Support SMAP for amd64.

This should stop kernel panics on SMAP supported CPUs after r336876.

PR:		230460
MFH:		2018Q4

20 files changed, 1375 insertions, 39 deletions

diff --git a/emulators/virtualbox-ose-additions/Makefile b/emulators/virtualbox-ose-additions/Makefile
index 61bdcc0549ee..3ad94e1eefd2 100644
--- a/emulators/virtualbox-ose-additions/Makefile
+++ b/emulators/virtualbox-ose-additions/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	virtualbox-ose
 PORTVERSION=	5.2.20
+PORTREVISION=	1
 CATEGORIES=	emulators
 MASTER_SITES=	http://download.virtualbox.org/virtualbox/${PORTVERSION}/
 PKGNAMESUFFIX?=	-additions
diff --git a/emulators/virtualbox-ose-kmod/Makefile b/emulators/virtualbox-ose-kmod/Makefile
index 503cdda63d66..efb09ba46c5f 100644
--- a/emulators/virtualbox-ose-kmod/Makefile
+++ b/emulators/virtualbox-ose-kmod/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	virtualbox-ose
 PORTVERSION=	5.2.20
+PORTREVISION=	1
 CATEGORIES=	emulators
 MASTER_SITES=	http://download.virtualbox.org/virtualbox/${PORTVERSION}/
 PKGNAMESUFFIX=	-kmod
diff --git a/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-VBoxNetFlt-freebsd.c b/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-VBoxNetFlt-freebsd.c
index 3eba424141a3..4c0df373227c 100644
--- a/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-VBoxNetFlt-freebsd.c
+++ b/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-VBoxNetFlt-freebsd.c
@@ -1,11 +1,6 @@
-Add VLAN trunking support to vboxnetflt
-
-See:		http://lists.freebsd.org/pipermail/freebsd-emulation/2012-April/009698.html
-See:		http://lists.freebsd.org/pipermail/freebsd-emulation/2013-May/010605.html
-Submitted by:	Landon J Fuller <landonf at plausible.coop>
---- src/VBox/HostDrivers/VBoxNetFlt/freebsd/VBoxNetFlt-freebsd.c.orig	2016-01-19 19:18:38 UTC
+--- src/VBox/HostDrivers/VBoxNetFlt/freebsd/VBoxNetFlt-freebsd.c.orig	2018-10-15 14:30:58 UTC
 +++ src/VBox/HostDrivers/VBoxNetFlt/freebsd/VBoxNetFlt-freebsd.c
-@@ -51,6 +51,7 @@
+@@ -52,6 +52,7 @@
  #include <net/if_dl.h>
  #include <net/if_types.h>
  #include <net/ethernet.h>
@@ -13,7 +8,15 @@ Submitted by:	Landon J Fuller <landonf at plausible.coop>
  
  #include <netgraph/ng_message.h>
  #include <netgraph/netgraph.h>
-@@ -369,7 +370,11 @@ static int ng_vboxnetflt_rcvdata(hook_p 
+@@ -73,6 +74,7 @@
+ 
+ #define VBOXNETFLT_OS_SPECFIC 1
+ #include "../VBoxNetFltInternal.h"
++#include "freebsd/the-freebsd-kernel.h"
+ 
+ static int vboxnetflt_modevent(struct module *, int, void *);
+ static ng_constructor_t    ng_vboxnetflt_constructor;
+@@ -370,7 +372,11 @@ static int ng_vboxnetflt_rcvdata(hook_p hook, item_p i
          mtx_lock_spin(&pThis->u.s.inq.ifq_mtx);
          _IF_ENQUEUE(&pThis->u.s.inq, m);
          mtx_unlock_spin(&pThis->u.s.inq.ifq_mtx);
@@ -25,7 +28,7 @@ Submitted by:	Landon J Fuller <landonf at plausible.coop>
      }
      /*
       * Handle mbufs on the outgoing hook, frames going to the interface
-@@ -387,7 +392,11 @@ static int ng_vboxnetflt_rcvdata(hook_p 
+@@ -388,7 +394,11 @@ static int ng_vboxnetflt_rcvdata(hook_p hook, item_p i
          mtx_lock_spin(&pThis->u.s.outq.ifq_mtx);
          _IF_ENQUEUE(&pThis->u.s.outq, m);
          mtx_unlock_spin(&pThis->u.s.outq.ifq_mtx);
@@ -37,7 +40,7 @@ Submitted by:	Landon J Fuller <landonf at plausible.coop>
      }
      else
      {
-@@ -427,6 +436,8 @@ static void vboxNetFltFreeBSDinput(void 
+@@ -428,6 +438,8 @@ static void vboxNetFltFreeBSDinput(void *arg, int pend
      struct ifnet *ifp = pThis->u.s.ifp;
      unsigned int cSegs = 0;
      bool fDropIt = false, fActive;
@@ -46,7 +49,7 @@ Submitted by:	Landon J Fuller <landonf at plausible.coop>
      PINTNETSG pSG;
  
      VBOXCURVNET_SET(ifp->if_vnet);
-@@ -439,6 +450,19 @@ static void vboxNetFltFreeBSDinput(void 
+@@ -440,6 +452,19 @@ static void vboxNetFltFreeBSDinput(void *arg, int pend
          if (m == NULL)
              break;
  
@@ -66,7 +69,7 @@ Submitted by:	Landon J Fuller <landonf at plausible.coop>
          for (m0 = m; m0 != NULL; m0 = m0->m_next)
              if (m0->m_len > 0)
                  cSegs++;
-@@ -453,6 +477,27 @@ static void vboxNetFltFreeBSDinput(void 
+@@ -454,6 +479,27 @@ static void vboxNetFltFreeBSDinput(void *arg, int pend
          vboxNetFltFreeBSDMBufToSG(pThis, m, pSG, cSegs, 0);
          fDropIt = pThis->pSwitchPort->pfnRecv(pThis->pSwitchPort, NULL /* pvIf */, pSG, INTNETTRUNKDIR_WIRE);
          RTMemTmpFree(pSG);
@@ -94,3 +97,177 @@ Submitted by:	Landon J Fuller <landonf at plausible.coop>
          if (fDropIt)
              m_freem(m);
          else
+@@ -513,6 +559,7 @@ static void vboxNetFltFreeBSDoutput(void *arg, int pen
+  */
+ int vboxNetFltPortOsXmit(PVBOXNETFLTINS pThis, void *pvIfData, PINTNETSG pSG, uint32_t fDst)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     NOREF(pvIfData);
+ 
+     void (*input_f)(struct ifnet *, struct mbuf *);
+@@ -529,10 +576,16 @@ int vboxNetFltPortOsXmit(PVBOXNETFLTINS pThis, void *p
+     {
+         m = vboxNetFltFreeBSDSGMBufFromSG(pThis, pSG);
+         if (m == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VERR_NO_MEMORY;
++        }
+         m = m_pullup(m, ETHER_HDR_LEN);
+         if (m == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VERR_NO_MEMORY;
++        }
+ 
+         m->m_flags |= M_PKTHDR;
+         ether_output_frame(ifp, m);
+@@ -542,10 +595,16 @@ int vboxNetFltPortOsXmit(PVBOXNETFLTINS pThis, void *p
+     {
+         m = vboxNetFltFreeBSDSGMBufFromSG(pThis, pSG);
+         if (m == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VERR_NO_MEMORY;
++        }
+         m = m_pullup(m, ETHER_HDR_LEN);
+         if (m == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VERR_NO_MEMORY;
++        }
+         /*
+          * Delivering packets to the host will be captured by the
+          * input hook. Tag the packet with a mbuf tag so that we
+@@ -556,6 +615,7 @@ int vboxNetFltPortOsXmit(PVBOXNETFLTINS pThis, void *p
+         if (mtag == NULL)
+         {
+             m_freem(m);
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VERR_NO_MEMORY;
+         }
+ 
+@@ -566,6 +626,7 @@ int vboxNetFltPortOsXmit(PVBOXNETFLTINS pThis, void *p
+         ifp->if_input(ifp, m);
+     }
+     VBOXCURVNET_RESTORE();
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -578,6 +639,7 @@ static bool vboxNetFltFreeBsdIsPromiscuous(PVBOXNETFLT
+ 
+ int vboxNetFltOsInitInstance(PVBOXNETFLTINS pThis, void *pvContext)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     char nam[NG_NODESIZ];
+     struct ifnet *ifp;
+     node_p node;
+@@ -586,7 +648,10 @@ int vboxNetFltOsInitInstance(PVBOXNETFLTINS pThis, voi
+     NOREF(pvContext);
+     ifp = ifunit(pThis->szName);
+     if (ifp == NULL)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_INTNET_FLT_IF_NOT_FOUND;
++    }
+ 
+     /* Create a new netgraph node for this instance */
+     if (ng_make_node_common(&ng_vboxnetflt_typestruct, &node) != 0)
+@@ -630,12 +695,14 @@ int vboxNetFltOsInitInstance(PVBOXNETFLTINS pThis, voi
+         vboxNetFltRelease(pThis, true /*fBusy*/);
+     }
+     VBOXCURVNET_RESTORE();
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ 
+     return VINF_SUCCESS;
+ }
+ 
+ bool vboxNetFltOsMaybeRediscovered(PVBOXNETFLTINS pThis)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     struct ifnet *ifp, *ifp0;
+ 
+     ifp = ASMAtomicUoReadPtrT(&pThis->u.s.ifp, struct ifnet *);
+@@ -652,6 +719,7 @@ bool vboxNetFltOsMaybeRediscovered(PVBOXNETFLTINS pThi
+         pThis->u.s.node = NULL;
+     }
+     VBOXCURVNET_RESTORE();
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ 
+     if (ifp0 != NULL)
+     {
+@@ -664,6 +732,7 @@ bool vboxNetFltOsMaybeRediscovered(PVBOXNETFLTINS pThi
+ 
+ void vboxNetFltOsDeleteInstance(PVBOXNETFLTINS pThis)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     taskqueue_drain(taskqueue_fast, &pThis->u.s.tskin);
+     taskqueue_drain(taskqueue_fast, &pThis->u.s.tskout);
+@@ -676,6 +745,7 @@ void vboxNetFltOsDeleteInstance(PVBOXNETFLTINS pThis)
+         ng_rmnode_self(pThis->u.s.node);
+     VBOXCURVNET_RESTORE();
+     pThis->u.s.node = NULL;
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ }
+ 
+ int vboxNetFltOsPreInitInstance(PVBOXNETFLTINS pThis)
+@@ -689,6 +759,7 @@ int vboxNetFltOsPreInitInstance(PVBOXNETFLTINS pThis)
+ 
+ void vboxNetFltPortOsSetActive(PVBOXNETFLTINS pThis, bool fActive)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     struct ifnet *ifp;
+     struct ifreq ifreq;
+     int error;
+@@ -722,7 +793,10 @@ void vboxNetFltPortOsSetActive(PVBOXNETFLTINS pThis, b
+         NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_CONNECT,
+             sizeof(struct ngm_connect), M_NOWAIT);
+         if (msg == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return;
++        }
+         con = (struct ngm_connect *)msg->data;
+         snprintf(con->path, NG_PATHSIZ, "vboxnetflt_%s:", ifp->if_xname);
+         strlcpy(con->ourhook, "lower", NG_HOOKSIZ);
+@@ -736,7 +810,10 @@ void vboxNetFltPortOsSetActive(PVBOXNETFLTINS pThis, b
+         NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_CONNECT,
+             sizeof(struct ngm_connect), M_NOWAIT);
+         if (msg == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return;
++        }
+         con = (struct ngm_connect *)msg->data;
+         snprintf(con->path, NG_PATHSIZ, "vboxnetflt_%s:",
+             ifp->if_xname);
+@@ -759,7 +836,10 @@ void vboxNetFltPortOsSetActive(PVBOXNETFLTINS pThis, b
+         NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_RMHOOK,
+             sizeof(struct ngm_rmhook), M_NOWAIT);
+         if (msg == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return;
++        }
+         rm = (struct ngm_rmhook *)msg->data;
+         strlcpy(rm->ourhook, "input", NG_HOOKSIZ);
+         NG_SEND_MSG_PATH(error, node, msg, path, 0);
+@@ -770,12 +850,16 @@ void vboxNetFltPortOsSetActive(PVBOXNETFLTINS pThis, b
+         NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_RMHOOK,
+             sizeof(struct ngm_rmhook), M_NOWAIT);
+         if (msg == NULL)
++        {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return;
++        }
+         rm = (struct ngm_rmhook *)msg->data;
+         strlcpy(rm->ourhook, "output", NG_HOOKSIZ);
+         NG_SEND_MSG_PATH(error, node, msg, path, 0);
+     }
+     VBOXCURVNET_RESTORE();
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ }
+ 
+ int vboxNetFltOsDisconnectIt(PVBOXNETFLTINS pThis)
diff --git a/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-files_vboxnetflt b/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-files_vboxnetflt
new file mode 100644
index 000000000000..c6b681245e91
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src-VBox-HostDrivers-VBoxNetFlt-freebsd-files_vboxnetflt
@@ -0,0 +1,10 @@
+--- src/VBox/HostDrivers/VBoxNetFlt/freebsd/files_vboxnetflt.orig	2018-10-15 14:30:58 UTC
++++ src/VBox/HostDrivers/VBoxNetFlt/freebsd/files_vboxnetflt
+@@ -61,6 +61,7 @@ VBOX_VBOXNETFLT_SOURCES=" \
+     ${PATH_ROOT}/include/iprt/uni.h=>include/iprt/uni.h \
+     ${PATH_ROOT}/include/iprt/utf16.h=>include/iprt/utf16.h \
+     ${PATH_ROOT}/include/iprt/uuid.h=>include/iprt/uuid.h \
++    ${PATH_ROOT}/include/iprt/x86.h=>include/iprt/x86.h \
+     ${PATH_ROOT}/include/iprt/nocrt/limits.h=>include/iprt/nocrt/limits.h \
+     ${PATH_ROOT}/include/VBox/cdefs.h=>include/VBox/cdefs.h \
+     ${PATH_ROOT}/include/VBox/err.h=>include/VBox/err.h \
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_SUPDrv.cpp b/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_SUPDrv.cpp
new file mode 100644
index 000000000000..11c13584a97b
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_SUPDrv.cpp
@@ -0,0 +1,11 @@
+--- src/VBox/HostDrivers/Support/SUPDrv.cpp.orig	2018-10-15 14:30:56 UTC
++++ src/VBox/HostDrivers/Support/SUPDrv.cpp
+@@ -104,7 +104,7 @@
+ /** @def SUPDRV_CHECK_SMAP_CHECK
+  * Checks that the AC flag is set if SMAP is enabled.  If AC is not set, it
+  * will be logged and @a a_BadExpr is executed. */
+-#if defined(RT_OS_DARWIN) || defined(RT_OS_LINUX)
++#if defined(RT_OS_DARWIN) || defined(RT_OS_FREEBSD) || defined(RT_OS_LINUX)
+ # define SUPDRV_CHECK_SMAP_SETUP() uint32_t const fKernelFeatures = SUPR0GetKernelFeatures()
+ # define SUPDRV_CHECK_SMAP_CHECK(a_pDevExt, a_BadExpr) \
+     do { \
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_freebsd_SUPDrv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_freebsd_SUPDrv-freebsd.c
index dc7ab72498ce..178f5881c255 100644
--- a/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_freebsd_SUPDrv-freebsd.c
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_HostDrivers_Support_freebsd_SUPDrv-freebsd.c
@@ -1,6 +1,166 @@
---- src/VBox/HostDrivers/Support/freebsd/SUPDrv-freebsd.c.orig	2016-07-18 11:56:20 UTC
+--- src/VBox/HostDrivers/Support/freebsd/SUPDrv-freebsd.c.orig	2018-10-15 14:30:57 UTC
 +++ src/VBox/HostDrivers/Support/freebsd/SUPDrv-freebsd.c
-@@ -541,8 +541,7 @@ bool VBOXCALL  supdrvOSGetForcedAsyncTsc
+@@ -46,6 +46,7 @@
+ #include <sys/uio.h>
+ 
+ #include "../SUPDrvInternal.h"
++#include "freebsd/the-freebsd-kernel.h"
+ #include <VBox/version.h>
+ #include <iprt/initterm.h>
+ #include <iprt/string.h>
+@@ -57,7 +58,14 @@
+ #include <iprt/alloc.h>
+ #include <iprt/err.h>
+ #include <iprt/asm.h>
++#include <iprt/x86.h>
+ 
++#ifdef VBOX_WITH_EFLAGS_AC_SET_IN_VBOXDRV
++# include <machine/cpufunc.h>
++# include <machine/md_var.h>
++# include <machine/specialreg.h>
++#endif
++
+ #ifdef VBOX_WITH_HARDENING
+ # define VBOXDRV_PERM 0600
+ #else
+@@ -76,7 +84,9 @@ static d_open_t     VBoxDrvFreeBSDOpenUsr;
+ static d_open_t     VBoxDrvFreeBSDOpenSys;
+ static void         vboxdrvFreeBSDDtr(void *pvData);
+ static d_ioctl_t    VBoxDrvFreeBSDIOCtl;
++static d_ioctl_t    VBoxDrvFreeBSDIOCtlSMAP;
+ static int          VBoxDrvFreeBSDIOCtlSlow(PSUPDRVSESSION pSession, u_long ulCmd, caddr_t pvData, struct thread *pTd);
++static bool         VBoxDrvFreeBSDCpuHasSMAP(void);
+ 
+ 
+ /*********************************************************************************************************************************
+@@ -182,6 +192,13 @@ static int VBoxDrvFreeBSDLoad(void)
+         rc = supdrvInitDevExt(&g_VBoxDrvFreeBSDDevExt, sizeof(SUPDRVSESSION));
+         if (RT_SUCCESS(rc))
+         {
++            if (VBoxDrvFreeBSDCpuHasSMAP())
++            {
++                LogRel(("disabling SMAP for VBoxDrvFreeBSDIOCtl\n"));
++                g_VBoxDrvFreeBSDChrDevSwSys.d_ioctl = VBoxDrvFreeBSDIOCtlSMAP;
++                g_VBoxDrvFreeBSDChrDevSwUsr.d_ioctl = VBoxDrvFreeBSDIOCtlSMAP;
++            }
++
+             /*
+              * Configure character devices. Add symbolic links for compatibility.
+              */
+@@ -311,7 +328,21 @@ static int VBoxDrvFreeBSDIOCtl(struct cdev *pDev, u_lo
+     PSUPDRVSESSION pSession;
+     devfs_get_cdevpriv((void **)&pSession);
+ 
++#ifdef VBOX_WITH_EFLAGS_AC_SET_IN_VBOXDRV
+     /*
++     * Refuse all I/O control calls if we've ever detected EFLAGS.AC being cleared.
++     *
++     * This isn't a problem, as there is absolutely nothing in the kernel context that
++     * depend on user context triggering cleanups.  That would be pretty wild, right?
++     */
++    if (RT_UNLIKELY(g_VBoxDrvFreeBSDDevExt.cBadContextCalls > 0))
++    {
++        SUPR0Printf("VBoxDrvFreBSDIOCtl: EFLAGS.AC=0 detected %u times, refusing all I/O controls!\n", g_VBoxDrvFreeBSDDevExt.cBadContextCalls);
++        return ESPIPE;
++    }
++#endif
++
++    /*
+      * Deal with the fast ioctl path first.
+      */
+     if (   (   ulCmd == SUP_IOCTL_FAST_DO_RAW_RUN
+@@ -325,6 +356,45 @@ static int VBoxDrvFreeBSDIOCtl(struct cdev *pDev, u_lo
+ 
+ 
+ /**
++ * Alternative Device I/O Control entry point on hosts with SMAP support.
++ *
++ * @returns depends...
++ * @param   pDev        The device.
++ * @param   ulCmd       The command.
++ * @param   pvData      Pointer to the data.
++ * @param   fFile       The file descriptor flags.
++ * @param   pTd         The calling thread.
++ */
++static int VBoxDrvFreeBSDIOCtlSMAP(struct cdev *pDev, u_long ulCmd, caddr_t pvData, int fFile, struct thread *pTd)
++{
++    /*
++     * Allow VBox R0 code to touch R3 memory. Setting the AC bit disables the
++     * SMAP check.
++     */
++    RTCCUINTREG fSavedEfl = ASMAddFlags(X86_EFL_AC);
++
++    int rc = VBoxDrvFreeBSDIOCtl(pDev, ulCmd, pvData, fFile, pTd);
++
++#ifdef VBOX_WITH_EFLAGS_AC_SET_IN_VBOXDRV
++    /*
++     * Before we restore AC and the rest of EFLAGS, check if the IOCtl handler code
++     * accidentially modified it or some other important flag.
++     */
++    if (RT_UNLIKELY(   (ASMGetFlags() & (X86_EFL_AC | X86_EFL_IF | X86_EFL_DF | X86_EFL_IOPL))
++                    != ((fSavedEfl    & (X86_EFL_AC | X86_EFL_IF | X86_EFL_DF | X86_EFL_IOPL)) | X86_EFL_AC) ))
++    {
++        char szTmp[48];
++        RTStrPrintf(szTmp, sizeof(szTmp), "ulCmd=%#x: %#x->%#x!", ulCmd, (uint32_t)fSavedEfl, (uint32_t)ASMGetFlags());
++        supdrvBadContext(&g_VBoxDrvFreeBSDDevExt, "SUPDrv-freebsd.c",  __LINE__, szTmp);
++    }
++#endif
++
++    ASMSetFlags(fSavedEfl);
++    return rc;
++}
++
++
++/**
+  * Deal with the 'slow' I/O control requests.
+  *
+  * @returns 0 on success, appropriate errno on failure.
+@@ -373,11 +443,10 @@ static int VBoxDrvFreeBSDIOCtlSlow(PSUPDRVSESSION pSes
+          */
+         SUPREQHDR Hdr;
+         pvUser = *(void **)pvData;
+-        int rc = copyin(pvUser, &Hdr, sizeof(Hdr));
+-        if (RT_UNLIKELY(rc))
++        if (RT_FAILURE(RTR0MemUserCopyFrom(&Hdr, pvUser, sizeof(Hdr))))
+         {
+-            OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: copyin(%p,Hdr,) -> %#x; ulCmd=%#lx\n", pvUser, rc, ulCmd));
+-            return rc;
++            OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: copyin(%p,Hdr,); ulCmd=%#lx\n", pvUser, ulCmd));
++            return EFAULT;
+         }
+         if (RT_UNLIKELY((Hdr.fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC))
+         {
+@@ -402,13 +471,12 @@ static int VBoxDrvFreeBSDIOCtlSlow(PSUPDRVSESSION pSes
+             OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: failed to allocate buffer of %d bytes; ulCmd=%#lx\n", cbReq, ulCmd));
+             return ENOMEM;
+         }
+-        rc = copyin(pvUser, pHdr, Hdr.cbIn);
+-        if (RT_UNLIKELY(rc))
++        if (RT_FAILURE(RTR0MemUserCopyFrom(pHdr, pvUser, Hdr.cbIn)))
+         {
+-            OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: copyin(%p,%p,%#x) -> %#x; ulCmd=%#lx\n",
+-                        pvUser, pHdr, Hdr.cbIn, rc, ulCmd));
++            OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: copyin(%p,%p,%#x); ulCmd=%#lx\n",
++                        pvUser, pHdr, Hdr.cbIn, ulCmd));
+             RTMemTmpFree(pHdr);
+-            return rc;
++            return EFAULT;
+         }
+         if (Hdr.cbIn < cbReq)
+             RT_BZERO((uint8_t *)pHdr + Hdr.cbIn, cbReq - Hdr.cbIn);
+@@ -436,9 +504,8 @@ static int VBoxDrvFreeBSDIOCtlSlow(PSUPDRVSESSION pSes
+                 OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: too much output! %#x > %#x; uCmd=%#lx!\n", cbOut, cbReq, ulCmd));
+                 cbOut = cbReq;
+             }
+-            rc = copyout(pHdr, pvUser, cbOut);
+-            if (RT_UNLIKELY(rc))
+-                OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: copyout(%p,%p,%#x) -> %d; uCmd=%#lx!\n", pHdr, pvUser, cbOut, rc, ulCmd));
++            if (RT_FAILURE(RTR0MemUserCopyTo(pvUser, pHdr, cbOut)))
++                OSDBGPRINT(("VBoxDrvFreeBSDIOCtlSlow: copyout(%p,%p,%#x); uCmd=%#lx!\n", pHdr, pvUser, cbOut, ulCmd));
+ 
+             Log(("VBoxDrvFreeBSDIOCtlSlow: returns %d / %d ulCmd=%lx\n", 0, pHdr->rc, ulCmd));
+ 
+@@ -541,8 +608,7 @@ bool VBOXCALL  supdrvOSGetForcedAsyncTscMode(PSUPDRVDE
  
  bool VBOXCALL  supdrvOSAreCpusOfflinedOnSuspend(void)
  {
@@ -10,3 +170,51 @@
  }
  
  
+@@ -616,11 +682,25 @@ int VBOXCALL    supdrvOSMsrProberModify(RTCPUID idCpu,
+ #endif /* SUPDRV_WITH_MSR_PROBER */
+ 
+ 
++/**
++ * Check if the CPU has SMAP support.
++ */
++static bool VBoxDrvFreeBSDCpuHasSMAP(void)
++{
++#ifdef VBOX_WITH_EFLAGS_AC_SET_IN_VBOXDRV
++    if ((cpu_stdext_feature & CPUID_STDEXT_SMAP) != 0)
++        return true;
++#endif
++    return false;
++}
++
++
+ SUPR0DECL(int) SUPR0Printf(const char *pszFormat, ...)
+ {
+     va_list va;
+     char szMsg[256];
+     int cch;
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     va_start(va, pszFormat);
+     cch = RTStrPrintfV(szMsg, sizeof(szMsg), pszFormat, va);
+@@ -628,12 +708,19 @@ SUPR0DECL(int) SUPR0Printf(const char *pszFormat, ...)
+ 
+     printf("%s", szMsg);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return cch;
+ }
+ 
+ 
+ SUPR0DECL(uint32_t) SUPR0GetKernelFeatures(void)
+ {
+-    return 0;
++    uint32_t fFlags = 0;
++#ifdef VBOX_WITH_EFLAGS_AC_SET_IN_VBOXDRV
++    if (g_VBoxDrvFreeBSDChrDevSwSys.d_ioctl == VBoxDrvFreeBSDIOCtlSMAP)
++        fFlags |= SUPKERNELFEATURES_SMAP;
++    else
++        Assert(!(ASMGetCR4() & X86_CR4_SMAP));
++#endif
++    return fFlags;
+ }
+-
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_alloc-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_alloc-r0drv-freebsd.c
new file mode 100644
index 000000000000..b82ec16c3ccc
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_alloc-r0drv-freebsd.c
@@ -0,0 +1,73 @@
+--- src/VBox/Runtime/r0drv/freebsd/alloc-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/alloc-r0drv-freebsd.c
+@@ -54,6 +54,7 @@ MALLOC_DEFINE(M_IPRTCONT, "iprtcont", "IPRT - contiguo
+ 
+ DECLHIDDEN(int) rtR0MemAllocEx(size_t cb, uint32_t fFlags, PRTMEMHDR *ppHdr)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     size_t      cbAllocated = cb;
+     PRTMEMHDR   pHdr        = NULL;
+ 
+@@ -76,8 +77,10 @@ DECLHIDDEN(int) rtR0MemAllocEx(size_t cb, uint32_t fFl
+         cbAllocated = RT_ALIGN_Z(cb + sizeof(*pHdr), PAGE_SIZE);
+ 
+         pVmObject = vm_object_allocate(OBJT_DEFAULT, cbAllocated >> PAGE_SHIFT);
+-        if (!pVmObject)
++        if (!pVmObject) {
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VERR_NO_EXEC_MEMORY;
++        }
+ 
+         /* Addr contains a start address vm_map_find will start searching for suitable space at. */
+ #if __FreeBSD_version >= 1000055
+@@ -114,6 +117,8 @@ DECLHIDDEN(int) rtR0MemAllocEx(size_t cb, uint32_t fFl
+                                  fFlags & RTMEMHDR_FLAG_ZEROED ? M_NOWAIT | M_ZERO : M_NOWAIT);
+     }
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
++
+     if (RT_UNLIKELY(!pHdr))
+         return VERR_NO_MEMORY;
+ 
+@@ -129,6 +134,8 @@ DECLHIDDEN(int) rtR0MemAllocEx(size_t cb, uint32_t fFl
+ 
+ DECLHIDDEN(void) rtR0MemFree(PRTMEMHDR pHdr)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     pHdr->u32Magic += 1;
+ 
+ #ifdef RT_ARCH_AMD64
+@@ -141,11 +148,14 @@ DECLHIDDEN(void) rtR0MemFree(PRTMEMHDR pHdr)
+     else
+ #endif
+         free(pHdr, M_IPRTHEAP);
++
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ }
+ 
+ 
+ RTR0DECL(void *) RTMemContAlloc(PRTCCPHYS pPhys, size_t cb)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     void *pv;
+ 
+     /*
+@@ -170,6 +180,7 @@ RTR0DECL(void *) RTMemContAlloc(PRTCCPHYS pPhys, size_
+         *pPhys = vtophys(pv);
+         Assert(!(*pPhys & PAGE_OFFSET_MASK));
+     }
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return pv;
+ }
+ 
+@@ -179,7 +190,9 @@ RTR0DECL(void) RTMemContFree(void *pv, size_t cb)
+     if (pv)
+     {
+         AssertMsg(!((uintptr_t)pv & PAGE_OFFSET_MASK), ("pv=%p\n", pv));
++        IPRT_FREEBSD_SAVE_EFL_AC();
+         contigfree(pv, cb, M_IPRTCONT);
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+     }
+ }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_assert-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_assert-r0drv-freebsd.c
new file mode 100644
index 000000000000..4ad72bc7dd59
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_assert-r0drv-freebsd.c
@@ -0,0 +1,29 @@
+--- src/VBox/Runtime/r0drv/freebsd/assert-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/assert-r0drv-freebsd.c
+@@ -44,15 +44,18 @@
+ 
+ DECLHIDDEN(void) rtR0AssertNativeMsg1(const char *pszExpr, unsigned uLine, const char *pszFile, const char *pszFunction)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     printf("\r\n!!Assertion Failed!!\r\n"
+            "Expression: %s\r\n"
+            "Location  : %s(%d) %s\r\n",
+            pszExpr, pszFile, uLine, pszFunction);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ }
+ 
+ 
+ DECLHIDDEN(void) rtR0AssertNativeMsg2V(bool fInitial, const char *pszFormat, va_list va)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     char szMsg[256];
+ 
+     RTStrPrintfV(szMsg, sizeof(szMsg) - 1, pszFormat, va);
+@@ -60,6 +63,7 @@ DECLHIDDEN(void) rtR0AssertNativeMsg2V(bool fInitial, 
+     printf("%s", szMsg);
+ 
+     NOREF(fInitial);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ }
+ 
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memobj-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memobj-r0drv-freebsd.c
index 3e40689685d3..eebd0ee2e57d 100644
--- a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memobj-r0drv-freebsd.c
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memobj-r0drv-freebsd.c
@@ -1,16 +1,24 @@
---- src/VBox/Runtime/r0drv/freebsd/memobj-r0drv-freebsd.c.orig	2017-04-28 15:04:48 UTC
+--- src/VBox/Runtime/r0drv/freebsd/memobj-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
 +++ src/VBox/Runtime/r0drv/freebsd/memobj-r0drv-freebsd.c
-@@ -121,16 +121,15 @@ DECLHIDDEN(int) rtR0MemObjNativeFree(RTR
+@@ -105,6 +105,7 @@ static vm_map_t rtR0MemObjFreeBSDGetMap(PRTR0MEMOBJINT
+ 
+ DECLHIDDEN(int) rtR0MemObjNativeFree(RTR0MEMOBJ pMem)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     PRTR0MEMOBJFREEBSD pMemFreeBSD = (PRTR0MEMOBJFREEBSD)pMem;
+     int rc;
+ 
+@@ -121,16 +122,15 @@ DECLHIDDEN(int) rtR0MemObjNativeFree(RTR0MEMOBJ pMem)
  
          case RTR0MEMOBJTYPE_LOCK:
          {
 -            vm_map_t pMap = kernel_map;
--
--            if (pMemFreeBSD->Core.u.Lock.R0Process != NIL_RTR0PROCESS)
--                pMap = &((struct proc *)pMemFreeBSD->Core.u.Lock.R0Process)->p_vmspace->vm_map;
 +            if (pMemFreeBSD->Core.u.Lock.R0Process != NIL_RTR0PROCESS) {
 +                vm_map_t pMap = &((struct proc *)pMemFreeBSD->Core.u.Lock.R0Process)->p_vmspace->vm_map;
  
+-            if (pMemFreeBSD->Core.u.Lock.R0Process != NIL_RTR0PROCESS)
+-                pMap = &((struct proc *)pMemFreeBSD->Core.u.Lock.R0Process)->p_vmspace->vm_map;
+-
 -            rc = vm_map_unwire(pMap,
 +                rc = vm_map_unwire(pMap,
                                 (vm_offset_t)pMemFreeBSD->Core.pv,
@@ -22,7 +30,15 @@
              break;
          }
  
-@@ -224,18 +223,23 @@ static vm_page_t rtR0MemObjFreeBSDContig
+@@ -194,6 +194,7 @@ DECLHIDDEN(int) rtR0MemObjNativeFree(RTR0MEMOBJ pMem)
+             return VERR_INTERNAL_ERROR;
+     }
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -224,18 +225,23 @@ static vm_page_t rtR0MemObjFreeBSDContigPhysAllocHelpe
  #else
          VM_OBJECT_UNLOCK(pObject);
  #endif
@@ -51,7 +67,7 @@
              break;
          vm_contig_grow_cache(cTries, 0, VmPhysAddrHigh);
          cTries++;
-@@ -243,11 +247,8 @@ static vm_page_t rtR0MemObjFreeBSDContig
+@@ -243,11 +249,8 @@ static vm_page_t rtR0MemObjFreeBSDContigPhysAllocHelpe
  
      if (!pPages)
          return pPages;
@@ -64,7 +80,7 @@
      for (vm_pindex_t iPage = 0; iPage < cPages; iPage++)
      {
          vm_page_t pPage = pPages + iPage;
-@@ -259,13 +260,9 @@ static vm_page_t rtR0MemObjFreeBSDContig
+@@ -259,13 +262,9 @@ static vm_page_t rtR0MemObjFreeBSDContigPhysAllocHelpe
              atomic_add_int(&cnt.v_wire_count, 1);
          }
      }
@@ -78,7 +94,7 @@
  }
  
  static int rtR0MemObjFreeBSDPhysAllocHelper(vm_object_t pObject, u_long cPages,
-@@ -292,16 +289,17 @@ static int rtR0MemObjFreeBSDPhysAllocHel
+@@ -292,16 +291,17 @@ static int rtR0MemObjFreeBSDPhysAllocHelper(vm_object_
  #else
              VM_OBJECT_LOCK(pObject);
  #endif
@@ -98,7 +114,143 @@
                  vm_page_unlock_queues();
  #endif
              }
-@@ -519,14 +517,19 @@ static int rtR0MemObjNativeLockInMap(PPR
+@@ -364,58 +364,77 @@ static int rtR0MemObjFreeBSDAllocHelper(PRTR0MEMOBJFRE
+ }
+ DECLHIDDEN(int) rtR0MemObjNativeAllocPage(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     PRTR0MEMOBJFREEBSD pMemFreeBSD = (PRTR0MEMOBJFREEBSD)rtR0MemObjNew(sizeof(*pMemFreeBSD),
+                                                                        RTR0MEMOBJTYPE_PAGE, NULL, cb);
+     if (!pMemFreeBSD)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_NO_MEMORY;
++    }
+ 
+     int rc = rtR0MemObjFreeBSDAllocHelper(pMemFreeBSD, fExecutable, ~(vm_paddr_t)0, false, VERR_NO_MEMORY);
+     if (RT_FAILURE(rc))
+     {
+         rtR0MemObjDelete(&pMemFreeBSD->Core);
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return rc;
+     }
+ 
+     *ppMem = &pMemFreeBSD->Core;
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
+ 
+ DECLHIDDEN(int) rtR0MemObjNativeAllocLow(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     PRTR0MEMOBJFREEBSD pMemFreeBSD = (PRTR0MEMOBJFREEBSD)rtR0MemObjNew(sizeof(*pMemFreeBSD),
+                                                                        RTR0MEMOBJTYPE_LOW, NULL, cb);
+     if (!pMemFreeBSD)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_NO_MEMORY;
++    }
+ 
+     int rc = rtR0MemObjFreeBSDAllocHelper(pMemFreeBSD, fExecutable, _4G - 1, false, VERR_NO_LOW_MEMORY);
+     if (RT_FAILURE(rc))
+     {
+         rtR0MemObjDelete(&pMemFreeBSD->Core);
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return rc;
+     }
+ 
+     *ppMem = &pMemFreeBSD->Core;
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
+ 
+ DECLHIDDEN(int) rtR0MemObjNativeAllocCont(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     PRTR0MEMOBJFREEBSD pMemFreeBSD = (PRTR0MEMOBJFREEBSD)rtR0MemObjNew(sizeof(*pMemFreeBSD),
+                                                                        RTR0MEMOBJTYPE_CONT, NULL, cb);
+     if (!pMemFreeBSD)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_NO_MEMORY;
++    }
+ 
+     int rc = rtR0MemObjFreeBSDAllocHelper(pMemFreeBSD, fExecutable, _4G - 1, true, VERR_NO_CONT_MEMORY);
+     if (RT_FAILURE(rc))
+     {
+         rtR0MemObjDelete(&pMemFreeBSD->Core);
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return rc;
+     }
+ 
+     pMemFreeBSD->Core.u.Cont.Phys = vtophys(pMemFreeBSD->Core.pv);
+     *ppMem = &pMemFreeBSD->Core;
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
+@@ -425,6 +444,7 @@ static int rtR0MemObjFreeBSDAllocPhysPages(PPRTR0MEMOB
+                                            RTHCPHYS PhysHighest, size_t uAlignment,
+                                            bool fContiguous, int rcNoMem)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     uint32_t   cPages = atop(cb);
+     vm_paddr_t VmPhysAddrHigh;
+ 
+@@ -432,7 +452,10 @@ static int rtR0MemObjFreeBSDAllocPhysPages(PPRTR0MEMOB
+     PRTR0MEMOBJFREEBSD pMemFreeBSD = (PRTR0MEMOBJFREEBSD)rtR0MemObjNew(sizeof(*pMemFreeBSD),
+                                                                        enmType, NULL, cb);
+     if (!pMemFreeBSD)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_NO_MEMORY;
++    }
+ 
+     pMemFreeBSD->pObject = vm_object_allocate(OBJT_PHYS, atop(cb));
+ 
+@@ -470,6 +493,7 @@ static int rtR0MemObjFreeBSDAllocPhysPages(PPRTR0MEMOB
+         rtR0MemObjDelete(&pMemFreeBSD->Core);
+     }
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
+@@ -489,17 +513,22 @@ DECLHIDDEN(int) rtR0MemObjNativeAllocPhysNC(PPRTR0MEMO
+ DECLHIDDEN(int) rtR0MemObjNativeEnterPhys(PPRTR0MEMOBJINTERNAL ppMem, RTHCPHYS Phys, size_t cb, uint32_t uCachePolicy)
+ {
+     AssertReturn(uCachePolicy == RTMEM_CACHE_POLICY_DONT_CARE, VERR_NOT_SUPPORTED);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     /* create the object. */
+     PRTR0MEMOBJFREEBSD pMemFreeBSD = (PRTR0MEMOBJFREEBSD)rtR0MemObjNew(sizeof(*pMemFreeBSD), RTR0MEMOBJTYPE_PHYS, NULL, cb);
+     if (!pMemFreeBSD)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_NO_MEMORY;
++    }
+ 
+     /* there is no allocation here, it needs to be mapped somewhere first. */
+     pMemFreeBSD->Core.u.Phys.fAllocated = false;
+     pMemFreeBSD->Core.u.Phys.PhysBase = Phys;
+     pMemFreeBSD->Core.u.Phys.uCachePolicy = uCachePolicy;
+     *ppMem = &pMemFreeBSD->Core;
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -511,6 +540,7 @@ static int rtR0MemObjNativeLockInMap(PPRTR0MEMOBJINTER
+                                      vm_offset_t AddrStart, size_t cb, uint32_t fAccess,
+                                      RTR0PROCESS R0Process, int fFlags)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     int rc;
+     NOREF(fAccess);
+ 
+@@ -519,21 +549,28 @@ static int rtR0MemObjNativeLockInMap(PPRTR0MEMOBJINTER
      if (!pMemFreeBSD)
          return VERR_NO_MEMORY;
  
@@ -126,7 +278,72 @@
      if (rc == KERN_SUCCESS)
      {
          pMemFreeBSD->Core.u.Lock.R0Process = R0Process;
-@@ -751,7 +754,12 @@ DECLHIDDEN(int) rtR0MemObjNativeMapUser(
+         *ppMem = &pMemFreeBSD->Core;
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VINF_SUCCESS;
+     }
+     rtR0MemObjDelete(&pMemFreeBSD->Core);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VERR_NO_MEMORY;/** @todo fix mach -> vbox error conversion for freebsd. */
+ }
+ 
+@@ -569,6 +606,7 @@ DECLHIDDEN(int) rtR0MemObjNativeLockKernel(PPRTR0MEMOB
+  */
+ static int rtR0MemObjNativeReserveInMap(PPRTR0MEMOBJINTERNAL ppMem, void *pvFixed, size_t cb, size_t uAlignment, RTR0PROCESS R0Process, vm_map_t pMap)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     int rc;
+ 
+     /*
+@@ -626,11 +664,13 @@ static int rtR0MemObjNativeReserveInMap(PPRTR0MEMOBJIN
+         pMemFreeBSD->Core.pv = (void *)MapAddress;
+         pMemFreeBSD->Core.u.ResVirt.R0Process = R0Process;
+         *ppMem = &pMemFreeBSD->Core;
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VINF_SUCCESS;
+     }
+ 
+     rc = VERR_NO_MEMORY; /** @todo fix translation (borrow from darwin) */
+     rtR0MemObjDelete(&pMemFreeBSD->Core);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ 
+ }
+@@ -652,6 +692,8 @@ DECLHIDDEN(int) rtR0MemObjNativeReserveUser(PPRTR0MEMO
+ DECLHIDDEN(int) rtR0MemObjNativeMapKernel(PPRTR0MEMOBJINTERNAL ppMem, RTR0MEMOBJ pMemToMap, void *pvFixed, size_t uAlignment,
+                                           unsigned fProt, size_t offSub, size_t cbSub)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+ //  AssertMsgReturn(!offSub && !cbSub, ("%#x %#x\n", offSub, cbSub), VERR_NOT_SUPPORTED);
+     AssertMsgReturn(pvFixed == (void *)-1, ("%p\n", pvFixed), VERR_NOT_SUPPORTED);
+ 
+@@ -707,6 +749,7 @@ DECLHIDDEN(int) rtR0MemObjNativeMapKernel(PPRTR0MEMOBJ
+             Assert((vm_offset_t)pMemFreeBSD->Core.pv == Addr);
+             pMemFreeBSD->Core.u.Mapping.R0Process = NIL_RTR0PROCESS;
+             *ppMem = &pMemFreeBSD->Core;
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VINF_SUCCESS;
+         }
+         rc = vm_map_remove(kernel_map, Addr, Addr + cbSub);
+@@ -715,6 +758,7 @@ DECLHIDDEN(int) rtR0MemObjNativeMapKernel(PPRTR0MEMOBJ
+     else
+         vm_object_deallocate(pMemToMapFreeBSD->pObject);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VERR_NO_MEMORY;
+ }
+ 
+@@ -722,6 +766,8 @@ DECLHIDDEN(int) rtR0MemObjNativeMapKernel(PPRTR0MEMOBJ
+ DECLHIDDEN(int) rtR0MemObjNativeMapUser(PPRTR0MEMOBJINTERNAL ppMem, RTR0MEMOBJ pMemToMap, RTR3PTR R3PtrFixed, size_t uAlignment,
+                                         unsigned fProt, RTR0PROCESS R0Process)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     /*
+      * Check for unsupported stuff.
+      */
+@@ -751,7 +797,12 @@ DECLHIDDEN(int) rtR0MemObjNativeMapUser(PPRTR0MEMOBJIN
      {
          /** @todo is this needed?. */
          PROC_LOCK(pProc);
@@ -140,7 +357,49 @@
          PROC_UNLOCK(pProc);
      }
      else
-@@ -850,11 +858,15 @@ DECLHIDDEN(RTHCPHYS) rtR0MemObjNativeGet
+@@ -793,6 +844,7 @@ DECLHIDDEN(int) rtR0MemObjNativeMapUser(PPRTR0MEMOBJIN
+             Assert((vm_offset_t)pMemFreeBSD->Core.pv == AddrR3);
+             pMemFreeBSD->Core.u.Mapping.R0Process = R0Process;
+             *ppMem = &pMemFreeBSD->Core;
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return VINF_SUCCESS;
+         }
+ 
+@@ -802,19 +854,25 @@ DECLHIDDEN(int) rtR0MemObjNativeMapUser(PPRTR0MEMOBJIN
+     else
+         vm_object_deallocate(pMemToMapFreeBSD->pObject);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VERR_NO_MEMORY;
+ }
+ 
+ 
+ DECLHIDDEN(int) rtR0MemObjNativeProtect(PRTR0MEMOBJINTERNAL pMem, size_t offSub, size_t cbSub, uint32_t fProt)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     vm_prot_t          ProtectionFlags = 0;
+     vm_offset_t        AddrStart       = (uintptr_t)pMem->pv + offSub;
+     vm_offset_t        AddrEnd         = AddrStart + cbSub;
+     vm_map_t           pVmMap          = rtR0MemObjFreeBSDGetMap(pMem);
+ 
+     if (!pVmMap)
++    {
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VERR_NOT_SUPPORTED;
++    }
+ 
+     if ((fProt & RTMEM_PROT_NONE) == RTMEM_PROT_NONE)
+         ProtectionFlags = VM_PROT_NONE;
+@@ -826,6 +884,7 @@ DECLHIDDEN(int) rtR0MemObjNativeProtect(PRTR0MEMOBJINT
+         ProtectionFlags |= VM_PROT_EXECUTE;
+ 
+     int krc = vm_map_protect(pVmMap, AddrStart, AddrEnd, ProtectionFlags, FALSE);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     if (krc == KERN_SUCCESS)
+         return VINF_SUCCESS;
+ 
+@@ -850,11 +909,19 @@ DECLHIDDEN(RTHCPHYS) rtR0MemObjNativeGetPagePhysAddr(P
  
              vm_offset_t pb = (vm_offset_t)pMemFreeBSD->Core.pv + ptoa(iPage);
  
@@ -149,14 +408,51 @@
 -            pmap_t pPhysicalMap       = vm_map_pmap(pProcMap);
 +            if (pMemFreeBSD->Core.u.Mapping.R0Process != NIL_RTR0PROCESS)
 +            {
++                RTHCPHYS addr;
++                IPRT_FREEBSD_SAVE_EFL_AC();
 +                struct proc    *pProc     = (struct proc *)pMemFreeBSD->Core.u.Lock.R0Process;
 +                struct vm_map  *pProcMap  = &pProc->p_vmspace->vm_map;
 +                pmap_t pPhysicalMap       = vm_map_pmap(pProcMap);
  
 -            return pmap_extract(pPhysicalMap, pb);
-+                return pmap_extract(pPhysicalMap, pb);
++                addr =  pmap_extract(pPhysicalMap, pb);
++                IPRT_FREEBSD_RESTORE_EFL_AC();
++                return addr;
 +            }
 +            return vtophys(pb);
          }
  
          case RTR0MEMOBJTYPE_MAPPING:
+@@ -863,11 +930,15 @@ DECLHIDDEN(RTHCPHYS) rtR0MemObjNativeGetPagePhysAddr(P
+ 
+             if (pMemFreeBSD->Core.u.Mapping.R0Process != NIL_RTR0PROCESS)
+             {
++                RTHCPHYS addr;
++                IPRT_FREEBSD_SAVE_EFL_AC();
+                 struct proc    *pProc     = (struct proc *)pMemFreeBSD->Core.u.Mapping.R0Process;
+                 struct vm_map  *pProcMap  = &pProc->p_vmspace->vm_map;
+                 pmap_t pPhysicalMap       = vm_map_pmap(pProcMap);
+ 
+-                return pmap_extract(pPhysicalMap, pb);
++                addr =  pmap_extract(pPhysicalMap, pb);
++                IPRT_FREEBSD_RESTORE_EFL_AC();
++                return addr;
+             }
+             return vtophys(pb);
+         }
+@@ -877,6 +948,7 @@ DECLHIDDEN(RTHCPHYS) rtR0MemObjNativeGetPagePhysAddr(P
+         case RTR0MEMOBJTYPE_PHYS_NC:
+         {
+             RTHCPHYS addr;
++            IPRT_FREEBSD_SAVE_EFL_AC();
+ #if __FreeBSD_version >= 1000030
+             VM_OBJECT_WLOCK(pMemFreeBSD->pObject);
+ #else
+@@ -888,6 +960,7 @@ DECLHIDDEN(RTHCPHYS) rtR0MemObjNativeGetPagePhysAddr(P
+ #else
+             VM_OBJECT_UNLOCK(pMemFreeBSD->pObject);
+ #endif
++            IPRT_FREEBSD_RESTORE_EFL_AC();
+             return addr;
+         }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memuserkernel-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memuserkernel-r0drv-freebsd.c
new file mode 100644
index 000000000000..53bac187bde0
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_memuserkernel-r0drv-freebsd.c
@@ -0,0 +1,22 @@
+--- src/VBox/Runtime/r0drv/freebsd/memuserkernel-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/memuserkernel-r0drv-freebsd.c
+@@ -36,7 +36,9 @@
+ 
+ RTR0DECL(int) RTR0MemUserCopyFrom(void *pvDst, RTR3PTR R3PtrSrc, size_t cb)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     int rc = copyin((const void *)R3PtrSrc, pvDst, cb);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     if (RT_LIKELY(rc == 0))
+         return VINF_SUCCESS;
+     return VERR_ACCESS_DENIED;
+@@ -45,7 +47,9 @@ RTR0DECL(int) RTR0MemUserCopyFrom(void *pvDst, RTR3PTR
+ 
+ RTR0DECL(int) RTR0MemUserCopyTo(RTR3PTR R3PtrDst, void const *pvSrc, size_t cb)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     int rc = copyout(pvSrc, (void *)R3PtrDst, cb);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     if (RT_LIKELY(rc == 0))
+         return VINF_SUCCESS;
+     return VERR_ACCESS_DENIED;
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_mp-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_mp-r0drv-freebsd.c
index 599feb738646..1de5b95f38b0 100644
--- a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_mp-r0drv-freebsd.c
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_mp-r0drv-freebsd.c
@@ -1,4 +1,4 @@
---- src/VBox/Runtime/r0drv/freebsd/mp-r0drv-freebsd.c.orig	2017-03-15 19:18:08 UTC
+--- src/VBox/Runtime/r0drv/freebsd/mp-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
 +++ src/VBox/Runtime/r0drv/freebsd/mp-r0drv-freebsd.c
 @@ -36,6 +36,15 @@
  #include <iprt/cpuset.h>
@@ -16,16 +16,40 @@
  
  RTDECL(RTCPUID) RTMpCpuId(void)
  {
-@@ -155,7 +164,7 @@ RTDECL(int) RTMpOnAll(PFNRTMPWORKER pfnW
+@@ -143,7 +152,9 @@ RTDECL(RTCPUID) RTMpGetOnlineCount(void)
+ static void rtmpOnAllFreeBSDWrapper(void *pvArg)
+ {
+     PRTMPARGS pArgs = (PRTMPARGS)pvArg;
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     pArgs->pfnWorker(curcpu, pArgs->pvUser1, pArgs->pvUser2);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+ }
+ 
+ 
+@@ -155,7 +166,9 @@ RTDECL(int) RTMpOnAll(PFNRTMPWORKER pfnWorker, void *p
      Args.pvUser2 = pvUser2;
      Args.idCpu = NIL_RTCPUID;
      Args.cHits = 0;
 -    smp_rendezvous(NULL, rtmpOnAllFreeBSDWrapper, smp_no_rendevous_barrier, &Args);
++    IPRT_FREEBSD_SAVE_EFL_AC();
 +    smp_rendezvous(NULL, rtmpOnAllFreeBSDWrapper, smp_no_rendezvous_barrier, &Args);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
      return VINF_SUCCESS;
  }
  
-@@ -180,10 +189,8 @@ RTDECL(int) RTMpOnOthers(PFNRTMPWORKER p
+@@ -171,7 +184,11 @@ static void rtmpOnOthersFreeBSDWrapper(void *pvArg)
+     PRTMPARGS pArgs = (PRTMPARGS)pvArg;
+     RTCPUID idCpu = curcpu;
+     if (pArgs->idCpu != idCpu)
++    {
++        IPRT_FREEBSD_SAVE_EFL_AC();
+         pArgs->pfnWorker(idCpu, pArgs->pvUser1, pArgs->pvUser2);
++        IPRT_FREEBSD_RESTORE_EFL_AC();
++    }
+ }
+ 
+ 
+@@ -180,10 +197,8 @@ RTDECL(int) RTMpOnOthers(PFNRTMPWORKER pfnWorker, void
      /* Will panic if no rendezvousing cpus, so check up front. */
      if (RTMpGetOnlineCount() > 1)
      {
@@ -38,9 +62,11 @@
  #endif
          RTMPARGS    Args;
  
-@@ -193,13 +200,9 @@ RTDECL(int) RTMpOnOthers(PFNRTMPWORKER p
+@@ -192,17 +207,15 @@ RTDECL(int) RTMpOnOthers(PFNRTMPWORKER pfnWorker, void
+         Args.pvUser2 = pvUser2;
          Args.idCpu = RTMpCpuId();
          Args.cHits = 0;
++        IPRT_FREEBSD_SAVE_EFL_AC();
  #if __FreeBSD_version >= 700000
 -# if __FreeBSD_version >= 900000
 -    Mask = all_cpus;
@@ -55,7 +81,21 @@
  #else
          smp_rendezvous(NULL, rtmpOnOthersFreeBSDWrapper, NULL, &Args);
  #endif
-@@ -228,10 +231,8 @@ static void rtmpOnSpecificFreeBSDWrapper
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+     }
+     return VINF_SUCCESS;
+ }
+@@ -220,18 +233,18 @@ static void rtmpOnSpecificFreeBSDWrapper(void *pvArg)
+     RTCPUID     idCpu = curcpu;
+     if (pArgs->idCpu == idCpu)
+     {
++        IPRT_FREEBSD_SAVE_EFL_AC();
+         pArgs->pfnWorker(idCpu, pArgs->pvUser1, pArgs->pvUser2);
+         ASMAtomicIncU32(&pArgs->cHits);
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+     }
+ }
+ 
  
  RTDECL(int) RTMpOnSpecific(RTCPUID idCpu, PFNRTMPWORKER pfnWorker, void *pvUser1, void *pvUser2)
  {
@@ -68,9 +108,11 @@
  #endif
      RTMPARGS    Args;
  
-@@ -245,12 +246,8 @@ RTDECL(int) RTMpOnSpecific(RTCPUID idCpu
+@@ -244,16 +257,14 @@ RTDECL(int) RTMpOnSpecific(RTCPUID idCpu, PFNRTMPWORKE
+     Args.pvUser2 = pvUser2;
      Args.idCpu = idCpu;
      Args.cHits = 0;
++    IPRT_FREEBSD_SAVE_EFL_AC();
  #if __FreeBSD_version >= 700000
 -# if __FreeBSD_version >= 900000
 -    CPU_SETOF(idCpu, &Mask);
@@ -83,7 +125,11 @@
  #else
      smp_rendezvous(NULL, rtmpOnSpecificFreeBSDWrapper, NULL, &Args);
  #endif
-@@ -273,22 +270,14 @@ static void rtmpFreeBSDPokeCallback(void
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return Args.cHits == 1
+          ? VINF_SUCCESS
+          : VERR_CPU_NOT_FOUND;
+@@ -273,22 +284,16 @@ static void rtmpFreeBSDPokeCallback(void *pvArg)
  
  RTDECL(int) RTMpPokeCpu(RTCPUID idCpu)
  {
@@ -104,8 +150,10 @@
 -    Mask = (cpumask_t)1 << idCpu;
 -# endif
 -    smp_rendezvous_cpus(Mask, NULL, rtmpFreeBSDPokeCallback, smp_no_rendevous_barrier, NULL);
++    IPRT_FREEBSD_SAVE_EFL_AC();
 +    CPU_SETOF(idCpu, &Cpus);
 +    smp_rendezvous_cpus(Cpus, NULL, rtmpFreeBSDPokeCallback, smp_no_rendezvous_barrier, NULL);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
  
      return VINF_SUCCESS;
  }
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semevent-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semevent-r0drv-freebsd.c
new file mode 100644
index 000000000000..c570caf8f51b
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semevent-r0drv-freebsd.c
@@ -0,0 +1,53 @@
+--- src/VBox/Runtime/r0drv/freebsd/semevent-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/semevent-r0drv-freebsd.c
+@@ -77,7 +77,9 @@ RTDECL(int)  RTSemEventCreateEx(PRTSEMEVENT phEventSem
+     Assert(!(fFlags & RTSEMEVENT_FLAGS_BOOTSTRAP_HACK) || (fFlags & RTSEMEVENT_FLAGS_NO_LOCK_VAL));
+     AssertPtrReturn(phEventSem, VERR_INVALID_POINTER);
+ 
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     PRTSEMEVENTINTERNAL pThis = (PRTSEMEVENTINTERNAL)RTMemAllocZ(sizeof(*pThis));
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     if (!pThis)
+         return VERR_NO_MEMORY;
+ 
+@@ -128,10 +130,12 @@ RTDECL(int)  RTSemEventDestroy(RTSEMEVENT hEventSem)
+     /*
+      * Invalidate it and signal the object just in case.
+      */
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     ASMAtomicWriteU32(&pThis->u32Magic, ~RTSEMEVENT_MAGIC);
+     ASMAtomicWriteU32(&pThis->fState, 0);
+     rtR0SemBsdBroadcast(pThis);
+     rtR0SemEventBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -149,9 +153,11 @@ RTDECL(int)  RTSemEventSignal(RTSEMEVENT hEventSem)
+     /*
+      * Signal the event object.
+      */
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     ASMAtomicWriteU32(&pThis->fState, 1);
+     rtR0SemBsdSignal(pThis);
+     rtR0SemEventBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -175,6 +181,7 @@ static int rtR0SemEventWait(PRTSEMEVENTINTERNAL pThis,
+     AssertPtrReturn(pThis, VERR_INVALID_PARAMETER);
+     AssertMsgReturn(pThis->u32Magic == RTSEMEVENT_MAGIC, ("%p u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_PARAMETER);
+     AssertReturn(RTSEMWAIT_FLAGS_ARE_VALID(fFlags), VERR_INVALID_PARAMETER);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     rtR0SemEventBsdRetain(pThis);
+ 
+     /*
+@@ -224,6 +231,7 @@ static int rtR0SemEventWait(PRTSEMEVENTINTERNAL pThis,
+     }
+ 
+     rtR0SemEventBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semeventmulti-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semeventmulti-r0drv-freebsd.c
new file mode 100644
index 000000000000..af139a58f91c
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semeventmulti-r0drv-freebsd.c
@@ -0,0 +1,73 @@
+--- src/VBox/Runtime/r0drv/freebsd/semeventmulti-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/semeventmulti-r0drv-freebsd.c
+@@ -96,7 +96,9 @@ RTDECL(int)  RTSemEventMultiCreateEx(PRTSEMEVENTMULTI 
+     PRTSEMEVENTMULTIINTERNAL pThis;
+ 
+     AssertReturn(!(fFlags & ~RTSEMEVENTMULTI_FLAGS_NO_LOCK_VAL), VERR_INVALID_PARAMETER);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     pThis = (PRTSEMEVENTMULTIINTERNAL)RTMemAlloc(sizeof(*pThis));
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     if (pThis)
+     {
+         pThis->u32Magic     = RTSEMEVENTMULTI_MAGIC;
+@@ -152,10 +154,12 @@ RTDECL(int)  RTSemEventMultiDestroy(RTSEMEVENTMULTI hE
+     /*
+      * Invalidate it and signal the object just in case.
+      */
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     ASMAtomicWriteU32(&pThis->u32Magic, ~RTSEMEVENTMULTI_MAGIC);
+     ASMAtomicAndU32(&pThis->fStateAndGen, RTSEMEVENTMULTIBSD_GEN_MASK);
+     rtR0SemBsdBroadcast(pThis);
+     rtR0SemEventMultiBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -164,6 +168,7 @@ RTDECL(int)  RTSemEventMultiSignal(RTSEMEVENTMULTI hEv
+ {
+     uint32_t fNew;
+     uint32_t fOld;
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     /*
+      * Validate input.
+@@ -190,12 +195,15 @@ RTDECL(int)  RTSemEventMultiSignal(RTSEMEVENTMULTI hEv
+ 
+     rtR0SemBsdBroadcast(pThis);
+     rtR0SemEventMultiBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+ 
+ RTDECL(int)  RTSemEventMultiReset(RTSEMEVENTMULTI hEventMultiSem)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     /*
+      * Validate input.
+      */
+@@ -212,6 +220,7 @@ RTDECL(int)  RTSemEventMultiReset(RTSEMEVENTMULTI hEve
+     ASMAtomicAndU32(&pThis->fStateAndGen, ~RTSEMEVENTMULTIBSD_STATE_MASK);
+ 
+     rtR0SemEventMultiBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -228,6 +237,7 @@ RTDECL(int)  RTSemEventMultiReset(RTSEMEVENTMULTI hEve
+ static int rtR0SemEventMultiBsdWait(PRTSEMEVENTMULTIINTERNAL pThis, uint32_t fFlags, uint64_t uTimeout,
+                                     PCRTLOCKVALSRCPOS pSrcPos)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     uint32_t    fOrgStateAndGen;
+     int         rc;
+ 
+@@ -287,6 +297,7 @@ static int rtR0SemEventMultiBsdWait(PRTSEMEVENTMULTIIN
+     }
+ 
+     rtR0SemEventMultiBsdRelease(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semfastmutex-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semfastmutex-r0drv-freebsd.c
new file mode 100644
index 000000000000..78ecef4a393d
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semfastmutex-r0drv-freebsd.c
@@ -0,0 +1,59 @@
+--- src/VBox/Runtime/r0drv/freebsd/semfastmutex-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/semfastmutex-r0drv-freebsd.c
+@@ -62,6 +62,7 @@ RTDECL(int)  RTSemFastMutexCreate(PRTSEMFASTMUTEX phFa
+ {
+     AssertCompile(sizeof(RTSEMFASTMUTEXINTERNAL) > sizeof(void *));
+     AssertPtrReturn(phFastMtx, VERR_INVALID_POINTER);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     PRTSEMFASTMUTEXINTERNAL pThis = (PRTSEMFASTMUTEXINTERNAL)RTMemAllocZ(sizeof(*pThis));
+     if (pThis)
+@@ -70,8 +71,10 @@ RTDECL(int)  RTSemFastMutexCreate(PRTSEMFASTMUTEX phFa
+         sx_init_flags(&pThis->SxLock, "IPRT Fast Mutex Semaphore", SX_DUPOK);
+ 
+         *phFastMtx = pThis;
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VINF_SUCCESS;
+     }
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VERR_NO_MEMORY;
+ }
+ 
+@@ -83,11 +86,13 @@ RTDECL(int)  RTSemFastMutexDestroy(RTSEMFASTMUTEX hFas
+         return VINF_SUCCESS;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMFASTMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     ASMAtomicWriteU32(&pThis->u32Magic, RTSEMFASTMUTEX_MAGIC_DEAD);
+     sx_destroy(&pThis->SxLock);
+     RTMemFree(pThis);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -97,8 +102,11 @@ RTDECL(int)  RTSemFastMutexRequest(RTSEMFASTMUTEX hFas
+     PRTSEMFASTMUTEXINTERNAL pThis = hFastMtx;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMFASTMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     sx_xlock(&pThis->SxLock);
++
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -108,8 +116,11 @@ RTDECL(int)  RTSemFastMutexRelease(RTSEMFASTMUTEX hFas
+     PRTSEMFASTMUTEXINTERNAL pThis = hFastMtx;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMFASTMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     sx_xunlock(&pThis->SxLock);
++
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semmutex-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semmutex-r0drv-freebsd.c
new file mode 100644
index 000000000000..6345ae10c562
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_semmutex-r0drv-freebsd.c
@@ -0,0 +1,80 @@
+--- src/VBox/Runtime/r0drv/freebsd/semmutex-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/semmutex-r0drv-freebsd.c
+@@ -62,6 +62,7 @@ RTDECL(int)  RTSemMutexCreate(PRTSEMMUTEX phMutexSem)
+ {
+     AssertCompile(sizeof(RTSEMMUTEXINTERNAL) > sizeof(void *));
+     AssertPtrReturn(phMutexSem, VERR_INVALID_POINTER);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     PRTSEMMUTEXINTERNAL pThis = (PRTSEMMUTEXINTERNAL)RTMemAllocZ(sizeof(*pThis));
+     if (pThis)
+@@ -70,8 +71,10 @@ RTDECL(int)  RTSemMutexCreate(PRTSEMMUTEX phMutexSem)
+         sx_init_flags(&pThis->SxLock, "IPRT Mutex Semaphore", SX_RECURSE);
+ 
+         *phMutexSem = pThis;
++        IPRT_FREEBSD_RESTORE_EFL_AC();
+         return VINF_SUCCESS;
+     }
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VERR_NO_MEMORY;
+ }
+ 
+@@ -83,12 +86,14 @@ RTDECL(int)  RTSemMutexDestroy(RTSEMMUTEX hMutexSem)
+         return VINF_SUCCESS;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     AssertReturn(ASMAtomicCmpXchgU32(&pThis->u32Magic, RTSEMMUTEX_MAGIC_DEAD, RTSEMMUTEX_MAGIC), VERR_INVALID_HANDLE);
+ 
+     sx_destroy(&pThis->SxLock);
+     RTMemFree(pThis);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -99,6 +104,7 @@ RTDECL(int)  RTSemMutexRequest(RTSEMMUTEX hMutexSem, R
+     int                 rc;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     if (cMillies == RT_INDEFINITE_WAIT)
+     {
+@@ -133,6 +139,7 @@ RTDECL(int)  RTSemMutexRequest(RTSEMMUTEX hMutexSem, R
+         } while (RTTimeSystemMilliTS() - StartTS < cMillies);
+     }
+ 
++    IPRT_FREEBSD_RESTORE_EFL_ONLY_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -149,6 +156,7 @@ RTDECL(int)  RTSemMutexRequestNoResume(RTSEMMUTEX hMut
+     int                 rc;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     if (cMillies == RT_INDEFINITE_WAIT)
+     {
+@@ -186,6 +194,7 @@ RTDECL(int)  RTSemMutexRequestNoResume(RTSEMMUTEX hMut
+         } while (RTTimeSystemMilliTS() - StartTS < cMillies);
+     }
+ 
++    IPRT_FREEBSD_RESTORE_EFL_ONLY_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -201,8 +210,11 @@ RTDECL(int)  RTSemMutexRelease(RTSEMMUTEX hMutexSem)
+     PRTSEMMUTEXINTERNAL pThis = hMutexSem;
+     AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
+     AssertMsgReturn(pThis->u32Magic == RTSEMMUTEX_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     sx_xunlock(&pThis->SxLock);
++
++    IPRT_FREEBSD_RESTORE_EFL_ONLY_AC();
+     return VINF_SUCCESS;
+ }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_spinlock-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_spinlock-r0drv-freebsd.c
new file mode 100644
index 000000000000..e76621407cea
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_spinlock-r0drv-freebsd.c
@@ -0,0 +1,30 @@
+--- src/VBox/Runtime/r0drv/freebsd/spinlock-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/spinlock-r0drv-freebsd.c
+@@ -82,7 +82,9 @@ RTDECL(int)  RTSpinlockCreate(PRTSPINLOCK pSpinlock, u
+      * Allocate.
+      */
+     AssertCompile(sizeof(RTSPINLOCKINTERNAL) > sizeof(void *));
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     PRTSPINLOCKINTERNAL pThis = (PRTSPINLOCKINTERNAL)RTMemAllocZ(sizeof(*pThis));
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     if (!pThis)
+         return VERR_NO_MEMORY;
+ 
+@@ -116,7 +118,9 @@ RTDECL(int)  RTSpinlockDestroy(RTSPINLOCK Spinlock)
+      * Make the lock invalid and release the memory.
+      */
+     ASMAtomicIncU32(&pThis->u32Magic);
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     RTMemFree(pThis);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -142,6 +146,7 @@ RTDECL(void) RTSpinlockAcquire(RTSPINLOCK Spinlock)
+                 {
+                     RT_ASSERT_PREEMPT_CPUID_SPIN_ACQUIRED(pThis);
+                     pThis->fIntSaved = fIntSaved;
++                    IPRT_FREEBSD_RESTORE_EFL_ONLY_AC_EX(fIntSaved);
+                     return;
+                 }
+                 if (--c <= 0)
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_the-freebsd-kernel.h b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_the-freebsd-kernel.h
index 242316926c95..5130dadb049a 100644
--- a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_the-freebsd-kernel.h
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_the-freebsd-kernel.h
@@ -1,4 +1,4 @@
---- src/VBox/Runtime/r0drv/freebsd/the-freebsd-kernel.h.orig	2017-04-18 09:53:54 UTC
+--- src/VBox/Runtime/r0drv/freebsd/the-freebsd-kernel.h.orig	2018-10-15 14:31:31 UTC
 +++ src/VBox/Runtime/r0drv/freebsd/the-freebsd-kernel.h
 @@ -60,6 +60,7 @@
  #include <sys/smp.h>
@@ -16,3 +16,28 @@
  #include <sys/resourcevar.h>
  #include <machine/cpu.h>
  
+@@ -114,6 +114,24 @@
+  */
+ #if 0 /** @todo Not available yet. */
+ # define USE_KMEM_ALLOC_PROT
++#endif
++
++/** 
++ * Macros for preserving EFLAGS.AC (despair / paranoid)
++ */
++#if __FreeBSD_version >= 1200076 && defined(RT_ARCH_AMD64)
++# include <iprt/asm-amd64-x86.h>
++# include <iprt/x86.h>
++# define IPRT_FREEBSD_SAVE_EFL_AC()             RTCCUINTREG const fSavedEfl = ASMGetFlags()
++# define IPRT_FREEBSD_RESTORE_EFL_AC()          ASMSetFlags(fSavedEfl)
++# define IPRT_FREEBSD_RESTORE_EFL_ONLY_AC()     ASMChangeFlags(~X86_EFL_AC, fSavedEfl & X86_EFL_AC)
++# define IPRT_FREEBSD_RESTORE_EFL_ONLY_AC_EX(f) ASMChangeFlags(~X86_EFL_AC, (f) & X86_EFL_AC)
++# define VBOX_WITH_EFLAGS_AC_SET_IN_VBOXDRV
++#else
++# define IPRT_FREEBSD_SAVE_EFL_AC()             do { } while (0)
++# define IPRT_FREEBSD_RESTORE_EFL_AC()          do { } while (0)
++# define IPRT_FREEBSD_RESTORE_EFL_ONLY_AC()     do { } while (0)
++# define IPRT_FREEBSD_RESTORE_EFL_ONLY_AC_EX(f) do { } while (0)
+ #endif
+ 
+ #endif
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread-r0drv-freebsd.c
index f17a42bfa9a7..2c65ff3a2029 100644
--- a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread-r0drv-freebsd.c
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread-r0drv-freebsd.c
@@ -1,6 +1,6 @@
---- src/VBox/Runtime/r0drv/freebsd/thread-r0drv-freebsd.c.orig	2016-07-18 11:56:55 UTC
+--- src/VBox/Runtime/r0drv/freebsd/thread-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
 +++ src/VBox/Runtime/r0drv/freebsd/thread-r0drv-freebsd.c
-@@ -49,7 +49,6 @@ RTDECL(RTNATIVETHREAD) RTThreadNativeSel
+@@ -49,7 +49,6 @@ RTDECL(RTNATIVETHREAD) RTThreadNativeSelf(void)
  static int rtR0ThreadFbsdSleepCommon(RTMSINTERVAL cMillies)
  {
      int rc;
@@ -8,7 +8,14 @@
  
      /*
       * 0 ms sleep -> yield.
-@@ -65,6 +64,21 @@ static int rtR0ThreadFbsdSleepCommon(RTM
+@@ -60,11 +59,28 @@ static int rtR0ThreadFbsdSleepCommon(RTMSINTERVAL cMil
+         return VINF_SUCCESS;
+     }
+ 
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     /*
+      * Translate milliseconds into ticks and go to sleep.
       */
      if (cMillies != RT_INDEFINITE_WAIT)
      {
@@ -30,7 +37,7 @@
          if (hz == 1000)
              cTicks = cMillies;
          else if (hz == 100)
-@@ -76,14 +90,23 @@ static int rtR0ThreadFbsdSleepCommon(RTM
+@@ -76,14 +92,24 @@ static int rtR0ThreadFbsdSleepCommon(RTMSINTERVAL cMil
              if (cTicks != cTicks64)
                  cTicks = INT_MAX;
          }
@@ -57,6 +64,36 @@
 +                    "iprts0",           /* max 6 chars */
 +                    0);
 +    }
++    IPRT_FREEBSD_RESTORE_EFL_AC();
      switch (rc)
      {
          case 0:
+@@ -114,11 +140,13 @@ RTDECL(int) RTThreadSleepNoLog(RTMSINTERVAL cMillies)
+ 
+ RTDECL(bool) RTThreadYield(void)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ #if __FreeBSD_version >= 900032
+     kern_yield(curthread->td_user_pri);
+ #else
+     uio_yield();
+ #endif
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return false; /** @todo figure this one ... */
+ }
+ 
+@@ -167,12 +195,14 @@ RTDECL(void) RTThreadPreemptDisable(PRTTHREADPREEMPTST
+ 
+ RTDECL(void) RTThreadPreemptRestore(PRTTHREADPREEMPTSTATE pState)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC(); /* paranoia */
+     AssertPtr(pState);
+     Assert(pState->u32Reserved == 42);
+     pState->u32Reserved = 0;
+ 
+     RT_ASSERT_PREEMPT_CPUID_RESTORE(pState);
+     critical_exit();
++    IPRT_FREEBSD_RESTORE_EFL_ONLY_AC();  /* paranoia */
+ }
+ 
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread2-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread2-r0drv-freebsd.c
new file mode 100644
index 000000000000..c2defe1768b9
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_thread2-r0drv-freebsd.c
@@ -0,0 +1,35 @@
+--- src/VBox/Runtime/r0drv/freebsd/thread2-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/thread2-r0drv-freebsd.c
+@@ -70,6 +70,8 @@ DECLHIDDEN(int) rtThreadNativeSetPriority(PRTTHREADINT
+             return VERR_INVALID_PARAMETER;
+     }
+ 
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+ #if __FreeBSD_version < 700000
+     /* Do like they're doing in subr_ntoskrnl.c... */
+     mtx_lock_spin(&sched_lock);
+@@ -86,6 +88,7 @@ DECLHIDDEN(int) rtThreadNativeSetPriority(PRTTHREADINT
+     thread_unlock(curthread);
+ #endif
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -135,6 +138,7 @@ static void rtThreadNativeMain(void *pvThreadInt)
+ 
+ DECLHIDDEN(int) rtThreadNativeCreate(PRTTHREADINT pThreadInt, PRTNATIVETHREAD pNativeThread)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
+     int rc;
+     struct proc *pProc;
+ 
+@@ -150,6 +154,7 @@ DECLHIDDEN(int) rtThreadNativeCreate(PRTTHREADINT pThr
+     }
+     else
+         rc = RTErrConvertFromErrno(rc);
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return rc;
+ }
+ 
diff --git a/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_timer-r0drv-freebsd.c b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_timer-r0drv-freebsd.c
new file mode 100644
index 000000000000..9dc293692223
--- /dev/null
+++ b/emulators/virtualbox-ose/files/patch-src_VBox_Runtime_r0drv_freebsd_timer-r0drv-freebsd.c
@@ -0,0 +1,68 @@
+--- src/VBox/Runtime/r0drv/freebsd/timer-r0drv-freebsd.c.orig	2018-10-15 14:31:31 UTC
++++ src/VBox/Runtime/r0drv/freebsd/timer-r0drv-freebsd.c
+@@ -92,6 +92,7 @@ static void rtTimerFreeBSDCallback(void *pvTimer);
+ RTDECL(int) RTTimerCreateEx(PRTTIMER *ppTimer, uint64_t u64NanoInterval, uint32_t fFlags, PFNRTTIMER pfnTimer, void *pvUser)
+ {
+     *ppTimer = NULL;
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     /*
+      * Validate flags.
+@@ -121,6 +122,7 @@ RTDECL(int) RTTimerCreateEx(PRTTIMER *ppTimer, uint64_
+     callout_init(&pTimer->Callout, CALLOUT_MPSAFE);
+ 
+     *ppTimer = pTimer;
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -141,6 +143,8 @@ DECLINLINE(bool) rtTimerIsValid(PRTTIMER pTimer)
+ 
+ RTDECL(int) RTTimerDestroy(PRTTIMER pTimer)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     /* It's ok to pass NULL pointer. */
+     if (pTimer == /*NIL_RTTIMER*/ NULL)
+         return VINF_SUCCESS;
+@@ -153,6 +157,8 @@ RTDECL(int) RTTimerDestroy(PRTTIMER pTimer)
+     pTimer->u32Magic++;
+     callout_stop(&pTimer->Callout);
+     RTMemFree(pTimer);
++
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+@@ -160,6 +166,7 @@ RTDECL(int) RTTimerDestroy(PRTTIMER pTimer)
+ RTDECL(int) RTTimerStart(PRTTIMER pTimer, uint64_t u64First)
+ {
+     struct timeval tv;
++    IPRT_FREEBSD_SAVE_EFL_AC();
+ 
+     if (!rtTimerIsValid(pTimer))
+         return VERR_INVALID_HANDLE;
+@@ -183,12 +190,15 @@ RTDECL(int) RTTimerStart(PRTTIMER pTimer, uint64_t u64
+     tv.tv_usec = (u64First % 1000000000) / 1000;
+     callout_reset(&pTimer->Callout, tvtohz(&tv), rtTimerFreeBSDCallback, pTimer);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+ 
+ 
+ RTDECL(int) RTTimerStop(PRTTIMER pTimer)
+ {
++    IPRT_FREEBSD_SAVE_EFL_AC();
++
+     if (!rtTimerIsValid(pTimer))
+         return VERR_INVALID_HANDLE;
+     if (pTimer->fSuspended)
+@@ -200,6 +210,7 @@ RTDECL(int) RTTimerStop(PRTTIMER pTimer)
+     pTimer->fSuspended = true;
+     callout_stop(&pTimer->Callout);
+ 
++    IPRT_FREEBSD_RESTORE_EFL_AC();
+     return VINF_SUCCESS;
+ }
+