The exception vector page on m88k systems has always been the same page as

the one used by the firmware, which (at least on mvme88k) is at address zero.

This is unfortunate, since this means that NULL pointer dereferences in the
kernel are not caught, and writes cause havoc.

This behaviour was necessary to be able to use the PROM system call interface
during early bootstrap, without having to disassemble the VBR page and
update branches - which use pc-relative displacement - if we were to use
a different VBR address.

On mvme88k, change this and actually set up two VBR pages: one, over the PROM
page (except for the system call vectors), and another one in the kernel
image (which will be mapped read-only). We'll run with the PROM page until
the end of autoconf, and then switch to the kernel one, and unmap all the
PROM below it.

As a bonus, the final kernel page can use optimized data access fault
handlers, which do not have to check for faults caused by badaddr(), since
badaddr() is only used during device probe on buses which do not support
hotplug.

There are a few infrastructure collateral damage on aviion and luna88k, but
these ports do not change their behaviour yet.

15 files changed, 270 insertions, 110 deletions

diff --git a/sys/arch/aviion/aviion/locore.S b/sys/arch/aviion/aviion/locore.S
index 0bb7e917820..ef139810fb7 100644
--- a/sys/arch/aviion/aviion/locore.S
+++ b/sys/arch/aviion/aviion/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.13 2010/04/24 18:46:51 miod Exp $	*/
+/*	$OpenBSD: locore.S,v 1.14 2010/12/23 20:05:07 miod Exp $	*/
 /*
  * Copyright (c) 2005, Miodrag Vallat.
  * Copyright (c) 1998 Steve Murphree, Jr.
@@ -120,15 +120,15 @@ ASLOCAL(main_start)
 	extu	r8,  r1,  8<8>
 
 	or.u	r13, r0,  hi16(_C_LABEL(cputyp))
-	st	r8,  r13, lo16(_C_LABEL(cputyp))
-
-	bsr	_ASM_LABEL(setup_psr)
+	bsr.n	_ASM_LABEL(setup_psr)
+	 st	r8,  r13, lo16(_C_LABEL(cputyp))
 
 	/* save PROM vbr */
 	ldcr	r12, VBR
 	or.u	r13, r0,  hi16(_C_LABEL(prom_vbr))
 	st	r12, r13, lo16(_C_LABEL(prom_vbr))
 	stcr	r0,  VBR
+	FLUSH_PIPELINE
 
 #ifdef MULTIPROCESSOR
 	/*
@@ -166,9 +166,14 @@ ASLOCAL(main_start)
 	or	r3, r3, lo16(_C_LABEL(vector_list))
 #endif /* M88100 */
 2:
+	or	r4, r0, 1
 	bsr.n	_C_LABEL(vector_init)
 	 ldcr	r2, VBR
 
+#ifdef MULTIPROCESSOR
+	bsr	_C_LABEL(atomic_init)
+#endif
+
 	/*
 	 * aviion_bootstrap(), among other things, clears proc0's u area.
 	 * We are still using the interrupt stack here, thus we are not
@@ -235,9 +240,8 @@ GLOBAL(secondary_start)
 	 */
 
 	or.u	r31, r0,  hi16(_ASM_LABEL(slavestack_end))
-	or	r31, r31, lo16(_ASM_LABEL(slavestack_end))
-
-	bsr	_ASM_LABEL(setup_psr)
+	bsr.n	_ASM_LABEL(setup_psr)
+	 or	r31, r31, lo16(_ASM_LABEL(slavestack_end))
 
 	stcr	r0,  VBR	/* set Vector Base Register to 0, ALWAYS! */
 	FLUSH_PIPELINE
diff --git a/sys/arch/aviion/include/prom.h b/sys/arch/aviion/include/prom.h
index 1783cb20ee2..f3280b146c2 100644
--- a/sys/arch/aviion/include/prom.h
+++ b/sys/arch/aviion/include/prom.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: prom.h,v 1.3 2010/04/24 18:46:55 miod Exp $	*/
+/*	$OpenBSD: prom.h,v 1.4 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Copyright (c) 2006, Miodrag Vallat.
  *
@@ -82,6 +82,4 @@ void	scm_putcrlf(void);
 __dead void scm_reboot(const char *);
 u_int	scm_sysid(void);
 
-extern u_int32_t scmvec[2], osvec[2];		/* SCM trap vector copies */
-
 #endif /* __AVIION_PROM_H__ */
diff --git a/sys/arch/luna88k/luna88k/locore.S b/sys/arch/luna88k/luna88k/locore.S
index d0291c72734..4f814a05920 100644
--- a/sys/arch/luna88k/luna88k/locore.S
+++ b/sys/arch/luna88k/luna88k/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.20 2007/12/22 17:14:39 miod Exp $	*/
+/*	$OpenBSD: locore.S,v 1.21 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Copyright (c) 1998 Steve Murphree, Jr.
  * Copyright (c) 1996 Nivas Madhur
@@ -153,7 +153,7 @@ ASLOCAL(main_init)
 
 	or.u	r3, r0, hi16(_C_LABEL(vector_list))
 	or	r3, r3, lo16(_C_LABEL(vector_list))
-
+	or	r4, r0, 1
 	bsr.n	_C_LABEL(vector_init)
 	 ldcr	r2, VBR
 
diff --git a/sys/arch/m88k/include/cpu.h b/sys/arch/m88k/include/cpu.h
index a953169f5ff..aecac92f45b 100644
--- a/sys/arch/m88k/include/cpu.h
+++ b/sys/arch/m88k/include/cpu.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.h,v 1.50 2010/09/28 20:27:55 miod Exp $ */
+/*	$OpenBSD: cpu.h,v 1.51 2010/12/23 20:05:08 miod Exp $ */
 /*
  * Copyright (c) 1996 Nivas Madhur
  * Copyright (c) 1992, 1993
@@ -276,6 +276,8 @@ void	signotify(struct proc *);
 void	softipi(void);
 
 int	badaddr(vaddr_t addr, int size);
+void	set_vbr(register_t);
+extern register_t kernel_vbr;
 
 #endif /* _KERNEL */
 #endif /* __M88K_CPU_H__ */
diff --git a/sys/arch/m88k/m88k/eh_common.S b/sys/arch/m88k/m88k/eh_common.S
index b9d8cfc5aa1..b8bce6aeb0e 100644
--- a/sys/arch/m88k/m88k/eh_common.S
+++ b/sys/arch/m88k/m88k/eh_common.S
@@ -1,4 +1,4 @@
-/*   $OpenBSD: eh_common.S,v 1.54 2009/03/15 20:39:53 miod Exp $	*/
+/*   $OpenBSD: eh_common.S,v 1.55 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Mach Operating System
  * Copyright (c) 1993-1991 Carnegie Mellon University
@@ -386,10 +386,14 @@ GLOBAL(instruction_access_handler)
  * data access exception handler --
  *  See badaddr() below for info about Data_Precheck.
  */
-GLOBAL(data_exception_handler)
+GLOBAL(data_exception_handler_bootstrap)
 	PREP88100("data", 3,, M88100_Data_Precheck)
 	/* No need to call m88100_trap(T_DATAFLT) as PREP will do this for us */
 	br	_ASM_LABEL(check_ast)
+GLOBAL(data_exception_handler)
+	PREP88100("data", 3,,)
+	/* No need to call m88100_trap(T_DATAFLT) as PREP will do this for us */
+	br	_ASM_LABEL(check_ast)
 
 /* misaligned access exception handler */
 GLOBAL(misaligned_handler)
@@ -723,7 +727,7 @@ ASLOCAL(m88110_ignore_data_exception)
 #endif /* M88110 */
 
 /*
- * extern boolean_t badaddr(vaddr_t addr, u_int len)
+ * extern int badaddr(vaddr_t addr, int len)
  *
  * Returns true (non-zero) if the given LEN bytes starting at ADDR are
  * not all currently accessible by the kernel.
@@ -764,7 +768,6 @@ GLOBAL(badaddr)
 	sub	r6,  r3, 4
 	bcnd.n	ne0, r6, _ASM_LABEL(badaddr__maybe_halfword)
 	 stcr	r5,  SR1
-	FLUSH_PIPELINE
 
 	/*
 	 * It's a bad address if it's misaligned.
@@ -780,6 +783,7 @@ GLOBAL(badaddr)
 	 *
 	 * If there is no fault, execution just continues as normal.
 	 */
+	FLUSH_PIPELINE
 	ld	r5, r2, 0
 	FLUSH_PIPELINE
 	br.n	_ASM_LABEL(badaddr__return)
@@ -1542,11 +1546,16 @@ GLOBAL(m88110_instruction_access_handler)
  * data access exception handler --
  *  See badaddr() below for info about Data_Precheck.
  */
-GLOBAL(m88110_data_exception_handler)
+GLOBAL(m88110_data_exception_handler_bootstrap)
 	PREP88110("data", 3, M88110_Data_Precheck)
 	or	r2, r0, T_DATAFLT
 	or	r3, r0, r30
 	XCALL(_C_LABEL(m88110_trap), _ASM_LABEL(check_ast))
+GLOBAL(m88110_data_exception_handler)
+	PREP88110("data", 3,)
+	or	r2, r0, T_DATAFLT
+	or	r3, r0, r30
+	XCALL(_C_LABEL(m88110_trap), _ASM_LABEL(check_ast))
 
 /* misaligned access exception handler */
 GLOBAL(m88110_misaligned_handler)
diff --git a/sys/arch/m88k/m88k/m88k_machdep.c b/sys/arch/m88k/m88k/m88k_machdep.c
index db3fc2a8499..89ddb045343 100644
--- a/sys/arch/m88k/m88k/m88k_machdep.c
+++ b/sys/arch/m88k/m88k/m88k_machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: m88k_machdep.c,v 1.50 2009/04/19 17:56:13 miod Exp $	*/
+/*	$OpenBSD: m88k_machdep.c,v 1.51 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Copyright (c) 1998, 1999, 2000, 2001 Steve Murphree, Jr.
  * Copyright (c) 1996 Nivas Madhur
@@ -83,7 +83,8 @@ typedef struct {
 void	dumpconf(void);
 void	dumpsys(void);
 void	regdump(struct trapframe *f);
-void	vector_init(m88k_exception_vector_area *, u_int32_t *);
+void	vector_init(m88k_exception_vector_area *, u_int32_t *, int);
+void	atomic_init(void);
 
 /*
  * CMMU and CPU variables
@@ -393,7 +394,7 @@ spl0()
 #define NO_OP 		0xf4005800	/* "or r0, r0, r0" */
 
 #define BRANCH(FROM, TO) \
-	(EMPTY_BR | ((vaddr_t)(TO) - (vaddr_t)(FROM)) >> 2)
+	(EMPTY_BR | ((((vaddr_t)(TO) - (vaddr_t)(FROM)) >> 2) & 0x03ffffff))
 
 #define SET_VECTOR_88100(NUM, VALUE) \
 	do { \
@@ -408,7 +409,7 @@ spl0()
 	} while (0)
 
 /*
- * vector_init(vector, vector_init_list)
+ * vector_init(vector, vector_init_list, bootstrap)
  *
  * This routine sets up the m88k vector table for the running processor,
  * as well as the atomic operation routines for multiprocessor kernels.
@@ -419,11 +420,12 @@ spl0()
  * next trap handler, as documented in its Errata. Processing trap #511
  * would then fall into the next page, unless the address computation wraps,
  * or software traps can not trigger the issue - the Errata does not provide
- * more detail. And since the MVME BUG does not add an extra NOP after their
+ * more detail. And since the MVME BUG does not add an extra NOP after its
  * VBR page, I'll assume this is safe for now -- miod
  */
 void
-vector_init(m88k_exception_vector_area *vbr, u_int32_t *vector_init_list)
+vector_init(m88k_exception_vector_area *vbr, u_int32_t *vector_init_list,
+    int bootstrap)
 {
 	u_int num;
 	u_int32_t vec;
@@ -442,6 +444,9 @@ vector_init(m88k_exception_vector_area *vbr, u_int32_t *vector_init_list)
 		for (num = 0; (vec = vector_init_list[num]) != 0; num++)
 			SET_VECTOR_88110(num, vec);
 
+		if (bootstrap)
+			SET_VECTOR_88110(0x03, vector_init_list[num + 1]);
+
 		for (; num < 512; num++)
 			SET_VECTOR_88110(num, m88110_sigsys);
 
@@ -469,6 +474,9 @@ vector_init(m88k_exception_vector_area *vbr, u_int32_t *vector_init_list)
 		for (num = 0; (vec = vector_init_list[num]) != 0; num++)
 			SET_VECTOR_88100(num, vec);
 
+		if (bootstrap)
+			SET_VECTOR_88100(0x03, vector_init_list[num + 1]);
+
 		for (; num < 512; num++)
 			SET_VECTOR_88100(num, sigsys);
 
@@ -485,16 +493,20 @@ vector_init(m88k_exception_vector_area *vbr, u_int32_t *vector_init_list)
 		break;
 #endif
 	}
+}
 
 #ifdef MULTIPROCESSOR
-	/*
-	 * Setting up the proper atomic operation code is not really
-	 * related to vector initialization, but is crucial enough to
-	 * be worth doing right now, rather than too late in the C code.
-	 *
-	 * This is only necessary for SMP kernels with 88100 and 88110
-	 * support compiled-in, which happen to run on 88100.
-	 */
+/*
+ * void atomic_init(void);
+ *
+ * This routine sets up proper atomic operation code for SMP kernels
+ * with both 88100 and 88110 support compiled-in. This is crucial enough
+ * to have to be done as early as possible.
+ * This is among the first C code to run, before anything is initialized.
+ */
+void
+atomic_init()
+{
 #if defined(M88100) && defined(M88110)
 	if (cputyp == CPU_88100) {
 		extern uint32_t __atomic_lock[];
@@ -517,8 +529,8 @@ vector_init(m88k_exception_vector_area *vbr, u_int32_t *vector_init_list)
 				*d++ = *s++;
 	}
 #endif	/* M88100 && M88110 */
-#endif	/* MULTIPROCESSOR */
 }
+#endif	/* MULTIPROCESSOR */
 
 #ifdef MULTIPROCESSOR
 
diff --git a/sys/arch/m88k/m88k/subr.S b/sys/arch/m88k/m88k/subr.S
index f4fd3f01f19..98c5733911b 100644
--- a/sys/arch/m88k/m88k/subr.S
+++ b/sys/arch/m88k/m88k/subr.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: subr.S,v 1.18 2010/04/20 20:28:18 miod Exp $	*/
+/* $OpenBSD: subr.S,v 1.19 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Mach Operating System
  * Copyright (c) 1993-1992 Carnegie Mellon University
@@ -1193,3 +1193,37 @@ ASENTRY(setup_psr)
 	FLUSH_PIPELINE
 
 	jmp	r1
+
+/*
+ * Update the VBR value.
+ * This needs to be done with interrupts and shadowing disabled.
+ */
+GLOBAL(set_vbr)
+	ldcr	r3, PSR
+	set	r4, r3, 1<PSR_INTERRUPT_DISABLE_BIT>
+	set	r4, r4, 1<PSR_SHADOW_FREEZE_BIT>
+	stcr	r4, PSR
+	FLUSH_PIPELINE
+
+	stcr	r2, VBR
+	FLUSH_PIPELINE
+
+#if defined(M88100) && defined(M88110)
+	ldcr	r2,  PID
+	extu	r5,  r2, 8<8>
+	cmp	r4, r5, CPU_88110
+	bb1	eq, r4, 1f
+#endif
+#ifdef M88100
+	/* 88100 */
+	stcr	r3, PSR
+	FLUSH_PIPELINE
+	jmp	r1
+#endif
+#ifdef M88110
+1:
+	/* 88110 */
+	stcr	r1, EXIP
+	stcr	r3, EPSR
+	RTE
+#endif
diff --git a/sys/arch/m88k/m88k/vectors_88100.S b/sys/arch/m88k/m88k/vectors_88100.S
index b1019a8a58c..77f7dcfa828 100644
--- a/sys/arch/m88k/m88k/vectors_88100.S
+++ b/sys/arch/m88k/m88k/vectors_88100.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vectors_88100.S,v 1.3 2006/05/08 14:03:35 miod Exp $	*/
+/*	$OpenBSD: vectors_88100.S,v 1.4 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Mach Operating System
  * Copyright (c) 1991, 1992 Carnegie Mellon University
@@ -86,4 +86,5 @@ GLOBAL(vector_list)
 	VECTOR(entry)				/* 84 */
 #endif
 	word	0
+	VECTOR(data_exception_handler_bootstrap)
 
diff --git a/sys/arch/m88k/m88k/vectors_88110.S b/sys/arch/m88k/m88k/vectors_88110.S
index de912a5ce40..e6a402b3c0d 100644
--- a/sys/arch/m88k/m88k/vectors_88110.S
+++ b/sys/arch/m88k/m88k/vectors_88110.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vectors_88110.S,v 1.5 2007/12/02 21:32:08 miod Exp $	*/
+/*	$OpenBSD: vectors_88110.S,v 1.6 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Mach Operating System
  * Copyright (c) 1991, 1992 Carnegie Mellon University
@@ -86,3 +86,4 @@ GLOBAL(m88110_vector_list)
 	VECTOR(m88110_entry)			/* 84 */
 #endif
 	word	0
+	VECTOR(m88110_data_exception_handler_bootstrap)
diff --git a/sys/arch/mvme88k/dev/bugio.c b/sys/arch/mvme88k/dev/bugio.c
index 98f227aa600..c4ab88e8f96 100644
--- a/sys/arch/mvme88k/dev/bugio.c
+++ b/sys/arch/mvme88k/dev/bugio.c
@@ -1,5 +1,29 @@
-/*	$OpenBSD: bugio.c,v 1.18 2007/12/15 19:35:50 miod Exp $ */
-/*  Copyright (c) 1998 Steve Murphree, Jr. */
+/*	$OpenBSD: bugio.c,v 1.19 2010/12/23 20:05:08 miod Exp $ */
+/*
+ * Copyright (c) 2006, 2010, Miodrag Vallat.
+ * Copyright (c) 1998 Steve Murphree, Jr.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -11,11 +35,6 @@
 register_t ossr3;
 register_t bugsr3;
 
-unsigned long bugvec[32], sysbugvec[32];
-
-void bug_vector(void);
-void sysbug_vector(void);
-
 #ifdef MULTIPROCESSOR
 #include <sys/lock.h>
 __cpu_simple_lock_t bug_lock = __SIMPLELOCK_UNLOCKED;
@@ -27,39 +46,15 @@ __cpu_simple_lock_t bug_lock = __SIMPLELOCK_UNLOCKED;
 #endif
 
 #define MVMEPROM_CALL(x)						\
-	__asm__ __volatile__ ("or r9,r0," __STRING(x));			\
-	__asm__ __volatile__ ("tb0 0,r0,496" :::			\
-	    "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8",		\
-	    "r9", "r10", "r11", "r12", "r13")
-
-void
-bug_vector()
-{
-	unsigned long *vbr;
-	int i;
-
-	__asm__ __volatile__ ("ldcr %0, cr7" : "=r" (vbr));
-	for (i = 0; i < 32; i++)
-		vbr[2 * MVMEPROM_VECTOR + i] = bugvec[i];
-}
-
-void
-sysbug_vector()
-{
-	unsigned long *vbr;
-	int i;
-
-	__asm__ __volatile__ ("ldcr %0, cr7" : "=r" (vbr));
-	for (i = 0; i < 32; i++)
-		vbr[2 * MVMEPROM_VECTOR + i] = sysbugvec[i];
-}
+	__asm__ __volatile__ ("or r9,r0," __STRING(x) "; tb0 0,r0,496"	\
+	    :::	"r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8",		\
+	        "r9", "r10", "r11", "r12", "r13", "memory")
 
 #define	BUGCTXT()							\
 {									\
 	BUG_LOCK();							\
 	psr = get_psr();						\
 	set_psr(psr | PSR_IND);			/* paranoia */		\
-	bug_vector();							\
 	__asm__ __volatile__ ("ldcr %0, cr20" : "=r" (ossr3));		\
 	__asm__ __volatile__ ("stcr %0, cr20" :: "r"(bugsr3));		\
 }
@@ -68,7 +63,6 @@ sysbug_vector()
 {									\
 	__asm__ __volatile__ ("ldcr %0, cr20" : "=r" (bugsr3));		\
 	__asm__ __volatile__ ("stcr %0, cr20" :: "r"(ossr3));		\
-	sysbug_vector();						\
 	set_psr(psr);							\
 	BUG_UNLOCK();							\
 }
@@ -78,6 +72,11 @@ bugpcrlf(void)
 {
 	u_int psr;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
 	MVMEPROM_CALL(MVMEPROM_OUTCRLF);
 	OSCTXT();
@@ -95,6 +94,11 @@ buginchr(void)
 	u_int psr;
 	int ret;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
 	MVMEPROM_CALL(MVMEPROM_INCHR);
 	__asm__ __volatile__ ("or %0,r0,r2" : "=r" (ret));
@@ -107,6 +111,11 @@ bugoutchr(int c)
 {
 	u_int psr;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
 	__asm__ __volatile__ ("or r2,r0,%0" : : "r" (c));
 	MVMEPROM_CALL(MVMEPROM_OUTCHR);
@@ -118,6 +127,11 @@ bugreturn(void)
 {
 	u_int psr;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
 	MVMEPROM_CALL(MVMEPROM_EXIT);
 	OSCTXT();
@@ -129,6 +143,11 @@ bugbrdid(struct mvmeprom_brdid *id)
 	u_int psr;
 	struct mvmeprom_brdid *ptr;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
 	MVMEPROM_CALL(MVMEPROM_GETBRDID);
 	__asm__ __volatile__ ("or %0,r0,r2" : "=r" (ptr));
@@ -142,6 +161,11 @@ bugdiskrd(struct mvmeprom_dskio *dio)
 {
 	u_int psr;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
 	__asm__ __volatile__ ("or r2, r0, %0" : : "r" (dio));
 	MVMEPROM_CALL(MVMEPROM_DSKRD);
@@ -159,9 +183,14 @@ spin_cpu(cpuid_t cpu, vaddr_t address)
 	u_int psr;
 	int ret;
 
+#ifdef DIAGNOSTIC
+	if (!cold)
+		panic("%s: BUG calls are forbidden at this point", __func__);
+#endif
+
 	BUGCTXT();
-	__asm__ __volatile__ ("or r2, r0, %0" : : "r" (cpu));
-	__asm__ __volatile__ ("or r3, r0, %0" : : "r" (address));
+	__asm__ __volatile__ ("or r2, r0, %0; or r3, r0, %1" ::
+	    "r" (cpu), "r" (address));
 	MVMEPROM_CALL(MVMEPROM_FORKMPU);
 	__asm__ __volatile__ ("or %0,r0,r2" : "=r" (ret));
 	OSCTXT();
diff --git a/sys/arch/mvme88k/dev/mainbus.c b/sys/arch/mvme88k/dev/mainbus.c
index 8e4f7f26fc3..8e74b5cc56d 100644
--- a/sys/arch/mvme88k/dev/mainbus.c
+++ b/sys/arch/mvme88k/dev/mainbus.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mainbus.c,v 1.24 2009/03/05 21:55:12 miod Exp $ */
+/*	$OpenBSD: mainbus.c,v 1.25 2010/12/23 20:05:08 miod Exp $ */
 /*
  * Copyright (c) 1998 Steve Murphree, Jr.
  * Copyright (c) 2004, Miodrag Vallat.
@@ -325,9 +325,7 @@ mainbus_attach(struct device *parent, struct device *self, void *args)
 	 * try to issue BUG calls (i.e. when printing their information
 	 * on console), so we postpone this to the end of autoconf.
 	 */
-	if (brdtyp == BRD_188)
-		startuphook_establish(cpu_hatch_secondary_processors, NULL);
-	else
+	if (brdtyp != BRD_188)
 		cpu_hatch_secondary_processors(NULL);
 #endif
 
diff --git a/sys/arch/mvme88k/include/prom.h b/sys/arch/mvme88k/include/prom.h
index 8caba0743bb..750fd8a54ff 100644
--- a/sys/arch/mvme88k/include/prom.h
+++ b/sys/arch/mvme88k/include/prom.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: prom.h,v 1.17 2007/12/15 19:35:52 miod Exp $ */
+/*	$OpenBSD: prom.h,v 1.18 2010/12/23 20:05:08 miod Exp $ */
 /*
  * Copyright (c) 1998 Steve Murphree, Jr.
  * Copyright (c) 1996 Nivas Madhur
@@ -168,8 +168,6 @@ struct mvmeprom_dskio {
 };
 #define MVMEPROM_BLOCK_SIZE	256
 
-extern unsigned long bugvec[32], sysbugvec[32];	/* BUG trap vector copies */
-
 #endif	/* _LOCORE */
 
 #ifndef RB_NOSYM
diff --git a/sys/arch/mvme88k/mvme88k/autoconf.c b/sys/arch/mvme88k/mvme88k/autoconf.c
index da12ef83d1e..a1497190dad 100644
--- a/sys/arch/mvme88k/mvme88k/autoconf.c
+++ b/sys/arch/mvme88k/mvme88k/autoconf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: autoconf.c,v 1.46 2010/11/18 21:13:19 miod Exp $	*/
+/*	$OpenBSD: autoconf.c,v 1.47 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Copyright (c) 1998 Steve Murphree, Jr.
  * Copyright (c) 1996 Nivas Madhur
@@ -40,8 +40,11 @@
 #include <sys/disklabel.h>
 #include <sys/kernel.h>
 
+#include <uvm/uvm.h>
+
 #include <machine/asm_macro.h>   /* enable/disable interrupts */
 #include <machine/autoconf.h>
+#include <machine/bugio.h>
 #include <machine/cpu.h>
 #include <machine/vmparam.h>
 
@@ -71,16 +74,12 @@ struct device *bootdv;	/* set by device drivers (if found) */
 void
 cpu_configure()
 {
+	extern void cpu_hatch_secondary_processors(void *);
 	softintr_init();
 
 	if (config_rootfound("mainbus", "mainbus") == 0)
 		panic("no mainbus found");
 
-	/*
-	 * Turn external interrupts on.
-	 */
-	set_psr(get_psr() & ~PSR_IND);
-	spl0();
 
 	/*
 	 * Finally switch to the real console driver,
@@ -89,7 +88,35 @@ cpu_configure()
 	cn_tab = NULL;
 	cninit();
 
+#ifdef MULTIPROCESSOR
+	/*
+	 * Spin up the other processors, but do not give them work to
+	 * do yet. This is normally done when attaching mainbus, but
+	 * on MVME188 boards, the system hangs if secondary processors
+	 * try to issue BUG calls (i.e. when printing their information
+	 * on console), so this has been postponed until now.
+	 */
+	if (brdtyp == BRD_188)
+		cpu_hatch_secondary_processors(NULL);
+#endif
+
+	/* NO BUG CALLS FROM NOW ON */
+
+	/*
+	 * Switch to our final trap vectors, and unmap whatever is below
+	 * the kernel.
+	 */
+	set_vbr(kernel_vbr);
+	pmap_kremove(0, (vsize_t)kernel_vbr);
+	pmap_update(pmap_kernel());
+
 	cold = 0;
+
+	/*
+	 * Turn external interrupts on.
+	 */
+	set_psr(get_psr() & ~PSR_IND);
+	spl0();
 }
 
 void
diff --git a/sys/arch/mvme88k/mvme88k/locore.S b/sys/arch/mvme88k/mvme88k/locore.S
index ae4bf00e317..6551081a01c 100644
--- a/sys/arch/mvme88k/mvme88k/locore.S
+++ b/sys/arch/mvme88k/mvme88k/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.66 2009/09/20 19:17:47 miod Exp $	*/
+/*	$OpenBSD: locore.S,v 1.67 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Copyright (c) 2005, Miodrag Vallat.
  * Copyright (c) 1998 Steve Murphree, Jr.
@@ -90,6 +90,33 @@ ASGLOBAL(start)
 	br	_ASM_LABEL(main_start)
 
 	/*
+	 * Room for the kernel (post-autoconf) VBR page. This is allocating
+	 * a bit too much (since kernel_text starts after the a.out header),
+	 * but it's a waste we can afford.
+	 * Note this page is in kernel text, in order to be write-protected
+	 * by pmap_bootstrap().
+	 */
+#ifdef __ELF__
+	space	PAGE_SIZE - 4 * 4
+#else
+	space	PAGE_SIZE - 4 * 4 - 0x20
+#endif
+
+#ifdef M88100
+	/*
+	 * The 88100 may execute the first instruction of the next trap
+	 * handler, as documented in its Errata. Processing trap #511
+	 * would then fall into the next page, unless the address computation
+	 * wraps, or software traps are exempt from the issue - the Errata
+	 * does not provide more detail.
+	 * Although the MVME BUG does not add an extra NOP after its VBR page,
+	 * it is cheap to add an extra NOP for safety.
+	 */
+	NOP
+#endif
+
+
+	/*
 	 * Startup code for main processor.
 	 */
 ASLOCAL(main_start)
@@ -126,12 +153,9 @@ ASLOCAL(main_start)
 	ldcr	r1,  PID
 	extu	r8,  r1, 8<8>
 	or.u	r13, r0,  hi16(_C_LABEL(cputyp))
-	st	r8,  r13, lo16(_C_LABEL(cputyp))
-
-	bsr	_ASM_LABEL(setup_psr)
 
-	stcr	r0,  VBR	/* set Vector Base Register to 0, ALWAYS! */
-	FLUSH_PIPELINE
+	bsr.n	_ASM_LABEL(setup_psr)
+	 st	r8,  r13, lo16(_C_LABEL(cputyp))
 
 #ifdef MULTIPROCESSOR
 	/*
@@ -154,6 +178,7 @@ ASLOCAL(main_start)
 	or.u	r31, r0,  hi16(_ASM_LABEL(initstack_end))
 	or	r31, r31, lo16(_ASM_LABEL(initstack_end))
 
+	/* ...and to our exception vectors */
 #ifdef M88110
 #ifdef M88100
 	cmp	r2, r8, CPU_88110
@@ -172,6 +197,10 @@ ASLOCAL(main_start)
 	bsr.n	_C_LABEL(mvme88k_vector_init)
 	 ldcr	r2, VBR
 
+#ifdef MULTIPROCESSOR
+	bsr	_C_LABEL(atomic_init)
+#endif
+
 	/*
 	 * mvme_bootstrap(), among other things, clears proc0's u area.
 	 * We are still using the interrupt stack here, thus we are not
@@ -198,12 +227,13 @@ ASLOCAL(main_start)
 	 */
 GLOBAL(secondary_start)
 	or.u	r31, r0,  hi16(_ASM_LABEL(slavestack_end))
-	or	r31, r31, lo16(_ASM_LABEL(slavestack_end))
+	bsr.n	_ASM_LABEL(setup_psr)
+	 or	r31, r31, lo16(_ASM_LABEL(slavestack_end))
 
-	bsr	_ASM_LABEL(setup_psr)
-
-	stcr	r0,  VBR	/* set Vector Base Register to 0, ALWAYS! */
-	FLUSH_PIPELINE
+	/*
+	 * We expect secondary processors to start running with the same 
+	 * VBR value as the primary one.
+	 */
 
 	/*
 	 * Have curcpu() point at the dummy cpuinfo structure,
@@ -348,6 +378,7 @@ ASLOCAL(slavestack_end)
 	.align	PAGE_SIZE
 ASLOCAL(u0)
 	space	USPACE
+
 GLOBAL(proc0paddr)
 	word	_ASM_LABEL(u0)	/*  KVA of proc0 uarea */
 
diff --git a/sys/arch/mvme88k/mvme88k/machdep.c b/sys/arch/mvme88k/mvme88k/machdep.c
index 1b5dd8eb083..a9aa744769b 100644
--- a/sys/arch/mvme88k/mvme88k/machdep.c
+++ b/sys/arch/mvme88k/mvme88k/machdep.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: machdep.c,v 1.238 2010/09/20 06:33:47 matthew Exp $	*/
+/* $OpenBSD: machdep.c,v 1.239 2010/12/23 20:05:08 miod Exp $	*/
 /*
  * Copyright (c) 1998, 1999, 2000, 2001 Steve Murphree, Jr.
  * Copyright (c) 1996 Nivas Madhur
@@ -99,7 +99,7 @@ void	dumpsys(void);
 int	getcpuspeed(struct mvmeprom_brdid *);
 void	identifycpu(void);
 void	mvme_bootstrap(void);
-void	mvme88k_vector_init(u_int32_t *, u_int32_t *);
+void	mvme88k_vector_init(uint32_t *, uint32_t *);
 void	myetheraddr(u_char *);
 void	savectx(struct pcb *);
 void	secondary_main(void);
@@ -116,6 +116,8 @@ extern void	m197_bootstrap(void);
 extern vaddr_t	m197_memsize(void);
 extern void	m197_startup(void);
 
+extern int kernelstart;
+register_t kernel_vbr;
 intrhand_t intr_handlers[NVMEINTR];
 
 /* board dependent pointers */
@@ -431,7 +433,9 @@ cpu_startup()
 __dead void
 _doboot()
 {
+	cold = 0;
 	cmmu_shutdown();
+	set_vbr(0);		/* restore BUG VBR */
 	bugreturn();
 	/*NOTREACHED*/
 	for (;;);		/* appease gcc */
@@ -712,7 +716,6 @@ secondary_main()
 	microuptime(&ci->ci_schedstate.spc_runtime);
 	ci->ci_curproc = NULL;
 	ci->ci_randseed = random();
-	SET(ci->ci_flags, CIF_ALIVE);
 
 	__cpu_simple_unlock(&cpu_hatch_mutex);
 
@@ -720,9 +723,14 @@ secondary_main()
 	__cpu_simple_lock(&cpu_boot_mutex);
 	__cpu_simple_unlock(&cpu_boot_mutex);
 
+	set_vbr(kernel_vbr);
+
 	spl0();
 	SCHED_LOCK(s);
 	set_psr(get_psr() & ~PSR_IND);
+
+	SET(ci->ci_flags, CIF_ALIVE);
+
 	cpu_switchto(NULL, sched_chooseproc());
 }
 
@@ -880,20 +888,29 @@ myetheraddr(cp)
 }
 
 void
-mvme88k_vector_init(u_int32_t *vbr, u_int32_t *vectors)
+mvme88k_vector_init(uint32_t *bugvbr, uint32_t *vectors)
 {
-	extern void vector_init(u_int32_t *, u_int32_t *);	/* gross */
-	int i;
+	extern vaddr_t vector_init(uint32_t *, uint32_t *, int); /* gross */
+	unsigned long bugvec[32];
+	uint i;
 
-	/* Save BUG vector */
+	/*
+	 * Set up bootstrap vectors, overwriting the existing BUG vbr
+	 * page. This allows us to keep the BUG system call vectors.
+	 */
+
+	for (i = 0; i < 16 * 2; i++)
+		bugvec[i] = bugvbr[MVMEPROM_VECTOR * 2 + i];
+	vector_init(bugvbr, vectors, 1);
 	for (i = 0; i < 16 * 2; i++)
-		bugvec[i] = vbr[MVMEPROM_VECTOR * 2 + i];
+		bugvbr[MVMEPROM_VECTOR * 2 + i] = bugvec[i];
 
-	vector_init(vbr, vectors);
+	/*
+	 * Set up final vectors.
+	 */
 
-	/* Save new BUG vector */
-	for (i = 0; i < 16 * 2; i++)
-		sysbugvec[i] = vbr[MVMEPROM_VECTOR * 2 + i];
+	kernel_vbr = trunc_page((vaddr_t)&kernelstart);
+	vector_init((uint32_t *)kernel_vbr, vectors, 0);
 }
 
 /*
@@ -903,7 +920,6 @@ mvme88k_vector_init(u_int32_t *vbr, u_int32_t *vectors)
 void
 mvme_bootstrap()
 {
-	extern int kernelstart;
 	extern struct consdev *cn_tab;
 	struct mvmeprom_brdid brdid;
 #ifndef MULTIPROCESSOR