Wrapper for volatile fields

[tgross35]

In C, fields can be defined as volatile whereas for Rust it is the accesses. I'm wondering if we should consider wrapping any volatile members in some UnsafeCell-based wrapper to ensure they aren't read by accident.

Unfortunately this is a bit tricky since we can't allow it to be moved by the compiler.

[tgross35]

I'm thinking maybe we should provide a struct Volatile<T>(UnsafeCell<T>); wrapper type that at least makes it clear what these fields are, even if we can't actually enforce volatility.

[tgross35]

We don't have great options here, but I think we could improve things with two types:

struct UnsafeVolatile<T>(UnsafeCell<T>);

#[derive(Clone, Copy)]
struct VolatilePtr<T>(*mut T)

impl<T> VolatilePtr<T> {
    fn new(*mut T) -> Self;
    fn volatile_ptr(self) -> *mut T;
}

Anything with UnsafeVolatile gets a /// DANGER! DO NOT TAKE A REFERENCE TO THIS STRUCT OR HOLD BY VALUE message. Really this type is kind of useless, but it serves as a speed bump and documentation home for this rare pattern (I think just struct intrspin and struct qtime_entry on QNX).

VolatilePtr is pretty minimal API, forcing somebody to see the word "volatile" upon access and hopefully read/write it only using volatile. This is more applicable for structs like aiocb and some pthread types.

Any thoughts @RalfJung?

Some discussion was at #general > Wrapper for volatile

[RalfJung]

I think a proper API for dealing with volatile would be a VolatilePtr that also supports field projections and that has read and write methods that do volatile accesses (and refuses to hand out the raw pointer, or only via some dangerously-named method).

In lieu of that... I guess marking the field makes sense. The UnsafeCell doesn't really do anything; there should at least be comments acknowledging that as others may copy the pattern. The VolatilePtr type seems a bit dangerous, I can easily imagine someone doing ptr.volatile_ptr().read() thinking this will be a volatile read as they said "volatile".