patina_boot: Benchmark execute end to end

[kat-perez]

Design status

Draft; do not merge as the final upstream design. OpenDevicePartnership/patina#1743 removes StandardBootServices from the Patina component model and introduces granular, mockable UEFI service traits. This PR is retained as a validated v22 benchmark spike. #202 tracks migrating patina_boot to the new service model and replacing the full boot-service table with generated service mocks.

Runtime-variable services are not part of Patina #1743 yet, so the migration must keep that boundary explicit rather than assuming all standard-service access has been replaced.

Summary

• add centralized mock UEFI boot/runtime service tables for host benchmarking
• benchmark the complete SimpleBootManager::execute() path
• assert the expected exhausted-options terminal state so failures cannot become benchmark results

Evidence

• cargo bench --bench orchestrator --no-run succeeds with the crate's pinned nightly toolchain
• the benchmark covers controller connection, BDS phase signals, console and boot-option discovery, and boot attempts

Mock table maintenance

SimpleBootManager::execute() accepts concrete standard-service wrappers, so the mock factory must populate every typed UEFI table slot. Only exercised slots implement behavior; all others return UNSUPPORTED. The table is centralized in one module, and r-efi table-shape changes fail compilation at that boundary.

[Copilot]

Pull request overview

Adds host-side Criterion benchmarks for patina_boot, including a new end-to-end benchmark intended to exercise SimpleBootManager::execute() without requiring real firmware by providing fake UEFI Boot/Runtime service tables.

Changes:

• Introduces fake r_efi::efi::BootServices / RuntimeServices tables with stubbed function pointers for host benchmarking.
• Extends the orchestrator bench suite with additional topology benchmarks and a new end-to-end execute_e2e benchmark.
• Adds a terminal-state assertion in the e2e bench to avoid silently benchmarking an unexpected success path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
uefi/crates/patina_boot/benches/support/fake_tables.rs	Adds fake UEFI Boot/Runtime services tables for running orchestrator logic on host.
uefi/crates/patina_boot/benches/orchestrator.rs	Adds new benchmarks (connect_all / expand_device_path topology) and an end-to-end execute_e2e benchmark using the fake tables.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

uefi/crates/patina_boot/benches/support/mock_tables.rs:399

• bs_create_event_ex has the same issue as bs_create_event: it writes through _a5 without checking for null, but the comment implies the write is null-checked. Adding a null check prevents UB if a caller passes a null out-pointer.

    // Hand back a dangling non-null event token.
    // SAFETY: out-pointers come from the wrapped table caller per the UEFI
    // contract; writes are null-checked or spec-required single writes.
    unsafe {
        *_a5 = 0x1000 as efi::Event;

uefi/crates/patina_boot/benches/orchestrator.rs:245

• The doc comment still references support/fake_tables.rs, but the benchmark now uses support/mock_tables.rs (via #[path = "support/mock_tables.rs"]). Updating the reference avoids confusion when someone tries to find the table implementation.

/// True end-to-end bench of `BootOrchestrator::execute()` against fake
/// firmware tables: `StandardBootServices`/`StandardRuntimeServices` wrap
/// stub `efi::BootServices`/`efi::RuntimeServices` tables (see
/// `support/fake_tables.rs`), and dispatch is a no-op mock. The canned
/// behavior presents no handles, no variables, and no loadable images, so

uefi/crates/patina_boot/benches/support/mock_tables.rs:97

• bs_create_event unconditionally writes through _a4 but the safety comment claims the write is null-checked. If a caller ever passes a null out-pointer, this is immediate UB. Either add a null check and return INVALID_PARAMETER, or adjust the safety comment to match reality.

This issue also appears on line 395 of the same file.

    // Hand back a dangling non-null event token.
    // SAFETY: out-pointers come from the wrapped table caller per the UEFI
    // contract; writes are null-checked or spec-required single writes.
    unsafe {
        *_a4 = 0x1000 as efi::Event;

uefi/crates/patina_boot/benches/support/mock_tables.rs:385

• bs_copy_mem and bs_set_mem are currently no-ops. If any benchmark path (or future extension) relies on these boot services, the behavior will silently diverge from UEFI semantics and can produce misleading benchmark behavior. These are easy to implement correctly with copy_nonoverlapping / write_bytes.

unsafe extern "efiapi" fn bs_copy_mem(_a0: *mut core::ffi::c_void, _a1: *mut core::ffi::c_void, _a2: usize) {
    // no-op
}

unsafe extern "efiapi" fn bs_set_mem(_a0: *mut core::ffi::c_void, _a1: usize, _a2: u8) {
    // no-op
}