[PATCH 4/5] gpu: nova-core: use pointer projection for command queue code

[Gary Guo]

From: Alexandre Courbot <acourbot@xxxxxxxxxx>

This has been previously attempted but missing compiler optimisations for
older LLVM versions cause build errors. With the panicking index projection
variant implemented, replace the manual pointer arithmetic with projection.

Signed-off-by: Alexandre Courbot <acourbot@xxxxxxxxxx>
Co-developed-by: Gary Guo <gary@xxxxxxxxxxx>
Signed-off-by: Gary Guo <gary@xxxxxxxxxxx>
---
 drivers/gpu/nova-core/gsp/cmdq.rs | 106 +++++++++++++++++++++-----------------
 1 file changed, 60 insertions(+), 46 deletions(-)

diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs b/drivers/gpu/nova-core/gsp/cmdq.rs
index 1c9b2085f5e4..0b51e10e2cfc 100644
--- a/drivers/gpu/nova-core/gsp/cmdq.rs
+++ b/drivers/gpu/nova-core/gsp/cmdq.rs
@@ -256,47 +256,60 @@ fn new(dev: &device::Device<device::Bound>) -> Result<Self> {
     /// As the message queue is a circular buffer, the region may be discontiguous in memory. In
     /// that case the second slice will have a non-zero length.
     fn driver_write_area(&mut self) -> (&mut [[u8; GSP_PAGE_SIZE]], &mut [[u8; GSP_PAGE_SIZE]]) {
-        let tx = self.cpu_write_ptr();
-        let rx = self.gsp_read_ptr();
+        let tx = num::u32_as_usize(self.cpu_write_ptr());
+        let rx = num::u32_as_usize(self.gsp_read_ptr());
 
         // Pointer to the first entry of the CPU message queue.
-        let data = ptr::project!(mut self.0.as_mut_ptr(), .cpuq.msgq.data[build: 0]);
+        let data = ptr::project!(mut self.0.as_mut_ptr(), .cpuq.msgq.data);
 
-        let (tail_end, wrap_end) = if rx == 0 {
+        let (tail_slice, wrap_slice) = if rx == 0 {
             // The write area is non-wrapping, and stops at the second-to-last entry of the command
             // queue (to leave the last one empty).
-            (MSGQ_NUM_PAGES - 1, 0)
-        } else if rx <= tx {
-            // The write area wraps and continues until `rx - 1`.
-            (MSGQ_NUM_PAGES, rx - 1)
+            // PANIC: per the invariant of `cpu_write_ptr`, `tx` is `< MSGQ_NUM_PAGES`.
+            (
+                ptr::project!(mut data, [panic: tx..num::u32_as_usize(MSGQ_NUM_PAGES) - 1]),
+                ptr::project!(mut data, [build: ..0]),
+            )
         } else {
-            // The write area doesn't wrap and stops at `rx - 1`.
-            (rx - 1, 0)
+            // Leave an empty slot before `rx`.
+            let end = rx - 1;
+
+            if rx <= tx {
+                // The area is discontiguous and we leave an empty slot before `rx`.
+                // The write area wraps and continues until `end`.
+                // PANIC:
+                // - per the invariant of `cpu_write_ptr`, `tx < MSGQ_NUM_PAGES`
+                // - The index `end` is non-negative because `rx != 0` in this branch.
+                (
+                    ptr::project!(mut data, [panic: tx..]),
+                    ptr::project!(mut data, [panic: ..end]),
+                )
+            } else {
+                // The write area doesn't wrap and stops at `end`.
+                // PANIC:
+                // - per the invariant of `cpu_write_ptr`, `tx < MSGQ_NUM_PAGES`
+                // - `end >= tx` because `rx > tx` in this branch.
+                (
+                    ptr::project!(mut data, [panic: tx..end]),
+                    ptr::project!(mut data, [build: ..0]),
+                )
+            }
         };
 
         // SAFETY:
-        // - `data` was created from a valid pointer, and `rx` and `tx` are in the
-        //   `0..MSGQ_NUM_PAGES` range per the invariants of `cpu_write_ptr` and `gsp_read_ptr`,
-        //   thus the created slices are valid.
+        // - Since `data` was created from a valid pointer, both `tail_slice` and `wrap_slice` are
+        //   pointers to valid arrays.
         // - The area starting at `tx` and ending at `rx - 2` modulo `MSGQ_NUM_PAGES`,
         //   inclusive, belongs to the driver for writing and is not accessed concurrently by
         //   the GSP.
         // - The caller holds a reference to `self` for as long as the returned slices are live,
         //   meaning the CPU write pointer cannot be advanced and thus that the returned area
         //   remains exclusive to the CPU for the duration of the slices.
-        // - The created slices point to non-overlapping sub-ranges of `data` in all
-        //   branches (in the `rx <= tx` case, the second slice ends at `rx - 1` which is strictly
-        //   less than `tx` where the first slice starts; in the other cases the second slice is
-        //   empty), so creating two `&mut` references from them does not violate aliasing rules.
-        unsafe {
-            (
-                core::slice::from_raw_parts_mut(
-                    data.add(num::u32_as_usize(tx)),
-                    num::u32_as_usize(tail_end - tx),
-                ),
-                core::slice::from_raw_parts_mut(data, num::u32_as_usize(wrap_end)),
-            )
-        }
+        // - `tail_slice` and `wrap_slice` point to non-overlapping sub-ranges of `data` in all
+        //   branches (in the `rx <= tx` case, `wrap_slice` ends at `rx - 1` which is strictly less
+        //   than `tx` where `tail_slice` starts; in the other cases `wrap_slice` is empty), so
+        //   creating two `&mut` references from them does not violate aliasing rules.
+        (unsafe { &mut *tail_slice }, unsafe { &mut *wrap_slice })
     }
 
     /// Returns the size of the region of the CPU message queue that the driver is currently allowed
@@ -318,39 +331,40 @@ fn driver_write_area_size(&self) -> usize {
     /// As the message queue is a circular buffer, the region may be discontiguous in memory. In
     /// that case the second slice will have a non-zero length.
     fn driver_read_area(&self) -> (&[[u8; GSP_PAGE_SIZE]], &[[u8; GSP_PAGE_SIZE]]) {
-        let tx = self.gsp_write_ptr();
-        let rx = self.cpu_read_ptr();
+        let tx = num::u32_as_usize(self.gsp_write_ptr());
+        let rx = num::u32_as_usize(self.cpu_read_ptr());
 
         // Pointer to the first entry of the GSP message queue.
-        let data = ptr::project!(self.0.as_ptr(), .gspq.msgq.data[build: 0]);
+        let data = ptr::project!(self.0.as_ptr(), .gspq.msgq.data);
 
-        let (tail_end, wrap_end) = if rx <= tx {
-            // Read area is non-wrapping and stops right before `tx`.
-            (tx, 0)
+        let (tail_slice, wrap_slice) = if rx <= tx {
+            // PANIC:
+            // - per branch condition, `rx <= tx`
+            // - per the invariant of `gsp_write_ptr`, `tx < MSGQ_NUM_PAGES`
+            (
+                ptr::project!(data, [panic: rx..tx]),
+                ptr::project!(data, [build: ..0]),
+            )
         } else {
-            // Read area is wrapping and stops right before `tx`.
-            (MSGQ_NUM_PAGES, tx)
+            // PANIC:
+            // - per the invariant of `cpu_read_ptr`, `rx < MSGQ_NUM_PAGES`
+            // - per the invariant of `gsp_write_ptr`, `tx < MSGQ_NUM_PAGES`
+            (
+                ptr::project!(data, [panic: rx..]),
+                ptr::project!(data, [panic: ..tx]),
+            )
         };
 
         // SAFETY:
-        // - `data` was created from a valid pointer, and `rx` and `tx` are in the
-        //   `0..MSGQ_NUM_PAGES` range per the invariants of `gsp_write_ptr` and `cpu_read_ptr`,
-        //   thus the created slices are valid.
+        // - Since `data` was created from a valid pointer, both `tail_slice` and `wrap_slice` are
+        //   pointers to valid arrays.
         // - The area starting at `rx` and ending at `tx - 1` modulo `MSGQ_NUM_PAGES`,
         //   inclusive, belongs to the driver for reading and is not accessed concurrently by
         //   the GSP.
         // - The caller holds a reference to `self` for as long as the returned slices are live,
         //   meaning the CPU read pointer cannot be advanced and thus that the returned area
         //   remains exclusive to the CPU for the duration of the slices.
-        unsafe {
-            (
-                core::slice::from_raw_parts(
-                    data.add(num::u32_as_usize(rx)),
-                    num::u32_as_usize(tail_end - rx),
-                ),
-                core::slice::from_raw_parts(data, num::u32_as_usize(wrap_end)),
-            )
-        }
+        (unsafe { &*tail_slice }, unsafe { &*wrap_slice })
     }
 
     /// Allocates a region on the command queue that is large enough to send a command of `size`

-- 
2.51.2