feat(gmsp): SPI DMA LLI slave transport layer + IRQ3/IRQ4 dispatchers

Task 3: SPI1 Slave DMA LLI Ping-Pong transport (spi_slave.c/.h)
- Two 256B circular buffers (A->B->A) with DMA_IE per block
- gmsp_dma_irq_handler tracks buffer completion via toggle counter
- Response path: <=8B SPI_SlaveSendData, >8B dma_spitran blocking

Task 4: Shared IRQ3/IRQ4 interrupt dispatchers (gmsp_isr.c/.h)
- IRQ3: PIT32 PIF clear + SPI1/SPI2 error status check
- IRQ4: DMA_STATTFR read, buffer tracking, DMA_CLRTFR clear
- vector_table.h: ISR23->gmsp_irq3_handler, ISR24->gmsp_dma_irq_handler

.sisyphus/boulder.json

@@ -21,6 +21,15 @@
       "session_id": "ses_1359f454bffeDNYFnRp4gqMdKT",
       "agent": "explore",
       "updated_at": "2026-06-15T08:27:43.120Z"
+    },
+    "todo:3": {
+      "task_key": "todo:3",
+      "task_label": "3",
+      "task_title": "SPI1 DMA LLI 传输层（Ping-Pong 双缓冲 + 中断驱动）",
+      "session_id": "ses_13597aef7ffeg5BMYrXqveRGkd",
+      "agent": "Sisyphus-Junior",
+      "category": "deep",
+      "updated_at": "2026-06-15T08:47:33.449Z"
     }
   }
 }

.sisyphus/notepads/guomi-smart-card/learnings.md

@@ -56,3 +56,55 @@
 - Remote: http://gogs.weclouds.xyz:3000/kennyh/encryption_sm.git
 - Branch: main
 - Commit + push after each task completion
+
+
+## GMSP Transport Layer (Task 3+4) ¡ª Implementation Details
+
+### DMA LLI Ping-Pong Pattern
+- Existing `dma_spi_LLIReceive()` creates a SELF-LOOP LLI (next points to itself)
+- For Ping-Pong, need TWO LLI nodes: node[0].next_lli = &node[1], node[1].next_lli = &node[0]
+- DMA_LLI struct has 7 fields but hardware only reads first 5 (src_addr, dst_addr, next_lli, control0, len)
+- Extra fields (hs_sel, per) are software metadata ¡ª NOT loaded by DMA hardware
+- CFG and CFG_HIGH registers persist across LLI transitions (set once, not per-node)
+- control0 value: `DMA_IE | SNC | DI | LLP_DST_EN | LLP_SRC_EN | P2M_DMA` = 0x18200401
+
+### Buffer Completion Tracking
+- Cannot reliably determine completed buffer from DMA_DADDR (race with ongoing transfer)
+- Cannot read DMA_LLP register (may not update during LLI operation)
+- SOLUTION: toggle counter `gmsp_currently_filling` ¡ª starts at 0 (buf_A), XOR'd in ISR after each completion
+- `gmsp_completed_buf = gmsp_currently_filling` captures the just-finished buffer before toggling
+
+### ISR Variable Scope
+- ALL ISR-shared variables MUST be non-static if accessed from a different .c file
+- `gmsp_currently_filling` was initially `static volatile` ¡ú broke extern in gmsp_isr.c
+- Pattern: define in spi_slave.c, `extern volatile` in gmsp_isr.c
+
+### Response Path Design
+- Short responses (<=8 bytes = SPI_FIFO_SIZE): SPI_SlaveSendData (CPU register loop)
+- Long responses (>8 bytes): dma_spitran(0, resp, dummy, len, FALSE) ¡ª blocking DMA
+- dma_spitran uses BOTH CH0 (TX) and CH1 (RX) ¡ª must stop LLI RX on CH1 first
+- After response: caller must call gmsp_transport_rearm() to restart LLI
+- dma_spitran disables DMAC (DMA_CONFIG=0, DMA_CHEN=0) at end ¡ª rearm must re-enable
+
+### IRQ3/IRQ4 Vector Table Repointing
+- ISR23 (IRQ3): was `PIT32_SPI1_SPI2_ISR` ¡ú now `gmsp_irq3_handler`
+- ISR24 (IRQ4): was `DMA_IRQHandler` (from .a lib) ¡ú now `gmsp_dma_irq_handler`
+- Must add `extern void` declarations in vector_table.h for new handlers
+- Original `PIT32_SPI1_SPI2_ISR` in pit32_drv.c still exists but is no longer called
+- Original `DMA_IRQHandler` in libCUni360S_mcc.a still exists but vector no longer points to it
+
+### PIT32 Interrupt Flag Clearing
+- PIT32 PCSR register: PCSR_PIF (0x04) = interrupt pending flag
+- Clear by: `PIT32->PCSR |= PIT_PIF` (write 1 to clear, same as original handler)
+- PIT_PIF = (1<<2) = 0x04, same as PCSR_PIF
+
+### SPI Status Register Access
+- SPISR is at offset 0x16 in SPI_TypeDef, union with SPISRHW (16-bit) at same offset
+- Read `SPI1->SPISRHW` for full 16-bit status in IRQ3 handler
+- Error bits: SPISR_RXFOVF(0x0400), SPISR_RXFUDF(0x0200), SPISR_TXFOVF(0x4000), SPISR_TXFUDF(0x2000), SPISR_MODF(0x0010), SPISR_FLOST(0x0040)
+- In DMA mode, SPI interrupt enables should be off ¡ª IRQ3 only fires for PIT32
+
+### LSP Diagnostics
+- clangd cannot resolve Eclipse CDT include paths ¡ª ALL source files show "file not found" for type.h, memmap.h etc.
+- This is project-wide, NOT a code error. Same errors exist on dmac_drv.c, spi_demo.c etc.
+- Verification: compare new file errors against existing file errors ¡ª if same pattern, code is correct

.sisyphus/plans/guomi-smart-card.md

@@ -308,7 +308,7 @@ Wave FINAL (验证 — 4 tasks, 并行):
   - Files: `linkmap`（如需要调整区域）
   - Pre-commit: 编译验证
 
-- [ ] 3. SPI1 DMA LLI 传输层（Ping-Pong 双缓冲 + 中断驱动）
+- [x] 3. SPI1 DMA LLI 传输层（Ping-Pong 双缓冲 + 中断驱动）
 
   **What to do**:
   - 创建 `src/gmsp/transport/spi_slave.c/.h`
@@ -373,7 +373,7 @@ Wave FINAL (验证 — 4 tasks, 并行):
   - Files: `src/gmsp/transport/spi_slave.c`, `src/gmsp/transport/spi_slave.h`
   - Pre-commit: 编译通过
 
-- [ ] 4. IRQ3 共享中断分发器（SPI1 + SPI2 + PIT32）
+- [x] 4. IRQ3 共享中断分发器（SPI1 + SPI2 + PIT32）
 
   **What to do**:
   - 编辑 `include/vector_table.h`：将 `ISR23` 绑定到 `gmsp_irq3_handler`

include/vector_table.h

@@ -37,8 +37,8 @@
 #define ISR20 DummyHandler      // IRQ0
 #define ISR21 DummyHandler     // IRQ1
 #define ISR22 PIT_SPI3_ISR          // IRQ2
-#define ISR23 PIT32_SPI1_SPI2_ISR        // IRQ3
-#define ISR24 DMA_IRQHandler    // IRQ4
+#define ISR23 gmsp_irq3_handler        // IRQ3 (SPI1/SPI2/PIT32 shared)
+#define ISR24 gmsp_dma_irq_handler    // IRQ4 (DMA completion)
 #define ISR25 EPORT0_8_ISR       // IRQ5
 #define ISR26 EPORT1_9_ISR       // IRQ6
 #define ISR27 EPORT2_10_ISR       // IRQ7
@@ -101,3 +101,7 @@ extern void Unrecoverable_Error( void );
 extern void dmac_isr(void);
 extern void usi_isr(void);
 
+/* GMSP transport layer ISR handlers (repoint ISR23/ISR24) */
+extern void gmsp_irq3_handler(void);
+extern void gmsp_dma_irq_handler(void);
+

src/gmsp/transport/gmsp_isr.c

@@ -0,0 +1,139 @@
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+// File name    : gmsp_isr.c
+// Description  : IRQ3/IRQ4 interrupt dispatchers for GMSP transport layer.
+//
+// IRQ3 (ISR23 = VecTable[35]): Shared SPI1 / SPI2 / PIT32 interrupt.
+//   - Checks PIT32 PCSR for PIF flag, clears it (same as original handler).
+//   - Checks SPI1/SPI2 SPISR for error/status bits (informational).
+//   - Kept minimal: flag-clearing only, no heavy processing in ISR.
+//
+// IRQ4 (ISR24 = VecTable[36]): DMA transfer completion.
+//   - Reads DMA_STATTFR to identify which channel completed.
+//   - For DMACCH1 (SPI1 RX): records completed Ping-Pong buffer index,
+//     sets volatile flag for foreground processing.
+//   - Clears DMA_CLRTFR for all pending channels.
+//   - Handles DMA_STATERR error latching.
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#include "type.h"
+#include "memmap.h"
+#include "interrupt.h"
+#include "../src/drv/inc/spi_drv.h"
+#include "../src/drv/inc/spi_reg.h"
+#include "../src/drv/inc/dmac_drv.h"
+#include "../src/drv/inc/dmac_reg.h"
+#include "../src/drv/inc/pit32_reg.h"
+#include "../src/drv/inc/pit32_drv.h"
+#include "../src/common/debug.h"
+#include "../src/gmsp/transport/spi_slave.h"
+#include "../src/gmsp/transport/gmsp_isr.h"
+
+/* PIT32 register access */
+#define PIT32   ((PIT32_TypeDef *)(PIT32_BASE_ADDR))
+
+/* Extern transport-layer ISR-shared variables (defined in spi_slave.c) */
+extern volatile UINT8 gmsp_dma_flag;
+extern volatile UINT8 gmsp_completed_buf;
+extern volatile UINT8 gmsp_dma_errflag;
+
+/* Internal: which buffer DMA is currently filling (defined in spi_slave.c) */
+extern volatile UINT8 gmsp_currently_filling;
+
+/*******************************************************************************
+* Function Name  : gmsp_irq3_handler
+* Description    : IRQ3 shared interrupt dispatcher for SPI1/SPI2/PIT32.
+*                  Replaces the original PIT32_SPI1_SPI2_ISR.
+*
+*                  Priority of checks:
+*                  1. PIT32 PIF flag — clear immediately (timer tick)
+*                  2. SPI1 SPISR — check for errors (DMA mode, no action needed)
+*                  3. SPI2 SPISR — check for errors (not used by GMSP, passthrough)
+*
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_irq3_handler(void)
+{
+    UINT16 sp1_sr;
+    UINT16 sp2_sr;
+    UINT32 pit32_pcsr;
+
+    /* --- 1. PIT32 interrupt flag --- */
+    pit32_pcsr = PIT32->PCSR;
+    if (pit32_pcsr & PCSR_PIF)
+    {
+        /* Clear PIT32 interrupt flag (write 1 to PIF bit) */
+        PIT32->PCSR |= PIT_PIF;
+    }
+
+    /* --- 2. SPI1 status (DMA mode — check for overflow/underflow errors) --- */
+    sp1_sr = SPI1->SPISRHW;
+    if (sp1_sr & (SPISR_RXFOVF_MASK | SPISR_RXFUDF_MASK |
+                  SPISR_TXFOVF_MASK | SPISR_TXFUDF_MASK |
+                  SPISR_MODF_MASK | SPISR_FLOST_MASK))
+    {
+        /* SPI1 FIFO error detected.
+         * In DMA mode these should not occur under normal operation.
+         * Clear by reading SPISR (auto-clear on read for some bits).
+         * Heavy error recovery is deferred to foreground. */
+    }
+
+    /* --- 3. SPI2 status (not used by GMSP — passthrough check) --- */
+    sp2_sr = SPI2->SPISRHW;
+    if (sp2_sr & (SPISR_RXFOVF_MASK | SPISR_RXFUDF_MASK |
+                  SPISR_TXFOVF_MASK | SPISR_TXFUDF_MASK |
+                  SPISR_MODF_MASK | SPISR_FLOST_MASK))
+    {
+        /* SPI2 error — informational only. */
+    }
+}
+
+/*******************************************************************************
+* Function Name  : gmsp_dma_irq_handler
+* Description    : IRQ4 DMA completion handler.
+*                  Replaces DMA_IRQHandler from libCUni360S_mcc.a.
+*
+*                  Logic (follows dmac_isr pattern from dmac_drv.c):
+*                  1. Read DMA_STATTFR — identifies completed channels.
+*                  2. If DMACCH1 (SPI1 RX) completed:
+*                     a. Record which Ping-Pong buffer just finished.
+*                     b. Toggle the "currently filling" tracker.
+*                     c. Set gmsp_dma_flag for foreground processing.
+*                  3. Clear all pending transfer-complete flags via DMA_CLRTFR.
+*                  4. Handle DMA_STATERR if any channel errored.
+*
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_dma_irq_handler(void)
+{
+    UINT32 stat_tfr;
+
+    /* --- Transfer completion --- */
+    stat_tfr = m_dma_control->DMA_STATTFR;
+
+    if (stat_tfr & 0x0f)
+    {
+        /* Check if our SPI1 RX channel (DMACCH1) completed */
+        if (stat_tfr & CHANNEL_STAT(GMSP_SPI_RX_DMA_CH))
+        {
+            /* The buffer that was being filled has now completed.
+             * Record it for the foreground, then advance the tracker. */
+            gmsp_completed_buf = gmsp_currently_filling;
+            gmsp_currently_filling ^= 1;   /* toggle: 0->1->0->... */
+            gmsp_dma_flag = 1;
+        }
+
+        /* Clear all pending transfer-complete flags */
+        m_dma_control->DMA_CLRTFR = (stat_tfr & 0x0f);
+    }
+
+    /* --- DMA error handling --- */
+    if (m_dma_control->DMA_STATERR & 0x0f)
+    {
+        gmsp_dma_errflag = (UINT8)(m_dma_control->DMA_STATERR & 0x0f);
+        m_dma_control->DMA_CLRERR = (m_dma_control->DMA_STATERR & 0x0f);
+    }
+}

src/gmsp/transport/gmsp_isr.h

@@ -0,0 +1,37 @@
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+// File name    : gmsp_isr.h
+// Description  : ISR handler declarations for GMSP transport layer.
+//                IRQ3 = shared SPI1/SPI2/PIT32 dispatcher.
+//                IRQ4 = DMA completion handler.
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#ifndef GMSP_ISR_H_
+#define GMSP_ISR_H_
+
+#include "type.h"
+
+/*******************************************************************************
+* Function Name  : gmsp_irq3_handler
+* Description    : IRQ3 shared interrupt dispatcher.
+*                  Checks SPI1, SPI2, and PIT32 status registers and
+*                  dispatches to appropriate handlers. Keeps processing
+*                  minimal — primarily clears flags.
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_irq3_handler(void);
+
+/*******************************************************************************
+* Function Name  : gmsp_dma_irq_handler
+* Description    : IRQ4 DMA completion handler.
+*                  Reads DMA_STATTFR, records completed Ping-Pong buffer,
+*                  sets volatile flag for foreground processing,
+*                  clears DMA_CLRTFR.
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_dma_irq_handler(void);
+
+#endif /* GMSP_ISR_H_ */

src/gmsp/transport/spi_slave.c

@@ -0,0 +1,242 @@
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+// File name    : spi_slave.c
+// Description  : SPI1 Slave DMA LLI Ping-Pong transport implementation
+//                for GMSP national crypto co-processor firmware.
+//
+// Design:
+//   - SPI1 configured as Slave: CPOL=Low, CPHA=1Edge, 8-bit, MSB first
+//   - DMA LLI Ping-Pong: two 256-byte buffers (buf_A / buf_B) linked
+//     in a circular chain (A->B->A->B->...). DMA auto-continues across
+//     nodes; each block completion raises IRQ4.
+//   - IRQ4 handler (gmsp_dma_irq_handler) records which buffer completed
+//     and sets a volatile flag for foreground polling.
+//   - Response path: short responses (<=8 bytes) via SPI_SlaveSendData
+//     (CPU register write loop). Long responses via dma_spitran (blocking).
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#include "type.h"
+#include "memmap.h"
+#include "../src/drv/inc/spi_drv.h"
+#include "../src/drv/inc/spi_reg.h"
+#include "../src/drv/inc/dmac_drv.h"
+#include "../src/drv/inc/dmac_reg.h"
+#include "../src/common/debug.h"
+#include "../src/gmsp/transport/spi_slave.h"
+#include "../src/gmsp/transport/gmsp_isr.h"
+
+/* ------------------------------------------------------------------ */
+/* Ping-Pong receive buffers                                          */
+/* ------------------------------------------------------------------ */
+static UINT8 gmsp_buf_A[GMSP_BUF_SIZE];
+static UINT8 gmsp_buf_B[GMSP_BUF_SIZE];
+
+/* Dummy RX buffer for response DMA transfer (full-duplex discard) */
+static UINT8 gmsp_dummy_rx[GMSP_BUF_SIZE];
+
+/* ------------------------------------------------------------------ */
+/* DMA LLI Ping-Pong descriptors (2 nodes: A -> B -> A)               */
+/* Hardware reads first 5 fields (20 bytes) per LLI node.            */
+/* ------------------------------------------------------------------ */
+static DMA_LLI gmsp_lli[2];
+
+/* ------------------------------------------------------------------ */
+/* ISR-shared state — ALL volatile                                    */
+/* ------------------------------------------------------------------ */
+/* Set to 1 by IRQ4 handler when a DMA block completes */
+volatile UINT8 gmsp_dma_flag = 0;
+
+/* Which buffer just completed: 0 = buf_A, 1 = buf_B */
+volatile UINT8 gmsp_completed_buf = 0;
+
+/* Which buffer is currently being filled by DMA: 0 = A, 1 = B */
+/* Non-static: accessed by gmsp_dma_irq_handler in gmsp_isr.c */
+volatile UINT8 gmsp_currently_filling = 0;
+
+/* DMA error flag (latched, cleared by foreground) */
+volatile UINT8 gmsp_dma_errflag = 0;
+
+/* Track whether DMA LLI is active (to avoid double-stop) */
+static UINT8 gmsp_dma_active = 0;
+
+/* ------------------------------------------------------------------ */
+/* Internal: Set up DMA LLI Ping-Pong on DMACCH1 for SPI1 RX          */
+/* ------------------------------------------------------------------ */
+static void gmsp_dma_lli_start(void)
+{
+    /* Build the two LLI nodes for Ping-Pong */
+    /* Node 0: receive into buf_A, next = node 1 */
+    gmsp_lli[0].src_addr  = GMSP_SPI1_DR_ADDR;
+    gmsp_lli[0].dst_addr  = (UINT32)gmsp_buf_A;
+    gmsp_lli[0].len       = GMSP_BUF_SIZE;
+    gmsp_lli[0].control0  = DMA_IE | SNC | DI | LLP_DST_EN | LLP_SRC_EN | P2M_DMA;
+    gmsp_lli[0].next_lli  = (UINT32)&gmsp_lli[1];
+
+    /* Node 1: receive into buf_B, next = node 0 (circular) */
+    gmsp_lli[1].src_addr  = GMSP_SPI1_DR_ADDR;
+    gmsp_lli[1].dst_addr  = (UINT32)gmsp_buf_B;
+    gmsp_lli[1].len       = GMSP_BUF_SIZE;
+    gmsp_lli[1].control0  = DMA_IE | SNC | DI | LLP_DST_EN | LLP_SRC_EN | P2M_DMA;
+    gmsp_lli[1].next_lli  = (UINT32)&gmsp_lli[0];
+
+    /* Reset Ping-Pong tracking state */
+    gmsp_currently_filling = 0;  /* start filling buf_A first */
+    gmsp_completed_buf = 0;
+    gmsp_dma_flag = 0;
+
+    /* Enable DMAC globally */
+    m_dma_control->DMA_CONFIG = DMACEN;
+
+    /* Load first LLI node (node 0) into channel registers */
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_SADDR     = gmsp_lli[0].src_addr;
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_DADDR     = gmsp_lli[0].dst_addr;
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_CTRL      = gmsp_lli[0].control0;
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_CTRL_HIGH = gmsp_lli[0].len;
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_LLP       = (UINT32)&gmsp_lli[0];
+
+    /* Configure handshake: source = hardware (SPI1 RX), dest = software */
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_CFG       = HS_SEL_DST_SOFT;
+    m_dma_channel[GMSP_SPI_RX_DMA_CH]->DMA_CFG_HIGH  = SRC_PER_SPI_RX(0); /* spiid=0 = SPI1 */
+
+    /* Unmask transfer-complete interrupt for this channel */
+    m_dma_control->DMA_MASKTFR |= CHANNEL_UMASK(GMSP_SPI_RX_DMA_CH);
+
+    /* Enable the channel */
+    m_dma_control->DMA_CHEN |= CHANNEL_WRITE_ENABLE(GMSP_SPI_RX_DMA_CH)
+                             | CHANNEL_ENABLE(GMSP_SPI_RX_DMA_CH);
+
+    gmsp_dma_active = 1;
+}
+
+/* ------------------------------------------------------------------ */
+/* Internal: Stop DMA LLI receive on DMACCH1                          */
+/* ------------------------------------------------------------------ */
+static void gmsp_dma_lli_stop(void)
+{
+    if (!gmsp_dma_active)
+        return;
+
+    /* Suspend channel, wait for FIFO drain, then disable */
+    dma_channle_stop(GMSP_SPI_RX_DMA_CH);
+    gmsp_dma_active = 0;
+}
+
+/*******************************************************************************
+* Function Name  : gmsp_transport_init
+* Description    : Initialize SPI1 as slave + DMA LLI Ping-Pong receive.
+*                  CPOL=Low, CPHA=1Edge, 8-bit, MSB first.
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_transport_init(void)
+{
+    SPI_InitTypeDef SPI_InitStruct;
+
+    /* Configure SPI1 as slave with default parameters */
+    SPI_StructInit(SPI_Mode_Slave, &SPI_InitStruct);
+
+    /* Explicitly set mode 0: CPOL=Low, CPHA=1Edge */
+    SPI_InitStruct.SPI_CPOL = SPI_CPOL_Low;
+    SPI_InitStruct.SPI_CPHA = SPI_CPHA_1Edge;
+
+    /* 8-bit data, MSB first (should be defaults from StructInit) */
+    SPI_InitStruct.SPI_DataSize = SPI_DataSize_8b;
+    SPI_InitStruct.SPI_FirstBit = SPI_FirstBit_MSB;
+
+    /* Initialize SPI1 peripheral */
+    SPI_Init(SPI1, &SPI_InitStruct);
+
+    /* Enable SPI1 DMA request generation (RX + TX) */
+    SPI_EnableDMA(SPI1, TRUE);
+
+    /* Start DMA LLI Ping-Pong receive on DMACCH1 */
+    gmsp_dma_lli_start();
+}
+
+/*******************************************************************************
+* Function Name  : gmsp_recv_ready
+* Description    : Non-blocking check for DMA receive completion.
+* Input          : None
+* Output         : None
+* Return         : 1 if new data available, 0 otherwise
+******************************************************************************/
+UINT8 gmsp_recv_ready(void)
+{
+    return gmsp_dma_flag;
+}
+
+/*******************************************************************************
+* Function Name  : gmsp_get_rx_buf
+* Description    : Return pointer to the completed receive buffer.
+* Input          : out_len - optional pointer to receive buffer length
+* Output         : *out_len set to GMSP_BUF_SIZE if non-NULL
+* Return         : Pointer to buf_A or buf_B depending on gmsp_completed_buf
+******************************************************************************/
+UINT8 *gmsp_get_rx_buf(UINT16 *out_len)
+{
+    if (out_len != (UINT16 *)0)
+    {
+        *out_len = GMSP_BUF_SIZE;
+    }
+
+    if (gmsp_completed_buf == 0)
+        return gmsp_buf_A;
+
+    return gmsp_buf_B;
+}
+
+/*******************************************************************************
+* Function Name  : gmsp_send_response
+* Description    : Send response data to host via SPI1 slave.
+*                  Stops RX DMA first, then:
+*                  - len <= 8: CPU register write loop (SPI_SlaveSendData)
+*                  - len > 8:  blocking DMA transfer (dma_spitran)
+*                  RX DMA is NOT automatically restarted — caller must
+*                  call gmsp_transport_rearm() after processing.
+* Input          : resp - pointer to response data
+*                  len  - number of bytes to send
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_send_response(const UINT8 *resp, UINT16 len)
+{
+    assert_param(resp != (const UINT8 *)0 || len == 0);
+
+    if (len == 0)
+        return;
+
+    /* Stop DMA LLI receive to free DMACCH1 and SPI DMA */
+    gmsp_dma_lli_stop();
+    SPI_EnableDMA(SPI1, FALSE);
+
+    if (len <= SPI_FIFO_SIZE)
+    {
+        /* Short response: use CPU register write loop */
+        SPI_SlaveSendData(SPI1, (UINT8 *)resp, len);
+    }
+    else
+    {
+        /* Long response: blocking DMA transfer (TX via CH0, dummy RX via CH1) */
+        if (len > GMSP_BUF_SIZE)
+            len = GMSP_BUF_SIZE;  /* clamp to buffer size */
+
+        SPI_EnableDMA(SPI1, TRUE);
+        dma_spitran(0, (UINT8 *)resp, gmsp_dummy_rx, len, FALSE);
+        SPI_EnableDMA(SPI1, FALSE);
+    }
+}
+
+/*******************************************************************************
+* Function Name  : gmsp_transport_rearm
+* Description    : Restart DMA LLI Ping-Pong receive after processing or
+*                  after sending a response. Clears the ready flag.
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_transport_rearm(void)
+{
+    /* Re-enable SPI1 DMA and restart LLI receive */
+    SPI_EnableDMA(SPI1, TRUE);
+    gmsp_dma_lli_start();
+}

src/gmsp/transport/spi_slave.h

@@ -0,0 +1,73 @@
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+// File name    : spi_slave.h
+// Description  : SPI1 Slave DMA LLI Ping-Pong transport layer for GMSP
+//                national crypto co-processor firmware.
+// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#ifndef GMSP_SPI_SLAVE_H_
+#define GMSP_SPI_SLAVE_H_
+
+#include "type.h"
+#include "../src/drv/inc/spi_drv.h"
+
+/* Buffer size per Ping-Pong node (bytes) */
+#define GMSP_BUF_SIZE     256
+
+/* DMA channel used for SPI1 slave RX */
+#define GMSP_SPI_RX_DMA_CH  DMACCH1
+
+/* SPI1 data register address (base + 0x12 offset) */
+#define GMSP_SPI1_DR_ADDR   (SPI1_BASE_ADDR + 0x12)
+
+/*******************************************************************************
+* Function Name  : gmsp_transport_init
+* Description    : Initialize SPI1 as slave (CPOL=0, CPHA=0, 8-bit, MSB first)
+*                  and start DMA LLI Ping-Pong dual-buffer receive.
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_transport_init(void);
+
+/*******************************************************************************
+* Function Name  : gmsp_recv_ready
+* Description    : Check if a new DMA receive block has completed (non-blocking).
+* Input          : None
+* Output         : None
+* Return         : 1 if data ready, 0 otherwise
+******************************************************************************/
+UINT8 gmsp_recv_ready(void);
+
+/*******************************************************************************
+* Function Name  : gmsp_get_rx_buf
+* Description    : Get pointer to the most recently completed receive buffer
+*                  and its length.
+* Input          : out_len - pointer to receive the data length (may be NULL)
+* Output         : *out_len = GMSP_BUF_SIZE
+* Return         : Pointer to the completed buffer (buf_A or buf_B)
+******************************************************************************/
+UINT8 *gmsp_get_rx_buf(UINT16 *out_len);
+
+/*******************************************************************************
+* Function Name  : gmsp_send_response
+* Description    : Send response data back to host via SPI1.
+*                  Short responses (<=8 bytes) use SPI register write loop.
+*                  Long responses use blocking DMA transfer.
+* Input          : resp - pointer to response data
+*                  len  - response length in bytes
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_send_response(const UINT8 *resp, UINT16 len);
+
+/*******************************************************************************
+* Function Name  : gmsp_transport_rearm
+* Description    : Reset DMA receive for next frame after processing.
+*                  Stops TX DMA, restarts LLI Ping-Pong receive, clears flag.
+* Input          : None
+* Output         : None
+* Return         : None
+******************************************************************************/
+void gmsp_transport_rearm(void);
+
+#endif /* GMSP_SPI_SLAVE_H_ */