\tif (!intr_mgt)\n+\t\treturn -EINVAL;\n+\n+\tif (!common-\u003ehas_ctrl)\n+\t\treturn -EINVAL;\n+\n+\tif (func_id \u003e= NBL_MAX_FUNC) {\n+\t\tdev_err(dev, \"Invalid func_id %u\\n\", func_id);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (num_net_msix == 0 \u0026\u0026 num_others_msix == 0) {\n+\t\tdev_err(dev, \"MSI-X vector count cannot both be zero\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (num_net_msix \u003e NBL_MSIX_MAP_TABLE_MAX_ENTRIES ||\n+\t num_others_msix \u003e NBL_MSIX_MAP_TABLE_MAX_ENTRIES) {\n+\t\tdev_err(dev, \"MSI-X count out of limit: net=%u, others=%u\\n\",\n+\t\t\tnum_net_msix, num_others_msix);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tif (check_add_overflow(num_net_msix, num_others_msix, \u0026requested) ||\n+\t requested \u003e NBL_MSIX_MAP_TABLE_MAX_ENTRIES) {\n+\t\tdev_err(dev, \"Total MSI-X vectors %u exceeds maximum %u\\n\",\n+\t\t\trequested, NBL_MSIX_MAP_TABLE_MAX_ENTRIES);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tret = nbl_res_func_id_to_bdf(res_mgt, func_id, \u0026bus, \u0026devid, \u0026function);\n+\tif (ret) {\n+\t\tif (ret == -EOPNOTSUPP)\n+\t\t\tdev_err(dev,\n+\t\t\t\t\"MSI-X mapping for VF func_id=%u is not supported\\n\",\n+\t\t\t\tfunc_id);\n+\t\treturn ret;\n+\t}\n+\n+\tmutex_lock(\u0026intr_mgt-\u003elock);\n+\tofficial_tbl = \u0026intr_mgt-\u003efunc_intr_res[func_id].msix_map_table;\n+\t/*\n+\t * Phase1: allocate global vector array first.\n+\t * Allocate the fixed-size MSIX DMA table only ONCE for this function.\n+\t */\n+\ttmp_interrupts = kcalloc(requested, sizeof(tmp_interrupts[0]),\n+\t\t\t\t GFP_KERNEL);\n+\tif (!tmp_interrupts) {\n+\t\tret = -ENOMEM;\n+\t\tgoto out_unlock;\n+\t}\n+\t/* Allocate MSIX DMA table once per function */\n+\tif (!official_tbl-\u003ebase_addr) {\n+\t\tofficial_tbl-\u003esize =\n+\t\t\tsizeof(struct nbl_msix_map) *\n+\t\t\tNBL_MSIX_MAP_TABLE_MAX_ENTRIES;\n+\t\tofficial_tbl-\u003ebase_addr = dma_alloc_coherent(dev,\n+\t\t\t\t\t\t\t official_tbl-\u003esize,\n+\t\t\t\t\t\t\t \u0026official_tbl-\u003edma,\n+\t\t\t\t\t\t\t GFP_KERNEL);\n+\t\tif (!official_tbl-\u003ebase_addr) {\n+\t\t\tdev_err(dev, \"Failed to allocate DMA memory for MSIX table\\n\");\n+\t\t\tret = -ENOMEM;\n+\t\t\tgoto release_vecs_unlock;\n+\t\t}\n+\t}\n+\n+\t/* Allocate net interrupt vectors */\n+\tfor (i = 0; i \u003c num_net_msix; i++) {\n+\t\tintr_index = find_first_zero_bit(intr_mgt-\u003eintr_net_bmap,\n+\t\t\t\t\t\t NBL_MAX_NET_INTERRUPT);\n+\t\tif (intr_index == NBL_MAX_NET_INTERRUPT) {\n+\t\t\tdev_err(dev, \"No free net interrupt vectors left\\n\");\n+\t\t\tret = -EAGAIN;\n+\t\t\tgoto release_vecs_unlock;\n+\t\t}\n+\t\ttmp_interrupts[i] = intr_index + NBL_NET_INTR_BASE;\n+\t\tset_bit(intr_index, intr_mgt-\u003eintr_net_bmap);\n+\t\tallocated_cnt++;\n+\t}\n+\n+\t/* Allocate other interrupt vectors */\n+\tfor (; i \u003c requested; i++) {\n+\t\tintr_index =\n+\t\t\tfind_first_zero_bit(intr_mgt-\u003eintr_other_bmap,\n+\t\t\t\t\t NBL_MAX_OTHER_INTERRUPT);\n+\t\tif (intr_index == NBL_MAX_OTHER_INTERRUPT) {\n+\t\t\tdev_err(dev, \"No free control interrupt vectors left\\n\");\n+\t\t\tret = -EAGAIN;\n+\t\t\tgoto release_vecs_unlock;\n+\t\t}\n+\t\ttmp_interrupts[i] = intr_index;\n+\t\tset_bit(intr_index, intr_mgt-\u003eintr_other_bmap);\n+\t\tallocated_cnt++;\n+\t}\n+\n+\t/*\n+\t * Phase2: tear down old hardware MSIX config, release old global\n+\t * vectors.\n+\t * NOTE: NO DMA table free here, only invalidate HW entries and\n+\t * release vec bitmap.\n+\t */\n+\tif (intr_mgt-\u003efunc_intr_res[func_id].interrupts) {\n+\t\told_interrupts = intr_mgt-\u003efunc_intr_res[func_id].interrupts;\n+\t\told_num = intr_mgt-\u003efunc_intr_res[func_id].num_interrupts;\n+\n+\t\tret = __nbl_res_intr_set_mailbox_irq(res_mgt, func_id, 0,\n+\t\t\t\t\t\t false);\n+\t\tif (ret) {\n+\t\t\tdev_err(dev, \"%s: disable old mailbox irq failed, keep old config\\n\",\n+\t\t\t\t__func__);\n+\t\t\tgoto release_vecs_unlock;\n+\t\t}\n+\t\tfor (j = 0; j \u003c old_num; j++) {\n+\t\t\thw_ops-\u003ecfg_msix_info(res_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t\t func_id, false, old_interrupts[j],\n+\t\t\t\t\t 0, 0, 0, false);\n+\t\t}\n+\t\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\t\tnbl_intr_release_bitmap(res_mgt, old_interrupts, old_num);\n+\t\tkfree(old_interrupts);\n+\t\tintr_mgt-\u003efunc_intr_res[func_id].interrupts = NULL;\n+\t\tintr_mgt-\u003efunc_intr_res[func_id].num_interrupts = 0;\n+\t\tintr_mgt-\u003efunc_intr_res[func_id].num_net_interrupts = 0;\n+\t}\n+\n+\t/* Swap new vector array into func state */\n+\tintr_mgt-\u003efunc_intr_res[func_id].interrupts = tmp_interrupts;\n+\tintr_mgt-\u003efunc_intr_res[func_id].num_interrupts = requested;\n+\tintr_mgt-\u003efunc_intr_res[func_id].num_net_interrupts = num_net_msix;\n+\ttmp_interrupts = NULL;\n+\n+\t/*\n+\t * Fill MSIX map table IN-PLACE in the pre-allocated DMA buffer.\n+\t * Only zero entries beyond requested count to avoid full table\n+\t * memset overhead.\n+\t */\n+\tmsix_map_entries = official_tbl-\u003ebase_addr;\n+\tmemset(msix_map_entries + requested, 0,\n+\t (NBL_MSIX_MAP_TABLE_MAX_ENTRIES - requested) *\n+\t sizeof(*msix_map_entries));\n+\n+\tfor (i = 0; i \u003c requested; i++) {\n+\t\tgvec = intr_mgt-\u003efunc_intr_res[func_id].interrupts[i];\n+\t\tmsix_map_entries[i].data =\n+\t\t\tcpu_to_le16(FIELD_PREP(NBL_MSIX_MAP_VALID_MASK, 1) |\n+\t\t\t\t FIELD_PREP(NBL_MSIX_MAP_INDEX_MASK,\n+\t\t\t\t\t gvec));\n+\t\tentry_masked = (i \u003c num_net_msix \u0026\u0026 net_msix_mask_en);\n+\t\thw_ops-\u003ecfg_msix_info(res_mgt-\u003ehw_ops_tbl-\u003epriv,\n+\t\t\t\t func_id, true, gvec,\n+\t\t\t\t bus, devid, function,\n+\t\t\t\t entry_masked);\n+\t}\n+\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\n+\t/* Flush CPU writes to coherent memory before hardware DMA access */\n+\tdma_wmb();\n+\n+\t/*\n+\t * cfg_msix_map uses the control PF's own BDF (common-\u003ehw_bus etc.),\n+\t * not the target function's BDF. This BDF tags the pcompler DMA\n+\t * read of the MSI-X map table as originating from the control PF.\n+\t * The target function's BDF (bus/devid/function from\n+\t * nbl_res_func_id_to_bdf) is used only in cfg_msix_info for the\n+\t * host_msix_ctrl table entry BDF filtering.\n+\t */\n+\thw_ops-\u003ecfg_msix_map(res_mgt-\u003ehw_ops_tbl-\u003epriv, func_id,\n+\t\t\t true, official_tbl-\u003edma, common-\u003ehw_bus,\n+\t\t\t common-\u003edevid, common-\u003efunction);\n+\thw_ops-\u003eflush_write(res_mgt-\u003ehw_ops_tbl-\u003epriv);\n+\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\treturn 0;\n+\n+release_vecs_unlock:\n+\tnbl_intr_release_bitmap(res_mgt, tmp_interrupts, allocated_cnt);\n+\tkfree(tmp_interrupts);\n+out_unlock:\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\treturn ret;\n+}\n+\n+/**\n+ * nbl_res_intr_set_mailbox_irq - bind mailbox IRQ to specified vector\n+ * @res_mgt: resource management instance\n+ * @func_id: target function identifier\n+ * @vector_id: index inside local interrupt array\n+ * @en_msix: enable/disable mailbox interrupt\n+ *\n+ * Serialization: takes intr_mgt-\u003elock internally.\n+ *\n+ * Return: 0 on success, negative errno on parameter or state check\n+ * failure. The hardware op is void and cannot report failure.\n+ */\n+int nbl_res_intr_set_mailbox_irq(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t u16 func_id, u16 vector_id,\n+\t\t\t\t bool en_msix)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tint ret;\n+\n+\tif (!intr_mgt)\n+\t\treturn -EINVAL;\n+\n+\tif (!common-\u003ehas_ctrl)\n+\t\treturn -EINVAL;\n+\n+\tmutex_lock(\u0026intr_mgt-\u003elock);\n+\tret = __nbl_res_intr_set_mailbox_irq(res_mgt, func_id,\n+\t\t\t\t\t vector_id, en_msix);\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\n+\treturn ret;\n+}\n+\n+static struct nbl_interrupt_mgt *nbl_intr_setup_mgt(struct device *dev)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt;\n+\tint err;\n+\n+\tintr_mgt = devm_kzalloc(dev, sizeof(*intr_mgt), GFP_KERNEL);\n+\tif (!intr_mgt)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\terr = devm_mutex_init(dev, \u0026intr_mgt-\u003elock);\n+\tif (err)\n+\t\treturn ERR_PTR(err);\n+\n+\tbitmap_zero(intr_mgt-\u003eintr_net_bmap, NBL_MAX_NET_INTERRUPT);\n+\tbitmap_zero(intr_mgt-\u003eintr_other_bmap, NBL_MAX_OTHER_INTERRUPT);\n+\n+\treturn intr_mgt;\n+}\n+\n+int nbl_intr_mgt_start(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct device *dev = res_mgt-\u003ecommon-\u003edev;\n+\tstruct nbl_interrupt_mgt *intr_mgt;\n+\tint ret;\n+\n+\tintr_mgt = nbl_intr_setup_mgt(dev);\n+\tif (IS_ERR(intr_mgt)) {\n+\t\tret = PTR_ERR(intr_mgt);\n+\t\treturn ret;\n+\t}\n+\n+\tres_mgt-\u003eintr_mgt = intr_mgt;\n+\treturn 0;\n+}\n+\n+void nbl_intr_mgt_stop(struct nbl_resource_mgt *res_mgt)\n+{\n+\tstruct nbl_interrupt_mgt *intr_mgt = res_mgt-\u003eintr_mgt;\n+\tu16 func_id;\n+\tint ret;\n+\n+\tif (!intr_mgt)\n+\t\treturn;\n+\n+\t/* Phase 1: batch invalidate all hardware MSIX map entries */\n+\tmutex_lock(\u0026intr_mgt-\u003elock);\n+\tfor (func_id = 0; func_id \u003c NBL_MAX_FUNC; func_id++) {\n+\t\tif (intr_mgt-\u003efunc_intr_res[func_id].interrupts) {\n+\t\t\tdev_info(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\t \"intr_mgt_stop: preparing destroy map for func %u\\n\",\n+\t\t\t\t func_id);\n+\t\t\tret = __nbl_res_intr_prepare_destroy_msix_map(res_mgt,\n+\t\t\t\t\t\t\t\t func_id);\n+\t\t\tif (ret)\n+\t\t\t\tdev_warn(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\t\t \"intr_mgt_stop: prepare destroy map for func %u failed: %d\\n\",\n+\t\t\t\t\t func_id, ret);\n+\t\t}\n+\t}\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\n+\t/*\n+\t * Global quiesce: wait for straggler DMA table reads after all\n+\t * MSIX map entries have been invalidated in hardware, before\n+\t * freeing coherent memory. Best-effort only.\n+\t */\n+\tusleep_range(NBL_MSIX_DMA_SYNC_MIN_US, NBL_MSIX_DMA_SYNC_MAX_US);\n+\n+\t/* Phase2: safely release MSIX coherent memory and intr resources */\n+\tmutex_lock(\u0026intr_mgt-\u003elock);\n+\tfor (func_id = 0; func_id \u003c NBL_MAX_FUNC; func_id++) {\n+\t\tif (intr_mgt-\u003efunc_intr_res[func_id].interrupts) {\n+\t\t\tret = __nbl_res_intr_complete_destroy_msix_map(res_mgt,\n+\t\t\t\t\t\t\t\t func_id);\n+\t\t\tif (ret)\n+\t\t\t\tdev_warn(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t\t\t \"intr_mgt_stop: complete destroy map for func %u failed: %d\\n\",\n+\t\t\t\t\t func_id, ret);\n+\t\t}\n+\t}\n+\tmutex_unlock(\u0026intr_mgt-\u003elock);\n+\n+\tres_mgt-\u003eintr_mgt = NULL;\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.h\nnew file mode 100644\nindex 0000000000000..9f66f5e19c984\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.h\n@@ -0,0 +1,21 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_INTERRUPT_H_\n+#define _NBL_INTERRUPT_H_\n+\n+#include \"nbl_resource.h\"\n+\n+#define NBL_MSIX_MAP_TABLE_MAX_ENTRIES\t1024\n+int nbl_res_intr_destroy_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t u16 func_id);\n+int nbl_res_intr_cfg_msix_map(struct nbl_resource_mgt *res_mgt,\n+\t\t\t u16 func_id, u16 num_net_msix,\n+\t\t\t u16 num_others_msix,\n+\t\t\t bool net_msix_mask_en);\n+int nbl_res_intr_set_mailbox_irq(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t u16 func_id, u16 vector_id,\n+\t\t\t\t bool en_msix);\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.c\nnew file mode 100644\nindex 0000000000000..411790adfb39f\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.c\n@@ -0,0 +1,152 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#include \u003clinux/pci.h\u003e\n+#include \"nbl_resource.h\"\n+\n+int nbl_res_func_id_to_vsi_id(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u16 type, u16 *vsi_id)\n+{\n+\tstruct nbl_vsi_info *vsi_info = res_mgt-\u003eresource_info-\u003evsi_info;\n+\tenum nbl_vsi_serv_type dst_type = NBL_VSI_SERV_PF_DATA_TYPE;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct device *dev = res_mgt-\u003ecommon-\u003edev;\n+\tint pfid = func_id;\n+\tu32 rel_pf_id;\n+\tint ret;\n+\n+\tif (!common-\u003ehas_ctrl || !vsi_id) {\n+\t\tdev_dbg(dev, \"No control plane or null vsi output ptr\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\tret = nbl_common_func_id_to_rel_pf_id(common, pfid, \u0026rel_pf_id);\n+\tif (ret)\n+\t\treturn ret;\n+\tif (rel_pf_id \u003e= vsi_info-\u003enum) {\n+\t\tdev_err(dev, \"PF %d (diff=%u) exceeds vsi_info-\u003enum (%u)\\n\",\n+\t\t\tpfid, rel_pf_id, vsi_info-\u003enum);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tret = nbl_res_pf_dev_vsi_type_to_hw_vsi_type(res_mgt, type, \u0026dst_type);\n+\tif (ret) {\n+\t\tdev_err(dev, \"Invalid vsi type %u func_id %u\\n\", type, func_id);\n+\t\treturn ret;\n+\t}\n+\t*vsi_id = vsi_info-\u003eserv_info[rel_pf_id][dst_type].base_id;\n+\treturn 0;\n+}\n+\n+int nbl_res_vsi_id_to_pf_id(struct nbl_resource_mgt *res_mgt, u16 vsi_id)\n+{\n+\tstruct nbl_vsi_info *vsi_info = res_mgt-\u003eresource_info-\u003evsi_info;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct device *dev = res_mgt-\u003ecommon-\u003edev;\n+\tint j = NBL_VSI_SERV_PF_DATA_TYPE;\n+\tint pf_id, i;\n+\n+\tif (!common-\u003ehas_ctrl) {\n+\t\tdev_dbg(dev, \"No control plane available\\n\");\n+\t\treturn -EINVAL;\n+\t}\n+\tfor (i = 0; i \u003c vsi_info-\u003enum; i++) {\n+\t\tif (vsi_id \u003e= vsi_info-\u003eserv_info[i][j].base_id \u0026\u0026\n+\t\t (vsi_id \u003c vsi_info-\u003eserv_info[i][j].base_id +\n+\t\t\t\t\tvsi_info-\u003eserv_info[i][j].num)) {\n+\t\t\tpf_id = i + common-\u003emgt_pf;\n+\t\t\tif (pf_id \u003e= NBL_MAX_PF) {\n+\t\t\t\tdev_err(dev, \"PF ID overflow\\n\");\n+\t\t\t\treturn -ERANGE;\n+\t\t\t}\n+\t\t\treturn pf_id;\n+\t\t}\n+\t}\n+\n+\tdev_dbg(dev, \"VSI ID %u not found\\n\", vsi_id);\n+\treturn -ENOENT;\n+}\n+\n+int nbl_res_func_id_to_bdf(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u8 *bus, u8 *dev, u8 *function)\n+{\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct nbl_sriov_info *sriov_info;\n+\tint pfid = func_id;\n+\tu8 pf_bus, devfn;\n+\tu32 rel_pf_id;\n+\tint ret;\n+\n+\tif (!common-\u003ehas_ctrl || !bus || !dev || !function)\n+\t\treturn -EINVAL;\n+\tret = nbl_common_func_id_to_rel_pf_id(common, pfid, \u0026rel_pf_id);\n+\tif (ret)\n+\t\treturn ret;\n+\tif (rel_pf_id \u003e= common-\u003emax_pf) {\n+\t\tdev_err(common-\u003edev,\n+\t\t\t\"func_id=%u rel_pf_id=%u exceeds max_pf=%u, VF BDF unsupported\\n\",\n+\t\t\tpfid, rel_pf_id,\n+\t\t\tcommon-\u003emax_pf);\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\tsriov_info = res_mgt-\u003eresource_info-\u003esriov_info + rel_pf_id;\n+\tpf_bus = PCI_BUS_NUM(sriov_info-\u003ebdf);\n+\tdevfn = sriov_info-\u003ebdf \u0026 0xff;\n+\t*bus = pf_bus;\n+\t*dev = PCI_SLOT(devfn);\n+\t*function = PCI_FUNC(devfn);\n+\n+\treturn 0;\n+}\n+\n+int nbl_res_get_eth_id(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t u16 vsi_id, u8 *eth_num, u8 *eth_id, u8 *logic_eth_id)\n+{\n+\tstruct nbl_eth_info *eth_info = res_mgt-\u003eresource_info-\u003eeth_info;\n+\tstruct nbl_common_info *common = res_mgt-\u003ecommon;\n+\tstruct device *dev = res_mgt-\u003ecommon-\u003edev;\n+\tint pfid = func_id;\n+\tint rel_pf_id;\n+\tint abs_pf_id;\n+\n+\tif (!common-\u003ehas_ctrl || !eth_num || !eth_id || !logic_eth_id)\n+\t\treturn -EINVAL;\n+\tabs_pf_id = nbl_res_vsi_id_to_pf_id(res_mgt, vsi_id);\n+\tif (abs_pf_id \u003c 0) {\n+\t\tdev_err(dev, \"Failed to get PF ID from VSI ID %u\\n\", vsi_id);\n+\t\treturn -EINVAL;\n+\t}\n+\tif (abs_pf_id != pfid) {\n+\t\tdev_err(dev, \"func_id %u does not match pf derived from vsi_id %u\\n\",\n+\t\t\tpfid, vsi_id);\n+\t\treturn -EINVAL;\n+\t}\n+\trel_pf_id = abs_pf_id - common-\u003emgt_pf;\n+\n+\tif (rel_pf_id \u003e= eth_info-\u003eeth_num) {\n+\t\tdev_err(dev, \"rel_pf_id %d out of range [0, %u)\\n\",\n+\t\t\trel_pf_id, eth_info-\u003eeth_num);\n+\t\treturn -ERANGE;\n+\t}\n+\n+\t*eth_num = eth_info-\u003eeth_num;\n+\t*eth_id = eth_info-\u003eeth_id[rel_pf_id];\n+\t*logic_eth_id = rel_pf_id;\n+\treturn 0;\n+}\n+\n+int nbl_res_pf_dev_vsi_type_to_hw_vsi_type(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t\t u16 src_type,\n+\t\t\t\t\t enum nbl_vsi_serv_type *dst_type)\n+{\n+\tswitch (src_type) {\n+\tcase NBL_VSI_DATA:\n+\t\t*dst_type = NBL_VSI_SERV_PF_DATA_TYPE;\n+\t\treturn 0;\n+\tdefault:\n+\t\tdev_err_once(res_mgt-\u003ecommon-\u003edev,\n+\t\t\t \"Unsupported vsi src_type %u\\n\", src_type);\n+\t\treturn -EINVAL;\n+\t}\n+}\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.h\nnew file mode 100644\nindex 0000000000000..5f0dfc74c0689\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.h\n@@ -0,0 +1,110 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_RESOURCE_H_\n+#define _NBL_RESOURCE_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+#include \"../nbl_include/nbl_include.h\"\n+#include \"../nbl_include/nbl_def_channel.h\"\n+#include \"../nbl_include/nbl_def_hw.h\"\n+#include \"../nbl_include/nbl_def_resource.h\"\n+#include \"../nbl_include/nbl_def_common.h\"\n+#include \"../nbl_core.h\"\n+\n+struct nbl_resource_mgt;\n+\n+/* --------- INTERRUPT ---------- */\n+#define NBL_MAX_OTHER_INTERRUPT\t\t\t1024\n+#define NBL_MAX_NET_INTERRUPT\t\t\t4096\n+#define NBL_NET_INTR_BASE\t\tNBL_MAX_OTHER_INTERRUPT\n+\n+#define NBL_MSIX_MAP_VALID_MASK\t\tBIT(0)\n+#define NBL_MSIX_MAP_INDEX_MASK\t\tGENMASK(13, 1)\n+#define NBL_MSIX_MAP_RSV_MASK\t\tGENMASK(15, 14)\n+\n+struct nbl_msix_map {\n+\t__le16 data;\n+};\n+\n+struct nbl_msix_map_table {\n+\tstruct nbl_msix_map *base_addr;\n+\tdma_addr_t dma;\n+\tsize_t size;\n+};\n+\n+struct nbl_func_interrupt_resource_mng {\n+\tu16 num_interrupts;\n+\tu16 num_net_interrupts;\n+\tu16 *interrupts;\n+\tstruct nbl_msix_map_table msix_map_table;\n+};\n+\n+struct nbl_interrupt_mgt {\n+\tstruct mutex lock; /* Protects bitmap + func_intr_res[] */\n+\tDECLARE_BITMAP(intr_net_bmap, NBL_MAX_NET_INTERRUPT);\n+\tDECLARE_BITMAP(intr_other_bmap, NBL_MAX_OTHER_INTERRUPT);\n+\tstruct nbl_func_interrupt_resource_mng func_intr_res[NBL_MAX_FUNC];\n+};\n+\n+/* --------- INFO ---------- */\n+struct nbl_sriov_info {\n+\tunsigned int bdf;\n+};\n+\n+struct nbl_eth_info {\n+\tDECLARE_BITMAP(eth_bitmap, NBL_MAX_ETHERNET);\n+\tu8 pf_bitmap[NBL_MAX_ETHERNET];\n+\tu8 eth_num;\n+\tu8 resv[3];\n+\tu8 eth_id[NBL_MAX_ETHERNET];\n+\tu8 logic_eth_id[NBL_MAX_ETHERNET];\n+};\n+\n+enum nbl_vsi_serv_type {\n+\tNBL_VSI_SERV_PF_DATA_TYPE,\n+\tNBL_VSI_SERV_MAX_TYPE,\n+};\n+\n+struct nbl_vsi_serv_info {\n+\tu16 base_id;\n+\tu16 num;\n+};\n+\n+struct nbl_vsi_info {\n+\tu16 num;\n+\tstruct nbl_vsi_serv_info serv_info[NBL_MAX_ETHERNET]\n+\t\t\t\t\t [NBL_VSI_SERV_MAX_TYPE];\n+};\n+\n+struct nbl_resource_info {\n+\tstruct nbl_sriov_info *sriov_info;\n+\tstruct nbl_eth_info *eth_info;\n+\tstruct nbl_vsi_info *vsi_info;\n+\tstruct nbl_board_port_info board_info;\n+};\n+\n+struct nbl_resource_mgt {\n+\tstruct nbl_common_info *common;\n+\tstruct nbl_resource_info *resource_info;\n+\tstruct nbl_channel_ops_tbl *chan_ops_tbl;\n+\tstruct nbl_hw_ops_tbl *hw_ops_tbl;\n+\tstruct nbl_interrupt_mgt *intr_mgt;\n+};\n+\n+int nbl_res_vsi_id_to_pf_id(struct nbl_resource_mgt *res_mgt, u16 vsi_id);\n+int nbl_res_func_id_to_vsi_id(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u16 type, u16 *vsi_id);\n+int nbl_res_func_id_to_bdf(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u8 *bus, u8 *dev, u8 *function);\n+int nbl_res_get_eth_id(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t u16 vsi_id, u8 *eth_num, u8 *eth_id, u8 *logic_eth_id);\n+int nbl_intr_mgt_start(struct nbl_resource_mgt *res_mgt);\n+int nbl_res_pf_dev_vsi_type_to_hw_vsi_type(struct nbl_resource_mgt *res_mgt,\n+\t\t\t\t\t u16 src_type,\n+\t\t\t\t\t enum nbl_vsi_serv_type *dst_type);\n+void nbl_intr_mgt_stop(struct nbl_resource_mgt *res_mgt);\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_channel.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_channel.h\nnew file mode 100644\nindex 0000000000000..6f8fc14a51f0e\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_channel.h\n@@ -0,0 +1,183 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEF_CHANNEL_H_\n+#define _NBL_DEF_CHANNEL_H_\n+\n+#include \u003clinux/types.h\u003e\n+#include \u003clinux/build_bug.h\u003e\n+\n+struct nbl_channel_mgt;\n+struct nbl_adapter;\n+\n+typedef void (*nbl_chan_resp)(void *, u16, u16, void *, u32);\n+\n+enum {\n+\tNBL_CHAN_RESP_OK = 0,\n+\tNBL_CHAN_RESP_ERR = 1,\n+\tNBL_CHAN_RESP_UNIMPLEMENTED = 2,\n+\tNBL_CHAN_RESP_PERM_DENY = 3,\n+};\n+\n+/*\n+ * Mailbox wire opcodes, stable wire ABI shared between driver and firmware.\n+ * Each opcode has a fixed assigned number to preserve compatibility.\n+ * ABI compatibility rules:\n+ * 1. New opcodes shall only be appended before NBL_CHAN_MSG_MAILBOX_MAX;\n+ * 2. Reordering, inserting or deleting existing enumerators breaks driver-\n+ * firmware interoperability and must be avoided;\n+ * 3. Modifications to existing opcodes require synchronized firmware ABI\n+ * updates.\n+ *\n+ * Only opcodes currently used by in-tree driver logic are defined here.\n+ * Unimplemented feature opcodes (KTLS, IPsec, vDPA, mirror etc.) will be\n+ * added incrementally together with their corresponding driver\n+ * implementation patches.\n+ */\n+enum nbl_chan_msg_type {\n+\tNBL_CHAN_MSG_ACK = 0,\n+\tNBL_CHAN_MSG_CONFIGURE_MSIX_MAP = 17,\n+\tNBL_CHAN_MSG_DESTROY_MSIX_MAP = 18,\n+\tNBL_CHAN_MSG_MAILBOX_SET_IRQ = 19,\n+\tNBL_CHAN_MSG_GET_VSI_ID = 21,\n+\tNBL_CHAN_MSG_GET_ETH_ID = 67,\n+\t/* mailbox msg end */\n+\tNBL_CHAN_MSG_MAILBOX_MAX,\n+};\n+\n+enum nbl_chan_state {\n+\tNBL_CHAN_IRQ_RDY,\n+\tNBL_CHAN_STATE_NBITS\n+};\n+\n+struct nbl_chan_param_cfg_msix_map {\n+\t__le16 num_net_msix;\n+\t__le16 num_others_msix;\n+\t__le16 msix_mask_en;\n+\t__le16 rsvd;\n+};\n+\n+struct nbl_chan_param_set_mailbox_irq {\n+\t__le16 vector_id;\n+\tu8 en_msix;\n+\tu8 rsvd;\n+};\n+\n+struct nbl_chan_param_get_vsi_id {\n+\t__le16 vsi_id;\n+\t__le16 type;\n+};\n+\n+struct nbl_chan_param_get_eth_id {\n+\t__le16 vsi_id;\n+\tu8 eth_num;\n+\tu8 eth_id;\n+\tu8 logic_eth_id;\n+\tu8 rsvd[3];\n+};\n+\n+struct nbl_board_port_info {\n+\tu8 eth_num;\n+\tu8 eth_speed;\n+\tu8 p4_version;\n+\tu8 rsv[5];\n+};\n+\n+static_assert(sizeof(struct nbl_chan_param_cfg_msix_map) == 8,\n+\t \"nbl_chan_param_cfg_msix_map size must be 8 bytes\");\n+static_assert(sizeof(struct nbl_chan_param_set_mailbox_irq) == 4,\n+\t \"nbl_chan_param_set_mailbox_irq size must be 4 bytes\");\n+static_assert(sizeof(struct nbl_chan_param_get_vsi_id) == 4,\n+\t \"nbl_chan_param_get_vsi_id size must be 4 bytes\");\n+static_assert(sizeof(struct nbl_chan_param_get_eth_id) == 8,\n+\t \"nbl_chan_param_get_eth_id size must be 8 bytes\");\n+static_assert(sizeof(struct nbl_board_port_info) == 8,\n+\t \"nbl_board_port_info size must be 8 bytes\");\n+\n+struct nbl_chan_send_info {\n+\tvoid *arg;\n+\tsize_t arg_len;\n+\tvoid *resp;\n+\tsize_t resp_len;\n+\tu16 dstid;\n+\tu16 msg_type;\n+\tu16 ack;\n+\tu16 ack_len;\n+};\n+\n+struct nbl_chan_ack_info {\n+\tvoid *data;\n+\tint err;\n+\tu32 data_len;\n+\tu16 dstid;\n+\tu16 msg_type;\n+\tu16 msgid;\n+};\n+\n+enum nbl_channel_type {\n+\tNBL_CHAN_TYPE_MAILBOX,\n+\tNBL_CHAN_TYPE_MAX\n+};\n+\n+static inline void\n+nbl_chan_fill_send_info(struct nbl_chan_send_info *info,\n+\t\t\tu16 dst_id, u16 msg_type,\n+\t\t\tvoid *argument, u32 arg_length,\n+\t\t\tvoid *response, u32 resp_length,\n+\t\t\tbool need_ack)\n+{\n+\tinfo-\u003edstid = dst_id;\n+\tinfo-\u003emsg_type = msg_type;\n+\tinfo-\u003earg = argument;\n+\tinfo-\u003earg_len = arg_length;\n+\tinfo-\u003eresp = response;\n+\tinfo-\u003eresp_len = resp_length;\n+\tinfo-\u003eack = need_ack;\n+}\n+\n+static inline void\n+nbl_chan_fill_ack_info(struct nbl_chan_ack_info *info,\n+\t\t u16 dst_id, u16 msg_type, u16 msg_id,\n+\t\t int err_code, void *ack_data, u32 data_length)\n+{\n+\tinfo-\u003edstid = dst_id;\n+\tinfo-\u003emsg_type = msg_type;\n+\tinfo-\u003emsgid = msg_id;\n+\tinfo-\u003eerr = err_code;\n+\tinfo-\u003edata = ack_data;\n+\tinfo-\u003edata_len = data_length;\n+}\n+\n+struct nbl_channel_ops {\n+\tint (*send_msg)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\tstruct nbl_chan_send_info *chan_send);\n+\tint (*send_ack)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\tstruct nbl_chan_ack_info *chan_ack);\n+\tint (*register_msg)(struct nbl_channel_mgt *chan_mgt, u16 msg_type,\n+\t\t\t nbl_chan_resp func, void *callback_priv);\n+\tvoid (*unregister_all_msg)(struct nbl_channel_mgt *chan_mgt);\n+\tvoid (*cfg_chan_qinfo_map_table)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t\t u8 bus, u8 devid);\n+\tbool (*check_queue_exist)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t u8 chan_type);\n+\tint (*setup_queue)(struct nbl_channel_mgt *chan_mgt, u8 chan_type);\n+\tint (*teardown_queue)(struct nbl_channel_mgt *chan_mgt, u8 chan_type);\n+\tvoid (*clean_queue_subtask)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t u8 chan_type);\n+\tvoid (*register_chan_task)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\t u8 chan_type, struct work_struct *task);\n+\tvoid (*set_queue_state)(struct nbl_channel_mgt *chan_mgt,\n+\t\t\t\tenum nbl_chan_state state, u8 chan_type,\n+\t\t\t\tu8 set);\n+};\n+\n+struct nbl_channel_ops_tbl {\n+\tstruct nbl_channel_ops *ops;\n+\tstruct nbl_channel_mgt *priv;\n+};\n+\n+int nbl_chan_init_common(struct nbl_adapter *adapter);\n+void nbl_chan_remove_common(struct nbl_adapter *adapter);\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_common.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_common.h\nnew file mode 100644\nindex 0000000000000..3c2cb34192df9\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_common.h\n@@ -0,0 +1,69 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEF_COMMON_H_\n+#define _NBL_DEF_COMMON_H_\n+\n+#include \u003clinux/types.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \u003clinux/device.h\u003e\n+#include \"nbl_include.h\"\n+\n+#define NBL_TWO_ETHERNET_PORT\t\t\t2\n+#define NBL_FOUR_ETHERNET_PORT\t\t\t4\n+#define NBL_DEFAULT_VSI_ID_GAP\t\t\t1024\n+#define NBL_TWO_ETHERNET_VSI_ID_GAP\t\t512\n+#define NBL_FOUR_ETHERNET_VSI_ID_GAP\t\t256\n+\n+static inline u32 nbl_vsi_id_gap(u32 m)\n+{\n+\tif (m == NBL_FOUR_ETHERNET_PORT)\n+\t\treturn NBL_FOUR_ETHERNET_VSI_ID_GAP;\n+\telse if (m == NBL_TWO_ETHERNET_PORT)\n+\t\treturn NBL_TWO_ETHERNET_VSI_ID_GAP;\n+\n+\treturn NBL_DEFAULT_VSI_ID_GAP;\n+}\n+\n+struct nbl_common_info {\n+\tstruct workqueue_struct *wq;\n+\tstruct pci_dev *pdev;\n+\tstruct device *dev;\n+\tu16 vsi_id;\n+\tu8 eth_id;\n+\tu8 logic_eth_id;\n+\tu8 eth_num;\n+\n+\tu8 function;\n+\tu8 devid;\n+\tu8 bus;\n+\tu8 hw_bus;\n+\tu16 mgt_pf;\n+\n+\tu8 has_ctrl;\n+\tu8 has_net;\n+\tu8 max_pf;\n+};\n+\n+struct nbl_hash_tbl_key {\n+\tstruct device *dev;\n+\tu16 key_size;\n+\tu16 data_size; /* no include key or node member */\n+\tu16 bucket_size;\n+\tu16 resv;\n+};\n+\n+void nbl_common_destroy_wq(struct nbl_common_info *common);\n+int nbl_common_create_wq(struct nbl_common_info *common);\n+int nbl_common_func_id_to_rel_pf_id(struct nbl_common_info *common, u32 pf_id,\n+\t\t\t\t u32 *rel_pf_id);\n+struct nbl_hash_tbl_mgt *\n+nbl_common_init_hash_table(struct nbl_hash_tbl_key *key);\n+void nbl_common_remove_hash_table(struct nbl_hash_tbl_mgt *tbl_mgt);\n+int nbl_common_alloc_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key,\n+\t\t\t void *data, void **out_data);\n+void *nbl_common_get_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key);\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dev.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dev.h\nnew file mode 100644\nindex 0000000000000..a66c633a0e7af\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dev.h\n@@ -0,0 +1,16 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEF_DEV_H_\n+#define _NBL_DEF_DEV_H_\n+\n+struct nbl_adapter;\n+\n+int nbl_dev_init(struct nbl_adapter *adapter);\n+void nbl_dev_remove(struct nbl_adapter *adapter);\n+int nbl_dev_start(struct nbl_adapter *adapter);\n+void nbl_dev_stop(struct nbl_adapter *adapter);\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dispatch.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dispatch.h\nnew file mode 100644\nindex 0000000000000..61083a750da47\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dispatch.h\n@@ -0,0 +1,56 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEF_DISPATCH_H_\n+#define _NBL_DEF_DISPATCH_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+struct nbl_dispatch_mgt;\n+struct nbl_adapter;\n+enum {\n+\tNBL_DISP_CTRL_LVL_MGT,\n+\tNBL_DISP_CTRL_LVL_NET,\n+\tNBL_DISP_CTRL_LVL_MAX,\n+};\n+\n+/**\n+ * struct nbl_dispatch_ops - dispatch control plane operation callbacks\n+ * @init_module: dispatch layer initialization, ONLY valid on Control PF,\n+ * caller must check has_ctrl guard\n+ * @deinit_module: dispatch layer cleanup, ONLY valid on Control PF,\n+ * caller must check has_ctrl guard\n+ * @cfg_msix_map: configure function msix mapping table\n+ * @destroy_msix_map: tear down msix mapping resource\n+ * @set_mailbox_irq: bind mailbox interrupt to specified msix vector\n+ * @get_vsi_id: resolve VSI ID by type\n+ * @get_eth_id: resolve eth port info from VSI ID\n+ *\n+ * Warning: All ops except init_module/deinit_module can be safely called\n+ * on PF/VF; init/deinit hooks are control-PF exclusive to prevent NULL ptr.\n+ */\n+struct nbl_dispatch_ops {\n+\tint (*init_module)(struct nbl_dispatch_mgt *disp_mgt);\n+\tvoid (*deinit_module)(struct nbl_dispatch_mgt *disp_mgt);\n+\tint (*cfg_msix_map)(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t u16 num_net_msix, u16 num_others_msix,\n+\t\t\t bool net_msix_mask_en);\n+\tint (*destroy_msix_map)(struct nbl_dispatch_mgt *disp_mgt);\n+\tint (*set_mailbox_irq)(struct nbl_dispatch_mgt *disp_mgt,\n+\t\t\t u16 vector_id, bool en_msix);\n+\tint (*get_vsi_id)(struct nbl_dispatch_mgt *disp_mgt, u16 type,\n+\t\t\t u16 *vsi_id);\n+\tint (*get_eth_id)(struct nbl_dispatch_mgt *disp_mgt, u16 vsi_id,\n+\t\t\t u8 *eth_num, u8 *eth_id, u8 *logic_eth_id);\n+};\n+\n+struct nbl_dispatch_ops_tbl {\n+\tstruct nbl_dispatch_ops *ops;\n+\tstruct nbl_dispatch_mgt *priv;\n+};\n+\n+int nbl_disp_init(struct nbl_adapter *adapter);\n+void nbl_disp_remove(struct nbl_adapter *adapter);\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_hw.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_hw.h\nnew file mode 100644\nindex 0000000000000..6aff1b10eb7f5\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_hw.h\n@@ -0,0 +1,82 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEF_HW_H_\n+#define _NBL_DEF_HW_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+struct nbl_board_port_info;\n+struct nbl_hw_mgt;\n+struct nbl_adapter;\n+struct nbl_hw_ops {\n+\tint (*init_module)(struct nbl_hw_mgt *hw_mgt, u8 eth_speed, u8 eth_num);\n+\tvoid (*deinit_module)(struct nbl_hw_mgt *hw_mgt);\n+\n+\tvoid (*cfg_msix_map)(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t bool valid, dma_addr_t dma_addr, u8 bus,\n+\t\t\t u8 devid, u8 function);\n+\tvoid (*cfg_msix_info)(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t bool valid, u16 interrupt_id, u8 bus,\n+\t\t\t u8 devid, u8 function,\n+\t\t\t bool net_msix_mask_en);\n+\tvoid (*flush_write)(struct nbl_hw_mgt *hw_mgt);\n+\tvoid (*update_mailbox_queue_tail_ptr)(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t\t u16 tail_ptr, u8 txrx);\n+\tvoid (*config_mailbox_rxq)(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t dma_addr_t dma_addr, int size_bwid);\n+\tvoid (*config_mailbox_txq)(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t\t dma_addr_t dma_addr, int size_bwid);\n+\tvoid (*stop_mailbox_rxq)(struct nbl_hw_mgt *hw_mgt);\n+\tvoid (*stop_mailbox_txq)(struct nbl_hw_mgt *hw_mgt);\n+\t/**\n+\t * get_host_pf_mask - Fetch host PF mask from firmware k_pf_mask reg\n+\t * @hw_mgt: hardware management context\n+\t * @pf_mask: output pointer for PF mask value\n+\t *\n+\t * k_pf_mask register rule:\n+\t * bit N == 0 -\u003e PF#N enabled; bit N == 1 -\u003e PF#N masked out.\n+\t * bit0 is PF0's mask bit (not reserved); PF0 can be masked but\n+\t * the driver requires at least PF0 enabled.\n+\t * Only 1/2/4 PFs are supported:\n+\t * 1 PF (PF0): mask = 0xfe\n+\t * 2 PFs (PF0,PF1): mask = 0xfc\n+\t * 4 PFs (PF0~PF3): mask = 0xf0\n+\t * All-zero mask (0x00) means all 8 PFs enabled, which is\n+\t * unsupported by the driver and rejected with -EINVAL.\n+\t *\n+\t * Firmware contract: number of unmasked PFs MUST equal\n+\t * get_board_info()-\u003eeth_num.\n+\t */\n+\tvoid (*get_host_pf_mask)(struct nbl_hw_mgt *hw_mgt, u32 *pf_mask);\n+\tvoid (*get_real_bus)(struct nbl_hw_mgt *hw_mgt, u8 *bus);\n+\n+\tvoid (*cfg_mailbox_qinfo)(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t\t u8 bus, u8 devid, u8 function);\n+\tvoid (*set_mailbox_irq)(struct nbl_hw_mgt *hw_mgt, u16 func_id,\n+\t\t\t\tbool en_msix, u16 gvec);\n+\tvoid (*get_fw_eth_map)(struct nbl_hw_mgt *hw_mgt, u32 *eth_map);\n+\t/**\n+\t * get_board_info - Fetch board info from firmware\n+\t * @hw_mgt: hardware management context\n+\t * @board_info: output pointer for board info structure\n+\t *\n+\t * Firmware contract: board_info.eth_num MUST equal the number of\n+\t * unmasked PFs from get_host_pf_mask(). See get_host_pf_mask for\n+\t * details.\n+\t */\n+\tvoid (*get_board_info)(struct nbl_hw_mgt *hw_mgt,\n+\t\t\t struct nbl_board_port_info *board_info);\n+};\n+\n+struct nbl_hw_ops_tbl {\n+\tstruct nbl_hw_ops *ops;\n+\tstruct nbl_hw_mgt *priv;\n+};\n+\n+int nbl_hw_init_leonis(struct nbl_adapter *adapter);\n+void nbl_hw_remove_leonis(struct nbl_adapter *adapter);\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_resource.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_resource.h\nnew file mode 100644\nindex 0000000000000..8dc64e806c1e2\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_resource.h\n@@ -0,0 +1,38 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_DEF_RESOURCE_H_\n+#define _NBL_DEF_RESOURCE_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+struct nbl_resource_mgt;\n+struct nbl_adapter;\n+\n+struct nbl_resource_ops {\n+\tint (*init_module)(struct nbl_resource_mgt *res_mgt);\n+\tvoid (*deinit_module)(struct nbl_resource_mgt *res_mgt);\n+\n+\tint (*cfg_msix_map)(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u16 num_net_msix, u16 num_others_msix,\n+\t\t\t bool net_msix_mask_en);\n+\tint (*destroy_msix_map)(struct nbl_resource_mgt *res_mgt, u16 func_id);\n+\tint (*set_mailbox_irq)(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u16 vector_id, bool en_msix);\n+\tint (*get_vsi_id)(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u16 type, u16 *vsi_id);\n+\tint (*get_eth_id)(struct nbl_resource_mgt *res_mgt, u16 func_id,\n+\t\t\t u16 vsi_id, u8 *eth_num, u8 *eth_id,\n+\t\t\t u8 *logic_eth_id);\n+};\n+\n+struct nbl_resource_ops_tbl {\n+\tstruct nbl_resource_ops *ops;\n+\tstruct nbl_resource_mgt *priv;\n+};\n+\n+int nbl_res_init_leonis(struct nbl_adapter *adapter);\n+void nbl_res_remove_leonis(struct nbl_adapter *adapter);\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_include.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_include.h\nnew file mode 100644\nindex 0000000000000..f3c807836d24c\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_include.h\n@@ -0,0 +1,54 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#ifndef _NBL_INCLUDE_H_\n+#define _NBL_INCLUDE_H_\n+\n+#include \u003clinux/types.h\u003e\n+\n+/* ------ Basic definitions ------- */\n+#define NBL_DRIVER_NAME\t\t\t\t\t\"nbl\"\n+#define NBL_MAX_PF\t\t\t\t\t8\n+#define NBL_NEXT_ID(id, max) (((id) + 1) % ((max) + 1))\n+\n+#define NBL_MAX_FUNC\t\t\t\t\t520\n+#define NBL_MAX_ETHERNET\t\t\t\t4\n+\n+enum {\n+\tNBL_VSI_DATA = 0,\n+};\n+\n+struct nbl_func_caps {\n+\tu32 has_ctrl:1;\n+\tu32 has_net:1;\n+\tu32 rsv:30;\n+};\n+\n+struct nbl_init_param {\n+\tstruct nbl_func_caps caps;\n+};\n+\n+/*\n+ * Firmware ABI defines port speed enum fixed, value 0 represents 10G, cannot\n+ * reassign 0 to INVALID for compatibility\n+ */\n+enum nbl_fw_port_speed {\n+\tNBL_FW_PORT_SPEED_10G,\n+\tNBL_FW_PORT_SPEED_25G,\n+\tNBL_FW_PORT_SPEED_50G,\n+\tNBL_FW_PORT_SPEED_100G,\n+};\n+\n+/*\n+ * Firmware quirk word @ NBL_LEONIS_QUIRKS_OFFSET (0x140)\n+ * Sentinel value: ~0U (0xFFFFFFFF) = firmware reports no active quirks\n+ * BIT(0): NBL_QUIRK_NO_TOE – ABI defined, driver implementation pending\n+ * BIT(1): NBL_QUIRK_UVN_PREFETCH_ALIGN – control UVN descriptor prefetch\n+ * selection\n+ */\n+#define NBL_QUIRK_NO_TOE\t\tBIT(0)\n+#define NBL_QUIRK_UVN_PREFETCH_ALIGN\tBIT(1)\n+\n+#endif\ndiff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_main.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_main.c\nnew file mode 100644\nindex 0000000000000..02cb35d32012f\n--- /dev/null\n+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_main.c\n@@ -0,0 +1,243 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Copyright (c) 2026 Nebula Matrix Limited.\n+ */\n+\n+#include \u003clinux/device.h\u003e\n+#include \u003clinux/pci.h\u003e\n+#include \u003clinux/module.h\u003e\n+#include \u003clinux/bits.h\u003e\n+#include \"nbl_include/nbl_include.h\"\n+#include \"nbl_include/nbl_def_channel.h\"\n+#include \"nbl_include/nbl_def_hw.h\"\n+#include \"nbl_include/nbl_def_resource.h\"\n+#include \"nbl_include/nbl_def_dispatch.h\"\n+#include \"nbl_include/nbl_def_dev.h\"\n+#include \"nbl_include/nbl_def_common.h\"\n+#include \"nbl_core.h\"\n+\n+int nbl_core_start(struct nbl_adapter *adapter)\n+{\n+\treturn nbl_dev_start(adapter);\n+}\n+\n+void nbl_core_stop(struct nbl_adapter *adapter)\n+{\n+\tnbl_dev_stop(adapter);\n+}\n+\n+struct nbl_adapter *nbl_core_init(struct pci_dev *pdev,\n+\t\t\t\t struct nbl_init_param *param)\n+{\n+\tstruct nbl_common_info *common;\n+\tstruct nbl_adapter *adapter;\n+\tint ret;\n+\n+\tadapter = devm_kzalloc(\u0026pdev-\u003edev, sizeof(*adapter), GFP_KERNEL);\n+\tif (!adapter)\n+\t\treturn ERR_PTR(-ENOMEM);\n+\n+\tadapter-\u003epdev = pdev;\n+\tcommon = \u0026adapter-\u003ecommon;\n+\n+\tcommon-\u003emgt_pf = 0;\n+\tcommon-\u003epdev = pdev;\n+\tcommon-\u003edev = \u0026pdev-\u003edev;\n+\tcommon-\u003ehas_ctrl = param-\u003ecaps.has_ctrl;\n+\tcommon-\u003ehas_net = param-\u003ecaps.has_net;\n+\tcommon-\u003efunction = PCI_FUNC(pdev-\u003edevfn);\n+\tcommon-\u003edevid = PCI_SLOT(pdev-\u003edevfn);\n+\tcommon-\u003ebus = pdev-\u003ebus-\u003enumber;\n+\n+\tret = nbl_hw_init_leonis(adapter);\n+\tif (ret)\n+\t\tgoto hw_init_fail;\n+\n+\tret = nbl_chan_init_common(adapter);\n+\tif (ret)\n+\t\tgoto chan_init_fail;\n+\n+\tret = nbl_res_init_leonis(adapter);\n+\tif (ret)\n+\t\tgoto res_init_fail;\n+\n+\tret = nbl_disp_init(adapter);\n+\tif (ret)\n+\t\tgoto disp_init_fail;\n+\n+\tret = nbl_dev_init(adapter);\n+\tif (ret)\n+\t\tgoto dev_init_fail;\n+\treturn adapter;\n+\n+dev_init_fail:\n+\tnbl_disp_remove(adapter);\n+disp_init_fail:\n+\tnbl_res_remove_leonis(adapter);\n+res_init_fail:\n+\tnbl_chan_remove_common(adapter);\n+chan_init_fail:\n+\tnbl_hw_remove_leonis(adapter);\n+hw_init_fail:\n+\treturn ERR_PTR(ret);\n+}\n+\n+void nbl_core_remove(struct nbl_adapter *adapter)\n+{\n+\tnbl_dev_remove(adapter);\n+\tnbl_disp_remove(adapter);\n+\tnbl_res_remove_leonis(adapter);\n+\tnbl_chan_remove_common(adapter);\n+\tnbl_hw_remove_leonis(adapter);\n+}\n+\n+static void nbl_get_func_param(struct pci_dev *pdev, kernel_ulong_t driver_data,\n+\t\t\t struct nbl_init_param *param)\n+{\n+\tparam-\u003ecaps.has_net = !!(driver_data \u0026 BIT(NBL_CAP_HAS_NET_BIT));\n+\n+\t/*\n+\t * Hardware fixed rule: physical PF0 is the only management PF with\n+\t * global ctrl capability. All PFs share identical PCI device ID, so\n+\t * distinguish control PF via physical function ID.\n+\t *\n+\t * Hardware \u0026 firmware design FORBID passing any PF through to virtual\n+\t * machines, there is no scenario where a non-management PF appears\n+\t * as Func 0 inside guest. Thus using PCI_FUNC(pdev-\u003edevfn) to identify\n+\t * control PF is safe on our platform.\n+\t */\n+\tif ((PCI_FUNC(pdev-\u003edevfn) == 0) \u0026\u0026 !pdev-\u003eis_virtfn)\n+\t\tparam-\u003ecaps.has_ctrl = 1;\n+}\n+\n+static int nbl_probe(struct pci_dev *pdev,\n+\t\t const struct pci_device_id *id)\n+{\n+\tstruct nbl_init_param param = { { 0 } };\n+\tstruct device *dev = \u0026pdev-\u003edev;\n+\tstruct nbl_adapter *adapter;\n+\tint err;\n+\n+\terr = pcim_enable_device(pdev);\n+\tif (err) {\n+\t\tdev_err(\u0026pdev-\u003edev, \"Failed to enable PCI dev, err=%d\\n\", err);\n+\t\treturn err;\n+\t}\n+\n+\tnbl_get_func_param(pdev, id-\u003edriver_data, \u0026param);\n+\t/* never return fail when DMA_BIT_MASK(64) */\n+\tdma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));\n+\n+\tpci_set_master(pdev);\n+\n+\tadapter = nbl_core_init(pdev, \u0026param);\n+\tif (IS_ERR(adapter)) {\n+\t\tdev_err(dev, \"Nbl adapter init fail: %pe\\n\", adapter);\n+\t\terr = PTR_ERR(adapter);\n+\t\tgoto adapter_init_err;\n+\t}\n+\tpci_set_drvdata(pdev, adapter);\n+\terr = nbl_core_start(adapter);\n+\tif (err)\n+\t\tgoto core_start_err;\n+\n+\treturn 0;\n+core_start_err:\n+\tnbl_core_remove(adapter);\n+adapter_init_err:\n+\tpci_clear_master(pdev);\n+\treturn err;\n+}\n+\n+static void nbl_remove(struct pci_dev *pdev)\n+{\n+\tstruct nbl_adapter *adapter = pci_get_drvdata(pdev);\n+\n+\tif (!adapter)\n+\t\treturn;\n+\tpci_set_drvdata(pdev, NULL);\n+\n+\tnbl_core_stop(adapter);\n+\tnbl_core_remove(adapter);\n+\n+\tpci_clear_master(pdev);\n+}\n+\n+/*\n+ * PCI Device IDs for Leonis/NBL Network Controllers\n+ *\n+ * Vendor ID: 0x1F0F\n+ * SNIC v3r1 product Device IDs range: 0x3403-0x3412\n+ */\n+#define NBL_VENDOR_ID\t\t\t\t0x1F0F\n+\n+#define NBL_DEVICE_ID_M18110\t\t\t0x3403\n+#define NBL_DEVICE_ID_M18110_LX\t\t\t0x3404\n+#define NBL_DEVICE_ID_M18110_BASE_T\t\t0x3405\n+#define NBL_DEVICE_ID_M18110_LX_BASE_T\t\t0x3406\n+#define NBL_DEVICE_ID_M18110_OCP\t\t0x3407\n+#define NBL_DEVICE_ID_M18110_LX_OCP\t\t0x3408\n+#define NBL_DEVICE_ID_M18110_BASE_T_OCP\t\t0x3409\n+#define NBL_DEVICE_ID_M18110_LX_BASE_T_OCP\t0x340a\n+#define NBL_DEVICE_ID_M18000\t\t\t0x340b\n+#define NBL_DEVICE_ID_M18000_LX\t\t\t0x340c\n+#define NBL_DEVICE_ID_M18000_BASE_T\t\t0x340d\n+#define NBL_DEVICE_ID_M18000_LX_BASE_T\t\t0x340e\n+#define NBL_DEVICE_ID_M18000_OCP\t\t0x340f\n+#define NBL_DEVICE_ID_M18000_LX_OCP\t\t0x3410\n+#define NBL_DEVICE_ID_M18000_BASE_T_OCP\t\t0x3411\n+#define NBL_DEVICE_ID_M18000_LX_BASE_T_OCP\t0x3412\n+\n+/* All below IDs belong to Leonis ASIC family, different form-factor variants,\n+ * share the same hardware initialization flow without differentiated ops.\n+ */\n+static const struct pci_device_id nbl_id_table[] = {\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_BASE_T),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX_BASE_T),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_BASE_T_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX_BASE_T_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_BASE_T),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX_BASE_T),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_BASE_T_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t{ PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX_BASE_T_OCP),\n+\t .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },\n+\t/* required as sentinel */\n+\t{ }\n+};\n+MODULE_DEVICE_TABLE(pci, nbl_id_table);\n+\n+static struct pci_driver nbl_driver = {\n+\t.name = NBL_DRIVER_NAME,\n+\t.id_table = nbl_id_table,\n+\t.probe = nbl_probe,\n+\t.remove = nbl_remove,\n+};\n+\n+module_pci_driver(nbl_driver);\n+\n+MODULE_LICENSE(\"GPL\");\n+MODULE_DESCRIPTION(\"Nebula Matrix Network Driver\");\n+MODULE_AUTHOR(\"Illusion Wang \u003cillusion.wang@nebula-matrix.com\u003e\");\n"
} |
| 2/1 | 2026/09/14 13:37 | agent | patch-evaluator |
2mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch series introduces a new PCIe driver for Nebula-matrix m18110/m18000 (SNIC s1000) series network interface cards. This hardware is a vendor-specific SmartNIC/ASIC that is not emulated in standard QEMU or GCE virtual environments, making the driver code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 6cac87f551af6462c516527ad541d6529cc40fef
Author: syz-cluster <triage@syzkaller.com>
Date: Mon Sep 14 13:37:26 2026 +0000
syz-cluster: applied patch under review
diff --git a/Documentation/networking/device_drivers/ethernet/index.rst b/Documentation/networking/device_drivers/ethernet/index.rst
index d9980c84487a5..403ae9c2b06a9 100644
--- a/Documentation/networking/device_drivers/ethernet/index.rst
+++ b/Documentation/networking/device_drivers/ethernet/index.rst
@@ -48,6 +48,7 @@ Contents:
meta/fbnic
microsoft/netvsc
mucse/rnpgbe
+ nebula-matrix/nbl
netronome/nfp
pensando/ionic
pensando/ionic_rdma
diff --git a/Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst b/Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst
new file mode 100644
index 0000000000000..5540291cf3766
--- /dev/null
+++ b/Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst
@@ -0,0 +1,28 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+================================================================
+Linux Base Driver for Nebula-matrix m18110-NIC/m18000-NIC family
+================================================================
+
+Overview:
+=========
+The m18110-NIC/m18000-NIC (marketed as SNIC s1000) is a series
+of network interface cards for the Data Center Area.
+
+This driver provides the core infrastructure for m18110/m18000-NIC
+devices, including:
+
+- PCI device enumeration and resource (BAR) management
+- Firmware command interface via PF mailbox
+- Channel-based communication between driver and firmware
+- Device initialization and teardown
+
+Support
+=======
+
+For more information about m18110-NIC/m18000-NIC, please visit the following URL:
+https://www.nebula-matrix.com/snic_s1000_en
+
+If an issue is identified with the released source code on the supported kernel
+with a supported adapter, email the specific information related to the issue to
+open@nebula-matrix.com.
diff --git a/MAINTAINERS b/MAINTAINERS
index 460cb72688450..ab55ba0da0a25 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -18654,6 +18654,16 @@ F: Documentation/devicetree/bindings/hwmon/nuvoton,nct7363.yaml
F: Documentation/hwmon/nct7363.rst
F: drivers/hwmon/nct7363.c
+NEBULA-MATRIX ETHERNET DRIVER (nebula-matrix)
+M: Illusion Wang <illusion.wang@nebula-matrix.com>
+M: Dimon Zhao <dimon.zhao@nebula-matrix.com>
+M: Alvin Wang <alvin.wang@nebula-matrix.com>
+M: Sam Chen <sam.chen@nebula-matrix.com>
+L: netdev@vger.kernel.org
+S: Maintained
+F: Documentation/networking/device_drivers/ethernet/nebula-matrix/
+F: drivers/net/ethernet/nebula-matrix/
+
NETCONSOLE
M: Breno Leitao <leitao@debian.org>
S: Maintained
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index 8581ccba1505e..c2b0161d0beca 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -130,6 +130,7 @@ config FEALNX
source "drivers/net/ethernet/ni/Kconfig"
source "drivers/net/ethernet/natsemi/Kconfig"
+source "drivers/net/ethernet/nebula-matrix/Kconfig"
source "drivers/net/ethernet/netronome/Kconfig"
source "drivers/net/ethernet/8390/Kconfig"
source "drivers/net/ethernet/nvidia/Kconfig"
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index 2b1153d35b52b..a306dae23bcb8 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -67,6 +67,7 @@ obj-$(CONFIG_NET_VENDOR_MUCSE) += mucse/
obj-$(CONFIG_NET_VENDOR_MYRI) += myricom/
obj-$(CONFIG_FEALNX) += fealnx.o
obj-$(CONFIG_NET_VENDOR_NATSEMI) += natsemi/
+obj-$(CONFIG_NET_VENDOR_NEBULA_MATRIX) += nebula-matrix/
obj-$(CONFIG_NET_VENDOR_NETRONOME) += netronome/
obj-$(CONFIG_NET_VENDOR_NI) += ni/
obj-$(CONFIG_NET_VENDOR_NVIDIA) += nvidia/
diff --git a/drivers/net/ethernet/nebula-matrix/Kconfig b/drivers/net/ethernet/nebula-matrix/Kconfig
new file mode 100644
index 0000000000000..dd0e91d14131f
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/Kconfig
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# Nebula-matrix network device configuration
+#
+
+config NET_VENDOR_NEBULA_MATRIX
+ bool "Nebula-matrix devices"
+ default y
+ help
+ If you have a network (Ethernet) card belonging to this class, say Y.
+ Note that the answer to this question doesn't directly affect the
+ kernel: saying N will just cause the configurator to skip all
+ the questions about Nebula-matrix cards. If you say Y, you will be asked
+ for your specific card in the following questions.
+
+if NET_VENDOR_NEBULA_MATRIX
+
+config NBL
+ tristate "Nebula-matrix Ethernet Controller m18110/m18000 support"
+ depends on PCI && (64BIT || COMPILE_TEST) && !CPU_BIG_ENDIAN
+ help
+ This driver provides the core infrastructure for Nebula-matrix
+ Ethernet Controller m18110/m18000 Family of devices, including
+ PCI enumeration, firmware mailbox and channel communication.
+
+ More specific information on configuring the driver is in
+ <file:Documentation/networking/device_drivers/ethernet/nebula-matrix/nbl.rst>.
+
+ To compile this driver as a module, choose M here. The module
+ will be called nbl.
+
+endif # NET_VENDOR_NEBULA_MATRIX
diff --git a/drivers/net/ethernet/nebula-matrix/Makefile b/drivers/net/ethernet/nebula-matrix/Makefile
new file mode 100644
index 0000000000000..42cdf2db8f0cf
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# Makefile for the Nebula-matrix network device drivers.
+#
+
+obj-$(CONFIG_NBL) += nbl/
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/Makefile b/drivers/net/ethernet/nebula-matrix/nbl/Makefile
new file mode 100644
index 0000000000000..71fbe3ee7e620
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/Makefile
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2026 Nebula Matrix Limited.
+
+obj-$(CONFIG_NBL) := nbl.o
+
+nbl-objs += nbl_common/nbl_common.o \
+ nbl_channel/nbl_channel.o \
+ nbl_hw/nbl_hw_leonis/nbl_hw_leonis.o \
+ nbl_hw/nbl_hw_leonis/nbl_resource_leonis.o \
+ nbl_hw/nbl_resource.o \
+ nbl_hw/nbl_interrupt.o \
+ nbl_hw/nbl_chip.o \
+ nbl_core/nbl_dispatch.o \
+ nbl_core/nbl_dev.o \
+ nbl_main.o
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.c
new file mode 100644
index 0000000000000..090a17b00dbbe
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.c
@@ -0,0 +1,1331 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/mutex.h>
+#include <linux/bitfield.h>
+#include <linux/pci.h>
+#include <linux/bits.h>
+#include <linux/dma-mapping.h>
+#include <linux/atomic.h>
+#include <linux/wait.h>
+#include "nbl_channel.h"
+
+static int nbl_chan_add_msg_handler(struct nbl_channel_mgt *chan_mgt,
+ u16 msg_type, nbl_chan_resp func,
+ void *priv)
+{
+ struct nbl_chan_msg_node_data handler = { 0 };
+ int ret;
+
+ handler.func = func;
+ handler.priv = priv;
+ ret = nbl_common_alloc_hash_node(chan_mgt->handle_hash_tbl, &msg_type,
+ &handler, NULL);
+
+ return ret;
+}
+
+static int nbl_chan_init_msg_handler(struct nbl_channel_mgt *chan_mgt)
+{
+ struct nbl_common_info *common = chan_mgt->common;
+ struct nbl_hash_tbl_key tbl_key = { 0 };
+
+ tbl_key.dev = common->dev;
+ tbl_key.key_size = sizeof(u16);
+ tbl_key.data_size = sizeof(struct nbl_chan_msg_node_data);
+ tbl_key.bucket_size = NBL_CHAN_HANDLER_TBL_BUCKET_SIZE;
+
+ chan_mgt->handle_hash_tbl = nbl_common_init_hash_table(&tbl_key);
+ if (!chan_mgt->handle_hash_tbl)
+ return -ENOMEM;
+
+ return 0;
+}
+
+static void nbl_chan_remove_msg_handler(struct nbl_channel_mgt *chan_mgt)
+{
+ if (!chan_mgt->handle_hash_tbl)
+ return;
+ nbl_common_remove_hash_table(chan_mgt->handle_hash_tbl);
+ chan_mgt->handle_hash_tbl = NULL;
+}
+
+static void nbl_chan_init_queue_param(struct nbl_chan_info *chan_info,
+ u16 num_txq_entries, u16 num_rxq_entries,
+ u16 txq_buf_size, u16 rxq_buf_size)
+{
+ chan_info->num_txq_entries = num_txq_entries;
+ chan_info->num_rxq_entries = num_rxq_entries;
+ chan_info->txq_buf_size = txq_buf_size;
+ chan_info->rxq_buf_size = rxq_buf_size;
+ atomic_set(&chan_info->inflight_tx_cnt, 0);
+ WRITE_ONCE(chan_info->shutdn, false);
+ WRITE_ONCE(chan_info->active, false);
+ WRITE_ONCE(chan_info->wait_head_index, 0);
+ memset(chan_info->state, 0, sizeof(chan_info->state));
+ init_waitqueue_head(&chan_info->inflight_wait);
+}
+
+static int nbl_chan_init_tx_queue(struct nbl_common_info *common,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_chan_ring *txq = &chan_info->txq;
+ struct device *dev = common->dev;
+ size_t size =
+ chan_info->num_txq_entries * sizeof(struct nbl_chan_tx_desc);
+ u16 i;
+
+ txq->desc.tx_desc =
+ dmam_alloc_coherent(dev, size, &txq->dma, GFP_KERNEL);
+ if (!txq->desc.tx_desc)
+ return -ENOMEM;
+
+ chan_info->wait = devm_kcalloc(dev, chan_info->num_txq_entries,
+ sizeof(*chan_info->wait), GFP_KERNEL);
+ if (!chan_info->wait)
+ return -ENOMEM;
+ for (i = 0; i < chan_info->num_txq_entries; i++) {
+ init_waitqueue_head(&chan_info->wait[i].wait_queue);
+ WRITE_ONCE(chan_info->wait[i].status, NBL_MBX_STATUS_IDLE);
+ WRITE_ONCE(chan_info->wait[i].acked, 0);
+ WRITE_ONCE(chan_info->wait[i].ack_data, NULL);
+ WRITE_ONCE(chan_info->wait[i].ack_data_len, 0);
+ WRITE_ONCE(chan_info->wait[i].ack_err, 0);
+ WRITE_ONCE(chan_info->wait[i].msg_type, 0);
+ WRITE_ONCE(chan_info->wait[i].msg_index, 0);
+ WRITE_ONCE(chan_info->wait[i].dstid, 0);
+ }
+
+ txq->buf = devm_kcalloc(dev, chan_info->num_txq_entries,
+ sizeof(*txq->buf), GFP_KERNEL);
+ if (!txq->buf)
+ return -ENOMEM;
+
+ return 0;
+}
+
+static int nbl_chan_init_rx_queue(struct nbl_common_info *common,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_chan_ring *rxq = &chan_info->rxq;
+ struct device *dev = common->dev;
+ size_t size =
+ chan_info->num_rxq_entries * sizeof(struct nbl_chan_rx_desc);
+
+ rxq->desc.rx_desc =
+ dmam_alloc_coherent(dev, size, &rxq->dma, GFP_KERNEL);
+ if (!rxq->desc.rx_desc) {
+ dev_err_ratelimited(dev,
+ "Allocate DMA for chan rx descriptor ring failed\n");
+ return -ENOMEM;
+ }
+
+ rxq->buf = devm_kcalloc(dev, chan_info->num_rxq_entries,
+ sizeof(*rxq->buf), GFP_KERNEL);
+ if (!rxq->buf)
+ return -ENOMEM;
+
+ return 0;
+}
+
+static int nbl_chan_init_queue(struct nbl_common_info *common,
+ struct nbl_chan_info *chan_info)
+{
+ int err;
+
+ err = nbl_chan_init_tx_queue(common, chan_info);
+ if (err)
+ return err;
+
+ err = nbl_chan_init_rx_queue(common, chan_info);
+
+ return err;
+}
+
+static void nbl_chan_config_queue(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info, bool tx)
+{
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+ struct nbl_hw_mgt *p = chan_mgt->hw_ops_tbl->priv;
+ struct nbl_chan_ring *ring;
+ dma_addr_t addr;
+ int size_bwid;
+
+ if (tx)
+ ring = &chan_info->txq;
+ else
+ ring = &chan_info->rxq;
+ addr = ring->dma;
+ if (tx) {
+ size_bwid = ilog2(chan_info->num_txq_entries);
+ hw_ops->config_mailbox_txq(p, addr, size_bwid);
+ } else {
+ size_bwid = ilog2(chan_info->num_rxq_entries);
+ hw_ops->config_mailbox_rxq(p, addr, size_bwid);
+ }
+}
+
+static int nbl_chan_alloc_all_tx_bufs(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_chan_ring *txq = &chan_info->txq;
+ struct device *dev = chan_mgt->common->dev;
+ struct nbl_chan_buf *buf;
+ u16 i;
+
+ for (i = 0; i < chan_info->num_txq_entries; i++) {
+ buf = &txq->buf[i];
+ buf->va = dmam_alloc_coherent(dev, chan_info->txq_buf_size,
+ &buf->pa, GFP_KERNEL);
+ if (!buf->va) {
+ dev_err_ratelimited(dev,
+ "Allocate buffer for chan tx queue failed\n");
+ return -ENOMEM;
+ }
+ }
+
+ txq->next_to_clean = 0;
+ txq->next_to_use = 0;
+ txq->tail_ptr = 0;
+
+ return 0;
+}
+
+static void nbl_chan_cfg_qinfo_map_table(struct nbl_channel_mgt *chan_mgt,
+ u8 bus, u8 devid)
+{
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+ struct nbl_hw_mgt *p = chan_mgt->hw_ops_tbl->priv;
+ u32 pf_mask = 0;
+ u8 func_id;
+
+ /*
+ * k_pf_mask rule: bit N == 0 means PF#N enabled, bit N == 1 masked out.
+ * Program mailbox QINFO entry for each hardware-active PF func_id.
+ *
+ * Note: This loop iterates over raw hardware PF func_id.
+ * Upper resource initialization nbl_res_init_pf_num() enforces
+ * product constraints: only 1/2/4 contiguous PFs(PF0 / PF0~1 / PF0~3)
+ * are allowed. Non-contiguous or unsupported PF count will be rejected
+ * before reaching this function.
+ */
+ hw_ops->get_host_pf_mask(p, &pf_mask);
+ for (func_id = 0; func_id < NBL_MAX_PF; func_id++) {
+ if (!(pf_mask & (1 << func_id)))
+ hw_ops->cfg_mailbox_qinfo(p, func_id, bus,
+ devid, func_id);
+ }
+}
+
+static int nbl_chan_alloc_all_rx_bufs(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_chan_ring *rxq = &chan_info->rxq;
+ struct device *dev = chan_mgt->common->dev;
+ struct nbl_chan_rx_desc *desc;
+ struct nbl_chan_buf *buf;
+ u16 i;
+
+ for (i = 0; i < chan_info->num_rxq_entries; i++) {
+ buf = &rxq->buf[i];
+ buf->va = dmam_alloc_coherent(dev, chan_info->rxq_buf_size,
+ &buf->pa, GFP_KERNEL);
+ if (!buf->va) {
+ dev_err_ratelimited(dev,
+ "Allocate buffer for chan rx queue failed\n");
+ goto err;
+ }
+ }
+
+ desc = rxq->desc.rx_desc;
+ /*
+ * Initially leave one RX descriptor unused so that
+ * next_to_clean and next_to_use can distinguish an empty
+ * ring from a full ring.
+ *
+ * The unused slot is replenished as RX descriptors are
+ * consumed and recycled.
+ */
+ for (i = 0; i < chan_info->num_rxq_entries - 1; i++) {
+ buf = &rxq->buf[i];
+ desc[i].buf_addr = cpu_to_le64(buf->pa);
+ desc[i].buf_len = cpu_to_le32(chan_info->rxq_buf_size);
+ desc[i].flags = cpu_to_le16(BIT(NBL_CHAN_RX_DESC_AVAIL));
+ }
+
+ rxq->next_to_clean = 0;
+ rxq->next_to_use = chan_info->num_rxq_entries - 1;
+ rxq->tail_ptr = chan_info->num_rxq_entries - 1;
+
+ return 0;
+err:
+ return -ENOMEM;
+}
+
+static int nbl_chan_alloc_all_bufs(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info)
+{
+ int err;
+
+ err = nbl_chan_alloc_all_tx_bufs(chan_mgt, chan_info);
+ if (err)
+ return err;
+ err = nbl_chan_alloc_all_rx_bufs(chan_mgt, chan_info);
+
+ return err;
+}
+
+static void nbl_chan_stop_queue(struct nbl_channel_mgt *chan_mgt)
+{
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+
+ hw_ops->stop_mailbox_rxq(chan_mgt->hw_ops_tbl->priv);
+ hw_ops->stop_mailbox_txq(chan_mgt->hw_ops_tbl->priv);
+}
+
+static int nbl_chan_teardown_queue(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type)
+{
+ struct nbl_chan_info *chan_info = chan_mgt->chan_info[chan_type];
+ struct nbl_chan_waitqueue_head *wait_head;
+ struct work_struct *task;
+ int ret = 0;
+ u16 i;
+
+ if (!READ_ONCE(chan_info->active)) {
+ dev_warn(chan_mgt->common->dev, "channel not active, skip duplicate teardown\n");
+ return 0;
+ }
+ /*
+ * Step1:
+ * block new sender
+ */
+ mutex_lock(&chan_info->state_lock);
+ WRITE_ONCE(chan_info->shutdn, true);
+ task = READ_ONCE(chan_info->clean_task);
+ WRITE_ONCE(chan_info->clean_task, NULL);
+ mutex_unlock(&chan_info->state_lock);
+ /*
+ * Step2:
+ * abort pending ACK waiters
+ */
+
+ mutex_lock(&chan_info->pending_lock);
+ for (i = 0; i < chan_info->num_txq_entries; i++) {
+ wait_head = &chan_info->wait[i];
+ /* Only wake threads that are actually waiting */
+ if (READ_ONCE(wait_head->status) == NBL_MBX_STATUS_WAITING) {
+ /* Update all status fields first */
+ WRITE_ONCE(wait_head->status, NBL_MBX_STATUS_TIMEOUT);
+ WRITE_ONCE(wait_head->ack_err, (s32)-EIO);
+ /* Ensure status visible before acked flag */
+ smp_wmb();
+ WRITE_ONCE(wait_head->acked, 1);
+ wake_up(&wait_head->wait_queue);
+ }
+ }
+ mutex_unlock(&chan_info->pending_lock);
+ /*
+ * Step3:
+ * wait all sender exit
+ *
+ * Drain strategy mirrors mlx5 command interface teardown:
+ * set shutdown flag first, abort all pending waiters, then
+ * block until inflight_tx_cnt reaches zero.
+ *
+ * A timeout here is treated as an exceptional condition rather
+ * than a fatal error, following the same rationale as mlx5:
+ * - shutdn is already set, so every sender path observes it
+ * at its next checkpoint and exits;
+ * - interrupt-driven senders have a 3s ACK wait
+ * (NBL_CHAN_ACK_WAIT_TIME); polling senders re-check shutdn
+ * on every 1-1.2ms iteration, so both exit promptly after
+ * shutdown is signaled rather than running to full timeout;
+ * - timeout is treated as an exceptional condition; callers
+ * must not access queue resources while an inflight sender
+ * may still be active;
+ * - in that hardware-dead case proceeding with teardown cannot
+ * make the situation worse, and avoids hanging rmmod forever.
+ */
+ ret = wait_event_timeout(chan_info->inflight_wait,
+ atomic_read(&chan_info->inflight_tx_cnt) == 0,
+ msecs_to_jiffies(5000));
+
+ if (!ret) {
+ dev_warn(chan_mgt->common->dev,
+ "teardown: inflight tx drain timeout\n");
+ ret = -ETIMEDOUT;
+ } else {
+ ret = 0;
+ }
+
+ /* After all TX drained, stop hardware queue */
+ nbl_chan_stop_queue(chan_mgt);
+
+ /* All send paths drained, safely cancel cleanup work */
+ if (task)
+ cancel_work_sync(task);
+ WRITE_ONCE(chan_info->active, false);
+ return ret;
+}
+
+static int nbl_chan_setup_queue(struct nbl_channel_mgt *chan_mgt, u8 chan_type)
+{
+ struct nbl_chan_info *chan_info = chan_mgt->chan_info[chan_type];
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+ struct nbl_common_info *common = chan_mgt->common;
+ struct nbl_chan_ring *rxq = &chan_info->rxq;
+ int err;
+
+ if (READ_ONCE(chan_info->active)) {
+ dev_warn(common->dev, "channel already active, reject duplicate setup\n");
+ return -EBUSY;
+ }
+ nbl_chan_init_queue_param(chan_info, NBL_CHAN_QUEUE_LEN,
+ NBL_CHAN_QUEUE_LEN, NBL_CHAN_BUF_LEN,
+ NBL_CHAN_BUF_LEN);
+ err = nbl_chan_init_queue(common, chan_info);
+ if (err)
+ return err;
+ err = nbl_chan_alloc_all_bufs(chan_mgt, chan_info);
+ if (err)
+ return err;
+ nbl_chan_config_queue(chan_mgt, chan_info, true); /* tx */
+ nbl_chan_config_queue(chan_mgt, chan_info, false); /* rx */
+ nbl_chan_update_tail_ptr(hw_ops, chan_mgt->hw_ops_tbl->priv,
+ rxq->tail_ptr, NBL_MB_RX_QID);
+ WRITE_ONCE(chan_info->active, true);
+ return 0;
+}
+
+static bool nbl_chan_txq_full(struct nbl_chan_ring *txq,
+ u16 num_entries)
+{
+ return NBL_NEXT_ID(txq->next_to_use, num_entries - 1) ==
+ txq->next_to_clean;
+}
+
+static int nbl_chan_update_txqueue(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info,
+ struct nbl_chan_tx_param *param)
+{
+ struct nbl_chan_ring *txq = &chan_info->txq;
+ struct nbl_chan_tx_desc *tx_desc;
+ struct nbl_chan_buf *tx_buf;
+
+ if (nbl_chan_txq_full(txq, chan_info->num_txq_entries))
+ return -EBUSY;
+ if (param->arg_len > NBL_CHAN_BUF_LEN - sizeof(*tx_desc))
+ return -EINVAL;
+ tx_desc =
+ NBL_CHAN_TX_RING_TO_DESC(txq, txq->next_to_use);
+ tx_buf =
+ NBL_CHAN_TX_RING_TO_BUF(txq, txq->next_to_use);
+ tx_desc->dstid = cpu_to_le16(param->dstid);
+ tx_desc->msg_type = cpu_to_le16(param->msg_type);
+ tx_desc->msgid = cpu_to_le16(param->msgid);
+
+ /*
+ * srcid field is filled by mailbox hardware after peer receives this
+ * packet, driver producer never writes srcid; reused descriptor slots
+ * will contain stale srcid value temporarily until hardware overwrites
+ * it.
+ */
+ if (param->arg_len > NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN) {
+ if (param->arg)
+ memcpy(tx_buf->va, param->arg, param->arg_len);
+ tx_desc->buf_addr = cpu_to_le64(tx_buf->pa);
+ tx_desc->buf_len = cpu_to_le16(param->arg_len);
+ tx_desc->data_len = 0;
+ memset(tx_desc->data, 0, sizeof(tx_desc->data));
+ } else {
+ memset(tx_desc->data, 0, sizeof(tx_desc->data));
+ memset(&tx_desc->buf_addr, 0, sizeof(tx_desc->buf_addr));
+ if (param->arg && param->arg_len > 0)
+ memcpy(tx_desc->data, param->arg, param->arg_len);
+ tx_desc->buf_len = 0;
+ tx_desc->data_len = cpu_to_le16(param->arg_len);
+ }
+ /* Ensure descriptor data visible to device before AVAIL flag */
+ dma_wmb();
+ tx_desc->flags = cpu_to_le16(BIT(NBL_CHAN_TX_DESC_AVAIL));
+
+ txq->next_to_use =
+ NBL_NEXT_ID(txq->next_to_use, chan_info->num_txq_entries - 1);
+ txq->tail_ptr++;
+
+ return 0;
+}
+
+/*
+ * Quiesce the TX mailbox queue and reclaim all outstanding
+ * descriptors. Called from the timeout path of nbl_chan_kick_tx_ring()
+ * with txq_lock held.
+ *
+ * The device failed to fetch/complete the current descriptor within the
+ * polling window. We assert QUEUE_RST to stop further DMA fetches,
+ * reclaim every descriptor between next_to_clean and next_to_use,
+ * reset the software tail_ptr counter to match the hardware reset state,
+ * and re-enable the queue so subsequent sends can proceed.
+ */
+static void nbl_chan_quiesce_and_reclaim_tx(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+ struct nbl_hw_mgt *hw_priv = chan_mgt->hw_ops_tbl->priv;
+ struct nbl_chan_ring *txq = &chan_info->txq;
+ struct nbl_chan_tx_desc *tx_desc;
+
+ /* Assert QUEUE_RST to stop hardware fetching new descriptors */
+ hw_ops->stop_mailbox_txq(hw_priv);
+ hw_ops->flush_write(hw_priv);
+
+ /*
+ * Reclaim all outstanding descriptors between next_to_clean and
+ * next_to_use. Under txq_lock there is at most one in-flight
+ * descriptor, but iterate the full range for robustness.
+ */
+ while (txq->next_to_clean != txq->next_to_use) {
+ tx_desc = NBL_CHAN_TX_RING_TO_DESC(txq,
+ txq->next_to_clean);
+ WRITE_ONCE(tx_desc->flags, 0);
+ txq->next_to_clean =
+ NBL_NEXT_ID(txq->next_to_clean,
+ chan_info->num_txq_entries - 1);
+ }
+
+ /*
+ * Hardware tail_ptr counter is cleared by QUEUE_RST. Reset
+ * software counter to match so the next doorbell update does
+ * not produce a false 16-bit wrap delta.
+ */
+ txq->tail_ptr = 0;
+ txq->next_to_use = 0;
+ txq->next_to_clean = 0;
+
+ /* Re-enable queue with current ring base and size */
+ nbl_chan_config_queue(chan_mgt, chan_info, true);
+}
+
+static int nbl_chan_kick_tx_ring(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+ struct nbl_chan_ring *txq = &chan_info->txq;
+ struct device *dev = chan_mgt->common->dev;
+ int max_retries = NBL_CHAN_TX_WAIT_TIMES;
+ struct nbl_chan_tx_desc *tx_desc;
+ int retry_count = 0;
+ u16 msg_type;
+
+ nbl_chan_update_tail_ptr(hw_ops, chan_mgt->hw_ops_tbl->priv,
+ txq->tail_ptr, NBL_MB_TX_QID);
+
+ tx_desc = NBL_CHAN_TX_RING_TO_DESC(txq, txq->next_to_clean);
+ /*
+ * Poll for HW to mark descriptor as USED.
+ * Mailbox is a low-speed control channel for management commands.
+ * We avoid enabling dedicated per-TX interrupt for single control
+ * message to reduce interrupt overhead, so use bounded polling
+ * with small delay instead.
+ */
+ while (retry_count < max_retries) {
+ if (READ_ONCE(chan_info->shutdn))
+ return -ESHUTDOWN;
+
+ if (le16_to_cpu(READ_ONCE(tx_desc->flags)) &
+ BIT(NBL_CHAN_TX_DESC_USED)) {
+ /*
+ * Order reads of other device-written descriptor
+ * fields after observing USED. Matches the RX side
+ * pattern in nbl_chan_clean_queue().
+ */
+ dma_rmb();
+ break;
+ }
+
+ retry_count++;
+ if (retry_count == max_retries) {
+ msg_type = le16_to_cpu(READ_ONCE(tx_desc->msg_type));
+ dev_err_ratelimited(dev, "chan send msg type: %d timeout\n",
+ msg_type);
+ /*
+ * Device failed to complete this descriptor.
+ * Quiesce the queue, reclaim the timed-out
+ * descriptor, and re-enable so future sends can
+ * proceed instead of stalling the ring full.
+ */
+ nbl_chan_quiesce_and_reclaim_tx(chan_mgt,
+ chan_info);
+ return -ETIMEDOUT;
+ }
+ usleep_range(NBL_CHAN_TX_WAIT_US, NBL_CHAN_TX_WAIT_US_MAX);
+ }
+
+ txq->next_to_clean = txq->next_to_use;
+
+ return 0;
+}
+
+static void nbl_chan_recv_ack_msg(void *priv, u16 srcid, u16 msgid, void *data,
+ u32 data_len)
+{
+ struct nbl_channel_mgt *chan_mgt = (struct nbl_channel_mgt *)priv;
+ struct nbl_chan_waitqueue_head *wait_head = NULL;
+ struct device *dev = chan_mgt->common->dev;
+ struct nbl_chan_info *chan_info =
+ chan_mgt->chan_info[NBL_CHAN_TYPE_MAILBOX];
+ u16 w_dstid, w_msgtype, w_msgidx;
+ u32 *payload = data;
+ u16 ack_msgtype = 0;
+ u16 ack_msgid = 0;
+ u32 ack_datalen;
+ void *ack_data;
+ u32 copy_len;
+ int w_status;
+ s32 raw_err;
+
+ if (READ_ONCE(chan_info->shutdn))
+ return;
+ if (data_len > NBL_CHAN_BUF_LEN ||
+ data_len < NBL_CHAN_ACK_HEAD_LEN * sizeof(u32)) {
+ dev_err_ratelimited(dev, "Invalid ACK data_len: %u\n",
+ data_len);
+ return;
+ }
+ ack_datalen = data_len - NBL_CHAN_ACK_HEAD_LEN * sizeof(u32);
+ ack_msgtype = le16_to_cpu(*(__le16 *)(payload + NBL_CHAN_MSG_TYPE_POS));
+ ack_msgid = le16_to_cpu(*(__le16 *)(payload + NBL_CHAN_MSG_ID_POS));
+ if (FIELD_GET(NBL_CHAN_MSGID_LOC_MASK, ack_msgid) >=
+ chan_info->num_txq_entries) {
+ dev_err_ratelimited(dev, "chan recv msg id: %u err\n",
+ ack_msgid);
+ return;
+ }
+ wait_head =
+ &chan_info->wait[FIELD_GET(NBL_CHAN_MSGID_LOC_MASK, ack_msgid)];
+
+ mutex_lock(&chan_info->pending_lock);
+
+ /* Cache repeated READ_ONCE values */
+ w_dstid = READ_ONCE(wait_head->dstid);
+ w_status = READ_ONCE(wait_head->status);
+ w_msgtype = READ_ONCE(wait_head->msg_type);
+ w_msgidx = READ_ONCE(wait_head->msg_index);
+
+ if (srcid != w_dstid) {
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev, "ACK srcid=%u != dstid=%u, rejecting\n",
+ srcid, w_dstid);
+ return;
+ }
+ if (w_status != NBL_MBX_STATUS_WAITING) {
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev,
+ "Skip ack invalid status, wait msgtype:%u idx:%u status:%d ack msgtype:%u msgid:%u datalen:%u\n",
+ w_msgtype, w_msgidx, w_status,
+ ack_msgtype, ack_msgid, ack_datalen);
+ return;
+ }
+
+ if (w_msgtype != ack_msgtype) {
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev,
+ "Skip ack msgtype mismatch, wait msgtype:%u idx:%u ack msgtype:%u msgid:%u\n",
+ w_msgtype, w_msgidx, ack_msgtype,
+ ack_msgid);
+ return;
+ }
+ if (FIELD_GET(NBL_CHAN_MSGID_INDEX_MASK, ack_msgid) != w_msgidx) {
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev,
+ "Stale ACK: expected index=%u, got msgid=%u\n",
+ w_msgidx, ack_msgid);
+ return;
+ }
+
+ raw_err = (s32)le32_to_cpu(*(__le32 *)&payload[NBL_CHAN_ACK_RET_POS]);
+ if (raw_err > 0 || raw_err < -MAX_ERRNO)
+ raw_err = -EREMOTEIO;
+
+ WRITE_ONCE(wait_head->ack_err, raw_err);
+
+ copy_len = min_t(u32, READ_ONCE(wait_head->ack_data_len), ack_datalen);
+ if (READ_ONCE(wait_head->ack_err) >= 0 && copy_len > 0) {
+ ack_data = READ_ONCE(wait_head->ack_data);
+ if (!ack_data) {
+ dev_err_ratelimited(dev, "ACK payload dropped: ack_data is NULL\n");
+ WRITE_ONCE(wait_head->ack_data_len, 0);
+ goto ack_done;
+ }
+ memcpy((char *)ack_data,
+ payload + NBL_CHAN_ACK_HEAD_LEN, copy_len);
+ WRITE_ONCE(wait_head->ack_data_len, (u16)copy_len);
+ } else {
+ WRITE_ONCE(wait_head->ack_data_len, 0);
+ }
+ack_done:
+ /* Guarantee payload data finished before acked flag visible */
+ smp_wmb();
+ WRITE_ONCE(wait_head->acked, 1);
+ WRITE_ONCE(wait_head->status, NBL_MBX_STATUS_ACKD);
+ mutex_unlock(&chan_info->pending_lock);
+ wake_up(&wait_head->wait_queue);
+}
+
+static void nbl_chan_recv_msg(struct nbl_channel_mgt *chan_mgt, void *data)
+{
+ struct device *dev = chan_mgt->common->dev;
+ struct nbl_chan_msg_node_data *msg_handler;
+ u16 msg_type, payload_len, srcid, msgid;
+ struct nbl_chan_info *chan_info =
+ chan_mgt->chan_info[NBL_CHAN_TYPE_MAILBOX];
+ struct nbl_chan_tx_desc *tx_desc;
+ void *payload;
+ size_t avail_space;
+ u16 data_len_fw;
+
+ if (READ_ONCE(chan_info->shutdn))
+ return;
+
+ tx_desc = data;
+ msg_type = le16_to_cpu(READ_ONCE(tx_desc->msg_type));
+ dev_dbg(dev, "recv msg_type: %d\n", msg_type);
+
+ srcid = le16_to_cpu(READ_ONCE(tx_desc->srcid));
+ msgid = le16_to_cpu(READ_ONCE(tx_desc->msgid));
+
+ if (msg_type >= NBL_CHAN_MSG_MAILBOX_MAX)
+ return;
+
+ data_len_fw = le16_to_cpu(READ_ONCE(tx_desc->data_len));
+ if (data_len_fw) {
+ payload_len = data_len_fw;
+
+ if (payload_len > NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN) {
+ dev_err_ratelimited(dev,
+ "data_len=%u exceeds embedded buffer size=%u\n",
+ payload_len,
+ NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN);
+ return;
+ }
+ /* Small pkt: payload stored inside descriptor data[] array */
+ payload = tx_desc->data;
+ } else {
+ payload_len = le16_to_cpu(READ_ONCE(tx_desc->buf_len));
+
+ avail_space = NBL_CHAN_BUF_LEN - sizeof(*tx_desc);
+ if (payload_len > avail_space) {
+ dev_err_ratelimited(dev,
+ "buf_len=%u exceeds external buffer size=%zu\n",
+ payload_len, avail_space);
+ return;
+ }
+ /* Large pkt: payload follows immediately after tx_desc */
+ payload = tx_desc + 1;
+ }
+
+ msg_handler = nbl_common_get_hash_node(chan_mgt->handle_hash_tbl,
+ &msg_type);
+ if (!msg_handler || !msg_handler->func) {
+ dev_err_ratelimited(dev,
+ "No handler for msg_type: %u (srcid=%u, msgid=%u)\n",
+ msg_type, srcid, msgid);
+ return;
+ }
+
+ msg_handler->func(msg_handler->priv, srcid, msgid, payload,
+ payload_len);
+}
+
+static void nbl_chan_advance_rx_ring(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info,
+ struct nbl_chan_ring *rxq)
+{
+ struct nbl_hw_ops *hw_ops = chan_mgt->hw_ops_tbl->ops;
+ struct nbl_chan_rx_desc *rx_desc;
+ struct nbl_chan_buf *rx_buf;
+ u16 next_to_use;
+
+ next_to_use = rxq->next_to_use;
+ rx_desc = NBL_CHAN_RX_RING_TO_DESC(rxq, next_to_use);
+ rx_buf = NBL_CHAN_RX_RING_TO_BUF(rxq, next_to_use);
+
+ /*
+ * Recycle the RX descriptor at next_to_use. The initial
+ * unused slot is intentionally recycled after the first
+ * RX descriptor is consumed, allowing the ring to become
+ * fully populated while next_to_clean tracks the consumer.
+ */
+ rx_desc->buf_addr = cpu_to_le64(rx_buf->pa);
+ rx_desc->buf_len = cpu_to_le32(chan_info->rxq_buf_size);
+
+ /*
+ * DMA Write Memory Barrier:
+ * Ensures all previous DMA-mapped writes (buffer address/length)
+ * are completed before the descriptor flags are updated.
+ * This prevents hardware from seeing a partially updated descriptor
+ * where flags are set but buffer info isn't ready yet.
+ */
+ dma_wmb();
+
+ rx_desc->flags = cpu_to_le16(BIT(NBL_CHAN_RX_DESC_AVAIL));
+
+ rxq->next_to_use++;
+ if (rxq->next_to_use == chan_info->num_rxq_entries)
+ rxq->next_to_use = 0;
+ rxq->tail_ptr++;
+
+ nbl_chan_update_tail_ptr(hw_ops, chan_mgt->hw_ops_tbl->priv,
+ rxq->tail_ptr, NBL_MB_RX_QID);
+}
+
+static void nbl_chan_clean_queue(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_info *chan_info)
+{
+ struct nbl_common_info *common = chan_mgt->common;
+ struct nbl_chan_ring *rxq = &chan_info->rxq;
+ struct device *dev = chan_mgt->common->dev;
+ u32 budget = NBL_CHAN_RX_CLEAN_BUDGET;
+ struct nbl_chan_rx_desc *rx_desc;
+ struct nbl_chan_buf *rx_buf;
+ struct work_struct *task;
+ bool more_work = false;
+ u16 next_to_clean;
+ u16 flags;
+
+ next_to_clean = rxq->next_to_clean;
+ rx_desc = NBL_CHAN_RX_RING_TO_DESC(rxq, next_to_clean);
+ rx_buf = NBL_CHAN_RX_RING_TO_BUF(rxq, next_to_clean);
+ while (le16_to_cpu(READ_ONCE(rx_desc->flags)) &
+ BIT(NBL_CHAN_RX_DESC_USED)) {
+ flags = le16_to_cpu(READ_ONCE(rx_desc->flags));
+
+ if (READ_ONCE(chan_info->shutdn))
+ break;
+ if (!(flags & BIT(NBL_CHAN_RX_DESC_WRITE)))
+ dev_dbg(dev,
+ "mailbox rx flag 0x%x missing NBL_CHAN_RX_DESC_WRITE\n",
+ flags);
+
+ /* Make sure hardware written descriptor visible to CPU */
+ dma_rmb();
+ nbl_chan_recv_msg(chan_mgt, rx_buf->va);
+ nbl_chan_advance_rx_ring(chan_mgt, chan_info, rxq);
+ next_to_clean++;
+ if (next_to_clean == chan_info->num_rxq_entries)
+ next_to_clean = 0;
+ rx_desc = NBL_CHAN_RX_RING_TO_DESC(rxq, next_to_clean);
+ rx_buf = NBL_CHAN_RX_RING_TO_BUF(rxq, next_to_clean);
+ if (--budget == 0) {
+ more_work = true;
+ break;
+ }
+ cond_resched();
+ }
+ rxq->next_to_clean = next_to_clean;
+
+ mutex_lock(&chan_info->state_lock);
+ /* Prevent queue_work after teardown clears clean_task */
+ if (READ_ONCE(chan_info->shutdn)) {
+ mutex_unlock(&chan_info->state_lock);
+ return;
+ }
+ if (common->wq && more_work) {
+ task = READ_ONCE(chan_info->clean_task);
+ if (task)
+ queue_work(common->wq, task);
+ }
+ mutex_unlock(&chan_info->state_lock);
+}
+
+static void nbl_chan_clean_queue_subtask(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type)
+{
+ struct nbl_chan_info *chan_info = chan_mgt->chan_info[chan_type];
+
+ nbl_chan_clean_queue(chan_mgt, chan_info);
+}
+
+static int nbl_chan_get_msg_id(struct nbl_chan_info *chan_info,
+ u16 *msgid)
+{
+ int search_loc = READ_ONCE(chan_info->wait_head_index), i;
+ struct nbl_chan_waitqueue_head *wait = NULL;
+ int status;
+ int next;
+
+ lockdep_assert_held(&chan_info->pending_lock);
+ for (i = 0; i < chan_info->num_txq_entries; i++) {
+ wait = &chan_info->wait[search_loc];
+ status = READ_ONCE(wait->status);
+ if (status == NBL_MBX_STATUS_IDLE ||
+ status == NBL_MBX_STATUS_TIMEOUT) {
+ WRITE_ONCE(wait->msg_index,
+ NBL_NEXT_ID(wait->msg_index,
+ NBL_CHAN_MSG_INDEX_MAX));
+
+ *msgid = FIELD_PREP(NBL_CHAN_MSGID_INDEX_MASK,
+ wait->msg_index) |
+ FIELD_PREP(NBL_CHAN_MSGID_LOC_MASK,
+ search_loc);
+
+ /* Advance starting search position for next caller */
+ next = NBL_NEXT_ID(search_loc,
+ chan_info->num_txq_entries - 1);
+ WRITE_ONCE(chan_info->wait_head_index, next);
+ return 0;
+ }
+
+ search_loc = NBL_NEXT_ID(search_loc,
+ chan_info->num_txq_entries - 1);
+ }
+
+ /*
+ * All tx slots are occupied. May happen under high transmit load
+ * or delayed remote ACK responses. Caller should retry later.
+ */
+ return -EAGAIN;
+}
+
+static void nbl_chan_reset_wait_head(struct nbl_chan_info *chan_info,
+ struct nbl_chan_waitqueue_head *wait_head)
+{
+ lockdep_assert_held(&chan_info->pending_lock);
+
+ WRITE_ONCE(wait_head->acked, 0);
+ WRITE_ONCE(wait_head->status, NBL_MBX_STATUS_IDLE);
+ WRITE_ONCE(wait_head->ack_data, NULL);
+ WRITE_ONCE(wait_head->ack_data_len, 0);
+ WRITE_ONCE(wait_head->ack_err, 0);
+ WRITE_ONCE(wait_head->msg_type, 0);
+ WRITE_ONCE(wait_head->dstid, 0);
+}
+
+static int nbl_chan_send_msg(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_send_info *chan_send)
+{
+ struct nbl_common_info *common = chan_mgt->common;
+ struct nbl_chan_waitqueue_head *wait_head = NULL;
+ struct nbl_chan_tx_param tx_param = { 0 };
+ int i = NBL_CHAN_TX_WAIT_ACK_TIMES;
+ struct nbl_chan_info *chan_info =
+ chan_mgt->chan_info[NBL_CHAN_TYPE_MAILBOX];
+ struct device *dev = common->dev;
+ struct work_struct *task;
+ u16 msgid = 0;
+ int ret;
+
+ if (chan_send->resp_len > NBL_CHAN_BUF_LEN) {
+ dev_err_ratelimited(dev, "resp_len %zu exceeds max %d\n",
+ chan_send->resp_len, NBL_CHAN_BUF_LEN);
+ return -EINVAL;
+ }
+
+ mutex_lock(&chan_info->state_lock);
+ if (READ_ONCE(chan_info->shutdn)) {
+ mutex_unlock(&chan_info->state_lock);
+ return -ESHUTDOWN;
+ }
+ atomic_inc(&chan_info->inflight_tx_cnt);
+ mutex_unlock(&chan_info->state_lock);
+
+ tx_param.msg_type = chan_send->msg_type;
+ tx_param.arg = chan_send->arg;
+ tx_param.arg_len = chan_send->arg_len;
+ tx_param.dstid = chan_send->dstid;
+ tx_param.msgid = msgid;
+ if (chan_send->ack) {
+ mutex_lock(&chan_info->pending_lock);
+
+ ret = nbl_chan_get_msg_id(chan_info, &msgid);
+ if (ret) {
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev,
+ "Channel tx wait head full, send msgtype:%u to dstid:%u failed\n",
+ chan_send->msg_type,
+ chan_send->dstid);
+ goto out_clean_inflight;
+ }
+ wait_head =
+ &chan_info->wait[FIELD_GET(NBL_CHAN_MSGID_LOC_MASK,
+ msgid)];
+ WRITE_ONCE(wait_head->acked, 0);
+ WRITE_ONCE(wait_head->ack_data, chan_send->resp);
+ WRITE_ONCE(wait_head->ack_data_len, chan_send->resp_len);
+ WRITE_ONCE(wait_head->msg_type, chan_send->msg_type);
+ WRITE_ONCE(wait_head->msg_index,
+ FIELD_GET(NBL_CHAN_MSGID_INDEX_MASK, msgid));
+ WRITE_ONCE(wait_head->dstid, chan_send->dstid);
+
+ WRITE_ONCE(wait_head->status, NBL_MBX_STATUS_WAITING);
+ mutex_unlock(&chan_info->pending_lock);
+
+ tx_param.msgid = msgid;
+ }
+
+ mutex_lock(&chan_info->txq_lock);
+ ret = nbl_chan_update_txqueue(chan_mgt, chan_info, &tx_param);
+ if (ret) {
+ mutex_unlock(&chan_info->txq_lock);
+ dev_err_ratelimited(dev,
+ "Channel tx queue full, send msgtype:%u to dstid:%u failed\n",
+ chan_send->msg_type, chan_send->dstid);
+ if (wait_head)
+ goto out_clear_wait_slot;
+ goto out_clean_inflight;
+ }
+
+ ret = nbl_chan_kick_tx_ring(chan_mgt, chan_info);
+ mutex_unlock(&chan_info->txq_lock);
+ if (ret) {
+ if (wait_head)
+ goto out_clear_wait_slot;
+ goto out_clean_inflight;
+ }
+
+ if (!chan_send->ack) {
+ ret = 0;
+ goto out_clean_inflight;
+ }
+
+ if (test_bit(NBL_CHAN_IRQ_RDY, chan_info->state)) {
+ while (!READ_ONCE(wait_head->acked)) {
+ /*
+ * avoids long task blocking when interrupt mode is
+ * disabled mid-wait. Cannot guarantee subsequent ACK
+ * delivery after interrupt mask off, only prevents
+ * infinite blocking. Spurious timeout is possible.
+ */
+ ret = wait_event_timeout(wait_head->wait_queue,
+ READ_ONCE(wait_head->acked) ||
+ READ_ONCE(chan_info->shutdn) ||
+ !test_bit(NBL_CHAN_IRQ_RDY,
+ chan_info->state),
+ NBL_CHAN_ACK_WAIT_TIME);
+
+ if (READ_ONCE(chan_info->shutdn)) {
+ ret = -ESHUTDOWN;
+ goto out_clear_wait_slot;
+ }
+ if (!test_bit(NBL_CHAN_IRQ_RDY, chan_info->state)) {
+ ret = -EIO;
+ goto out_clear_wait_slot;
+ }
+ if (ret == 0) {
+ mutex_lock(&chan_info->pending_lock);
+ if (READ_ONCE(wait_head->status) ==
+ NBL_MBX_STATUS_WAITING) {
+ WRITE_ONCE(wait_head->status,
+ NBL_MBX_STATUS_TIMEOUT);
+ WRITE_ONCE(wait_head->acked, 0);
+ WRITE_ONCE(wait_head->ack_data, NULL);
+ WRITE_ONCE(wait_head->ack_data_len, 0);
+ /*
+ * Ensure all status/ack slot
+ * updates are visible before subsequent
+ * readers observe acked == 0
+ */
+ smp_wmb();
+ }
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev,
+ "Channel waiting ack failed, message type: %d, msg id: %u\n",
+ chan_send->msg_type, msgid);
+ ret = -ETIMEDOUT;
+ /*
+ * TIMEOUT slots can be reused by another
+ * sender. The current sender no longer
+ * owns the slot after transitioning it to
+ * TIMEOUT.
+ */
+ goto out_clean_inflight;
+ }
+
+ if (READ_ONCE(wait_head->acked))
+ break;
+ }
+ if (READ_ONCE(wait_head->acked)) {
+ /*
+ * Load ordering: observe acked flag before
+ * reading ACK payload metadata.
+ */
+ smp_rmb();
+ chan_send->ack_len = READ_ONCE(wait_head->ack_data_len);
+ ret = READ_ONCE(wait_head->ack_err);
+ }
+ } else {
+ /* Polling path for synchronous ACK */
+ while (i--) {
+ if (READ_ONCE(chan_info->shutdn)) {
+ ret = -ESHUTDOWN;
+ goto out_clear_wait_slot;
+ }
+
+ mutex_lock(&chan_info->state_lock);
+ task = READ_ONCE(chan_info->clean_task);
+ if (common->wq && task &&
+ !READ_ONCE(chan_info->shutdn) &&
+ !work_pending(task))
+ queue_work(common->wq, task);
+ mutex_unlock(&chan_info->state_lock);
+ if (READ_ONCE(wait_head->acked)) {
+ /*
+ * Guarantee load order: observe acked
+ * flag before reading ack payload metadata.
+ */
+ smp_rmb();
+ chan_send->ack_len =
+ READ_ONCE(wait_head->ack_data_len);
+ ret = READ_ONCE(wait_head->ack_err);
+ goto out_clear_wait_slot;
+ }
+
+ usleep_range(NBL_CHAN_TX_WAIT_ACK_US_MIN,
+ NBL_CHAN_TX_WAIT_ACK_US_MAX);
+ cond_resched();
+ }
+ mutex_lock(&chan_info->pending_lock);
+ if (READ_ONCE(wait_head->status) == NBL_MBX_STATUS_ACKD) {
+ /* Ensure status load completes before ack payload/err
+ * loads.
+ */
+ smp_rmb();
+ chan_send->ack_len = READ_ONCE(wait_head->ack_data_len);
+ ret = READ_ONCE(wait_head->ack_err);
+ mutex_unlock(&chan_info->pending_lock);
+ goto out_clear_wait_slot;
+ }
+ mutex_unlock(&chan_info->pending_lock);
+ dev_err_ratelimited(dev,
+ "Channel polling ack failed, message type: %d msg id: %u\n",
+ chan_send->msg_type, msgid);
+ ret = -ETIMEDOUT;
+ }
+
+out_clear_wait_slot:
+ mutex_lock(&chan_info->pending_lock);
+ nbl_chan_reset_wait_head(chan_info, wait_head);
+ mutex_unlock(&chan_info->pending_lock);
+
+out_clean_inflight:
+ mutex_lock(&chan_info->state_lock);
+ if (atomic_dec_and_test(&chan_info->inflight_tx_cnt))
+ wake_up(&chan_info->inflight_wait);
+ mutex_unlock(&chan_info->state_lock);
+ return ret;
+}
+
+static int nbl_chan_send_ack(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_ack_info *chan_ack)
+{
+ size_t head_len = NBL_CHAN_ACK_HEAD_LEN * sizeof(u32);
+ size_t data_len = chan_ack->data_len;
+ struct nbl_chan_send_info chan_send;
+ __le32 *tmp;
+ size_t len;
+ int ret;
+
+ if (data_len >
+ NBL_CHAN_BUF_LEN - sizeof(struct nbl_chan_tx_desc) - head_len)
+ return -EINVAL;
+
+ len = head_len + data_len;
+ tmp = kzalloc(len, GFP_KERNEL);
+ if (!tmp)
+ return -ENOMEM;
+
+ *(__le16 *)&tmp[NBL_CHAN_MSG_TYPE_POS] =
+ cpu_to_le16(chan_ack->msg_type);
+ *(__le16 *)&tmp[NBL_CHAN_MSG_ID_POS] = cpu_to_le16(chan_ack->msgid);
+ tmp[NBL_CHAN_ACK_RET_POS] = cpu_to_le32(chan_ack->err);
+ if (chan_ack->data && chan_ack->data_len)
+ memcpy(&tmp[NBL_CHAN_ACK_HEAD_LEN], chan_ack->data,
+ chan_ack->data_len);
+
+ nbl_chan_fill_send_info(&chan_send, chan_ack->dstid, NBL_CHAN_MSG_ACK,
+ tmp, len, NULL, 0, 0);
+ ret = nbl_chan_send_msg(chan_mgt, &chan_send);
+ kfree(tmp);
+
+ return ret;
+}
+
+static int nbl_chan_register_msg(struct nbl_channel_mgt *chan_mgt, u16 msg_type,
+ nbl_chan_resp func, void *callback)
+{
+ return nbl_chan_add_msg_handler(chan_mgt, msg_type, func, callback);
+}
+
+static bool nbl_chan_check_queue_exist(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type)
+{
+ struct nbl_chan_info *chan_info = chan_mgt->chan_info[chan_type];
+
+ return chan_info ? true : false;
+}
+
+static void nbl_chan_register_chan_task(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type, struct work_struct *task)
+{
+ struct nbl_chan_info *chan_info = chan_mgt->chan_info[chan_type];
+
+ mutex_lock(&chan_info->state_lock);
+ if (!READ_ONCE(chan_info->shutdn))
+ WRITE_ONCE(chan_info->clean_task, task);
+ mutex_unlock(&chan_info->state_lock);
+}
+
+static void nbl_chan_set_queue_state(struct nbl_channel_mgt *chan_mgt,
+ enum nbl_chan_state state, u8 chan_type,
+ u8 set)
+{
+ struct nbl_chan_info *chan_info = chan_mgt->chan_info[chan_type];
+ int i;
+
+ if (set)
+ set_bit(state, chan_info->state);
+ else
+ clear_bit(state, chan_info->state);
+ /*
+ * When clearing IRQ_RDY, wake all per-slot wait queues so
+ * sleeping senders observe the condition immediately and
+ * return -EIO instead of waiting out the 3s timeout and
+ * reporting -ETIMEDOUT.
+ */
+ if (!set && state == NBL_CHAN_IRQ_RDY) {
+ for (i = 0; i < chan_info->num_txq_entries; i++)
+ wake_up_all(&chan_info->wait[i].wait_queue);
+ }
+}
+
+static struct nbl_channel_ops chan_ops = {
+ .send_msg = nbl_chan_send_msg,
+ .send_ack = nbl_chan_send_ack,
+ .register_msg = nbl_chan_register_msg,
+ .unregister_all_msg = nbl_chan_remove_msg_handler,
+ .cfg_chan_qinfo_map_table = nbl_chan_cfg_qinfo_map_table,
+ .check_queue_exist = nbl_chan_check_queue_exist,
+ .setup_queue = nbl_chan_setup_queue,
+ .teardown_queue = nbl_chan_teardown_queue,
+ .clean_queue_subtask = nbl_chan_clean_queue_subtask,
+ .register_chan_task = nbl_chan_register_chan_task,
+ .set_queue_state = nbl_chan_set_queue_state,
+};
+
+static struct nbl_channel_mgt *
+nbl_chan_setup_chan_mgt(struct nbl_adapter *adapter)
+{
+ struct nbl_hw_ops_tbl *hw_ops_tbl = adapter->intf.hw_ops_tbl;
+ struct nbl_common_info *common = &adapter->common;
+ struct device *dev = &adapter->pdev->dev;
+ struct nbl_channel_mgt *chan_mgt;
+ struct nbl_chan_info *mailbox;
+ int ret;
+
+ chan_mgt = devm_kzalloc(dev, sizeof(*chan_mgt), GFP_KERNEL);
+ if (!chan_mgt)
+ return ERR_PTR(-ENOMEM);
+
+ chan_mgt->common = common;
+ chan_mgt->hw_ops_tbl = hw_ops_tbl;
+
+ mailbox = devm_kzalloc(dev, sizeof(*mailbox), GFP_KERNEL);
+ if (!mailbox)
+ return ERR_PTR(-ENOMEM);
+ mailbox->chan_type = NBL_CHAN_TYPE_MAILBOX;
+ chan_mgt->chan_info[NBL_CHAN_TYPE_MAILBOX] = mailbox;
+
+ ret = nbl_chan_init_msg_handler(chan_mgt);
+ if (ret)
+ return ERR_PTR(ret);
+ ret = devm_mutex_init(common->dev, &mailbox->txq_lock);
+ if (ret)
+ return ERR_PTR(ret);
+ ret = devm_mutex_init(common->dev, &mailbox->state_lock);
+ if (ret)
+ return ERR_PTR(ret);
+ ret = devm_mutex_init(common->dev, &mailbox->pending_lock);
+ if (ret)
+ return ERR_PTR(ret);
+ return chan_mgt;
+}
+
+static struct nbl_channel_ops_tbl *
+nbl_chan_setup_ops(struct device *dev, struct nbl_channel_mgt *chan_mgt)
+{
+ struct nbl_channel_ops_tbl *chan_ops_tbl;
+ int ret;
+
+ chan_ops_tbl = devm_kzalloc(dev, sizeof(*chan_ops_tbl), GFP_KERNEL);
+ if (!chan_ops_tbl)
+ return ERR_PTR(-ENOMEM);
+ if (!chan_ops.send_msg || !chan_ops.send_ack ||
+ !chan_ops.register_msg || !chan_ops.unregister_all_msg ||
+ !chan_ops.cfg_chan_qinfo_map_table ||
+ !chan_ops.check_queue_exist || !chan_ops.setup_queue ||
+ !chan_ops.teardown_queue || !chan_ops.clean_queue_subtask ||
+ !chan_ops.register_chan_task || !chan_ops.set_queue_state)
+ return ERR_PTR(-EINVAL);
+
+ chan_ops_tbl->ops = &chan_ops;
+ chan_ops_tbl->priv = chan_mgt;
+
+ ret = nbl_chan_register_msg(chan_mgt, NBL_CHAN_MSG_ACK,
+ nbl_chan_recv_ack_msg, chan_mgt);
+ if (ret)
+ return ERR_PTR(ret);
+
+ return chan_ops_tbl;
+}
+
+int nbl_chan_init_common(struct nbl_adapter *adap)
+{
+ struct nbl_channel_ops_tbl *chan_ops_tbl;
+ struct device *dev = &adap->pdev->dev;
+ struct nbl_channel_mgt *chan_mgt;
+ int ret;
+
+ chan_mgt = nbl_chan_setup_chan_mgt(adap);
+ if (IS_ERR(chan_mgt)) {
+ ret = PTR_ERR(chan_mgt);
+ goto exit;
+ }
+
+ chan_ops_tbl = nbl_chan_setup_ops(dev, chan_mgt);
+ if (IS_ERR(chan_ops_tbl)) {
+ ret = PTR_ERR(chan_ops_tbl);
+ goto cleanup_mgt;
+ }
+
+ adap->intf.channel_ops_tbl = chan_ops_tbl;
+ adap->core.chan_mgt = chan_mgt;
+ ret = nbl_common_create_wq(&adap->common);
+ if (ret)
+ goto cleanup_mgt;
+ return 0;
+
+cleanup_mgt:
+ nbl_chan_remove_msg_handler(chan_mgt);
+exit:
+ return ret;
+}
+
+void nbl_chan_remove_common(struct nbl_adapter *adap)
+{
+ struct nbl_channel_mgt *chan_mgt = adap->core.chan_mgt;
+
+ if (!chan_mgt)
+ return;
+ nbl_common_destroy_wq(&adap->common);
+ /*
+ * All channel queues shall be torn down earlier in remove path
+ * to drain inflight tx workers and stop hardware before destroying
+ * message handler hash table.
+ */
+ nbl_chan_remove_msg_handler(chan_mgt);
+ adap->core.chan_mgt = NULL;
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.h
new file mode 100644
index 0000000000000..403a4d22111ba
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_channel.h
@@ -0,0 +1,171 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_CHANNEL_H_
+#define _NBL_CHANNEL_H_
+
+#include <linux/types.h>
+
+#include "../nbl_include/nbl_include.h"
+#include "../nbl_include/nbl_def_channel.h"
+#include "../nbl_include/nbl_def_hw.h"
+#include "../nbl_include/nbl_def_common.h"
+#include "../nbl_core.h"
+
+#define NBL_CHAN_TX_RING_TO_DESC(tx_ring, i) \
+ (&((((tx_ring)->desc.tx_desc))[i]))
+#define NBL_CHAN_RX_RING_TO_DESC(rx_ring, i) \
+ (&((((rx_ring)->desc.rx_desc))[i]))
+#define NBL_CHAN_TX_RING_TO_BUF(tx_ring, i) (&(((tx_ring)->buf)[i]))
+#define NBL_CHAN_RX_RING_TO_BUF(rx_ring, i) (&(((rx_ring)->buf)[i]))
+
+#define NBL_CHAN_TX_WAIT_US 100
+#define NBL_CHAN_TX_WAIT_US_MAX 120
+#define NBL_CHAN_TX_WAIT_TIMES 100
+#define NBL_CHAN_TX_WAIT_ACK_US_MIN 1000
+#define NBL_CHAN_TX_WAIT_ACK_US_MAX 1200
+#define NBL_CHAN_TX_WAIT_ACK_TIMES 5000
+#define NBL_CHAN_QUEUE_LEN 256
+#define NBL_CHAN_BUF_LEN 4096
+#define NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN 16
+
+#define NBL_CHAN_TX_DESC_AVAIL 0
+#define NBL_CHAN_TX_DESC_USED 1
+#define NBL_CHAN_RX_DESC_WRITE 1
+#define NBL_CHAN_RX_DESC_AVAIL 3
+#define NBL_CHAN_RX_DESC_USED 4
+
+#define NBL_CHAN_ACK_HEAD_LEN 3
+#define NBL_CHAN_ACK_RET_POS 2
+#define NBL_CHAN_MSG_ID_POS 1
+#define NBL_CHAN_MSG_TYPE_POS 0
+
+#define NBL_CHAN_ACK_WAIT_TIME (3 * HZ)
+#define NBL_CHAN_RX_CLEAN_BUDGET 64
+#define NBL_CHAN_HANDLER_TBL_BUCKET_SIZE 512
+
+enum {
+ NBL_MB_RX_QID = 0,
+ NBL_MB_TX_QID = 1,
+};
+
+enum {
+ NBL_MBX_STATUS_IDLE = 0,
+ NBL_MBX_STATUS_WAITING,
+ NBL_MBX_STATUS_ACKD,
+ NBL_MBX_STATUS_TIMEOUT,
+};
+
+struct nbl_chan_tx_param {
+ enum nbl_chan_msg_type msg_type;
+ void *arg;
+ size_t arg_len;
+ u16 dstid;
+ u16 msgid;
+};
+
+struct nbl_chan_buf {
+ void *va;
+ dma_addr_t pa;
+ size_t size;
+};
+
+struct nbl_chan_tx_desc {
+ __le16 flags;
+ __le16 srcid;
+ __le16 dstid;
+ __le16 data_len;
+ __le16 buf_len;
+ __le64 buf_addr;
+ __le16 msg_type;
+ u8 data[NBL_CHAN_TX_DESC_EMBEDDED_DATA_LEN];
+ __le16 msgid;
+ u8 rsv[26];
+} __packed;
+
+struct nbl_chan_rx_desc {
+ __le16 flags;
+ __le32 buf_len;
+ __le16 buf_id;
+ __le64 buf_addr;
+} __packed;
+
+union nbl_chan_desc_ptr {
+ struct nbl_chan_tx_desc *tx_desc;
+ struct nbl_chan_rx_desc *rx_desc;
+};
+
+struct nbl_chan_ring {
+ union nbl_chan_desc_ptr desc;
+ struct nbl_chan_buf *buf;
+ u16 next_to_use;
+ u16 tail_ptr; /* hardware does modulo ring size internally */
+ u16 next_to_clean;
+ dma_addr_t dma;
+};
+
+#define NBL_CHAN_MSG_INDEX_MAX 63
+
+#define NBL_CHAN_MSGID_INDEX_MASK GENMASK(5, 0)
+#define NBL_CHAN_MSGID_LOC_MASK GENMASK(13, 6)
+
+static inline void nbl_chan_update_tail_ptr(struct nbl_hw_ops *hw_ops,
+ void *hw_priv, u32 tail_ptr, u8 qid)
+{
+ hw_ops->update_mailbox_queue_tail_ptr(hw_priv, tail_ptr, qid);
+}
+
+struct nbl_chan_waitqueue_head {
+ struct wait_queue_head wait_queue;
+ char *ack_data;
+ int acked;
+ s32 ack_err;
+ u16 ack_data_len;
+ u16 msg_type;
+ int status;
+ u8 msg_index;
+ u16 dstid;
+};
+
+struct nbl_chan_info {
+ wait_queue_head_t inflight_wait;
+ struct nbl_chan_ring txq;
+ struct nbl_chan_ring rxq;
+ struct nbl_chan_waitqueue_head *wait;
+ /*
+ *Protects access to the TX queue (txq) and related metadata.
+ *This mutex ensures exclusive access when updating the TX queue
+ */
+ struct mutex txq_lock;
+ /* Guards channel state bitmap, active and shutdn flags */
+ struct mutex state_lock;
+ /* Guards pending requests and pending work list operations */
+ struct mutex pending_lock;
+ struct work_struct *clean_task;
+ u16 wait_head_index;
+ u16 num_txq_entries;
+ u16 num_rxq_entries;
+ u16 txq_buf_size;
+ u16 rxq_buf_size;
+ DECLARE_BITMAP(state, NBL_CHAN_STATE_NBITS);
+ u8 chan_type;
+ atomic_t inflight_tx_cnt;
+ bool shutdn;
+ bool active;
+};
+
+struct nbl_chan_msg_node_data {
+ nbl_chan_resp func;
+ void *priv;
+};
+
+struct nbl_channel_mgt {
+ struct nbl_common_info *common;
+ struct nbl_hw_ops_tbl *hw_ops_tbl;
+ struct nbl_chan_info *chan_info[NBL_CHAN_TYPE_MAX];
+ struct nbl_hash_tbl_mgt *handle_hash_tbl;
+};
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.c
new file mode 100644
index 0000000000000..597c11ed7fd8a
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.c
@@ -0,0 +1,231 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#include <linux/device.h>
+#include <linux/jhash.h>
+#include "nbl_common.h"
+
+void nbl_common_destroy_wq(struct nbl_common_info *common)
+{
+ if (!common || !common->wq)
+ return;
+
+ destroy_workqueue(common->wq);
+ common->wq = NULL;
+}
+
+int nbl_common_create_wq(struct nbl_common_info *common)
+{
+ char wq_name[32];
+
+ snprintf(wq_name, sizeof(wq_name), "nbl_wq_%s", pci_name(common->pdev));
+ common->wq = alloc_workqueue(wq_name, WQ_UNBOUND, 0);
+ if (!common->wq) {
+ dev_err(common->dev, "Failed to alloc workqueue %s\n", wq_name);
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
+/**
+ * nbl_common_func_id_to_rel_pf_id - convert absolute PF id to relative PF id
+ * @common: common device info
+ * @pf_id: absolute PF identifier
+ * @rel_pf_id: output relative pf id
+ *
+ * Leonis uses fixed mgt_pf = 0. Support future non-zero management PF.
+ *
+ * Return: 0 on success, -EINVAL on invalid arguments.
+ */
+int nbl_common_func_id_to_rel_pf_id(struct nbl_common_info *common, u32 pf_id,
+ u32 *rel_pf_id)
+{
+ if (!rel_pf_id)
+ return -EINVAL;
+
+ if (pf_id < common->mgt_pf)
+ return -EINVAL;
+ *rel_pf_id = pf_id - common->mgt_pf;
+ return 0;
+}
+
+static u32 nbl_common_calc_hash_key(void *key, u32 key_size, u32 bucket_size)
+{
+ u32 hash;
+
+ if (bucket_size == 0 || bucket_size == 1)
+ return 0;
+
+ hash = jhash(key, key_size, 0);
+
+ /* Use bitmask if bucket_size is a power of 2 */
+ if ((bucket_size & (bucket_size - 1)) == 0)
+ return hash & (bucket_size - 1);
+ return hash % bucket_size;
+}
+
+/**
+ * nbl_common_init_hash_table - initialize per-device hash table
+ * @key: hash table creation parameters
+ *
+ * Return: allocated tbl mgt pointer, NULL on failure.
+ */
+struct nbl_hash_tbl_mgt *
+nbl_common_init_hash_table(struct nbl_hash_tbl_key *key)
+{
+ struct nbl_hash_tbl_mgt *tbl_mgt;
+ u32 bucket_size;
+ u32 i;
+
+ tbl_mgt = devm_kzalloc(key->dev, sizeof(*tbl_mgt), GFP_KERNEL);
+ if (!tbl_mgt)
+ return NULL;
+
+ bucket_size = key->bucket_size;
+ tbl_mgt->hash = devm_kcalloc(key->dev, bucket_size,
+ sizeof(struct hlist_head), GFP_KERNEL);
+ if (!tbl_mgt->hash)
+ return NULL;
+
+ tbl_mgt->bucket_locks = devm_kcalloc(key->dev, bucket_size,
+ sizeof(spinlock_t), GFP_KERNEL);
+ if (!tbl_mgt->bucket_locks)
+ return NULL;
+
+ for (i = 0; i < bucket_size; i++) {
+ INIT_HLIST_HEAD(&tbl_mgt->hash[i]);
+ spin_lock_init(&tbl_mgt->bucket_locks[i]);
+ }
+
+ memcpy(&tbl_mgt->tbl_key, key, sizeof(tbl_mgt->tbl_key));
+ tbl_mgt->node_num = 0;
+
+ return tbl_mgt;
+}
+
+/**
+ * nbl_common_alloc_hash_node - insert handler node into hash table
+ * @tbl_mgt: hash table manager
+ * @key: match key (msg_type)
+ * @data: handler callback info
+ * @out_data: optional pointer to return allocated data ptr
+ *
+ * Caller context: process context for dynamic registration, init path safe.
+ * Protected by per-bucket spin_lock_bh to avoid race with concurrent lookup.
+ *
+ * Return: 0 on success, -ENOMEM on allocation failure.
+ */
+int nbl_common_alloc_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key,
+ void *data, void **out_data)
+{
+ struct nbl_hash_entry_node *hash_node;
+ u16 data_size;
+ u16 node_size;
+ u32 hash_val;
+ u16 key_size;
+
+ node_size = sizeof(*hash_node);
+ hash_node = kzalloc(node_size, GFP_KERNEL);
+ if (!hash_node)
+ return -ENOMEM;
+
+ key_size = tbl_mgt->tbl_key.key_size;
+ hash_node->key = kzalloc(key_size, GFP_KERNEL);
+ if (!hash_node->key)
+ goto alloc_key_failed;
+
+ data_size = tbl_mgt->tbl_key.data_size;
+ hash_node->data = kzalloc(data_size, GFP_KERNEL);
+ if (!hash_node->data)
+ goto alloc_data_failed;
+
+ memcpy(hash_node->key, key, key_size);
+ memcpy(hash_node->data, data, data_size);
+
+ hash_val = nbl_common_calc_hash_key(key, key_size,
+ tbl_mgt->tbl_key.bucket_size);
+
+ spin_lock_bh(&tbl_mgt->bucket_locks[hash_val]);
+ hlist_add_head(&hash_node->node, tbl_mgt->hash + hash_val);
+ tbl_mgt->node_num++;
+ spin_unlock_bh(&tbl_mgt->bucket_locks[hash_val]);
+
+ if (out_data)
+ *out_data = hash_node->data;
+
+ return 0;
+
+alloc_data_failed:
+ kfree(hash_node->key);
+alloc_key_failed:
+ kfree(hash_node);
+ return -ENOMEM;
+}
+
+/**
+ * nbl_common_get_hash_node - lookup handler from hash table
+ * @tbl_mgt: hash table manager
+ * @key: lookup key
+ *
+ * All accessors use spin_lock_bh so that process-context holders
+ * disable softirq and cannot deadlock against a concurrent softirq
+ * caller (e.g. NAPI RX path). Safe in both process and softirq
+ * context.
+ *
+ * Return: attached handler data if found, NULL otherwise.
+ */
+void *nbl_common_get_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key)
+{
+ struct nbl_hash_entry_node *hash_node;
+ struct hlist_head *head;
+ void *data = NULL;
+ u32 hash_val;
+ u16 key_size;
+
+ key_size = tbl_mgt->tbl_key.key_size;
+ hash_val = nbl_common_calc_hash_key(key, key_size,
+ tbl_mgt->tbl_key.bucket_size);
+ head = tbl_mgt->hash + hash_val;
+
+ spin_lock_bh(&tbl_mgt->bucket_locks[hash_val]);
+ hlist_for_each_entry(hash_node, head, node) {
+ if (!memcmp(hash_node->key, key, key_size)) {
+ data = hash_node->data;
+ break;
+ }
+ }
+ spin_unlock_bh(&tbl_mgt->bucket_locks[hash_val]);
+
+ return data;
+}
+
+/*
+ * Free all hash nodes in the table.
+ */
+void nbl_common_remove_hash_table(struct nbl_hash_tbl_mgt *tbl_mgt)
+{
+ struct nbl_hash_entry_node *hash_node;
+ struct hlist_node *safe_node;
+ struct hlist_head *head;
+ u32 i;
+
+ if (!tbl_mgt)
+ return;
+
+ for (i = 0; i < tbl_mgt->tbl_key.bucket_size; i++) {
+ head = tbl_mgt->hash + i;
+
+ spin_lock_bh(&tbl_mgt->bucket_locks[i]);
+ hlist_for_each_entry_safe(hash_node, safe_node, head, node) {
+ hlist_del(&hash_node->node);
+ tbl_mgt->node_num--;
+ kfree(hash_node->key);
+ kfree(hash_node->data);
+ kfree(hash_node);
+ }
+ spin_unlock_bh(&tbl_mgt->bucket_locks[i]);
+ }
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.h
new file mode 100644
index 0000000000000..159421e53902c
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_common/nbl_common.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_COMMON_H_
+#define _NBL_COMMON_H_
+
+#include <linux/types.h>
+
+#include "../nbl_include/nbl_include.h"
+#include "../nbl_include/nbl_def_common.h"
+
+struct nbl_hash_tbl_mgt {
+ struct nbl_hash_tbl_key tbl_key;
+ struct hlist_head *hash;
+ /**
+ * bucket_locks: per-bucket spinlock array
+ * Each hash bucket corresponds to an independent spinlock.
+ * Protects concurrent hash list modification
+ */
+ spinlock_t *bucket_locks;
+ u16 node_num;
+};
+
+struct nbl_hash_entry_node {
+ struct hlist_node node;
+ void *key;
+ void *data;
+};
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core.h
new file mode 100644
index 0000000000000..56872c8ca9a7e
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_CORE_H_
+#define _NBL_CORE_H_
+
+#include <linux/pci.h>
+#include "nbl_include/nbl_include.h"
+#include "nbl_include/nbl_def_common.h"
+
+enum {
+ NBL_CAP_HAS_NET_BIT,
+};
+
+struct nbl_interface {
+ struct nbl_hw_ops_tbl *hw_ops_tbl;
+ struct nbl_resource_ops_tbl *resource_ops_tbl;
+ struct nbl_dispatch_ops_tbl *dispatch_ops_tbl;
+ struct nbl_channel_ops_tbl *channel_ops_tbl;
+};
+
+struct nbl_core {
+ struct nbl_hw_mgt *hw_mgt;
+ struct nbl_resource_mgt *res_mgt;
+ struct nbl_dispatch_mgt *disp_mgt;
+ struct nbl_dev_mgt *dev_mgt;
+ struct nbl_channel_mgt *chan_mgt;
+};
+
+struct nbl_adapter {
+ struct pci_dev *pdev;
+ struct nbl_core core;
+ struct nbl_interface intf;
+ struct nbl_common_info common;
+};
+
+struct nbl_adapter *nbl_core_init(struct pci_dev *pdev,
+ struct nbl_init_param *param);
+void nbl_core_remove(struct nbl_adapter *adapter);
+int nbl_core_start(struct nbl_adapter *adapter);
+void nbl_core_stop(struct nbl_adapter *adapter);
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c
new file mode 100644
index 0000000000000..e9b0576de0f30
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c
@@ -0,0 +1,571 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/device.h>
+#include <linux/pci.h>
+#include "nbl_dev.h"
+
+static void nbl_dev_clean_mailbox_schedule(struct nbl_dev_mgt *dev_mgt);
+
+/* ---------- Interrupt config ---------- */
+static irqreturn_t nbl_dev_clean_mailbox(int irq __always_unused, void *data)
+{
+ struct nbl_dev_mgt *dev_mgt = (struct nbl_dev_mgt *)data;
+
+ nbl_dev_clean_mailbox_schedule(dev_mgt);
+ return IRQ_HANDLED;
+}
+
+static void nbl_dev_init_msix_cnt(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+
+ /* mailbox vector allocated in nbl_dev_start() via
+ * nbl_dev_init_interrupt_scheme(); nbl_dev_request_mailbox_irq()
+ * only attaches the irq handler to pre-allocated vectors.
+ */
+ msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].num = 1;
+}
+
+static int nbl_dev_request_mailbox_irq(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+ struct nbl_common_info *common = dev_mgt->common;
+ u16 lvec;
+ int irq_num;
+ int err;
+
+ if (!msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].num)
+ return 0;
+
+ lvec = msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;
+ irq_num = pci_irq_vector(common->pdev, lvec);
+ if (irq_num < 0) {
+ dev_err(common->dev, "Failed to get mailbox IRQ vector: %d\n",
+ irq_num);
+ return irq_num;
+ }
+
+ snprintf(dev_common->mailbox_name, sizeof(dev_common->mailbox_name),
+ "nbl_mailbox@pci:%s", pci_name(common->pdev));
+ err = request_irq(irq_num, nbl_dev_clean_mailbox, 0,
+ dev_common->mailbox_name, dev_mgt);
+ if (err)
+ return err;
+
+ return 0;
+}
+
+static void nbl_dev_free_mailbox_irq(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+ struct nbl_common_info *common = dev_mgt->common;
+ u16 lvec;
+ int irq_num;
+
+ if (!msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].num)
+ return;
+
+ lvec = msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;
+ irq_num = pci_irq_vector(common->pdev, lvec);
+ if (irq_num >= 0)
+ free_irq(irq_num, dev_mgt);
+}
+
+static int nbl_dev_enable_mailbox_irq(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+ u16 lvec;
+ int ret;
+
+ if (!msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].num)
+ return 0;
+
+ lvec = msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;
+ /*
+ * Enable sequence: perform set_mailbox_irq RPC in polling mode first.
+ * Only set NBL_CHAN_IRQ_RDY after RPC succeeds, mirroring disable path.
+ * This avoids waiting for an interrupt which has not been armed yet.
+ */
+ ret = disp_ops->set_mailbox_irq(dev_mgt->disp_ops_tbl->priv,
+ lvec, true);
+ if (ret)
+ return ret;
+ chan_ops->set_queue_state(dev_mgt->chan_ops_tbl->priv,
+ NBL_CHAN_IRQ_RDY,
+ NBL_CHAN_TYPE_MAILBOX, true);
+ return 0;
+}
+
+static int nbl_dev_disable_mailbox_irq(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+ u16 lvec;
+
+ if (!msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].num)
+ return 0;
+
+ lvec = msix_info->serv_info[NBL_MSIX_MAILBOX_TYPE].base_vector_id;
+ /*
+ * Disable sequence invariant: update software state first, then mask
+ * hardware interrupt. Must not reverse the order.
+ *
+ * If hardware interrupt is masked before clearing INTERRUPT_READY,
+ * the hardware may still transmit outstanding ACK packets for in-flight
+ * messages. Subsequent switch to polling mode discards pending ACK
+ * processing, triggering "Channel waiting ack failed" and "Skip ack
+ * with invalid status" errors.
+ *
+ * By entering polling mode first, any late hardware interrupts are
+ * ignored without pending ACK expectations, then hardware interrupt
+ * can be safely disabled.
+ *
+ * This helper is invoked in two paths:
+ * 1. Error unwind path of nbl_dev_start(): followed immediately by
+ * nbl_dev_free_mailbox_irq() and full channel teardown. No new mailbox
+ * interrupts can fire afterwards, and subsequent cancel_work_sync()
+ * drains pending cleanup work before resources are released.
+ * 2. Normal device stop path nbl_dev_stop(): free_irq() blocks until
+ * any in-flight hardirq handler completes and prevents new interrupts.
+ * cancel_work_sync() then waits for any already running mailbox cleanup
+ * work to finish, or cancels queued but unstarted work items before
+ * final channel destruction. No stuck descriptors linger in either
+ * scenario.
+ */
+ chan_ops->set_queue_state(dev_mgt->chan_ops_tbl->priv,
+ NBL_CHAN_IRQ_RDY,
+ NBL_CHAN_TYPE_MAILBOX, false);
+
+ return disp_ops->set_mailbox_irq(dev_mgt->disp_ops_tbl->priv,
+ lvec, false);
+}
+
+static int nbl_dev_cfg_msix_map(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+ bool mask_en = msix_info->serv_info[NBL_MSIX_NET_TYPE].hw_self_mask_en;
+ u16 msix_net_num = msix_info->serv_info[NBL_MSIX_NET_TYPE].num;
+ u16 msix_not_net_num = 0;
+ int err, i;
+
+ msix_info->serv_info[NBL_MSIX_NET_TYPE].base_vector_id = 0;
+ /*
+ * Calculate base_vector_id for each MSIX service type.
+ * This relies on NBL_MSIX_TYPE enum being ordered sequentially,
+ * starting from NBL_MSIX_NET_TYPE.
+ */
+ for (i = NBL_MSIX_NET_TYPE + 1; i < NBL_MSIX_TYPE_MAX; i++)
+ msix_info->serv_info[i].base_vector_id =
+ msix_info->serv_info[i - 1].base_vector_id +
+ msix_info->serv_info[i - 1].num;
+
+ for (i = 0; i < NBL_MSIX_TYPE_MAX; i++) {
+ if (i == NBL_MSIX_NET_TYPE)
+ continue;
+ msix_not_net_num += msix_info->serv_info[i].num;
+ }
+
+ err = disp_ops->cfg_msix_map(dev_mgt->disp_ops_tbl->priv,
+ msix_net_num, msix_not_net_num,
+ mask_en);
+
+ return err;
+}
+
+static int nbl_dev_destroy_msix_map(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+
+ return disp_ops->destroy_msix_map(dev_mgt->disp_ops_tbl->priv);
+}
+
+static int nbl_dev_init_interrupt_scheme(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dev_common *dev_common = dev_mgt->common_dev;
+ struct nbl_msix_info *msix_info = &dev_common->msix_info;
+ struct nbl_common_info *common = dev_mgt->common;
+ int needed = 0;
+ int err;
+ int i;
+
+ for (i = 0; i < NBL_MSIX_TYPE_MAX; i++)
+ needed += msix_info->serv_info[i].num;
+
+ err = pci_alloc_irq_vectors(common->pdev, needed, needed,
+ PCI_IRQ_MSIX | PCI_IRQ_AFFINITY);
+ if (err < 0) {
+ dev_err(common->dev,
+ "pci_alloc_irq_vectors failed, err = %d\n", err);
+ return err;
+ }
+ if (err != needed) {
+ dev_err(common->dev, "pci_alloc_irq_vectors got %d vecs, need %d\n",
+ err, needed);
+ return -ENOSPC;
+ }
+ return 0;
+}
+
+static void nbl_dev_clear_interrupt_scheme(struct nbl_dev_mgt *dev_mgt)
+{
+ /*
+ * pcim_enable_device() is used in nbl_probe().
+ * pci_alloc_irq_vectors() registers pcim_msi_release devres callback,
+ * which invokes pci_free_irq_vectors() automatically on device detach.
+ * Do NOT call pci_free_irq_vectors() explicitly here to avoid
+ * double-free.
+ */
+}
+
+/* ---------- Channel config ---------- */
+static void nbl_dev_setup_chan_qinfo(struct nbl_dev_mgt *dev_mgt, u8 chan_type)
+{
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+ struct nbl_channel_mgt *priv = dev_mgt->chan_ops_tbl->priv;
+ struct nbl_common_info *common = dev_mgt->common;
+
+ if (!chan_ops->check_queue_exist(priv, chan_type))
+ return;
+
+ chan_ops->cfg_chan_qinfo_map_table(priv, common->hw_bus, common->devid);
+}
+
+static int nbl_dev_setup_chan_queue(struct nbl_dev_mgt *dev_mgt, u8 chan_type)
+{
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+ struct nbl_channel_mgt *priv = dev_mgt->chan_ops_tbl->priv;
+ int ret = 0;
+
+ if (chan_ops->check_queue_exist(priv, chan_type))
+ ret = chan_ops->setup_queue(priv, chan_type);
+
+ return ret;
+}
+
+static int nbl_dev_remove_chan_queue(struct nbl_dev_mgt *dev_mgt, u8 chan_type)
+{
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+ struct nbl_channel_mgt *priv = dev_mgt->chan_ops_tbl->priv;
+ int ret = 0;
+
+ if (chan_ops->check_queue_exist(priv, chan_type))
+ ret = chan_ops->teardown_queue(priv, chan_type);
+
+ return ret;
+}
+
+static void nbl_dev_register_chan_task(struct nbl_dev_mgt *dev_mgt,
+ u8 chan_type, struct work_struct *task)
+{
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+
+ if (chan_ops->check_queue_exist(dev_mgt->chan_ops_tbl->priv, chan_type))
+ chan_ops->register_chan_task(dev_mgt->chan_ops_tbl->priv,
+ chan_type, task);
+}
+
+/* ---------- Tasks config ---------- */
+static void nbl_dev_clean_mailbox_task(struct work_struct *work)
+{
+ struct nbl_dev_common *common_dev =
+ container_of(work, struct nbl_dev_common, clean_mbx_task);
+ struct nbl_dev_mgt *dev_mgt = common_dev->dev_mgt;
+ struct nbl_channel_ops *chan_ops = dev_mgt->chan_ops_tbl->ops;
+
+ chan_ops->clean_queue_subtask(dev_mgt->chan_ops_tbl->priv,
+ NBL_CHAN_TYPE_MAILBOX);
+}
+
+static void nbl_dev_clean_mailbox_schedule(struct nbl_dev_mgt *dev_mgt)
+{
+ struct nbl_dev_common *common_dev = dev_mgt->common_dev;
+ struct nbl_common_info *common = dev_mgt->common;
+
+ queue_work(common->wq, &common_dev->clean_mbx_task);
+}
+
+/* ---------- Dev init process ---------- */
+static int nbl_dev_setup_common_dev(struct nbl_adapter *adapter)
+{
+ struct nbl_dev_mgt *dev_mgt = adapter->core.dev_mgt;
+ struct nbl_dev_common *common_dev;
+ int ret;
+
+ common_dev = devm_kzalloc(&adapter->pdev->dev, sizeof(*common_dev),
+ GFP_KERNEL);
+ if (!common_dev)
+ return -ENOMEM;
+ common_dev->dev_mgt = dev_mgt;
+
+ ret = nbl_dev_setup_chan_queue(dev_mgt, NBL_CHAN_TYPE_MAILBOX);
+ if (ret)
+ goto err_cleanup;
+
+ INIT_WORK(&common_dev->clean_mbx_task, nbl_dev_clean_mailbox_task);
+ nbl_dev_register_chan_task(dev_mgt, NBL_CHAN_TYPE_MAILBOX,
+ &common_dev->clean_mbx_task);
+ /*
+ * VSI/ETH identity fetch moved to nbl_dev_start().
+ * This avoids cross-PF probe race when manager PF is not ready.
+ */
+ dev_mgt->common_dev = common_dev;
+ nbl_dev_init_msix_cnt(dev_mgt);
+
+ return 0;
+err_cleanup:
+ cancel_work_sync(&common_dev->clean_mbx_task);
+ nbl_dev_remove_chan_queue(dev_mgt, NBL_CHAN_TYPE_MAILBOX);
+ nbl_dev_register_chan_task(dev_mgt, NBL_CHAN_TYPE_MAILBOX, NULL);
+ return ret;
+}
+
+static void nbl_dev_remove_common_dev(struct nbl_adapter *adapter)
+{
+ struct nbl_dev_mgt *dev_mgt = adapter->core.dev_mgt;
+ struct nbl_dev_common *common_dev = dev_mgt->common_dev;
+
+ if (!common_dev)
+ return;
+ cancel_work_sync(&common_dev->clean_mbx_task);
+ nbl_dev_remove_chan_queue(dev_mgt, NBL_CHAN_TYPE_MAILBOX);
+ nbl_dev_register_chan_task(dev_mgt, NBL_CHAN_TYPE_MAILBOX, NULL);
+}
+
+static int nbl_dev_setup_ctrl_dev(struct nbl_adapter *adapter)
+{
+ struct nbl_dev_mgt *dev_mgt = adapter->core.dev_mgt;
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+ int ret;
+
+ ret = disp_ops->init_module(dev_mgt->disp_ops_tbl->priv);
+ if (ret)
+ return ret;
+
+ nbl_dev_setup_chan_qinfo(dev_mgt, NBL_CHAN_TYPE_MAILBOX);
+
+ return 0;
+}
+
+/*
+ * Tear down control device: deinit_module sets driver_status=false
+ * to notify firmware to clean all per-PF hardware state (including
+ * qinfo registers). The qinfo map programmed in setup_ctrl_dev is
+ * not explicitly cleared; firmware handles it on driver_status change.
+ *
+ * NOTE: Firmware clears chip-global qinfo routing entries when control PF
+ * deinit runs. MUST unbind all sibling non-control PFs on the same chip
+ * BEFORE unbinding the control PF. Unbinding control PF while siblings are
+ * still bound will leave those sibling PFs with broken mailbox RPC,
+ * causing RPC ACK timeouts. This operation sequence is NOT supported.
+ */
+static void nbl_dev_remove_ctrl_dev(struct nbl_adapter *adapter)
+{
+ struct nbl_dev_mgt *dev_mgt = adapter->core.dev_mgt;
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+
+ disp_ops->deinit_module(dev_mgt->disp_ops_tbl->priv);
+}
+
+static struct nbl_dev_mgt *nbl_dev_setup_dev_mgt(struct nbl_common_info *common)
+{
+ struct nbl_dev_mgt *dev_mgt;
+
+ dev_mgt = devm_kzalloc(common->dev, sizeof(*dev_mgt), GFP_KERNEL);
+ if (!dev_mgt)
+ return ERR_PTR(-ENOMEM);
+
+ dev_mgt->common = common;
+ return dev_mgt;
+}
+
+int nbl_dev_init(struct nbl_adapter *adapter)
+{
+ struct nbl_common_info *common = &adapter->common;
+ struct nbl_dispatch_ops_tbl *disp_ops_tbl =
+ adapter->intf.dispatch_ops_tbl;
+ struct nbl_channel_ops_tbl *chan_ops_tbl =
+ adapter->intf.channel_ops_tbl;
+ struct nbl_dev_mgt *dev_mgt;
+ int ret;
+
+ dev_mgt = nbl_dev_setup_dev_mgt(common);
+ if (IS_ERR(dev_mgt)) {
+ ret = PTR_ERR(dev_mgt);
+ return ret;
+ }
+
+ dev_mgt->disp_ops_tbl = disp_ops_tbl;
+ dev_mgt->chan_ops_tbl = chan_ops_tbl;
+ adapter->core.dev_mgt = dev_mgt;
+
+ /*
+ * Chip hardware initialization is completed by firmware at power-up.
+ * Only driver functional table/register config follows here, safe to
+ * access hardware registers before ctrl dev setup.
+ */
+ ret = nbl_dev_setup_common_dev(adapter);
+ if (ret)
+ goto setup_err;
+
+ if (common->has_ctrl) {
+ ret = nbl_dev_setup_ctrl_dev(adapter);
+ if (ret)
+ goto setup_ctrl_dev_fail;
+ }
+
+ return 0;
+setup_ctrl_dev_fail:
+ nbl_dev_remove_common_dev(adapter);
+setup_err:
+ return ret;
+}
+
+/*
+ * Teardown order: Stop mailbox channel and drain all inflight DMA first,
+ * then invoke deinit_module to notify firmware.
+ *
+ * This intentionally breaks strict init/teardown mirror symmetry due to
+ * hardware constraint: firmware may perform asynchronous global hardware
+ * cleanup once driver_status=false is set. We must guarantee no ongoing
+ * mailbox DMA before deinit_module to avoid invalid DMA write.
+ *
+ * Init order: create mailbox(common_dev) → ctrl dev init
+ * Teardown order: destroy mailbox(common_dev) → ctrl dev deinit
+ */
+void nbl_dev_remove(struct nbl_adapter *adapter)
+{
+ struct nbl_common_info *common = &adapter->common;
+
+ nbl_dev_remove_common_dev(adapter);
+ if (common->has_ctrl)
+ nbl_dev_remove_ctrl_dev(adapter);
+}
+
+/* ---------- Dev start process ---------- */
+int nbl_dev_start(struct nbl_adapter *adapter)
+{
+ struct nbl_dev_mgt *dev_mgt = adapter->core.dev_mgt;
+ struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
+ struct nbl_dispatch_mgt *priv = dev_mgt->disp_ops_tbl->priv;
+ struct nbl_dev_common *common_dev = dev_mgt->common_dev;
+ struct nbl_common_info *common = dev_mgt->common;
+ int cleanup_ret;
+ int ret;
+
+ ret = nbl_dev_cfg_msix_map(dev_mgt);
+ if (ret)
+ goto err_destroy_map;
+
+ /* Fetch VSI/ETH identity after cfg_msix_map */
+ ret = disp_ops->get_vsi_id(priv, NBL_VSI_DATA, &common->vsi_id);
+ if (ret)
+ goto err_destroy_map;
+ ret = disp_ops->get_eth_id(priv, common->vsi_id, &common->eth_num,
+ &common->eth_id, &common->logic_eth_id);
+ if (ret)
+ goto err_destroy_map;
+
+ ret = nbl_dev_init_interrupt_scheme(dev_mgt);
+ if (ret)
+ goto err_destroy_map;
+
+ ret = nbl_dev_request_mailbox_irq(dev_mgt);
+ if (ret)
+ goto err_destroy_map;
+
+ ret = nbl_dev_enable_mailbox_irq(dev_mgt);
+ if (ret)
+ goto err_disable_irq;
+
+ return 0;
+
+err_disable_irq:
+ cleanup_ret = nbl_dev_disable_mailbox_irq(dev_mgt);
+ if (cleanup_ret)
+ dev_err(dev_mgt->common->dev,
+ "rollback: disable mailbox IRQ failed: %d\n",
+ cleanup_ret);
+ nbl_dev_free_mailbox_irq(dev_mgt);
+err_destroy_map:
+ /*
+ * Destroy device-side MSI-X map BEFORE releasing kernel-side
+ * vectors. This masks all hardware vectors and clears the
+ * pcompleter map entry, so no MSI-X message can fire after
+ * vector release.
+ *
+ * For non-control PFs this is a polling-mode mailbox RPC
+ * (IRQ_RDY already cleared by disable above, or never set).
+ * If the RPC fails the device may remain armed.
+ *
+ * This is best-effort teardown: we still release kernel vectors
+ * even if remote RPC fails. The hardware entry will be reclaimed
+ * by firmware on chip reset.
+ *
+ * Note: pci_clear_master() runs in nbl_probe() core_start_err path,
+ * Also pci_clear_master() on non-control PF
+ * cannot stop DMA using the manager PF's BDF; this is a known
+ * limitation. Stale hardware entries will be reclaimed by firmware
+ * on chip reset.
+ */
+ cleanup_ret = nbl_dev_destroy_msix_map(dev_mgt);
+ if (cleanup_ret)
+ dev_err(dev_mgt->common->dev,
+ "rollback: destroy MSI-X map failed: %d\n",
+ cleanup_ret);
+ nbl_dev_clear_interrupt_scheme(dev_mgt);
+
+ cancel_work_sync(&common_dev->clean_mbx_task);
+ return ret;
+}
+
+void nbl_dev_stop(struct nbl_adapter *adapter)
+{
+ struct nbl_dev_mgt *dev_mgt = adapter->core.dev_mgt;
+ struct nbl_dev_common *common_dev = dev_mgt->common_dev;
+ int ret;
+
+ ret = nbl_dev_disable_mailbox_irq(dev_mgt);
+ if (ret)
+ dev_err(dev_mgt->common->dev,
+ "Failed to disable mailbox IRQ: %d\n", ret);
+ nbl_dev_free_mailbox_irq(dev_mgt);
+
+ /*
+ * Destroy hardware MSI-X map BEFORE releasing kernel-side
+ * vectors. Masks all device vectors and clears pcompleter
+ * map entry first.
+ *
+ * This is best-effort teardown: if destroy_msix_map RPC fails,
+ * hardware MSI-X map remains valid. We proceed to release
+ * kernel vectors anyway. Hardware stale entries rely on
+ * firmware cleanup on chip reset.
+ *
+ * pci_clear_master() on non-control PF cannot stop DMA using manager
+ * PF's BDF.
+ */
+ ret = nbl_dev_destroy_msix_map(dev_mgt);
+ if (ret)
+ dev_err(dev_mgt->common->dev,
+ "Failed to destroy MSI-X map: %d\n", ret);
+
+ nbl_dev_clear_interrupt_scheme(dev_mgt);
+
+ /*
+ * destroy_msix_map() sends ack-requested messages which may
+ * requeue clean_mbx_task via polling send path. Drain work
+ * after the operation.
+ */
+ cancel_work_sync(&common_dev->clean_mbx_task);
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.h
new file mode 100644
index 0000000000000..24e890fd89874
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEV_H_
+#define _NBL_DEV_H_
+
+#include <linux/types.h>
+
+#include "../nbl_include/nbl_include.h"
+#include "../nbl_include/nbl_def_channel.h"
+#include "../nbl_include/nbl_def_hw.h"
+#include "../nbl_include/nbl_def_resource.h"
+#include "../nbl_include/nbl_def_dispatch.h"
+#include "../nbl_include/nbl_def_dev.h"
+#include "../nbl_include/nbl_def_common.h"
+#include "../nbl_core.h"
+
+#define NBL_STRING_NAME_LEN 32
+
+enum nbl_msix_serv_type {
+ NBL_MSIX_NET_TYPE,
+ NBL_MSIX_MAILBOX_TYPE,
+ NBL_MSIX_TYPE_MAX
+};
+
+struct nbl_msix_serv_info {
+ char irq_name[NBL_STRING_NAME_LEN];
+ u16 num;
+ u16 base_vector_id;
+ /* true: hw report msix, hw need to mask actively */
+ bool hw_self_mask_en;
+};
+
+struct nbl_msix_info {
+ struct nbl_msix_serv_info serv_info[NBL_MSIX_TYPE_MAX];
+};
+
+struct nbl_dev_common {
+ struct nbl_dev_mgt *dev_mgt;
+ struct nbl_msix_info msix_info;
+ char mailbox_name[NBL_STRING_NAME_LEN];
+ /* for ctrl-dev/net-dev mailbox recv msg */
+ struct work_struct clean_mbx_task;
+};
+
+struct nbl_dev_mgt {
+ struct nbl_common_info *common;
+ struct nbl_dispatch_ops_tbl *disp_ops_tbl;
+ struct nbl_channel_ops_tbl *chan_ops_tbl;
+ struct nbl_dev_common *common_dev;
+};
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.c
new file mode 100644
index 0000000000000..7254ed10d478f
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.c
@@ -0,0 +1,695 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/device.h>
+#include <linux/mutex.h>
+#include <linux/pci.h>
+#include "nbl_dispatch.h"
+
+static int nbl_disp_chan_get_vsi_id_req(struct nbl_dispatch_mgt *disp_mgt,
+ u16 type, u16 *vsi_id)
+{
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_common_info *common = disp_mgt->common;
+ struct nbl_chan_param_get_vsi_id result = { 0 };
+ struct nbl_chan_param_get_vsi_id param = { 0 };
+ struct nbl_chan_send_info chan_send = {0};
+ int ret;
+
+ param.type = cpu_to_le16(type);
+
+ nbl_chan_fill_send_info(&chan_send, common->mgt_pf,
+ NBL_CHAN_MSG_GET_VSI_ID,
+ ¶m, sizeof(param), &result,
+ sizeof(result), 1);
+ ret = chan_ops->send_msg(disp_mgt->chan_ops_tbl->priv, &chan_send);
+ if (ret < 0)
+ return ret;
+ switch (ret) {
+ case NBL_CHAN_RESP_OK:
+ break;
+ case NBL_CHAN_RESP_UNIMPLEMENTED:
+ return -EOPNOTSUPP;
+ case NBL_CHAN_RESP_ERR:
+ return -EREMOTEIO;
+ case NBL_CHAN_RESP_PERM_DENY:
+ return -EPERM;
+ default:
+ return -EREMOTEIO;
+ }
+ if (chan_send.ack_len != sizeof(result)) {
+ dev_err(disp_mgt->common->dev,
+ "get_vsi_id: short ACK, ack_len=%u expected %zu\n",
+ chan_send.ack_len, sizeof(result));
+ return -EREMOTEIO;
+ }
+ *vsi_id = le16_to_cpu(result.vsi_id);
+ return 0;
+}
+
+static void nbl_disp_chan_get_vsi_id_resp(void *priv, u16 src_id, u16 msg_id,
+ void *data, u32 data_len)
+{
+ struct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct device *dev = disp_mgt->common->dev;
+ struct nbl_chan_param_get_vsi_id result = { 0 };
+ struct nbl_chan_param_get_vsi_id param = { 0 };
+ struct nbl_chan_ack_info chan_ack;
+ int err = NBL_CHAN_RESP_OK;
+ u16 vsi_id = 0;
+ u32 rel_pf_id;
+ int ret;
+
+ ret = nbl_common_func_id_to_rel_pf_id(disp_mgt->common, src_id,
+ &rel_pf_id);
+ if (ret) {
+ err = NBL_CHAN_RESP_PERM_DENY;
+ goto ack_out;
+ }
+ if (data_len < sizeof(param)) {
+ err = NBL_CHAN_RESP_ERR;
+ goto ack_out;
+ }
+ memcpy(¶m, data, sizeof(param));
+
+ if (res_ops->get_vsi_id) {
+ ret = res_ops->get_vsi_id(p, src_id, le16_to_cpu(param.type),
+ &vsi_id);
+ if (ret)
+ err = NBL_CHAN_RESP_ERR;
+ } else {
+ err = NBL_CHAN_RESP_UNIMPLEMENTED;
+ }
+
+ result.vsi_id = cpu_to_le16(vsi_id);
+ack_out:
+ nbl_chan_fill_ack_info(&chan_ack, src_id,
+ NBL_CHAN_MSG_GET_VSI_ID, msg_id, err,
+ &result, sizeof(result));
+ ret = chan_ops->send_ack(disp_mgt->chan_ops_tbl->priv, &chan_ack);
+ if (ret)
+ dev_err(dev,
+ "channel send ack failed with ret: %d, msg_type: %d\n",
+ ret, NBL_CHAN_MSG_GET_VSI_ID);
+}
+
+static int nbl_disp_chan_get_eth_id_req(struct nbl_dispatch_mgt *disp_mgt,
+ u16 vsi_id, u8 *eth_num, u8 *eth_id,
+ u8 *logic_eth_id)
+{
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_common_info *common = disp_mgt->common;
+ struct nbl_chan_param_get_eth_id result = { 0 };
+ struct nbl_chan_param_get_eth_id param = { 0 };
+ struct nbl_chan_send_info chan_send = {0};
+ int ret;
+
+ param.vsi_id = cpu_to_le16(vsi_id);
+
+ nbl_chan_fill_send_info(&chan_send, common->mgt_pf,
+ NBL_CHAN_MSG_GET_ETH_ID,
+ ¶m, sizeof(param), &result,
+ sizeof(result), 1);
+ ret = chan_ops->send_msg(disp_mgt->chan_ops_tbl->priv, &chan_send);
+ if (ret < 0)
+ return ret;
+ switch (ret) {
+ case NBL_CHAN_RESP_OK:
+ break;
+ case NBL_CHAN_RESP_UNIMPLEMENTED:
+ return -EOPNOTSUPP;
+ case NBL_CHAN_RESP_ERR:
+ return -EREMOTEIO;
+ case NBL_CHAN_RESP_PERM_DENY:
+ return -EPERM;
+ default:
+ return -EREMOTEIO;
+ }
+ if (chan_send.ack_len != sizeof(result)) {
+ dev_err(disp_mgt->common->dev,
+ "get_eth_id: short ACK, ack_len=%u expected %zu\n",
+ chan_send.ack_len, sizeof(result));
+ return -EREMOTEIO;
+ }
+ *eth_num = result.eth_num;
+ *eth_id = result.eth_id;
+ *logic_eth_id = result.logic_eth_id;
+
+ return 0;
+}
+
+static void nbl_disp_chan_get_eth_id_resp(void *priv, u16 src_id, u16 msg_id,
+ void *data, u32 data_len)
+{
+ struct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_chan_param_get_eth_id result = { 0 };
+ struct nbl_chan_param_get_eth_id param = { 0 };
+ struct device *dev = disp_mgt->common->dev;
+ struct nbl_chan_ack_info chan_ack;
+ int err = NBL_CHAN_RESP_OK;
+ u32 rel_pf_id;
+ int ret;
+
+ ret = nbl_common_func_id_to_rel_pf_id(disp_mgt->common, src_id,
+ &rel_pf_id);
+ if (ret) {
+ err = NBL_CHAN_RESP_PERM_DENY;
+ goto ack_out;
+ }
+ if (data_len < sizeof(param)) {
+ err = NBL_CHAN_RESP_ERR;
+ goto ack_out;
+ }
+ memcpy(¶m, data, sizeof(param));
+
+ if (res_ops->get_eth_id) {
+ ret = res_ops->get_eth_id(p, src_id, le16_to_cpu(param.vsi_id),
+ &result.eth_num, &result.eth_id,
+ &result.logic_eth_id);
+ if (ret)
+ err = NBL_CHAN_RESP_ERR;
+ } else {
+ err = NBL_CHAN_RESP_UNIMPLEMENTED;
+ }
+ack_out:
+ nbl_chan_fill_ack_info(&chan_ack, src_id,
+ NBL_CHAN_MSG_GET_ETH_ID, msg_id, err,
+ &result, sizeof(result));
+ ret = chan_ops->send_ack(disp_mgt->chan_ops_tbl->priv, &chan_ack);
+ if (ret)
+ dev_err(dev,
+ "channel send ack failed with ret: %d, msg_type: %d\n",
+ ret, NBL_CHAN_MSG_GET_ETH_ID);
+}
+
+static void nbl_disp_deinit_module(struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+
+ if (res_ops->deinit_module)
+ res_ops->deinit_module(p);
+}
+
+static int nbl_disp_init_module(struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+
+ if (res_ops->init_module)
+ return res_ops->init_module(p);
+ return -EOPNOTSUPP;
+}
+
+static int nbl_disp_cfg_msix_map(struct nbl_dispatch_mgt *disp_mgt,
+ u16 num_net_msix, u16 num_others_msix,
+ bool net_msix_mask_en)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_common_info *common = disp_mgt->common;
+ int ret;
+
+ if (!res_ops->cfg_msix_map)
+ return -EOPNOTSUPP;
+ mutex_lock(&disp_mgt->ops_mutex_lock);
+ ret = res_ops->cfg_msix_map(p, common->mgt_pf, num_net_msix,
+ num_others_msix, net_msix_mask_en);
+ mutex_unlock(&disp_mgt->ops_mutex_lock);
+ return ret;
+}
+
+static int
+nbl_disp_chan_cfg_msix_map_req(struct nbl_dispatch_mgt *disp_mgt,
+ u16 num_net_msix, u16 num_others_msix,
+ bool net_msix_mask_en)
+{
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_common_info *common = disp_mgt->common;
+ struct nbl_chan_param_cfg_msix_map param = { 0 };
+ struct nbl_chan_send_info chan_send = {0};
+ int ret;
+
+ param.num_net_msix = cpu_to_le16(num_net_msix);
+ param.num_others_msix = cpu_to_le16(num_others_msix);
+ param.msix_mask_en = cpu_to_le16(!!net_msix_mask_en);
+
+ nbl_chan_fill_send_info(&chan_send, common->mgt_pf,
+ NBL_CHAN_MSG_CONFIGURE_MSIX_MAP,
+ ¶m, sizeof(param),
+ NULL, 0, 1);
+ ret = chan_ops->send_msg(disp_mgt->chan_ops_tbl->priv, &chan_send);
+ if (ret < 0)
+ return ret;
+ switch (ret) {
+ case NBL_CHAN_RESP_OK:
+ break;
+ case NBL_CHAN_RESP_UNIMPLEMENTED:
+ return -EOPNOTSUPP;
+ case NBL_CHAN_RESP_PERM_DENY:
+ return -EPERM;
+ case NBL_CHAN_RESP_ERR:
+ return -EREMOTEIO;
+ default:
+ return -EREMOTEIO;
+ }
+ return 0;
+}
+
+/*
+ * Precondition: caller must disable mailbox IRQ_RDY and switch send_msg
+ * to polling path before issuing cfg_msix_map RPC.
+ * The responder will disable mailbox MSIX routing during resource ops,
+ * so ACK cannot rely on interrupt wakeup.
+ */
+static void nbl_disp_chan_cfg_msix_map_resp(void *priv, u16 src_id, u16 msg_id,
+ void *data, u32 data_len)
+{
+ struct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct device *dev = disp_mgt->common->dev;
+ struct nbl_chan_param_cfg_msix_map param = { 0 };
+ struct nbl_chan_ack_info chan_ack;
+ int err = NBL_CHAN_RESP_OK;
+ u32 rel_pf_id;
+ int ret;
+
+ ret = nbl_common_func_id_to_rel_pf_id(disp_mgt->common, src_id,
+ &rel_pf_id);
+ if (ret) {
+ err = NBL_CHAN_RESP_PERM_DENY;
+ goto ack_out;
+ }
+ if (data_len < sizeof(param)) {
+ err = NBL_CHAN_RESP_ERR;
+ goto ack_out;
+ }
+ memcpy(¶m, data, sizeof(param));
+
+ if (res_ops->cfg_msix_map) {
+ mutex_lock(&disp_mgt->ops_mutex_lock);
+ ret = res_ops->cfg_msix_map(p, src_id,
+ le16_to_cpu(param.num_net_msix),
+ le16_to_cpu(param.num_others_msix),
+ !!le16_to_cpu(param.msix_mask_en));
+ mutex_unlock(&disp_mgt->ops_mutex_lock);
+ if (ret)
+ err = NBL_CHAN_RESP_ERR;
+ } else {
+ err = NBL_CHAN_RESP_UNIMPLEMENTED;
+ }
+ack_out:
+ nbl_chan_fill_ack_info(&chan_ack, src_id,
+ NBL_CHAN_MSG_CONFIGURE_MSIX_MAP, msg_id,
+ err, NULL, 0);
+ ret = chan_ops->send_ack(disp_mgt->chan_ops_tbl->priv, &chan_ack);
+ if (ret)
+ dev_err(dev,
+ "channel send ack failed with ret: %d, msg_type: %d\n",
+ ret, NBL_CHAN_MSG_CONFIGURE_MSIX_MAP);
+}
+
+static int nbl_disp_chan_destroy_msix_map_req(struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_common_info *common = disp_mgt->common;
+ struct nbl_chan_send_info chan_send = {0};
+ int ret;
+
+ nbl_chan_fill_send_info(&chan_send, common->mgt_pf,
+ NBL_CHAN_MSG_DESTROY_MSIX_MAP,
+ NULL, 0, NULL, 0, 1);
+ ret = chan_ops->send_msg(disp_mgt->chan_ops_tbl->priv, &chan_send);
+ if (ret < 0)
+ return ret;
+ switch (ret) {
+ case NBL_CHAN_RESP_OK:
+ break;
+ case NBL_CHAN_RESP_UNIMPLEMENTED:
+ return -EOPNOTSUPP;
+ case NBL_CHAN_RESP_PERM_DENY:
+ return -EPERM;
+ case NBL_CHAN_RESP_ERR:
+ return -EREMOTEIO;
+ default:
+ return -EREMOTEIO;
+ }
+ return 0;
+}
+
+/*
+ * Precondition: caller must disable mailbox IRQ_RDY and switch send_msg
+ * to polling path before issuing destroy_msix_map.
+ * The responder will disable mailbox MSIX routing during resource ops,
+ * so ACK cannot rely on interrupt wakeup.
+ */
+static void nbl_disp_chan_destroy_msix_map_resp(void *priv, u16 src_id,
+ u16 msg_id, void *data,
+ u32 data_len)
+{
+ struct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct device *dev = disp_mgt->common->dev;
+ struct nbl_chan_ack_info chan_ack;
+ int err = NBL_CHAN_RESP_OK;
+ u32 rel_pf_id;
+ int ret;
+
+ ret = nbl_common_func_id_to_rel_pf_id(disp_mgt->common, src_id,
+ &rel_pf_id);
+ if (ret) {
+ err = NBL_CHAN_RESP_PERM_DENY;
+ goto ack_out;
+ }
+ if (res_ops->destroy_msix_map) {
+ mutex_lock(&disp_mgt->ops_mutex_lock);
+ ret = res_ops->destroy_msix_map(p, src_id);
+ mutex_unlock(&disp_mgt->ops_mutex_lock);
+ if (ret)
+ err = NBL_CHAN_RESP_ERR;
+ } else {
+ err = NBL_CHAN_RESP_UNIMPLEMENTED;
+ }
+ack_out:
+ nbl_chan_fill_ack_info(&chan_ack, src_id,
+ NBL_CHAN_MSG_DESTROY_MSIX_MAP, msg_id,
+ err, NULL, 0);
+ ret = chan_ops->send_ack(disp_mgt->chan_ops_tbl->priv, &chan_ack);
+ if (ret)
+ dev_err(dev,
+ "channel send ack failed with ret: %d, msg_type: %d\n",
+ ret, NBL_CHAN_MSG_DESTROY_MSIX_MAP);
+}
+
+static int nbl_disp_chan_set_mailbox_irq_req(struct nbl_dispatch_mgt *disp_mgt,
+ u16 vector_id, bool en_msix)
+{
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_chan_param_set_mailbox_irq param = { 0 };
+ struct nbl_common_info *common = disp_mgt->common;
+ struct nbl_chan_send_info chan_send = {0};
+ int ret;
+
+ param.vector_id = cpu_to_le16(vector_id);
+ param.en_msix = !!en_msix;
+
+ nbl_chan_fill_send_info(&chan_send, common->mgt_pf,
+ NBL_CHAN_MSG_MAILBOX_SET_IRQ,
+ ¶m, sizeof(param), NULL, 0, 1);
+ ret = chan_ops->send_msg(disp_mgt->chan_ops_tbl->priv, &chan_send);
+ if (ret < 0)
+ return ret;
+ switch (ret) {
+ case NBL_CHAN_RESP_OK:
+ break;
+ case NBL_CHAN_RESP_UNIMPLEMENTED:
+ return -EOPNOTSUPP;
+ case NBL_CHAN_RESP_ERR:
+ return -EREMOTEIO;
+ case NBL_CHAN_RESP_PERM_DENY:
+ return -EPERM;
+ default:
+ return -EREMOTEIO;
+ }
+ return 0;
+}
+
+static void nbl_disp_chan_set_mailbox_irq_resp(void *priv, u16 src_id,
+ u16 msg_id, void *data,
+ u32 data_len)
+{
+ struct nbl_dispatch_mgt *disp_mgt = (struct nbl_dispatch_mgt *)priv;
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_chan_param_set_mailbox_irq param = { 0 };
+ struct device *dev = disp_mgt->common->dev;
+ struct nbl_chan_ack_info chan_ack;
+ int err = NBL_CHAN_RESP_OK;
+ u16 vector_id;
+ u32 rel_pf_id;
+ bool en_msix;
+ int ret;
+
+ ret = nbl_common_func_id_to_rel_pf_id(disp_mgt->common, src_id,
+ &rel_pf_id);
+ if (ret) {
+ err = NBL_CHAN_RESP_PERM_DENY;
+ goto ack_out;
+ }
+ if (data_len < sizeof(param)) {
+ err = NBL_CHAN_RESP_ERR;
+ goto ack_out;
+ }
+ memcpy(¶m, data, sizeof(param));
+ vector_id = le16_to_cpu(param.vector_id);
+ en_msix = !!param.en_msix;
+
+ if (res_ops->set_mailbox_irq) {
+ mutex_lock(&disp_mgt->ops_mutex_lock);
+ ret = res_ops->set_mailbox_irq(p, src_id, vector_id, en_msix);
+ mutex_unlock(&disp_mgt->ops_mutex_lock);
+ if (ret)
+ err = NBL_CHAN_RESP_ERR;
+ } else {
+ err = NBL_CHAN_RESP_UNIMPLEMENTED;
+ }
+
+ack_out:
+ nbl_chan_fill_ack_info(&chan_ack, src_id,
+ NBL_CHAN_MSG_MAILBOX_SET_IRQ, msg_id,
+ err, NULL, 0);
+ ret = chan_ops->send_ack(disp_mgt->chan_ops_tbl->priv, &chan_ack);
+ if (ret)
+ dev_err(dev,
+ "channel send ack failed with ret: %d, msg_type: %d\n",
+ ret, NBL_CHAN_MSG_MAILBOX_SET_IRQ);
+}
+
+static int nbl_disp_destroy_msix_map(struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_common_info *common = disp_mgt->common;
+ int ret;
+
+ if (!res_ops->destroy_msix_map)
+ return -EOPNOTSUPP;
+ mutex_lock(&disp_mgt->ops_mutex_lock);
+ ret = res_ops->destroy_msix_map(p, common->mgt_pf);
+ mutex_unlock(&disp_mgt->ops_mutex_lock);
+ return ret;
+}
+
+static int nbl_disp_set_mailbox_irq(struct nbl_dispatch_mgt *disp_mgt,
+ u16 vector_id, bool en_msix)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_common_info *common = disp_mgt->common;
+ int ret;
+
+ if (!res_ops->set_mailbox_irq)
+ return -EOPNOTSUPP;
+ mutex_lock(&disp_mgt->ops_mutex_lock);
+ ret = res_ops->set_mailbox_irq(p, common->mgt_pf, vector_id, en_msix);
+ mutex_unlock(&disp_mgt->ops_mutex_lock);
+ return ret;
+}
+
+static int nbl_disp_get_vsi_id(struct nbl_dispatch_mgt *disp_mgt, u16 type,
+ u16 *vsi_id)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_common_info *common = disp_mgt->common;
+
+ if (res_ops->get_vsi_id)
+ return res_ops->get_vsi_id(p, common->mgt_pf, type, vsi_id);
+ return -EOPNOTSUPP;
+}
+
+static int nbl_disp_get_eth_id(struct nbl_dispatch_mgt *disp_mgt, u16 vsi_id,
+ u8 *eth_num, u8 *eth_id, u8 *logic_eth_id)
+{
+ struct nbl_resource_ops *res_ops = disp_mgt->res_ops_tbl->ops;
+ struct nbl_resource_mgt *p = disp_mgt->res_ops_tbl->priv;
+ struct nbl_common_info *common = disp_mgt->common;
+
+ if (res_ops->get_eth_id)
+ return res_ops->get_eth_id(p, common->mgt_pf, vsi_id,
+ eth_num, eth_id, logic_eth_id);
+ return -EOPNOTSUPP;
+}
+
+static int nbl_disp_setup_msg(struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_channel_ops *chan_ops = disp_mgt->chan_ops_tbl->ops;
+ struct nbl_channel_mgt *p = disp_mgt->chan_ops_tbl->priv;
+ int ret = 0;
+ int _ret;
+
+ _ret = chan_ops->register_msg(p, NBL_CHAN_MSG_CONFIGURE_MSIX_MAP,
+ nbl_disp_chan_cfg_msix_map_resp,
+ disp_mgt);
+ if (_ret < 0 && !ret)
+ ret = _ret;
+
+ _ret = chan_ops->register_msg(p, NBL_CHAN_MSG_DESTROY_MSIX_MAP,
+ nbl_disp_chan_destroy_msix_map_resp,
+ disp_mgt);
+ if (_ret < 0 && !ret)
+ ret = _ret;
+
+ _ret = chan_ops->register_msg(p, NBL_CHAN_MSG_MAILBOX_SET_IRQ,
+ nbl_disp_chan_set_mailbox_irq_resp,
+ disp_mgt);
+ if (_ret < 0 && !ret)
+ ret = _ret;
+
+ _ret = chan_ops->register_msg(p, NBL_CHAN_MSG_GET_VSI_ID,
+ nbl_disp_chan_get_vsi_id_resp,
+ disp_mgt);
+ if (_ret < 0 && !ret)
+ ret = _ret;
+
+ _ret = chan_ops->register_msg(p, NBL_CHAN_MSG_GET_ETH_ID,
+ nbl_disp_chan_get_eth_id_resp,
+ disp_mgt);
+ if (_ret < 0 && !ret)
+ ret = _ret;
+
+ return ret;
+}
+
+static void nbl_disp_set_ctrl_bit(struct nbl_dispatch_mgt *disp_mgt, u32 lvl)
+{
+ set_bit(lvl, disp_mgt->ctrl_lvl);
+}
+
+static void nbl_disp_refresh_ctrl_ops(struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_dispatch_ops *disp_ops = disp_mgt->disp_ops_tbl->ops;
+
+ memset(disp_ops, 0, sizeof(*disp_ops));
+ if (test_bit(NBL_DISP_CTRL_LVL_MGT, disp_mgt->ctrl_lvl)) {
+ disp_ops->init_module = nbl_disp_init_module;
+ disp_ops->deinit_module = nbl_disp_deinit_module;
+ disp_ops->cfg_msix_map = nbl_disp_cfg_msix_map;
+ disp_ops->destroy_msix_map = nbl_disp_destroy_msix_map;
+ disp_ops->set_mailbox_irq = nbl_disp_set_mailbox_irq;
+ disp_ops->get_vsi_id = nbl_disp_get_vsi_id;
+ disp_ops->get_eth_id = nbl_disp_get_eth_id;
+ } else if (test_bit(NBL_DISP_CTRL_LVL_NET, disp_mgt->ctrl_lvl)) {
+ disp_ops->cfg_msix_map =
+ nbl_disp_chan_cfg_msix_map_req;
+ disp_ops->destroy_msix_map = nbl_disp_chan_destroy_msix_map_req;
+ disp_ops->set_mailbox_irq = nbl_disp_chan_set_mailbox_irq_req;
+ disp_ops->get_vsi_id = nbl_disp_chan_get_vsi_id_req;
+ disp_ops->get_eth_id = nbl_disp_chan_get_eth_id_req;
+ }
+}
+
+static struct nbl_dispatch_mgt *
+nbl_disp_setup_disp_mgt(struct nbl_common_info *common)
+{
+ struct nbl_dispatch_mgt *disp_mgt;
+ struct device *dev = common->dev;
+ int err;
+
+ disp_mgt = devm_kzalloc(dev, sizeof(*disp_mgt), GFP_KERNEL);
+ if (!disp_mgt)
+ return ERR_PTR(-ENOMEM);
+
+ disp_mgt->common = common;
+ err = devm_mutex_init(common->dev, &disp_mgt->ops_mutex_lock);
+ if (err)
+ return ERR_PTR(err);
+ return disp_mgt;
+}
+
+static struct nbl_dispatch_ops_tbl *
+nbl_disp_setup_ops(struct device *dev, struct nbl_dispatch_mgt *disp_mgt)
+{
+ struct nbl_dispatch_ops_tbl *disp_ops_tbl;
+ struct nbl_dispatch_ops *disp_ops;
+
+ disp_ops_tbl = devm_kzalloc(dev, sizeof(*disp_ops_tbl), GFP_KERNEL);
+ if (!disp_ops_tbl)
+ return ERR_PTR(-ENOMEM);
+
+ disp_ops = devm_kzalloc(dev, sizeof(*disp_ops), GFP_KERNEL);
+ if (!disp_ops)
+ return ERR_PTR(-ENOMEM);
+
+ disp_ops_tbl->ops = disp_ops;
+ disp_ops_tbl->priv = disp_mgt;
+
+ return disp_ops_tbl;
+}
+
+int nbl_disp_init(struct nbl_adapter *adapter)
+{
+ struct nbl_common_info *common = &adapter->common;
+ struct nbl_dispatch_ops_tbl *disp_ops_tbl;
+ struct nbl_resource_ops_tbl *res_ops_tbl =
+ adapter->intf.resource_ops_tbl;
+ struct nbl_channel_ops_tbl *chan_ops_tbl =
+ adapter->intf.channel_ops_tbl;
+ struct device *dev = &adapter->pdev->dev;
+ struct nbl_dispatch_mgt *disp_mgt;
+ int ret;
+
+ disp_mgt = nbl_disp_setup_disp_mgt(common);
+ if (IS_ERR(disp_mgt)) {
+ ret = PTR_ERR(disp_mgt);
+ return ret;
+ }
+
+ disp_ops_tbl = nbl_disp_setup_ops(dev, disp_mgt);
+ if (IS_ERR(disp_ops_tbl)) {
+ ret = PTR_ERR(disp_ops_tbl);
+ return ret;
+ }
+
+ disp_mgt->res_ops_tbl = res_ops_tbl;
+ disp_mgt->chan_ops_tbl = chan_ops_tbl;
+ disp_mgt->disp_ops_tbl = disp_ops_tbl;
+ adapter->core.disp_mgt = disp_mgt;
+ adapter->intf.dispatch_ops_tbl = disp_ops_tbl;
+
+ ret = nbl_disp_setup_msg(disp_mgt);
+ if (ret)
+ return ret;
+
+ if (common->has_ctrl)
+ nbl_disp_set_ctrl_bit(disp_mgt, NBL_DISP_CTRL_LVL_MGT);
+
+ if (common->has_net)
+ nbl_disp_set_ctrl_bit(disp_mgt, NBL_DISP_CTRL_LVL_NET);
+ nbl_disp_refresh_ctrl_ops(disp_mgt);
+ return 0;
+}
+
+void nbl_disp_remove(struct nbl_adapter *adapter)
+{
+ /*
+ * All dispatch objects are allocated via devm.
+ * Dispatch message handlers are not explicitly unregistered here.
+ * Safety relies on dev layer shutting down mailbox channel queue
+ * before nbl_res_remove_leonis(), so responders cannot run after
+ * resource layer is torn down. Channel layer nbl_chan_remove_common()
+ * finalizes cleanup at device teardown.
+ */
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.h
new file mode 100644
index 0000000000000..8549048f76e95
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dispatch.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DISPATCH_H_
+#define _NBL_DISPATCH_H_
+#include "../nbl_include/nbl_include.h"
+#include "../nbl_include/nbl_def_channel.h"
+#include "../nbl_include/nbl_def_resource.h"
+#include "../nbl_include/nbl_def_dispatch.h"
+#include "../nbl_include/nbl_def_common.h"
+#include "../nbl_core.h"
+
+struct nbl_dispatch_mgt {
+ struct nbl_common_info *common;
+ struct nbl_resource_ops_tbl *res_ops_tbl;
+ struct nbl_channel_ops_tbl *chan_ops_tbl;
+ struct nbl_dispatch_ops_tbl *disp_ops_tbl;
+ DECLARE_BITMAP(ctrl_lvl, NBL_DISP_CTRL_LVL_MAX);
+ /* use for the caller not in interrupt */
+ struct mutex ops_mutex_lock;
+};
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.c
new file mode 100644
index 0000000000000..419eb6392ada1
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.c
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/device.h>
+#include "nbl_chip.h"
+
+void nbl_res_chip_deinit_module(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ struct nbl_common_info *common = res_mgt->common;
+
+ if (!common->has_ctrl)
+ return;
+ hw_ops->deinit_module(res_mgt->hw_ops_tbl->priv);
+}
+
+int nbl_res_chip_init_module(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_common_info *common = res_mgt->common;
+ struct nbl_hw_ops *hw_ops;
+ u8 eth_speed, eth_num;
+ struct nbl_hw_mgt *p;
+
+ if (!common->has_ctrl)
+ return -EINVAL;
+ eth_speed = res_mgt->resource_info->board_info.eth_speed;
+ eth_num = res_mgt->resource_info->board_info.eth_num;
+ hw_ops = res_mgt->hw_ops_tbl->ops;
+ p = res_mgt->hw_ops_tbl->priv;
+ return hw_ops->init_module(p, eth_speed, eth_num);
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.h
new file mode 100644
index 0000000000000..d14093ba916c9
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_chip.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_CHIP_H_
+#define _NBL_CHIP_H_
+
+#include "nbl_resource.h"
+int nbl_res_chip_init_module(struct nbl_resource_mgt *res_mgt);
+void nbl_res_chip_deinit_module(struct nbl_resource_mgt *res_mgt);
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.c
new file mode 100644
index 0000000000000..aaf6d25e8ae23
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.c
@@ -0,0 +1,1172 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/device.h>
+#include <linux/pci.h>
+#include <linux/bits.h>
+#include <linux/io.h>
+#include <linux/spinlock.h>
+#include <linux/bitfield.h>
+#include "nbl_hw_leonis.h"
+
+static void nbl_hw_read_mbx_regs(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 *data,
+ u32 len)
+{
+ u32 i;
+
+ if (len % 4)
+ return;
+ if (reg >= (u64)hw_mgt->mailbox_bar_size ||
+ reg + len > (u64)hw_mgt->mailbox_bar_size) {
+ dev_err_once(hw_mgt->common->dev,
+ "mbx read out of range: reg=0x%llx len=%u bar_size=%pa\n",
+ reg, len, &hw_mgt->mailbox_bar_size);
+ return;
+ }
+ for (i = 0; i < len / 4; i++)
+ data[i] = nbl_mbx_rd32(hw_mgt, reg + i * sizeof(u32));
+}
+
+static void nbl_hw_write_mbx_regs(struct nbl_hw_mgt *hw_mgt, u64 reg,
+ const u32 *data, u32 len)
+{
+ u32 i;
+
+ if (len % 4)
+ return;
+ if (reg >= (u64)hw_mgt->mailbox_bar_size ||
+ reg + len > (u64)hw_mgt->mailbox_bar_size) {
+ dev_err_once(hw_mgt->common->dev,
+ "mbx write out of range: reg=0x%llx len=%u bar_size=%pa\n",
+ reg, len, &hw_mgt->mailbox_bar_size);
+ return;
+ }
+ for (i = 0; i < len / 4; i++)
+ nbl_mbx_wr32(hw_mgt, reg + i * sizeof(u32), data[i]);
+}
+
+static void nbl_hw_rd_regs(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 *data,
+ u32 len)
+{
+ u32 size = len / 4;
+ u32 i;
+
+ if (len % 4)
+ return;
+ for (i = 0; i < size; i++)
+ data[i] = rd32(hw_mgt->hw_addr, reg + i * sizeof(u32));
+}
+
+static void nbl_hw_wr_regs(struct nbl_hw_mgt *hw_mgt, u64 reg, const u32 *data,
+ u32 len)
+{
+ u32 size = len / 4;
+ u32 i;
+
+ if (len % 4)
+ return;
+ for (i = 0; i < size; i++)
+ wr32(hw_mgt->hw_addr, reg + i * sizeof(u32), data[i]);
+}
+
+static void nbl_hw_rd_regs_lock(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 *data,
+ u32 len)
+{
+ u32 size = len / 4;
+ u32 i;
+
+ if (len % 4)
+ return;
+
+ spin_lock(&hw_mgt->reg_lock);
+
+ for (i = 0; i < size; i++)
+ data[i] = rd32(hw_mgt->hw_addr, reg + i * sizeof(u32));
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static void nbl_hw_wr_regs_lock(struct nbl_hw_mgt *hw_mgt, u64 reg,
+ const u32 *data, u32 len)
+{
+ u32 size = len / 4;
+ u32 i;
+
+ if (len % 4)
+ return;
+ spin_lock(&hw_mgt->reg_lock);
+ for (i = 0; i < size; i++)
+ wr32(hw_mgt->hw_addr, reg + i * sizeof(u32), data[i]);
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+/*
+ * Registers reset to zero after cold boot / FLR / bus reset. Firmware
+ * programs valid values before driver probe, so zero is only seen on
+ * hardware fault or register read failure. Initialize data=0 to guard
+ * against nbl_hw_read_mbx_regs() early-return on bounds-check failure.
+ */
+static void nbl_hw_get_fw_eth_map(struct nbl_hw_mgt *hw_mgt, u32 *eth_map)
+{
+ u32 data = 0;
+
+ nbl_hw_read_mbx_regs(hw_mgt, NBL_FW_BOARD_DW6_OFFSET, &data,
+ sizeof(data));
+ *eth_map = FIELD_GET(NBL_FW_BOARD_DW6_ETH_BITMAP_MASK, data);
+}
+
+static u32 nbl_hw_get_quirks(struct nbl_hw_mgt *hw_mgt)
+{
+ u32 quirks = 0;
+
+ /*
+ * Read quirk bits from mailbox register.
+ * All supported firmware implement the quirk ABI,
+ * firmware always populates NBL_LEONIS_QUIRKS_OFFSET.
+ * Value ~0U indicates no active quirks.
+ */
+ nbl_hw_read_mbx_regs(hw_mgt, NBL_LEONIS_QUIRKS_OFFSET, &quirks,
+ sizeof(u32));
+
+ if (quirks == ~0u)
+ return 0;
+
+ return quirks;
+}
+
+static void nbl_configure_dped_checksum(struct nbl_hw_mgt *hw_mgt)
+{
+ u32 data = 0;
+
+ /* DPED dped_l4_ck_cmd_40 for sctp */
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_DPED_L4_CK_CMD_40_ADDR, &data, sizeof(data));
+ data |= FIELD_PREP(NBL_DPED_L4_CK_CMD_40_EN_MASK, 1);
+ nbl_hw_wr_regs(hw_mgt, NBL_DPED_L4_CK_CMD_40_ADDR, &data, sizeof(data));
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static void nbl_dped_init(struct nbl_hw_mgt *hw_mgt)
+{
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_wr32(hw_mgt, NBL_DPED_VLAN_OFFSET, 0xC);
+ nbl_hw_wr32(hw_mgt, NBL_DPED_DSCP_OFFSET_0, 0x8);
+ nbl_hw_wr32(hw_mgt, NBL_DPED_DSCP_OFFSET_1, 0x4);
+ spin_unlock(&hw_mgt->reg_lock);
+ /* dped checksum offload */
+ nbl_configure_dped_checksum(hw_mgt);
+}
+
+static void nbl_uped_init(struct nbl_hw_mgt *hw_mgt)
+{
+ u32 hw_edit = 0;
+
+ /* V4 TCP: l3_len = 0 */
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V4_TCP_IDX),
+ &hw_edit, sizeof(hw_edit));
+ hw_edit &= ~NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK;
+ nbl_hw_wr_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V4_TCP_IDX),
+ &hw_edit, sizeof(hw_edit));
+
+ /* V6 TCP: l3_len = 1 */
+ nbl_hw_rd_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V6_TCP_IDX),
+ &hw_edit, sizeof(hw_edit));
+ hw_edit = (hw_edit & ~NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK) |
+ FIELD_PREP(NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK, 1);
+ nbl_hw_wr_regs(hw_mgt, NBL_UPED_HW_EDT_PROF_TABLE(NBL_UPED_V6_TCP_IDX),
+ &hw_edit, sizeof(hw_edit));
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static int nbl_shaping_eth_init(struct nbl_hw_mgt *hw_mgt, u8 eth_id, u8 speed)
+{
+ struct nbl_shaping_dvn_dport_u dvn_dport = { 0 };
+ struct nbl_shaping_dport_u dport = { 0 };
+ u32 rate, half_rate;
+ u32 depth;
+ u64 low_val, high_val;
+
+ switch (speed) {
+ case NBL_FW_PORT_SPEED_100G:
+ rate = 100000;
+ break;
+ case NBL_FW_PORT_SPEED_50G:
+ rate = 50000;
+ break;
+ case NBL_FW_PORT_SPEED_25G:
+ rate = 25000;
+ break;
+ case NBL_FW_PORT_SPEED_10G:
+ rate = 10000;
+ break;
+ default:
+ dev_err(hw_mgt->common->dev,
+ "Unsupported port speed %u for eth%u\n", speed, eth_id);
+ return -EINVAL;
+ }
+
+ half_rate = rate / 2;
+ depth = max_t(u32, rate * 2, NBL_LR_LEONIS_NET_BUCKET_DEPTH);
+
+ /* 1. clear valid first
+ * dport and dvn_dport are zero-initialised above, so VALID=0 already
+ */
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DPORT_REG(eth_id), dport.data,
+ sizeof(dport));
+ nbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DVN_DPORT_REG(eth_id),
+ dvn_dport.data, sizeof(dvn_dport));
+
+ /* 2. write config words (valid=0, safe) */
+ low_val = FIELD_PREP(NBL_DPORT_CIR_MASK, rate) |
+ FIELD_PREP(NBL_DPORT_PIR_MASK, rate) |
+ FIELD_PREP(NBL_DPORT_DEPTH_MASK, depth) |
+ FIELD_PREP(NBL_DPORT_CBS_MASK_LOW, depth & 0x3F);
+ high_val = FIELD_PREP(NBL_DPORT_CBS_MASK_HIGH, depth >> 6) |
+ FIELD_PREP(NBL_DPORT_PBS_MASK, depth);
+ /* Fixed split, independent of host endian */
+ dport.data[0] = lower_32_bits(low_val);
+ dport.data[1] = upper_32_bits(low_val);
+ dport.data[2] = lower_32_bits(high_val);
+ dport.data[3] = upper_32_bits(high_val);
+
+ low_val = FIELD_PREP(NBL_DPORT_CIR_MASK, half_rate) |
+ FIELD_PREP(NBL_DPORT_PIR_MASK, rate) |
+ FIELD_PREP(NBL_DPORT_DEPTH_MASK, depth) |
+ FIELD_PREP(NBL_DPORT_CBS_MASK_LOW, depth & 0x3F);
+ high_val = FIELD_PREP(NBL_DPORT_CBS_MASK_HIGH, depth >> 6) |
+ FIELD_PREP(NBL_DPORT_PBS_MASK, depth);
+ dvn_dport.data[0] = lower_32_bits(low_val);
+ dvn_dport.data[1] = upper_32_bits(low_val);
+ dvn_dport.data[2] = lower_32_bits(high_val);
+ dvn_dport.data[3] = upper_32_bits(high_val);
+
+ nbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DPORT_REG(eth_id), dport.data,
+ sizeof(dport));
+ nbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DVN_DPORT_REG(eth_id),
+ dvn_dport.data, sizeof(dvn_dport));
+
+ /* 3. commit: set valid last */
+ low_val = FIELD_PREP(NBL_DPORT_VALID_MASK, 1);
+ dport.data[0] |= lower_32_bits(low_val);
+
+ low_val = FIELD_PREP(NBL_DPORT_VALID_MASK, 1);
+ dvn_dport.data[0] |= lower_32_bits(low_val);
+
+ nbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DPORT_REG(eth_id), dport.data,
+ sizeof(dport));
+ nbl_hw_wr_regs(hw_mgt, NBL_SHAPING_DVN_DPORT_REG(eth_id),
+ dvn_dport.data, sizeof(dvn_dport));
+ spin_unlock(&hw_mgt->reg_lock);
+ return 0;
+}
+
+static int nbl_shaping_init(struct nbl_hw_mgt *hw_mgt, u8 speed)
+{
+#define NBL_SHAPING_FLUSH_INTERVAL 128
+ struct nbl_shaping_net_u net_shaping = { 0 };
+ u32 eth_bitmap = 0;
+ u32 psha_en = 0;
+ int ret;
+ int i;
+
+ nbl_hw_get_fw_eth_map(hw_mgt, ð_bitmap);
+ for (i = 0; i < NBL_MAX_ETHERNET; i++) {
+ if (!(eth_bitmap & BIT(i)))
+ continue;
+ ret = nbl_shaping_eth_init(hw_mgt, i, speed);
+ if (ret)
+ return ret;
+ }
+ psha_en = eth_bitmap & GENMASK(3, 0);
+ psha_en = FIELD_PREP(NBL_DSCH_PSHA_EN_MASK, psha_en);
+ nbl_hw_wr_regs_lock(hw_mgt, NBL_DSCH_PSHA_EN_ADDR, &psha_en,
+ sizeof(psha_en));
+
+ for (i = 0; i < NBL_MAX_FUNC; i++) {
+ nbl_hw_wr_regs_lock(hw_mgt, NBL_SHAPING_NET_REG(i),
+ net_shaping.data,
+ sizeof(net_shaping));
+ if ((i + 1) % NBL_SHAPING_FLUSH_INTERVAL == 0)
+ nbl_flush_writes(hw_mgt);
+ }
+ nbl_flush_writes(hw_mgt);
+ return 0;
+}
+
+static void nbl_dsch_qid_max_init(struct nbl_hw_mgt *hw_mgt)
+{
+ u32 quanta = 0;
+
+ quanta = FIELD_PREP(NBL_DSCH_VN_QUANTA_H_QUA_MASK, NBL_HOST_QUANTA) |
+ FIELD_PREP(NBL_DSCH_VN_QUANTA_E_QUA_MASK, NBL_ECPU_QUANTA);
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_wr_regs(hw_mgt, NBL_DSCH_VN_QUANTA_ADDR, &quanta,
+ sizeof(quanta));
+ nbl_hw_wr32(hw_mgt, NBL_DSCH_HOST_QID_MAX, NBL_MAX_QUEUE_ID);
+
+ nbl_hw_wr32(hw_mgt, NBL_DVN_ECPU_QUEUE_NUM, 0);
+ nbl_hw_wr32(hw_mgt, NBL_UVN_ECPU_QUEUE_NUM, 0);
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static int nbl_ustore_init(struct nbl_hw_mgt *hw_mgt, u8 eth_num)
+{
+ u32 eth_bitmap = 0;
+ u32 drop_th = 0;
+ u32 pkt_len = 0;
+ int i;
+
+ /*
+ * eth_num is validated in the resource layer:
+ * nbl_res_init_pf_num() requires 1/2/4 PFs, and
+ * nbl_res_ctrl_dev_setup_eth_info() requires max_pf == eth_num.
+ * This is a defensive check only; if it triggers, the resource
+ * layer validation was bypassed, which is a bug.
+ */
+ if (WARN_ON(eth_num != 1 && eth_num != 2 && eth_num != 4))
+ return -EINVAL;
+ /* Read current packet length config
+ *(to preserve other fields while updating 'min')
+ */
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_USTORE_PKT_LEN_ADDR, &pkt_len,
+ sizeof(pkt_len));
+ /* min arp packet length 42 (14 + 28) */
+ pkt_len &= ~NBL_USTORE_PKT_LEN_MIN_MASK;
+ pkt_len |= FIELD_PREP(NBL_USTORE_PKT_LEN_MIN_MASK, 42);
+ nbl_hw_wr_regs(hw_mgt, NBL_USTORE_PKT_LEN_ADDR, &pkt_len,
+ sizeof(pkt_len));
+
+ drop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_EN_MASK, 1);
+ if (eth_num == 1)
+ drop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK,
+ NBL_USTORE_SINGLE_ETH_DROP_TH);
+ else if (eth_num == 2)
+ drop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK,
+ NBL_USTORE_DUAL_ETH_DROP_TH);
+ else
+ drop_th |= FIELD_PREP(NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK,
+ NBL_USTORE_QUAD_ETH_DROP_TH);
+ nbl_hw_get_fw_eth_map(hw_mgt, ð_bitmap);
+ for (i = 0; i < NBL_MAX_ETHERNET; i++) {
+ if (!(eth_bitmap & BIT(i)))
+ continue;
+ nbl_hw_wr_regs(hw_mgt, NBL_USTORE_PORT_DROP_TH_REG_ARR(i),
+ &drop_th, sizeof(drop_th));
+ }
+
+ /* Clear port drop/truncate counters by reading them
+ * (hardware has read-to-clear behavior for these registers)
+ */
+ for (i = 0; i < NBL_MAX_ETHERNET; i++) {
+ if (!(eth_bitmap & BIT(i)))
+ continue;
+ nbl_hw_rd32(hw_mgt, NBL_USTORE_BUF_PORT_DROP_PKT(i));
+ nbl_hw_rd32(hw_mgt, NBL_USTORE_BUF_PORT_TRUN_PKT(i));
+ }
+ spin_unlock(&hw_mgt->reg_lock);
+ return 0;
+}
+
+static void nbl_dstore_init(struct nbl_hw_mgt *hw_mgt, u8 speed)
+{
+ u32 eth_bitmap = 0;
+ u32 drop_th = 0;
+ u32 fc_th = 0;
+ u32 bp_th = 0;
+ int i;
+
+ for (i = 0; i < NBL_DSTORE_PORT_DROP_TH_DEPTH; i++) {
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_DSTORE_PORT_DROP_TH_REG(i), &drop_th,
+ sizeof(drop_th));
+ drop_th &= ~NBL_DSTORE_PORT_DROP_EN_MASK;
+ nbl_hw_wr_regs(hw_mgt, NBL_DSTORE_PORT_DROP_TH_REG(i), &drop_th,
+ sizeof(drop_th));
+ spin_unlock(&hw_mgt->reg_lock);
+ }
+
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_DSTORE_DISC_BP_TH, &bp_th, sizeof(bp_th));
+ bp_th |= FIELD_PREP(NBL_DSTORE_DISC_BP_TH_EN_MASK, 1);
+ nbl_hw_wr_regs(hw_mgt, NBL_DSTORE_DISC_BP_TH, &bp_th, sizeof(bp_th));
+ spin_unlock(&hw_mgt->reg_lock);
+
+ nbl_hw_get_fw_eth_map(hw_mgt, ð_bitmap);
+ for (i = 0; i < NBL_MAX_ETHERNET; i++) {
+ if (!(eth_bitmap & BIT(i)))
+ continue;
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_DSTORE_D_DPORT_FC_TH_REG(i), &fc_th,
+ sizeof(fc_th));
+ fc_th &= ~(NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK |
+ NBL_DSTORE_D_DPORT_FC_XON_TH_MASK);
+ if (speed == NBL_FW_PORT_SPEED_100G) {
+ fc_th |=
+ FIELD_PREP(NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK,
+ NBL_DSTORE_DROP_XOFF_TH_100G) |
+ FIELD_PREP(NBL_DSTORE_D_DPORT_FC_XON_TH_MASK,
+ NBL_DSTORE_DROP_XON_TH_100G);
+ } else {
+ fc_th |=
+ FIELD_PREP(NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK,
+ NBL_DSTORE_DROP_XOFF_TH) |
+ FIELD_PREP(NBL_DSTORE_D_DPORT_FC_XON_TH_MASK,
+ NBL_DSTORE_DROP_XON_TH);
+ }
+
+ fc_th |= FIELD_PREP(NBL_DSTORE_D_DPORT_FC_FC_EN_MASK, 1);
+ nbl_hw_wr_regs(hw_mgt, NBL_DSTORE_D_DPORT_FC_TH_REG(i), &fc_th,
+ sizeof(fc_th));
+ spin_unlock(&hw_mgt->reg_lock);
+ }
+}
+
+static void nbl_dvn_descreq_num_cfg(struct nbl_hw_mgt *hw_mgt, u8 descreq_num)
+{
+ u8 split_ring_num = (descreq_num >> 3) & 0x1;
+ u8 ring_num = descreq_num & 0x7;
+ u32 num_cfg;
+ u32 reg_val;
+
+ nbl_hw_rd_regs_lock(hw_mgt, NBL_DVN_DESCREQ_NUM_CFG, ®_val,
+ sizeof(reg_val));
+
+ num_cfg = FIELD_PREP(NBL_DVN_DESCREQ_NUM_CFG_AVRING_DESREQ_NUM_CFG_MASK,
+ split_ring_num) |
+ FIELD_PREP(NBL_DVN_DESCREQ_NUM_CFG_PACKED_L1_NUM_MASK,
+ ring_num);
+ reg_val &= ~(NBL_DVN_DESCREQ_NUM_CFG_AVRING_DESREQ_NUM_CFG_MASK |
+ NBL_DVN_DESCREQ_NUM_CFG_PACKED_L1_NUM_MASK);
+ reg_val |= num_cfg;
+ nbl_hw_wr_regs_lock(hw_mgt, NBL_DVN_DESCREQ_NUM_CFG, ®_val,
+ sizeof(reg_val));
+}
+
+static void nbl_dvn_init(struct nbl_hw_mgt *hw_mgt, u8 speed)
+{
+ u32 timeout = 0;
+ u32 ro_flag = 0;
+
+ timeout = FIELD_PREP(NBL_DVN_DESC_WR_MERGE_TIMEOUT_CFG_CYCLE_MASK,
+ DEFAULT_DVN_DESC_WR_MERGE_TIMEOUT_MAX);
+ nbl_hw_wr_regs_lock(hw_mgt, NBL_DVN_DESC_WR_MERGE_TIMEOUT, &timeout,
+ sizeof(timeout));
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_DVN_DIF_REQ_RD_RO_FLAG, &ro_flag,
+ sizeof(ro_flag));
+ if (pcie_relaxed_ordering_enabled(hw_mgt->common->pdev)) {
+ ro_flag |=
+ FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DESC_RO_EN_MASK,
+ 1) |
+ FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DATA_RO_EN_MASK,
+ 1) |
+ FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_AVRING_RO_EN_MASK,
+ 1);
+ } else {
+ ro_flag &=
+ ~(FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DESC_RO_EN_MASK,
+ 1) |
+ FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_DATA_RO_EN_MASK,
+ 1) |
+ FIELD_PREP(NBL_DVN_DIF_REQ_RD_RO_FLAG_AVRING_RO_EN_MASK,
+ 1));
+ }
+ nbl_hw_wr_regs(hw_mgt, NBL_DVN_DIF_REQ_RD_RO_FLAG, &ro_flag,
+ sizeof(ro_flag));
+ spin_unlock(&hw_mgt->reg_lock);
+ if (speed == NBL_FW_PORT_SPEED_100G)
+ nbl_dvn_descreq_num_cfg(hw_mgt,
+ DEFAULT_DVN_100G_DESCREQ_NUMCFG);
+ else
+ nbl_dvn_descreq_num_cfg(hw_mgt, DEFAULT_DVN_DESCREQ_NUMCFG);
+}
+
+static void nbl_uvn_init(struct nbl_hw_mgt *hw_mgt)
+{
+ u16 wr_timeout = NBL_UVN_DESC_WR_TIMEOUT_VAL;
+ u32 timeout = NBL_UVN_DESC_RD_WAIT_TICKS;
+ u32 prefetch_init = 0;
+ bool ro_enabled;
+ u32 flag = 0;
+ u32 mask = 0;
+ u32 quirks;
+ u32 reg_val;
+
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_wr32(hw_mgt, NBL_UVN_DESC_RD_WAIT, timeout);
+ nbl_hw_rd_regs(hw_mgt, NBL_UVN_DESC_WR_TIMEOUT,
+ ®_val, sizeof(reg_val));
+ reg_val &= ~NBL_UVN_DESC_WR_TIMEOUT_NUM_MASK;
+ reg_val |= FIELD_PREP(NBL_UVN_DESC_WR_TIMEOUT_NUM_MASK, wr_timeout);
+ nbl_hw_wr_regs(hw_mgt, NBL_UVN_DESC_WR_TIMEOUT, ®_val,
+ sizeof(reg_val));
+ ro_enabled = pcie_relaxed_ordering_enabled(hw_mgt->common->pdev);
+
+ nbl_hw_rd_regs(hw_mgt, NBL_UVN_DIF_REQ_RO_FLAG, &flag, sizeof(flag));
+ if (ro_enabled) {
+ flag |= FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_AVAIL_RD_MASK, 1) |
+ FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_RD_MASK, 1) |
+ FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_PKT_WR_MASK, 1);
+ flag &= ~FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_WR_MASK, 1);
+ } else {
+ flag &= ~(FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_AVAIL_RD_MASK, 1) |
+ FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_RD_MASK, 1) |
+ FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_PKT_WR_MASK, 1) |
+ FIELD_PREP(NBL_UVN_DIF_REQ_RO_FLAG_DESC_WR_MASK, 1));
+ }
+ nbl_hw_wr_regs(hw_mgt, NBL_UVN_DIF_REQ_RO_FLAG, &flag, sizeof(flag));
+
+ nbl_hw_rd_regs(hw_mgt, NBL_UVN_QUEUE_ERR_MASK, &mask, sizeof(mask));
+ mask |= FIELD_PREP(NBL_UVN_QUEUE_ERR_MASK_DIF_ERR_MASK, 1);
+
+ nbl_hw_wr_regs(hw_mgt, NBL_UVN_QUEUE_ERR_MASK, &mask, sizeof(mask));
+
+ spin_unlock(&hw_mgt->reg_lock);
+ quirks = nbl_hw_get_quirks(hw_mgt);
+ /*
+ * sel=0: use configured num; sel=1: use internal calc (max 32)
+ * Default is sel=1, unless NBL_QUIRK_UVN_PREFETCH_ALIGN is set,
+ * in which case override to sel=0.
+ */
+ nbl_hw_rd_regs_lock(hw_mgt, NBL_UVN_DESC_PREFETCH_INIT,
+ ®_val, sizeof(reg_val));
+ prefetch_init =
+ FIELD_PREP(NBL_UVN_DESC_PREFETCH_INIT_NUM_MASK,
+ NBL_UVN_DESC_PREFETCH_NUM) |
+ FIELD_PREP(NBL_UVN_DESC_PREFETCH_INIT_SEL_MASK,
+ (quirks & NBL_QUIRK_UVN_PREFETCH_ALIGN) ? 0 : 1);
+ reg_val &= ~(NBL_UVN_DESC_PREFETCH_INIT_NUM_MASK |
+ NBL_UVN_DESC_PREFETCH_INIT_SEL_MASK);
+ reg_val |= prefetch_init;
+ nbl_hw_wr_regs_lock(hw_mgt, NBL_UVN_DESC_PREFETCH_INIT,
+ ®_val, sizeof(reg_val));
+}
+
+static void nbl_uqm_init(struct nbl_hw_mgt *hw_mgt)
+{
+ u32 que_type = 0;
+ u32 cnt = 0;
+ int i;
+
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_FWD_DROP_CNT, &cnt, sizeof(cnt));
+
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_PKT_CNT, &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_PKT_SLICE_CNT, &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_PKT_LEN_ADD_CNT, &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_HEAD_PNTR_ADD_CNT, &cnt,
+ sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_DROP_WEIGHT_ADD_CNT, &cnt, sizeof(cnt));
+
+ for (i = 0; i < NBL_UQM_PORT_DROP_DEPTH; i++) {
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_UQM_PORT_DROP_PKT_CNT + (sizeof(cnt) * i),
+ &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_UQM_PORT_DROP_PKT_SLICE_CNT +
+ (sizeof(cnt) * i),
+ &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_UQM_PORT_DROP_PKT_LEN_ADD_CNT +
+ (sizeof(cnt) * i),
+ &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_UQM_PORT_DROP_HEAD_PNTR_ADD_CNT +
+ (sizeof(cnt) * i),
+ &cnt, sizeof(cnt));
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_UQM_PORT_DROP_WEIGHT_ADD_CNT +
+ (sizeof(cnt) * i),
+ &cnt, sizeof(cnt));
+ }
+
+ for (i = 0; i < NBL_UQM_DPORT_DROP_DEPTH; i++)
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_UQM_DPORT_DROP_CNT + (sizeof(cnt) * i), &cnt,
+ sizeof(cnt));
+ /* bit0: 0=bp mode, 1=drop mode, resv bit1-31 */
+ nbl_hw_wr_regs(hw_mgt, NBL_UQM_QUE_TYPE, &que_type, sizeof(que_type));
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static int nbl_dp_init(struct nbl_hw_mgt *hw_mgt, u8 speed, u8 eth_num)
+{
+ int ret;
+
+ nbl_dped_init(hw_mgt);
+ nbl_uped_init(hw_mgt);
+ ret = nbl_shaping_init(hw_mgt, speed);
+ if (ret)
+ return ret;
+ nbl_dsch_qid_max_init(hw_mgt);
+ ret = nbl_ustore_init(hw_mgt, eth_num);
+ if (ret)
+ return ret;
+ nbl_dstore_init(hw_mgt, speed);
+ nbl_dvn_init(hw_mgt, speed);
+ nbl_uvn_init(hw_mgt);
+ nbl_uqm_init(hw_mgt);
+ return 0;
+}
+
+static void nbl_host_padpt_init(struct nbl_hw_mgt *hw_mgt)
+{
+ /* padpt flow control register */
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_CPLH_UP,
+ NBL_HOST_PADPT_CFG_FC_CPLH_UP_VAL);
+ nbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_PD_DN,
+ NBL_HOST_PADPT_CFG_FC_PD_DN_VAL);
+ nbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_PH_DN,
+ NBL_HOST_PADPT_CFG_FC_PH_DN_VAL);
+ nbl_hw_wr32(hw_mgt, NBL_HOST_PADPT_HOST_CFG_FC_NPH_DN,
+ NBL_HOST_PADPT_CFG_FC_NPH_DN_VAL);
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static void nbl_intf_init(struct nbl_hw_mgt *hw_mgt)
+{
+ nbl_host_padpt_init(hw_mgt);
+}
+
+static void nbl_hw_set_driver_status(struct nbl_hw_mgt *hw_mgt, bool active)
+{
+ u32 status;
+
+ spin_lock(&hw_mgt->reg_lock);
+ status = nbl_hw_rd32(hw_mgt, NBL_DRIVER_STATUS_REG);
+
+ status &= ~BIT(NBL_DRIVER_STATUS_BIT);
+ status |= FIELD_PREP(BIT(NBL_DRIVER_STATUS_BIT), active);
+
+ nbl_hw_wr32(hw_mgt, NBL_DRIVER_STATUS_REG, status);
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+/*
+ * Setting driver status to false notifies firmware to clean up per-PF
+ * hardware state such as qinfo registers.
+ *
+ * Note: firmware does NOT automatically revert chip-wide registers
+ * configured in this init flow. Those chip-wide settings remain valid
+ * until chip reset or explicitly cleared by driver.
+ *
+ * For normal successful probe, driver will reset these chip-wide
+ * resources in subsequent deinit. For failed probe before
+ * driver_status is set to true, hardware may stay in partial
+ * programmed state. We validate all input parameters before touching
+ * hardware registers to avoid this scenario.
+ */
+static void nbl_hw_deinit_module(struct nbl_hw_mgt *hw_mgt)
+{
+ nbl_hw_set_driver_status(hw_mgt, false);
+ /* ensure registers written */
+ nbl_flush_writes(hw_mgt);
+ /*
+ * Firmware cleanup is asynchronous: there is no cleanup-complete
+ * status register in the current hardware revision. The posted
+ * write flush above only ensures driver_status reaches the chip;
+ * firmware may still be performing per-PF state cleanup when this
+ * function returns.
+ *
+ * Caller must ensure no new DMA is initiated after this point.
+ * The mailbox channel is stopped by nbl_chan_teardown_queue()
+ * before this function is called, so no in-flight mailbox DMA
+ * remains.
+ */
+}
+
+static bool nbl_hw_eth_speed_valid(u8 speed)
+{
+ switch (speed) {
+ case NBL_FW_PORT_SPEED_10G:
+ case NBL_FW_PORT_SPEED_25G:
+ case NBL_FW_PORT_SPEED_50G:
+ case NBL_FW_PORT_SPEED_100G:
+ return true;
+ default:
+ return false;
+ }
+}
+
+static bool nbl_hw_eth_num_valid(u8 eth_num)
+{
+ return eth_num == 1 || eth_num == 2 || eth_num == 4;
+}
+
+/*
+ * Full chip hardware initialization is handled by firmware.
+ * This function only configures driver-level table entries and registers.
+ */
+static int nbl_hw_init_module(struct nbl_hw_mgt *hw_mgt, u8 eth_speed,
+ u8 eth_num)
+{
+ int ret;
+
+ if (!nbl_hw_eth_speed_valid(eth_speed)) {
+ dev_err(hw_mgt->common->dev, "Invalid eth_speed %u\n",
+ eth_speed);
+ return -EINVAL;
+ }
+ if (!nbl_hw_eth_num_valid(eth_num)) {
+ dev_err(hw_mgt->common->dev, "Invalid eth_num %u\n", eth_num);
+ return -EINVAL;
+ }
+
+ ret = nbl_dp_init(hw_mgt, eth_speed, eth_num);
+ if (ret)
+ return ret;
+ nbl_intf_init(hw_mgt);
+ nbl_hw_set_driver_status(hw_mgt, true);
+ /* ensure registers written */
+ nbl_flush_writes(hw_mgt);
+
+ return 0;
+}
+
+/*
+ * nbl_hw_set_mailbox_irq - read-modify-write NBL_MAILBOX_QINFO_MAP_REG_ARR
+ *
+ * The full RMW sequence is wrapped by reg_lock, so concurrent register
+ * access from different CPUs is already serialized safely.
+ * nbl_hw_cfg_mailbox_qinfo() overwrites the entire register during init,
+ * which unconditionally clears MSIX_IDX and MSIX_IDX_VALID bits, disabling
+ * mailbox MSIX interrupt routing for this PF.
+ */
+static void nbl_hw_set_mailbox_irq(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ bool en_msix, u16 gvec)
+{
+ u32 data = 0;
+
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id), &data,
+ sizeof(data));
+ data &= ~(NBL_MAILBOX_QINFO_MAP_MSIX_IDX_MASK |
+ NBL_MAILBOX_QINFO_MAP_MSIX_IDX_VALID_MASK);
+ if (en_msix)
+ data |= FIELD_PREP(NBL_MAILBOX_QINFO_MAP_MSIX_IDX_MASK,
+ gvec) |
+ FIELD_PREP(NBL_MAILBOX_QINFO_MAP_MSIX_IDX_VALID_MASK,
+ 1);
+
+ nbl_hw_wr_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id), &data,
+ sizeof(data));
+ spin_unlock(&hw_mgt->reg_lock);
+ nbl_flush_writes(hw_mgt);
+}
+
+static void nbl_hw_cfg_msix_map(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ bool valid, dma_addr_t dma_addr, u8 bus,
+ u8 devid, u8 function)
+{
+ struct nbl_function_msix_map function_msix_map;
+
+ memset(&function_msix_map, 0, sizeof(function_msix_map));
+ if (valid) {
+ function_msix_map.data[0] = lower_32_bits(dma_addr);
+ function_msix_map.data[1] = upper_32_bits(dma_addr);
+ /* use ctrl dev's bdf, because the dma memory was
+ * allocated by it
+ */
+ function_msix_map.data[2] =
+ FIELD_PREP(NBL_FUNCTION_MSIX_MAP_FUNCTION_MASK,
+ function) |
+ FIELD_PREP(NBL_FUNCTION_MSIX_MAP_DEVID_MASK, devid) |
+ FIELD_PREP(NBL_FUNCTION_MSIX_MAP_BUS_MASK, bus) |
+ FIELD_PREP(NBL_FUNCTION_MSIX_MAP_VALID_MASK, 1);
+ } else {
+ /*
+ * reg_lock prevents concurrent CPU writes to the same
+ * function's MSIX entry, but cannot synchronize hardware DMA
+ * reads. Upper layer uses two-stage destruction + sync sleep
+ * to avoid torn hardware read of partial MSIX entry.
+ * Keep valid live dma address here, only clear VALID flag.
+ */
+ function_msix_map.data[0] = lower_32_bits(dma_addr);
+ function_msix_map.data[1] = upper_32_bits(dma_addr);
+ function_msix_map.data[2] = 0;
+ }
+
+ nbl_hw_wr_regs_lock(hw_mgt,
+ NBL_PCOMPLETER_FUNCTION_MSIX_MAP_REG_ARR(func_id),
+ function_msix_map.data, sizeof(function_msix_map));
+}
+
+static void nbl_hw_cfg_msix_info(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ bool valid, u16 interrupt_id, u8 bus,
+ u8 devid, u8 function, bool msix_mask_en)
+{
+ u32 host_msix_fid = 0;
+ struct nbl_host_msix_info msix_info;
+
+ memset(&msix_info, 0, sizeof(msix_info));
+ if (valid) {
+ host_msix_fid =
+ FIELD_PREP(NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_FID_MASK,
+ func_id) |
+ FIELD_PREP(NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_VLD_MASK,
+ 1);
+
+ msix_info.data[1] =
+ FIELD_PREP(NBL_HOST_MSIX_INFO_FUNCTION_MASK, function) |
+ FIELD_PREP(NBL_HOST_MSIX_INFO_DEVID_MASK, devid) |
+ FIELD_PREP(NBL_HOST_MSIX_INFO_BUS_MASK, bus) |
+ FIELD_PREP(NBL_HOST_MSIX_INFO_VALID_MASK, 1);
+
+ if (msix_mask_en)
+ msix_info.data[1] |=
+ FIELD_PREP(NBL_HOST_MSIX_INFO_MSIX_MASK_EN_MASK, 1);
+ }
+ spin_lock(&hw_mgt->reg_lock);
+ /*
+ * Programming order rule:
+ * Enable: PADPT_HOST_MSIX_INFO -> PCOMPLETER_HOST_MSIX_FID_TABLE
+ * Teardown: reverse order, clear FID VLD first to avoid inconsistent
+ * state
+ */
+ if (valid) {
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_PADPT_HOST_MSIX_INFO_REG_ARR(interrupt_id),
+ msix_info.data, sizeof(msix_info));
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_PCOMPLETER_HOST_MSIX_FID_TABLE(interrupt_id),
+ &host_msix_fid, sizeof(host_msix_fid));
+ } else {
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_PCOMPLETER_HOST_MSIX_FID_TABLE(interrupt_id),
+ &host_msix_fid, sizeof(host_msix_fid));
+ nbl_hw_wr_regs(hw_mgt,
+ NBL_PADPT_HOST_MSIX_INFO_REG_ARR(interrupt_id),
+ msix_info.data, sizeof(msix_info));
+ }
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+static void nbl_hw_update_mailbox_queue_tail_ptr(struct nbl_hw_mgt *hw_mgt,
+ u16 tail_ptr, u8 txrx)
+{
+ /* local_qid 0 and 1 denote rx and tx queue respectively */
+ u32 local_qid = txrx;
+ u32 value = ((u32)tail_ptr << 16) | local_qid;
+
+ /* wmb for doorbell */
+ wmb();
+ nbl_mbx_wr32(hw_mgt, NBL_MAILBOX_NOTIFY_ADDR, value);
+}
+
+static void nbl_hw_config_mailbox_rxq(struct nbl_hw_mgt *hw_mgt,
+ dma_addr_t dma_addr, int size_bwid)
+{
+ struct nbl_mailbox_qinfo_cfg_table cfg_tbl;
+
+ memset(&cfg_tbl, 0, sizeof(cfg_tbl));
+ cfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);
+ nbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR,
+ cfg_tbl.data, sizeof(cfg_tbl));
+
+ cfg_tbl.data[0] = lower_32_bits(dma_addr);
+ cfg_tbl.data[1] = upper_32_bits(dma_addr);
+ cfg_tbl.data[2] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_SIZE_BWID_MASK,
+ size_bwid);
+ cfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 0) |
+ FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_EN_MASK, 1);
+ nbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR,
+ cfg_tbl.data, sizeof(cfg_tbl));
+}
+
+static void nbl_hw_config_mailbox_txq(struct nbl_hw_mgt *hw_mgt,
+ dma_addr_t dma_addr, int size_bwid)
+{
+ struct nbl_mailbox_qinfo_cfg_table cfg_tbl;
+
+ memset(&cfg_tbl, 0, sizeof(cfg_tbl));
+ cfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);
+ nbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR,
+ cfg_tbl.data, sizeof(cfg_tbl));
+
+ cfg_tbl.data[0] = lower_32_bits(dma_addr);
+ cfg_tbl.data[1] = upper_32_bits(dma_addr);
+ cfg_tbl.data[2] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_SIZE_BWID_MASK,
+ size_bwid);
+ cfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 0) |
+ FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_EN_MASK, 1);
+ nbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR,
+ cfg_tbl.data, sizeof(cfg_tbl));
+}
+
+static void nbl_hw_stop_mailbox_rxq(struct nbl_hw_mgt *hw_mgt)
+{
+ struct nbl_mailbox_qinfo_cfg_table cfg_tbl;
+
+ memset(&cfg_tbl, 0, sizeof(cfg_tbl));
+ cfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);
+ nbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR,
+ cfg_tbl.data, sizeof(cfg_tbl));
+}
+
+static void nbl_hw_stop_mailbox_txq(struct nbl_hw_mgt *hw_mgt)
+{
+ struct nbl_mailbox_qinfo_cfg_table cfg_tbl;
+
+ memset(&cfg_tbl, 0, sizeof(cfg_tbl));
+ cfg_tbl.data[3] = FIELD_PREP(NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK, 1);
+ nbl_hw_write_mbx_regs(hw_mgt, NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR,
+ cfg_tbl.data, sizeof(cfg_tbl));
+}
+
+static void nbl_hw_get_host_pf_mask(struct nbl_hw_mgt *hw_mgt, u32 *pf_mask)
+{
+ nbl_hw_rd_regs_lock(hw_mgt, NBL_PCIE_HOST_K_PF_MASK_REG, pf_mask,
+ sizeof(*pf_mask));
+}
+
+static void nbl_hw_get_real_bus(struct nbl_hw_mgt *hw_mgt, u8 *bus)
+{
+ u32 data = 0;
+
+ nbl_hw_rd_regs_lock(hw_mgt, NBL_PCIE_HOST_TL_CFG_BUSDEV, &data,
+ sizeof(data));
+ *bus = FIELD_GET(NBL_PCIE_BUS_MASK, data);
+}
+
+static void nbl_hw_cfg_mailbox_qinfo(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ u8 bus, u8 devid, u8 function)
+{
+ u32 data = 0;
+
+ spin_lock(&hw_mgt->reg_lock);
+ nbl_hw_rd_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id),
+ &data, sizeof(data));
+ data &= ~(NBL_MAILBOX_QINFO_MAP_FUNCTION_MASK |
+ NBL_MAILBOX_QINFO_MAP_DEVID_MASK |
+ NBL_MAILBOX_QINFO_MAP_BUS_MASK);
+ data |= FIELD_PREP(NBL_MAILBOX_QINFO_MAP_FUNCTION_MASK, function) |
+ FIELD_PREP(NBL_MAILBOX_QINFO_MAP_DEVID_MASK, devid) |
+ FIELD_PREP(NBL_MAILBOX_QINFO_MAP_BUS_MASK, bus);
+ nbl_hw_wr_regs(hw_mgt, NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id),
+ &data, sizeof(data));
+ spin_unlock(&hw_mgt->reg_lock);
+}
+
+/*
+ * Registers reset to zero after cold boot / FLR / bus reset. Firmware
+ * programs valid values before driver probe, so zero is only seen on
+ * hardware fault or register read failure. Initialize data=0 to guard
+ * against nbl_hw_read_mbx_regs() early-return on bounds-check failure.
+ */
+static void nbl_hw_get_board_info(struct nbl_hw_mgt *hw_mgt,
+ struct nbl_board_port_info *board_info)
+{
+ u32 data = 0;
+
+ nbl_hw_read_mbx_regs(hw_mgt, NBL_FW_BOARD_DW3_OFFSET, &data,
+ sizeof(data));
+ board_info->eth_num = FIELD_GET(NBL_FW_BOARD_DW3_PORT_NUM_MASK, data);
+ board_info->eth_speed =
+ FIELD_GET(NBL_FW_BOARD_DW3_PORT_SPEED_MASK, data);
+ board_info->p4_version =
+ FIELD_GET(NBL_FW_BOARD_DW3_P4_VERSION_MASK, data);
+}
+
+static struct nbl_hw_ops hw_ops = {
+ .init_module = nbl_hw_init_module,
+ .deinit_module = nbl_hw_deinit_module,
+
+ .cfg_msix_map = nbl_hw_cfg_msix_map,
+ .cfg_msix_info = nbl_hw_cfg_msix_info,
+ .flush_write = nbl_flush_writes,
+
+ .update_mailbox_queue_tail_ptr = nbl_hw_update_mailbox_queue_tail_ptr,
+ .config_mailbox_rxq = nbl_hw_config_mailbox_rxq,
+ .config_mailbox_txq = nbl_hw_config_mailbox_txq,
+ .stop_mailbox_rxq = nbl_hw_stop_mailbox_rxq,
+ .stop_mailbox_txq = nbl_hw_stop_mailbox_txq,
+ .get_host_pf_mask = nbl_hw_get_host_pf_mask,
+ .get_real_bus = nbl_hw_get_real_bus,
+
+ .cfg_mailbox_qinfo = nbl_hw_cfg_mailbox_qinfo,
+ .set_mailbox_irq = nbl_hw_set_mailbox_irq,
+
+ .get_fw_eth_map = nbl_hw_get_fw_eth_map,
+ .get_board_info = nbl_hw_get_board_info,
+};
+
+/* Structure starts here, adding an op should not modify anything below */
+static struct nbl_hw_mgt *nbl_hw_setup_hw_mgt(struct nbl_common_info *common)
+{
+ struct device *dev = common->dev;
+ struct nbl_hw_mgt *hw_mgt;
+
+ hw_mgt = devm_kzalloc(dev, sizeof(*hw_mgt), GFP_KERNEL);
+ if (!hw_mgt)
+ return ERR_PTR(-ENOMEM);
+
+ hw_mgt->common = common;
+
+ return hw_mgt;
+}
+
+static struct nbl_hw_ops_tbl *nbl_hw_setup_ops(struct nbl_common_info *common,
+ struct nbl_hw_mgt *hw_mgt)
+{
+ struct nbl_hw_ops_tbl *hw_ops_tbl;
+ struct device *dev;
+
+ dev = common->dev;
+ hw_ops_tbl = devm_kzalloc(dev, sizeof(*hw_ops_tbl), GFP_KERNEL);
+ if (!hw_ops_tbl)
+ return ERR_PTR(-ENOMEM);
+ if (!hw_ops.cfg_msix_map || !hw_ops.cfg_msix_info ||
+ !hw_ops.flush_write || !hw_ops.update_mailbox_queue_tail_ptr ||
+ !hw_ops.config_mailbox_rxq || !hw_ops.config_mailbox_txq ||
+ !hw_ops.stop_mailbox_rxq || !hw_ops.stop_mailbox_txq ||
+ !hw_ops.get_host_pf_mask || !hw_ops.get_real_bus ||
+ !hw_ops.cfg_mailbox_qinfo || !hw_ops.set_mailbox_irq ||
+ !hw_ops.get_fw_eth_map || !hw_ops.get_board_info ||
+ !hw_ops.init_module || !hw_ops.deinit_module)
+ return ERR_PTR(-EINVAL);
+ hw_ops_tbl->ops = &hw_ops;
+ hw_ops_tbl->priv = hw_mgt;
+
+ return hw_ops_tbl;
+}
+
+static int nbl_pcim_request_selected_bars(struct pci_dev *pdev, u32 mask,
+ const char *name)
+{
+ int bar;
+ int ret;
+
+ for (bar = 0; bar < PCI_STD_NUM_BARS; bar++) {
+ if (!(mask & BIT(bar)))
+ continue;
+ ret = pcim_request_region(pdev, bar, name);
+ if (ret)
+ return ret;
+ }
+ return 0;
+}
+
+int nbl_hw_init_leonis(struct nbl_adapter *adapter)
+{
+ resource_size_t expect_sz = NBL_MEM_BAR_TOTAL_SIZE;
+ struct nbl_common_info *common = &adapter->common;
+ struct nbl_hw_ops_tbl *hw_ops_tbl = NULL;
+ struct pci_dev *pdev = common->pdev;
+ struct nbl_hw_mgt *hw_mgt = NULL;
+ resource_size_t bar_len;
+ resource_size_t hw_size;
+ u32 bar_mask;
+ int ret;
+
+ hw_mgt = nbl_hw_setup_hw_mgt(common);
+ if (IS_ERR(hw_mgt)) {
+ ret = PTR_ERR(hw_mgt);
+ goto setup_mgt_fail;
+ }
+ bar_mask = BIT(NBL_MEMORY_BAR) | BIT(NBL_MAILBOX_BAR);
+ ret = nbl_pcim_request_selected_bars(pdev, bar_mask, NBL_DRIVER_NAME);
+ if (ret) {
+ dev_err(&pdev->dev,
+ "Request memory bar failed, err = %d\n",
+ ret);
+ goto setup_mgt_fail;
+ }
+
+ bar_len = pci_resource_len(pdev, NBL_MEMORY_BAR);
+ if (!(pci_resource_flags(pdev, NBL_MEMORY_BAR) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "MEMORY BAR is not memory resource\n");
+ ret = -EINVAL;
+ goto setup_mgt_fail;
+ }
+ if (common->has_ctrl) {
+ /*
+ * Hardware layout: MEMORY BAR total size is 64M.
+ * The tail NBL_RDMA_NOTIFY_LEN bytes of the 64M BAR are
+ * reserved exclusively for RDMA notify hardware.
+ * Ethernet driver must avoid mapping this reserved tail
+ * to prevent x86 PAT aliasing conflict between eth net
+ * mapping and RDMA driver WC mapping. Mapping starts
+ * at BAR offset 0.
+ *
+ * Skip trailing NBL_RDMA_NOTIFY_LEN bytes at BAR tail.
+ * Round size down to page boundary to avoid ioremap
+ * rounding up and accidentally including RDMA reserved
+ * region when PAGE_SIZE > 8KiB.
+ */
+ if (bar_len < NBL_MEM_BAR_TOTAL_SIZE) {
+ dev_err(&pdev->dev,
+ "MEMORY BAR len %pa smaller than expected %pa\n",
+ &bar_len, &expect_sz);
+ ret = -EINVAL;
+ goto setup_mgt_fail;
+ }
+ hw_size = PAGE_ALIGN_DOWN(NBL_MEM_BAR_TOTAL_SIZE -
+ NBL_RDMA_NOTIFY_LEN);
+ hw_mgt->hw_addr =
+ pcim_iomap(pdev, NBL_MEMORY_BAR,
+ hw_size);
+ } else {
+ if (bar_len < NBL_REG_NET_ONLY_LEN) {
+ dev_err(&pdev->dev,
+ "MEMORY BAR len %pa too small for net only reg space\n",
+ &bar_len);
+ ret = -EINVAL;
+ goto setup_mgt_fail;
+ }
+ hw_size = NBL_REG_NET_ONLY_LEN;
+ hw_mgt->hw_addr = pcim_iomap(pdev, NBL_MEMORY_BAR,
+ hw_size);
+ }
+ if (!hw_mgt->hw_addr) {
+ dev_err(&pdev->dev, "MEMORY BAR pcim_iomap failed\n");
+ ret = -EIO;
+ goto setup_mgt_fail;
+ }
+
+ bar_len = pci_resource_len(pdev, NBL_MAILBOX_BAR);
+ if (!(pci_resource_flags(pdev, NBL_MAILBOX_BAR) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "MAILBOX BAR is not memory resource\n");
+ ret = -EINVAL;
+ goto setup_mgt_fail;
+ }
+ if (bar_len < NBL_BAR2_MAX_LEN) {
+ dev_err(&pdev->dev, "MAILBOX BAR length %pa too small\n",
+ &bar_len);
+ ret = -EINVAL;
+ goto setup_mgt_fail;
+ }
+ hw_mgt->mailbox_bar_hw_addr = pcim_iomap(pdev, NBL_MAILBOX_BAR,
+ bar_len);
+ if (!hw_mgt->mailbox_bar_hw_addr) {
+ dev_err(&pdev->dev, "MAILBOX BAR pcim_iomap failed\n");
+ ret = -EIO;
+ goto setup_mgt_fail;
+ }
+
+ hw_mgt->mailbox_bar_size = bar_len;
+ spin_lock_init(&hw_mgt->reg_lock);
+
+ hw_ops_tbl = nbl_hw_setup_ops(common, hw_mgt);
+ if (IS_ERR(hw_ops_tbl)) {
+ ret = PTR_ERR(hw_ops_tbl);
+ goto setup_mgt_fail;
+ }
+ adapter->intf.hw_ops_tbl = hw_ops_tbl;
+ adapter->core.hw_mgt = hw_mgt;
+
+ return 0;
+
+setup_mgt_fail:
+ return ret;
+}
+
+void nbl_hw_remove_leonis(struct nbl_adapter *adapter)
+{
+ /* All BAR mappings & PCI regions are managed by pcim/devres,
+ * no manual iounmap / release required
+ */
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.h
new file mode 100644
index 0000000000000..99711f18ddc3a
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_hw_leonis.h
@@ -0,0 +1,334 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_HW_LEONIS_H_
+#define _NBL_HW_LEONIS_H_
+
+#include <linux/types.h>
+
+#include "../../nbl_include/nbl_include.h"
+#include "../nbl_hw_reg.h"
+
+#define NBL_DRIVER_STATUS_REG 0x1300444
+#define NBL_DRIVER_STATUS_BIT 16
+
+/* ---------- REG BASE ADDR ---------- */
+/* Interface modules base addr */
+#define NBL_INTF_HOST_PCOMPLETER_BASE 0x00f08000
+#define NBL_INTF_HOST_PADPT_BASE 0x00f4c000
+#define NBL_INTF_HOST_MAILBOX_BASE 0x00fb0000
+#define NBL_INTF_HOST_PCIE_BASE 0X01504000
+/* DP modules base addr */
+#define NBL_DP_USTORE_BASE 0x00104000
+#define NBL_DP_UQM_BASE 0x00114000
+#define NBL_DP_UPED_BASE 0x0015c000
+#define NBL_DP_UVN_BASE 0x00244000
+#define NBL_DP_DSCH_BASE 0x00404000
+#define NBL_DP_SHAPING_BASE 0x00504000
+#define NBL_DP_DVN_BASE 0x00514000
+#define NBL_DP_DSTORE_BASE 0x00704000
+#define NBL_DP_DPED_BASE 0x0075c000
+/* -------- MAILBOX BAR2 ----- */
+#define NBL_MAILBOX_NOTIFY_ADDR 0x00000000
+#define NBL_MAILBOX_QINFO_CFG_RX_TABLE_ADDR 0x10
+#define NBL_MAILBOX_QINFO_CFG_TX_TABLE_ADDR 0x20
+
+/* -------- MAILBOX -------- */
+
+/* mailbox BAR qinfo_cfg_table */
+#define MAILBOX_QINFO_CFG_TABLE_DWLEN 4
+/* data[2] */
+#define NBL_MAILBOX_QINFO_CFG_QUEUE_SIZE_BWID_MASK GENMASK(3, 0)
+/* data[3] */
+#define NBL_MAILBOX_QINFO_CFG_QUEUE_RST_MASK BIT(0)
+#define NBL_MAILBOX_QINFO_CFG_QUEUE_EN_MASK BIT(1)
+#define NBL_MAILBOX_QINFO_CFG_DIF_ERR_MASK BIT(2)
+#define NBL_MAILBOX_QINFO_CFG_PTR_ERR_MASK BIT(3)
+struct nbl_mailbox_qinfo_cfg_table {
+ u32 data[MAILBOX_QINFO_CFG_TABLE_DWLEN];
+};
+
+/* -------- MAILBOX BAR0 ----- */
+/* mailbox qinfo_map_table */
+#define NBL_MAILBOX_QINFO_MAP_REG_ARR(func_id) \
+ (NBL_INTF_HOST_MAILBOX_BASE + 0x00001000 + (func_id) * sizeof(u32))
+
+/* MAILBOX qinfo_map_table */
+#define NBL_MAILBOX_QINFO_MAP_FUNCTION_MASK GENMASK(2, 0)
+#define NBL_MAILBOX_QINFO_MAP_DEVID_MASK GENMASK(7, 3)
+#define NBL_MAILBOX_QINFO_MAP_BUS_MASK GENMASK(15, 8)
+#define NBL_MAILBOX_QINFO_MAP_MSIX_IDX_MASK GENMASK(28, 16)
+#define NBL_MAILBOX_QINFO_MAP_MSIX_IDX_VALID_MASK BIT(29)
+
+/* -------- HOST_PCIE -------- */
+#define NBL_PCIE_HOST_K_PF_MASK_REG (NBL_INTF_HOST_PCIE_BASE + 0x00001004)
+#define NBL_PCIE_HOST_TL_CFG_BUSDEV (NBL_INTF_HOST_PCIE_BASE + 0x11040)
+
+#define NBL_PCIE_BUS_MASK GENMASK(12, 5)
+
+/* -------- HOST_PADPT -------- */
+#define NBL_HOST_PADPT_HOST_CFG_FC_PD_DN (NBL_INTF_HOST_PADPT_BASE + 0x00000160)
+#define NBL_HOST_PADPT_HOST_CFG_FC_PH_DN (NBL_INTF_HOST_PADPT_BASE + 0x00000164)
+#define NBL_HOST_PADPT_HOST_CFG_FC_NPH_DN \
+ (NBL_INTF_HOST_PADPT_BASE + 0x0000016C)
+#define NBL_HOST_PADPT_HOST_CFG_FC_CPLH_UP \
+ (NBL_INTF_HOST_PADPT_BASE + 0x00000170)
+
+#define NBL_HOST_PADPT_CFG_FC_CPLH_UP_VAL 0x10400
+#define NBL_HOST_PADPT_CFG_FC_PD_DN_VAL 0x10080
+#define NBL_HOST_PADPT_CFG_FC_PH_DN_VAL 0x10010
+#define NBL_HOST_PADPT_CFG_FC_NPH_DN_VAL 0x10010
+/* host_padpt host_msix_info */
+#define NBL_PADPT_HOST_MSIX_INFO_REG_ARR(vector_id) \
+ (NBL_INTF_HOST_PADPT_BASE + 0x00010000 + \
+ (vector_id) * sizeof(struct nbl_host_msix_info))
+
+#define NBL_HOST_MSIX_INFO_DWLEN 2
+/* data[0] */
+#define NBL_HOST_MSIX_INFO_INTRL_PNUM_MASK GENMASK(15, 0)
+#define NBL_HOST_MSIX_INFO_INTRL_RATE_MASK GENMASK(31, 16)
+/* data[1] */
+#define NBL_HOST_MSIX_INFO_FUNCTION_MASK GENMASK(2, 0)
+#define NBL_HOST_MSIX_INFO_DEVID_MASK GENMASK(7, 3)
+#define NBL_HOST_MSIX_INFO_BUS_MASK GENMASK(15, 8)
+#define NBL_HOST_MSIX_INFO_VALID_MASK BIT(16)
+#define NBL_HOST_MSIX_INFO_MSIX_MASK_EN_MASK BIT(17)
+struct nbl_host_msix_info {
+ u32 data[NBL_HOST_MSIX_INFO_DWLEN];
+};
+
+/* -------- HOST_PCOMPLETER -------- */
+/* pcompleter_host pcompleter_host_virtio_qid_map_table */
+#define NBL_PCOMPLETER_FUNCTION_MSIX_MAP_REG_ARR(i) \
+ (NBL_INTF_HOST_PCOMPLETER_BASE + 0x00004000 + \
+ (i) * sizeof(struct nbl_function_msix_map))
+#define NBL_PCOMPLETER_HOST_MSIX_FID_TABLE(i) \
+ (NBL_INTF_HOST_PCOMPLETER_BASE + 0x0003a000 + (i) * sizeof(u32))
+
+#define NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_FID_MASK GENMASK(9, 0)
+#define NBL_PCOMPLETER_HOST_MSIX_FID_TABLE_VLD_MASK BIT(10)
+
+#define NBL_FUNC_MSIX_MAP_DWLEN 4
+/* data[2] */
+#define NBL_FUNCTION_MSIX_MAP_FUNCTION_MASK GENMASK(2, 0)
+#define NBL_FUNCTION_MSIX_MAP_DEVID_MASK GENMASK(7, 3)
+#define NBL_FUNCTION_MSIX_MAP_BUS_MASK GENMASK(15, 8)
+#define NBL_FUNCTION_MSIX_MAP_VALID_MASK BIT(16)
+struct nbl_function_msix_map {
+ u32 data[NBL_FUNC_MSIX_MAP_DWLEN];
+};
+
+/* ---------- DPED ---------- */
+#define NBL_DPED_VLAN_OFFSET (NBL_DP_DPED_BASE + 0x000003F4)
+#define NBL_DPED_DSCP_OFFSET_0 (NBL_DP_DPED_BASE + 0x000003F8)
+#define NBL_DPED_DSCP_OFFSET_1 (NBL_DP_DPED_BASE + 0x000003FC)
+/* DPED hw_edt_prof/ UPED hw_edt_prof */
+
+#define NBL_DPED_L4_CK_CMD_40_ADDR (NBL_DP_DPED_BASE + 0x00000338)
+
+#define NBL_DPED_L4_CK_CMD_40_EN_MASK BIT(31)
+
+/* ---------- UPED ---------- */
+/* UPED uped_hw_edt_prof */
+#define NBL_UPED_HW_EDT_PROF_TABLE(i) \
+ (NBL_DP_UPED_BASE + 0x00001000 + (i) * sizeof(u32))
+#define NBL_UPED_V4_TCP_IDX 5
+#define NBL_UPED_V6_TCP_IDX 6
+#define NBL_PED_HW_EDIT_PROFILE_L3_LEN_MASK GENMASK(3, 2)
+
+/* ---------- DSCH ---------- */
+#define NBL_DSCH_PSHA_EN_MASK GENMASK(3, 0)
+/* DSCH dsch maxqid */
+#define NBL_DSCH_HOST_QID_MAX (NBL_DP_DSCH_BASE + 0x00000118)
+#define NBL_DSCH_VN_QUANTA_ADDR (NBL_DP_DSCH_BASE + 0x00000134)
+
+#define NBL_MAX_QUEUE_ID 0x7ff
+#define NBL_HOST_QUANTA 0x8000
+#define NBL_ECPU_QUANTA 0x1000
+
+#define NBL_DSCH_VN_QUANTA_H_QUA_MASK GENMASK(15, 0)
+#define NBL_DSCH_VN_QUANTA_E_QUA_MASK GENMASK(31, 16)
+
+/* ---------- DVN ---------- */
+/* DVN dvn_queue_table */
+#define NBL_DVN_ECPU_QUEUE_NUM (NBL_DP_DVN_BASE + 0x0000041C)
+#define NBL_DVN_DESCREQ_NUM_CFG (NBL_DP_DVN_BASE + 0x00000430)
+#define NBL_DVN_DESC_WR_MERGE_TIMEOUT (NBL_DP_DVN_BASE + 0x00000480)
+#define NBL_DVN_DIF_REQ_RD_RO_FLAG (NBL_DP_DVN_BASE + 0x0000045C)
+
+#define DEFAULT_DVN_DESCREQ_NUMCFG 0x03
+#define DEFAULT_DVN_100G_DESCREQ_NUMCFG 0x07
+
+#define DEFAULT_DVN_DESC_WR_MERGE_TIMEOUT_MAX 0x3FF
+
+/* spilit ring descreq_num 0:8,1:16 */
+#define NBL_DVN_DESCREQ_NUM_CFG_AVRING_DESREQ_NUM_CFG_MASK BIT(0)
+/* packet ring descreq_num
+ * 0:8,1:12,2:16;3:20,4:24,5:26;6:32,7:32
+ */
+#define NBL_DVN_DESCREQ_NUM_CFG_PACKED_L1_NUM_MASK GENMASK(6, 4)
+
+#define NBL_DVN_DESC_WR_MERGE_TIMEOUT_CFG_CYCLE_MASK GENMASK(9, 0)
+
+#define NBL_DVN_DIF_REQ_RD_RO_FLAG_DESC_RO_EN_MASK BIT(0)
+#define NBL_DVN_DIF_REQ_RD_RO_FLAG_DATA_RO_EN_MASK BIT(1)
+#define NBL_DVN_DIF_REQ_RD_RO_FLAG_AVRING_RO_EN_MASK BIT(2)
+
+/* ---------- UVN ---------- */
+/* UVN uvn_queue_table */
+
+#define NBL_UVN_DESC_RD_WAIT (NBL_DP_UVN_BASE + 0x0000020C)
+#define NBL_UVN_QUEUE_ERR_MASK (NBL_DP_UVN_BASE + 0x00000224)
+#define NBL_UVN_ECPU_QUEUE_NUM (NBL_DP_UVN_BASE + 0x0000023C)
+#define NBL_UVN_DESC_WR_TIMEOUT (NBL_DP_UVN_BASE + 0x00000214)
+#define NBL_UVN_DIF_REQ_RO_FLAG (NBL_DP_UVN_BASE + 0x00000250)
+#define NBL_UVN_DESC_PREFETCH_INIT (NBL_DP_UVN_BASE + 0x00000204)
+#define NBL_UVN_DESC_PREFETCH_NUM 4
+
+#define NBL_UVN_DIF_REQ_RO_FLAG_AVAIL_RD_MASK BIT(0)
+#define NBL_UVN_DIF_REQ_RO_FLAG_DESC_RD_MASK BIT(1)
+#define NBL_UVN_DIF_REQ_RO_FLAG_PKT_WR_MASK BIT(2)
+#define NBL_UVN_DIF_REQ_RO_FLAG_DESC_WR_MASK BIT(3)
+
+#define NBL_UVN_DESC_WR_TIMEOUT_NUM_MASK GENMASK(14, 0)
+
+#define NBL_UVN_QUEUE_ERR_MASK_DIF_ERR_MASK BIT(5)
+
+#define NBL_UVN_DESC_PREFETCH_INIT_NUM_MASK GENMASK(7, 0)
+#define NBL_UVN_DESC_PREFETCH_INIT_SEL_MASK BIT(16)
+
+#define NBL_UVN_DESC_WR_TIMEOUT_VAL 0x12c
+/* 200us = 200000ns / 1.67ns per tick = 119760 ticks */
+#define NBL_UVN_DESC_RD_WAIT_TICKS 119760
+
+/* -------- USTORE -------- */
+#define NBL_USTORE_PKT_LEN_ADDR (NBL_DP_USTORE_BASE + 0x00000108)
+#define NBL_USTORE_PORT_DROP_TH_REG_ARR(port_id) \
+ (NBL_DP_USTORE_BASE + 0x00000150 + (port_id) * sizeof(u32))
+#define NBL_USTORE_BUF_PORT_DROP_PKT(eth_id) \
+ (NBL_DP_USTORE_BASE + 0x00002500 + (eth_id) * sizeof(u32))
+#define NBL_USTORE_BUF_PORT_TRUN_PKT(eth_id) \
+ (NBL_DP_USTORE_BASE + 0x00002540 + (eth_id) * sizeof(u32))
+
+#define NBL_USTORE_SINGLE_ETH_DROP_TH 0xC80
+#define NBL_USTORE_DUAL_ETH_DROP_TH 0x640
+#define NBL_USTORE_QUAD_ETH_DROP_TH 0x320
+
+/* USTORE pkt_len */
+#define NBL_USTORE_PKT_LEN_MIN_MASK GENMASK(6, 0)
+
+/* USTORE port_drop_th */
+#define NBL_USTORE_PORT_DROP_TH_DISC_TH_MASK GENMASK(11, 0)
+#define NBL_USTORE_PORT_DROP_TH_EN_MASK BIT(31)
+
+/* UQM*/
+#define NBL_UQM_QUE_TYPE (NBL_DP_UQM_BASE + 0x0000013c)
+#define NBL_UQM_DROP_PKT_CNT (NBL_DP_UQM_BASE + 0x000009C0)
+#define NBL_UQM_DROP_PKT_SLICE_CNT (NBL_DP_UQM_BASE + 0x000009C4)
+#define NBL_UQM_DROP_PKT_LEN_ADD_CNT (NBL_DP_UQM_BASE + 0x000009C8)
+#define NBL_UQM_DROP_HEAD_PNTR_ADD_CNT (NBL_DP_UQM_BASE + 0x000009CC)
+#define NBL_UQM_DROP_WEIGHT_ADD_CNT (NBL_DP_UQM_BASE + 0x000009D0)
+#define NBL_UQM_PORT_DROP_PKT_CNT (NBL_DP_UQM_BASE + 0x000009D4)
+#define NBL_UQM_PORT_DROP_PKT_SLICE_CNT (NBL_DP_UQM_BASE + 0x000009F4)
+#define NBL_UQM_PORT_DROP_PKT_LEN_ADD_CNT (NBL_DP_UQM_BASE + 0x00000A14)
+#define NBL_UQM_PORT_DROP_HEAD_PNTR_ADD_CNT (NBL_DP_UQM_BASE + 0x00000A34)
+#define NBL_UQM_PORT_DROP_WEIGHT_ADD_CNT (NBL_DP_UQM_BASE + 0x00000A54)
+#define NBL_UQM_FWD_DROP_CNT (NBL_DP_UQM_BASE + 0x00000A80)
+#define NBL_UQM_DPORT_DROP_CNT (NBL_DP_UQM_BASE + 0x00000B74)
+
+#define NBL_UQM_PORT_DROP_DEPTH 6
+#define NBL_UQM_DPORT_DROP_DEPTH 16
+
+/* --------- SHAPING --------- */
+
+/* Shaping rate unit: 1 = 1 Mbit/s.
+ * e.g. 100000 = 100 Gbit/s, 25000 = 25 Gbit/s.
+ */
+#define NBL_LR_LEONIS_NET_BUCKET_DEPTH 9600
+#define NBL_SHAPING_DPORT_ADDR (NBL_DP_SHAPING_BASE + 0x700)
+#define NBL_SHAPING_DPORT_DWLEN 4
+#define NBL_SHAPING_DPORT_REG(r) \
+ (NBL_SHAPING_DPORT_ADDR + (NBL_SHAPING_DPORT_DWLEN * 4) * (r))
+#define NBL_SHAPING_DVN_DPORT_ADDR (NBL_DP_SHAPING_BASE + 0x750)
+#define NBL_SHAPING_DVN_DPORT_DWLEN 4
+#define NBL_SHAPING_DVN_DPORT_REG(r) \
+ (NBL_SHAPING_DVN_DPORT_ADDR + (NBL_SHAPING_DVN_DPORT_DWLEN * 4) * (r))
+#define NBL_DSCH_PSHA_EN_ADDR (NBL_DP_DSCH_BASE + 0x00000314)
+#define NBL_SHAPING_NET_ADDR (NBL_DP_SHAPING_BASE + 0x1800)
+#define NBL_SHAPING_NET_DWLEN 4
+#define NBL_SHAPING_NET_REG(r) \
+ (NBL_SHAPING_NET_ADDR + (NBL_SHAPING_NET_DWLEN * 4) * (r))
+
+#define NBL_DPORT_VALID_MASK GENMASK_ULL(0, 0)
+#define NBL_DPORT_DEPTH_MASK GENMASK_ULL(19, 1)
+#define NBL_DPORT_CIR_MASK GENMASK_ULL(38, 20)
+#define NBL_DPORT_PIR_MASK GENMASK_ULL(57, 39)
+#define NBL_DPORT_CBS_MASK_LOW GENMASK_ULL(63, 58)
+#define NBL_DPORT_CBS_MASK_HIGH GENMASK_ULL(14, 0)
+#define NBL_DPORT_PBS_MASK GENMASK_ULL(35, 15)
+
+/* SHAPING shaping_net */
+struct nbl_shaping_net_u {
+ u32 data[NBL_SHAPING_NET_DWLEN];
+};
+
+struct nbl_shaping_dport_u {
+ u32 data[NBL_SHAPING_DPORT_DWLEN];
+};
+
+struct nbl_shaping_dvn_dport_u {
+ u32 data[NBL_SHAPING_DVN_DPORT_DWLEN];
+};
+
+/* -------- DSTORE -------- */
+#define NBL_DSTORE_D_DPORT_FC_TH_ADDR (NBL_DP_DSTORE_BASE + 0x00000600)
+#define NBL_DSTORE_D_DPORT_FC_TH_DEPTH 5
+#define NBL_DSTORE_D_DPORT_FC_TH_WIDTH 32
+#define NBL_DSTORE_D_DPORT_FC_TH_DWLEN 1
+
+#define NBL_DSTORE_D_DPORT_FC_XOFF_TH_MASK GENMASK(10, 0)
+#define NBL_DSTORE_D_DPORT_FC_XON_TH_MASK GENMASK(26, 16)
+#define NBL_DSTORE_D_DPORT_FC_FC_EN_MASK BIT(31)
+
+#define NBL_DSTORE_D_DPORT_FC_TH_REG(r) \
+ (NBL_DSTORE_D_DPORT_FC_TH_ADDR + \
+ (NBL_DSTORE_D_DPORT_FC_TH_DWLEN * 4) * (r))
+#define NBL_DSTORE_PORT_DROP_TH_ADDR (NBL_DP_DSTORE_BASE + 0x00000150)
+#define NBL_DSTORE_PORT_DROP_TH_DEPTH 6
+#define NBL_DSTORE_PORT_DROP_TH_WIDTH 32
+#define NBL_DSTORE_PORT_DROP_TH_DWLEN 1
+
+#define NBL_DSTORE_PORT_DROP_EN_MASK BIT(31)
+
+#define NBL_DSTORE_DROP_XOFF_TH 0xC8
+#define NBL_DSTORE_DROP_XON_TH 0x64
+
+#define NBL_DSTORE_DROP_XOFF_TH_100G 0x1F4
+#define NBL_DSTORE_DROP_XON_TH_100G 0x12C
+
+#define NBL_DSTORE_DISC_BP_TH (NBL_DP_DSTORE_BASE + 0x00000630)
+
+#define NBL_DSTORE_DISC_BP_TH_EN_MASK BIT(31)
+
+#define NBL_DSTORE_PORT_DROP_TH_REG(r) \
+ (NBL_DSTORE_PORT_DROP_TH_ADDR + \
+ (NBL_DSTORE_PORT_DROP_TH_DWLEN * 4) * (r))
+
+#define NBL_FW_BOARD_CONFIG 0x200
+#define NBL_FW_BOARD_DW3_OFFSET (NBL_FW_BOARD_CONFIG + 12)
+#define NBL_FW_BOARD_DW6_OFFSET (NBL_FW_BOARD_CONFIG + 24)
+
+#define NBL_FW_BOARD_DW3_PORT_TYPE_MASK BIT(0)
+#define NBL_FW_BOARD_DW3_PORT_NUM_MASK GENMASK(7, 1)
+#define NBL_FW_BOARD_DW3_PORT_SPEED_MASK GENMASK(9, 8)
+#define NBL_FW_BOARD_DW3_GPIO_TYPE_MASK GENMASK(12, 10)
+#define NBL_FW_BOARD_DW3_P4_VERSION_MASK GENMASK(13, 13)
+
+#define NBL_FW_BOARD_DW6_LANE_BITMAP_MASK GENMASK(7, 0)
+#define NBL_FW_BOARD_DW6_ETH_BITMAP_MASK GENMASK(15, 8)
+
+#define NBL_LEONIS_QUIRKS_OFFSET 0x00000140
+#define NBL_BAR2_MAX_LEN 0x300
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.c
new file mode 100644
index 0000000000000..c6f8afc3a7235
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.c
@@ -0,0 +1,365 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/device.h>
+#include <linux/pci.h>
+#include <linux/bits.h>
+#include "nbl_resource_leonis.h"
+
+static struct nbl_resource_ops res_ops = {
+ .get_vsi_id = nbl_res_func_id_to_vsi_id,
+ .get_eth_id = nbl_res_get_eth_id,
+ .cfg_msix_map = nbl_res_intr_cfg_msix_map,
+ .destroy_msix_map = nbl_res_intr_destroy_msix_map,
+ .set_mailbox_irq = nbl_res_intr_set_mailbox_irq,
+ .init_module = nbl_res_chip_init_module,
+ .deinit_module = nbl_res_chip_deinit_module,
+};
+
+static struct nbl_resource_mgt *
+nbl_res_setup_res_mgt(struct nbl_common_info *common)
+{
+ struct nbl_resource_info *resource_info;
+ struct nbl_resource_mgt *res_mgt;
+ struct device *dev = common->dev;
+
+ res_mgt = devm_kzalloc(dev, sizeof(*res_mgt), GFP_KERNEL);
+ if (!res_mgt)
+ return ERR_PTR(-ENOMEM);
+ res_mgt->common = common;
+
+ resource_info =
+ devm_kzalloc(dev, sizeof(*resource_info), GFP_KERNEL);
+ if (!resource_info)
+ return ERR_PTR(-ENOMEM);
+ res_mgt->resource_info = resource_info;
+
+ return res_mgt;
+}
+
+static struct nbl_resource_ops_tbl *
+nbl_res_setup_ops(struct device *dev, struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_resource_ops_tbl *res_ops_tbl;
+
+ res_ops_tbl = devm_kzalloc(dev, sizeof(*res_ops_tbl), GFP_KERNEL);
+ if (!res_ops_tbl)
+ return ERR_PTR(-ENOMEM);
+ if (!res_ops.get_vsi_id || !res_ops.get_eth_id ||
+ !res_ops.cfg_msix_map || !res_ops.destroy_msix_map ||
+ !res_ops.set_mailbox_irq || !res_ops.init_module ||
+ !res_ops.deinit_module)
+ return ERR_PTR(-EINVAL);
+ res_ops_tbl->ops = &res_ops;
+ res_ops_tbl->priv = res_mgt;
+
+ return res_ops_tbl;
+}
+
+static int nbl_res_ctrl_dev_setup_eth_info(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ struct device *dev = res_mgt->common->dev;
+ struct nbl_eth_info *eth_info;
+ u32 eth_bitmap = 0, eth_id;
+ u32 eth_num = 0;
+ u32 fw_port_num;
+ int i;
+
+ eth_info = devm_kzalloc(dev, sizeof(*eth_info), GFP_KERNEL);
+ if (!eth_info)
+ return -ENOMEM;
+
+ res_mgt->resource_info->eth_info = eth_info;
+
+ fw_port_num = res_mgt->resource_info->board_info.eth_num;
+
+ hw_ops->get_fw_eth_map(res_mgt->hw_ops_tbl->priv, ð_bitmap);
+ if (eth_bitmap & ~((1 << NBL_MAX_ETHERNET) - 1)) {
+ dev_err(dev, "FW reported invalid eth_bitmap 0x%x\n",
+ eth_bitmap);
+ return -EINVAL;
+ }
+ if (fw_port_num != hweight32(eth_bitmap)) {
+ dev_err(dev, "FW inconsistency: port_num=%u, bitmap=0x%x\n",
+ fw_port_num, eth_bitmap);
+ return -EINVAL;
+ }
+ /*
+ * Firmware is ready before probe. Valid port counts are 1/2/4;
+ * 0 (invalid config), 3 (unsupported topology), and >4 (exceeds
+ * hardware max) are all rejected with -EINVAL.
+ */
+ if (fw_port_num == 0 || fw_port_num == 3 ||
+ fw_port_num > NBL_MAX_ETHERNET) {
+ dev_err(dev, "FW reports %u Ethernet ports, unsupported (valid: 1/2/4)\n",
+ fw_port_num);
+ return -EINVAL;
+ }
+ eth_info->eth_num = fw_port_num;
+ /* Intentional design constraint: each PF maps to exactly one
+ * Ethernet port. This couples PF identity to port identity
+ * and is required by nbl_res_get_eth_id() which indexes
+ * eth_info->eth_id[] by relative PF id.
+ */
+ if (res_mgt->common->max_pf != eth_info->eth_num) {
+ dev_err(dev, "Invalid PF-to-port topology: max_pf=%u, eth_num=%u\n",
+ res_mgt->common->max_pf, eth_info->eth_num);
+ return -EINVAL;
+ }
+
+ /*
+ * Any subset of valid bitmap bits is accepted (e.g. 0/1, 0/2,
+ * 1/3, etc.). Firmware only needs to report the correct count
+ * of active ports; no hard-coded fixed bit positions required.
+ */
+ for (i = 0; i < NBL_MAX_ETHERNET; i++) {
+ if ((1 << i) & eth_bitmap) {
+ set_bit(i, eth_info->eth_bitmap);
+ eth_info->eth_id[eth_num] = i;
+ eth_info->logic_eth_id[i] = eth_num;
+ eth_num++;
+ }
+ }
+
+ for (i = 0; i < res_mgt->common->max_pf; i++) {
+ eth_id = eth_info->eth_id[i];
+ eth_info->pf_bitmap[eth_id] |= BIT(i);
+ }
+
+ return 0;
+}
+
+static int nbl_res_ctrl_dev_sriov_info_init(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ struct nbl_hw_mgt *p = res_mgt->hw_ops_tbl->priv;
+ struct nbl_common_info *common = res_mgt->common;
+ struct nbl_sriov_info *sriov_info;
+ struct device *dev = common->dev;
+ u8 hw_bus = 0;
+ u16 function;
+ u16 func_id;
+
+ hw_ops->get_real_bus(p, &hw_bus);
+ if (common->function + common->max_pf > NBL_MAX_PF) {
+ dev_err(dev, "PF count exceeds available function space\n");
+ return -EINVAL;
+ }
+ sriov_info = devm_kcalloc(dev, common->max_pf,
+ sizeof(*sriov_info), GFP_KERNEL);
+ if (!sriov_info)
+ return -ENOMEM;
+
+ res_mgt->resource_info->sriov_info = sriov_info;
+ /*
+ * common->hw_bus supplies bus number for channel mailbox QINFO mapping.
+ * Execution order guarantee: this assignment runs before
+ * cfg_chan_qinfo_map_table(), only executed
+ * on control PF path.
+ */
+ common->hw_bus = hw_bus;
+
+ for (func_id = 0; func_id < common->max_pf; func_id++) {
+ sriov_info = res_mgt->resource_info->sriov_info + func_id;
+ function = common->function + func_id;
+ sriov_info->bdf = PCI_DEVID(common->hw_bus,
+ PCI_DEVFN(common->devid, function));
+ }
+
+ return 0;
+}
+
+static int nbl_res_ctrl_dev_vsi_info_init(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_eth_info *eth_info = res_mgt->resource_info->eth_info;
+ struct nbl_common_info *common = res_mgt->common;
+ struct device *dev = common->dev;
+ struct nbl_vsi_info *vsi_info;
+ int i;
+
+ vsi_info = devm_kzalloc(dev, sizeof(*vsi_info), GFP_KERNEL);
+ if (!vsi_info)
+ return -ENOMEM;
+
+ res_mgt->resource_info->vsi_info = vsi_info;
+ /*
+ * case 1 one port(1pf)
+ * pf0 (NBL_VSI_SERV_PF_DATA_TYPE) vsi is 0
+ * case 2 two port(2pf)
+ * pf0,pf1(NBL_VSI_SERV_PF_DATA_TYPE) vsi is 0,512
+ * case 3 four port(4pf)
+ * pf0,pf1,pf2,pf3(NBL_VSI_SERV_PF_DATA_TYPE) vsi is 0,256,512,768
+ */
+
+ vsi_info->num = eth_info->eth_num;
+ /*
+ * eth_num can be 1/2/4:
+ * - 2/4 ports use dedicated gap constants;
+ * - 1 port falls back to NBL_DEFAULT_VSI_ID_GAP (1024).
+ * All three values produce valid base_id offsets.
+ */
+ for (i = 0; i < vsi_info->num; i++) {
+ vsi_info->serv_info[i][NBL_VSI_SERV_PF_DATA_TYPE].base_id =
+ i * nbl_vsi_id_gap(vsi_info->num);
+ vsi_info->serv_info[i][NBL_VSI_SERV_PF_DATA_TYPE].num = 1;
+ }
+
+ return 0;
+}
+
+static int nbl_res_init_pf_num(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ u32 exp_contiguous_mask = 0;
+ u32 pf_mask = 0;
+ u32 pf_num = 0;
+ int i;
+
+ hw_ops->get_host_pf_mask(res_mgt->hw_ops_tbl->priv, &pf_mask);
+
+ /*
+ * k_pf_mask register rule:
+ * bit N == 0 -> PF#N enabled; bit N == 1 -> PF#N masked out.
+ * Hardware constraint: bit0 is PF0's mask bit; driver requires
+ * PF0 enabled as management PF, so bit0 must be clear.
+ * All-zero pf_mask means all PF0~PF7 are enabled, which is unsupported
+ * by the driver
+ *
+ * Product firmware constraint: only 3 valid configurations supported:
+ * 1 PF (PF0 only): pf_num = 1, mask = 0xfe
+ * 2 PFs (PF0,PF1): pf_num = 2, mask = 0xfc
+ * 4 PFs (PF0~PF3): pf_num = 4, mask = 0xf0
+ * No other PF count or sparse/non-contiguous PF layout is allowed.
+ */
+ for (i = 0; i < NBL_MAX_PF; i++) {
+ if (!(pf_mask & (1 << i)))
+ pf_num++;
+ }
+
+ /*
+ * Sanity check: enabled PFs must be contiguous starting from PF0.
+ * Current resource framework uses relative PF id, sparse PF layout
+ * will cause mismatch between resource layer and hardware func_id.
+ */
+ for (i = 0; i < pf_num; i++)
+ exp_contiguous_mask |= BIT(i);
+ if ((pf_mask & exp_contiguous_mask) != 0) {
+ dev_err(res_mgt->common->dev,
+ "pf_mask 0x%08x: non-contiguous enabled PF, unsupported\n",
+ pf_mask);
+ return -EINVAL;
+ }
+
+ /* Only allow product-specified PF count: 1 / 2 / 4 */
+ if (pf_num != 1 && pf_num != 2 && pf_num != 4) {
+ dev_err(res_mgt->common->dev,
+ "Invalid pf_num=%u (mask=0x%08x), only 1/2/4 PFs supported\n",
+ pf_num, pf_mask);
+ return -EINVAL;
+ }
+
+ res_mgt->common->max_pf = pf_num;
+
+ return 0;
+}
+
+static void nbl_res_init_board_info(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+
+ hw_ops->get_board_info(res_mgt->hw_ops_tbl->priv,
+ &res_mgt->resource_info->board_info);
+}
+
+static int nbl_res_start(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_common_info *common = res_mgt->common;
+ int ret = 0;
+
+ if (common->has_ctrl) {
+ nbl_res_init_board_info(res_mgt);
+
+ ret = nbl_res_init_pf_num(res_mgt);
+ if (ret)
+ return ret;
+
+ ret = nbl_res_ctrl_dev_sriov_info_init(res_mgt);
+ if (ret)
+ return ret;
+
+ ret = nbl_res_ctrl_dev_setup_eth_info(res_mgt);
+ if (ret)
+ return ret;
+
+ ret = nbl_res_ctrl_dev_vsi_info_init(res_mgt);
+ if (ret)
+ return ret;
+
+ ret = nbl_intr_mgt_start(res_mgt);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
+int nbl_res_init_leonis(struct nbl_adapter *adap)
+{
+ struct nbl_channel_ops_tbl *chan_ops_tbl = adap->intf.channel_ops_tbl;
+ struct nbl_hw_ops_tbl *hw_ops_tbl = adap->intf.hw_ops_tbl;
+ struct nbl_common_info *common = &adap->common;
+ struct nbl_resource_ops_tbl *res_ops_tbl;
+ struct device *dev = &adap->pdev->dev;
+ struct nbl_resource_mgt *res_mgt;
+ int ret;
+
+ res_mgt = nbl_res_setup_res_mgt(common);
+ if (IS_ERR(res_mgt)) {
+ ret = PTR_ERR(res_mgt);
+ return ret;
+ }
+ res_mgt->chan_ops_tbl = chan_ops_tbl;
+ res_mgt->hw_ops_tbl = hw_ops_tbl;
+
+ ret = nbl_res_start(res_mgt);
+ if (ret)
+ return ret;
+
+ res_ops_tbl = nbl_res_setup_ops(dev, res_mgt);
+ if (IS_ERR(res_ops_tbl)) {
+ ret = PTR_ERR(res_ops_tbl);
+ return ret;
+ }
+ adap->intf.resource_ops_tbl = res_ops_tbl;
+ adap->core.res_mgt = res_mgt;
+
+ return 0;
+}
+
+void nbl_res_remove_leonis(struct nbl_adapter *adap)
+{
+ struct nbl_resource_mgt *res_mgt = adap->core.res_mgt;
+ struct nbl_common_info *common = &adap->common;
+
+ if (!res_mgt)
+ return;
+
+ /*
+ * Tear down all MSI-X maps before devres releases the coherent
+ * tables. This is critical on the control PF, which may hold
+ * maps for remote PFs that are still bound.
+ */
+ if (common->has_ctrl && res_mgt->intr_mgt)
+ nbl_intr_mgt_stop(res_mgt);
+
+ /* Note:
+ * per-function interrupts arrays (kcalloc) are freed by
+ * nbl_intr_mgt_stop().
+ * MSIX coherent tables are explicitly freed by dmam_free_coherent()
+ * inside the intr destroy path, before nbl_intr_mgt_stop() returns.
+ * intr_mgt itself (devm_kzalloc) is released by devres after this
+ * function returns
+ */
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.h
new file mode 100644
index 0000000000000..f1cb0f23240b0
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_resource_leonis.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_RESOURCE_LEONIS_H_
+#define _NBL_RESOURCE_LEONIS_H_
+
+#include "../nbl_resource.h"
+#include "../nbl_interrupt.h"
+#include "../nbl_chip.h"
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_reg.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_reg.h
new file mode 100644
index 0000000000000..795f29bfb47a9
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_reg.h
@@ -0,0 +1,75 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_HW_REG_H_
+#define _NBL_HW_REG_H_
+
+#include <linux/types.h>
+
+#include "../nbl_include/nbl_def_channel.h"
+#include "../nbl_include/nbl_def_hw.h"
+#include "../nbl_include/nbl_def_common.h"
+#include "../nbl_core.h"
+
+#define NBL_MEMORY_BAR 0
+#define NBL_MAILBOX_BAR 2
+#define NBL_RDMA_NOTIFY_LEN (8ULL << 10)
+#define NBL_REG_NET_ONLY_LEN (8ULL << 10)
+#define NBL_HW_DUMMY_REG 0x1300904
+/*
+ * PCI MEMORY BAR total size: 64MiB.
+ */
+#define NBL_MEM_BAR_TOTAL_SIZE (64ULL << 20)
+
+struct nbl_hw_mgt {
+ struct nbl_common_info *common;
+ u8 __iomem *hw_addr;
+ u8 __iomem *mailbox_bar_hw_addr;
+ resource_size_t mailbox_bar_size;
+ spinlock_t reg_lock; /* Protect reg access */
+};
+
+static inline u32 rd32(u8 __iomem *addr, u64 reg)
+{
+ return readl(addr + reg);
+}
+
+static inline void wr32(u8 __iomem *addr, u64 reg, u32 value)
+{
+ writel(value, addr + reg);
+}
+
+static inline void nbl_hw_wr32(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 value)
+{
+ wr32(hw_mgt->hw_addr, reg, value);
+}
+
+static inline u32 nbl_hw_rd32(struct nbl_hw_mgt *hw_mgt, u64 reg)
+{
+ return rd32(hw_mgt->hw_addr, reg);
+}
+
+static inline void nbl_mbx_wr32(struct nbl_hw_mgt *hw_mgt, u64 reg, u32 value)
+{
+ writel(value, hw_mgt->mailbox_bar_hw_addr + reg);
+}
+
+/*
+ * Only call this when has_ctrl=true, which maps enough space
+ * (bar_len - 8192) to cover NBL_HW_DUMMY_REG (0x1300904).
+ * The flow/design guarantees this is only called in the
+ * has_ctrl path.
+ */
+static inline void nbl_flush_writes(struct nbl_hw_mgt *hw_mgt)
+{
+ nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
+}
+
+static inline u32 nbl_mbx_rd32(struct nbl_hw_mgt *hw_mgt, u64 reg)
+{
+ return readl(hw_mgt->mailbox_bar_hw_addr + reg);
+}
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.c
new file mode 100644
index 0000000000000..6ad65f6e1c615
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.c
@@ -0,0 +1,591 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/bitfield.h>
+#include "nbl_interrupt.h"
+
+#define NBL_MSIX_DMA_SYNC_MIN_US 1000 /* us */
+#define NBL_MSIX_DMA_SYNC_MAX_US 1200 /* us */
+
+/*
+ * Release global vector IDs back to intr_net_bmap / intr_other_bmap.
+ * Caller must hold intr_mgt->lock.
+ */
+static void nbl_intr_release_bitmap(struct nbl_resource_mgt *res_mgt,
+ u16 *vec_buf, u16 cnt)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ u16 bit;
+ u16 i;
+
+ lockdep_assert_held(&intr_mgt->lock);
+
+ if (!vec_buf || cnt == 0)
+ return;
+
+ for (i = 0; i < cnt; i++) {
+ u16 intr_index = vec_buf[i];
+
+ if (intr_index >= NBL_NET_INTR_BASE) {
+ bit = intr_index - NBL_NET_INTR_BASE;
+ if (bit < NBL_MAX_NET_INTERRUPT)
+ clear_bit(bit, intr_mgt->intr_net_bmap);
+ else
+ dev_warn(res_mgt->common->dev,
+ "invalid net intr index %u\n",
+ intr_index);
+ } else {
+ if (intr_index < NBL_MAX_OTHER_INTERRUPT)
+ clear_bit(intr_index,
+ intr_mgt->intr_other_bmap);
+ else
+ dev_warn(res_mgt->common->dev,
+ "invalid other intr index %u\n",
+ intr_index);
+ }
+ }
+}
+
+/*
+ * Internal (unlocked) mailbox IRQ bind. Caller must hold
+ * intr_mgt->lock. The disable path does not require a configured
+ * MSI-X map because the hardware op ignores gvec when
+ * en_msix=false.
+ */
+static int __nbl_res_intr_set_mailbox_irq(struct nbl_resource_mgt *res_mgt,
+ u16 func_id, u16 vector_id,
+ bool en_msix)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ struct nbl_common_info *common = res_mgt->common;
+ struct device *dev = common->dev;
+ u16 gvec;
+
+ lockdep_assert_held(&intr_mgt->lock);
+
+ if (func_id >= NBL_MAX_FUNC) {
+ dev_err(dev, "func_id %u out of range\n", func_id);
+ return -EINVAL;
+ }
+
+ if (!en_msix) {
+ hw_ops->set_mailbox_irq(res_mgt->hw_ops_tbl->priv,
+ func_id, false, 0);
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+ return 0;
+ }
+
+ if (!intr_mgt->func_intr_res[func_id].interrupts) {
+ dev_err(dev, "func %u MSIX map not configured\n", func_id);
+ return -ENODEV;
+ }
+
+ if (vector_id >= intr_mgt->func_intr_res[func_id].num_interrupts) {
+ dev_err(dev, "vector_id %u out of range (max %u)\n",
+ vector_id,
+ intr_mgt->func_intr_res[func_id].num_interrupts - 1);
+ return -EINVAL;
+ }
+
+ gvec = intr_mgt->func_intr_res[func_id].interrupts[vector_id];
+ hw_ops->set_mailbox_irq(res_mgt->hw_ops_tbl->priv, func_id,
+ en_msix, gvec);
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+
+ return 0;
+}
+
+/*
+ * Internal (unlocked) MSI-X map teardown prepare phase: only hardware register
+ * operations. Caller must hold intr_mgt->lock.
+ */
+static int
+__nbl_res_intr_prepare_destroy_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ u16 *interrupts;
+ u16 intr_num, i;
+ int ret;
+
+ lockdep_assert_held(&intr_mgt->lock);
+
+ if (func >= NBL_MAX_FUNC) {
+ dev_err(res_mgt->common->dev, "Invalid func_id %u\n", func);
+ return -EINVAL;
+ }
+
+ interrupts = intr_mgt->func_intr_res[func].interrupts;
+ if (!interrupts)
+ return 0;
+
+ intr_num = intr_mgt->func_intr_res[func].num_interrupts;
+
+ /* Step 0: disable mailbox IRQ routing before tearing down map */
+ ret = __nbl_res_intr_set_mailbox_irq(res_mgt, func, 0, false);
+ if (ret) {
+ dev_err(res_mgt->common->dev, "disable mailbox irq failed, func=%u ret=%d\n",
+ func, ret);
+ return ret;
+ }
+
+ /* Step 1: invalidate each MSIX info entry in hardware first */
+ for (i = 0; i < intr_num; i++) {
+ hw_ops->cfg_msix_info(res_mgt->hw_ops_tbl->priv,
+ func, false, interrupts[i],
+ 0, 0, 0, false);
+ }
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+
+ /* Stage1 tear down: retain DMA address, only clear VALID bit */
+ hw_ops->cfg_msix_map(res_mgt->hw_ops_tbl->priv, func,
+ false,
+ intr_mgt->func_intr_res[func].msix_map_table.dma,
+ 0, 0, 0);
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+
+ /* Stage2: zero MSIX map entry */
+ hw_ops->cfg_msix_map(res_mgt->hw_ops_tbl->priv, func,
+ false, 0, 0, 0, 0);
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+
+ return 0;
+}
+
+/*
+ * __nbl_res_intr_complete_destroy_msix_map - release vector bitmap, DMA memory
+ * and interrupt buffer after global hardware quiesce. No hardware register ops.
+ *
+ * Caller must hold intr_mgt->lock.
+ */
+static int
+__nbl_res_intr_complete_destroy_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func_id)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ struct device *dev = res_mgt->common->dev;
+ struct nbl_msix_map_table *msix_map_table;
+ u16 *interrupts;
+ u16 intr_num;
+
+ lockdep_assert_held(&intr_mgt->lock);
+
+ if (func_id >= NBL_MAX_FUNC) {
+ dev_err(dev, "Invalid func_id %u\n", func_id);
+ return -EINVAL;
+ }
+
+ interrupts = intr_mgt->func_intr_res[func_id].interrupts;
+ if (!interrupts)
+ return 0;
+
+ intr_num = intr_mgt->func_intr_res[func_id].num_interrupts;
+ msix_map_table = &intr_mgt->func_intr_res[func_id].msix_map_table;
+
+ nbl_intr_release_bitmap(res_mgt, interrupts, intr_num);
+
+ if (msix_map_table->base_addr) {
+ dma_free_coherent(dev, msix_map_table->size,
+ msix_map_table->base_addr,
+ msix_map_table->dma);
+ msix_map_table->base_addr = NULL;
+ msix_map_table->dma = 0;
+ msix_map_table->size = 0;
+ }
+
+ kfree(interrupts);
+ intr_mgt->func_intr_res[func_id].interrupts = NULL;
+ intr_mgt->func_intr_res[func_id].num_interrupts = 0;
+ intr_mgt->func_intr_res[func_id].num_net_interrupts = 0;
+
+ return 0;
+}
+
+/*
+ * Internal (unlocked) MSI-X map teardown. Caller must hold
+ * intr_mgt->lock on entry.
+ * This is used for single function synchronous destroy path.
+ */
+static int __nbl_res_intr_destroy_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func_id)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ int ret;
+
+ lockdep_assert_held(&intr_mgt->lock);
+
+ ret = __nbl_res_intr_prepare_destroy_msix_map(res_mgt, func_id);
+ if (ret)
+ return ret;
+ mutex_unlock(&intr_mgt->lock);
+ usleep_range(NBL_MSIX_DMA_SYNC_MIN_US, NBL_MSIX_DMA_SYNC_MAX_US);
+ mutex_lock(&intr_mgt->lock);
+
+ return __nbl_res_intr_complete_destroy_msix_map(res_mgt, func_id);
+}
+
+int nbl_res_intr_destroy_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func_id)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ int ret;
+
+ if (!intr_mgt)
+ return -EINVAL;
+
+ mutex_lock(&intr_mgt->lock);
+ ret = __nbl_res_intr_destroy_msix_map(res_mgt, func_id);
+ mutex_unlock(&intr_mgt->lock);
+
+ return ret;
+}
+
+/**
+ * nbl_res_intr_cfg_msix_map - allocate & program MSI-X mapping table
+ * @res_mgt: resource management instance
+ * @func_id: target function identifier
+ * @num_net_msix: required net data interrupt vectors
+ * @num_others_msix: required control interrupt vectors
+ * @net_msix_mask_en: enable mask for net interrupt entries
+ *
+ * Allocate interrupt vectors; MSIX coherent DMA table is allocated once
+ * per function on first configuration, entries are updated in-place on
+ * subsequent reconfigurations. No free/realloc of DMA table on vector
+ * count changes. This removes the DMA table free/realloc cycle,
+ * per-reconfig timed sleep and the in-flight DMA race window.
+ *
+ * Serialization: this function takes intr_mgt->lock internally to
+ * protect the global vector bitmaps and per-function state against
+ * concurrent callers.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+int nbl_res_intr_cfg_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func_id, u16 num_net_msix,
+ u16 num_others_msix,
+ bool net_msix_mask_en)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ struct nbl_hw_ops *hw_ops = res_mgt->hw_ops_tbl->ops;
+ struct nbl_common_info *common = res_mgt->common;
+ struct nbl_msix_map_table *official_tbl;
+ struct nbl_msix_map *msix_map_entries;
+ struct device *dev = common->dev;
+ u16 requested, intr_index;
+ u8 bus, devid, function;
+ bool entry_masked = false;
+ u16 *tmp_interrupts = NULL;
+ u16 allocated_cnt = 0;
+ u16 *old_interrupts;
+ u16 old_num;
+ int ret = 0;
+ u16 gvec;
+ u16 i, j;
+
+ if (!intr_mgt)
+ return -EINVAL;
+
+ if (!common->has_ctrl)
+ return -EINVAL;
+
+ if (func_id >= NBL_MAX_FUNC) {
+ dev_err(dev, "Invalid func_id %u\n", func_id);
+ return -EINVAL;
+ }
+
+ if (num_net_msix == 0 && num_others_msix == 0) {
+ dev_err(dev, "MSI-X vector count cannot both be zero\n");
+ return -EINVAL;
+ }
+
+ if (num_net_msix > NBL_MSIX_MAP_TABLE_MAX_ENTRIES ||
+ num_others_msix > NBL_MSIX_MAP_TABLE_MAX_ENTRIES) {
+ dev_err(dev, "MSI-X count out of limit: net=%u, others=%u\n",
+ num_net_msix, num_others_msix);
+ return -EINVAL;
+ }
+
+ if (check_add_overflow(num_net_msix, num_others_msix, &requested) ||
+ requested > NBL_MSIX_MAP_TABLE_MAX_ENTRIES) {
+ dev_err(dev, "Total MSI-X vectors %u exceeds maximum %u\n",
+ requested, NBL_MSIX_MAP_TABLE_MAX_ENTRIES);
+ return -EINVAL;
+ }
+
+ ret = nbl_res_func_id_to_bdf(res_mgt, func_id, &bus, &devid, &function);
+ if (ret) {
+ if (ret == -EOPNOTSUPP)
+ dev_err(dev,
+ "MSI-X mapping for VF func_id=%u is not supported\n",
+ func_id);
+ return ret;
+ }
+
+ mutex_lock(&intr_mgt->lock);
+ official_tbl = &intr_mgt->func_intr_res[func_id].msix_map_table;
+ /*
+ * Phase1: allocate global vector array first.
+ * Allocate the fixed-size MSIX DMA table only ONCE for this function.
+ */
+ tmp_interrupts = kcalloc(requested, sizeof(tmp_interrupts[0]),
+ GFP_KERNEL);
+ if (!tmp_interrupts) {
+ ret = -ENOMEM;
+ goto out_unlock;
+ }
+ /* Allocate MSIX DMA table once per function */
+ if (!official_tbl->base_addr) {
+ official_tbl->size =
+ sizeof(struct nbl_msix_map) *
+ NBL_MSIX_MAP_TABLE_MAX_ENTRIES;
+ official_tbl->base_addr = dma_alloc_coherent(dev,
+ official_tbl->size,
+ &official_tbl->dma,
+ GFP_KERNEL);
+ if (!official_tbl->base_addr) {
+ dev_err(dev, "Failed to allocate DMA memory for MSIX table\n");
+ ret = -ENOMEM;
+ goto release_vecs_unlock;
+ }
+ }
+
+ /* Allocate net interrupt vectors */
+ for (i = 0; i < num_net_msix; i++) {
+ intr_index = find_first_zero_bit(intr_mgt->intr_net_bmap,
+ NBL_MAX_NET_INTERRUPT);
+ if (intr_index == NBL_MAX_NET_INTERRUPT) {
+ dev_err(dev, "No free net interrupt vectors left\n");
+ ret = -EAGAIN;
+ goto release_vecs_unlock;
+ }
+ tmp_interrupts[i] = intr_index + NBL_NET_INTR_BASE;
+ set_bit(intr_index, intr_mgt->intr_net_bmap);
+ allocated_cnt++;
+ }
+
+ /* Allocate other interrupt vectors */
+ for (; i < requested; i++) {
+ intr_index =
+ find_first_zero_bit(intr_mgt->intr_other_bmap,
+ NBL_MAX_OTHER_INTERRUPT);
+ if (intr_index == NBL_MAX_OTHER_INTERRUPT) {
+ dev_err(dev, "No free control interrupt vectors left\n");
+ ret = -EAGAIN;
+ goto release_vecs_unlock;
+ }
+ tmp_interrupts[i] = intr_index;
+ set_bit(intr_index, intr_mgt->intr_other_bmap);
+ allocated_cnt++;
+ }
+
+ /*
+ * Phase2: tear down old hardware MSIX config, release old global
+ * vectors.
+ * NOTE: NO DMA table free here, only invalidate HW entries and
+ * release vec bitmap.
+ */
+ if (intr_mgt->func_intr_res[func_id].interrupts) {
+ old_interrupts = intr_mgt->func_intr_res[func_id].interrupts;
+ old_num = intr_mgt->func_intr_res[func_id].num_interrupts;
+
+ ret = __nbl_res_intr_set_mailbox_irq(res_mgt, func_id, 0,
+ false);
+ if (ret) {
+ dev_err(dev, "%s: disable old mailbox irq failed, keep old config\n",
+ __func__);
+ goto release_vecs_unlock;
+ }
+ for (j = 0; j < old_num; j++) {
+ hw_ops->cfg_msix_info(res_mgt->hw_ops_tbl->priv,
+ func_id, false, old_interrupts[j],
+ 0, 0, 0, false);
+ }
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+ nbl_intr_release_bitmap(res_mgt, old_interrupts, old_num);
+ kfree(old_interrupts);
+ intr_mgt->func_intr_res[func_id].interrupts = NULL;
+ intr_mgt->func_intr_res[func_id].num_interrupts = 0;
+ intr_mgt->func_intr_res[func_id].num_net_interrupts = 0;
+ }
+
+ /* Swap new vector array into func state */
+ intr_mgt->func_intr_res[func_id].interrupts = tmp_interrupts;
+ intr_mgt->func_intr_res[func_id].num_interrupts = requested;
+ intr_mgt->func_intr_res[func_id].num_net_interrupts = num_net_msix;
+ tmp_interrupts = NULL;
+
+ /*
+ * Fill MSIX map table IN-PLACE in the pre-allocated DMA buffer.
+ * Only zero entries beyond requested count to avoid full table
+ * memset overhead.
+ */
+ msix_map_entries = official_tbl->base_addr;
+ memset(msix_map_entries + requested, 0,
+ (NBL_MSIX_MAP_TABLE_MAX_ENTRIES - requested) *
+ sizeof(*msix_map_entries));
+
+ for (i = 0; i < requested; i++) {
+ gvec = intr_mgt->func_intr_res[func_id].interrupts[i];
+ msix_map_entries[i].data =
+ cpu_to_le16(FIELD_PREP(NBL_MSIX_MAP_VALID_MASK, 1) |
+ FIELD_PREP(NBL_MSIX_MAP_INDEX_MASK,
+ gvec));
+ entry_masked = (i < num_net_msix && net_msix_mask_en);
+ hw_ops->cfg_msix_info(res_mgt->hw_ops_tbl->priv,
+ func_id, true, gvec,
+ bus, devid, function,
+ entry_masked);
+ }
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+
+ /* Flush CPU writes to coherent memory before hardware DMA access */
+ dma_wmb();
+
+ /*
+ * cfg_msix_map uses the control PF's own BDF (common->hw_bus etc.),
+ * not the target function's BDF. This BDF tags the pcompler DMA
+ * read of the MSI-X map table as originating from the control PF.
+ * The target function's BDF (bus/devid/function from
+ * nbl_res_func_id_to_bdf) is used only in cfg_msix_info for the
+ * host_msix_ctrl table entry BDF filtering.
+ */
+ hw_ops->cfg_msix_map(res_mgt->hw_ops_tbl->priv, func_id,
+ true, official_tbl->dma, common->hw_bus,
+ common->devid, common->function);
+ hw_ops->flush_write(res_mgt->hw_ops_tbl->priv);
+
+ mutex_unlock(&intr_mgt->lock);
+ return 0;
+
+release_vecs_unlock:
+ nbl_intr_release_bitmap(res_mgt, tmp_interrupts, allocated_cnt);
+ kfree(tmp_interrupts);
+out_unlock:
+ mutex_unlock(&intr_mgt->lock);
+ return ret;
+}
+
+/**
+ * nbl_res_intr_set_mailbox_irq - bind mailbox IRQ to specified vector
+ * @res_mgt: resource management instance
+ * @func_id: target function identifier
+ * @vector_id: index inside local interrupt array
+ * @en_msix: enable/disable mailbox interrupt
+ *
+ * Serialization: takes intr_mgt->lock internally.
+ *
+ * Return: 0 on success, negative errno on parameter or state check
+ * failure. The hardware op is void and cannot report failure.
+ */
+int nbl_res_intr_set_mailbox_irq(struct nbl_resource_mgt *res_mgt,
+ u16 func_id, u16 vector_id,
+ bool en_msix)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ struct nbl_common_info *common = res_mgt->common;
+ int ret;
+
+ if (!intr_mgt)
+ return -EINVAL;
+
+ if (!common->has_ctrl)
+ return -EINVAL;
+
+ mutex_lock(&intr_mgt->lock);
+ ret = __nbl_res_intr_set_mailbox_irq(res_mgt, func_id,
+ vector_id, en_msix);
+ mutex_unlock(&intr_mgt->lock);
+
+ return ret;
+}
+
+static struct nbl_interrupt_mgt *nbl_intr_setup_mgt(struct device *dev)
+{
+ struct nbl_interrupt_mgt *intr_mgt;
+ int err;
+
+ intr_mgt = devm_kzalloc(dev, sizeof(*intr_mgt), GFP_KERNEL);
+ if (!intr_mgt)
+ return ERR_PTR(-ENOMEM);
+
+ err = devm_mutex_init(dev, &intr_mgt->lock);
+ if (err)
+ return ERR_PTR(err);
+
+ bitmap_zero(intr_mgt->intr_net_bmap, NBL_MAX_NET_INTERRUPT);
+ bitmap_zero(intr_mgt->intr_other_bmap, NBL_MAX_OTHER_INTERRUPT);
+
+ return intr_mgt;
+}
+
+int nbl_intr_mgt_start(struct nbl_resource_mgt *res_mgt)
+{
+ struct device *dev = res_mgt->common->dev;
+ struct nbl_interrupt_mgt *intr_mgt;
+ int ret;
+
+ intr_mgt = nbl_intr_setup_mgt(dev);
+ if (IS_ERR(intr_mgt)) {
+ ret = PTR_ERR(intr_mgt);
+ return ret;
+ }
+
+ res_mgt->intr_mgt = intr_mgt;
+ return 0;
+}
+
+void nbl_intr_mgt_stop(struct nbl_resource_mgt *res_mgt)
+{
+ struct nbl_interrupt_mgt *intr_mgt = res_mgt->intr_mgt;
+ u16 func_id;
+ int ret;
+
+ if (!intr_mgt)
+ return;
+
+ /* Phase 1: batch invalidate all hardware MSIX map entries */
+ mutex_lock(&intr_mgt->lock);
+ for (func_id = 0; func_id < NBL_MAX_FUNC; func_id++) {
+ if (intr_mgt->func_intr_res[func_id].interrupts) {
+ dev_info(res_mgt->common->dev,
+ "intr_mgt_stop: preparing destroy map for func %u\n",
+ func_id);
+ ret = __nbl_res_intr_prepare_destroy_msix_map(res_mgt,
+ func_id);
+ if (ret)
+ dev_warn(res_mgt->common->dev,
+ "intr_mgt_stop: prepare destroy map for func %u failed: %d\n",
+ func_id, ret);
+ }
+ }
+ mutex_unlock(&intr_mgt->lock);
+
+ /*
+ * Global quiesce: wait for straggler DMA table reads after all
+ * MSIX map entries have been invalidated in hardware, before
+ * freeing coherent memory. Best-effort only.
+ */
+ usleep_range(NBL_MSIX_DMA_SYNC_MIN_US, NBL_MSIX_DMA_SYNC_MAX_US);
+
+ /* Phase2: safely release MSIX coherent memory and intr resources */
+ mutex_lock(&intr_mgt->lock);
+ for (func_id = 0; func_id < NBL_MAX_FUNC; func_id++) {
+ if (intr_mgt->func_intr_res[func_id].interrupts) {
+ ret = __nbl_res_intr_complete_destroy_msix_map(res_mgt,
+ func_id);
+ if (ret)
+ dev_warn(res_mgt->common->dev,
+ "intr_mgt_stop: complete destroy map for func %u failed: %d\n",
+ func_id, ret);
+ }
+ }
+ mutex_unlock(&intr_mgt->lock);
+
+ res_mgt->intr_mgt = NULL;
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.h
new file mode 100644
index 0000000000000..9f66f5e19c984
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_interrupt.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_INTERRUPT_H_
+#define _NBL_INTERRUPT_H_
+
+#include "nbl_resource.h"
+
+#define NBL_MSIX_MAP_TABLE_MAX_ENTRIES 1024
+int nbl_res_intr_destroy_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func_id);
+int nbl_res_intr_cfg_msix_map(struct nbl_resource_mgt *res_mgt,
+ u16 func_id, u16 num_net_msix,
+ u16 num_others_msix,
+ bool net_msix_mask_en);
+int nbl_res_intr_set_mailbox_irq(struct nbl_resource_mgt *res_mgt,
+ u16 func_id, u16 vector_id,
+ bool en_msix);
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.c
new file mode 100644
index 0000000000000..411790adfb39f
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.c
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#include <linux/pci.h>
+#include "nbl_resource.h"
+
+int nbl_res_func_id_to_vsi_id(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 type, u16 *vsi_id)
+{
+ struct nbl_vsi_info *vsi_info = res_mgt->resource_info->vsi_info;
+ enum nbl_vsi_serv_type dst_type = NBL_VSI_SERV_PF_DATA_TYPE;
+ struct nbl_common_info *common = res_mgt->common;
+ struct device *dev = res_mgt->common->dev;
+ int pfid = func_id;
+ u32 rel_pf_id;
+ int ret;
+
+ if (!common->has_ctrl || !vsi_id) {
+ dev_dbg(dev, "No control plane or null vsi output ptr\n");
+ return -EINVAL;
+ }
+ ret = nbl_common_func_id_to_rel_pf_id(common, pfid, &rel_pf_id);
+ if (ret)
+ return ret;
+ if (rel_pf_id >= vsi_info->num) {
+ dev_err(dev, "PF %d (diff=%u) exceeds vsi_info->num (%u)\n",
+ pfid, rel_pf_id, vsi_info->num);
+ return -EINVAL;
+ }
+
+ ret = nbl_res_pf_dev_vsi_type_to_hw_vsi_type(res_mgt, type, &dst_type);
+ if (ret) {
+ dev_err(dev, "Invalid vsi type %u func_id %u\n", type, func_id);
+ return ret;
+ }
+ *vsi_id = vsi_info->serv_info[rel_pf_id][dst_type].base_id;
+ return 0;
+}
+
+int nbl_res_vsi_id_to_pf_id(struct nbl_resource_mgt *res_mgt, u16 vsi_id)
+{
+ struct nbl_vsi_info *vsi_info = res_mgt->resource_info->vsi_info;
+ struct nbl_common_info *common = res_mgt->common;
+ struct device *dev = res_mgt->common->dev;
+ int j = NBL_VSI_SERV_PF_DATA_TYPE;
+ int pf_id, i;
+
+ if (!common->has_ctrl) {
+ dev_dbg(dev, "No control plane available\n");
+ return -EINVAL;
+ }
+ for (i = 0; i < vsi_info->num; i++) {
+ if (vsi_id >= vsi_info->serv_info[i][j].base_id &&
+ (vsi_id < vsi_info->serv_info[i][j].base_id +
+ vsi_info->serv_info[i][j].num)) {
+ pf_id = i + common->mgt_pf;
+ if (pf_id >= NBL_MAX_PF) {
+ dev_err(dev, "PF ID overflow\n");
+ return -ERANGE;
+ }
+ return pf_id;
+ }
+ }
+
+ dev_dbg(dev, "VSI ID %u not found\n", vsi_id);
+ return -ENOENT;
+}
+
+int nbl_res_func_id_to_bdf(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u8 *bus, u8 *dev, u8 *function)
+{
+ struct nbl_common_info *common = res_mgt->common;
+ struct nbl_sriov_info *sriov_info;
+ int pfid = func_id;
+ u8 pf_bus, devfn;
+ u32 rel_pf_id;
+ int ret;
+
+ if (!common->has_ctrl || !bus || !dev || !function)
+ return -EINVAL;
+ ret = nbl_common_func_id_to_rel_pf_id(common, pfid, &rel_pf_id);
+ if (ret)
+ return ret;
+ if (rel_pf_id >= common->max_pf) {
+ dev_err(common->dev,
+ "func_id=%u rel_pf_id=%u exceeds max_pf=%u, VF BDF unsupported\n",
+ pfid, rel_pf_id,
+ common->max_pf);
+ return -EOPNOTSUPP;
+ }
+ sriov_info = res_mgt->resource_info->sriov_info + rel_pf_id;
+ pf_bus = PCI_BUS_NUM(sriov_info->bdf);
+ devfn = sriov_info->bdf & 0xff;
+ *bus = pf_bus;
+ *dev = PCI_SLOT(devfn);
+ *function = PCI_FUNC(devfn);
+
+ return 0;
+}
+
+int nbl_res_get_eth_id(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 vsi_id, u8 *eth_num, u8 *eth_id, u8 *logic_eth_id)
+{
+ struct nbl_eth_info *eth_info = res_mgt->resource_info->eth_info;
+ struct nbl_common_info *common = res_mgt->common;
+ struct device *dev = res_mgt->common->dev;
+ int pfid = func_id;
+ int rel_pf_id;
+ int abs_pf_id;
+
+ if (!common->has_ctrl || !eth_num || !eth_id || !logic_eth_id)
+ return -EINVAL;
+ abs_pf_id = nbl_res_vsi_id_to_pf_id(res_mgt, vsi_id);
+ if (abs_pf_id < 0) {
+ dev_err(dev, "Failed to get PF ID from VSI ID %u\n", vsi_id);
+ return -EINVAL;
+ }
+ if (abs_pf_id != pfid) {
+ dev_err(dev, "func_id %u does not match pf derived from vsi_id %u\n",
+ pfid, vsi_id);
+ return -EINVAL;
+ }
+ rel_pf_id = abs_pf_id - common->mgt_pf;
+
+ if (rel_pf_id >= eth_info->eth_num) {
+ dev_err(dev, "rel_pf_id %d out of range [0, %u)\n",
+ rel_pf_id, eth_info->eth_num);
+ return -ERANGE;
+ }
+
+ *eth_num = eth_info->eth_num;
+ *eth_id = eth_info->eth_id[rel_pf_id];
+ *logic_eth_id = rel_pf_id;
+ return 0;
+}
+
+int nbl_res_pf_dev_vsi_type_to_hw_vsi_type(struct nbl_resource_mgt *res_mgt,
+ u16 src_type,
+ enum nbl_vsi_serv_type *dst_type)
+{
+ switch (src_type) {
+ case NBL_VSI_DATA:
+ *dst_type = NBL_VSI_SERV_PF_DATA_TYPE;
+ return 0;
+ default:
+ dev_err_once(res_mgt->common->dev,
+ "Unsupported vsi src_type %u\n", src_type);
+ return -EINVAL;
+ }
+}
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.h
new file mode 100644
index 0000000000000..5f0dfc74c0689
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_resource.h
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_RESOURCE_H_
+#define _NBL_RESOURCE_H_
+
+#include <linux/types.h>
+
+#include "../nbl_include/nbl_include.h"
+#include "../nbl_include/nbl_def_channel.h"
+#include "../nbl_include/nbl_def_hw.h"
+#include "../nbl_include/nbl_def_resource.h"
+#include "../nbl_include/nbl_def_common.h"
+#include "../nbl_core.h"
+
+struct nbl_resource_mgt;
+
+/* --------- INTERRUPT ---------- */
+#define NBL_MAX_OTHER_INTERRUPT 1024
+#define NBL_MAX_NET_INTERRUPT 4096
+#define NBL_NET_INTR_BASE NBL_MAX_OTHER_INTERRUPT
+
+#define NBL_MSIX_MAP_VALID_MASK BIT(0)
+#define NBL_MSIX_MAP_INDEX_MASK GENMASK(13, 1)
+#define NBL_MSIX_MAP_RSV_MASK GENMASK(15, 14)
+
+struct nbl_msix_map {
+ __le16 data;
+};
+
+struct nbl_msix_map_table {
+ struct nbl_msix_map *base_addr;
+ dma_addr_t dma;
+ size_t size;
+};
+
+struct nbl_func_interrupt_resource_mng {
+ u16 num_interrupts;
+ u16 num_net_interrupts;
+ u16 *interrupts;
+ struct nbl_msix_map_table msix_map_table;
+};
+
+struct nbl_interrupt_mgt {
+ struct mutex lock; /* Protects bitmap + func_intr_res[] */
+ DECLARE_BITMAP(intr_net_bmap, NBL_MAX_NET_INTERRUPT);
+ DECLARE_BITMAP(intr_other_bmap, NBL_MAX_OTHER_INTERRUPT);
+ struct nbl_func_interrupt_resource_mng func_intr_res[NBL_MAX_FUNC];
+};
+
+/* --------- INFO ---------- */
+struct nbl_sriov_info {
+ unsigned int bdf;
+};
+
+struct nbl_eth_info {
+ DECLARE_BITMAP(eth_bitmap, NBL_MAX_ETHERNET);
+ u8 pf_bitmap[NBL_MAX_ETHERNET];
+ u8 eth_num;
+ u8 resv[3];
+ u8 eth_id[NBL_MAX_ETHERNET];
+ u8 logic_eth_id[NBL_MAX_ETHERNET];
+};
+
+enum nbl_vsi_serv_type {
+ NBL_VSI_SERV_PF_DATA_TYPE,
+ NBL_VSI_SERV_MAX_TYPE,
+};
+
+struct nbl_vsi_serv_info {
+ u16 base_id;
+ u16 num;
+};
+
+struct nbl_vsi_info {
+ u16 num;
+ struct nbl_vsi_serv_info serv_info[NBL_MAX_ETHERNET]
+ [NBL_VSI_SERV_MAX_TYPE];
+};
+
+struct nbl_resource_info {
+ struct nbl_sriov_info *sriov_info;
+ struct nbl_eth_info *eth_info;
+ struct nbl_vsi_info *vsi_info;
+ struct nbl_board_port_info board_info;
+};
+
+struct nbl_resource_mgt {
+ struct nbl_common_info *common;
+ struct nbl_resource_info *resource_info;
+ struct nbl_channel_ops_tbl *chan_ops_tbl;
+ struct nbl_hw_ops_tbl *hw_ops_tbl;
+ struct nbl_interrupt_mgt *intr_mgt;
+};
+
+int nbl_res_vsi_id_to_pf_id(struct nbl_resource_mgt *res_mgt, u16 vsi_id);
+int nbl_res_func_id_to_vsi_id(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 type, u16 *vsi_id);
+int nbl_res_func_id_to_bdf(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u8 *bus, u8 *dev, u8 *function);
+int nbl_res_get_eth_id(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 vsi_id, u8 *eth_num, u8 *eth_id, u8 *logic_eth_id);
+int nbl_intr_mgt_start(struct nbl_resource_mgt *res_mgt);
+int nbl_res_pf_dev_vsi_type_to_hw_vsi_type(struct nbl_resource_mgt *res_mgt,
+ u16 src_type,
+ enum nbl_vsi_serv_type *dst_type);
+void nbl_intr_mgt_stop(struct nbl_resource_mgt *res_mgt);
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_channel.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_channel.h
new file mode 100644
index 0000000000000..6f8fc14a51f0e
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_channel.h
@@ -0,0 +1,183 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEF_CHANNEL_H_
+#define _NBL_DEF_CHANNEL_H_
+
+#include <linux/types.h>
+#include <linux/build_bug.h>
+
+struct nbl_channel_mgt;
+struct nbl_adapter;
+
+typedef void (*nbl_chan_resp)(void *, u16, u16, void *, u32);
+
+enum {
+ NBL_CHAN_RESP_OK = 0,
+ NBL_CHAN_RESP_ERR = 1,
+ NBL_CHAN_RESP_UNIMPLEMENTED = 2,
+ NBL_CHAN_RESP_PERM_DENY = 3,
+};
+
+/*
+ * Mailbox wire opcodes, stable wire ABI shared between driver and firmware.
+ * Each opcode has a fixed assigned number to preserve compatibility.
+ * ABI compatibility rules:
+ * 1. New opcodes shall only be appended before NBL_CHAN_MSG_MAILBOX_MAX;
+ * 2. Reordering, inserting or deleting existing enumerators breaks driver-
+ * firmware interoperability and must be avoided;
+ * 3. Modifications to existing opcodes require synchronized firmware ABI
+ * updates.
+ *
+ * Only opcodes currently used by in-tree driver logic are defined here.
+ * Unimplemented feature opcodes (KTLS, IPsec, vDPA, mirror etc.) will be
+ * added incrementally together with their corresponding driver
+ * implementation patches.
+ */
+enum nbl_chan_msg_type {
+ NBL_CHAN_MSG_ACK = 0,
+ NBL_CHAN_MSG_CONFIGURE_MSIX_MAP = 17,
+ NBL_CHAN_MSG_DESTROY_MSIX_MAP = 18,
+ NBL_CHAN_MSG_MAILBOX_SET_IRQ = 19,
+ NBL_CHAN_MSG_GET_VSI_ID = 21,
+ NBL_CHAN_MSG_GET_ETH_ID = 67,
+ /* mailbox msg end */
+ NBL_CHAN_MSG_MAILBOX_MAX,
+};
+
+enum nbl_chan_state {
+ NBL_CHAN_IRQ_RDY,
+ NBL_CHAN_STATE_NBITS
+};
+
+struct nbl_chan_param_cfg_msix_map {
+ __le16 num_net_msix;
+ __le16 num_others_msix;
+ __le16 msix_mask_en;
+ __le16 rsvd;
+};
+
+struct nbl_chan_param_set_mailbox_irq {
+ __le16 vector_id;
+ u8 en_msix;
+ u8 rsvd;
+};
+
+struct nbl_chan_param_get_vsi_id {
+ __le16 vsi_id;
+ __le16 type;
+};
+
+struct nbl_chan_param_get_eth_id {
+ __le16 vsi_id;
+ u8 eth_num;
+ u8 eth_id;
+ u8 logic_eth_id;
+ u8 rsvd[3];
+};
+
+struct nbl_board_port_info {
+ u8 eth_num;
+ u8 eth_speed;
+ u8 p4_version;
+ u8 rsv[5];
+};
+
+static_assert(sizeof(struct nbl_chan_param_cfg_msix_map) == 8,
+ "nbl_chan_param_cfg_msix_map size must be 8 bytes");
+static_assert(sizeof(struct nbl_chan_param_set_mailbox_irq) == 4,
+ "nbl_chan_param_set_mailbox_irq size must be 4 bytes");
+static_assert(sizeof(struct nbl_chan_param_get_vsi_id) == 4,
+ "nbl_chan_param_get_vsi_id size must be 4 bytes");
+static_assert(sizeof(struct nbl_chan_param_get_eth_id) == 8,
+ "nbl_chan_param_get_eth_id size must be 8 bytes");
+static_assert(sizeof(struct nbl_board_port_info) == 8,
+ "nbl_board_port_info size must be 8 bytes");
+
+struct nbl_chan_send_info {
+ void *arg;
+ size_t arg_len;
+ void *resp;
+ size_t resp_len;
+ u16 dstid;
+ u16 msg_type;
+ u16 ack;
+ u16 ack_len;
+};
+
+struct nbl_chan_ack_info {
+ void *data;
+ int err;
+ u32 data_len;
+ u16 dstid;
+ u16 msg_type;
+ u16 msgid;
+};
+
+enum nbl_channel_type {
+ NBL_CHAN_TYPE_MAILBOX,
+ NBL_CHAN_TYPE_MAX
+};
+
+static inline void
+nbl_chan_fill_send_info(struct nbl_chan_send_info *info,
+ u16 dst_id, u16 msg_type,
+ void *argument, u32 arg_length,
+ void *response, u32 resp_length,
+ bool need_ack)
+{
+ info->dstid = dst_id;
+ info->msg_type = msg_type;
+ info->arg = argument;
+ info->arg_len = arg_length;
+ info->resp = response;
+ info->resp_len = resp_length;
+ info->ack = need_ack;
+}
+
+static inline void
+nbl_chan_fill_ack_info(struct nbl_chan_ack_info *info,
+ u16 dst_id, u16 msg_type, u16 msg_id,
+ int err_code, void *ack_data, u32 data_length)
+{
+ info->dstid = dst_id;
+ info->msg_type = msg_type;
+ info->msgid = msg_id;
+ info->err = err_code;
+ info->data = ack_data;
+ info->data_len = data_length;
+}
+
+struct nbl_channel_ops {
+ int (*send_msg)(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_send_info *chan_send);
+ int (*send_ack)(struct nbl_channel_mgt *chan_mgt,
+ struct nbl_chan_ack_info *chan_ack);
+ int (*register_msg)(struct nbl_channel_mgt *chan_mgt, u16 msg_type,
+ nbl_chan_resp func, void *callback_priv);
+ void (*unregister_all_msg)(struct nbl_channel_mgt *chan_mgt);
+ void (*cfg_chan_qinfo_map_table)(struct nbl_channel_mgt *chan_mgt,
+ u8 bus, u8 devid);
+ bool (*check_queue_exist)(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type);
+ int (*setup_queue)(struct nbl_channel_mgt *chan_mgt, u8 chan_type);
+ int (*teardown_queue)(struct nbl_channel_mgt *chan_mgt, u8 chan_type);
+ void (*clean_queue_subtask)(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type);
+ void (*register_chan_task)(struct nbl_channel_mgt *chan_mgt,
+ u8 chan_type, struct work_struct *task);
+ void (*set_queue_state)(struct nbl_channel_mgt *chan_mgt,
+ enum nbl_chan_state state, u8 chan_type,
+ u8 set);
+};
+
+struct nbl_channel_ops_tbl {
+ struct nbl_channel_ops *ops;
+ struct nbl_channel_mgt *priv;
+};
+
+int nbl_chan_init_common(struct nbl_adapter *adapter);
+void nbl_chan_remove_common(struct nbl_adapter *adapter);
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_common.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_common.h
new file mode 100644
index 0000000000000..3c2cb34192df9
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_common.h
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEF_COMMON_H_
+#define _NBL_DEF_COMMON_H_
+
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/device.h>
+#include "nbl_include.h"
+
+#define NBL_TWO_ETHERNET_PORT 2
+#define NBL_FOUR_ETHERNET_PORT 4
+#define NBL_DEFAULT_VSI_ID_GAP 1024
+#define NBL_TWO_ETHERNET_VSI_ID_GAP 512
+#define NBL_FOUR_ETHERNET_VSI_ID_GAP 256
+
+static inline u32 nbl_vsi_id_gap(u32 m)
+{
+ if (m == NBL_FOUR_ETHERNET_PORT)
+ return NBL_FOUR_ETHERNET_VSI_ID_GAP;
+ else if (m == NBL_TWO_ETHERNET_PORT)
+ return NBL_TWO_ETHERNET_VSI_ID_GAP;
+
+ return NBL_DEFAULT_VSI_ID_GAP;
+}
+
+struct nbl_common_info {
+ struct workqueue_struct *wq;
+ struct pci_dev *pdev;
+ struct device *dev;
+ u16 vsi_id;
+ u8 eth_id;
+ u8 logic_eth_id;
+ u8 eth_num;
+
+ u8 function;
+ u8 devid;
+ u8 bus;
+ u8 hw_bus;
+ u16 mgt_pf;
+
+ u8 has_ctrl;
+ u8 has_net;
+ u8 max_pf;
+};
+
+struct nbl_hash_tbl_key {
+ struct device *dev;
+ u16 key_size;
+ u16 data_size; /* no include key or node member */
+ u16 bucket_size;
+ u16 resv;
+};
+
+void nbl_common_destroy_wq(struct nbl_common_info *common);
+int nbl_common_create_wq(struct nbl_common_info *common);
+int nbl_common_func_id_to_rel_pf_id(struct nbl_common_info *common, u32 pf_id,
+ u32 *rel_pf_id);
+struct nbl_hash_tbl_mgt *
+nbl_common_init_hash_table(struct nbl_hash_tbl_key *key);
+void nbl_common_remove_hash_table(struct nbl_hash_tbl_mgt *tbl_mgt);
+int nbl_common_alloc_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key,
+ void *data, void **out_data);
+void *nbl_common_get_hash_node(struct nbl_hash_tbl_mgt *tbl_mgt, void *key);
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dev.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dev.h
new file mode 100644
index 0000000000000..a66c633a0e7af
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dev.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEF_DEV_H_
+#define _NBL_DEF_DEV_H_
+
+struct nbl_adapter;
+
+int nbl_dev_init(struct nbl_adapter *adapter);
+void nbl_dev_remove(struct nbl_adapter *adapter);
+int nbl_dev_start(struct nbl_adapter *adapter);
+void nbl_dev_stop(struct nbl_adapter *adapter);
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dispatch.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dispatch.h
new file mode 100644
index 0000000000000..61083a750da47
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_dispatch.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEF_DISPATCH_H_
+#define _NBL_DEF_DISPATCH_H_
+
+#include <linux/types.h>
+
+struct nbl_dispatch_mgt;
+struct nbl_adapter;
+enum {
+ NBL_DISP_CTRL_LVL_MGT,
+ NBL_DISP_CTRL_LVL_NET,
+ NBL_DISP_CTRL_LVL_MAX,
+};
+
+/**
+ * struct nbl_dispatch_ops - dispatch control plane operation callbacks
+ * @init_module: dispatch layer initialization, ONLY valid on Control PF,
+ * caller must check has_ctrl guard
+ * @deinit_module: dispatch layer cleanup, ONLY valid on Control PF,
+ * caller must check has_ctrl guard
+ * @cfg_msix_map: configure function msix mapping table
+ * @destroy_msix_map: tear down msix mapping resource
+ * @set_mailbox_irq: bind mailbox interrupt to specified msix vector
+ * @get_vsi_id: resolve VSI ID by type
+ * @get_eth_id: resolve eth port info from VSI ID
+ *
+ * Warning: All ops except init_module/deinit_module can be safely called
+ * on PF/VF; init/deinit hooks are control-PF exclusive to prevent NULL ptr.
+ */
+struct nbl_dispatch_ops {
+ int (*init_module)(struct nbl_dispatch_mgt *disp_mgt);
+ void (*deinit_module)(struct nbl_dispatch_mgt *disp_mgt);
+ int (*cfg_msix_map)(struct nbl_dispatch_mgt *disp_mgt,
+ u16 num_net_msix, u16 num_others_msix,
+ bool net_msix_mask_en);
+ int (*destroy_msix_map)(struct nbl_dispatch_mgt *disp_mgt);
+ int (*set_mailbox_irq)(struct nbl_dispatch_mgt *disp_mgt,
+ u16 vector_id, bool en_msix);
+ int (*get_vsi_id)(struct nbl_dispatch_mgt *disp_mgt, u16 type,
+ u16 *vsi_id);
+ int (*get_eth_id)(struct nbl_dispatch_mgt *disp_mgt, u16 vsi_id,
+ u8 *eth_num, u8 *eth_id, u8 *logic_eth_id);
+};
+
+struct nbl_dispatch_ops_tbl {
+ struct nbl_dispatch_ops *ops;
+ struct nbl_dispatch_mgt *priv;
+};
+
+int nbl_disp_init(struct nbl_adapter *adapter);
+void nbl_disp_remove(struct nbl_adapter *adapter);
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_hw.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_hw.h
new file mode 100644
index 0000000000000..6aff1b10eb7f5
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_hw.h
@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEF_HW_H_
+#define _NBL_DEF_HW_H_
+
+#include <linux/types.h>
+
+struct nbl_board_port_info;
+struct nbl_hw_mgt;
+struct nbl_adapter;
+struct nbl_hw_ops {
+ int (*init_module)(struct nbl_hw_mgt *hw_mgt, u8 eth_speed, u8 eth_num);
+ void (*deinit_module)(struct nbl_hw_mgt *hw_mgt);
+
+ void (*cfg_msix_map)(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ bool valid, dma_addr_t dma_addr, u8 bus,
+ u8 devid, u8 function);
+ void (*cfg_msix_info)(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ bool valid, u16 interrupt_id, u8 bus,
+ u8 devid, u8 function,
+ bool net_msix_mask_en);
+ void (*flush_write)(struct nbl_hw_mgt *hw_mgt);
+ void (*update_mailbox_queue_tail_ptr)(struct nbl_hw_mgt *hw_mgt,
+ u16 tail_ptr, u8 txrx);
+ void (*config_mailbox_rxq)(struct nbl_hw_mgt *hw_mgt,
+ dma_addr_t dma_addr, int size_bwid);
+ void (*config_mailbox_txq)(struct nbl_hw_mgt *hw_mgt,
+ dma_addr_t dma_addr, int size_bwid);
+ void (*stop_mailbox_rxq)(struct nbl_hw_mgt *hw_mgt);
+ void (*stop_mailbox_txq)(struct nbl_hw_mgt *hw_mgt);
+ /**
+ * get_host_pf_mask - Fetch host PF mask from firmware k_pf_mask reg
+ * @hw_mgt: hardware management context
+ * @pf_mask: output pointer for PF mask value
+ *
+ * k_pf_mask register rule:
+ * bit N == 0 -> PF#N enabled; bit N == 1 -> PF#N masked out.
+ * bit0 is PF0's mask bit (not reserved); PF0 can be masked but
+ * the driver requires at least PF0 enabled.
+ * Only 1/2/4 PFs are supported:
+ * 1 PF (PF0): mask = 0xfe
+ * 2 PFs (PF0,PF1): mask = 0xfc
+ * 4 PFs (PF0~PF3): mask = 0xf0
+ * All-zero mask (0x00) means all 8 PFs enabled, which is
+ * unsupported by the driver and rejected with -EINVAL.
+ *
+ * Firmware contract: number of unmasked PFs MUST equal
+ * get_board_info()->eth_num.
+ */
+ void (*get_host_pf_mask)(struct nbl_hw_mgt *hw_mgt, u32 *pf_mask);
+ void (*get_real_bus)(struct nbl_hw_mgt *hw_mgt, u8 *bus);
+
+ void (*cfg_mailbox_qinfo)(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ u8 bus, u8 devid, u8 function);
+ void (*set_mailbox_irq)(struct nbl_hw_mgt *hw_mgt, u16 func_id,
+ bool en_msix, u16 gvec);
+ void (*get_fw_eth_map)(struct nbl_hw_mgt *hw_mgt, u32 *eth_map);
+ /**
+ * get_board_info - Fetch board info from firmware
+ * @hw_mgt: hardware management context
+ * @board_info: output pointer for board info structure
+ *
+ * Firmware contract: board_info.eth_num MUST equal the number of
+ * unmasked PFs from get_host_pf_mask(). See get_host_pf_mask for
+ * details.
+ */
+ void (*get_board_info)(struct nbl_hw_mgt *hw_mgt,
+ struct nbl_board_port_info *board_info);
+};
+
+struct nbl_hw_ops_tbl {
+ struct nbl_hw_ops *ops;
+ struct nbl_hw_mgt *priv;
+};
+
+int nbl_hw_init_leonis(struct nbl_adapter *adapter);
+void nbl_hw_remove_leonis(struct nbl_adapter *adapter);
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_resource.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_resource.h
new file mode 100644
index 0000000000000..8dc64e806c1e2
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_def_resource.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_DEF_RESOURCE_H_
+#define _NBL_DEF_RESOURCE_H_
+
+#include <linux/types.h>
+
+struct nbl_resource_mgt;
+struct nbl_adapter;
+
+struct nbl_resource_ops {
+ int (*init_module)(struct nbl_resource_mgt *res_mgt);
+ void (*deinit_module)(struct nbl_resource_mgt *res_mgt);
+
+ int (*cfg_msix_map)(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 num_net_msix, u16 num_others_msix,
+ bool net_msix_mask_en);
+ int (*destroy_msix_map)(struct nbl_resource_mgt *res_mgt, u16 func_id);
+ int (*set_mailbox_irq)(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 vector_id, bool en_msix);
+ int (*get_vsi_id)(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 type, u16 *vsi_id);
+ int (*get_eth_id)(struct nbl_resource_mgt *res_mgt, u16 func_id,
+ u16 vsi_id, u8 *eth_num, u8 *eth_id,
+ u8 *logic_eth_id);
+};
+
+struct nbl_resource_ops_tbl {
+ struct nbl_resource_ops *ops;
+ struct nbl_resource_mgt *priv;
+};
+
+int nbl_res_init_leonis(struct nbl_adapter *adapter);
+void nbl_res_remove_leonis(struct nbl_adapter *adapter);
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_include.h b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_include.h
new file mode 100644
index 0000000000000..f3c807836d24c
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_include/nbl_include.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#ifndef _NBL_INCLUDE_H_
+#define _NBL_INCLUDE_H_
+
+#include <linux/types.h>
+
+/* ------ Basic definitions ------- */
+#define NBL_DRIVER_NAME "nbl"
+#define NBL_MAX_PF 8
+#define NBL_NEXT_ID(id, max) (((id) + 1) % ((max) + 1))
+
+#define NBL_MAX_FUNC 520
+#define NBL_MAX_ETHERNET 4
+
+enum {
+ NBL_VSI_DATA = 0,
+};
+
+struct nbl_func_caps {
+ u32 has_ctrl:1;
+ u32 has_net:1;
+ u32 rsv:30;
+};
+
+struct nbl_init_param {
+ struct nbl_func_caps caps;
+};
+
+/*
+ * Firmware ABI defines port speed enum fixed, value 0 represents 10G, cannot
+ * reassign 0 to INVALID for compatibility
+ */
+enum nbl_fw_port_speed {
+ NBL_FW_PORT_SPEED_10G,
+ NBL_FW_PORT_SPEED_25G,
+ NBL_FW_PORT_SPEED_50G,
+ NBL_FW_PORT_SPEED_100G,
+};
+
+/*
+ * Firmware quirk word @ NBL_LEONIS_QUIRKS_OFFSET (0x140)
+ * Sentinel value: ~0U (0xFFFFFFFF) = firmware reports no active quirks
+ * BIT(0): NBL_QUIRK_NO_TOE – ABI defined, driver implementation pending
+ * BIT(1): NBL_QUIRK_UVN_PREFETCH_ALIGN – control UVN descriptor prefetch
+ * selection
+ */
+#define NBL_QUIRK_NO_TOE BIT(0)
+#define NBL_QUIRK_UVN_PREFETCH_ALIGN BIT(1)
+
+#endif
diff --git a/drivers/net/ethernet/nebula-matrix/nbl/nbl_main.c b/drivers/net/ethernet/nebula-matrix/nbl/nbl_main.c
new file mode 100644
index 0000000000000..02cb35d32012f
--- /dev/null
+++ b/drivers/net/ethernet/nebula-matrix/nbl/nbl_main.c
@@ -0,0 +1,243 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nebula Matrix Limited.
+ */
+
+#include <linux/device.h>
+#include <linux/pci.h>
+#include <linux/module.h>
+#include <linux/bits.h>
+#include "nbl_include/nbl_include.h"
+#include "nbl_include/nbl_def_channel.h"
+#include "nbl_include/nbl_def_hw.h"
+#include "nbl_include/nbl_def_resource.h"
+#include "nbl_include/nbl_def_dispatch.h"
+#include "nbl_include/nbl_def_dev.h"
+#include "nbl_include/nbl_def_common.h"
+#include "nbl_core.h"
+
+int nbl_core_start(struct nbl_adapter *adapter)
+{
+ return nbl_dev_start(adapter);
+}
+
+void nbl_core_stop(struct nbl_adapter *adapter)
+{
+ nbl_dev_stop(adapter);
+}
+
+struct nbl_adapter *nbl_core_init(struct pci_dev *pdev,
+ struct nbl_init_param *param)
+{
+ struct nbl_common_info *common;
+ struct nbl_adapter *adapter;
+ int ret;
+
+ adapter = devm_kzalloc(&pdev->dev, sizeof(*adapter), GFP_KERNEL);
+ if (!adapter)
+ return ERR_PTR(-ENOMEM);
+
+ adapter->pdev = pdev;
+ common = &adapter->common;
+
+ common->mgt_pf = 0;
+ common->pdev = pdev;
+ common->dev = &pdev->dev;
+ common->has_ctrl = param->caps.has_ctrl;
+ common->has_net = param->caps.has_net;
+ common->function = PCI_FUNC(pdev->devfn);
+ common->devid = PCI_SLOT(pdev->devfn);
+ common->bus = pdev->bus->number;
+
+ ret = nbl_hw_init_leonis(adapter);
+ if (ret)
+ goto hw_init_fail;
+
+ ret = nbl_chan_init_common(adapter);
+ if (ret)
+ goto chan_init_fail;
+
+ ret = nbl_res_init_leonis(adapter);
+ if (ret)
+ goto res_init_fail;
+
+ ret = nbl_disp_init(adapter);
+ if (ret)
+ goto disp_init_fail;
+
+ ret = nbl_dev_init(adapter);
+ if (ret)
+ goto dev_init_fail;
+ return adapter;
+
+dev_init_fail:
+ nbl_disp_remove(adapter);
+disp_init_fail:
+ nbl_res_remove_leonis(adapter);
+res_init_fail:
+ nbl_chan_remove_common(adapter);
+chan_init_fail:
+ nbl_hw_remove_leonis(adapter);
+hw_init_fail:
+ return ERR_PTR(ret);
+}
+
+void nbl_core_remove(struct nbl_adapter *adapter)
+{
+ nbl_dev_remove(adapter);
+ nbl_disp_remove(adapter);
+ nbl_res_remove_leonis(adapter);
+ nbl_chan_remove_common(adapter);
+ nbl_hw_remove_leonis(adapter);
+}
+
+static void nbl_get_func_param(struct pci_dev *pdev, kernel_ulong_t driver_data,
+ struct nbl_init_param *param)
+{
+ param->caps.has_net = !!(driver_data & BIT(NBL_CAP_HAS_NET_BIT));
+
+ /*
+ * Hardware fixed rule: physical PF0 is the only management PF with
+ * global ctrl capability. All PFs share identical PCI device ID, so
+ * distinguish control PF via physical function ID.
+ *
+ * Hardware & firmware design FORBID passing any PF through to virtual
+ * machines, there is no scenario where a non-management PF appears
+ * as Func 0 inside guest. Thus using PCI_FUNC(pdev->devfn) to identify
+ * control PF is safe on our platform.
+ */
+ if ((PCI_FUNC(pdev->devfn) == 0) && !pdev->is_virtfn)
+ param->caps.has_ctrl = 1;
+}
+
+static int nbl_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+{
+ struct nbl_init_param param = { { 0 } };
+ struct device *dev = &pdev->dev;
+ struct nbl_adapter *adapter;
+ int err;
+
+ err = pcim_enable_device(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "Failed to enable PCI dev, err=%d\n", err);
+ return err;
+ }
+
+ nbl_get_func_param(pdev, id->driver_data, ¶m);
+ /* never return fail when DMA_BIT_MASK(64) */
+ dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+
+ pci_set_master(pdev);
+
+ adapter = nbl_core_init(pdev, ¶m);
+ if (IS_ERR(adapter)) {
+ dev_err(dev, "Nbl adapter init fail: %pe\n", adapter);
+ err = PTR_ERR(adapter);
+ goto adapter_init_err;
+ }
+ pci_set_drvdata(pdev, adapter);
+ err = nbl_core_start(adapter);
+ if (err)
+ goto core_start_err;
+
+ return 0;
+core_start_err:
+ nbl_core_remove(adapter);
+adapter_init_err:
+ pci_clear_master(pdev);
+ return err;
+}
+
+static void nbl_remove(struct pci_dev *pdev)
+{
+ struct nbl_adapter *adapter = pci_get_drvdata(pdev);
+
+ if (!adapter)
+ return;
+ pci_set_drvdata(pdev, NULL);
+
+ nbl_core_stop(adapter);
+ nbl_core_remove(adapter);
+
+ pci_clear_master(pdev);
+}
+
+/*
+ * PCI Device IDs for Leonis/NBL Network Controllers
+ *
+ * Vendor ID: 0x1F0F
+ * SNIC v3r1 product Device IDs range: 0x3403-0x3412
+ */
+#define NBL_VENDOR_ID 0x1F0F
+
+#define NBL_DEVICE_ID_M18110 0x3403
+#define NBL_DEVICE_ID_M18110_LX 0x3404
+#define NBL_DEVICE_ID_M18110_BASE_T 0x3405
+#define NBL_DEVICE_ID_M18110_LX_BASE_T 0x3406
+#define NBL_DEVICE_ID_M18110_OCP 0x3407
+#define NBL_DEVICE_ID_M18110_LX_OCP 0x3408
+#define NBL_DEVICE_ID_M18110_BASE_T_OCP 0x3409
+#define NBL_DEVICE_ID_M18110_LX_BASE_T_OCP 0x340a
+#define NBL_DEVICE_ID_M18000 0x340b
+#define NBL_DEVICE_ID_M18000_LX 0x340c
+#define NBL_DEVICE_ID_M18000_BASE_T 0x340d
+#define NBL_DEVICE_ID_M18000_LX_BASE_T 0x340e
+#define NBL_DEVICE_ID_M18000_OCP 0x340f
+#define NBL_DEVICE_ID_M18000_LX_OCP 0x3410
+#define NBL_DEVICE_ID_M18000_BASE_T_OCP 0x3411
+#define NBL_DEVICE_ID_M18000_LX_BASE_T_OCP 0x3412
+
+/* All below IDs belong to Leonis ASIC family, different form-factor variants,
+ * share the same hardware initialization flow without differentiated ops.
+ */
+static const struct pci_device_id nbl_id_table[] = {
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_BASE_T),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX_BASE_T),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_BASE_T_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18110_LX_BASE_T_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_BASE_T),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX_BASE_T),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_BASE_T_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ { PCI_DEVICE(NBL_VENDOR_ID, NBL_DEVICE_ID_M18000_LX_BASE_T_OCP),
+ .driver_data = BIT(NBL_CAP_HAS_NET_BIT) },
+ /* required as sentinel */
+ { }
+};
+MODULE_DEVICE_TABLE(pci, nbl_id_table);
+
+static struct pci_driver nbl_driver = {
+ .name = NBL_DRIVER_NAME,
+ .id_table = nbl_id_table,
+ .probe = nbl_probe,
+ .remove = nbl_remove,
+};
+
+module_pci_driver(nbl_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Nebula Matrix Network Driver");
+MODULE_AUTHOR("Illusion Wang <illusion.wang@nebula-matrix.com>");
|
| 3/2 | 2026/09/14 13:37 | llm | patch-evaluator |
2mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 101891 output: 111 thoughts: 2136 Thoughts: **Analysis of the Nebula-matrix Ethernet Controller Driver Patch for Fuzzing Suitability** Okay, let's break this down. We're looking at a patch series introducing a new network device driver, specifically for the Nebula-matrix Ethernet Controller family, also marketed as the SNIC s1000. The driver adds files in `Documentation/`, `drivers/net/ethernet/nebula-matrix/`, and a `CONFIG_NBL` option. My immediate concern is reachability. The instructions are clear: we only proceed if the code can *actually execute* in a standard virtualized environment (QEMU or GCE). The key question is whether this driver interacts with hardware that's *not* emulated in those environments. The documentation describes this as a "series of network interface cards for the Data Center Area" and includes PCI device enumeration, firmware interaction, and channel-based communication. Alarm bells are ringing. I've checked the PCI IDs: Vendor ID is 0x1F0F (Nebula Matrix Limited), and Device IDs are 0x3403-0x3412. This confirms this is dedicated hardware, a SmartNIC/ASIC, not a virtual device. The description is explicit: "Nebula-matrix Ethernet Controller". QEMU does *not* emulate this, it only emulates generic devices. The instructions specifically highlight in section 2: "Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU". This is a perfect match. Let's do a quick scan of the added files to confirm there are no fallbacks. Looking at the file list, the core of the driver is located at `drivers/net/ethernet/nebula-matrix/`, with the driver core tied directly to the PCI device. I confirm that with the inclusion of `module_pci_driver(nbl_driver)`. There's no indication of any virtual buses, loopbacks, mock devices, or any other method to make the driver function without the specific PCIe device being probed. Thus, based on the documented requirements, this patch series falls squarely into the "Structurally unreachable hardware" category and is described as requiring physical ASIC/PCIe cards that are not emulated in standard QEMU. Therefore, after evaluating all the requirements, it is impossible to be fuzzed in standard QEMU or GCE environments. The conclusion is clear: this patch is *not* suitable for fuzzing. |
| 4/2 | 2026/09/14 13:40 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch series introduces a new PCIe driver for Nebula-matrix m18110/m18000 (SNIC s1000) series network interface cards. This hardware is a vendor-specific SmartNIC/ASIC that is not emulated in standard QEMU or GCE virtual environments, making the driver code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch series introduces a new PCIe driver for Nebula-matrix m18110/m18000 (SNIC s1000) series network interface cards. This hardware is a vendor-specific SmartNIC/ASIC that is not emulated in standard QEMU or GCE virtual environments, making the driver code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 5/1 | 2026/09/14 13:40 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|