[Bug]: System Table structures are not guaranteed to be externally visible.

[joschock]

Is there an existing issue for this?

• I have searched existing issues

Current Behavior

Under the present design point the system tables and config tables implementations do not use references when producing, consuming, or modifying system tables (the main system table, runtime services table, boot services table, and various configuration tables) without special care to ensure that no aliases inside or outside patina exists. Otherwise changes to those tables from within patina core are not guaranteed to be externally observable (i.e. the compiler can make assumptions about those accesses that might mean they don't actually get written to system memory), and changes to the system tables from outside patina (such as installation of new function pointers in the runtime services table by e.g. VariableServices) are not guaranteed to be observed by patina.

Empirically, this works at the moment, but it is essentially UB in the sense that it could not work under future compiler revisions or with changes in optimizations enabled etc.

This issue primarily involves reviewing and tightening up the accesses to the system table to ensure that external changes to the system table are observable to patina, and patina changes to the system table are observable to external drivers.

Expected Behavior

External driver should observe all changes that are made to externally observable structures, and all changes made by external drivers to externally observable structures should be observed by Patina. Present code does not guarantee this, although it works in practice.

Steps To Reproduce

By inspection.

Build Environment

N/A

Version Information

Commit: c28a32ab2435e58eb6b332bfbab03a476396910f

Urgency

Medium

Are you going to fix this?

I will fix it

Do you need maintainer feedback?

No maintainer feedback needed

Anything else?

No response

[joschock]

Related to #1200

[joschock]

After further reading, volatile is not necessarily required. I will edit the text of the issue to reflect that. The main concern here is that the rust compiler doesn't elide reads to the system tables that may have been changed outside of patina or elide writes that might be observed outside patina.

Another way to say this is that I think it is unsafe to have any references (shared or mutable) to any of the system tables while there is any possibility of code inside or outside Patina accessing the tables. It is safe to have references that only exist in context where it can be guaranteed that no outside code is going to modify the table.