DF-4906 — READ_PENDING_WAIT spins forever on a stuck FID/VID "change pending" bit

File: sys/dev/powermng/powernow/powernow.c:84-87 (used at 263, 275, 293, 299, 306) Severity: Low · Bucket: base:dev · Confidence: certain (code) / speculative (trigger)

Root cause

#define READ_PENDING_WAIT(status)                               \
        do {                                                    \
                (status) = rdmsr(MSR_AMDK7_FIDVID_STATUS);      \
        } while (PN8_STA_PENDING(status))                       /* powernow.c:84-87 */

Every step of the fid/vid transition in k8_powernow_setperf() ends in this unbounded do/while. If the CPU's FID/VID status "change pending" bit (MSR 0xc0010042 bit 31) never clears — stuck due to silicon erratum, a wedged PLL, or incomplete VM MSR emulation — the calling thread spins at full tilt forever in kernel context; nothing preempts a rdmsr-test loop that never sleeps and never checks signals.

The driver's own comment (powernow.c:235-238) acknowledges the hazard — "need to ensure that the change pending bit isn't stuck" — and then proceeds to use the unbounded macro at all five wait points (powernow.c:263, 275, 293, 299, 306). Linux's powernow-k8 equivalent checks the pending bit once and returns -EIO instead of spinning.

Consequences: one CPU pegged at 100% in kernel; the sysctl write thread is unkillable (never reaches a sleep/checkpoint); on the module-load path (powernow_init:392 → setperf) the boot kldload wedges. Local DoS only; requires root-triggered frequency change or the module-load path, plus a misbehaving CPU/firmware.

Verification status

untested — requires AMD K8 hardware with a stuck pending bit; the audit guest is Intel/QEMU and the module's CPUID gate refuses (MOD_LOAD error 2, env.txt).

Recommended fix

Bound the wait (e.g. loop with a deadline; on timeout abort the transition with an error) — see fix.diff.

DF-4906 — VERDICT

status: untested · reproduced: 0 · impact: dos (unkillable kernel spin) · confidence: speculative (code certain)

Narrative

All five wait points in the fid/vid transition sequence end with the READ_PENDING_WAIT macro (powernow.c:84-87) — an unbounded do { rdmsr; } while (pending) loop. Nothing in the loop sleeps, checks signals, or times out; a FID/VID status register whose change-pending bit (bit 31) never clears therefore spins the calling thread at 100% in kernel context forever:

• sysctl-write path (machdep.powernow.frequency.target, powernow.c:323-335): unkillable thread, one CPU lost;
• module-load path (powernow_init:392 → setperf): kldload wedges.

The developer comment at powernow.c:235-238 explicitly flags the stuck pending bit as a case to guard, but the macro provides no guard. The upstream Linux powernow-k8 driver checks the pending bit once and propagates -EIO.

Verification

Not runtime-testable: needs an AMD K8 whose pending bit sticks (silicon erratum / hostile VM MSR emulation). The Intel/QEMU audit guest refuses the module at the CPUID gate (MOD_LOAD error 2, env.txt) before any MSR access. Analysis pack only.

Fix

fix.diff: bounded loop (1e6 iterations, DELAY(1) between polls). Applies cleanly. Callers already tolerate the macro not forcing an error return; a full fix should also abort the transition on timeout.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.