[PATCH v2 18/31] gpu: nova-core: gsp: add GMC dispatch on receive

[John Hubbard]

The r000 boot path delivers the load-and-execute steps as GMC events
keyed by command id, where the RPC path keys on a function code, so the
boot loop needs its own dispatch.

Add a GMC receive that dispatches on the command id. A GMC element and
an RPC element share every field through the NVDM header, so this checks
the NVDM type before reading the GMC header and drops an element of the
other kind rather than handing the handler a command id decoded from an
RPC header. It also drops an element whose GMC payload size disagrees
with the length the transport header declares, since GSP-RM sends the
two as one length and nothing says which to believe. An element nobody
claims yields Ok(None), and the read pointer advances on every path.

Assisted-by: Cursor:claude-opus-5
Reviewed-by: Timur Tabi <ttabi@xxxxxxxxxx>
Signed-off-by: John Hubbard <jhubbard@xxxxxxxxxx>
---
 drivers/gpu/nova-core/gsp/cmdq.rs | 79 ++++++++++++++++++++++++++++++-
 drivers/gpu/nova-core/gsp/fw.rs   | 20 ++++++++
 2 files changed, 97 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs b/drivers/gpu/nova-core/gsp/cmdq.rs
index 96128c418dc9..98d749674df1 100644
--- a/drivers/gpu/nova-core/gsp/cmdq.rs
+++ b/drivers/gpu/nova-core/gsp/cmdq.rs
@@ -641,7 +641,6 @@ struct GspMessage<'a> {
 /// A GMC message ready to be processed from the message queue.
 ///
 /// This is the type returned by [`CmdqInner::wait_for_gmc_msg`].
-#[expect(dead_code)]
 struct GmcMessage<'a> {
     // Reference to the header of the message.
     header: &'a GspGmcMsgElement,
@@ -791,6 +790,22 @@ fn receive_msg<M: MessageFromGsp>(&self, timeout: Delta) -> Result<M>
         self.inner.lock().receive_msg(timeout, None)
     }
 
+    /// Receives one GMC event from the GSP and passes its command id and raw payload slices to
+    /// `handler`.
+    ///
+    /// This method may sleep while waiting. The [`CmdqInner`] mutex stays locked across the wait
+    /// and across the `handler` call, so `handler` must not call back into this [`Cmdq`].
+    ///
+    /// See [`CmdqInner::receive_gmc_and_dispatch`] for return values, queue state, and errors.
+    #[expect(dead_code)]
+    pub(crate) fn receive_gmc_and_dispatch<R>(
+        &self,
+        timeout: Delta,
+        handler: impl FnOnce(u32, &[u8], &[u8]) -> Option<R>,
+    ) -> Result<Option<R>> {
+        self.inner.lock().receive_gmc_and_dispatch(timeout, handler)
+    }
+
     /// Waits for an unsolicited GSP event of type `M`, dispatching any other event that arrives
     /// first.
     ///
@@ -1314,7 +1329,6 @@ fn drain(&mut self) -> Result {
     /// - `ETIMEDOUT` if `timeout` has elapsed before any message becomes available.
     /// - `EIO` if the framing is invalid, or the queue was already poisoned by an earlier such
     ///   failure. Either failure poisons the queue, so recovery requires a reset.
-    #[expect(dead_code)]
     fn wait_for_gmc_msg(&self, timeout: Delta) -> Result<GmcMessage<'_>> {
         if self.poisoned.get() {
             return Err(EIO);
@@ -1370,4 +1384,65 @@ fn wait_for_gmc_msg(&self, timeout: Delta) -> Result<GmcMessage<'_>> {
             contents: (slice_1, slice_2),
         })
     }
+
+    /// Receive the next GMC event from the GSP and dispatch it through a handler.
+    ///
+    /// The handler receives the GMC command id and the raw payload slices that follow the
+    /// [`super::fw::GmcApiHeader`] (two slices because the circular buffer may wrap). It returns
+    /// `None` for an event it does not handle.
+    ///
+    /// Where [`Self::receive_msg`] keys on [`MsgFunction`], this keys on the GMC command id,
+    /// which is the form the r000 firmware uses for boot events.
+    ///
+    /// Returns `Ok(None)` when nothing claimed the element, either because it is not a GMC
+    /// element or because the handler declined it. The read pointer is advanced on every path.
+    ///
+    /// # Errors
+    ///
+    /// - `ETIMEDOUT` if `timeout` has elapsed before any message becomes available.
+    /// - `EIO` if the queue is poisoned or the element fails framing validation (see
+    ///   [`Self::wait_for_gmc_msg`]).
+    fn receive_gmc_and_dispatch<R>(
+        &mut self,
+        timeout: Delta,
+        handler: impl FnOnce(u32, &[u8], &[u8]) -> Option<R>,
+    ) -> Result<Option<R>> {
+        let message = self.wait_for_gmc_msg(timeout)?;
+        let header = message.header;
+        let length = header.length();
+
+        // The RPC and GMC elements share every field through `nvdm_header`, so `gmc` holds an
+        // RPC header rather than a GMC one unless the NVDM type says otherwise.
+        let result = if !header.is_gmc_api() {
+            dev_warn!(&self.dev, "GSP GMC: dropping non-GMC queue element\n");
+            None
+        } else if num::u32_as_usize(header.gmc.size) != header.payload_length() {
+            // GSP-RM sends the element as the GMC header plus `size` bytes, so the two lengths
+            // describe the same payload and a handler cannot tell which one to believe.
+            dev_err!(
+                &self.dev,
+                "GSP GMC: payload is {} bytes, transport declares {}\n",
+                header.gmc.size,
+                header.payload_length(),
+            );
+            None
+        } else {
+            let command_id = header.gmc.command_id();
+
+            dev_dbg!(
+                &self.dev,
+                "GSP GMC: event: seq# {}, command_id=0x{:x}, length=0x{:x}\n",
+                header.gmc.sequence,
+                command_id,
+                length,
+            );
+
+            handler(command_id, message.contents.0, message.contents.1)
+        };
+
+        self.gsp_mem
+            .advance_cpu_read_ptr(u32::try_from(length.div_ceil(GSP_PAGE_SIZE))?);
+
+        Ok(result)
+    }
 }
diff --git a/drivers/gpu/nova-core/gsp/fw.rs b/drivers/gpu/nova-core/gsp/fw.rs
index bbcc2e2b8401..31c0e6351fdc 100644
--- a/drivers/gpu/nova-core/gsp/fw.rs
+++ b/drivers/gpu/nova-core/gsp/fw.rs
@@ -1008,6 +1008,10 @@ pub(crate) struct GmcApiHeader {
     reserved: [u32; 5],
 }
 
+/// Command identifier bits of [`GmcApiHeader::command`], matching Open RM's
+/// `GMCAPI_HEADER_COMMAND_ID_MASK`. The remaining byte carries flags.
+const GMCAPI_COMMAND_ID_MASK: u32 = 0x00ff_ffff;
+
 static_assert!(size_of::<GmcApiHeader>() == size_of::<r000_00::GMCAPI_HEADER>());
 static_assert!(
     core::mem::offset_of!(GmcApiHeader, command)
@@ -1030,6 +1034,13 @@ pub(crate) struct GmcApiHeader {
         == core::mem::offset_of!(r000_00::GMCAPI_HEADER, reserved)
 );
 
+impl GmcApiHeader {
+    /// Returns the command identifier, without the flag byte.
+    pub(crate) fn command_id(&self) -> u32 {
+        self.command & GMCAPI_COMMAND_ID_MASK
+    }
+}
+
 // SAFETY: All fields are integer types with no uninitialized padding bytes.
 unsafe impl AsBytes for GmcApiHeader {}
 
@@ -1134,6 +1145,15 @@ pub(crate) fn validate_framing(&self) -> Result {
         )
     }
 
+    /// Returns `true` if the NVDM header routes this element to the GSP's GMC dispatch.
+    ///
+    /// A [`GspMsgElement`] and a [`GspGmcMsgElement`] share every field through `nvdm_header`,
+    /// so the NVDM type is what distinguishes the two on the queue, and `gmc` holds an RPC
+    /// header rather than a GMC one when this returns `false`.
+    pub(crate) fn is_gmc_api(&self) -> bool {
+        self.nvdm_header.validate(NvdmType::GmcApi)
+    }
+
     /// Returns the number of elements (i.e. memory pages) used by this message.
     pub(crate) fn element_count(&self) -> u32 {
         self.mctp_payload_size
-- 
2.55.0