Add leap-seconds.list to /usr/share/zoneinfo.
It was introduced in tzdata2024a and some software (such as
Hare language) expects this to be present. This version is
from tzdata2025c. I'll do a full upgrade of tzdata2025c in a
later commit.
Pointed-out-by: mneumann
nvmm(4): Extract out nvmm_x86_internal.h from nvmm_x86.h
Similar to nvmm_internal.h, extract the kernel-only bits from nvmm_x86.h
and put into a separate 'nvmm_x86_internal.h'.
nvmm(4): Enable selective CR0 write intercept in the SVM backend
Similar to the VMX backend [1], enable selective CR0 write intercept in
the SVM backend to force CR0_ET/CR0_NE to 1, and CR0_CD/CR0_NW to 0.
This addresses the severe performance issue observed in UEFI guests [2].
When booting a DragonFly installation ISO on my AMD 3700X, it previously
took 50-60 seconds from VM power-on before the kernel started loading,
and around 17 *minutes* to reach the login prompt. Even when the guest
OS was otherwise idle, the qemu process consumed 40-50% CPU.
Note that the selective CR0 write intercept is enabled only when the CPU
supports the DecodeAssists feature, as the intercept handling relies on
the decoded information provided in EXITINFO1. A diagnostic message is
printed in svm_ident() when DecodeAssists is unavailable.
Meanwhile, rename 'VMCB_CTRL_INTERCEPT_CR0_SPEC' to
'VMCB_CTRL_INTERCEPT_CR0_SEL' to better align with
'VMCB_EXITCODE_CR0_SEL_WRITE'.
[9 lines not shown]
nvmm(4): Tweak os_atomic_load_uint() to use relaxed semantic
The original NetBSD code uses atomic_load_relaxed(), so this macro
should be "atomic_load_int()", i.e., without the "acquire" semantic.
Also, the relaxed semantic suffices for the current use cases.
Add leap-seconds.list to /usr/share/zoneinfo.
It was introduced in tzdata2024a and some software (such as
Hare language) expects this to be present. This version is
from tzdata2025c. I'll do a full upgrade of tzdata2025c in a
later commit.
Pointed-out-by: mneumann
testcases/libnvmm: Add two memory tests using RIP-relative addressing
While these two tests do not exercise the RIP-relative address
calculation path in store_to_gva(), they can help validate the x86
instruction decoder.
Credit: Claude Sonnet 4.5 (https://claude.ai/)
libnvmm(3): Fix RIP-relative addressing in store_to_gva()
RIP-relative addressing uses the start address of the *next* instruction
as the base, rather than the *current* one. Adjust RIP by the
instruction length when computing the effective address.
NOTE: This bug does not affect memory assists:
- The MMIO exits handled by assist_mem_single() do not call
store_to_gva(). In addition, assist_mem_single() does not compute
RIP-relative addresses, as the effective GPA is already provided in
'exit->u.mem.gpa'.
- Other MMIO exits handled by assist_mem_double_movs() do call
store_to_gva(), but only for RSI/RDI-based operands.
Credit: Claude Sonnet 4.5 (https://claude.ai/)
fdisk(8): Fix uint32_t overflow in print_part()
dp_size is uint32_t and would overflow when is multipled by secsize
(512), and that resulted in printing a wrong partition size in MB.
While there, tweak 'Meg' to 'MB' to be clearer.
testcases/libnvmm: Add two memory tests using RIP-relative addressing
While these two tests do not exercise the RIP-relative address
calculation path in store_to_gva(), they can help validate the x86
instruction decoder.
Credit: Claude Sonnet 4.5 (https://claude.ai/)
libnvmm(3): Fix RIP-relative addressing in store_to_gva()
RIP-relative addressing uses the start address of the *next* instruction
as the base, rather than the *current* one. Adjust RIP by the
instruction length when computing the effective address.
NOTE: This bug does not affect memory assists:
- The MMIO exits handled by assist_mem_single() do not call
store_to_gva(). In addition, assist_mem_single() does not compute
RIP-relative addresses, as the effective GPA is already provided in
'exit->u.mem.gpa'.
- Other MMIO exits handled by assist_mem_double_movs() do call
store_to_gva(), but only for RSI/RDI-based operands.
Credit: Claude Sonnet 4.5 (https://claude.ai/)
kernel - Fix overflow in alist and blist code
* This code tracks swap space and large blocks of contiguous DMA memory.
* Fix overflows in array size calculations that did not take into
account terminator entries.
(a) Remove terminals from alists entirely.
(b) Account for space used by the terminator in blists.
Found-by: tuxillo / AI
kernel - Fix serious root vulnerabilities in the caps code
* The caps code was inadvertently allowing many root-only operations
to be run from user mode, particularly mount/umount ops by assuming
a root creds check that was not taking place in some of the API
calls, but was taking place in others.
* All API calls now check root creds by default unless passed the
appropriate flag.
Found-by: ivadasz (Imre Vadasz)
kernel - Fix overflow in alist and blist code
* This code tracks swap space and large blocks of contiguous DMA memory.
* Fix overflows in array size calculations that did not take into
account terminator entries.
(a) Remove terminals from alists entirely.
(b) Account for space used by the terminator in blists.
Found-by: tuxillo / AI
netstat(1): Use same width for 'Netif' column in IPv4/IPv6 cases
This utility used a narrower 'Netif' column for IPv4 than IPv6, which
looks a bit strange and is actually insufficient nowadays, since we
supports to customize the interface name. So just use the same column
width for both IPv4 and IPv6.
libstdc++: Fix unsigned wraparound in codecvt::do_length [PR105857]
When the max argument to std::codecvt<wchar_t, char, mbstate_t>::length
is SIZE_MAX/4+1 or greater the multiplication with sizeof(wchar_t) will
wrap to a small value, and the alloca call will have a buffer that's
smaller than requested. The call to mbsnrtowcs then has a buffer that is
smaller than the value passed as the buffer length. When libstdc++.so is
built with -D_FORTIFY_SOURCE=3 the mismatched buffer and length will get
detected and will abort inside Glibc.
When it doesn't abort, there's no buffer overflow because Glibc's
mbsnrtowcs has the same len * sizeof(wchar_t) calculation to determine
the size of the buffer in bytes, and that will wrap to the same small
number as the alloca argument. So luckily Glibc agrees with the caller
about the real size of the buffer, and won't overflow it.
Even when the max argument isn't large enough to wrap, it can still be
much too large to safely pass to alloca, so we should limit that. We
already have a loop that processes chunks so that we can handle null
[4 lines not shown]
nvmm(4): Expose ARCH_CAP to guest only if the host CPU supports it
* Don't expose ARCH_CAP to guest on AMD CPUs, because the ARCH_CAP
feature bit and the IA32_ARCH_CAPABILITIES MSR are Intel-specific and
unavailable on AMD systems. I decided to not follow Linux KVM, which
chose to always provide ARCH_CAP and emulate the MSR for AMD CPUs.
* Check whether the host CPU supports the ARCH_CAP feature bit and only
expose it to the guest if the host supports it.
Credit to tuxillo and Claude Opus LLM for the analyses and initial
patches.
cpu/x86_64: Fix do_cpuid() to explicitly set ECX=0
The old do_cpuid() did not initialize ECX before executing the CPUID
instruction, so the results could be incorrect when ECX contained a
non-zero garbage value.
This issue was observed on Intel CPUs when booting a FreeBSD 14.x/15.x
ISO under NVMM, where it caused a general protection fault (#GP) shortly
after the FreeBSD kernel was loaded:
qemu-system-x86_64: NVMM: Mem Assist Failed [gpa=0xbfff8]
qemu-system-x86_64: NVMM: Failed to execute a VCPU.
Abort trap (core dumped)
It occurred when NVMM tried to handle the reading of
IA32_ARCH_CAPABILITIES MSR but the second do_cpuid() returned the
incorrect results indicating that the MSR was unavailable.
The problem was first reported by mneumann in bug #3310 on 2025-11-26 [1].
[11 lines not shown]
KERN_PROC - Fix KERN_PROC_ARGS and KERN_PROC_CWD to return length if oldptr==NULL.
Sysctl handlers still have to compute the full output, even when
oldptr == NULL. This is necessary to implement the behavior documented in
sysctl(3), that it will return the required buffer length in "oldlenp", if
"oldptr" is NULL and "oldlenp" is not NULL.
procfs - Don't reset fd offset when reading regs, fpregs, or dbregs files.
* For repeated reads, we can simply use pread(2). And this way, we allow for
normal shell tooling to work correctly on these procfs files.
* This also matches the behavior on NetBSD.
