Re: [PATCH] target/i386: tdx: fix locking for interrupt injection

[Xiaoyao Li]

On 7/17/2025 6:39 PM, Paolo Bonzini wrote:

Take tdx_guest->lock when injecting the event notification interrupt into
the guest.

Fixes CID 1612364.

Reported-by: Peter Maydell <peter.mayd...@linaro.org>
Cc: Xiaoyao Li <xiaoyao...@intel.com>
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>

Reviewed-by: Xiaoyao Li <xiaoyao...@intel.com>

---
  target/i386/kvm/tdx.c | 10 +++++++---
  1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 7d69d6d7b06..7dcf2f75026 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1126,10 +1126,15 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
      return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
  }

-static void tdx_inject_interrupt(uint32_t apicid, uint32_t vector)

+static void tdx_inject_interrupt(TdxGuest *tdx_guest)
  {
      int ret;
+    uint32_t apicid, vector;

+ qemu_mutex_lock(&tdx_guest->lock);

+    vector = tdx_guest->event_notify_vector;
+    apicid = tdx_guest->event_notify_apicid;
+    qemu_mutex_unlock(&tdx_guest->lock);
      if (vector < 32 || vector > 255) {
          return;
      }
@@ -1179,8 +1184,7 @@ static void tdx_get_quote_completion(TdxGenerateQuoteTask 
*task)
          error_report("TDX: get-quote: failed to update GetQuote header.");
      }

- tdx_inject_interrupt(tdx_guest->event_notify_apicid,

-                         tdx_guest->event_notify_vector);
+    tdx_inject_interrupt(tdx);

g_free(task->send_data);

      g_free(task->receive_buf);