Index: UPDATING
===================================================================
--- UPDATING	(revision 326181)
+++ UPDATING	(working copy)
@@ -51,6 +51,13 @@
 
 ****************************** SPECIAL WARNING: ******************************
 
+20171125:
+	PowerPC users must update loader(8) by rebuilding world before
+	installing a new kernel, as the protocol connecting them has
+	changed. Without the update, loader metadata will not be passed
+	successfully to the kernel and users will have to enter their
+	root partition as the kernel mountroot prompt to continue booting.
+
 201711xx:
 	The LOADER_FIREWIRE_SUPPORT build variable as been renamed to
 	WITH/OUT_LOADER_FIREWIRE. LOADER_{NO_,}GELI_SUPPORT has been renamed
Index: sys/powerpc/aim/locore32.S
===================================================================
--- sys/powerpc/aim/locore32.S	(revision 326181)
+++ sys/powerpc/aim/locore32.S	(working copy)
@@ -79,7 +79,7 @@
 	/* Set up temporary stack pointer */
 	lwz	%r1,8(%r30)
 	add	%r1,%r1,%r30
-	addi	%r1,%r1,(8+TMPSTKSZ-32)
+	addi	%r1,%r1,(8+TMPSTKSZ-36)
 
 	/* Relocate self */
 	stw	%r3,16(%r1)
@@ -86,6 +86,7 @@
 	stw	%r4,20(%r1)
 	stw	%r5,24(%r1)
 	stw	%r6,28(%r1)
+	stw	%r7,32(%r1)
 
 	lwz	%r3,0(%r30) /* _DYNAMIC in %r3 */
 	add	%r3,%r3,%r30
@@ -99,6 +100,7 @@
 	lwz	%r4,20(%r1)
 	lwz	%r5,24(%r1)
 	lwz	%r6,28(%r1)
+	lwz	%r7,32(%r1)
 
 	/* MD setup */
 	bl	powerpc_init
Index: sys/powerpc/aim/locore64.S
===================================================================
--- sys/powerpc/aim/locore64.S	(revision 326181)
+++ sys/powerpc/aim/locore64.S	(working copy)
@@ -73,6 +73,7 @@
  * r4: ignored
  * r5: OF client interface pointer (or zero)
  * r6: Loader metadata pointer (or zero)
+ * r7: Magic cookie (0xfb5d104d) to indicate that r6 has loader metadata
  */
 	.text
 ASENTRY_NOPROF(__start)
@@ -108,6 +109,8 @@
 	std	%r4,56(%r1)
 	std	%r5,64(%r1)
 	std	%r6,72(%r1)
+	std	%r7,80(%r1)
+
 	bl	1f
 	.llong _DYNAMIC-.
 1:	mflr	%r3
@@ -120,6 +123,7 @@
 	ld	%r4,56(%r1)
 	ld	%r5,64(%r1)
 	ld	%r6,72(%r1)
+	ld	%r7,80(%r1)
 
 	/* Begin CPU init */
 	mr	%r4,%r2 /* Replace ignored r4 with tocbase for trap handlers */
Index: sys/powerpc/booke/booke_machdep.c
===================================================================
--- sys/powerpc/booke/booke_machdep.c	(revision 326181)
+++ sys/powerpc/booke/booke_machdep.c	(working copy)
@@ -200,7 +200,8 @@
 	    ("Handler " #handler " too far from interrupt vector base")); \
 	mtspr(ivor, (uintptr_t)(&handler) & 0xffffUL);
 
-uintptr_t powerpc_init(vm_offset_t fdt, vm_offset_t, vm_offset_t, void *mdp);
+uintptr_t powerpc_init(vm_offset_t fdt, vm_offset_t, vm_offset_t, void *mdp,
+    vm_offset_t mdp_cookie);
 void booke_cpu_init(void);
 
 void
@@ -346,7 +347,11 @@
 		break;
 	}
 
-	ret = powerpc_init(dtbp, 0, 0, mdp);
+	/*
+	 * Last element is a magic cookie that indicates that the metadata
+	 * pointer is meaningful.
+	 */
+	ret = powerpc_init(dtbp, 0, 0, mdp, (mdp == NULL) ? 0 : 0xfb5d104d);
 
 	/* Enable caches */
 	booke_enable_l1_cache();
Index: sys/powerpc/powerpc/machdep.c
===================================================================
--- sys/powerpc/powerpc/machdep.c	(revision 326181)
+++ sys/powerpc/powerpc/machdep.c	(working copy)
@@ -154,7 +154,8 @@
 SYSCTL_INT(_machdep, CPU_CACHELINE, cacheline_size,
 	   CTLFLAG_RD, &cacheline_size, 0, "");
 
-uintptr_t	powerpc_init(vm_offset_t, vm_offset_t, vm_offset_t, void *);
+uintptr_t	powerpc_init(vm_offset_t, vm_offset_t, vm_offset_t, void *,
+		    vm_offset_t);
 
 long		Maxmem = 0;
 long		realmem = 0;
@@ -232,7 +233,8 @@
 void booke_cpu_init(void);
 
 uintptr_t
-powerpc_init(vm_offset_t fdt, vm_offset_t toc, vm_offset_t ofentry, void *mdp)
+powerpc_init(vm_offset_t fdt, vm_offset_t toc, vm_offset_t ofentry, void *mdp,
+    vm_offset_t mdp_cookie)
 {
 	struct		pcpu *pc;
 	vm_offset_t	startkernel, endkernel;
@@ -250,8 +252,11 @@
 	startkernel = __startkernel;
 	endkernel = __endkernel;
 
-	/* Check for ePAPR loader, which puts a magic value into r6 */
-	if (mdp == (void *)0x65504150)
+	/*
+	 * If the metadata pointer cookie is not set to the magic value,
+	 * the number in mdp should be treated as nonsense.
+	 */
+	if (mdp_cookie != 0xfb5d104d)
 		mdp = NULL;
 
 #ifdef AIM