DF-5620 — rejected _CST MWAIT descriptors still mutate the global C3

preamble (cpu_mwait_cx_no_bmsts/bmarb on the error path)

Root cause

acpi_cst_cx_mwait_setup() (sys/platform/pc64/acpica/acpi_cstate_machdep.c) jumps to its done: block on the invalid-mwait-hint rejection path (:161-165) and the done: block unconditionally executes the descriptor's global side effects:

    if (!cpu_mwait_hint_valid(eax_hint)) {
        kprintf("C%d: invalid mwait hint 0x%08x\n", ...);
        error = EINVAL;
        goto done;                    /* <-- side effects still run */
    }
    ...
done:
    if ((cx->gas.AccessWidth & ACPI_GAS_INTEL_ARG1_BM_STS) == 0 && ...) {
        cpu_mwait_cx_no_bmsts();     /* clears cpu_mwait_c3_preamble BM_STS */
        ...
    }
    if (cx->type < ACPI_STATE_C3 && MWAIT_EAX_TO_CX(eax_hint) >= 3) {
        cpu_mwait_cx_no_bmsts();     /* again */
        cpu_mwait_cx_no_bmarb();     /* clears BM_ARB  (deep-mapping) */
    }

cpu_mwait_c3_preamble governs the C3 entry discipline of the machine-dependent MWAIT idle loop on every CPU (sys/platform/pc64/x86_64/machdep.c:3400-3409). A descriptor the kernel itself rejected as invalid therefore globally disables the C3 BM_STS check and bus-master-arbitration avoidance. The EOPNOTSUPP paths (no MONITOR / no MWAIT extensions, :149-153) already return without side effects — only the hint-rejection path is inconsistent.

Live proof (differential, single variable = the _CST content)

Planted _CST = valid C1 + C2 FixedHW/native (Intel FFH encoding, BitOffset=2) with invalid mwait hint 0x99999971 (MWAIT_EAX_TO_CX(0x71) = 8 >= CPU_MWAIT_CX_MAX). QEMU 7.2 never advertises CPUID.05H.ECX.EXT, so the mwaitforce.ko helper substitutes only the missing CPUID advertisement (DF-5155 "honest gap" methodology, same as DF-5483's estforce.ko); every subsequent instruction is the stock driver.

Guest stays healthy in all three (the valid C1 is used: cx_supported: C1/1) — the rejected C2 never enters the idle table, yet on the stock kernel it rewired the global C3 preamble for the whole system.

Build

# module (guest): /tmp/mwf with KMOD= mwaitforce SRCS= mwaitforce.c
make SYSDIR=/usr/src/sys && cp mwaitforce.ko /boot/kernel/
echo mwaitforce_load=YES >> /boot/loader.conf
# blob: see DF-5619 pack (mkdsdt.py badhint + gen_cst.py -> cst_badhint.bin)

Run

vm.sh down
QEMU_EXTRA="-machine accel=tcg -cpu SandyBridge \
  -device loader,file=/tmp/opencode/cst_badhint.bin,addr=0x40000000,force-raw=on" vm.sh up 240
vm.sh run_root 'sysctl machdep.mwait.CX.c3_preamble; dmesg | grep -a "invalid mwait"'

Expected decisive evidence

• run.attack_sysctl.txt — c3_preamble: 0 + the "invalid mwait hint" rejection lines (state rejected) on the stock kernel.
• run.control_sysctl.txt — c3_preamble: 3 with the same module/CPU/boot.
• run.fixedkernel_badhint.txt — c3_preamble: 3, rejection lines unchanged, on the kernel rebuilt with fix.diff.

DF-5620 VERDICT

REPRODUCED (logic bug live-demonstrated with a differential control; fix validated by kernel rebuild).

What was run

The planted-ACPI rig (see DF-5619 pack) carrying _CST = valid C1 + a C2 FixedHardware/native descriptor (Intel FFH encoding, BitWidth=1 vendor, BitOffset=2 class, Address=0x99999971 = mwait hint arg0) whose hint is INVALID: MWAIT_EAX_TO_CX(0x99999971) = 8 >= CPU_MWAIT_CX_MAX. Because QEMU 7.2 never advertises CPUID.05H.ECX.EXT (leaf ECX = 0x2, INTBRK only, under both TCG and KVM) and also masks CPUID.01H:ECX.MON, the stock code would EOPNOTSUPP at acpi_cstate_machdep.c:149-153 before reaching the code under test. The mwaitforce.ko helper therefore ORs the missing advertisement bits into cpu_feature2/cpu_mwait_feature from a SYSINIT at SI_SUB_CONFIGURE/SI_ORDER_FIRST — after every CPU's identify_cpu() has written those globals (they are clobbered per-CPU at identcpu.c:645/649; a first attempt forcing at SI_SUB_DRIVERS was silently undone by the APs) and immediately before acpi0/cpu_cst probe. This is the same "substitute ONLY the missing CPUID advertisement" methodology as DF-5483's estforce.ko; everything after the substitution is the genuine stock driver. (cpu_mwait_cx_info[] subcnts remain zero because cpu_mwait_attach() bailed earlier — irrelevant here: the scenario IS the invalid-hint rejection; and the default idle hook stays the static "sti; hlt", so the late feature words cannot destabilize boot idle.)

Observations (exact)

1. control (C1-only _CST + mwaitforce): full boot, machdep.mwait.CX.c3_preamble: 3, zero mwait console lines.
2. attack (C1 + badhint C2 + mwaitforce): full boot, console shows C2 -> cpu specific C8 sub state 1 + C2: invalid mwait hint 0x99999971 for each CPU — the descriptor is REJECTED (cx_supported stays "C1/1") — but machdep.mwait.CX.c3_preamble: 0: the done: block ran cpu_mwait_cx_no_bmsts() twice (AccessWidth lacks the BM_STS bit; deep-mapping block) and cpu_mwait_cx_no_bmarb(), clearing BOTH the BM_STS and BM_ARB bits of the global C3 preamble that governs the machdep MWAIT idle loop's C3 entry discipline on every CPU. (run.attack_sysctl.txt)
3. fixed kernel (fix.diff: rejection returns EINVAL before any side effects): same attack blob, same module — rejection lines unchanged, c3_preamble: 3. Side effects gone. (run.fixedkernel_badhint.txt)

Impact ceiling

Firmware/AML-controlled degradation of C3 power-management discipline system-wide (on pre-Core2 MP Intel platforms, entering C3 without the BM_STS check / arbitration disable risks the cache-coherency hazards the PIIX4-era quirks in this very driver exist to work around). No memory corruption, no user-triggerable path; the demonstrated artifact is the global preamble corruption itself. Severity Low.

Fix validation

fix.diff rewrites the error path: invalid hint -> return EINVAL (no side effects); the BM fixups run only on the success path; behavior for valid descriptors unchanged. Applied (with DF-5619's fix) in the guest's /usr/src, kernel rebuilt -Werror-clean, rebooted: attack blob → c3_preamble: 3 (was 0), invalid mwait hint still printed (rejection semantics preserved), guest healthy. Baseline vs patched: the rejected descriptor no longer mutates global state. Fix validated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.