[PATCH v3 11/33] gpu: nova-core: add GMC transport receive path

[John Hubbard <jhubbard@nvidia.com>]

The r000 firmware posts GMC and RPC messages on the same queue. Behind
the transport headers, a GMC element carries a GMC header instead of an
RPC header.

Nova-core's receive path decoded RPC elements only.

Add a receive path for GMC elements. It validates the transport headers
before it trusts the length that they declare, as Open RM does. The read
pointer advances by that length, so a bad header leaves no way to find
the next element. The receive path poisons the queue on a bad header,
and every later receive fails until the device is reset. The GMC receive
path has no caller yet.

Assisted-by: LLM
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
---
 drivers/gpu/nova-core/gsp/cmdq.rs | 167 ++++++++++++++++++++++++++----
 drivers/gpu/nova-core/gsp/fw.rs   |  64 ++++++++++--
 drivers/gpu/nova-core/mctp.rs     |  14 ++-
 3 files changed, 214 insertions(+), 31 deletions(-)

diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs b/drivers/gpu/nova-core/gsp/cmdq.rs
index c0c3d8596b30..a1bf536dc109 100644
--- a/drivers/gpu/nova-core/gsp/cmdq.rs
+++ b/drivers/gpu/nova-core/gsp/cmdq.rs
@@ -59,12 +59,14 @@
             MsgFunction,
             MsgqRxHeader,
             MsgqTxHeader,
+            QueueElementHeader,
             GSP_MSG_QUEUE_ELEMENT_SIZE_MAX, //
         },
         PteArray,
         GSP_PAGE_SHIFT,
         GSP_PAGE_SIZE, //
     },
+    mctp::NvdmType,
     num,
     sbuffer::SBufferIter, //
 };
@@ -475,6 +477,44 @@ struct GspMessage<'a> {
     contents: (&'a [u8], &'a [u8]),
 }
 
+/// A GMC (GPU Management Controller) API message ready to be processed from the message queue.
+///
+/// This is the message that [`QueueElement::Gmc`] carries.
+#[expect(dead_code)]
+struct GmcMessage<'a> {
+    // The queue element header and the GMC API header that open the element.
+    header: &'a GspGmcMsgElement,
+    // Slices to the payload that follows the GMC API header. The second slice is empty unless the
+    // payload wraps around the end of the message queue.
+    contents: (&'a [u8], &'a [u8]),
+}
+
+/// A queue element that has passed validation, decoded as an RPC message or as a GMC API message.
+///
+/// The queue element header holds an MCTP (Management Component Transport Protocol) header and an
+/// NVDM (NVIDIA vendor-defined message) header. The NVDM type selects between the two kinds of
+/// message.
+///
+/// This is the type returned by [`CmdqInner::wait_for_element`].
+enum QueueElement<'a> {
+    /// A GMC API message.
+    Gmc(GmcMessage<'a>),
+    /// An element whose NVDM type names another kind of message, such as an RM RPC. Only its
+    /// queue element header is decoded.
+    Other(&'a QueueElementHeader),
+}
+
+impl QueueElement<'_> {
+    /// Returns the number of queue slots that the element occupies.
+    #[expect(dead_code)]
+    fn element_count(&self) -> u32 {
+        match self {
+            Self::Gmc(message) => message.header.element_count(),
+            Self::Other(element_header) => element_header.element_count(),
+        }
+    }
+}
+
 /// GSP command queue.
 ///
 /// Provides the ability to send commands and receive messages from the GSP using a shared memory
@@ -838,29 +878,7 @@ fn wait_for_msg(&self, timeout: Delta) -> Result<GspMessage<'_>> {
             header.length(),
         );
 
-        let payload_length = header.payload_length();
-
-        // Check that the driver read area is large enough for the message.
-        if slice_1.len() + slice_2.len() < payload_length {
-            return Err(self.poison(fmt!(
-                "message advertises {} payload bytes but only {} are readable",
-                payload_length,
-                slice_1.len() + slice_2.len()
-            )));
-        }
-
-        // Cut the message slices down to the actual length of the message.
-        let (slice_1, slice_2) = if slice_1.len() > payload_length {
-            // PANIC: we checked above that `slice_1` is at least as long as `payload_length`.
-            (slice_1.split_at(payload_length).0, &slice_2[0..0])
-        } else {
-            (
-                slice_1,
-                // PANIC: we checked above that `slice_1.len() + slice_2.len()` is at least as
-                // large as `payload_length`.
-                slice_2.split_at(payload_length - slice_1.len()).0,
-            )
-        };
+        let (slice_1, slice_2) = self.payload_slices(slice_1, slice_2, header.payload_length())?;
 
         // Validate checksum.
         if Cmdq::calculate_checksum(SBufferIter::new_reader([
@@ -1029,4 +1047,107 @@ fn drain(&mut self) -> Result {
 
         Ok(())
     }
+
+    /// Truncates the read area that follows the queue element header and the message header to
+    /// the `payload_length` bytes of payload.
+    ///
+    /// # Errors
+    ///
+    /// - `EIO` if fewer bytes than that are readable, which poisons the queue.
+    fn payload_slices<'a>(
+        &self,
+        slice_1: &'a [u8],
+        slice_2: &'a [u8],
+        payload_length: usize,
+    ) -> Result<(&'a [u8], &'a [u8])> {
+        if slice_1.len() + slice_2.len() < payload_length {
+            return Err(self.poison(fmt!(
+                "message advertises {} payload bytes but only {} are readable",
+                payload_length,
+                slice_1.len() + slice_2.len()
+            )));
+        }
+
+        Ok(if slice_1.len() > payload_length {
+            // PANIC: we checked above that `slice_1` is at least as long as `payload_length`.
+            (slice_1.split_at(payload_length).0, &slice_2[0..0])
+        } else {
+            (
+                slice_1,
+                // PANIC: we checked above that `slice_1.len() + slice_2.len()` is at least as
+                // large as `payload_length`.
+                slice_2.split_at(payload_length - slice_1.len()).0,
+            )
+        })
+    }
+
+    /// Waits for the next queue element and decodes it as an RPC message or as a GMC API message.
+    ///
+    /// ```text
+    ///     +------------------------------------+
+    ///     | queue element header: magic, MCTP  |  validated
+    ///     |   header, NVDM header, lengths     |
+    ///     +------------------------------------+
+    ///     | message header                     |  decoded as a GMC API header when the NVDM type
+    ///     +------------------------------------+  is GmcApi, and left undecoded otherwise
+    ///     | payload                            |  truncated to the length that the queue
+    ///     +------------------------------------+  element header declares
+    /// ```
+    ///
+    /// # Errors
+    ///
+    /// - `ETIMEDOUT` if no element arrives within `timeout`.
+    /// - `EIO` if the queue is already poisoned, or if the framing is invalid, which poisons it
+    ///   (see [`Self::poisoned`]).
+    #[expect(dead_code)]
+    fn wait_for_element(&self, timeout: Delta) -> Result<QueueElement<'_>> {
+        if self.poisoned.get() {
+            return Err(EIO);
+        }
+
+        let (slice_1, slice_2) = read_poll_timeout(
+            || Ok(self.gsp_mem.driver_read_area()),
+            |driver_area| !driver_area.0.is_empty(),
+            Delta::from_millis(1),
+            timeout,
+        )
+        .map(|(slice_1, slice_2)| (slice_1.as_flattened(), slice_2.as_flattened()))?;
+
+        let Some((element_header, _)) = QueueElementHeader::from_bytes_prefix(slice_1) else {
+            return Err(self.poison(fmt!(
+                "read area of {} bytes is shorter than a queue element header",
+                slice_1.len()
+            )));
+        };
+
+        if let Err(error) = element_header.validate() {
+            return Err(self.poison(fmt!(
+                "element has a bad queue element header ({:?}), declared length {}",
+                error,
+                element_header.element_len()
+            )));
+        }
+
+        if !element_header.is_nvdm_type(NvdmType::GmcApi) {
+            return Ok(QueueElement::Other(element_header));
+        }
+
+        let Some((header, slice_1)) = GspGmcMsgElement::from_bytes_prefix(slice_1) else {
+            return Err(self.poison(fmt!(
+                "read area of {} bytes is shorter than a GMC element header",
+                slice_1.len()
+            )));
+        };
+
+        let Some(payload_length) = header.payload_length() else {
+            return Err(self.poison(fmt!(
+                "GMC message seq# {} declares a message shorter than the GMC API header",
+                header.gmc.sequence
+            )));
+        };
+
+        let contents = self.payload_slices(slice_1, slice_2, payload_length)?;
+
+        Ok(QueueElement::Gmc(GmcMessage { header, contents }))
+    }
 }
diff --git a/drivers/gpu/nova-core/gsp/fw.rs b/drivers/gpu/nova-core/gsp/fw.rs
index 75bc3d66f71f..5548ca77f49b 100644
--- a/drivers/gpu/nova-core/gsp/fw.rs
+++ b/drivers/gpu/nova-core/gsp/fw.rs
@@ -944,7 +944,6 @@ pub(crate) struct QueueElementHeader {
         == core::mem::offset_of!(r000_00::GSP_MSG_QUEUE_ELEMENT, nvdmHeader)
 );
 
-#[expect(dead_code)]
 impl QueueElementHeader {
     /// Builds the queue element header of an element whose message header and payload together
     /// take `message_len` bytes.
@@ -968,21 +967,68 @@ fn new(nvdm: NvdmType, message_len: usize) -> Result<Self> {
     }
 
     /// Returns the length of the whole element, the queue element header included.
-    fn element_len(&self) -> usize {
+    pub(crate) fn element_len(&self) -> usize {
         num::u32_as_usize(self.element_len)
     }
 
     /// Returns the length of the payload that follows a message header of `message_header_len`
-    /// bytes.
-    fn payload_len(&self, message_header_len: usize) -> usize {
-        num::u32_as_usize(self.message_len).saturating_sub(message_header_len)
+    /// bytes, or `None` if the declared message is shorter than that header.
+    fn payload_len(&self, message_header_len: usize) -> Option<usize> {
+        num::u32_as_usize(self.message_len).checked_sub(message_header_len)
     }
 
     /// Returns the number of queue slots that this element occupies.
-    fn element_count(&self) -> u32 {
+    pub(crate) fn element_count(&self) -> u32 {
         self.element_len
             .div_ceil(num::usize_into_u32::<GSP_PAGE_SIZE>())
     }
+
+    /// Validates the queue element header.
+    ///
+    /// Returns the first check that fails as a [`QueueElementHeaderError`].
+    pub(crate) fn validate(&self) -> Result<(), QueueElementHeaderError> {
+        if self.magic != MCTP_MAGIC {
+            return Err(QueueElementHeaderError::BadMagic);
+        }
+        // The MCTP start-of-message and end-of-message bits are not checked. Every element carries
+        // one whole message, because a large RPC is split into continuation records, not packets.
+        if !self.mctp.has_expected_version() {
+            return Err(QueueElementHeaderError::BadMctpVersion);
+        }
+        if !self.nvdm.has_nvidia_vendor() {
+            return Err(QueueElementHeaderError::BadNvdmVendor);
+        }
+
+        // Under confidential compute, GSP-RM pads the element out to whole queue slots, so the
+        // element may be longer than its queue element header and message together, but never
+        // shorter.
+        let length = self.element_len();
+        let min_length = size_of::<Self>().saturating_add(num::u32_as_usize(self.message_len));
+        if length < min_length || length > GSP_MSG_QUEUE_ELEMENT_SIZE_MAX {
+            return Err(QueueElementHeaderError::BadLength);
+        }
+
+        Ok(())
+    }
+
+    pub(crate) fn is_nvdm_type(&self, nvdm_type: NvdmType) -> bool {
+        self.nvdm.validate(nvdm_type)
+    }
+}
+
+/// The check of [`QueueElementHeader::validate`] that a queue element header fails.
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum QueueElementHeaderError {
+    /// The first word is not `"MCTP"`.
+    BadMagic,
+    /// The MCTP header carries a version other than the one that this driver uses.
+    BadMctpVersion,
+    /// The NVDM header names a vendor other than NVIDIA, or a message type other than
+    /// vendor-defined.
+    BadNvdmVendor,
+    /// The element length is shorter than the queue element header and the message together, or
+    /// above the maximum element size.
+    BadLength,
 }
 
 // SAFETY: All fields are integer types or transparent wrappers over one, with no padding.
@@ -1091,6 +1137,12 @@ pub(crate) fn init(
         })
     }
 
+    /// Returns the length of the payload that follows the GMC API header, or `None` if the queue
+    /// element header declares a message shorter than the GMC API header.
+    pub(crate) fn payload_length(&self) -> Option<usize> {
+        self.element_header.payload_len(size_of::<GmcApiHeader>())
+    }
+
     /// Returns the length of the whole element, both headers included.
     pub(crate) fn length(&self) -> usize {
         self.element_header.element_len()
diff --git a/drivers/gpu/nova-core/mctp.rs b/drivers/gpu/nova-core/mctp.rs
index 0eb964c74e32..d2a7c6c02c35 100644
--- a/drivers/gpu/nova-core/mctp.rs
+++ b/drivers/gpu/nova-core/mctp.rs
@@ -70,6 +70,11 @@ pub(crate) fn single_packet() -> Self {
     pub(crate) fn is_single_packet(self) -> bool {
         self.som().into_bool() && self.eom().into_bool()
     }
+
+    /// Returns `true` if this MCTP header carries [`Self::VERSION`].
+    pub(crate) fn has_expected_version(self) -> bool {
+        u32::from(self.version()) == Self::VERSION
+    }
 }
 
 /// MCTP message type for PCI vendor-defined messages.
@@ -96,10 +101,15 @@ pub(crate) fn new(nvdm_type: NvdmType) -> Self {
             .with_nvdm_type(nvdm_type)
     }
 
-    /// Validates this header against the expected NVIDIA NVDM format and type.
-    pub(crate) fn validate(self, expected_type: NvdmType) -> bool {
+    pub(crate) fn has_nvidia_vendor(self) -> bool {
         u8::from(self.msg_type()) == MSG_TYPE_VENDOR_PCI
             && u16::from(self.vendor_id()) == Vendor::NVIDIA.as_raw()
+    }
+
+    /// Returns `true` if this NVDM header names the NVIDIA vendor and the NVDM type
+    /// `expected_type`.
+    pub(crate) fn validate(self, expected_type: NvdmType) -> bool {
+        self.has_nvidia_vendor()
             && matches!(self.nvdm_type(), Ok(nvdm_type) if nvdm_type == expected_type)
     }
 }
-- 
2.55.0