Merge ~paelzer/ubuntu/+source/ipxe:merge-upstream-disco into ubuntu/+source/ipxe:ubuntu/disco-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Hi,
Heads up - this is a merge which is none - therefore the MP might look odd.

We are already ahead of Debian, this puts us ahead even more.
Therefore this MP has:
- no old/new Debian
- plenty of changes ouside of debian/*
- you need the tarball from the PPA

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3566/+packages

It has no own tests and no reasonable depending dep8 tests.
But I'll push it through the automated virt stack testing before an upload - so consider that done.

[Christian Ehrhardt  (paelzer)]

FYI I realized my deadlines is rather short since this is one of the first I'd want/need to upload.
Therefore a review today would be great.

[Andreas Hasenack (ahasenack)]

There is only one change in debian/, which is a delta drop, that was easy to check. Regarding the source code changes, well, it's a new upstream version, just like any other package. It's ok too, tests will tell.

I'm checking d/changelog, since that has to be manually reconstructed. A couple of comments inline about that, easy to fix if I'm correct, so preemptive +1.

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks Andreas.
Catch one is right - I added the line
Catch two was intentional - the rom size change that I added is now logically part of the general "add checks on rom size changes"

Adapting and tag+upload

[Christian Ehrhardt  (paelzer)]

Building, I'm tracking migration - thakns

diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 0e75158..0000000
--- a/.travis.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-dist: trusty
-
-sudo: false
-
-language: c
-
-cache: ccache
-
-compiler:
-  - gcc
-
-addons:
-  apt:
-    packages:
-      - binutils-dev
-      - liblzma-dev
-      - syslinux
-      - genisoimage
-  coverity_scan:
-    project:
-      name: "ipxe/ipxe"
-      version: $TRAVIS_COMMIT
-    build_command_prepend: "make -C src bin/deps"
-    build_command: "make -C src bin/blib.a"
-    branch_pattern: coverity_scan
-
-env:
-  global:
-    - MAKEFLAGS="-j 4"
-
-script:
-  - make -C src bin/blib.a
-  - make -C src bin/ipxe.pxe
-  - make -C src bin/ipxe.usb
-  - make -C src bin/ipxe.iso
-  - make -C src bin/8086100e.mrom
-  - make -C src bin-x86_64-pcbios/blib.a
-  - make -C src bin-x86_64-pcbios/ipxe.pxe
-  - make -C src bin-x86_64-pcbios/ipxe.usb
-  - make -C src bin-x86_64-pcbios/ipxe.iso
-  - make -C src bin-x86_64-pcbios/8086100e.mrom
-  - make -C src bin-x86_64-efi/blib.a
-  - make -C src bin-x86_64-efi/ipxe.efi
-  - make -C src bin-x86_64-efi/intel.efidrv
-  - make -C src bin-x86_64-efi/intel.efirom
-  - make -C src bin-i386-efi/blib.a
-  - make -C src bin-i386-efi/ipxe.efi
-  - make -C src bin-i386-efi/intel.efidrv
-  - make -C src bin-i386-efi/intel.efirom
-  - make -C src bin-x86_64-linux/blib.a
-  - make -C src bin-x86_64-linux/tap.linux
-  - make -C src bin-x86_64-linux/af_packet.linux
-  - make -C src bin-x86_64-linux/tests.linux
-  - ./src/bin-x86_64-linux/tests.linux
diff --git a/debian/changelog b/debian/changelog
index 724c673..fd4106b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,40 @@
+ipxe (1.0.0+git-20190109.133f4c4-0ubuntu1) disco; urgency=medium
+
+  * Merge new upstream release 1.0.0+git-20190109.133f4c4
+    Remaining Changes:
+    - d/p/enable-https.patch: Enable HTTPS support.
+    - Split grub integration from ipxe->grub-ipxe.
+      - d/control: add package and adapt dependencies
+      - d/[grub-]ipxe.install: move some files to grub-ipxe
+      - rename d/ipxe.post* to d/grub-ipxe-post*
+    - Install ne.rom as pxe-ne2k_isa.rom
+      - d/ipxe-qemu.install: Install ne.rom as pxe-ne2k_isa.rom.
+      - d/ipxe-qemu.links: compat link for ne.rom
+    - d/ipxe-qemu.links: Add compat links from /usr/share/qemu
+      to /usr/lib/ipxe/qemu.
+    - d/util/check-rom-sizes, d/rules: check sizes of generated roms to avoid
+      accidentially breaking KVM live migration on updates/fixes.
+    - handling of efi rom size changes in Bionic (LP 1713490)
+      - d/util/check-rom-sizes: bump efi rom sizes
+      - d/control: break older qemu versions to ensure the new sized roms
+    - debian/patches/handle-dhcp-nack.patch: Handle DHCP NAK and send a
+      re-discover. (LP 1707999)
+    - updated debian/patches/util-elf2efi-GNU_SOURCE.patch to match latest
+      upstream.
+    - add new rom for vmxnet3 (LP 1737211)
+      - d/ipxe-qemu.install: install new rom
+        are only associated with new qemu versions.
+    - Build ROMs for QEMU with CONFIG=qemu (LP: 1789319)
+    - d/p/0005-strip-802.1Q-VLAN-0-priority-tags.patch: Strip 802.1Q VLAN 0
+      priority tags; Fixes PXE when VLAN tag is 0. (LP: 1805920)
+    - debian/copyright: update copyright information to satisfy lintian
+      dep5 checks (LP: 1747071)
+  * Dropped changes (upstream):
+    - debian/patches/fix-elf2efi-plt-relocation.diff: Cherry-pick fix from
+      ipxe devel mailing list to handle R_X86_64_PLT32 relocations.
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 09 Jan 2019 11:09:29 +0100
+
 ipxe (1.0.0+git-20180124.fbe8c52d-0ubuntu5) disco; urgency=medium
 
   * d/p/0005-strip-802.1Q-VLAN-0-priority-tags.patch: Strip 802.1Q VLAN 0
diff --git a/debian/patches/fix-elf2efi-plt-relocation.diff b/debian/patches/fix-elf2efi-plt-relocation.diff
deleted file mode 100644
index 6ff9351..0000000
--- a/debian/patches/fix-elf2efi-plt-relocation.diff
+++ /dev/null
@@ -1,27 +0,0 @@
-Description: Fix elf2efi to recognize R_X86_64_PLT32 relocation type
- Recent changes in GNU build tools causes a build failure with ipxe.efi
- during the elf2efi64 conversion:
- .
- ./util/elf2efi64 --subsystem=10 bin-x86_64-efi/ipxe.efi.tmp bin-x86_64-efi/ipxe.efi
- Unrecognised relocation type 4
- make: *** [Makefile.efi:26: bin-x86_64-efi/ipxe.efi] Error 1
- .
- The relocation type 4 is defined in elf.h as R_X86_64_PLT32 and is now
- being used by the GNU linker. This is currently not supported by the
- elf2efi.c source found in ipxe.
- .
- This error is resolved by adding R_X86_64_PLT32 to the list of
- recognized relocation headers types for elf2efi.
-Author: John Jolly <***@suse.com> 
-Origin: vendor, http://ipxe-devel.ipxe.narkive.com/XVJMK4BP/fix-elf2efi-to-recognize-r-x86-64-plt32-relocation-type
-
---- a/src/util/elf2efi.c
-+++ b/src/util/elf2efi.c
-@@ -635,6 +635,7 @@ static void process_reloc ( struct elf_f
- 		case ELF_MREL ( EM_ARM, R_ARM_THM_JUMP24 ) :
- 		case ELF_MREL ( EM_ARM, R_ARM_V4BX ):
- 		case ELF_MREL ( EM_X86_64, R_X86_64_PC32 ) :
-+		case ELF_MREL ( EM_X86_64, R_X86_64_PLT32 ) :
- 		case ELF_MREL ( EM_AARCH64, R_AARCH64_CALL26 ) :
- 		case ELF_MREL ( EM_AARCH64, R_AARCH64_JUMP26 ) :
- 		case ELF_MREL ( EM_AARCH64, R_AARCH64_ADR_PREL_LO21 ) :
diff --git a/debian/patches/series b/debian/patches/series
index db818d1..c66db88 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,5 +2,4 @@
 util-elf2efi-GNU_SOURCE.patch
 enable-https.patch
 handle-dhcp-nack.patch
-fix-elf2efi-plt-relocation.diff
 0005-strip-802.1Q-VLAN-0-priority-tags.patch
diff --git a/src/Makefile.housekeeping b/src/Makefile.housekeeping
index 00b0792..f833492 100644
--- a/src/Makefile.housekeeping
+++ b/src/Makefile.housekeeping
@@ -174,9 +174,17 @@ endif
 # Inhibit this.
 #
 ifeq ($(CCTYPE),gcc)
-WNA_TEST = $(CC) -Wno-address -x c -c /dev/null -o /dev/null >/dev/null 2>&1
+WNA_TEST = $(CC) -Waddress -x c -c /dev/null -o /dev/null >/dev/null 2>&1
 WNA_FLAGS := $(shell $(WNA_TEST) && $(ECHO) '-Wno-address')
 WORKAROUND_CFLAGS += $(WNA_FLAGS)
+
+# gcc 8.0 generates warnings for certain suspect string operations. Our
+# sources have been vetted for correct usage.  Turn off these warnings.
+#
+WNST_TEST = $(CC) -Wstringop-truncation -x c -c /dev/null -o /dev/null \
+		  >/dev/null 2>&1
+WNST_FLAGS := $(shell $(WNST_TEST) && $(ECHO) '-Wno-stringop-truncation')
+WORKAROUND_CFLAGS += $(WNST_FLAGS)
 endif
 
 # Some versions of gas choke on division operators, treating them as
@@ -437,7 +445,7 @@ endif
 CFLAGS		+= $(WORKAROUND_CFLAGS) $(EXTRA_CFLAGS)
 ASFLAGS		+= $(WORKAROUND_ASFLAGS) $(EXTRA_ASFLAGS)
 LDFLAGS		+= $(WORKAROUND_LDFLAGS) $(EXTRA_LDFLAGS)
-HOST_CFLAGS	+= -O2 -g
+HOST_CFLAGS	+= $(WORKAROUND_CFLAGS) -O2 -g
 
 # Inhibit -Werror if NO_WERROR is specified on make command line
 #
diff --git a/src/arch/x86/core/dumpregs.c b/src/arch/x86/core/dumpregs.c
index 37d62a7..a5108ea 100644
--- a/src/arch/x86/core/dumpregs.c
+++ b/src/arch/x86/core/dumpregs.c
@@ -7,7 +7,7 @@ void __asmcall _dump_regs ( struct i386_all_regs *ix86 ) {
 		TEXT16_CODE ( ".globl dump_regs\n\t"
 			      "\ndump_regs:\n\t"
 			      VIRT_CALL ( _dump_regs )
-			      "ret\n\t" ) );
+			      "ret\n\t" ) : );
 
 	printf ( "EAX=%08x EBX=%08x ECX=%08x EDX=%08x\n"
 		 "ESI=%08x EDI=%08x EBP=%08x ESP=%08x\n"
diff --git a/src/arch/x86/drivers/net/undinet.c b/src/arch/x86/drivers/net/undinet.c
index 7819118..9b7d6d8 100644
--- a/src/arch/x86/drivers/net/undinet.c
+++ b/src/arch/x86/drivers/net/undinet.c
@@ -33,6 +33,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #include <ipxe/netdevice.h>
 #include <ipxe/if_ether.h>
 #include <ipxe/ethernet.h>
+#include <ipxe/pci.h>
 #include <ipxe/profile.h>
 #include <undi.h>
 #include <undinet.h>
@@ -807,6 +808,10 @@ struct undinet_irq_broken {
 	uint16_t pci_vendor;
 	/** PCI device ID */
 	uint16_t pci_device;
+	/** PCI subsystem vendor ID */
+	uint16_t pci_subsys_vendor;
+	/** PCI subsystem ID */
+	uint16_t pci_subsys;
 };
 
 /**
@@ -822,10 +827,10 @@ struct undinet_irq_broken {
  */
 static const struct undinet_irq_broken undinet_irq_broken_list[] = {
 	/* HP XX70x laptops */
-	{ .pci_vendor = 0x8086, .pci_device = 0x1502 },
-	{ .pci_vendor = 0x8086, .pci_device = 0x1503 },
+	{ 0x8086, 0x1502, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x8086, 0x1503, PCI_ANY_ID, PCI_ANY_ID },
 	/* HP 745 G3 laptop */
-	{ .pci_vendor = 0x14e4, .pci_device = 0x1687 },
+	{ 0x14e4, 0x1687, PCI_ANY_ID, PCI_ANY_ID },
 };
 
 /**
@@ -836,14 +841,30 @@ static const struct undinet_irq_broken undinet_irq_broken_list[] = {
  */
 static int undinet_irq_is_broken ( struct device_description *desc ) {
 	const struct undinet_irq_broken *broken;
+	struct pci_device pci;
+	uint16_t subsys_vendor;
+	uint16_t subsys;
 	unsigned int i;
 
+	/* Ignore non-PCI devices */
+	if ( desc->bus_type != BUS_TYPE_PCI )
+		return 0;
+
+	/* Read subsystem IDs */
+	pci_init ( &pci, desc->location );
+	pci_read_config_word ( &pci, PCI_SUBSYSTEM_VENDOR_ID, &subsys_vendor );
+	pci_read_config_word ( &pci, PCI_SUBSYSTEM_ID, &subsys );
+
+	/* Check for a match against the broken device list */
 	for ( i = 0 ; i < ( sizeof ( undinet_irq_broken_list ) /
 			    sizeof ( undinet_irq_broken_list[0] ) ) ; i++ ) {
 		broken = &undinet_irq_broken_list[i];
-		if ( ( desc->bus_type == BUS_TYPE_PCI ) &&
-		     ( desc->vendor == broken->pci_vendor ) &&
-		     ( desc->device == broken->pci_device ) ) {
+		if ( ( broken->pci_vendor == desc->vendor ) &&
+		     ( broken->pci_device == desc->device ) &&
+		     ( ( broken->pci_subsys_vendor == subsys_vendor ) ||
+		       ( broken->pci_subsys_vendor == PCI_ANY_ID ) ) &&
+		     ( ( broken->pci_subsys == subsys ) ||
+		       ( broken->pci_subsys == PCI_ANY_ID ) ) ) {
 			return 1;
 		}
 	}
@@ -938,10 +959,9 @@ int undinet_probe ( struct undi_device *undi, struct device *dev ) {
 	memcpy ( netdev->ll_addr, undi_info.CurrentNodeAddress, ETH_ALEN );
 	undinic->irq = undi_info.IntNumber;
 	if ( undinic->irq > IRQ_MAX ) {
-		DBGC ( undinic, "UNDINIC %p has invalid IRQ %d\n",
+		DBGC ( undinic, "UNDINIC %p ignoring invalid IRQ %d\n",
 		       undinic, undinic->irq );
-		rc = -EINVAL;
-		goto err_bad_irq;
+		undinic->irq = 0;
 	}
 	DBGC ( undinic, "UNDINIC %p has MAC address %s and IRQ %d\n",
 	       undinic, eth_ntoa ( netdev->hw_addr ), undinic->irq );
@@ -984,7 +1004,6 @@ int undinet_probe ( struct undi_device *undi, struct device *dev ) {
 
  err_register:
  err_undi_get_iface_info:
- err_bad_irq:
  err_undi_get_information:
  err_undi_initialize:
 	/* Shut down UNDI stack */
diff --git a/src/arch/x86/include/bits/errfile.h b/src/arch/x86/include/bits/errfile.h
index 9d1fed7..b0ae1ab 100644
--- a/src/arch/x86/include/bits/errfile.h
+++ b/src/arch/x86/include/bits/errfile.h
@@ -27,6 +27,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define ERRFILE_acpipwr		( ERRFILE_ARCH | ERRFILE_CORE | 0x00100000 )
 #define ERRFILE_cpuid		( ERRFILE_ARCH | ERRFILE_CORE | 0x00110000 )
 #define ERRFILE_rdtsc_timer	( ERRFILE_ARCH | ERRFILE_CORE | 0x00120000 )
+#define ERRFILE_acpi_timer	( ERRFILE_ARCH | ERRFILE_CORE | 0x00130000 )
 
 #define ERRFILE_bootsector     ( ERRFILE_ARCH | ERRFILE_IMAGE | 0x00000000 )
 #define ERRFILE_bzimage	       ( ERRFILE_ARCH | ERRFILE_IMAGE | 0x00010000 )
diff --git a/src/arch/x86/include/ipxe/rtc_entropy.h b/src/arch/x86/include/ipxe/rtc_entropy.h
index e214745..581abcd 100644
--- a/src/arch/x86/include/ipxe/rtc_entropy.h
+++ b/src/arch/x86/include/ipxe/rtc_entropy.h
@@ -22,7 +22,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  * @ret min_entropy	min-entropy of each sample
  */
-static inline __always_inline double
+static inline __always_inline min_entropy_t
 ENTROPY_INLINE ( rtc, min_entropy_per_sample ) ( void ) {
 
 	/* The min-entropy has been measured on several platforms
@@ -38,7 +38,7 @@ ENTROPY_INLINE ( rtc, min_entropy_per_sample ) ( void ) {
 	 * safety margin to allow for some potential non-independence
 	 * of samples.
 	 */
-	return 1.3;
+	return MIN_ENTROPY ( 1.3 );
 }
 
 extern uint8_t rtc_sample ( void );
diff --git a/src/arch/x86/include/librm.h b/src/arch/x86/include/librm.h
index 311748b..5196d39 100644
--- a/src/arch/x86/include/librm.h
+++ b/src/arch/x86/include/librm.h
@@ -254,9 +254,13 @@ extern void remove_user_from_rm_stack ( userptr_t data, size_t size );
 #define CODE_DEFAULT ".code32"
 #endif
 
+/* LINE_SYMBOL: declare a symbol for the current source code line */
+#define LINE_SYMBOL _S2 ( OBJECT ) "__line_" _S2 ( __LINE__ ) "__%=:"
+
 /* TEXT16_CODE: declare a fragment of code that resides in .text16 */
 #define TEXT16_CODE( asm_code_str )			\
 	".section \".text16\", \"ax\", @progbits\n\t"	\
+	"\n" LINE_SYMBOL "\n\t"				\
 	".code16\n\t"					\
 	asm_code_str "\n\t"				\
 	CODE_DEFAULT "\n\t"				\
@@ -276,6 +280,7 @@ extern void remove_user_from_rm_stack ( userptr_t data, size_t size );
 	"push $1f\n\t"					\
 	"call phys_call\n\t"				\
 	".section \".text.phys\", \"ax\", @progbits\n\t"\
+	"\n" LINE_SYMBOL "\n\t"				\
 	".code32\n\t"					\
 	"\n1:\n\t"					\
 	asm_code_str					\
@@ -376,6 +381,50 @@ struct interrupt_vector {
 /** "jmp" instruction */
 #define JMP_INSN 0xe9
 
+/** 32-bit interrupt wrapper stack frame */
+struct interrupt_frame32 {
+	uint32_t esp;
+	uint32_t ss;
+	uint32_t gs;
+	uint32_t fs;
+	uint32_t es;
+	uint32_t ds;
+	uint32_t ebp;
+	uint32_t edi;
+	uint32_t esi;
+	uint32_t edx;
+	uint32_t ecx;
+	uint32_t ebx;
+	uint32_t eax;
+	uint32_t eip;
+	uint32_t cs;
+	uint32_t eflags;
+} __attribute__ (( packed ));
+
+/** 64-bit interrupt wrapper stack frame */
+struct interrupt_frame64 {
+	uint64_t r15;
+	uint64_t r14;
+	uint64_t r13;
+	uint64_t r12;
+	uint64_t r11;
+	uint64_t r10;
+	uint64_t r9;
+	uint64_t r8;
+	uint64_t rbp;
+	uint64_t rdi;
+	uint64_t rsi;
+	uint64_t rdx;
+	uint64_t rcx;
+	uint64_t rbx;
+	uint64_t rax;
+	uint64_t rip;
+	uint64_t cs;
+	uint64_t rflags;
+	uint64_t rsp;
+	uint64_t ss;
+} __attribute__ (( packed ));
+
 extern void set_interrupt_vector ( unsigned int intr, void *vector );
 
 /** A page table */
diff --git a/src/arch/x86/interface/pcbios/acpi_timer.c b/src/arch/x86/interface/pcbios/acpi_timer.c
new file mode 100644
index 0000000..82e85a0
--- /dev/null
+++ b/src/arch/x86/interface/pcbios/acpi_timer.c
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2018 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <unistd.h>
+#include <errno.h>
+#include <assert.h>
+#include <byteswap.h>
+#include <ipxe/io.h>
+#include <ipxe/acpi.h>
+
+/** @file
+ *
+ * ACPI power management timer
+ *
+ */
+
+/** ACPI timer frequency (fixed 3.579545MHz) */
+#define ACPI_TIMER_HZ 3579545
+
+/** ACPI timer mask
+ *
+ * Timers may be implemented as either 24-bit or 32-bit counters.  We
+ * simplify the code by pessimistically assuming that the timer has
+ * only 24 bits.
+ */
+#define ACPI_TIMER_MASK 0x00ffffffUL
+
+/** Power management timer register address */
+static unsigned int pm_tmr;
+
+struct timer acpi_timer __timer ( TIMER_PREFERRED );
+
+/**
+ * Get current system time in ticks
+ *
+ * @ret ticks		Current time, in ticks
+ */
+static unsigned long acpi_currticks ( void ) {
+	static unsigned long offset;
+	static uint32_t prev;
+	uint32_t now;
+
+	/* Read timer and account for wraparound */
+	now = ( inl ( pm_tmr ) & ACPI_TIMER_MASK );
+	if ( now < prev ) {
+		offset += ( ( ACPI_TIMER_MASK + 1 ) /
+			    ( ACPI_TIMER_HZ / TICKS_PER_SEC ) );
+	}
+	prev = now;
+
+	/* Convert to timer ticks */
+	return ( offset + ( now / ( ACPI_TIMER_HZ / TICKS_PER_SEC ) ) );
+}
+
+/**
+ * Delay for a fixed number of microseconds
+ *
+ * @v usecs		Number of microseconds for which to delay
+ */
+static void acpi_udelay ( unsigned long usecs ) {
+	uint32_t start;
+	uint32_t elapsed;
+	uint32_t threshold;
+
+	/* Delay until a suitable number of ticks have elapsed.  We do
+	 * not need to allow for multiple wraparound, since the
+	 * wraparound period for a 24-bit timer at 3.579545MHz is
+	 * around 4700000us.
+	 */
+	start = inl ( pm_tmr );
+	threshold = ( ( usecs * ACPI_TIMER_HZ ) / 1000000 );
+	do {
+		elapsed = ( ( inl ( pm_tmr ) - start ) & ACPI_TIMER_MASK );
+	} while ( elapsed < threshold );
+}
+
+/**
+ * Probe ACPI power management timer
+ *
+ * @ret rc		Return status code
+ */
+static int acpi_timer_probe ( void ) {
+	struct acpi_fadt fadtab;
+	userptr_t fadt;
+	unsigned int pm_tmr_blk;
+
+	/* Locate FADT */
+	fadt = acpi_find ( FADT_SIGNATURE, 0 );
+	if ( ! fadt ) {
+		DBGC ( &acpi_timer, "ACPI could not find FADT\n" );
+		return -ENOENT;
+	}
+
+	/* Read FADT */
+	copy_from_user ( &fadtab, fadt, 0, sizeof ( fadtab ) );
+	pm_tmr_blk = le32_to_cpu ( fadtab.pm_tmr_blk );
+	if ( ! pm_tmr_blk ) {
+		DBGC ( &acpi_timer, "ACPI has no timer\n" );
+		return -ENOENT;
+	}
+
+	/* Record power management timer register address */
+	pm_tmr = ( pm_tmr_blk + ACPI_PM_TMR );
+
+	return 0;
+}
+
+/** ACPI timer */
+struct timer acpi_timer __timer ( TIMER_PREFERRED ) = {
+	.name = "acpi",
+	.probe = acpi_timer_probe,
+	.currticks = acpi_currticks,
+	.udelay = acpi_udelay,
+};
diff --git a/src/arch/x86/interface/pcbios/bios_console.c b/src/arch/x86/interface/pcbios/bios_console.c
index 81e3a7d..08fa6d0 100644
--- a/src/arch/x86/interface/pcbios/bios_console.c
+++ b/src/arch/x86/interface/pcbios/bios_console.c
@@ -521,12 +521,12 @@ static void bios_inject_startup ( void ) {
 	__asm__ __volatile__ (
 		TEXT16_CODE ( "\nint16_wrapper:\n\t"
 			      "pushfw\n\t"
-			      "cmpb $0, %cs:bios_inject_lock\n\t"
+			      "cmpb $0, %%cs:bios_inject_lock\n\t"
 			      "jnz 1f\n\t"
 			      VIRT_CALL ( bios_inject )
 			      "\n1:\n\t"
 			      "popfw\n\t"
-			      "ljmp *%cs:int16_vector\n\t" ) );
+			      "ljmp *%%cs:int16_vector\n\t" ) : );
 
 	/* Hook INT 16 */
 	hook_bios_interrupt ( 0x16, ( ( intptr_t ) int16_wrapper ),
diff --git a/src/arch/x86/interface/pcbios/bios_reboot.c b/src/arch/x86/interface/pcbios/bios_reboot.c
index c6c5a5a..071173f 100644
--- a/src/arch/x86/interface/pcbios/bios_reboot.c
+++ b/src/arch/x86/interface/pcbios/bios_reboot.c
@@ -48,7 +48,7 @@ static void bios_reboot ( int warm ) {
 	put_real ( flag, BDA_SEG, BDA_REBOOT );
 
 	/* Jump to system reset vector */
-	__asm__ __volatile__ ( REAL_CODE ( "ljmp $0xf000, $0xfff0" ) );
+	__asm__ __volatile__ ( REAL_CODE ( "ljmp $0xf000, $0xfff0" ) : );
 }
 
 /**
diff --git a/src/arch/x86/interface/syslinux/comboot_call.c b/src/arch/x86/interface/syslinux/comboot_call.c
index 2f5c252..e70f200 100644
--- a/src/arch/x86/interface/syslinux/comboot_call.c
+++ b/src/arch/x86/interface/syslinux/comboot_call.c
@@ -663,7 +663,7 @@ void hook_comboot_interrupts ( ) {
 			      VIRT_CALL ( int20 )
 			      "clc\n\t"
 			      "call patch_cf\n\t"
-		              "iret\n\t" ) );
+		              "iret\n\t" ) : );
 
 	hook_bios_interrupt ( 0x20, ( intptr_t ) int20_wrapper, &int20_vector );
 
@@ -672,7 +672,7 @@ void hook_comboot_interrupts ( ) {
 			      VIRT_CALL ( int21 )
 			      "clc\n\t"
 			      "call patch_cf\n\t"
-		              "iret\n\t" ) );
+		              "iret\n\t" ) : );
 
 	hook_bios_interrupt ( 0x21, ( intptr_t ) int21_wrapper, &int21_vector );
 
@@ -681,7 +681,7 @@ void hook_comboot_interrupts ( ) {
 			      VIRT_CALL ( int22 )
 			      "clc\n\t"
 			      "call patch_cf\n\t"
-		              "iret\n\t" ) );
+		              "iret\n\t" ) : );
 
 	hook_bios_interrupt ( 0x22, ( intptr_t ) int22_wrapper, &int22_vector );
 }
diff --git a/src/arch/x86/transitions/librm.S b/src/arch/x86/transitions/librm.S
index c31daad..9d3eff9 100644
--- a/src/arch/x86/transitions/librm.S
+++ b/src/arch/x86/transitions/librm.S
@@ -1363,20 +1363,19 @@ flatten_dummy:
 	.code32
 	.globl interrupt_wrapper
 interrupt_wrapper:
-	/* Preserve registers (excluding already-saved %eax and
-	 * otherwise unused registers which are callee-save for both
-	 * 32-bit and 64-bit ABIs).
-	 */
+	/* Preserve registers (excluding already-saved %eax) */
 	pushl	%ebx
 	pushl	%ecx
 	pushl	%edx
 	pushl	%esi
 	pushl	%edi
+	pushl	%ebp
 
 	/* Expand IRQ number to whole %eax register */
 	movzbl	%al, %eax
 
 .if64 ; /* Skip transition to long mode, if applicable */
+	xorl	%edx, %edx
 	movw	%cs, %bx
 	cmpw	$LONG_CS, %bx
 	je	1f
@@ -1391,24 +1390,45 @@ interrupt_wrapper:
 
 	/* Switch to virtual addressing */
 	call	intr_to_prot
+
+	/* Pass 32-bit interrupt frame pointer in %edx */
+	movl	%esp, %edx
+	xorl	%ecx, %ecx
 .if64
 	/* Switch to long mode */
 	call	prot_to_long
 	.code64
 
-1:	/* Preserve long-mode caller-save registers */
+1:	/* Preserve long-mode registers */
 	pushq	%r8
 	pushq	%r9
 	pushq	%r10
 	pushq	%r11
+	pushq	%r12
+	pushq	%r13
+	pushq	%r14
+	pushq	%r15
 
 	/* Expand IRQ number to whole %rdi register */
 	movl	%eax, %edi
+
+	/* Pass 32-bit interrupt frame pointer (if applicable) in %rsi */
+	testl	%edx, %edx
+	je	1f
+	movl	%edx, %esi
+	addl	virt_offset, %esi
+1:
+	/* Pass 64-bit interrupt frame pointer in %rdx */
+	movq	%rsp, %rdx
 .endif
 	/* Call interrupt handler */
 	call	interrupt
 .if64
-	/* Restore long-mode caller-save registers */
+	/* Restore long-mode registers */
+	popq	%r15
+	popq	%r14
+	popq	%r13
+	popq	%r12
 	popq	%r11
 	popq	%r10
 	popq	%r9
@@ -1432,6 +1452,7 @@ interrupt_wrapper:
 	popl	%ds
 
 1:	/* Restore registers */
+	popl	%ebp
 	popl	%edi
 	popl	%esi
 	popl	%edx
diff --git a/src/arch/x86/transitions/librm_mgmt.c b/src/arch/x86/transitions/librm_mgmt.c
index 8144e76..f9e1d26 100644
--- a/src/arch/x86/transitions/librm_mgmt.c
+++ b/src/arch/x86/transitions/librm_mgmt.c
@@ -13,6 +13,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <ipxe/profile.h>
 #include <realmode.h>
 #include <pic8259.h>
+#include <ipxe/shell.h>
 
 /*
  * This file provides functions for managing librm.
@@ -43,6 +44,9 @@ struct idtr64 idtr64 = {
 	.limit = ( sizeof ( idt64 ) - 1 ),
 };
 
+/** Length of stack dump */
+#define STACK_DUMP_LEN 128
+
 /** Timer interrupt profiler */
 static struct profiler timer_irq_profiler __profiler = { .name = "irq.timer" };
 
@@ -160,14 +164,100 @@ static struct profiler * interrupt_profiler ( int intr ) {
 }
 
 /**
+ * Display interrupt stack dump (for debugging)
+ *
+ * @v intr		Interrupt number
+ * @v frame32		32-bit interrupt wrapper stack frame (or NULL)
+ * @v frame64		64-bit interrupt wrapper stack frame (or NULL)
+ */
+static __attribute__ (( unused )) void
+interrupt_dump ( int intr, struct interrupt_frame32 *frame32,
+		 struct interrupt_frame64 *frame64 ) {
+	unsigned long sp;
+	void *stack;
+
+	/* Do nothing unless debugging is enabled */
+	if ( ! DBG_LOG )
+		return;
+
+	/* Print register dump */
+	if ( ( sizeof ( physaddr_t ) <= sizeof ( uint32_t ) ) || frame32 ) {
+		sp = ( frame32->esp + sizeof ( *frame32 ) -
+		       offsetof ( typeof ( *frame32 ), esp ) );
+		DBGC ( &intr, "INT%d at %04x:%08x (stack %04x:%08lx):\n",
+		       intr, frame32->cs, frame32->eip, frame32->ss, sp );
+		DBGC ( &intr, "cs = %04x  ds = %04x  es = %04x  fs = %04x  "
+		       "gs = %04x  ss = %04x\n", frame32->cs, frame32->ds,
+		       frame32->es, frame32->fs, frame32->gs, frame32->ss );
+		DBGC ( &intr, "eax = %08x  ebx = %08x  ecx = %08x  "
+		       "edx = %08x  flg = %08x\n", frame32->eax, frame32->ebx,
+		       frame32->ecx, frame32->edx, frame32->eflags );
+		DBGC ( &intr, "esi = %08x  edi = %08x  ebp = %08x  "
+		       "esp = %08lx  eip = %08x\n", frame32->esi, frame32->edi,
+		       frame32->ebp, sp, frame32->eip );
+		stack = ( ( ( void * ) frame32 ) + sizeof ( *frame32 ) );
+	} else {
+		DBGC ( &intr, "INT%d at %04llx:%016llx (stack "
+		       "%04llx:%016llx):\n", intr,
+		       ( ( unsigned long long ) frame64->cs ),
+		       ( ( unsigned long long ) frame64->rip ),
+		       ( ( unsigned long long ) frame64->ss ),
+		       ( ( unsigned long long ) frame64->rsp ) );
+		DBGC ( &intr, "rax = %016llx  rbx = %016llx  rcx = %016llx\n",
+		       ( ( unsigned long long ) frame64->rax ),
+		       ( ( unsigned long long ) frame64->rbx ),
+		       ( ( unsigned long long ) frame64->rcx ) );
+		DBGC ( &intr, "rdx = %016llx  rsi = %016llx  rdi = %016llx\n",
+		       ( ( unsigned long long ) frame64->rdx ),
+		       ( ( unsigned long long ) frame64->rsi ),
+		       ( ( unsigned long long ) frame64->rdi ) );
+		DBGC ( &intr, "rbp = %016llx  rsp = %016llx  flg = %016llx\n",
+		       ( ( unsigned long long ) frame64->rbp ),
+		       ( ( unsigned long long ) frame64->rsp ),
+		       ( ( unsigned long long ) frame64->rflags ) );
+		DBGC ( &intr, "r8  = %016llx  r9  = %016llx  r10 = %016llx\n",
+		       ( ( unsigned long long ) frame64->r8 ),
+		       ( ( unsigned long long ) frame64->r9 ),
+		       ( ( unsigned long long ) frame64->r10 ) );
+		DBGC ( &intr, "r11 = %016llx  r12 = %016llx  r13 = %016llx\n",
+		       ( ( unsigned long long ) frame64->r11 ),
+		       ( ( unsigned long long ) frame64->r12 ),
+		       ( ( unsigned long long ) frame64->r13 ) );
+		DBGC ( &intr, "r14 = %016llx  r15 = %016llx\n",
+		       ( ( unsigned long long ) frame64->r14 ),
+		       ( ( unsigned long long ) frame64->r15 ) );
+		sp = frame64->rsp;
+		stack = phys_to_virt ( sp );
+	}
+
+	/* Print stack dump */
+	DBGC_HDA ( &intr, sp, stack, STACK_DUMP_LEN );
+}
+
+/**
  * Interrupt handler
  *
  * @v intr		Interrupt number
+ * @v frame32		32-bit interrupt wrapper stack frame (or NULL)
+ * @v frame64		64-bit interrupt wrapper stack frame (or NULL)
+ * @v frame		Interrupt wrapper stack frame
  */
-void __attribute__ (( regparm ( 1 ) )) interrupt ( int intr ) {
+void __attribute__ (( regparm ( 3 ) ))
+interrupt ( int intr, struct interrupt_frame32 *frame32,
+	    struct interrupt_frame64 *frame64 ) {
 	struct profiler *profiler = interrupt_profiler ( intr );
 	uint32_t discard_eax;
 
+	/* Trap CPU exceptions if debugging is enabled.  Note that we
+	 * cannot treat INT8+ as exceptions, since we are not
+	 * permitted to rebase the PIC.
+	 */
+	if ( DBG_LOG && ( intr < IRQ_INT ( 0 ) ) ) {
+		interrupt_dump ( intr, frame32, frame64 );
+		DBG ( "CPU exception: dropping to emergency shell\n" );
+		shell();
+	}
+
 	/* Reissue interrupt in real mode */
 	profile_start ( profiler );
 	__asm__ __volatile__ ( REAL_CODE ( "movb %%al, %%cs:(1f + 1)\n\t"
diff --git a/src/arch/x86/transitions/librm_test.c b/src/arch/x86/transitions/librm_test.c
index ba4254f..77cf802 100644
--- a/src/arch/x86/transitions/librm_test.c
+++ b/src/arch/x86/transitions/librm_test.c
@@ -97,7 +97,7 @@ static void librm_test_exec ( void ) {
 	/* Profile complete real-mode call cycle */
 	for ( i = 0 ; i < PROFILE_COUNT ; i++ ) {
 		profile_start ( &real_call_profiler );
-		__asm__ __volatile__ ( REAL_CODE ( "" ) );
+		__asm__ __volatile__ ( REAL_CODE ( "" ) : );
 		profile_stop ( &real_call_profiler );
 	}
 
diff --git a/src/arch/x86_64/Makefile b/src/arch/x86_64/Makefile
index 246905c..b3064b7 100644
--- a/src/arch/x86_64/Makefile
+++ b/src/arch/x86_64/Makefile
@@ -13,6 +13,10 @@ CFLAGS		+= -m64
 ASFLAGS		+= --64
 LDFLAGS		+= -m elf_x86_64
 
+# Prevent use of MMX and SSE registers
+#
+CFLAGS		+= -mno-mmx -mno-sse
+
 # EFI requires -fshort-wchar, and nothing else currently uses wchar_t
 #
 CFLAGS		+= -fshort-wchar
diff --git a/src/arch/x86_64/include/bits/hyperv.h b/src/arch/x86_64/include/bits/hyperv.h
index 975b1ee..fa8bb3f 100644
--- a/src/arch/x86_64/include/bits/hyperv.h
+++ b/src/arch/x86_64/include/bits/hyperv.h
@@ -44,8 +44,7 @@ hv_call ( struct hv_hypervisor *hv, unsigned int code, const void *in,
 			       : "=a" ( result ), "+r" ( rcx ), "+r" ( rdx ),
 				 "+r" ( r8 )
 			       : "m" ( hypercall )
-			       : "r9", "r10", "r11", "xmm0", "xmm1", "xmm2",
-				 "xmm3", "xmm4", "xmm5" );
+			       : "r9", "r10", "r11" );
 	return result;
 }
 
diff --git a/src/config/config_timer.c b/src/config/config_timer.c
index a462970..d53c399 100644
--- a/src/config/config_timer.c
+++ b/src/config/config_timer.c
@@ -46,3 +46,6 @@ REQUIRE_OBJECT ( efi_timer );
 #ifdef TIMER_LINUX
 REQUIRE_OBJECT ( linux_timer );
 #endif
+#ifdef TIMER_ACPI
+REQUIRE_OBJECT ( acpi_timer );
+#endif
diff --git a/src/config/crypto.h b/src/config/crypto.h
index 8f885c5..1edcdce 100644
--- a/src/config/crypto.h
+++ b/src/config/crypto.h
@@ -58,6 +58,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 #define CROSSCERT "http://ca.ipxe.org/auto"
 
+/** Perform OCSP checks when applicable
+ *
+ * Some CAs provide non-functional OCSP servers, and some clients are
+ * forced to operate on networks without access to the OCSP servers.
+ * Allow the user to explicitly disable the use of OCSP checks.
+ */
+#define OCSP_CHECK
+
 #include <config/named.h>
 #include NAMED_CONFIG(crypto.h)
 #include <config/local/crypto.h>
diff --git a/src/core/netbios.c b/src/core/netbios.c
new file mode 100644
index 0000000..0d4e208
--- /dev/null
+++ b/src/core/netbios.c
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2018 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+/** @file
+ *
+ * NetBIOS user names
+ *
+ */
+
+#include <stddef.h>
+#include <string.h>
+#include <ipxe/netbios.h>
+
+/**
+ * Split NetBIOS [domain\]username into separate domain and username fields
+ *
+ * @v username		NetBIOS [domain\]username string
+ * @ret domain		Domain portion of string, or NULL if no domain present
+ *
+ * This function modifies the original string by removing the
+ * separator.  The caller may restore the string using
+ * netbios_domain_undo().
+ */
+const char * netbios_domain ( char **username ) {
+	char *domain_username = *username;
+	char *sep;
+
+	/* Find separator, if present */
+	sep = strchr ( domain_username, '\\' );
+	if ( ! sep )
+		return NULL;
+
+	/* Overwrite separator with NUL terminator and update username string */
+	*sep = '\0';
+	*username = ( sep + 1 );
+
+	return domain_username;
+}
diff --git a/src/core/profile.c b/src/core/profile.c
index 1075047..3655108 100644
--- a/src/core/profile.c
+++ b/src/core/profile.c
@@ -26,6 +26,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <stdint.h>
 #include <stdio.h>
 #include <strings.h>
+#include <limits.h>
 #include <assert.h>
 #include <ipxe/isqrt.h>
 #include <ipxe/profile.h>
@@ -122,8 +123,9 @@ void profile_update ( struct profiler *profiler, unsigned long sample ) {
 	 */
 	assert ( ( ( signed ) sample ) >= 0 );
 
-	/* Update sample count */
-	profiler->count++;
+	/* Update sample count, limiting to avoid signed overflow */
+	if ( profiler->count < INT_MAX )
+		profiler->count++;
 
 	/* Adjust mean sample value scale if necessary.  Skip if
 	 * sample is zero (in which case flsl(sample)-1 would
diff --git a/src/crypto/entropy.c b/src/crypto/entropy.c
index 5acbc02..ced6fd9 100644
--- a/src/crypto/entropy.c
+++ b/src/crypto/entropy.c
@@ -70,7 +70,8 @@ repetition_count_cutoff ( void ) {
 	 * where W is set at 2^(-30) (in ANS X9.82 Part 2 (October
 	 * 2011 Draft) Section 8.5.2.1.3.1).
 	 */
-	max_repetitions = ( 1 + ( 30 / min_entropy_per_sample() ) );
+	max_repetitions = ( 1 + ( MIN_ENTROPY ( 30 ) /
+				  min_entropy_per_sample() ) );
 
 	/* Round up to a whole number of repetitions.  We don't have
 	 * the ceil() function available, so do the rounding by hand.
@@ -237,7 +238,7 @@ adaptive_proportion_cutoff ( void ) {
 
 	/* Look up cutoff value in cutoff table */
 	n = ADAPTIVE_PROPORTION_WINDOW_SIZE;
-	h = min_entropy_per_sample();
+	h = ( min_entropy_per_sample() / MIN_ENTROPY_SCALE );
 	cutoff = adaptive_proportion_cutoff_lookup ( n, h );
 
 	/* Fail unless cutoff value is a build-time constant */
diff --git a/src/crypto/x509.c b/src/crypto/x509.c
index 76ace03..feb7e4a 100644
--- a/src/crypto/x509.c
+++ b/src/crypto/x509.c
@@ -40,6 +40,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <ipxe/socket.h>
 #include <ipxe/in.h>
 #include <ipxe/image.h>
+#include <ipxe/ocsp.h>
 #include <ipxe/x509.h>
 #include <config/crypto.h>
 
@@ -1362,8 +1363,7 @@ int x509_validate ( struct x509_certificate *cert,
 	}
 
 	/* Fail if OCSP is required */
-	if ( cert->extensions.auth_info.ocsp.uri.len &&
-	     ( ! cert->extensions.auth_info.ocsp.good ) ) {
+	if ( ocsp_required ( cert ) ) {
 		DBGC ( cert, "X509 %p \"%s\" requires an OCSP check\n",
 		       cert, x509_name ( cert ) );
 		return -EACCES_OCSP_REQUIRED;
diff --git a/src/drivers/bitbash/mii_bit.c b/src/drivers/bitbash/mii_bit.c
new file mode 100644
index 0000000..5f0ec04
--- /dev/null
+++ b/src/drivers/bitbash/mii_bit.c
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2018 Sylvie Barlow <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <unistd.h>
+#include <ipxe/bitbash.h>
+#include <ipxe/mii_bit.h>
+
+/**
+ * Transfer bits over MII bit-bashing interface
+ *
+ * @v basher		Bit basher
+ * @v mask		Mask
+ * @v write		Data to write
+ * @ret read		Data read
+ */
+static uint32_t mii_bit_xfer ( struct bit_basher *basher,
+			       uint32_t mask, uint32_t write ) {
+	uint32_t read = 0;
+	int bit;
+
+	for ( ; mask ; mask >>= 1 ) {
+
+		/* Delay */
+		udelay ( 1 );
+
+		/* Write bit to basher */
+		write_bit ( basher, MII_BIT_MDIO, ( write & mask ) );
+
+		/* Read bit from basher */
+		bit = read_bit ( basher, MII_BIT_MDIO );
+		read <<= 1;
+		read |= ( bit & 1 );
+
+		/* Set clock high */
+		write_bit ( basher, MII_BIT_MDC, 1 );
+
+		/* Delay */
+		udelay ( 1 );
+
+		/* Set clock low */
+		write_bit ( basher, MII_BIT_MDC, 0 );
+	}
+	return read;
+}
+
+/**
+ * Read or write via MII bit-bashing interface
+ *
+ * @v basher		Bit basher
+ * @v phy		PHY address
+ * @v reg		Register address
+ * @v data		Data to write
+ * @v cmd		Command
+ * @ret data		Data read
+ */
+static unsigned int mii_bit_rw ( struct bit_basher *basher,
+				 unsigned int phy, unsigned int reg,
+				 unsigned int data, unsigned int cmd ) {
+
+	/* Initiate drive for write */
+	write_bit ( basher, MII_BIT_DRIVE, 1 );
+
+	/* Write start */
+	mii_bit_xfer ( basher, MII_BIT_START_MASK, MII_BIT_START );
+
+	/* Write command */
+	mii_bit_xfer ( basher, MII_BIT_CMD_MASK, cmd );
+
+	/* Write PHY address */
+	mii_bit_xfer ( basher, MII_BIT_PHY_MASK, phy );
+
+	/* Write register address */
+	mii_bit_xfer ( basher, MII_BIT_REG_MASK, reg );
+
+	/* Switch drive to read if applicable */
+	write_bit ( basher, MII_BIT_DRIVE, ( cmd & MII_BIT_CMD_RW ) );
+
+	/* Allow space for turnaround */
+	mii_bit_xfer ( basher, MII_BIT_SWITCH_MASK, MII_BIT_SWITCH );
+
+	/* Read or write data */
+	data = mii_bit_xfer (basher, MII_BIT_DATA_MASK, data );
+
+	/* Initiate drive for read */
+	write_bit ( basher, MII_BIT_DRIVE, 0 );
+
+	return data;
+}
+
+/**
+ * Read from MII register
+ *
+ * @v mdio		MII interface
+ * @v phy		PHY address
+ * @v reg		Register address
+ * @ret data		Data read, or negative error
+ */
+static int mii_bit_read ( struct mii_interface *mdio, unsigned int phy,
+			  unsigned int reg ) {
+	struct mii_bit_basher *miibit =
+		container_of ( mdio, struct mii_bit_basher, mdio );
+	struct bit_basher *basher = &miibit->basher;
+
+	return mii_bit_rw ( basher, phy, reg, 0, MII_BIT_CMD_READ );
+}
+
+/**
+ * Write to MII register
+ *
+ * @v mdio		MII interface
+ * @v phy		PHY address
+ * @v reg		Register address
+ * @v data		Data to write
+ * @ret rc		Return status code
+ */
+static int mii_bit_write ( struct mii_interface *mdio, unsigned int phy,
+			   unsigned int reg, unsigned int data ) {
+	struct mii_bit_basher *miibit =
+		container_of ( mdio, struct mii_bit_basher, mdio );
+	struct bit_basher *basher = &miibit->basher;
+
+	mii_bit_rw ( basher, phy, reg, data, MII_BIT_CMD_WRITE );
+	return 0;
+}
+
+/** MII bit basher operations */
+static struct mii_operations mii_bit_op = {
+	.read = mii_bit_read,
+	.write = mii_bit_write,
+};
+
+/**
+ * Initialise bit-bashing interface
+ *
+ * @v miibit		MII bit basher
+ */
+void init_mii_bit_basher ( struct mii_bit_basher *miibit ) {
+	mdio_init ( &miibit->mdio, &mii_bit_op );
+};
diff --git a/src/drivers/infiniband/CIB_PRM.h b/src/drivers/infiniband/CIB_PRM.h
index 6d07c01..d578f9b 100755
--- a/src/drivers/infiniband/CIB_PRM.h
+++ b/src/drivers/infiniband/CIB_PRM.h
@@ -33,7 +33,7 @@ typedef uint16_t		__be16;
 
 #define GOLAN_PCI_CMD_XPORT			7
 #define CMD_OWNER_HW				0x1
-
+#define GOLAN_LOG_MAX_QP			0x1
 #define IB_NUM_PKEYS		0x20
 
 struct health_buffer {
@@ -229,8 +229,7 @@ struct golan_hca_cap {
 	u8		rsvd1[16];
 	u8		log_max_srq_sz;
 	u8		log_max_qp_sz;
-	u8		rsvd2;
-	u8		log_max_qp;
+	__be16		log_max_qp;
 	u8		log_max_strq_sz;
 	u8		log_max_srqs;
 	u8		rsvd4[2];
diff --git a/src/drivers/infiniband/golan.c b/src/drivers/infiniband/golan.c
index 61331d4..18ebfb1 100755
--- a/src/drivers/infiniband/golan.c
+++ b/src/drivers/infiniband/golan.c
@@ -363,7 +363,7 @@ static inline int golan_set_hca_cap(struct golan *golan)
 	DBGC( golan , "%s caps.log_pg_sz = %d\n", __FUNCTION__, golan->caps.log_pg_sz);
 	DBGC( golan , "%s caps.log_uar_sz = %d\n", __FUNCTION__, be32_to_cpu(golan->caps.uar_page_sz));
 	golan->caps.uar_page_sz = 0;
-
+	golan->caps.log_max_qp = GOLAN_LOG_MAX_QP;
 
 	memcpy(((struct golan_hca_cap *)GET_INBOX(golan, GEN_MBOX)),
 		   &(golan->caps),
@@ -2586,8 +2586,6 @@ struct flexboot_nodnic_callbacks shomron_nodnic_callbacks = {
 	.tx_uar_send_doorbell_fn = shomron_tx_uar_send_db,
 };
 
-static int shomron_nodnic_supported = 0;
-
 static int shomron_nodnic_is_supported ( struct pci_device *pci ) {
 	if ( DEVICE_IS_CIB ( pci->device ) )
 		return 0;
@@ -2607,8 +2605,7 @@ static int golan_probe ( struct pci_device *pci ) {
 		goto probe_done;
 	}
 
-	shomron_nodnic_supported = shomron_nodnic_is_supported ( pci );
-	if ( shomron_nodnic_supported ) {
+	if ( shomron_nodnic_is_supported ( pci ) ) {
 		DBG ( "%s: Using NODNIC driver\n", __FUNCTION__ );
 		rc = flexboot_nodnic_probe ( pci, &shomron_nodnic_callbacks, NULL );
 	} else {
@@ -2624,7 +2621,7 @@ probe_done:
 static void golan_remove ( struct pci_device *pci ) {
 	DBG ( "%s: start\n", __FUNCTION__ );
 
-	if ( ! shomron_nodnic_supported ) {
+	if ( ! shomron_nodnic_is_supported ( pci ) ) {
 		DBG ( "%s: Using normal driver remove\n", __FUNCTION__ );
 		golan_remove_normal ( pci );
 		return;
diff --git a/src/drivers/net/efi/nii.c b/src/drivers/net/efi/nii.c
index 1700b4b..2d87e0c 100644
--- a/src/drivers/net/efi/nii.c
+++ b/src/drivers/net/efi/nii.c
@@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #include <string.h>
 #include <strings.h>
+#include <stdlib.h>
 #include <unistd.h>
 #include <errno.h>
 #include <ipxe/netdevice.h>
@@ -137,6 +138,16 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 #define PCI_MAX_BAR 6
 
+/** An NII memory mapping */
+struct nii_mapping {
+	/** List of mappings */
+	struct list_head list;
+	/** Mapped address */
+	UINT64 addr;
+	/** Mapping cookie created by PCI I/O protocol */
+	VOID *mapping;
+};
+
 /** An NII NIC */
 struct nii_nic {
 	/** EFI device */
@@ -179,6 +190,9 @@ struct nii_nic {
 	struct io_buffer *txbuf;
 	/** Current receive buffer */
 	struct io_buffer *rxbuf;
+
+	/** Mapping list */
+	struct list_head mappings;
 };
 
 /** Maximum number of received packets per poll */
@@ -280,7 +294,19 @@ static int nii_pci_open ( struct nii_nic *nii ) {
  */
 static void nii_pci_close ( struct nii_nic *nii ) {
 	EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
+	struct nii_mapping *map;
+	struct nii_mapping *tmp;
+
+	/* Remove any stale mappings */
+	list_for_each_entry_safe ( map, tmp, &nii->mappings, list ) {
+		DBGC ( nii, "NII %s removing stale mapping %#llx\n",
+		       nii->dev.name, ( ( unsigned long long ) map->addr ) );
+		nii->pci_io->Unmap ( nii->pci_io, map->mapping );
+		list_del ( &map->list );
+		free ( map );
+	}
 
+	/* Close protocols */
 	bs->CloseProtocol ( nii->pci_device, &efi_pci_io_protocol_guid,
 			    efi_image_handle, nii->efidev->device );
 }
@@ -332,6 +358,139 @@ static EFIAPI VOID nii_io ( UINT64 unique_id, UINT8 op, UINT8 len, UINT64 addr,
 }
 
 /**
+ * Map callback
+ *
+ * @v unique_id		NII NIC
+ * @v addr		Address of memory to be mapped
+ * @v len		Length of memory to be mapped
+ * @v dir		Direction of data flow
+ * @v mapped		Device mapped address to fill in
+ */
+static EFIAPI VOID nii_map ( UINT64 unique_id, UINT64 addr, UINT32 len,
+			     UINT32 dir, UINT64 mapped ) {
+	struct nii_nic *nii = ( ( void * ) ( intptr_t ) unique_id );
+	EFI_PHYSICAL_ADDRESS *phys = ( ( void * ) ( intptr_t ) mapped );
+	EFI_PCI_IO_PROTOCOL_OPERATION op;
+	struct nii_mapping *map;
+	UINTN count = len;
+	EFI_STATUS efirc;
+	int rc;
+
+	/* Return a zero mapped address on failure */
+	*phys = 0;
+
+	/* Determine PCI mapping operation */
+	switch ( dir ) {
+	case TO_AND_FROM_DEVICE:
+		op = EfiPciIoOperationBusMasterCommonBuffer;
+		break;
+	case FROM_DEVICE:
+		op = EfiPciIoOperationBusMasterWrite;
+		break;
+	case TO_DEVICE:
+		op = EfiPciIoOperationBusMasterRead;
+		break;
+	default:
+		DBGC ( nii, "NII %s unsupported mapping direction %d\n",
+		       nii->dev.name, dir );
+		goto err_dir;
+	}
+
+	/* Allocate a mapping record */
+	map = zalloc ( sizeof ( *map ) );
+	if ( ! map )
+		goto err_alloc;
+	map->addr = addr;
+
+	/* Create map */
+	if ( ( efirc = nii->pci_io->Map ( nii->pci_io, op,
+					  ( ( void * ) ( intptr_t ) addr ),
+					  &count, phys, &map->mapping ) ) != 0){
+		rc = -EEFI ( efirc );
+		DBGC ( nii, "NII %s map operation failed: %s\n",
+		       nii->dev.name, strerror ( rc ) );
+		goto err_map;
+	}
+
+	/* Add to list of mappings */
+	list_add ( &map->list, &nii->mappings );
+	DBGC2 ( nii, "NII %s mapped %#llx+%#x->%#llx\n",
+		nii->dev.name, ( ( unsigned long long ) addr ),
+		len, ( ( unsigned long long ) *phys ) );
+	return;
+
+	list_del ( &map->list );
+ err_map:
+	free ( map );
+ err_alloc:
+ err_dir:
+	return;
+}
+
+/**
+ * Unmap callback
+ *
+ * @v unique_id		NII NIC
+ * @v addr		Address of mapped memory
+ * @v len		Length of mapped memory
+ * @v dir		Direction of data flow
+ * @v mapped		Device mapped address
+ */
+static EFIAPI VOID nii_unmap ( UINT64 unique_id, UINT64 addr, UINT32 len,
+			       UINT32 dir __unused, UINT64 mapped ) {
+	struct nii_nic *nii = ( ( void * ) ( intptr_t ) unique_id );
+	struct nii_mapping *map;
+
+	/* Locate mapping record */
+	list_for_each_entry ( map, &nii->mappings, list ) {
+		if ( map->addr == addr ) {
+			nii->pci_io->Unmap ( nii->pci_io, map->mapping );
+			list_del ( &map->list );
+			free ( map );
+			DBGC2 ( nii, "NII %s unmapped %#llx+%#x->%#llx\n",
+				nii->dev.name, ( ( unsigned long long ) addr ),
+				len, ( ( unsigned long long ) mapped ) );
+			return;
+		}
+	}
+
+	DBGC ( nii, "NII %s non-existent mapping %#llx+%#x->%#llx\n",
+	       nii->dev.name, ( ( unsigned long long ) addr ),
+	       len, ( ( unsigned long long ) mapped ) );
+}
+
+/**
+ * Sync callback
+ *
+ * @v unique_id		NII NIC
+ * @v addr		Address of mapped memory
+ * @v len		Length of mapped memory
+ * @v dir		Direction of data flow
+ * @v mapped		Device mapped address
+ */
+static EFIAPI VOID nii_sync ( UINT64 unique_id __unused, UINT64 addr,
+			      UINT32 len, UINT32 dir, UINT64 mapped ) {
+	const void *src;
+	void *dst;
+
+	/* Do nothing if this is an identity mapping */
+	if ( addr == mapped )
+		return;
+
+	/* Determine direction */
+	if ( dir == FROM_DEVICE ) {
+		src = ( ( void * ) ( intptr_t ) mapped );
+		dst = ( ( void * ) ( intptr_t ) addr );
+	} else {
+		src = ( ( void * ) ( intptr_t ) addr );
+		dst = ( ( void * ) ( intptr_t ) mapped );
+	}
+
+	/* Copy data */
+	memcpy ( dst, src, len );
+}
+
+/**
  * Delay callback
  *
  * @v unique_id		NII NIC
@@ -499,6 +658,9 @@ static int nii_start_undi ( struct nii_nic *nii ) {
 	cpb.Delay = ( ( intptr_t ) nii_delay );
 	cpb.Block = ( ( intptr_t ) nii_block );
 	cpb.Mem_IO = ( ( intptr_t ) nii_io );
+	cpb.Map_Mem = ( ( intptr_t ) nii_map );
+	cpb.UnMap_Mem = ( ( intptr_t ) nii_unmap );
+	cpb.Sync_Mem = ( ( intptr_t ) nii_sync );
 	cpb.Unique_ID = ( ( intptr_t ) nii );
 
 	/* Issue command */
@@ -1063,6 +1225,7 @@ int nii_start ( struct efi_device *efidev ) {
 	netdev_init ( netdev, &nii_operations );
 	nii = netdev->priv;
 	nii->efidev = efidev;
+	INIT_LIST_HEAD ( &nii->mappings );
 	netdev->ll_broadcast = nii->broadcast;
 	efidev_set_drvdata ( efidev, netdev );
 
diff --git a/src/drivers/net/ena.c b/src/drivers/net/ena.c
index 8d29979..0f25c0b 100644
--- a/src/drivers/net/ena.c
+++ b/src/drivers/net/ena.c
@@ -565,6 +565,7 @@ static int ena_get_device_attributes ( struct net_device *netdev ) {
 	feature = &rsp->get_feature.feature;
 	memcpy ( netdev->hw_addr, feature->device.mac, ETH_ALEN );
 	netdev->max_pkt_len = le32_to_cpu ( feature->device.mtu );
+	netdev->mtu = ( netdev->max_pkt_len - ETH_HLEN );
 
 	DBGC ( ena, "ENA %p MAC %s MTU %zd\n",
 	       ena, eth_ntoa ( netdev->hw_addr ), netdev->max_pkt_len );
diff --git a/src/drivers/net/icplus.c b/src/drivers/net/icplus.c
new file mode 100644
index 0000000..4bed924
--- /dev/null
+++ b/src/drivers/net/icplus.c
@@ -0,0 +1,809 @@
+/*
+ * Copyright (C) 2018 Sylvie Barlow <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <byteswap.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/ethernet.h>
+#include <ipxe/if_ether.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/malloc.h>
+#include <ipxe/pci.h>
+#include "icplus.h"
+
+/** @file
+ *
+ * IC+ network driver
+ *
+ */
+
+/******************************************************************************
+ *
+ * Device reset
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Reset hardware
+ *
+ * @v icp		IC+ device
+ * @ret rc		Return status code
+ */
+static int icplus_reset ( struct icplus_nic *icp ) {
+	uint32_t asicctrl;
+	unsigned int i;
+
+	/* Trigger reset */
+	writel ( ( ICP_ASICCTRL_GLOBALRESET | ICP_ASICCTRL_DMA |
+		   ICP_ASICCTRL_FIFO | ICP_ASICCTRL_NETWORK | ICP_ASICCTRL_HOST |
+		   ICP_ASICCTRL_AUTOINIT ), ( icp->regs + ICP_ASICCTRL ) );
+
+	/* Wait for reset to complete */
+	for ( i = 0 ; i < ICP_RESET_MAX_WAIT_MS ; i++ ) {
+
+		/* Check if device is ready */
+		asicctrl = readl ( icp->regs + ICP_ASICCTRL );
+		if ( ! ( asicctrl & ICP_ASICCTRL_RESETBUSY ) )
+			return 0;
+
+		/* Delay */
+		mdelay ( 1 );
+	}
+
+	DBGC ( icp, "ICPLUS %p timed out waiting for reset (asicctrl %#08x)\n",
+	       icp, asicctrl );
+	return -ETIMEDOUT;
+}
+
+/******************************************************************************
+ *
+ * EEPROM interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Read data from EEPROM
+ *
+ * @v nvs		NVS device
+ * @v address		Address from which to read
+ * @v data		Data buffer
+ * @v len		Length of data buffer
+ * @ret rc		Return status code
+ */
+static int icplus_read_eeprom ( struct nvs_device *nvs, unsigned int address,
+				void *data, size_t len ) {
+	struct icplus_nic *icp =
+		container_of ( nvs, struct icplus_nic, eeprom );
+	unsigned int i;
+	uint16_t eepromctrl;
+	uint16_t *data_word = data;
+
+	/* Sanity check.  We advertise a blocksize of one word, so
+	 * should only ever receive single-word requests.
+	 */
+	assert ( len == sizeof ( *data_word ) );
+
+	/* Initiate read */
+	writew ( ( ICP_EEPROMCTRL_OPCODE_READ |
+		   ICP_EEPROMCTRL_ADDRESS ( address ) ),
+		 ( icp->regs + ICP_EEPROMCTRL ) );
+
+	/* Wait for read to complete */
+	for ( i = 0 ; i < ICP_EEPROM_MAX_WAIT_MS ; i++ ) {
+
+		/* If read is not complete, delay 1ms and retry */
+		eepromctrl = readw ( icp->regs + ICP_EEPROMCTRL );
+		if ( eepromctrl & ICP_EEPROMCTRL_BUSY ) {
+			mdelay ( 1 );
+			continue;
+		}
+
+		/* Extract data */
+		*data_word = cpu_to_le16 ( readw ( icp->regs + ICP_EEPROMDATA ));
+		return 0;
+	}
+
+	DBGC ( icp, "ICPLUS %p timed out waiting for EEPROM read\n", icp );
+	return -ETIMEDOUT;
+}
+
+/**
+ * Write data to EEPROM
+ *
+ * @v nvs		NVS device
+ * @v address		Address to which to write
+ * @v data		Data buffer
+ * @v len		Length of data buffer
+ * @ret rc		Return status code
+ */
+static int icplus_write_eeprom ( struct nvs_device *nvs,
+				 unsigned int address __unused,
+				 const void *data __unused,
+				 size_t len __unused ) {
+	struct icplus_nic *icp =
+		container_of ( nvs, struct icplus_nic, eeprom );
+
+	DBGC ( icp, "ICPLUS %p EEPROM write not supported\n", icp );
+	return -ENOTSUP;
+}
+
+/**
+ * Initialise EEPROM
+ *
+ * @v icp		IC+ device
+ */
+static void icplus_init_eeprom ( struct icplus_nic *icp ) {
+
+	/* The hardware supports only single-word reads */
+	icp->eeprom.word_len_log2 = ICP_EEPROM_WORD_LEN_LOG2;
+	icp->eeprom.size = ICP_EEPROM_MIN_SIZE_WORDS;
+	icp->eeprom.block_size = 1;
+	icp->eeprom.read = icplus_read_eeprom;
+	icp->eeprom.write = icplus_write_eeprom;
+}
+
+/******************************************************************************
+ *
+ * MII interface
+ *
+ ******************************************************************************
+ */
+
+/** Pin mapping for MII bit-bashing interface */
+static const uint8_t icplus_mii_bits[] = {
+	[MII_BIT_MDC]	= ICP_PHYCTRL_MGMTCLK,
+	[MII_BIT_MDIO]	= ICP_PHYCTRL_MGMTDATA,
+	[MII_BIT_DRIVE]	= ICP_PHYCTRL_MGMTDIR,
+};
+
+/**
+ * Read input bit
+ *
+ * @v basher		Bit-bashing interface
+ * @v bit_id		Bit number
+ * @ret zero		Input is a logic 0
+ * @ret non-zero	Input is a logic 1
+ */
+static int icplus_mii_read_bit ( struct bit_basher *basher,
+				 unsigned int bit_id ) {
+	struct icplus_nic *icp = container_of ( basher, struct icplus_nic,
+						miibit.basher );
+	uint8_t mask = icplus_mii_bits[bit_id];
+	uint8_t reg;
+
+	DBG_DISABLE ( DBGLVL_IO );
+	reg = readb ( icp->regs + ICP_PHYCTRL );
+	DBG_ENABLE ( DBGLVL_IO );
+	return ( reg & mask );
+}
+
+/**
+ * Set/clear output bit
+ *
+ * @v basher		Bit-bashing interface
+ * @v bit_id		Bit number
+ * @v data		Value to write
+ */
+static void icplus_mii_write_bit ( struct bit_basher *basher,
+				   unsigned int bit_id, unsigned long data ) {
+	struct icplus_nic *icp = container_of ( basher, struct icplus_nic,
+						miibit.basher );
+	uint8_t mask = icplus_mii_bits[bit_id];
+	uint8_t reg;
+
+	DBG_DISABLE ( DBGLVL_IO );
+	reg = readb ( icp->regs + ICP_PHYCTRL );
+	reg &= ~mask;
+	reg |= ( data & mask );
+	writeb ( reg, icp->regs + ICP_PHYCTRL );
+	readb ( icp->regs + ICP_PHYCTRL ); /* Ensure write reaches chip */
+	DBG_ENABLE ( DBGLVL_IO );
+}
+
+/** MII bit-bashing interface */
+static struct bit_basher_operations icplus_basher_ops = {
+	.read = icplus_mii_read_bit,
+	.write = icplus_mii_write_bit,
+};
+
+/******************************************************************************
+ *
+ * Link state
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Configure PHY
+ *
+ * @v icp		IC+ device
+ * @ret rc		Return status code
+ */
+static int icplus_init_phy ( struct icplus_nic *icp ) {
+	uint32_t asicctrl;
+	int rc;
+
+	/* Find PHY address */
+	if ( ( rc = mii_find ( &icp->mii ) ) != 0 ) {
+		DBGC ( icp, "ICPLUS %p could not find PHY address: %s\n",
+		       icp, strerror ( rc ) );
+		return rc;
+	}
+
+	/* Configure PHY to advertise 1000Mbps if applicable */
+	asicctrl = readl ( icp->regs + ICP_ASICCTRL );
+	if ( asicctrl & ICP_ASICCTRL_PHYSPEED1000 ) {
+		if ( ( rc = mii_write ( &icp->mii, MII_CTRL1000,
+					ADVERTISE_1000FULL ) ) != 0 ) {
+			DBGC ( icp, "ICPLUS %p could not advertise 1000Mbps: "
+			       "%s\n", icp, strerror ( rc ) );
+			return rc;
+		}
+	}
+
+	/* Reset PHY */
+	if ( ( rc = mii_reset ( &icp->mii ) ) != 0 ) {
+		DBGC ( icp, "ICPLUS %p could not reset PHY: %s\n",
+		       icp, strerror ( rc ) );
+		return rc;
+	}
+
+	return 0;
+}
+
+/**
+ * Check link state
+ *
+ * @v netdev		Network device
+ */
+static void icplus_check_link ( struct net_device *netdev ) {
+	struct icplus_nic *icp = netdev->priv;
+	uint8_t phyctrl;
+
+	/* Read link status */
+	phyctrl = readb ( icp->regs + ICP_PHYCTRL );
+	DBGC ( icp, "ICPLUS %p PHY control is %02x\n", icp, phyctrl );
+
+	/* Update network device */
+	if ( phyctrl & ICP_PHYCTRL_LINKSPEED ) {
+		netdev_link_up ( netdev );
+	} else {
+		netdev_link_down ( netdev );
+	}
+}
+
+/******************************************************************************
+ *
+ * Network device interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Set descriptor ring base address
+ *
+ * @v icp		IC+ device
+ * @v offset		Register offset
+ * @v address		Base address
+ */
+static inline void icplus_set_base ( struct icplus_nic *icp, unsigned int offset,
+				     void *base ) {
+	physaddr_t phys = virt_to_bus ( base );
+
+	/* Program base address registers */
+	writel ( ( phys & 0xffffffffUL ),
+		 ( icp->regs + offset + ICP_BASE_LO ) );
+	if ( sizeof ( phys ) > sizeof ( uint32_t ) ) {
+		writel ( ( ( ( uint64_t ) phys ) >> 32 ),
+			 ( icp->regs + offset + ICP_BASE_HI ) );
+	} else {
+		writel ( 0, ( icp->regs + offset + ICP_BASE_HI ) );
+	}
+}
+
+/**
+ * Create descriptor ring
+ *
+ * @v icp		IC+ device
+ * @v ring		Descriptor ring
+ * @ret rc		Return status code
+ */
+static int icplus_create_ring ( struct icplus_nic *icp, struct icplus_ring *ring ) {
+	size_t len = ( sizeof ( ring->entry[0] ) * ICP_NUM_DESC );
+	int rc;
+	unsigned int i;
+	struct icplus_descriptor *desc;
+	struct icplus_descriptor *next;
+
+	/* Allocate descriptor ring */
+	ring->entry = malloc_dma ( len, ICP_ALIGN );
+	if ( ! ring->entry ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+
+	/* Initialise descriptor ring */
+	memset ( ring->entry, 0, len );
+	for ( i = 0 ; i < ICP_NUM_DESC ; i++ ) {
+		desc = &ring->entry[i];
+		next = &ring->entry[ ( i + 1 ) % ICP_NUM_DESC ];
+		desc->next = cpu_to_le64 ( virt_to_bus ( next ) );
+		desc->flags = ( ICP_TX_UNALIGN | ICP_TX_INDICATE );
+		desc->control = ( ICP_TX_SOLE_FRAG | ICP_DONE );
+	}
+
+	/* Reset transmit producer & consumer counters */
+	ring->prod = 0;
+	ring->cons = 0;
+
+	DBGC ( icp, "ICP %p %s ring at [%#08lx,%#08lx)\n",
+	       icp, ( ( ring->listptr == ICP_TFDLISTPTR ) ? "TX" : "RX" ),
+	       virt_to_bus ( ring->entry ),
+	       ( virt_to_bus ( ring->entry ) + len ) );
+	return 0;
+
+	free_dma ( ring->entry, len );
+	ring->entry = NULL;
+ err_alloc:
+	return rc;
+}
+
+/**
+ * Destroy descriptor ring
+ *
+ * @v icp		IC+ device
+ * @v ring		Descriptor ring
+ */
+static void icplus_destroy_ring ( struct icplus_nic *icp __unused,
+				  struct icplus_ring *ring ) {
+	size_t len = ( sizeof ( ring->entry[0] ) * ICP_NUM_DESC );
+
+	/* Free descriptor ring */
+	free_dma ( ring->entry, len );
+	ring->entry = NULL;
+}
+
+/**
+ * Refill receive descriptor ring
+ *
+ * @v icp		IC+ device
+ */
+void icplus_refill_rx ( struct icplus_nic *icp ) {
+	struct icplus_descriptor *desc;
+	struct io_buffer *iobuf;
+	unsigned int rx_idx;
+	physaddr_t address;
+	unsigned int refilled = 0;
+
+	/* Refill ring */
+	while ( ( icp->rx.prod - icp->rx.cons ) < ICP_NUM_DESC ) {
+
+		/* Allocate I/O buffer */
+		iobuf = alloc_iob ( ICP_RX_MAX_LEN );
+		if ( ! iobuf ) {
+			/* Wait for next refill */
+			break;
+		}
+
+		/* Get next receive descriptor */
+		rx_idx = ( icp->rx.prod++ % ICP_NUM_DESC );
+		desc = &icp->rx.entry[rx_idx];
+
+		/* Populate receive descriptor */
+		address = virt_to_bus ( iobuf->data );
+	        desc->data.address = cpu_to_le64 ( address );
+		desc->data.len = cpu_to_le16 ( ICP_RX_MAX_LEN );
+		wmb();
+		desc->control = 0;
+
+		/* Record I/O buffer */
+		assert ( icp->rx_iobuf[rx_idx] == NULL );
+		icp->rx_iobuf[rx_idx] = iobuf;
+
+		DBGC2 ( icp, "ICP %p RX %d is [%llx,%llx)\n", icp, rx_idx,
+			( ( unsigned long long ) address ),
+			( ( unsigned long long ) address + ICP_RX_MAX_LEN ) );
+		refilled++;
+	}
+
+	/* Push descriptors to card, if applicable */
+	if ( refilled ) {
+		wmb();
+		writew ( ICP_DMACTRL_RXPOLLNOW, icp->regs + ICP_DMACTRL );
+	}
+}
+
+/**
+ * Open network device
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int icplus_open ( struct net_device *netdev ) {
+	struct icplus_nic *icp = netdev->priv;
+	int rc;
+
+	/* Create transmit descriptor ring */
+	if ( ( rc = icplus_create_ring ( icp, &icp->tx ) ) != 0 )
+		goto err_create_tx;
+
+	/* Create receive descriptor ring */
+	if ( ( rc = icplus_create_ring ( icp, &icp->rx ) ) != 0 )
+		goto err_create_rx;
+
+	/* Program descriptor base address */
+	icplus_set_base ( icp, icp->tx.listptr, icp->tx.entry );
+	icplus_set_base ( icp, icp->rx.listptr, icp->rx.entry );
+
+	/* Enable receive mode */
+	writew ( ( ICP_RXMODE_UNICAST | ICP_RXMODE_MULTICAST |
+		   ICP_RXMODE_BROADCAST | ICP_RXMODE_ALLFRAMES ),
+		 icp->regs + ICP_RXMODE );
+
+	/* Enable transmitter and receiver */
+	writel ( ( ICP_MACCTRL_TXENABLE | ICP_MACCTRL_RXENABLE |
+		   ICP_MACCTRL_DUPLEX ), icp->regs + ICP_MACCTRL );
+
+	/* Fill receive ring */
+	icplus_refill_rx ( icp );
+
+	/* Check link state */
+	icplus_check_link ( netdev );
+
+	return 0;
+
+	icplus_reset ( icp );
+	icplus_destroy_ring ( icp, &icp->rx );
+ err_create_rx:
+	icplus_destroy_ring ( icp, &icp->tx );
+ err_create_tx:
+	return rc;
+}
+
+/**
+ * Close network device
+ *
+ * @v netdev		Network device
+ */
+static void icplus_close ( struct net_device *netdev ) {
+	struct icplus_nic *icp = netdev->priv;
+	unsigned int i;
+
+	/* Perform global reset */
+	icplus_reset ( icp );
+
+	/* Destroy receive descriptor ring */
+	icplus_destroy_ring ( icp, &icp->rx );
+
+	/* Destroy transmit descriptor ring */
+	icplus_destroy_ring ( icp, &icp->tx );
+
+	/* Discard any unused receive buffers */
+	for ( i = 0 ; i < ICP_NUM_DESC ; i++ ) {
+		if ( icp->rx_iobuf[i] )
+			free_iob ( icp->rx_iobuf[i] );
+		icp->rx_iobuf[i] = NULL;
+	}
+}
+
+/**
+ * Transmit packet
+ *
+ * @v netdev		Network device
+ * @v iobuf		I/O buffer
+ * @ret rc		Return status code
+ */
+static int icplus_transmit ( struct net_device *netdev,
+			     struct io_buffer *iobuf ) {
+	struct icplus_nic *icp = netdev->priv;
+	struct icplus_descriptor *desc;
+	unsigned int tx_idx;
+	physaddr_t address;
+
+	/* Check if ring is full */
+	if ( ( icp->tx.prod - icp->tx.cons ) >= ICP_NUM_DESC ) {
+		DBGC ( icp, "ICP %p out of transmit descriptors\n", icp );
+		return -ENOBUFS;
+	}
+
+	/* Find TX descriptor entry to use */
+	tx_idx = ( icp->tx.prod++ % ICP_NUM_DESC );
+	desc = &icp->tx.entry[tx_idx];
+
+	/* Fill in TX descriptor */
+	address = virt_to_bus ( iobuf->data );
+	desc->data.address = cpu_to_le64 ( address );
+	desc->data.len = cpu_to_le16 ( iob_len ( iobuf ) );
+	wmb();
+	desc->control = ICP_TX_SOLE_FRAG;
+	wmb();
+
+	/* Ring doorbell */
+	writew ( ICP_DMACTRL_TXPOLLNOW, icp->regs + ICP_DMACTRL );
+
+	DBGC2 ( icp, "ICP %p TX %d is [%llx,%llx)\n", icp, tx_idx,
+		( ( unsigned long long ) address ),
+		( ( unsigned long long ) address + iob_len ( iobuf ) ) );
+	DBGC2_HDA ( icp, virt_to_phys ( desc ), desc, sizeof ( *desc ) );
+	return 0;
+}
+
+/**
+ * Poll for completed packets
+ *
+ * @v netdev		Network device
+ */
+static void icplus_poll_tx ( struct net_device *netdev ) {
+	struct icplus_nic *icp = netdev->priv;
+	struct icplus_descriptor *desc;
+	unsigned int tx_idx;
+
+	/* Check for completed packets */
+	while ( icp->tx.cons != icp->tx.prod ) {
+
+		/* Get next transmit descriptor */
+		tx_idx = ( icp->tx.cons % ICP_NUM_DESC );
+		desc = &icp->tx.entry[tx_idx];
+
+		/* Stop if descriptor is still in use */
+		if ( ! ( desc->control & ICP_DONE ) )
+			return;
+
+		/* Complete TX descriptor */
+		DBGC2 ( icp, "ICP %p TX %d complete\n", icp, tx_idx );
+		netdev_tx_complete_next ( netdev );
+		icp->tx.cons++;
+	}
+}
+
+/**
+ * Poll for received packets
+ *
+ * @v netdev		Network device
+ */
+static void icplus_poll_rx ( struct net_device *netdev ) {
+	struct icplus_nic *icp = netdev->priv;
+	struct icplus_descriptor *desc;
+	struct io_buffer *iobuf;
+	unsigned int rx_idx;
+	size_t len;
+
+	/* Check for received packets */
+	while ( icp->rx.cons != icp->rx.prod ) {
+
+		/* Get next transmit descriptor */
+		rx_idx = ( icp->rx.cons % ICP_NUM_DESC );
+		desc = &icp->rx.entry[rx_idx];
+
+		/* Stop if descriptor is still in use */
+		if ( ! ( desc->control & ICP_DONE ) )
+			return;
+
+		/* Populate I/O buffer */
+		iobuf = icp->rx_iobuf[rx_idx];
+		icp->rx_iobuf[rx_idx] = NULL;
+		len = le16_to_cpu ( desc->len );
+		iob_put ( iobuf, len );
+
+		/* Hand off to network stack */
+		if ( desc->flags & ( ICP_RX_ERR_OVERRUN | ICP_RX_ERR_RUNT |
+				     ICP_RX_ERR_ALIGN | ICP_RX_ERR_FCS |
+				     ICP_RX_ERR_OVERSIZED | ICP_RX_ERR_LEN ) ) {
+			DBGC ( icp, "ICP %p RX %d error (length %zd, "
+			       "flags %02x)\n", icp, rx_idx, len, desc->flags );
+			netdev_rx_err ( netdev, iobuf, -EIO );
+		} else {
+			DBGC2 ( icp, "ICP %p RX %d complete (length "
+				"%zd)\n", icp, rx_idx, len );
+			netdev_rx ( netdev, iobuf );
+		}
+		icp->rx.cons++;
+	}
+}
+
+/**
+ * Poll for completed and received packets
+ *
+ * @v netdev		Network device
+ */
+static void icplus_poll ( struct net_device *netdev ) {
+	struct icplus_nic *icp = netdev->priv;
+	uint16_t intstatus;
+	uint32_t txstatus;
+
+	/* Check for interrupts */
+	intstatus = readw ( icp->regs + ICP_INTSTATUS );
+
+	/* Poll for TX completions, if applicable */
+	if ( intstatus & ICP_INTSTATUS_TXCOMPLETE ) {
+		txstatus = readl ( icp->regs + ICP_TXSTATUS );
+		if ( txstatus & ICP_TXSTATUS_ERROR )
+			DBGC ( icp, "ICP %p TX error: %08x\n", icp, txstatus );
+		icplus_poll_tx ( netdev );
+	}
+
+	/* Poll for RX completions, if applicable */
+	if ( intstatus & ICP_INTSTATUS_RXDMACOMPLETE ) {
+		writew ( ICP_INTSTATUS_RXDMACOMPLETE, icp->regs + ICP_INTSTATUS );
+		icplus_poll_rx ( netdev );
+	}
+
+	/* Check link state, if applicable */
+	if ( intstatus & ICP_INTSTATUS_LINKEVENT ) {
+		writew ( ICP_INTSTATUS_LINKEVENT, icp->regs + ICP_INTSTATUS );
+		icplus_check_link ( netdev );
+	}
+
+	/* Refill receive ring */
+	icplus_refill_rx ( icp );
+}
+
+/**
+ * Enable or disable interrupts
+ *
+ * @v netdev		Network device
+ * @v enable		Interrupts should be enabled
+ */
+static void icplus_irq ( struct net_device *netdev, int enable ) {
+	struct icplus_nic *icp = netdev->priv;
+
+	DBGC ( icp, "ICPLUS %p does not yet support interrupts\n", icp );
+	( void ) enable;
+}
+
+/** IC+ network device operations */
+static struct net_device_operations icplus_operations = {
+	.open		= icplus_open,
+	.close		= icplus_close,
+	.transmit	= icplus_transmit,
+	.poll		= icplus_poll,
+	.irq		= icplus_irq,
+};
+
+/******************************************************************************
+ *
+ * PCI interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Probe PCI device
+ *
+ * @v pci		PCI device
+ * @ret rc		Return status code
+ */
+static int icplus_probe ( struct pci_device *pci ) {
+	struct net_device *netdev;
+	struct icplus_nic *icp;
+	int rc;
+
+	/* Allocate and initialise net device */
+	netdev = alloc_etherdev ( sizeof ( *icp ) );
+	if ( ! netdev ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+	netdev_init ( netdev, &icplus_operations );
+	icp = netdev->priv;
+	pci_set_drvdata ( pci, netdev );
+	netdev->dev = &pci->dev;
+	memset ( icp, 0, sizeof ( *icp ) );
+	icp->miibit.basher.op = &icplus_basher_ops;
+	init_mii_bit_basher ( &icp->miibit );
+	mii_init ( &icp->mii, &icp->miibit.mdio, 0 );
+	icp->tx.listptr = ICP_TFDLISTPTR;
+	icp->rx.listptr = ICP_RFDLISTPTR;
+
+	/* Fix up PCI device */
+	adjust_pci_device ( pci );
+
+	/* Map registers */
+	icp->regs = ioremap ( pci->membase, ICP_BAR_SIZE );
+	if ( ! icp->regs ) {
+		rc = -ENODEV;
+		goto err_ioremap;
+	}
+
+	/* Reset the NIC */
+	if ( ( rc = icplus_reset ( icp ) ) != 0 )
+		goto err_reset;
+
+	/* Initialise EEPROM */
+	icplus_init_eeprom ( icp );
+
+	/* Read EEPROM MAC address */
+	if ( ( rc = nvs_read ( &icp->eeprom, ICP_EEPROM_MAC,
+			       netdev->hw_addr, ETH_ALEN ) ) != 0 ) {
+		DBGC ( icp, "ICPLUS %p could not read EEPROM MAC address: %s\n",
+		       icp, strerror ( rc ) );
+		goto err_eeprom;
+	}
+
+	/* Configure PHY */
+	if ( ( rc = icplus_init_phy ( icp ) ) != 0 )
+		goto err_phy;
+
+	/* Register network device */
+	if ( ( rc = register_netdev ( netdev ) ) != 0 )
+		goto err_register_netdev;
+
+	/* Set initial link state */
+	icplus_check_link ( netdev );
+
+	return 0;
+
+	unregister_netdev ( netdev );
+ err_register_netdev:
+ err_phy:
+ err_eeprom:
+	icplus_reset ( icp );
+ err_reset:
+	iounmap ( icp->regs );
+ err_ioremap:
+	netdev_nullify ( netdev );
+	netdev_put ( netdev );
+ err_alloc:
+	return rc;
+}
+
+/**
+ * Remove PCI device
+ *
+ * @v pci		PCI device
+ */
+static void icplus_remove ( struct pci_device *pci ) {
+	struct net_device *netdev = pci_get_drvdata ( pci );
+	struct icplus_nic *icp = netdev->priv;
+
+	/* Unregister network device */
+	unregister_netdev ( netdev );
+
+	/* Reset card */
+	icplus_reset ( icp );
+
+	/* Free network device */
+	iounmap ( icp->regs );
+	netdev_nullify ( netdev );
+	netdev_put ( netdev );
+}
+
+/** IC+ PCI device IDs */
+static struct pci_device_id icplus_nics[] = {
+	PCI_ROM ( 0x13f0, 0x1023, "ip1000a",	"IP1000A", 0 ),
+};
+
+/** IC+ PCI driver */
+struct pci_driver icplus_driver __pci_driver = {
+	.ids = icplus_nics,
+	.id_count = ( sizeof ( icplus_nics ) / sizeof ( icplus_nics[0] ) ),
+	.probe = icplus_probe,
+	.remove = icplus_remove,
+};
diff --git a/src/drivers/net/icplus.h b/src/drivers/net/icplus.h
new file mode 100644
index 0000000..35fa422
--- /dev/null
+++ b/src/drivers/net/icplus.h
@@ -0,0 +1,206 @@
+#ifndef _ICPLUS_H
+#define _ICPLUS_H
+
+/** @file
+ *
+ * IC+ network driver
+ *
+ */
+
+#include <ipxe/nvs.h>
+#include <ipxe/mii_bit.h>
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+/** BAR size */
+#define ICP_BAR_SIZE 0x200
+
+/** Alignment requirement */
+#define ICP_ALIGN 0x8
+
+/** Base address low register offset */
+#define ICP_BASE_LO 0x0
+
+/** Base address high register offset */
+#define ICP_BASE_HI 0x4
+
+/** ASIC control register (double word) */
+#define ICP_ASICCTRL 0x30
+#define ICP_ASICCTRL_PHYSPEED1000	0x00000040UL	/**< PHY speed 1000 */
+#define ICP_ASICCTRL_GLOBALRESET	0x00010000UL	/**< Global reset */
+#define ICP_ASICCTRL_DMA		0x00080000UL	/**< DMA */
+#define ICP_ASICCTRL_FIFO		0x00100000UL	/**< FIFO */
+#define ICP_ASICCTRL_NETWORK		0x00200000UL	/**< Network */
+#define ICP_ASICCTRL_HOST		0x00400000UL	/**< Host */
+#define ICP_ASICCTRL_AUTOINIT		0x00800000UL	/**< Auto init */
+#define ICP_ASICCTRL_RESETBUSY		0x04000000UL	/**< Reset busy */
+
+/** Maximum time to wait for reset */
+#define ICP_RESET_MAX_WAIT_MS 1000
+
+/** DMA control register (word/double word) */
+#define ICP_DMACTRL 0x00
+#define ICP_DMACTRL_RXPOLLNOW		0x0010		/**< Receive poll now */
+#define ICP_DMACTRL_TXPOLLNOW 		0x1000		/**< Transmit poll now */
+
+/** EEPROM control register (word) */
+#define ICP_EEPROMCTRL 0x4a
+#define ICP_EEPROMCTRL_ADDRESS( x )	( (x) << 0 )	/**< Address */
+#define ICP_EEPROMCTRL_OPCODE( x )	( (x) << 8 )	/**< Opcode */
+#define ICP_EEPROMCTRL_OPCODE_READ \
+	ICP_EEPROMCTRL_OPCODE ( 2 )			/**< Read register */
+#define ICP_EEPROMCTRL_BUSY		0x8000		/**< EEPROM busy */
+
+/** Maximum time to wait for reading EEPROM */
+#define ICP_EEPROM_MAX_WAIT_MS 1000
+
+/** EEPROM word length */
+#define ICP_EEPROM_WORD_LEN_LOG2 1
+
+/** Minimum EEPROM size, in words */
+#define ICP_EEPROM_MIN_SIZE_WORDS 0x20
+
+/** Address of MAC address within EEPROM */
+#define ICP_EEPROM_MAC 0x10
+
+/** EEPROM data register (word) */
+#define ICP_EEPROMDATA 0x48
+
+/** Interupt status register (word) */
+#define ICP_INTSTATUS 0x5e
+#define ICP_INTSTATUS_TXCOMPLETE	0x0004		/**< TX complete */
+#define ICP_INTSTATUS_LINKEVENT		0x0100		/**< Link event */
+#define ICP_INTSTATUS_RXDMACOMPLETE	0x0400		/**< RX DMA complete */
+
+/** MAC control register (double word) */
+#define ICP_MACCTRL 0x6c
+#define ICP_MACCTRL_DUPLEX		0x00000020UL	/**< Duplex select */
+#define ICP_MACCTRL_TXENABLE		0x01000000UL	/**< TX enable */
+#define ICP_MACCTRL_TXDISABLE		0x02000000UL	/**< TX disable */
+#define ICP_MACCTRL_RXENABLE		0x08000000UL	/**< RX enable */
+#define ICP_MACCTRL_RXDISABLE		0x10000000UL	/**< RX disable */
+
+/** PHY control register (byte) */
+#define ICP_PHYCTRL 0x76
+#define ICP_PHYCTRL_MGMTCLK		0x01		/**< Management clock */
+#define ICP_PHYCTRL_MGMTDATA		0x02		/**< Management data */
+#define ICP_PHYCTRL_MGMTDIR		0x04		/**< Management direction */
+#define ICP_PHYCTRL_LINKSPEED		0xc0		/**< Link speed */
+
+/** Receive mode register (word) */
+#define ICP_RXMODE 0x88
+#define ICP_RXMODE_UNICAST		0x0001		/**< Receive unicast */
+#define ICP_RXMODE_MULTICAST		0x0002		/**< Receice multicast */
+#define ICP_RXMODE_BROADCAST		0x0004		/**< Receive broadcast */
+#define ICP_RXMODE_ALLFRAMES		0x0008		/**< Receive all frames */
+
+/** List pointer receive register */
+#define ICP_RFDLISTPTR 0x1c
+
+/** List pointer transmit register */
+#define ICP_TFDLISTPTR 0x10
+
+/** Transmit status register */
+#define ICP_TXSTATUS 0x60
+#define ICP_TXSTATUS_ERROR		0x00000001UL	/**< TX error */
+
+/** Data fragment */
+union icplus_fragment {
+	/** Address of data */
+	uint64_t address;
+	/** Length */
+	struct {
+		/** Reserved */
+		uint8_t reserved[6];
+		/** Length of data */
+		uint16_t len;
+	};
+};
+
+/** Transmit or receive descriptor */
+struct icplus_descriptor {
+	/** Address of next descriptor */
+	uint64_t next;
+	/** Actual length */
+	uint16_t len;
+	/** Flags */
+	uint8_t flags;
+	/** Control */
+	uint8_t control;
+	/** VLAN */
+	uint16_t vlan;
+	/** Reserved */
+	uint16_t reserved_a;
+	/** Data buffer */
+	union icplus_fragment data;
+	/** Reserved */
+	uint8_t reserved_b[8];
+};
+
+/** Descriptor complete */
+#define ICP_DONE 0x80
+
+/** Transmit alignment disabled */
+#define ICP_TX_UNALIGN 0x01
+
+/** Request transmit completion */
+#define ICP_TX_INDICATE 0x40
+
+/** Sole transmit fragment */
+#define ICP_TX_SOLE_FRAG 0x01
+
+/** Recieve frame overrun error */
+#define ICP_RX_ERR_OVERRUN 0x01
+
+/** Receive runt frame error */
+#define ICP_RX_ERR_RUNT 0x02
+
+/** Receive alignment error */
+#define ICP_RX_ERR_ALIGN 0x04
+
+/** Receive FCS error */
+#define ICP_RX_ERR_FCS 0x08
+
+/** Receive oversized frame error */
+#define ICP_RX_ERR_OVERSIZED 0x10
+
+/** Recieve length error */
+#define ICP_RX_ERR_LEN 0x20
+
+/** Descriptor ring */
+struct icplus_ring {
+	/** Producer counter */
+	unsigned int prod;
+	/** Consumer counter */
+	unsigned int cons;
+	/** Ring entries */
+	struct icplus_descriptor *entry;
+	/* List pointer register */
+	unsigned int listptr;
+};
+
+/** Number of descriptors */
+#define ICP_NUM_DESC 4
+
+/** Maximum receive packet length */
+#define ICP_RX_MAX_LEN ETH_FRAME_LEN
+
+/** An IC+ network card */
+struct icplus_nic {
+	/** Registers */
+	void *regs;
+	/** EEPROM */
+	struct nvs_device eeprom;
+	/** MII bit bashing interface */
+	struct mii_bit_basher miibit;
+	/** MII device */
+	struct mii_device mii;
+	/** Transmit descriptor ring */
+	struct icplus_ring tx;
+	/** Receive descriptor ring */
+	struct icplus_ring rx;
+	/** Receive I/O buffers */
+	struct io_buffer *rx_iobuf[ICP_NUM_DESC];
+};
+
+#endif /* _ICPLUS_H */
diff --git a/src/drivers/net/intel.c b/src/drivers/net/intel.c
index dc511b8..a2e6d53 100644
--- a/src/drivers/net/intel.c
+++ b/src/drivers/net/intel.c
@@ -635,10 +635,23 @@ void intel_empty_rx ( struct intel_nic *intel ) {
 static int intel_open ( struct net_device *netdev ) {
 	struct intel_nic *intel = netdev->priv;
 	union intel_receive_address mac;
+	uint32_t fextnvm11;
 	uint32_t tctl;
 	uint32_t rctl;
 	int rc;
 
+	/* Set undocumented bit in FEXTNVM11 to work around an errata
+	 * in i219 devices that will otherwise cause a complete
+	 * datapath hang at the next device reset.
+	 */
+	if ( intel->flags & INTEL_RST_HANG ) {
+		DBGC ( intel, "INTEL %p WARNING: applying reset hang "
+		       "workaround\n", intel );
+		fextnvm11 = readl ( intel->regs + INTEL_FEXTNVM11 );
+		fextnvm11 |= INTEL_FEXTNVM11_WTF;
+		writel ( fextnvm11, intel->regs + INTEL_FEXTNVM11 );
+	}
+
 	/* Create transmit descriptor ring */
 	if ( ( rc = intel_create_ring ( intel, &intel->tx ) ) != 0 )
 		goto err_create_tx;
@@ -1123,20 +1136,21 @@ static struct pci_device_id intel_nics[] = {
 	PCI_ROM ( 0x8086, 0x153b, "i217v", "I217-V", 0 ),
 	PCI_ROM ( 0x8086, 0x1559, "i218v", "I218-V", 0),
 	PCI_ROM ( 0x8086, 0x155a, "i218lm", "I218-LM", 0),
-	PCI_ROM ( 0x8086, 0x156f, "i219lm", "I219-LM", 0 ),
-	PCI_ROM ( 0x8086, 0x1570, "i219v", "I219-V", INTEL_NO_PHY_RST ),
+	PCI_ROM ( 0x8086, 0x156f, "i219lm", "I219-LM", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x1570, "i219v", "I219-V", INTEL_I219 ),
 	PCI_ROM ( 0x8086, 0x157b, "i210-2", "I210", 0 ),
 	PCI_ROM ( 0x8086, 0x15a0, "i218lm-2", "I218-LM", INTEL_NO_PHY_RST ),
 	PCI_ROM ( 0x8086, 0x15a1, "i218v-2", "I218-V", 0 ),
 	PCI_ROM ( 0x8086, 0x15a2, "i218lm-3", "I218-LM", INTEL_NO_PHY_RST ),
 	PCI_ROM ( 0x8086, 0x15a3, "i218v-3", "I218-V", INTEL_NO_PHY_RST ),
-	PCI_ROM ( 0x8086, 0x15b7, "i219lm-2", "I219-LM (2)", INTEL_NO_PHY_RST ),
-	PCI_ROM ( 0x8086, 0x15b8, "i219v-2", "I219-V (2)", 0 ),
-	PCI_ROM ( 0x8086, 0x15b9, "i219lm-3", "I219-LM (3)", INTEL_NO_PHY_RST ),
-	PCI_ROM ( 0x8086, 0x15d6, "i219v-5", "I219-V (5)", INTEL_NO_PHY_RST ),
-	PCI_ROM ( 0x8086, 0x15d7, "i219lm-4", "I219-LM (4)", INTEL_NO_PHY_RST ),
-	PCI_ROM ( 0x8086, 0x15d8, "i219v-4", "I219-V (4)", INTEL_NO_PHY_RST ),
-	PCI_ROM ( 0x8086, 0x15e3, "i219lm-5", "I219-LM (5)", INTEL_NO_PHY_RST ),
+	PCI_ROM ( 0x8086, 0x15b7, "i219lm-2", "I219-LM (2)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15b8, "i219v-2", "I219-V (2)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15b9, "i219lm-3", "I219-LM (3)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15d6, "i219v-5", "I219-V (5)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15d7, "i219lm-4", "I219-LM (4)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15d8, "i219v-4", "I219-V (4)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15e3, "i219lm-5", "I219-LM (5)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x1f41, "i354", "I354", INTEL_NO_ASDE ),
 	PCI_ROM ( 0x8086, 0x294c, "82566dc-2", "82566DC-2", 0 ),
 	PCI_ROM ( 0x8086, 0x2e6e, "cemedia", "CE Media Processor", 0 ),
 };
diff --git a/src/drivers/net/intel.h b/src/drivers/net/intel.h
index 1487768..9d740ef 100644
--- a/src/drivers/net/intel.h
+++ b/src/drivers/net/intel.h
@@ -195,6 +195,10 @@ struct intel_descriptor {
 #define INTEL_RAH0 0x05404UL
 #define INTEL_RAH0_AV		0x80000000UL	/**< Address valid */
 
+/** Future Extended NVM register 11 */
+#define INTEL_FEXTNVM11 0x05bbcUL
+#define INTEL_FEXTNVM11_WTF	0x00002000UL	/**< Don't ask */
+
 /** Receive address */
 union intel_receive_address {
 	struct {
@@ -308,8 +312,13 @@ enum intel_flags {
 	INTEL_NO_PHY_RST = 0x0004,
 	/** ASDE is broken */
 	INTEL_NO_ASDE = 0x0008,
+	/** Reset may cause a complete device hang */
+	INTEL_RST_HANG = 0x0010,
 };
 
+/** The i219 has a seriously broken reset mechanism */
+#define INTEL_I219 ( INTEL_NO_PHY_RST | INTEL_RST_HANG )
+
 /**
  * Dump diagnostic information
  *
diff --git a/src/drivers/net/intelx.c b/src/drivers/net/intelx.c
index 0d5fb25..47de90c 100644
--- a/src/drivers/net/intelx.c
+++ b/src/drivers/net/intelx.c
@@ -474,6 +474,8 @@ static struct pci_device_id intelx_nics[] = {
 	PCI_ROM ( 0x8086, 0x1557, "82599en-sfp", "82599 (Single Port SFI Only)", 0 ),
 	PCI_ROM ( 0x8086, 0x1560, "x540t1", "X540-AT2/X540-BT2 (with single port NVM)", 0 ),
 	PCI_ROM ( 0x8086, 0x1563, "x550t2", "X550-T2", 0 ),
+	PCI_ROM ( 0x8086, 0x15ab, "x552", "X552", 0 ),
+	PCI_ROM ( 0x8086, 0x15e5, "x553", "X553", 0 ),
 };
 
 /** PCI driver */
diff --git a/src/drivers/net/intelxl.c b/src/drivers/net/intelxl.c
new file mode 100644
index 0000000..3e40fa4
--- /dev/null
+++ b/src/drivers/net/intelxl.c
@@ -0,0 +1,1525 @@
+/*
+ * Copyright (C) 2018 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#include <byteswap.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/ethernet.h>
+#include <ipxe/if_ether.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/malloc.h>
+#include <ipxe/pci.h>
+#include <ipxe/version.h>
+#include "intelxl.h"
+
+/** @file
+ *
+ * Intel 40 Gigabit Ethernet network card driver
+ *
+ */
+
+/******************************************************************************
+ *
+ * Device reset
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Reset hardware
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_reset ( struct intelxl_nic *intelxl ) {
+	uint32_t pfgen_ctrl;
+
+	/* Perform a global software reset */
+	pfgen_ctrl = readl ( intelxl->regs + INTELXL_PFGEN_CTRL );
+	writel ( ( pfgen_ctrl | INTELXL_PFGEN_CTRL_PFSWR ),
+		 intelxl->regs + INTELXL_PFGEN_CTRL );
+	mdelay ( INTELXL_RESET_DELAY_MS );
+
+	return 0;
+}
+
+/******************************************************************************
+ *
+ * MAC address
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Fetch initial MAC address and maximum frame size
+ *
+ * @v intelxl		Intel device
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int intelxl_fetch_mac ( struct intelxl_nic *intelxl,
+			       struct net_device *netdev ) {
+	union intelxl_receive_address mac;
+	uint32_t prtgl_sal;
+	uint32_t prtgl_sah;
+	size_t mfs;
+
+	/* Read NVM-loaded address */
+	prtgl_sal = readl ( intelxl->regs + INTELXL_PRTGL_SAL );
+	prtgl_sah = readl ( intelxl->regs + INTELXL_PRTGL_SAH );
+	mac.reg.low = cpu_to_le32 ( prtgl_sal );
+	mac.reg.high = cpu_to_le32 ( prtgl_sah );
+
+	/* Check that address is valid */
+	if ( ! is_valid_ether_addr ( mac.raw ) ) {
+		DBGC ( intelxl, "INTELXL %p has invalid MAC address (%s)\n",
+		       intelxl, eth_ntoa ( mac.raw ) );
+		return -ENOENT;
+	}
+
+	/* Copy MAC address */
+	DBGC ( intelxl, "INTELXL %p has autoloaded MAC address %s\n",
+	       intelxl, eth_ntoa ( mac.raw ) );
+	memcpy ( netdev->hw_addr, mac.raw, ETH_ALEN );
+
+	/* Get maximum frame size */
+	mfs = INTELXL_PRTGL_SAH_MFS_GET ( prtgl_sah );
+	netdev->max_pkt_len = ( mfs - 4 /* CRC */ );
+
+	return 0;
+}
+
+/******************************************************************************
+ *
+ * Admin queue
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Create admin queue
+ *
+ * @v intelxl		Intel device
+ * @v admin		Admin queue
+ * @ret rc		Return status code
+ */
+static int intelxl_create_admin ( struct intelxl_nic *intelxl,
+				  struct intelxl_admin *admin ) {
+	size_t len = ( sizeof ( admin->desc[0] ) * INTELXL_ADMIN_NUM_DESC );
+	void *admin_regs = ( intelxl->regs + admin->reg );
+	physaddr_t address;
+
+	/* Allocate admin queue */
+	admin->desc = malloc_dma ( ( len + sizeof ( *admin->buffer ) ),
+				   INTELXL_ALIGN );
+	if ( ! admin->desc )
+		return -ENOMEM;
+	admin->buffer = ( ( ( void * ) admin->desc ) + len );
+
+	/* Initialise admin queue */
+	memset ( admin->desc, 0, len );
+
+	/* Reset head and tail registers */
+	writel ( 0, admin_regs + INTELXL_ADMIN_HEAD );
+	writel ( 0, admin_regs + INTELXL_ADMIN_TAIL );
+
+	/* Reset queue index */
+	admin->index = 0;
+
+	/* Program queue address */
+	address = virt_to_bus ( admin->desc );
+	writel ( ( address & 0xffffffffUL ), admin_regs + INTELXL_ADMIN_BAL );
+	if ( sizeof ( physaddr_t ) > sizeof ( uint32_t ) ) {
+		writel ( ( ( ( uint64_t ) address ) >> 32 ),
+			 admin_regs + INTELXL_ADMIN_BAH );
+	} else {
+		writel ( 0, admin_regs + INTELXL_ADMIN_BAH );
+	}
+
+	/* Program queue length and enable queue */
+	writel ( ( INTELXL_ADMIN_LEN_LEN ( INTELXL_ADMIN_NUM_DESC ) |
+		   INTELXL_ADMIN_LEN_ENABLE ),
+		 admin_regs + INTELXL_ADMIN_LEN );
+
+	DBGC ( intelxl, "INTELXL %p A%cQ is at [%08llx,%08llx) buf "
+	       "[%08llx,%08llx)\n", intelxl,
+	       ( ( admin->reg == INTELXL_ADMIN_CMD ) ? 'T' : 'R' ),
+	       ( ( unsigned long long ) address ),
+	       ( ( unsigned long long ) address + len ),
+	       ( ( unsigned long long ) virt_to_bus ( admin->buffer ) ),
+	       ( ( unsigned long long ) ( virt_to_bus ( admin->buffer ) +
+					  sizeof ( admin->buffer[0] ) ) ) );
+	return 0;
+}
+
+/**
+ * Destroy admin queue
+ *
+ * @v intelxl		Intel device
+ * @v admin		Admin queue
+ */
+static void intelxl_destroy_admin ( struct intelxl_nic *intelxl,
+				    struct intelxl_admin *admin ) {
+	size_t len = ( sizeof ( admin->desc[0] ) * INTELXL_ADMIN_NUM_DESC );
+	void *admin_regs = ( intelxl->regs + admin->reg );
+
+	/* Disable queue */
+	writel ( 0, admin_regs + INTELXL_ADMIN_LEN );
+
+	/* Free queue */
+	free_dma ( admin->desc, ( len + sizeof ( *admin->buffer ) ) );
+}
+
+/**
+ * Issue admin queue command
+ *
+ * @v intelxl		Intel device
+ * @v cmd		Command descriptor
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_command ( struct intelxl_nic *intelxl,
+				   struct intelxl_admin_descriptor *cmd ) {
+	struct intelxl_admin *admin = &intelxl->command;
+	void *admin_regs = ( intelxl->regs + admin->reg );
+	struct intelxl_admin_descriptor *desc;
+	uint64_t buffer;
+	unsigned int index;
+	unsigned int tail;
+	unsigned int i;
+	int rc;
+
+	/* Get next queue entry */
+	index = admin->index++;
+	tail = ( admin->index % INTELXL_ADMIN_NUM_DESC );
+	desc = &admin->desc[index % INTELXL_ADMIN_NUM_DESC];
+
+	/* Clear must-be-zero flags */
+	cmd->flags &= ~cpu_to_le16 ( INTELXL_ADMIN_FL_DD |
+				     INTELXL_ADMIN_FL_CMP |
+				     INTELXL_ADMIN_FL_ERR );
+
+	/* Clear return value */
+	cmd->ret = 0;
+
+	/* Populate cookie */
+	cmd->cookie = cpu_to_le32 ( index );
+
+	/* Populate data buffer address if applicable */
+	if ( cmd->flags & cpu_to_le16 ( INTELXL_ADMIN_FL_BUF ) ) {
+		buffer = virt_to_bus ( admin->buffer );
+		cmd->params.buffer.high = cpu_to_le32 ( buffer >> 32 );
+		cmd->params.buffer.low = cpu_to_le32 ( buffer & 0xffffffffUL );
+	}
+
+	/* Copy command descriptor to queue entry */
+	memcpy ( desc, cmd, sizeof ( *desc ) );
+	DBGC2 ( intelxl, "INTELXL %p admin command %#x:\n", intelxl, index );
+	DBGC2_HDA ( intelxl, virt_to_phys ( desc ), desc, sizeof ( *desc ) );
+
+	/* Post command descriptor */
+	wmb();
+	writel ( tail, admin_regs + INTELXL_ADMIN_TAIL );
+
+	/* Wait for completion */
+	for ( i = 0 ; i < INTELXL_ADMIN_MAX_WAIT_MS ; i++ ) {
+
+		/* If response is not complete, delay 1ms and retry */
+		if ( ! ( desc->flags & INTELXL_ADMIN_FL_DD ) ) {
+			mdelay ( 1 );
+			continue;
+		}
+		DBGC2 ( intelxl, "INTELXL %p admin command %#x response:\n",
+			intelxl, index );
+		DBGC2_HDA ( intelxl, virt_to_phys ( desc ), desc,
+			    sizeof ( *desc ) );
+
+		/* Check for cookie mismatch */
+		if ( desc->cookie != cmd->cookie ) {
+			DBGC ( intelxl, "INTELXL %p admin command %#x bad "
+			       "cookie %#x\n", intelxl, index,
+			       le32_to_cpu ( desc->cookie ) );
+			rc = -EPROTO;
+			goto err;
+		}
+
+		/* Check for errors */
+		if ( desc->ret != 0 ) {
+			DBGC ( intelxl, "INTELXL %p admin command %#x error "
+			       "%d\n", intelxl, index,
+			       le16_to_cpu ( desc->ret ) );
+			rc = -EIO;
+			goto err;
+		}
+
+		/* Copy response back to command descriptor */
+		memcpy ( cmd, desc, sizeof ( *cmd ) );
+
+		/* Success */
+		return 0;
+	}
+
+	rc = -ETIMEDOUT;
+	DBGC ( intelxl, "INTELXL %p timed out waiting for admin command %#x:\n",
+	       intelxl, index );
+ err:
+	DBGC_HDA ( intelxl, virt_to_phys ( desc ), cmd, sizeof ( *cmd ) );
+	DBGC_HDA ( intelxl, virt_to_phys ( desc ), desc, sizeof ( *desc ) );
+	return rc;
+}
+
+/**
+ * Get firmware version
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_version ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_version_params *version = &cmd.params.version;
+	unsigned int api;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_VERSION );
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+	api = le16_to_cpu ( version->api.major );
+	DBGC ( intelxl, "INTELXL %p firmware v%d.%d API v%d.%d\n",
+	       intelxl, le16_to_cpu ( version->firmware.major ),
+	       le16_to_cpu ( version->firmware.minor ),
+	       api, le16_to_cpu ( version->api.minor ) );
+
+	/* Check for API compatibility */
+	if ( api > INTELXL_ADMIN_API_MAJOR ) {
+		DBGC ( intelxl, "INTELXL %p unsupported API v%d\n",
+		       intelxl, api );
+		return -ENOTSUP;
+	}
+
+	return 0;
+}
+
+/**
+ * Report driver version
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_driver ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_driver_params *driver = &cmd.params.driver;
+	struct intelxl_admin_driver_buffer *buf =
+		&intelxl->command.buffer->driver;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_DRIVER );
+	cmd.flags = cpu_to_le16 ( INTELXL_ADMIN_FL_RD | INTELXL_ADMIN_FL_BUF );
+	cmd.len = cpu_to_le16 ( sizeof ( *buf ) );
+	driver->major = product_major_version;
+	driver->minor = product_minor_version;
+	snprintf ( buf->name, sizeof ( buf->name ), "%s",
+		   ( product_name[0] ? product_name : product_short_name ) );
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Shutdown admin queues
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_shutdown ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_shutdown_params *shutdown = &cmd.params.shutdown;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_SHUTDOWN );
+	shutdown->unloading = INTELXL_ADMIN_SHUTDOWN_UNLOADING;
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Get switch configuration
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_switch ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_switch_params *sw = &cmd.params.sw;
+	struct intelxl_admin_switch_buffer *buf = &intelxl->command.buffer->sw;
+	struct intelxl_admin_switch_config *cfg = &buf->cfg;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_SWITCH );
+	cmd.flags = cpu_to_le16 ( INTELXL_ADMIN_FL_BUF );
+	cmd.len = cpu_to_le16 ( sizeof ( *buf ) );
+
+	/* Get each configuration in turn */
+	do {
+		/* Issue command */
+		if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+			return rc;
+
+		/* Dump raw configuration */
+		DBGC2 ( intelxl, "INTELXL %p SEID %#04x:\n",
+			intelxl, le16_to_cpu ( cfg->seid ) );
+		DBGC2_HDA ( intelxl, 0, cfg, sizeof ( *cfg ) );
+
+		/* Parse response */
+		if ( cfg->type == INTELXL_ADMIN_SWITCH_TYPE_VSI ) {
+			intelxl->vsi = le16_to_cpu ( cfg->seid );
+			DBGC ( intelxl, "INTELXL %p VSI %#04x uplink %#04x "
+			       "downlink %#04x conn %#02x\n", intelxl,
+			       intelxl->vsi, le16_to_cpu ( cfg->uplink ),
+			       le16_to_cpu ( cfg->downlink ), cfg->connection );
+		}
+
+	} while ( sw->next );
+
+	/* Check that we found a VSI */
+	if ( ! intelxl->vsi ) {
+		DBGC ( intelxl, "INTELXL %p has no VSI\n", intelxl );
+		return -ENOENT;
+	}
+
+	return 0;
+}
+
+/**
+ * Get VSI parameters
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_vsi ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_vsi_params *vsi = &cmd.params.vsi;
+	struct intelxl_admin_vsi_buffer *buf = &intelxl->command.buffer->vsi;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_VSI );
+	cmd.flags = cpu_to_le16 ( INTELXL_ADMIN_FL_BUF );
+	cmd.len = cpu_to_le16 ( sizeof ( *buf ) );
+	vsi->vsi = cpu_to_le16 ( intelxl->vsi );
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+
+	/* Parse response */
+	intelxl->queue = le16_to_cpu ( buf->queue[0] );
+	intelxl->qset = le16_to_cpu ( buf->qset[0] );
+	DBGC ( intelxl, "INTELXL %p VSI %#04x queue %#04x qset %#04x\n",
+	       intelxl, intelxl->vsi, intelxl->queue, intelxl->qset );
+
+	return 0;
+}
+
+/**
+ * Set VSI promiscuous modes
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_promisc ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_promisc_params *promisc = &cmd.params.promisc;
+	uint16_t flags;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_PROMISC );
+	flags = ( INTELXL_ADMIN_PROMISC_FL_UNICAST |
+		  INTELXL_ADMIN_PROMISC_FL_MULTICAST |
+		  INTELXL_ADMIN_PROMISC_FL_BROADCAST |
+		  INTELXL_ADMIN_PROMISC_FL_VLAN );
+	promisc->flags = cpu_to_le16 ( flags );
+	promisc->valid = cpu_to_le16 ( flags );
+	promisc->vsi = cpu_to_le16 ( intelxl->vsi );
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Restart autonegotiation
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_autoneg ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_autoneg_params *autoneg = &cmd.params.autoneg;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_AUTONEG );
+	autoneg->flags = ( INTELXL_ADMIN_AUTONEG_FL_RESTART |
+			   INTELXL_ADMIN_AUTONEG_FL_ENABLE );
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Get link status
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int intelxl_admin_link ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	struct intelxl_admin_descriptor cmd;
+	struct intelxl_admin_link_params *link = &cmd.params.link;
+	int rc;
+
+	/* Populate descriptor */
+	memset ( &cmd, 0, sizeof ( cmd ) );
+	cmd.opcode = cpu_to_le16 ( INTELXL_ADMIN_LINK );
+	link->notify = INTELXL_ADMIN_LINK_NOTIFY;
+
+	/* Issue command */
+	if ( ( rc = intelxl_admin_command ( intelxl, &cmd ) ) != 0 )
+		return rc;
+	DBGC ( intelxl, "INTELXL %p PHY %#02x speed %#02x status %#02x\n",
+	       intelxl, link->phy, link->speed, link->status );
+
+	/* Update network device */
+	if ( link->status & INTELXL_ADMIN_LINK_UP ) {
+		netdev_link_up ( netdev );
+	} else {
+		netdev_link_down ( netdev );
+	}
+
+	return 0;
+}
+
+/**
+ * Refill admin event queue
+ *
+ * @v intelxl		Intel device
+ */
+static void intelxl_refill_admin ( struct intelxl_nic *intelxl ) {
+	struct intelxl_admin *admin = &intelxl->event;
+	void *admin_regs = ( intelxl->regs + admin->reg );
+	unsigned int tail;
+
+	/* Update tail pointer */
+	tail = ( ( admin->index + INTELXL_ADMIN_NUM_DESC - 1 ) %
+		 INTELXL_ADMIN_NUM_DESC );
+	writel ( tail, admin_regs + INTELXL_ADMIN_TAIL );
+}
+
+/**
+ * Poll admin event queue
+ *
+ * @v netdev		Network device
+ */
+static void intelxl_poll_admin ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	struct intelxl_admin *admin = &intelxl->event;
+	struct intelxl_admin_descriptor *desc;
+
+	/* Check for events */
+	while ( 1 ) {
+
+		/* Get next event descriptor */
+		desc = &admin->desc[admin->index % INTELXL_ADMIN_NUM_DESC];
+
+		/* Stop if descriptor is not yet completed */
+		if ( ! ( desc->flags & INTELXL_ADMIN_FL_DD ) )
+			return;
+		DBGC2 ( intelxl, "INTELXL %p admin event %#x:\n",
+			intelxl, admin->index );
+		DBGC2_HDA ( intelxl, virt_to_phys ( desc ), desc,
+			    sizeof ( *desc ) );
+
+		/* Handle event */
+		switch ( desc->opcode ) {
+		case cpu_to_le16 ( INTELXL_ADMIN_LINK ):
+			intelxl_admin_link ( netdev );
+			break;
+		default:
+			DBGC ( intelxl, "INTELXL %p admin event %#x "
+			       "unrecognised opcode %#04x\n", intelxl,
+			       admin->index, le16_to_cpu ( desc->opcode ) );
+			break;
+		}
+
+		/* Clear event completion flag */
+		desc->flags = 0;
+		wmb();
+
+		/* Update index and refill queue */
+		admin->index++;
+		intelxl_refill_admin ( intelxl );
+	}
+}
+
+/**
+ * Open admin queues
+ *
+ * @v intelxl		Intel device
+ * @ret rc		Return status code
+ */
+static int intelxl_open_admin ( struct intelxl_nic *intelxl ) {
+	int rc;
+
+	/* Create admin event queue */
+	if ( ( rc = intelxl_create_admin ( intelxl, &intelxl->event ) ) != 0 )
+		goto err_create_event;
+
+	/* Create admin command queue */
+	if ( ( rc = intelxl_create_admin ( intelxl, &intelxl->command ) ) != 0 )
+		goto err_create_command;
+
+	/* Post all descriptors to event queue */
+	intelxl_refill_admin ( intelxl );
+
+	/* Get firmware version */
+	if ( ( rc = intelxl_admin_version ( intelxl ) ) != 0 )
+		goto err_version;
+
+	/* Report driver version */
+	if ( ( rc = intelxl_admin_driver ( intelxl ) ) != 0 )
+		goto err_driver;
+
+	return 0;
+
+ err_driver:
+ err_version:
+	intelxl_destroy_admin ( intelxl, &intelxl->command );
+ err_create_command:
+	intelxl_destroy_admin ( intelxl, &intelxl->event );
+ err_create_event:
+	return rc;
+}
+
+/**
+ * Close admin queues
+ *
+ * @v intelxl		Intel device
+ */
+static void intelxl_close_admin ( struct intelxl_nic *intelxl ) {
+
+	/* Shut down admin queues */
+	intelxl_admin_shutdown ( intelxl );
+
+	/* Destroy admin command queue */
+	intelxl_destroy_admin ( intelxl, &intelxl->command );
+
+	/* Destroy admin event queue */
+	intelxl_destroy_admin ( intelxl, &intelxl->event );
+}
+
+/******************************************************************************
+ *
+ * Descriptor rings
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Dump queue context (for debugging)
+ *
+ * @v intelxl		Intel device
+ * @v op		Context operation
+ * @v len		Size of context
+ */
+static __attribute__ (( unused )) void
+intelxl_context_dump ( struct intelxl_nic *intelxl, uint32_t op, size_t len ) {
+	struct intelxl_context_line line;
+	uint32_t pfcm_lanctxctl;
+	uint32_t pfcm_lanctxstat;
+	unsigned int queue;
+	unsigned int index;
+	unsigned int i;
+
+	/* Do nothing unless debug output is enabled */
+	if ( ! DBG_EXTRA )
+		return;
+
+	/* Dump context */
+	DBGC2 ( intelxl, "INTELXL %p context %#08x:\n", intelxl, op );
+	for ( index = 0 ; ( sizeof ( line ) * index ) < len ; index++ ) {
+
+		/* Start context operation */
+		queue = ( intelxl->base + intelxl->queue );
+		pfcm_lanctxctl =
+			( INTELXL_PFCM_LANCTXCTL_QUEUE_NUM ( queue ) |
+			  INTELXL_PFCM_LANCTXCTL_SUB_LINE ( index ) |
+			  INTELXL_PFCM_LANCTXCTL_OP_CODE_READ | op );
+		writel ( pfcm_lanctxctl,
+			 intelxl->regs + INTELXL_PFCM_LANCTXCTL );
+
+		/* Wait for operation to complete */
+		for ( i = 0 ; i < INTELXL_CTX_MAX_WAIT_MS ; i++ ) {
+
+			/* Check if operation is complete */
+			pfcm_lanctxstat = readl ( intelxl->regs +
+						  INTELXL_PFCM_LANCTXSTAT );
+			if ( pfcm_lanctxstat & INTELXL_PFCM_LANCTXSTAT_DONE )
+				break;
+
+			/* Delay */
+			mdelay ( 1 );
+		}
+
+		/* Read context data */
+		for ( i = 0 ; i < ( sizeof ( line ) /
+				    sizeof ( line.raw[0] ) ) ; i++ ) {
+			line.raw[i] = readl ( intelxl->regs +
+					      INTELXL_PFCM_LANCTXDATA ( i ) );
+		}
+		DBGC2_HDA ( intelxl, ( sizeof ( line ) * index ),
+			    &line, sizeof ( line ) );
+	}
+}
+
+/**
+ * Program queue context line
+ *
+ * @v intelxl		Intel device
+ * @v line		Queue context line
+ * @v index		Line number
+ * @v op		Context operation
+ * @ret rc		Return status code
+ */
+static int intelxl_context_line ( struct intelxl_nic *intelxl,
+				  struct intelxl_context_line *line,
+				  unsigned int index, uint32_t op ) {
+	uint32_t pfcm_lanctxctl;
+	uint32_t pfcm_lanctxstat;
+	unsigned int queue;
+	unsigned int i;
+
+	/* Write context data */
+	for ( i = 0; i < ( sizeof ( *line ) / sizeof ( line->raw[0] ) ); i++ ) {
+		writel ( le32_to_cpu ( line->raw[i] ),
+			 intelxl->regs + INTELXL_PFCM_LANCTXDATA ( i ) );
+	}
+
+	/* Start context operation */
+	queue = ( intelxl->base + intelxl->queue );
+	pfcm_lanctxctl = ( INTELXL_PFCM_LANCTXCTL_QUEUE_NUM ( queue ) |
+			   INTELXL_PFCM_LANCTXCTL_SUB_LINE ( index ) |
+			   INTELXL_PFCM_LANCTXCTL_OP_CODE_WRITE | op );
+	writel ( pfcm_lanctxctl, intelxl->regs + INTELXL_PFCM_LANCTXCTL );
+
+	/* Wait for operation to complete */
+	for ( i = 0 ; i < INTELXL_CTX_MAX_WAIT_MS ; i++ ) {
+
+		/* Check if operation is complete */
+		pfcm_lanctxstat = readl ( intelxl->regs +
+					  INTELXL_PFCM_LANCTXSTAT );
+		if ( pfcm_lanctxstat & INTELXL_PFCM_LANCTXSTAT_DONE )
+			return 0;
+
+		/* Delay */
+		mdelay ( 1 );
+	}
+
+	DBGC ( intelxl, "INTELXL %p timed out waiting for context: %#08x\n",
+	       intelxl, pfcm_lanctxctl );
+	return -ETIMEDOUT;
+}
+
+/**
+ * Program queue context
+ *
+ * @v intelxl		Intel device
+ * @v line		Queue context lines
+ * @v len		Size of context
+ * @v op		Context operation
+ * @ret rc		Return status code
+ */
+static int intelxl_context ( struct intelxl_nic *intelxl,
+			     struct intelxl_context_line *line,
+			     size_t len, uint32_t op ) {
+	unsigned int index;
+	int rc;
+
+	DBGC2 ( intelxl, "INTELXL %p context %#08x len %#zx:\n",
+		intelxl, op, len );
+	DBGC2_HDA ( intelxl, 0, line, len );
+
+	/* Program one line at a time */
+	for ( index = 0 ; ( sizeof ( *line ) * index ) < len ; index++ ) {
+		if ( ( rc = intelxl_context_line ( intelxl, line++, index,
+						   op ) ) != 0 )
+			return rc;
+	}
+
+	return 0;
+}
+
+/**
+ * Program transmit queue context
+ *
+ * @v intelxl		Intel device
+ * @v address		Descriptor ring base address
+ * @ret rc		Return status code
+ */
+static int intelxl_context_tx ( struct intelxl_nic *intelxl,
+				physaddr_t address ) {
+	union {
+		struct intelxl_context_tx tx;
+		struct intelxl_context_line line;
+	} ctx;
+	int rc;
+
+	/* Initialise context */
+	memset ( &ctx, 0, sizeof ( ctx ) );
+	ctx.tx.flags = cpu_to_le16 ( INTELXL_CTX_TX_FL_NEW );
+	ctx.tx.base = cpu_to_le64 ( INTELXL_CTX_TX_BASE ( address ) );
+	ctx.tx.count =
+		cpu_to_le16 ( INTELXL_CTX_TX_COUNT ( INTELXL_TX_NUM_DESC ) );
+	ctx.tx.qset = INTELXL_CTX_TX_QSET ( intelxl->qset );
+
+	/* Program context */
+	if ( ( rc = intelxl_context ( intelxl, &ctx.line, sizeof ( ctx ),
+				      INTELXL_PFCM_LANCTXCTL_TYPE_TX ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Program receive queue context
+ *
+ * @v intelxl		Intel device
+ * @v address		Descriptor ring base address
+ * @ret rc		Return status code
+ */
+static int intelxl_context_rx ( struct intelxl_nic *intelxl,
+				physaddr_t address ) {
+	union {
+		struct intelxl_context_rx rx;
+		struct intelxl_context_line line;
+	} ctx;
+	uint64_t base_count;
+	int rc;
+
+	/* Initialise context */
+	memset ( &ctx, 0, sizeof ( ctx ) );
+	base_count = INTELXL_CTX_RX_BASE_COUNT ( address, INTELXL_RX_NUM_DESC );
+	ctx.rx.base_count = cpu_to_le64 ( base_count );
+	ctx.rx.len = cpu_to_le16 ( INTELXL_CTX_RX_LEN ( intelxl->mfs ) );
+	ctx.rx.flags = INTELXL_CTX_RX_FL_CRCSTRIP;
+	ctx.rx.mfs = cpu_to_le16 ( INTELXL_CTX_RX_MFS ( intelxl->mfs ) );
+
+	/* Program context */
+	if ( ( rc = intelxl_context ( intelxl, &ctx.line, sizeof ( ctx ),
+				      INTELXL_PFCM_LANCTXCTL_TYPE_RX ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Enable descriptor ring
+ *
+ * @v intelxl		Intel device
+ * @v ring		Descriptor ring
+ * @ret rc		Return status code
+ */
+static int intelxl_enable_ring ( struct intelxl_nic *intelxl,
+				 struct intelxl_ring *ring ) {
+	void *ring_regs = ( intelxl->regs + ring->reg );
+	uint32_t qxx_ena;
+
+	/* Enable ring */
+	writel ( INTELXL_QXX_ENA_REQ, ( ring_regs + INTELXL_QXX_ENA ) );
+	udelay ( INTELXL_QUEUE_ENABLE_DELAY_US );
+	qxx_ena = readl ( ring_regs + INTELXL_QXX_ENA );
+	if ( ! ( qxx_ena & INTELXL_QXX_ENA_STAT ) ) {
+		DBGC ( intelxl, "INTELXL %p ring %06x failed to enable: "
+		       "%#08x\n", intelxl, ring->reg, qxx_ena );
+		return -EIO;
+	}
+
+	return 0;
+}
+
+/**
+ * Disable descriptor ring
+ *
+ * @v intelxl		Intel device
+ * @v ring		Descriptor ring
+ * @ret rc		Return status code
+ */
+static int intelxl_disable_ring ( struct intelxl_nic *intelxl,
+				  struct intelxl_ring *ring ) {
+	void *ring_regs = ( intelxl->regs + ring->reg );
+	uint32_t qxx_ena;
+	unsigned int i;
+
+	/* Disable ring */
+	writel ( 0, ( ring_regs + INTELXL_QXX_ENA ) );
+
+	/* Wait for ring to be disabled */
+	for ( i = 0 ; i < INTELXL_QUEUE_DISABLE_MAX_WAIT_MS ; i++ ) {
+
+		/* Check if ring is disabled */
+		qxx_ena = readl ( ring_regs + INTELXL_QXX_ENA );
+		if ( ! ( qxx_ena & INTELXL_QXX_ENA_STAT ) )
+			return 0;
+
+		/* Delay */
+		mdelay ( 1 );
+	}
+
+	DBGC ( intelxl, "INTELXL %p ring %06x timed out waiting for disable: "
+	       "%#08x\n", intelxl, ring->reg, qxx_ena );
+	return -ETIMEDOUT;
+}
+
+/**
+ * Create descriptor ring
+ *
+ * @v intelxl		Intel device
+ * @v ring		Descriptor ring
+ * @ret rc		Return status code
+ */
+static int intelxl_create_ring ( struct intelxl_nic *intelxl,
+				 struct intelxl_ring *ring ) {
+	void *ring_regs = ( intelxl->regs + ring->reg );
+	physaddr_t address;
+	int rc;
+
+	/* Allocate descriptor ring */
+	ring->desc = malloc_dma ( ring->len, INTELXL_ALIGN );
+	if ( ! ring->desc ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+
+	/* Initialise descriptor ring */
+	memset ( ring->desc, 0, ring->len );
+
+	/* Reset tail pointer */
+	writel ( 0, ( ring_regs + INTELXL_QXX_TAIL ) );
+
+	/* Program queue context */
+	address = virt_to_bus ( ring->desc );
+	if ( ( rc = ring->context ( intelxl, address ) ) != 0 )
+		goto err_context;
+
+	/* Enable ring */
+	if ( ( rc = intelxl_enable_ring ( intelxl, ring ) ) != 0 )
+		goto err_enable;
+
+	/* Reset counters */
+	ring->prod = 0;
+	ring->cons = 0;
+
+	DBGC ( intelxl, "INTELXL %p ring %06x is at [%08llx,%08llx)\n",
+	       intelxl, ring->reg, ( ( unsigned long long ) address ),
+	       ( ( unsigned long long ) address + ring->len ) );
+
+	return 0;
+
+	intelxl_disable_ring ( intelxl, ring );
+ err_enable:
+ err_context:
+	free_dma ( ring->desc, ring->len );
+ err_alloc:
+	return rc;
+}
+
+/**
+ * Destroy descriptor ring
+ *
+ * @v intelxl		Intel device
+ * @v ring		Descriptor ring
+ */
+static void intelxl_destroy_ring ( struct intelxl_nic *intelxl,
+				   struct intelxl_ring *ring ) {
+	int rc;
+
+	/* Disable ring */
+	if ( ( rc = intelxl_disable_ring ( intelxl, ring ) ) != 0 ) {
+		/* Leak memory; there's nothing else we can do */
+		return;
+	}
+
+	/* Free descriptor ring */
+	free_dma ( ring->desc, ring->len );
+	ring->desc = NULL;
+}
+
+/**
+ * Refill receive descriptor ring
+ *
+ * @v intelxl		Intel device
+ */
+static void intelxl_refill_rx ( struct intelxl_nic *intelxl ) {
+	struct intelxl_rx_data_descriptor *rx;
+	struct io_buffer *iobuf;
+	unsigned int rx_idx;
+	unsigned int rx_tail;
+	physaddr_t address;
+	unsigned int refilled = 0;
+
+	/* Refill ring */
+	while ( ( intelxl->rx.prod - intelxl->rx.cons ) < INTELXL_RX_FILL ) {
+
+		/* Allocate I/O buffer */
+		iobuf = alloc_iob ( intelxl->mfs );
+		if ( ! iobuf ) {
+			/* Wait for next refill */
+			break;
+		}
+
+		/* Get next receive descriptor */
+		rx_idx = ( intelxl->rx.prod++ % INTELXL_RX_NUM_DESC );
+		rx = &intelxl->rx.desc[rx_idx].rx;
+
+		/* Populate receive descriptor */
+		address = virt_to_bus ( iobuf->data );
+		rx->address = cpu_to_le64 ( address );
+		rx->flags = 0;
+
+		/* Record I/O buffer */
+		assert ( intelxl->rx_iobuf[rx_idx] == NULL );
+		intelxl->rx_iobuf[rx_idx] = iobuf;
+
+		DBGC2 ( intelxl, "INTELXL %p RX %d is [%llx,%llx)\n", intelxl,
+			rx_idx, ( ( unsigned long long ) address ),
+			( ( unsigned long long ) address + intelxl->mfs ) );
+		refilled++;
+	}
+
+	/* Push descriptors to card, if applicable */
+	if ( refilled ) {
+		wmb();
+		rx_tail = ( intelxl->rx.prod % INTELXL_RX_NUM_DESC );
+		writel ( rx_tail,
+			 ( intelxl->regs + intelxl->rx.reg + INTELXL_QXX_TAIL));
+	}
+}
+
+/******************************************************************************
+ *
+ * Network device interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Open network device
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int intelxl_open ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	union intelxl_receive_address mac;
+	unsigned int queue;
+	uint32_t prtgl_sal;
+	uint32_t prtgl_sah;
+	int rc;
+
+	/* Calculate maximum frame size */
+	intelxl->mfs = ( ( ETH_HLEN + netdev->mtu + 4 /* CRC */ +
+			   INTELXL_ALIGN - 1 ) & ~( INTELXL_ALIGN - 1 ) );
+
+	/* Program MAC address and maximum frame size */
+	memset ( &mac, 0, sizeof ( mac ) );
+	memcpy ( mac.raw, netdev->ll_addr, sizeof ( mac.raw ) );
+	prtgl_sal = le32_to_cpu ( mac.reg.low );
+	prtgl_sah = ( le32_to_cpu ( mac.reg.high ) |
+		      INTELXL_PRTGL_SAH_MFS_SET ( intelxl->mfs ) );
+	writel ( prtgl_sal, intelxl->regs + INTELXL_PRTGL_SAL );
+	writel ( prtgl_sah, intelxl->regs + INTELXL_PRTGL_SAH );
+
+	/* Associate transmit queue to PF */
+	writel ( ( INTELXL_QXX_CTL_PFVF_Q_PF |
+		   INTELXL_QXX_CTL_PFVF_PF_INDX ( intelxl->pf ) ),
+		 ( intelxl->regs + intelxl->tx.reg + INTELXL_QXX_CTL ) );
+
+	/* Clear transmit pre queue disable */
+	queue = ( intelxl->base + intelxl->queue );
+	writel ( ( INTELXL_GLLAN_TXPRE_QDIS_CLEAR_QDIS |
+		   INTELXL_GLLAN_TXPRE_QDIS_QINDX ( queue ) ),
+		 ( intelxl->regs + INTELXL_GLLAN_TXPRE_QDIS ( queue ) ) );
+
+	/* Reset transmit queue head */
+	writel ( 0, ( intelxl->regs + INTELXL_QTX_HEAD ( intelxl->queue ) ) );
+
+	/* Create receive descriptor ring */
+	if ( ( rc = intelxl_create_ring ( intelxl, &intelxl->rx ) ) != 0 )
+		goto err_create_rx;
+
+	/* Create transmit descriptor ring */
+	if ( ( rc = intelxl_create_ring ( intelxl, &intelxl->tx ) ) != 0 )
+		goto err_create_tx;
+
+	/* Fill receive ring */
+	intelxl_refill_rx ( intelxl );
+
+	/* Restart autonegotiation */
+	intelxl_admin_autoneg ( intelxl );
+
+	/* Update link state */
+	intelxl_admin_link ( netdev );
+
+	return 0;
+
+	writel ( ( INTELXL_GLLAN_TXPRE_QDIS_SET_QDIS |
+		   INTELXL_GLLAN_TXPRE_QDIS_QINDX ( queue ) ),
+		 ( intelxl->regs + INTELXL_GLLAN_TXPRE_QDIS ( queue ) ) );
+	udelay ( INTELXL_QUEUE_PRE_DISABLE_DELAY_US );
+	intelxl_destroy_ring ( intelxl, &intelxl->tx );
+ err_create_tx:
+	intelxl_destroy_ring ( intelxl, &intelxl->rx );
+ err_create_rx:
+	return rc;
+}
+
+/**
+ * Close network device
+ *
+ * @v netdev		Network device
+ */
+static void intelxl_close ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	unsigned int queue;
+	unsigned int i;
+
+	/* Dump contexts (for debugging) */
+	intelxl_context_dump ( intelxl, INTELXL_PFCM_LANCTXCTL_TYPE_TX,
+			       sizeof ( struct intelxl_context_tx ) );
+	intelxl_context_dump ( intelxl, INTELXL_PFCM_LANCTXCTL_TYPE_RX,
+			       sizeof ( struct intelxl_context_rx ) );
+
+	/* Pre-disable transmit queue */
+	queue = ( intelxl->base + intelxl->queue );
+	writel ( ( INTELXL_GLLAN_TXPRE_QDIS_SET_QDIS |
+		   INTELXL_GLLAN_TXPRE_QDIS_QINDX ( queue ) ),
+		 ( intelxl->regs + INTELXL_GLLAN_TXPRE_QDIS ( queue ) ) );
+	udelay ( INTELXL_QUEUE_PRE_DISABLE_DELAY_US );
+
+	/* Destroy transmit descriptor ring */
+	intelxl_destroy_ring ( intelxl, &intelxl->tx );
+
+	/* Destroy receive descriptor ring */
+	intelxl_destroy_ring ( intelxl, &intelxl->rx );
+
+	/* Discard any unused receive buffers */
+	for ( i = 0 ; i < INTELXL_RX_NUM_DESC ; i++ ) {
+		if ( intelxl->rx_iobuf[i] )
+			free_iob ( intelxl->rx_iobuf[i] );
+		intelxl->rx_iobuf[i] = NULL;
+	}
+}
+
+/**
+ * Transmit packet
+ *
+ * @v netdev		Network device
+ * @v iobuf		I/O buffer
+ * @ret rc		Return status code
+ */
+static int intelxl_transmit ( struct net_device *netdev,
+			      struct io_buffer *iobuf ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	struct intelxl_tx_data_descriptor *tx;
+	unsigned int tx_idx;
+	unsigned int tx_tail;
+	physaddr_t address;
+	size_t len;
+
+	/* Get next transmit descriptor */
+	if ( ( intelxl->tx.prod - intelxl->tx.cons ) >= INTELXL_TX_FILL ) {
+		DBGC ( intelxl, "INTELXL %p out of transmit descriptors\n",
+		       intelxl );
+		return -ENOBUFS;
+	}
+	tx_idx = ( intelxl->tx.prod++ % INTELXL_TX_NUM_DESC );
+	tx_tail = ( intelxl->tx.prod % INTELXL_TX_NUM_DESC );
+	tx = &intelxl->tx.desc[tx_idx].tx;
+
+	/* Populate transmit descriptor */
+	address = virt_to_bus ( iobuf->data );
+	len = iob_len ( iobuf );
+	tx->address = cpu_to_le64 ( address );
+	tx->len = cpu_to_le32 ( INTELXL_TX_DATA_LEN ( len ) );
+	tx->flags = cpu_to_le32 ( INTELXL_TX_DATA_DTYP | INTELXL_TX_DATA_EOP |
+				  INTELXL_TX_DATA_RS | INTELXL_TX_DATA_JFDI );
+	wmb();
+
+	/* Notify card that there are packets ready to transmit */
+	writel ( tx_tail,
+		 ( intelxl->regs + intelxl->tx.reg + INTELXL_QXX_TAIL ) );
+
+	DBGC2 ( intelxl, "INTELXL %p TX %d is [%llx,%llx)\n", intelxl, tx_idx,
+		( ( unsigned long long ) address ),
+		( ( unsigned long long ) address + len ) );
+	return 0;
+}
+
+/**
+ * Poll for completed packets
+ *
+ * @v netdev		Network device
+ */
+static void intelxl_poll_tx ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	struct intelxl_tx_writeback_descriptor *tx_wb;
+	unsigned int tx_idx;
+
+	/* Check for completed packets */
+	while ( intelxl->tx.cons != intelxl->tx.prod ) {
+
+		/* Get next transmit descriptor */
+		tx_idx = ( intelxl->tx.cons % INTELXL_TX_NUM_DESC );
+		tx_wb = &intelxl->tx.desc[tx_idx].tx_wb;
+
+		/* Stop if descriptor is still in use */
+		if ( ! ( tx_wb->flags & INTELXL_TX_WB_FL_DD ) )
+			return;
+		DBGC2 ( intelxl, "INTELXL %p TX %d complete\n",
+			intelxl, tx_idx );
+
+		/* Complete TX descriptor */
+		netdev_tx_complete_next ( netdev );
+		intelxl->tx.cons++;
+	}
+}
+
+/**
+ * Poll for received packets
+ *
+ * @v netdev		Network device
+ */
+static void intelxl_poll_rx ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+	struct intelxl_rx_writeback_descriptor *rx_wb;
+	struct io_buffer *iobuf;
+	unsigned int rx_idx;
+	size_t len;
+
+	/* Check for received packets */
+	while ( intelxl->rx.cons != intelxl->rx.prod ) {
+
+		/* Get next receive descriptor */
+		rx_idx = ( intelxl->rx.cons % INTELXL_RX_NUM_DESC );
+		rx_wb = &intelxl->rx.desc[rx_idx].rx_wb;
+
+		/* Stop if descriptor is still in use */
+		if ( ! ( rx_wb->flags & cpu_to_le32 ( INTELXL_RX_WB_FL_DD ) ) )
+			return;
+
+		/* Populate I/O buffer */
+		iobuf = intelxl->rx_iobuf[rx_idx];
+		intelxl->rx_iobuf[rx_idx] = NULL;
+		len = INTELXL_RX_WB_LEN ( le32_to_cpu ( rx_wb->len ) );
+		iob_put ( iobuf, len );
+
+		/* Hand off to network stack */
+		if ( rx_wb->flags & cpu_to_le32 ( INTELXL_RX_WB_FL_RXE ) ) {
+			DBGC ( intelxl, "INTELXL %p RX %d error (length %zd, "
+			       "flags %08x)\n", intelxl, rx_idx, len,
+			       le32_to_cpu ( rx_wb->flags ) );
+			netdev_rx_err ( netdev, iobuf, -EIO );
+		} else {
+			DBGC2 ( intelxl, "INTELXL %p RX %d complete (length "
+				"%zd)\n", intelxl, rx_idx, len );
+			netdev_rx ( netdev, iobuf );
+		}
+		intelxl->rx.cons++;
+	}
+}
+
+/**
+ * Poll for completed and received packets
+ *
+ * @v netdev		Network device
+ */
+static void intelxl_poll ( struct net_device *netdev ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+
+	/* Acknowledge interrupts, if applicable */
+	if ( netdev_irq_enabled ( netdev ) ) {
+		writel ( ( INTELXL_PFINT_DYN_CTL0_CLEARPBA |
+			   INTELXL_PFINT_DYN_CTL0_INTENA_MASK ),
+			 intelxl->regs + INTELXL_PFINT_DYN_CTL0 );
+	}
+
+	/* Poll for completed packets */
+	intelxl_poll_tx ( netdev );
+
+	/* Poll for received packets */
+	intelxl_poll_rx ( netdev );
+
+	/* Poll for admin events */
+	intelxl_poll_admin ( netdev );
+
+	/* Refill RX ring */
+	intelxl_refill_rx ( intelxl );
+}
+
+/**
+ * Enable or disable interrupts
+ *
+ * @v netdev		Network device
+ * @v enable		Interrupts should be enabled
+ */
+static void intelxl_irq ( struct net_device *netdev, int enable ) {
+	struct intelxl_nic *intelxl = netdev->priv;
+
+	if ( enable ) {
+		writel ( INTELXL_PFINT_DYN_CTL0_INTENA,
+			 intelxl->regs + INTELXL_PFINT_DYN_CTL0 );
+	} else {
+		writel ( 0, intelxl->regs + INTELXL_PFINT_DYN_CTL0 );
+	}
+}
+
+/** Network device operations */
+static struct net_device_operations intelxl_operations = {
+	.open		= intelxl_open,
+	.close		= intelxl_close,
+	.transmit	= intelxl_transmit,
+	.poll		= intelxl_poll,
+	.irq		= intelxl_irq,
+};
+
+/******************************************************************************
+ *
+ * PCI interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Probe PCI device
+ *
+ * @v pci		PCI device
+ * @ret rc		Return status code
+ */
+static int intelxl_probe ( struct pci_device *pci ) {
+	struct net_device *netdev;
+	struct intelxl_nic *intelxl;
+	uint32_t pfgen_portnum;
+	uint32_t pflan_qalloc;
+	int rc;
+
+	/* Allocate and initialise net device */
+	netdev = alloc_etherdev ( sizeof ( *intelxl ) );
+	if ( ! netdev ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+	netdev_init ( netdev, &intelxl_operations );
+	intelxl = netdev->priv;
+	pci_set_drvdata ( pci, netdev );
+	netdev->dev = &pci->dev;
+	memset ( intelxl, 0, sizeof ( *intelxl ) );
+	intelxl->pf = PCI_FUNC ( pci->busdevfn );
+	intelxl_init_admin ( &intelxl->command, INTELXL_ADMIN_CMD );
+	intelxl_init_admin ( &intelxl->event, INTELXL_ADMIN_EVT );
+	intelxl_init_ring ( &intelxl->tx, INTELXL_TX_NUM_DESC,
+			    intelxl_context_tx );
+	intelxl_init_ring ( &intelxl->rx, INTELXL_RX_NUM_DESC,
+			    intelxl_context_rx );
+
+	/* Fix up PCI device */
+	adjust_pci_device ( pci );
+
+	/* Map registers */
+	intelxl->regs = ioremap ( pci->membase, INTELXL_BAR_SIZE );
+	if ( ! intelxl->regs ) {
+		rc = -ENODEV;
+		goto err_ioremap;
+	}
+
+	/* Reset the NIC */
+	if ( ( rc = intelxl_reset ( intelxl ) ) != 0 )
+		goto err_reset;
+
+	/* Get port number and base queue number */
+	pfgen_portnum = readl ( intelxl->regs + INTELXL_PFGEN_PORTNUM );
+	intelxl->port = INTELXL_PFGEN_PORTNUM_PORT_NUM ( pfgen_portnum );
+	pflan_qalloc = readl ( intelxl->regs + INTELXL_PFLAN_QALLOC );
+	intelxl->base = INTELXL_PFLAN_QALLOC_FIRSTQ ( pflan_qalloc );
+	DBGC ( intelxl, "INTELXL %p PF %d using port %d queues [%#04x-%#04x]\n",
+	       intelxl, intelxl->pf, intelxl->port, intelxl->base,
+	       INTELXL_PFLAN_QALLOC_LASTQ ( pflan_qalloc ) );
+
+	/* Fetch MAC address and maximum frame size */
+	if ( ( rc = intelxl_fetch_mac ( intelxl, netdev ) ) != 0 )
+		goto err_fetch_mac;
+
+	/* Open admin queues */
+	if ( ( rc = intelxl_open_admin ( intelxl ) ) != 0 )
+		goto err_open_admin;
+
+	/* Get switch configuration */
+	if ( ( rc = intelxl_admin_switch ( intelxl ) ) != 0 )
+		goto err_admin_switch;
+
+	/* Get VSI configuration */
+	if ( ( rc = intelxl_admin_vsi ( intelxl ) ) != 0 )
+		goto err_admin_vsi;
+
+	/* Configure switch for promiscuous mode */
+	if ( ( rc = intelxl_admin_promisc ( intelxl ) ) != 0 )
+		goto err_admin_promisc;
+
+	/* Configure queue register addresses */
+	intelxl->tx.reg = INTELXL_QTX ( intelxl->queue );
+	intelxl->rx.reg = INTELXL_QRX ( intelxl->queue );
+
+	/* Configure interrupt causes */
+	writel ( ( INTELXL_QINT_TQCTL_NEXTQ_INDX_NONE |
+		   INTELXL_QINT_TQCTL_CAUSE_ENA ),
+		 intelxl->regs + INTELXL_QINT_TQCTL ( intelxl->queue ) );
+	writel ( ( INTELXL_QINT_RQCTL_NEXTQ_INDX ( intelxl->queue ) |
+		   INTELXL_QINT_RQCTL_NEXTQ_TYPE_TX |
+		   INTELXL_QINT_RQCTL_CAUSE_ENA ),
+		 intelxl->regs + INTELXL_QINT_RQCTL ( intelxl->queue ) );
+	writel ( ( INTELXL_PFINT_LNKLST0_FIRSTQ_INDX ( intelxl->queue ) |
+		   INTELXL_PFINT_LNKLST0_FIRSTQ_TYPE_RX ),
+		 intelxl->regs + INTELXL_PFINT_LNKLST0 );
+	writel ( INTELXL_PFINT_ICR0_ENA_ADMINQ,
+		 intelxl->regs + INTELXL_PFINT_ICR0_ENA );
+
+	/* Register network device */
+	if ( ( rc = register_netdev ( netdev ) ) != 0 )
+		goto err_register_netdev;
+
+	/* Set initial link state */
+	intelxl_admin_link ( netdev );
+
+	return 0;
+
+	unregister_netdev ( netdev );
+ err_register_netdev:
+ err_admin_promisc:
+ err_admin_vsi:
+ err_admin_switch:
+	intelxl_close_admin ( intelxl );
+ err_open_admin:
+ err_fetch_mac:
+	intelxl_reset ( intelxl );
+ err_reset:
+	iounmap ( intelxl->regs );
+ err_ioremap:
+	netdev_nullify ( netdev );
+	netdev_put ( netdev );
+ err_alloc:
+	return rc;
+}
+
+/**
+ * Remove PCI device
+ *
+ * @v pci		PCI device
+ */
+static void intelxl_remove ( struct pci_device *pci ) {
+	struct net_device *netdev = pci_get_drvdata ( pci );
+	struct intelxl_nic *intelxl = netdev->priv;
+
+	/* Unregister network device */
+	unregister_netdev ( netdev );
+
+	/* Close admin queues */
+	intelxl_close_admin ( intelxl );
+
+	/* Reset the NIC */
+	intelxl_reset ( intelxl );
+
+	/* Free network device */
+	iounmap ( intelxl->regs );
+	netdev_nullify ( netdev );
+	netdev_put ( netdev );
+}
+
+/** PCI device IDs */
+static struct pci_device_id intelxl_nics[] = {
+	PCI_ROM ( 0x8086, 0x1572, "x710-sfp", "X710 10GbE SFP+", 0 ),
+	PCI_ROM ( 0x8086, 0x1574, "xl710-qemu", "Virtual XL710", 0 ),
+	PCI_ROM ( 0x8086, 0x1580, "xl710-kx-b", "XL710 40GbE backplane", 0 ),
+	PCI_ROM ( 0x8086, 0x1581, "xl710-kx-c", "XL710 10GbE backplane", 0 ),
+	PCI_ROM ( 0x8086, 0x1583, "xl710-qda2", "XL710 40GbE QSFP+", 0 ),
+	PCI_ROM ( 0x8086, 0x1584, "xl710-qda1", "XL710 40GbE QSFP+", 0 ),
+	PCI_ROM ( 0x8086, 0x1585, "x710-qsfp", "X710 10GbE QSFP+", 0 ),
+	PCI_ROM ( 0x8086, 0x1586, "x710-10gt", "X710 10GBASE-T", 0 ),
+	PCI_ROM ( 0x8086, 0x1587, "x710-kr2", "XL710 20GbE backplane", 0 ),
+	PCI_ROM ( 0x8086, 0x1588, "x710-kr2-a", "XL710 20GbE backplane", 0 ),
+	PCI_ROM ( 0x8086, 0x1589, "x710-10gt4", "X710 10GBASE-T4", 0 ),
+	PCI_ROM ( 0x8086, 0x158a, "xxv710", "XXV710 25GbE backplane", 0 ),
+	PCI_ROM ( 0x8086, 0x158b, "xxv710-sfp28", "XXV710 25GbE SFP28", 0 ),
+	PCI_ROM ( 0x8086, 0x37ce, "x722-kx", "X722 10GbE backplane", 0 ),
+	PCI_ROM ( 0x8086, 0x37cf, "x722-qsfp", "X722 10GbE QSFP+", 0 ),
+	PCI_ROM ( 0x8086, 0x37d0, "x722-sfp", "X722 10GbE SFP+", 0 ),
+	PCI_ROM ( 0x8086, 0x37d1, "x722-1gt", "X722 1GBASE-T", 0 ),
+	PCI_ROM ( 0x8086, 0x37d2, "x722-10gt", "X722 10GBASE-T", 0 ),
+	PCI_ROM ( 0x8086, 0x37d3, "x722-sfp-i", "X722 10GbE SFP+", 0 ),
+};
+
+/** PCI driver */
+struct pci_driver intelxl_driver __pci_driver = {
+	.ids = intelxl_nics,
+	.id_count = ( sizeof ( intelxl_nics ) / sizeof ( intelxl_nics[0] ) ),
+	.probe = intelxl_probe,
+	.remove = intelxl_remove,
+};
diff --git a/src/drivers/net/intelxl.h b/src/drivers/net/intelxl.h
new file mode 100644
index 0000000..02d9b98
--- /dev/null
+++ b/src/drivers/net/intelxl.h
@@ -0,0 +1,790 @@
+#ifndef _INTELX_H
+#define _INTELX_H
+
+/** @file
+ *
+ * Intel 40 Gigabit Ethernet network card driver
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <ipxe/if_ether.h>
+
+struct intelxl_nic;
+
+/** BAR size */
+#define INTELXL_BAR_SIZE 0x200000
+
+/** Alignment
+ *
+ * No data structure requires greater than 128 byte alignment.
+ */
+#define INTELXL_ALIGN 128
+
+/******************************************************************************
+ *
+ * Admin queue
+ *
+ ******************************************************************************
+ */
+
+/** PF Admin Command Queue register block */
+#define INTELXL_ADMIN_CMD 0x080000
+
+/** PF Admin Event Queue register block */
+#define INTELXL_ADMIN_EVT 0x080080
+
+/** Admin Queue Base Address Low Register (offset) */
+#define INTELXL_ADMIN_BAL 0x000
+
+/** Admin Queue Base Address High Register (offset) */
+#define INTELXL_ADMIN_BAH 0x100
+
+/** Admin Queue Length Register (offset) */
+#define INTELXL_ADMIN_LEN 0x200
+#define INTELXL_ADMIN_LEN_LEN(x)	( (x) << 0 )	/**< Queue length */
+#define INTELXL_ADMIN_LEN_ENABLE	0x80000000UL	/**< Queue enable */
+
+/** Admin Queue Head Register (offset) */
+#define INTELXL_ADMIN_HEAD 0x300
+
+/** Admin Queue Tail Register (offset) */
+#define INTELXL_ADMIN_TAIL 0x400
+
+/** Admin queue data buffer command parameters */
+struct intelxl_admin_buffer_params {
+	/** Reserved */
+	uint8_t reserved[8];
+	/** Buffer address high */
+	uint32_t high;
+	/** Buffer address low */
+	uint32_t low;
+} __attribute__ (( packed ));
+
+/** Admin queue Get Version command */
+#define INTELXL_ADMIN_VERSION 0x0001
+
+/** Admin queue version number */
+struct intelxl_admin_version {
+	/** Major version number */
+	uint16_t major;
+	/** Minor version number */
+	uint16_t minor;
+} __attribute__ (( packed ));
+
+/** Admin queue Get Version command parameters */
+struct intelxl_admin_version_params {
+	/** ROM version */
+	uint32_t rom;
+	/** Firmware build ID */
+	uint32_t build;
+	/** Firmware version */
+	struct intelxl_admin_version firmware;
+	/** API version */
+	struct intelxl_admin_version api;
+} __attribute__ (( packed ));
+
+/** Admin queue Driver Version command */
+#define INTELXL_ADMIN_DRIVER 0x0002
+
+/** Admin queue Driver Version command parameters */
+struct intelxl_admin_driver_params {
+	/** Driver version */
+	uint8_t major;
+	/** Minor version */
+	uint8_t minor;
+	/** Build version */
+	uint8_t build;
+	/** Sub-build version */
+	uint8_t sub;
+	/** Reserved */
+	uint8_t reserved[4];
+	/** Data buffer address */
+	uint64_t address;
+} __attribute__ (( packed ));
+
+/** Admin queue Driver Version data buffer */
+struct intelxl_admin_driver_buffer {
+	/** Driver name */
+	char name[32];
+} __attribute__ (( packed ));
+
+/** Admin queue Shutdown command */
+#define INTELXL_ADMIN_SHUTDOWN 0x0003
+
+/** Admin queue Shutdown command parameters */
+struct intelxl_admin_shutdown_params {
+	/** Driver unloading */
+	uint8_t unloading;
+	/** Reserved */
+	uint8_t reserved[15];
+} __attribute__ (( packed ));
+
+/** Driver is unloading */
+#define INTELXL_ADMIN_SHUTDOWN_UNLOADING 0x01
+
+/** Admin queue Get Switch Configuration command */
+#define INTELXL_ADMIN_SWITCH 0x0200
+
+/** Switching element configuration */
+struct intelxl_admin_switch_config {
+	/** Switching element type */
+	uint8_t type;
+	/** Revision */
+	uint8_t revision;
+	/** Switching element ID */
+	uint16_t seid;
+	/** Uplink switching element ID */
+	uint16_t uplink;
+	/** Downlink switching element ID */
+	uint16_t downlink;
+	/** Reserved */
+	uint8_t reserved_b[3];
+	/** Connection type */
+	uint8_t connection;
+	/** Reserved */
+	uint8_t reserved_c[2];
+	/** Element specific information */
+	uint16_t info;
+} __attribute__ (( packed ));
+
+/** Virtual Station Inferface element type */
+#define INTELXL_ADMIN_SWITCH_TYPE_VSI 19
+
+/** Admin queue Get Switch Configuration command parameters */
+struct intelxl_admin_switch_params {
+	/** Starting switching element identifier */
+	uint16_t next;
+	/** Reserved */
+	uint8_t reserved[6];
+	/** Data buffer address */
+	uint64_t address;
+} __attribute__ (( packed ));
+
+/** Admin queue Get Switch Configuration data buffer */
+struct intelxl_admin_switch_buffer {
+	/** Number of switching elements reported */
+	uint16_t count;
+	/** Total number of switching elements */
+	uint16_t total;
+	/** Reserved */
+	uint8_t reserved_a[12];
+	/** Switch configuration */
+	struct intelxl_admin_switch_config cfg;
+} __attribute__ (( packed ));
+
+/** Admin queue Get VSI Parameters command */
+#define INTELXL_ADMIN_VSI 0x0212
+
+/** Admin queue Get VSI Parameters command parameters */
+struct intelxl_admin_vsi_params {
+	/** VSI switching element ID */
+	uint16_t vsi;
+	/** Reserved */
+	uint8_t reserved[6];
+	/** Data buffer address */
+	uint64_t address;
+} __attribute__ (( packed ));
+
+/** Admin queue Get VSI Parameters data buffer */
+struct intelxl_admin_vsi_buffer {
+	/** Reserved */
+	uint8_t reserved_a[30];
+	/** Queue numbers */
+	uint16_t queue[16];
+	/** Reserved */
+	uint8_t reserved_b[34];
+	/** Queue set handles for each traffic class */
+	uint16_t qset[8];
+	/** Reserved */
+	uint8_t reserved_c[16];
+} __attribute__ (( packed ));
+
+/** Admin queue Set VSI Promiscuous Modes command */
+#define INTELXL_ADMIN_PROMISC 0x0254
+
+/** Admin queue Set VSI Promiscuous Modes command parameters */
+struct intelxl_admin_promisc_params {
+	/** Flags */
+	uint16_t flags;
+	/** Valid flags */
+	uint16_t valid;
+	/** VSI switching element ID */
+	uint16_t vsi;
+	/** Reserved */
+	uint8_t reserved[10];
+} __attribute__ (( packed ));
+
+/** Promiscuous unicast mode */
+#define INTELXL_ADMIN_PROMISC_FL_UNICAST 0x0001
+
+/** Promiscuous multicast mode */
+#define INTELXL_ADMIN_PROMISC_FL_MULTICAST 0x0002
+
+/** Promiscuous broadcast mode */
+#define INTELXL_ADMIN_PROMISC_FL_BROADCAST 0x0004
+
+/** Promiscuous VLAN mode */
+#define INTELXL_ADMIN_PROMISC_FL_VLAN 0x0010
+
+/** Admin queue Restart Autonegotiation command */
+#define INTELXL_ADMIN_AUTONEG 0x0605
+
+/** Admin queue Restart Autonegotiation command parameters */
+struct intelxl_admin_autoneg_params {
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved[15];
+} __attribute__ (( packed ));
+
+/** Restart autonegotiation */
+#define INTELXL_ADMIN_AUTONEG_FL_RESTART 0x02
+
+/** Enable link */
+#define INTELXL_ADMIN_AUTONEG_FL_ENABLE 0x04
+
+/** Admin queue Get Link Status command */
+#define INTELXL_ADMIN_LINK 0x0607
+
+/** Admin queue Get Link Status command parameters */
+struct intelxl_admin_link_params {
+	/** Link status notification */
+	uint8_t notify;
+	/** Reserved */
+	uint8_t reserved_a;
+	/** PHY type */
+	uint8_t phy;
+	/** Link speed */
+	uint8_t speed;
+	/** Link status */
+	uint8_t status;
+	/** Reserved */
+	uint8_t reserved_b[11];
+} __attribute__ (( packed ));
+
+/** Notify driver of link status changes */
+#define INTELXL_ADMIN_LINK_NOTIFY 0x03
+
+/** Link is up */
+#define INTELXL_ADMIN_LINK_UP 0x01
+
+/** Admin queue command parameters */
+union intelxl_admin_params {
+	/** Additional data buffer command parameters */
+	struct intelxl_admin_buffer_params buffer;
+	/** Get Version command parameters */
+	struct intelxl_admin_version_params version;
+	/** Driver Version command parameters */
+	struct intelxl_admin_driver_params driver;
+	/** Shutdown command parameters */
+	struct intelxl_admin_shutdown_params shutdown;
+	/** Get Switch Configuration command parameters */
+	struct intelxl_admin_switch_params sw;
+	/** Get VSI Parameters command parameters */
+	struct intelxl_admin_vsi_params vsi;
+	/** Set VSI Promiscuous Modes command parameters */
+	struct intelxl_admin_promisc_params promisc;
+	/** Restart Autonegotiation command parameters */
+	struct intelxl_admin_autoneg_params autoneg;
+	/** Get Link Status command parameters */
+	struct intelxl_admin_link_params link;
+} __attribute__ (( packed ));
+
+/** Admin queue data buffer */
+union intelxl_admin_buffer {
+	/** Driver Version data buffer */
+	struct intelxl_admin_driver_buffer driver;
+	/** Get Switch Configuration data buffer */
+	struct intelxl_admin_switch_buffer sw;
+	/** Get VSI Parameters data buffer */
+	struct intelxl_admin_vsi_buffer vsi;
+} __attribute__ (( packed ));
+
+/** Admin queue descriptor */
+struct intelxl_admin_descriptor {
+	/** Flags */
+	uint16_t flags;
+	/** Opcode */
+	uint16_t opcode;
+	/** Data length */
+	uint16_t len;
+	/** Return value */
+	uint16_t ret;
+	/** Cookie */
+	uint32_t cookie;
+	/** Reserved */
+	uint32_t reserved;
+	/** Parameters */
+	union intelxl_admin_params params;
+} __attribute__ (( packed ));
+
+/** Admin descriptor done */
+#define INTELXL_ADMIN_FL_DD 0x0001
+
+/** Admin descriptor contains a completion */
+#define INTELXL_ADMIN_FL_CMP 0x0002
+
+/** Admin descriptor completed in error */
+#define INTELXL_ADMIN_FL_ERR 0x0004
+
+/** Admin descriptor uses data buffer for command parameters */
+#define INTELXL_ADMIN_FL_RD 0x0400
+
+/** Admin descriptor uses data buffer */
+#define INTELXL_ADMIN_FL_BUF 0x1000
+
+/** Admin queue */
+struct intelxl_admin {
+	/** Descriptors */
+	struct intelxl_admin_descriptor *desc;
+	/** Queue index */
+	unsigned int index;
+
+	/** Register block */
+	unsigned int reg;
+	/** Data buffer */
+	union intelxl_admin_buffer *buffer;
+};
+
+/**
+ * Initialise admin queue
+ *
+ * @v admin		Admin queue
+ * @v reg		Register block
+ */
+static inline __attribute__ (( always_inline )) void
+intelxl_init_admin ( struct intelxl_admin *admin, unsigned int reg ) {
+
+	admin->reg = reg;
+}
+
+/** Number of admin queue descriptors */
+#define INTELXL_ADMIN_NUM_DESC 4
+
+/** Maximum time to wait for an admin request to complete */
+#define INTELXL_ADMIN_MAX_WAIT_MS 100
+
+/** Admin queue API major version */
+#define INTELXL_ADMIN_API_MAJOR 1
+
+/******************************************************************************
+ *
+ * Transmit and receive queue context
+ *
+ ******************************************************************************
+ */
+
+/** CMLAN Context Data Register */
+#define INTELXL_PFCM_LANCTXDATA(x) ( 0x10c100 + ( 0x80 * (x) ) )
+
+/** CMLAN Context Control Register */
+#define INTELXL_PFCM_LANCTXCTL 0x10c300
+#define INTELXL_PFCM_LANCTXCTL_QUEUE_NUM(x) \
+	( (x) << 0 )					/**< Queue number */
+#define INTELXL_PFCM_LANCTXCTL_SUB_LINE(x) \
+	( (x) << 12 )					/**< Sub-line */
+#define INTELXL_PFCM_LANCTXCTL_TYPE(x) \
+	( (x) << 15 )					/**< Queue type */
+#define INTELXL_PFCM_LANCTXCTL_TYPE_RX \
+	INTELXL_PFCM_LANCTXCTL_TYPE ( 0x0 )		/**< RX queue type */
+#define INTELXL_PFCM_LANCTXCTL_TYPE_TX \
+	INTELXL_PFCM_LANCTXCTL_TYPE ( 0x1 )		/**< TX queue type */
+#define INTELXL_PFCM_LANCTXCTL_OP_CODE(x) \
+	( (x) << 17 )					/**< Op code */
+#define INTELXL_PFCM_LANCTXCTL_OP_CODE_READ \
+	INTELXL_PFCM_LANCTXCTL_OP_CODE ( 0x0 )		/**< Read context */
+#define INTELXL_PFCM_LANCTXCTL_OP_CODE_WRITE \
+	INTELXL_PFCM_LANCTXCTL_OP_CODE ( 0x1 )		/**< Write context */
+
+/** CMLAN Context Status Register */
+#define INTELXL_PFCM_LANCTXSTAT 0x10c380
+#define INTELXL_PFCM_LANCTXSTAT_DONE   0x00000001UL	/**< Complete */
+
+/** Queue context line */
+struct intelxl_context_line {
+	/** Raw data */
+	uint32_t raw[4];
+} __attribute__ (( packed ));
+
+/** Transmit queue context */
+struct intelxl_context_tx {
+	/** Head pointer */
+	uint16_t head;
+	/** Flags */
+	uint16_t flags;
+	/** Base address */
+	uint64_t base;
+	/** Reserved */
+	uint8_t reserved_a[8];
+	/** Queue count */
+	uint16_t count;
+	/** Reserved */
+	uint8_t reserved_b[100];
+	/** Queue set */
+	uint16_t qset;
+	/** Reserved */
+	uint8_t reserved_c[4];
+} __attribute__ (( packed ));
+
+/** New transmit queue context */
+#define INTELXL_CTX_TX_FL_NEW 0x4000
+
+/** Transmit queue base address */
+#define INTELXL_CTX_TX_BASE( base ) ( (base) >> 7 )
+
+/** Transmit queue count */
+#define INTELXL_CTX_TX_COUNT( count ) ( (count) << 1 )
+
+/** Transmit queue set */
+#define INTELXL_CTX_TX_QSET( qset) ( (qset) << 4 )
+
+/** Receive queue context */
+struct intelxl_context_rx {
+	/** Head pointer */
+	uint16_t head;
+	/** Reserved */
+	uint8_t reserved_a[2];
+	/** Base address and queue count */
+	uint64_t base_count;
+	/** Data buffer length */
+	uint16_t len;
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved_b[7];
+	/** Maximum frame size */
+	uint16_t mfs;
+} __attribute__ (( packed ));
+
+/** Receive queue base address and queue count */
+#define INTELXL_CTX_RX_BASE_COUNT( base, count ) \
+	( ( (base) >> 7 ) | ( ( ( uint64_t ) (count) ) << 57 ) )
+
+/** Receive queue data buffer length */
+#define INTELXL_CTX_RX_LEN( len ) ( (len) >> 1 )
+
+/** Strip CRC from received packets */
+#define INTELXL_CTX_RX_FL_CRCSTRIP 0x20
+
+/** Receive queue maximum frame size */
+#define INTELXL_CTX_RX_MFS( mfs ) ( (mfs) >> 2 )
+
+/** Maximum time to wait for a context operation to complete */
+#define INTELXL_CTX_MAX_WAIT_MS 100
+
+/** Time to wait for a queue to become enabled */
+#define INTELXL_QUEUE_ENABLE_DELAY_US 20
+
+/** Time to wait for a transmit queue to become pre-disabled */
+#define INTELXL_QUEUE_PRE_DISABLE_DELAY_US 400
+
+/** Maximum time to wait for a queue to become disabled */
+#define INTELXL_QUEUE_DISABLE_MAX_WAIT_MS 1000
+
+/******************************************************************************
+ *
+ * Transmit and receive descriptors
+ *
+ ******************************************************************************
+ */
+
+/** Global Transmit Queue Head register */
+#define INTELXL_QTX_HEAD(x) ( 0x0e4000 + ( 0x4 * (x) ) )
+
+/** Global Transmit Pre Queue Disable register */
+#define INTELXL_GLLAN_TXPRE_QDIS(x) ( 0x0e6500 + ( 0x4 * ( (x) / 0x80 ) ) )
+#define INTELXL_GLLAN_TXPRE_QDIS_QINDX(x) \
+	( (x) << 0 )					/**< Queue index */
+#define INTELXL_GLLAN_TXPRE_QDIS_SET_QDIS \
+	0x40000000UL					/**< Set disable */
+#define INTELXL_GLLAN_TXPRE_QDIS_CLEAR_QDIS				\
+	0x80000000UL					/**< Clear disable */
+
+/** Global Transmit Queue register block */
+#define INTELXL_QTX(x) ( 0x100000 + ( 0x4 * (x) ) )
+
+/** Global Receive Queue register block */
+#define INTELXL_QRX(x) ( 0x120000 + ( 0x4 * (x) ) )
+
+/** Queue Enable Register (offset) */
+#define INTELXL_QXX_ENA 0x0000
+#define INTELXL_QXX_ENA_REQ		0x00000001UL	/**< Enable request */
+#define INTELXL_QXX_ENA_STAT		0x00000004UL	/**< Enabled status */
+
+/** Queue Control Register (offset) */
+#define INTELXL_QXX_CTL 0x4000
+#define INTELXL_QXX_CTL_PFVF_Q(x)	( (x) << 0 )	/**< PF/VF queue */
+#define INTELXL_QXX_CTL_PFVF_Q_PF \
+	INTELXL_QXX_CTL_PFVF_Q ( 0x2 )			/**< PF queue */
+#define INTELXL_QXX_CTL_PFVF_PF_INDX(x)	( (x) << 2 )	/**< PF index */
+
+/** Queue Tail Pointer Register (offset) */
+#define INTELXL_QXX_TAIL 0x8000
+
+/** Transmit data descriptor */
+struct intelxl_tx_data_descriptor {
+	/** Buffer address */
+	uint64_t address;
+	/** Flags */
+	uint32_t flags;
+	/** Length */
+	uint32_t len;
+} __attribute__ (( packed ));
+
+/** Transmit data descriptor type */
+#define INTELXL_TX_DATA_DTYP 0x0
+
+/** Transmit data descriptor end of packet */
+#define INTELXL_TX_DATA_EOP 0x10
+
+/** Transmit data descriptor report status */
+#define INTELXL_TX_DATA_RS 0x20
+
+/** Transmit data descriptor pretty please
+ *
+ * This bit is completely missing from older versions of the XL710
+ * datasheet.  Later versions describe it innocuously as "reserved,
+ * must be 1".  Without this bit, everything will appear to work (up
+ * to and including the port "transmit good octets" counter), but no
+ * packet will actually be sent.
+ */
+#define INTELXL_TX_DATA_JFDI 0x40
+
+/** Transmit data descriptor length */
+#define INTELXL_TX_DATA_LEN( len ) ( (len) << 2 )
+
+/** Transmit writeback descriptor */
+struct intelxl_tx_writeback_descriptor {
+	/** Reserved */
+	uint8_t reserved_a[8];
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved_b[7];
+} __attribute__ (( packed ));
+
+/** Transmit writeback descriptor complete */
+#define INTELXL_TX_WB_FL_DD 0x01
+
+/** Receive data descriptor */
+struct intelxl_rx_data_descriptor {
+	/** Buffer address */
+	uint64_t address;
+	/** Flags */
+	uint32_t flags;
+	/** Reserved */
+	uint8_t reserved[4];
+} __attribute__ (( packed ));
+
+/** Receive writeback descriptor */
+struct intelxl_rx_writeback_descriptor {
+	/** Reserved */
+	uint8_t reserved[8];
+	/** Flags */
+	uint32_t flags;
+	/** Length */
+	uint32_t len;
+} __attribute__ (( packed ));
+
+/** Receive writeback descriptor complete */
+#define INTELXL_RX_WB_FL_DD 0x00000001UL
+
+/** Receive writeback descriptor error */
+#define INTELXL_RX_WB_FL_RXE 0x00080000UL
+
+/** Receive writeback descriptor length */
+#define INTELXL_RX_WB_LEN(len) ( ( (len) >> 6 ) & 0x3fff )
+
+/** Packet descriptor */
+union intelxl_descriptor {
+	/** Transmit data descriptor */
+	struct intelxl_tx_data_descriptor tx;
+	/** Transmit writeback descriptor */
+	struct intelxl_tx_writeback_descriptor tx_wb;
+	/** Receive data descriptor */
+	struct intelxl_rx_data_descriptor rx;
+	/** Receive writeback descriptor */
+	struct intelxl_rx_writeback_descriptor rx_wb;
+};
+
+/** Descriptor ring */
+struct intelxl_ring {
+	/** Descriptors */
+	union intelxl_descriptor *desc;
+	/** Producer index */
+	unsigned int prod;
+	/** Consumer index */
+	unsigned int cons;
+
+	/** Register block */
+	unsigned int reg;
+	/** Length (in bytes) */
+	size_t len;
+	/** Program queue context
+	 *
+	 * @v intelxl		Intel device
+	 * @v address		Descriptor ring base address
+	 */
+	int ( * context ) ( struct intelxl_nic *intelxl, physaddr_t address );
+};
+
+/**
+ * Initialise descriptor ring
+ *
+ * @v ring		Descriptor ring
+ * @v count		Number of descriptors
+ * @v context		Method to program queue context
+ */
+static inline __attribute__ (( always_inline)) void
+intelxl_init_ring ( struct intelxl_ring *ring, unsigned int count,
+		    int ( * context ) ( struct intelxl_nic *intelxl,
+					physaddr_t address ) ) {
+
+	ring->len = ( count * sizeof ( ring->desc[0] ) );
+	ring->context = context;
+}
+
+/** Number of transmit descriptors */
+#define INTELXL_TX_NUM_DESC 16
+
+/** Transmit descriptor ring maximum fill level */
+#define INTELXL_TX_FILL ( INTELXL_TX_NUM_DESC - 1 )
+
+/** Number of receive descriptors
+ *
+ * In PXE mode (i.e. able to post single receive descriptors), 8
+ * descriptors is the only permitted value covering all possible
+ * numbers of PFs.
+ */
+#define INTELXL_RX_NUM_DESC 8
+
+/** Receive descriptor ring fill level */
+#define INTELXL_RX_FILL ( INTELXL_RX_NUM_DESC - 1 )
+
+/******************************************************************************
+ *
+ * Top level
+ *
+ ******************************************************************************
+ */
+
+/** PF Interrupt Zero Dynamic Control Register */
+#define INTELXL_PFINT_DYN_CTL0 0x038480
+#define INTELXL_PFINT_DYN_CTL0_INTENA	0x00000001UL	/**< Enable */
+#define INTELXL_PFINT_DYN_CTL0_CLEARPBA	0x00000002UL	/**< Acknowledge */
+#define INTELXL_PFINT_DYN_CTL0_INTENA_MASK 0x80000000UL	/**< Ignore enable */
+
+/** PF Interrupt Zero Linked List Register */
+#define INTELXL_PFINT_LNKLST0 0x038500
+#define INTELXL_PFINT_LNKLST0_FIRSTQ_INDX(x) \
+	( (x) << 0 )					/**< Queue index */
+#define INTELXL_PFINT_LNKLST0_FIRSTQ_INDX_NONE \
+	INTELXL_PFINT_LNKLST0_FIRSTQ_INDX ( 0x7ff )	/**< End of list */
+#define INTELXL_PFINT_LNKLST0_FIRSTQ_TYPE(x) \
+	( (x) << 11 )					/**< Queue type */
+#define INTELXL_PFINT_LNKLST0_FIRSTQ_TYPE_RX \
+	INTELXL_PFINT_LNKLST0_FIRSTQ_TYPE ( 0x0 )	/**< Receive queue */
+#define INTELXL_PFINT_LNKLST0_FIRSTQ_TYPE_TX \
+	INTELXL_PFINT_LNKLST0_FIRSTQ_TYPE ( 0x1 )	/**< Transmit queue */
+
+/** PF Interrupt Zero Cause Enablement Register */
+#define INTELXL_PFINT_ICR0_ENA 0x038800
+#define INTELXL_PFINT_ICR0_ENA_ADMINQ	0x40000000UL	/**< Admin event */
+
+/** Receive Queue Interrupt Cause Control Register */
+#define INTELXL_QINT_RQCTL(x) ( 0x03a000 + ( 0x4 * (x) ) )
+#define INTELXL_QINT_RQCTL_NEXTQ_INDX(x) ( (x) << 16 )	/**< Queue index */
+#define INTELXL_QINT_RQCTL_NEXTQ_INDX_NONE \
+	INTELXL_QINT_RQCTL_NEXTQ_INDX ( 0x7ff )		/**< End of list */
+#define INTELXL_QINT_RQCTL_NEXTQ_TYPE(x) ( (x) << 27 )	/**< Queue type */
+#define INTELXL_QINT_RQCTL_NEXTQ_TYPE_RX \
+	INTELXL_QINT_RQCTL_NEXTQ_TYPE ( 0x0 )		/**< Receive queue */
+#define INTELXL_QINT_RQCTL_NEXTQ_TYPE_TX \
+	INTELXL_QINT_RQCTL_NEXTQ_TYPE ( 0x1 )		/**< Transmit queue */
+#define INTELXL_QINT_RQCTL_CAUSE_ENA	0x40000000UL	/**< Enable */
+
+/** Transmit Queue Interrupt Cause Control Register */
+#define INTELXL_QINT_TQCTL(x) ( 0x03c000 + ( 0x4 * (x) ) )
+#define INTELXL_QINT_TQCTL_NEXTQ_INDX(x) ( (x) << 16 )	/**< Queue index */
+#define INTELXL_QINT_TQCTL_NEXTQ_INDX_NONE \
+	INTELXL_QINT_TQCTL_NEXTQ_INDX ( 0x7ff )		/**< End of list */
+#define INTELXL_QINT_TQCTL_NEXTQ_TYPE(x) ( (x) << 27 )	/**< Queue type */
+#define INTELXL_QINT_TQCTL_NEXTQ_TYPE_RX \
+	INTELXL_QINT_TQCTL_NEXTQ_TYPE ( 0x0 )		/**< Receive queue */
+#define INTELXL_QINT_TQCTL_NEXTQ_TYPE_TX \
+	INTELXL_QINT_TQCTL_NEXTQ_TYPE ( 0x1 )		/**< Transmit queue */
+#define INTELXL_QINT_TQCTL_CAUSE_ENA	0x40000000UL	/**< Enable */
+
+/** PF Control Register */
+#define INTELXL_PFGEN_CTRL 0x092400
+#define INTELXL_PFGEN_CTRL_PFSWR	0x00000001UL	/**< Software Reset */
+
+/** Time to delay for device reset, in milliseconds */
+#define INTELXL_RESET_DELAY_MS 100
+
+/** PF Queue Allocation Register */
+#define INTELXL_PFLAN_QALLOC 0x1c0400
+#define INTELXL_PFLAN_QALLOC_FIRSTQ(x) \
+	( ( (x) >> 0 ) & 0x7ff )			/**< First queue */
+#define INTELXL_PFLAN_QALLOC_LASTQ(x) \
+	( ( (x) >> 16 ) & 0x7ff )			/**< Last queue */
+
+/** PF LAN Port Number Register */
+#define INTELXL_PFGEN_PORTNUM 0x1c0480
+#define INTELXL_PFGEN_PORTNUM_PORT_NUM(x) \
+	( ( (x) >> 0 ) & 0x3 )				/**< Port number */
+
+/** Port MAC Address Low Register */
+#define INTELXL_PRTGL_SAL 0x1e2120
+
+/** Port MAC Address High Register */
+#define INTELXL_PRTGL_SAH 0x1e2140
+#define INTELXL_PRTGL_SAH_MFS_GET(x)	( (x) >> 16 )	/**< Max frame size */
+#define INTELXL_PRTGL_SAH_MFS_SET(x)	( (x) << 16 )	/**< Max frame size */
+
+/** Receive address */
+union intelxl_receive_address {
+	struct {
+		uint32_t low;
+		uint32_t high;
+	} __attribute__ (( packed )) reg;
+	uint8_t raw[ETH_ALEN];
+};
+
+/** An Intel 40Gigabit network card */
+struct intelxl_nic {
+	/** Registers */
+	void *regs;
+	/** Maximum frame size */
+	size_t mfs;
+
+	/** Physical function number */
+	unsigned int pf;
+	/** Absolute queue number base */
+	unsigned int base;
+	/** Port number */
+	unsigned int port;
+	/** Queue number */
+	unsigned int queue;
+	/** Virtual Station Interface switching element ID */
+	unsigned int vsi;
+	/** Queue set handle */
+	unsigned int qset;
+
+	/** Admin command queue */
+	struct intelxl_admin command;
+	/** Admin event queue */
+	struct intelxl_admin event;
+
+	/** Transmit descriptor ring */
+	struct intelxl_ring tx;
+	/** Receive descriptor ring */
+	struct intelxl_ring rx;
+	/** Receive I/O buffers */
+	struct io_buffer *rx_iobuf[INTELXL_RX_NUM_DESC];
+};
+
+#endif /* _INTELXL_H */
diff --git a/src/drivers/net/mii.c b/src/drivers/net/mii.c
index 9b29702..87605f0 100644
--- a/src/drivers/net/mii.c
+++ b/src/drivers/net/mii.c
@@ -37,10 +37,10 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 /**
  * Restart autonegotiation
  *
- * @v mii		MII interface
+ * @v mii		MII device
  * @ret rc		Return status code
  */
-int mii_restart ( struct mii_interface *mii ) {
+int mii_restart ( struct mii_device *mii ) {
 	int bmcr;
 	int rc;
 
@@ -66,12 +66,12 @@ int mii_restart ( struct mii_interface *mii ) {
 }
 
 /**
- * Reset MII interface
+ * Reset MII device
  *
- * @v mii		MII interface
+ * @v mii		MII device
  * @ret rc		Return status code
  */
-int mii_reset ( struct mii_interface *mii ) {
+int mii_reset ( struct mii_device *mii ) {
 	unsigned int i;
 	int bmcr;
 	int rc;
@@ -119,11 +119,11 @@ int mii_reset ( struct mii_interface *mii ) {
 /**
  * Update link status via MII
  *
- * @v mii		MII interface
+ * @v mii		MII device
  * @v netdev		Network device
  * @ret rc		Return status code
  */
-int mii_check_link ( struct mii_interface *mii, struct net_device *netdev ) {
+int mii_check_link ( struct mii_device *mii, struct net_device *netdev ) {
 	int bmsr;
 	int link;
 	int rc;
@@ -147,3 +147,28 @@ int mii_check_link ( struct mii_interface *mii, struct net_device *netdev ) {
 
 	return 0;
 }
+
+/**
+ * Find PHY address
+ *
+ * @v mii		MII device
+ * @ret rc		Return status code
+ */
+int mii_find ( struct mii_device *mii ) {
+	unsigned int address;
+	int id;
+
+	/* Try all possible PHY addresses */
+	for ( address = 0 ; address <= MII_MAX_PHY_ADDRESS ; address++ ) {
+		mii->address = address;
+		id = mii_read ( mii, MII_PHYSID1 );
+		if ( ( id > 0x0000 ) && ( id < 0xffff ) ) {
+			DBGC ( mii, "MII %p found PHY at address %d\n",