OvmfPkg: Clarify invariants for NestedInterruptTplLib

NestedInterruptTplLib relies on CPU interrupts being disabled to
guarantee exclusive (and hence atomic) access to the shared state in
IsrState.  Nothing in the calling interrupt handler should have
re-enabled interrupts before calling NestedInterruptRestoreTPL(), and
the loop in NestedInterruptRestoreTPL() itself maintains the invariant
that interrupts are disabled at the start of each iteration.

Add assertions to clarify this invariant, and expand the comments
around the calls to RestoreTPL() and DisableInterrupts() to clarify
the expectations around enabling and disabling interrupts.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
Acked-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c b/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c
index e19d98878eb75a270405f23468bb2576fe1d1642..e921a09c559948bccd285f4115389bf93c45e38c 100644 (file)
--- a/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c
+++ b/OvmfPkg/Library/NestedInterruptTplLib/Tpl.c
@@ -104,6 +104,7 @@ NestedInterruptRestoreTPL (
   // defer our call to RestoreTPL() to the in-progress outer instance\r
   // of the same interrupt handler.\r
   //\r
+  ASSERT (GetInterruptState () == FALSE);\r
   if (InterruptedTPL == IsrState->InProgressRestoreTPL) {\r
     //\r
     // Trigger outer instance of this interrupt handler to perform the\r
@@ -153,6 +154,7 @@ NestedInterruptRestoreTPL (
     //\r
     // Check shared state loop invariants.\r
     //\r
+    ASSERT (GetInterruptState () == FALSE);\r
     ASSERT (IsrState->InProgressRestoreTPL < InterruptedTPL);\r
     ASSERT (IsrState->DeferredRestoreTPL == FALSE);\r
 \r
@@ -167,13 +169,17 @@ NestedInterruptRestoreTPL (
 \r
     //\r
     // Call RestoreTPL() to allow event notifications to be\r
-    // dispatched.  This will implicitly re-enable interrupts.\r
+    // dispatched.  This will implicitly re-enable interrupts (if\r
+    // InterruptedTPL is below TPL_HIGH_LEVEL), even though we are\r
+    // still inside the interrupt handler.\r
     //\r
     gBS->RestoreTPL (InterruptedTPL);\r
 \r
     //\r
     // Re-disable interrupts after the call to RestoreTPL() to ensure\r
-    // that we have exclusive access to the shared state.\r
+    // that we have exclusive access to the shared state.  Interrupts\r
+    // will be re-enabled by the IRET or equivalent instruction when\r
+    // we subsequently return from the interrupt handler.\r
     //\r
     DisableInterrupts ();\r
 \r