Merge ~paelzer/ubuntu/+source/ipxe:merge-20220113.fbbdc3926-jammy into ubuntu/+source/ipxe:ubuntu/jammy-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4753/+packages

Regression tests are ongoing, but looking good enough by now to get the reviews started.

[Christian Ehrhardt  (paelzer)]

FYI regression tests are mostly good (no ipxe issue left, just libvirt)

[Andreas Hasenack (ahasenack)]

Forgive my noobness with things ipxe, but why isn't this package just built again on arm64 (and armhf, and riscv, and ...)? Why keep it arch all?

Is this a case where the built files are on the server, and it can happily "serve" binaries from other architectures depending on the architecture of the booting client?

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Hi Andreas,
first of all it only needs/wants/supports arm64 + x86 - no other arch builds make sense.

Furthermore we'd want to keep it arch-all for a few reasons:
1. there are use cases of qemu emulating arm64 on any other arch, for that you'd want ipxe-arm64 there and being arch-all allows to use these roms just anywhere
2. Keeping a single build on just x86 is easier to debug and faster to build than having two builds (e.g. a common developer can fully run it on a laptop)
3. keeping both built by the same step allows us to keep the same package and dependencies.
   If we'd have two we#d either have:
   - two arch:all packages with new name/dependencies
   - one arch:any that for usage on non-primary architecture would need to be added via foreign-architecture

Overall the way as proposed is better for the developer, builds on LP and most importantly even the user without any drawback related to it.

Does that explain it enough Andreas?

[Andreas Hasenack (ahasenack)]

Yes, thanks
+1

review: Approve

[Christian Ehrhardt  (paelzer)]

Uploading as tested

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ipxe_1.21.1+git-20220113.fbbdc3926-0ubuntu1.dsc: done.
  Uploading ipxe_1.21.1+git-20220113.fbbdc3926.orig.tar.gz: done.
  Uploading ipxe_1.21.1+git-20220113.fbbdc3926-0ubuntu1.debian.tar.xz: done.
  Uploading ipxe_1.21.1+git-20220113.fbbdc3926-0ubuntu1_source.buildinfo: done.
  Uploading ipxe_1.21.1+git-20220113.fbbdc3926-0ubuntu1_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

https://launchpad.net/ubuntu/+source/ipxe/1.21.1+git-20220113.fbbdc3926-0ubuntu1

diff --git a/contrib/cloud/aws-import b/contrib/cloud/aws-import
index 9ee53e7..eef4302 100755
--- a/contrib/cloud/aws-import
+++ b/contrib/cloud/aws-import
@@ -3,14 +3,25 @@
 import argparse
 from base64 import b64encode
 from concurrent.futures import ThreadPoolExecutor, as_completed
+from datetime import date
 from hashlib import sha256
 from itertools import count
+import subprocess
 
 import boto3
 
 BLOCKSIZE = 512 * 1024
 
 
+def detect_architecture(image):
+    """Detect CPU architecture"""
+    mdir = subprocess.run(['mdir', '-b', '-i', image, '::/EFI/BOOT'],
+                          capture_output=True)
+    if any(b'BOOTAA64.EFI' in x for x in mdir.stdout.splitlines()):
+        return 'arm64'
+    return 'x86_64'
+
+
 def create_snapshot(region, description, image):
     """Create an EBS snapshot"""
     client = boto3.client('ebs', region_name=region)
@@ -65,36 +76,64 @@ def import_image(region, name, architecture, image, public):
     return image_id
 
 
+def launch_link(region, image_id):
+    """Construct a web console launch link"""
+    return ("https://console.aws.amazon.com/ec2/v2/home?"
+            "region=%s#LaunchInstanceWizard:ami=%s" % (region, image_id))
+
+
 # Parse command-line arguments
 parser = argparse.ArgumentParser(description="Import AWS EC2 image (AMI)")
-parser.add_argument('--architecture', '-a', default='x86_64',
-                    help="CPU architecture")
-parser.add_argument('--name', '-n', required=True,
+parser.add_argument('--name', '-n',
                     help="Image name")
 parser.add_argument('--public', '-p', action='store_true',
                     help="Make image public")
 parser.add_argument('--region', '-r', action='append',
                     help="AWS region(s)")
-parser.add_argument('image', help="iPXE disk image")
+parser.add_argument('--wiki', '-w', metavar='FILE',
+                    help="Generate Dokuwiki table")
+parser.add_argument('image', nargs='+', help="iPXE disk image")
 args = parser.parse_args()
 
+# Detect CPU architectures
+architectures = {image: detect_architecture(image) for image in args.image}
+
+# Use default name if none specified
+if not args.name:
+    args.name = 'iPXE (%s)' % date.today().strftime('%Y-%m-%d')
+
 # Use all regions if none specified
 if not args.region:
     args.region = sorted(x['RegionName'] for x in
                          boto3.client('ec2').describe_regions()['Regions'])
 
-# Use one thread per region to maximise parallelism
-with ThreadPoolExecutor(max_workers=len(args.region)) as executor:
+# Use one thread per import to maximise parallelism
+imports = [(region, image) for region in args.region for image in args.image]
+with ThreadPoolExecutor(max_workers=len(imports)) as executor:
     futures = {executor.submit(import_image,
                                region=region,
                                name=args.name,
-                               architecture=args.architecture,
-                               image=args.image,
-                               public=args.public): region
-               for region in args.region}
+                               architecture=architectures[image],
+                               image=image,
+                               public=args.public): (region, image)
+               for region, image in imports}
     results = {futures[future]: future.result()
                for future in as_completed(futures)}
 
+# Construct Dokuwiki table
+wikitab = ["^ AWS region  ^ CPU architecture  ^ AMI ID  ^\n"] + list(
+    "| ''%s''  | ''%s''  | ''[[%s|%s]]''  |\n" % (
+        region,
+        architectures[image],
+        launch_link(region, results[(region, image)]),
+        results[(region, image)],
+    ) for region, image in imports)
+if args.wiki:
+    with open(args.wiki, 'wt') as fh:
+        fh.writelines(wikitab)
+
 # Show created images
-for region in args.region:
-    print("%s: %s" % (region, results[region]))
+for region, image in imports:
+    print("%s %s %s %s" % (
+        region, image, architectures[image], results[(region, image)]
+    ))
diff --git a/debian/changelog b/debian/changelog
index e9fe661..1c1aed4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+ipxe (1.21.1+git-20220113.fbbdc3926-0ubuntu1) jammy; urgency=medium
+
+  * Bump code to 1.21.1+git-20220113.fbbdc3926
+  * d/grub-ipxe.install, d/control, d/rules: Build ipxe-arm64.efi
+    (LP: #1890230)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 13 Jan 2022 14:53:40 +0100
+
 ipxe (1.21.1+git-20210429.323af9ee-0ubuntu1) impish; urgency=medium
 
   * Bump code to 1.21.1+git-20210429.323af9ee
diff --git a/debian/control b/debian/control
index fea0238..1d324df 100644
--- a/debian/control
+++ b/debian/control
@@ -9,6 +9,7 @@ Build-Depends:
  dh-exec,
  xorriso, isolinux, syslinux-common, syslinux-utils, dosfstools, mtools,
  binutils-dev, liblzma-dev, zlib1g-dev,
+ gcc-aarch64-linux-gnu,
 Standards-Version: 3.9.6
 Homepage: http://ipxe.org/
 Vcs-Git: https://salsa.debian.org/waldi/ipxe.git
diff --git a/debian/grub-ipxe.install b/debian/grub-ipxe.install
index 7284a31..faac8e1 100644
--- a/debian/grub-ipxe.install
+++ b/debian/grub-ipxe.install
@@ -1,3 +1,4 @@
 debian/tree/ipxe/* .
 src/bin-i386-pcbios/ipxe.lkrn boot
 src/bin-x86_64-efi/ipxe.efi boot
+src/bin-arm64-efi/ipxe-arm64.efi boot
diff --git a/debian/rules b/debian/rules
index d2885cf..d6108cf 100755
--- a/debian/rules
+++ b/debian/rules
@@ -23,7 +23,10 @@ src/bin-i386-pcbios/%.rom src/bin-x86_64-efi/%.efirom: export CONFIG=qemu
 # qemu EFI roms are built without HTTPS, EFI does that on its own (and better)
 src/bin-x86_64-efi/%.efirom: export NOHTTPS=true
 
-src/bin-i386-pcbios/% src/bin-x86_64-efi/%:
+# Note: d/rules Makefile logic can't differentiate src/bin-arm64-efi/ipxe.efi
+# from src/bin-x86_64-efi/ipxe.efi which makes these steps more complex and
+# ugly than they should be.
+src/bin-i386-pcbios/% src/bin-x86_64-efi/% src/bin-arm64-efi/%.efi:
 	# clean and reconfigure if either NOHTTPS or CONFIG=qemu switches
 	if [ "config:$(CONFIG)nohttps:$(NOHTTPS)" != "$(shell cat debian/last-used-config 2>/dev/null)" ]; then \
 	    if [ "$(NOHTTPS)" = "true" ]; then \
@@ -33,8 +36,15 @@ src/bin-i386-pcbios/% src/bin-x86_64-efi/%:
 	    fi; \
 	   echo -n "config:$(CONFIG)" > debian/last-used-config; \
 	   echo -n "nohttps:$(NOHTTPS)" >> debian/last-used-config; \
-	fi;
-	dh_auto_build --sourcedirectory=src -- V=1 NO_WERROR=1 VERSION="$(VERSION)" $(subst src/,,$@)
+	fi; \
+	if [ "$@" = "src/bin-arm64-efi/ipxe-arm64.efi" ]; then \
+		export CROSS=aarch64-linux-gnu-; \
+		export CC=aarch64-linux-gnu-gcc; \
+		dh_auto_build --sourcedirectory=src -- V=1 NO_WERROR=1 VERSION="$(VERSION)" bin-arm64-efi/ipxe.efi; \
+		mv src/bin-arm64-efi/ipxe.efi src/bin-arm64-efi/ipxe-arm64.efi; \
+	else \
+		dh_auto_build --sourcedirectory=src -- V=1 NO_WERROR=1 VERSION="$(VERSION)" $(subst src/,,$@); \
+	fi; \
 
 src/bin-combined/%.efirom: src/bin-i386-pcbios/%.rom src/bin-x86_64-efi/%.efirom
 	@[ -d $(dir $@) ] || mkdir $(dir $@)
diff --git a/src/Makefile b/src/Makefile
index 69139dc..4c4abf1 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -190,7 +190,7 @@ vmware : bin/8086100f.mrom bin/808610d3.mrom bin/10222000.rom bin/15ad07b0.rom
 	@$(ECHO) '    bin/10222000.rom  -- vlance/pcnet32'
 	@$(ECHO) '    bin/15ad07b0.rom  -- vmxnet3'
 	@$(ECHO) 
-	@$(ECHO) 'For more information, see http://ipxe.org/howto/vmware'
+	@$(ECHO) 'For more information, see https://ipxe.org/howto/vmware'
 	@$(ECHO)
 	@$(ECHO) '==========================================================='
 
diff --git a/src/Makefile.efi b/src/Makefile.efi
index 11e29dd..bd479b3 100644
--- a/src/Makefile.efi
+++ b/src/Makefile.efi
@@ -43,7 +43,8 @@ $(BIN)/%.drv.efi : $(BIN)/%.efidrv
 
 $(BIN)/%.efirom : $(BIN)/%.efidrv $(EFIROM)
 	$(QM)$(ECHO) "  [FINISH] $@"
-	$(Q)$(EFIROM) -v $(TGT_PCI_VENDOR) -d $(TGT_PCI_DEVICE) -c $< $@
+	$(Q)$(EFIROM) -v $(firstword $(TGT_PCI_VENDOR) 0) \
+		      -d $(firstword $(TGT_PCI_DEVICE) 0) -c $< $@
 
 $(BIN)/efidrv.cab : $(BIN)/alldrv.efis # $(ALL_drv.efi) is not yet defined
 	$(QM)$(ECHO) "  [CAB] $@"
diff --git a/src/Makefile.housekeeping b/src/Makefile.housekeeping
index e017c65..24ed5d1 100644
--- a/src/Makefile.housekeeping
+++ b/src/Makefile.housekeeping
@@ -918,7 +918,7 @@ $(BIN)/deps/%.d : % $(MAKEDEPS)
 
 # Calculate list of dependency files
 #
-AUTO_DEPS	= $(patsubst %,$(BIN)/deps/%.d,$(AUTO_SRCS))
+AUTO_DEPS	= $(patsubst %,$(BIN)/deps/%.d,$(AUTO_SRCS) core/version.c)
 autodeps :
 	@$(ECHO) $(AUTO_DEPS)
 VERYCLEANUP	+= $(BIN)/deps
@@ -1167,7 +1167,8 @@ $(BLIB) : $(BLIB_OBJS) $(BLIB_LIST) $(MAKEDEPS)
 	$(Q)$(RM) $(BLIB)
 	$(QM)$(ECHO) "  [AR] $@"
 	$(Q)$(AR) rD $@ $(sort $(BLIB_OBJS))
-	$(Q)$(OBJCOPY) --prefix-symbols=$(SYMBOL_PREFIX) $@
+	$(Q)$(OBJCOPY) --enable-deterministic-archives \
+		       --prefix-symbols=$(SYMBOL_PREFIX) $@
 	$(Q)$(RANLIB) -D $@
 blib : $(BLIB)
 
@@ -1201,7 +1202,7 @@ endif
 # Build version
 #
 GIT_INDEX := $(if $(GITVERSION),$(if $(wildcard ../.git/index),../.git/index))
-$(BIN)/version.%.o : core/version.c $(MAKEDEPS) $(GIT_INDEX)
+$(BIN)/version.%.o : core/version.c $(MAKEDEPS) $(version_DEPS) $(GIT_INDEX)
 	$(QM)$(ECHO) "  [VERSION] $@"
 	$(Q)$(COMPILE_c) -DBUILD_NAME="\"$*\"" \
 		-DVERSION_MAJOR=$(VERSION_MAJOR) \
diff --git a/src/arch/x86/core/x86_bigint.c b/src/arch/x86/core/x86_bigint.c
index 6413b2f..9a25bda 100644
--- a/src/arch/x86/core/x86_bigint.c
+++ b/src/arch/x86/core/x86_bigint.c
@@ -75,17 +75,18 @@ void bigint_multiply_raw ( const uint32_t *multiplicand0,
 			 *
 			 *     a < 2^{n}, b < 2^{n} => ab < 2^{2n}
 			 */
-			__asm__ __volatile__ ( "mull %4\n\t"
-					       "addl %%eax, (%5,%2,4)\n\t"
-					       "adcl %%edx, 4(%5,%2,4)\n\t"
+			__asm__ __volatile__ ( "mull %5\n\t"
+					       "addl %%eax, (%6,%2,4)\n\t"
+					       "adcl %%edx, 4(%6,%2,4)\n\t"
 					       "\n1:\n\t"
-					       "adcl $0, 8(%5,%2,4)\n\t"
+					       "adcl $0, 8(%6,%2,4)\n\t"
 					       "inc %2\n\t"
 						       /* Does not affect CF */
 					       "jc 1b\n\t"
 					       : "=&a" ( discard_a ),
 						 "=&d" ( discard_d ),
-						 "=&r" ( index )
+						 "=&r" ( index ),
+						 "+m" ( *result )
 					       : "0" ( multiplicand_element ),
 						 "g" ( multiplier_element ),
 						 "r" ( result_elements ),
diff --git a/src/arch/x86/drivers/net/undinet.c b/src/arch/x86/drivers/net/undinet.c
index 9b7d6d8..43cb18b 100644
--- a/src/arch/x86/drivers/net/undinet.c
+++ b/src/arch/x86/drivers/net/undinet.c
@@ -104,6 +104,13 @@ static union u_PXENV_ANY __bss16 ( undinet_params );
 SEGOFF16_t __bss16 ( undinet_entry_point );
 #define undinet_entry_point __use_data16 ( undinet_entry_point )
 
+/* Read TSC in real mode only when profiling */
+#if PROFILING
+#define RDTSC_IF_PROFILING "rdtsc\n\t"
+#else
+#define RDTSC_IF_PROFILING ""
+#endif
+
 /** IRQ profiler */
 static struct profiler undinet_irq_profiler __profiler =
 	{ .name = "undinet.irq" };
@@ -288,14 +295,14 @@ static int undinet_call ( struct undi_nic *undinic, unsigned int function,
 	 */
 	profile_start ( &profiler->total );
 	__asm__ __volatile__ ( REAL_CODE ( "pushl %%ebp\n\t" /* gcc bug */
-					   "rdtsc\n\t"
+					   RDTSC_IF_PROFILING
 					   "pushl %%eax\n\t"
 					   "pushw %%es\n\t"
 					   "pushw %%di\n\t"
 					   "pushw %%bx\n\t"
 					   "lcall *undinet_entry_point\n\t"
 					   "movw %%ax, %%bx\n\t"
-					   "rdtsc\n\t"
+					   RDTSC_IF_PROFILING
 					   "addw $6, %%sp\n\t"
 					   "popl %%edx\n\t"
 					   "popl %%ebp\n\t" /* gcc bug */ )
diff --git a/src/arch/x86/image/bzimage.c b/src/arch/x86/image/bzimage.c
index 51498bf..a782127 100644
--- a/src/arch/x86/image/bzimage.c
+++ b/src/arch/x86/image/bzimage.c
@@ -327,32 +327,6 @@ static void bzimage_set_cmdline ( struct image *image,
 }
 
 /**
- * Parse standalone image command line for cpio parameters
- *
- * @v image		bzImage file
- * @v cpio		CPIO header
- * @v cmdline		Command line
- */
-static void bzimage_parse_cpio_cmdline ( struct image *image,
-					 struct cpio_header *cpio,
-					 const char *cmdline ) {
-	char *arg;
-	char *end;
-	unsigned int mode;
-
-	/* Look for "mode=" */
-	if ( ( arg = strstr ( cmdline, "mode=" ) ) ) {
-		arg += 5;
-		mode = strtoul ( arg, &end, 8 /* Octal for file mode */ );
-		if ( *end && ( *end != ' ' ) ) {
-			DBGC ( image, "bzImage %p strange \"mode=\""
-			       "terminator '%c'\n", image, *end );
-		}
-		cpio_set_field ( cpio->c_mode, ( 0100000 | mode ) );
-	}
-}
-
-/**
  * Align initrd length
  *
  * @v len		Length
@@ -374,11 +348,9 @@ static inline size_t bzimage_align ( size_t len ) {
 static size_t bzimage_load_initrd ( struct image *image,
 				    struct image *initrd,
 				    userptr_t address ) {
-	char *filename = initrd->cmdline;
-	char *cmdline;
+	const char *filename = cpio_name ( initrd );
 	struct cpio_header cpio;
 	size_t offset;
-	size_t name_len;
 	size_t pad_len;
 
 	/* Do not include kernel image itself as an initrd */
@@ -386,25 +358,7 @@ static size_t bzimage_load_initrd ( struct image *image,
 		return 0;
 
 	/* Create cpio header for non-prebuilt images */
-	if ( filename && filename[0] ) {
-		cmdline = strchr ( filename, ' ' );
-		name_len = ( ( cmdline ? ( ( size_t ) ( cmdline - filename ) )
-			       : strlen ( filename ) ) + 1 /* NUL */ );
-		memset ( &cpio, '0', sizeof ( cpio ) );
-		memcpy ( cpio.c_magic, CPIO_MAGIC, sizeof ( cpio.c_magic ) );
-		cpio_set_field ( cpio.c_mode, 0100644 );
-		cpio_set_field ( cpio.c_nlink, 1 );
-		cpio_set_field ( cpio.c_filesize, initrd->len );
-		cpio_set_field ( cpio.c_namesize, name_len );
-		if ( cmdline ) {
-			bzimage_parse_cpio_cmdline ( image, &cpio,
-						     ( cmdline + 1 /* ' ' */ ));
-		}
-		offset = ( ( sizeof ( cpio ) + name_len + 0x03 ) & ~0x03 );
-	} else {
-		offset = 0;
-		name_len = 0;
-	}
+	offset = cpio_header ( initrd, &cpio );
 
 	/* Copy in initrd image body (and cpio header if applicable) */
 	if ( address ) {
@@ -413,7 +367,7 @@ static size_t bzimage_load_initrd ( struct image *image,
 			memset_user ( address, 0, 0, offset );
 			copy_to_user ( address, 0, &cpio, sizeof ( cpio ) );
 			copy_to_user ( address, sizeof ( cpio ), filename,
-				       ( name_len - 1 /* NUL (or space) */ ) );
+				       cpio_name_len ( initrd ) );
 		}
 		DBGC ( image, "bzImage %p initrd %p [%#08lx,%#08lx,%#08lx)"
 		       "%s%s\n", image, initrd, user_to_phys ( address, 0 ),
diff --git a/src/arch/x86/image/initrd.c b/src/arch/x86/image/initrd.c
index 49b959a..d7b1f57 100644
--- a/src/arch/x86/image/initrd.c
+++ b/src/arch/x86/image/initrd.c
@@ -29,6 +29,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <ipxe/uaccess.h>
 #include <ipxe/init.h>
 #include <ipxe/memblock.h>
+#include <ipxe/cpio.h>
 
 /** @file
  *
diff --git a/src/arch/x86/include/bits/bigint.h b/src/arch/x86/include/bits/bigint.h
index 4f1bc87..7443d6f 100644
--- a/src/arch/x86/include/bits/bigint.h
+++ b/src/arch/x86/include/bits/bigint.h
@@ -25,19 +25,22 @@ typedef uint32_t bigint_element_t;
 static inline __attribute__ (( always_inline )) void
 bigint_init_raw ( uint32_t *value0, unsigned int size,
 		  const void *data, size_t len ) {
-	long pad_len = ( sizeof ( bigint_t ( size ) ) - len );
+	bigint_t ( size ) __attribute__ (( may_alias )) *value =
+		( ( void * ) value0 );
+	long pad_len = ( sizeof ( *value ) - len );
 	void *discard_D;
 	long discard_c;
 
 	/* Copy raw data in reverse order, padding with zeros */
 	__asm__ __volatile__ ( "\n1:\n\t"
-			       "movb -1(%2,%1), %%al\n\t"
+			       "movb -1(%3,%1), %%al\n\t"
 			       "stosb\n\t"
 			       "loop 1b\n\t"
 			       "xorl %%eax, %%eax\n\t"
-			       "mov %3, %1\n\t"
+			       "mov %4, %1\n\t"
 			       "rep stosb\n\t"
-			       : "=&D" ( discard_D ), "=&c" ( discard_c )
+			       : "=&D" ( discard_D ), "=&c" ( discard_c ),
+				 "+m" ( *value )
 			       : "r" ( data ), "g" ( pad_len ), "0" ( value0 ),
 				 "1" ( len )
 			       : "eax" );
@@ -53,6 +56,8 @@ bigint_init_raw ( uint32_t *value0, unsigned int size,
 static inline __attribute__ (( always_inline )) void
 bigint_add_raw ( const uint32_t *addend0, uint32_t *value0,
 		 unsigned int size ) {
+	bigint_t ( size ) __attribute__ (( may_alias )) *value =
+		( ( void * ) value0 );
 	long index;
 	void *discard_S;
 	long discard_c;
@@ -60,11 +65,11 @@ bigint_add_raw ( const uint32_t *addend0, uint32_t *value0,
 	__asm__ __volatile__ ( "xor %0, %0\n\t" /* Zero %0 and clear CF */
 			       "\n1:\n\t"
 			       "lodsl\n\t"
-			       "adcl %%eax, (%3,%0,4)\n\t"
+			       "adcl %%eax, (%4,%0,4)\n\t"
 			       "inc %0\n\t" /* Does not affect CF */
 			       "loop 1b\n\t"
 			       : "=&r" ( index ), "=&S" ( discard_S ),
-				 "=&c" ( discard_c )
+				 "=&c" ( discard_c ), "+m" ( *value )
 			       : "r" ( value0 ), "1" ( addend0 ), "2" ( size )
 			       : "eax" );
 }
@@ -79,6 +84,8 @@ bigint_add_raw ( const uint32_t *addend0, uint32_t *value0,
 static inline __attribute__ (( always_inline )) void
 bigint_subtract_raw ( const uint32_t *subtrahend0, uint32_t *value0,
 		      unsigned int size ) {
+	bigint_t ( size ) __attribute__ (( may_alias )) *value =
+		( ( void * ) value0 );
 	long index;
 	void *discard_S;
 	long discard_c;
@@ -86,11 +93,11 @@ bigint_subtract_raw ( const uint32_t *subtrahend0, uint32_t *value0,
 	__asm__ __volatile__ ( "xor %0, %0\n\t" /* Zero %0 and clear CF */
 			       "\n1:\n\t"
 			       "lodsl\n\t"
-			       "sbbl %%eax, (%3,%0,4)\n\t"
+			       "sbbl %%eax, (%4,%0,4)\n\t"
 			       "inc %0\n\t" /* Does not affect CF */
 			       "loop 1b\n\t"
 			       : "=&r" ( index ), "=&S" ( discard_S ),
-				 "=&c" ( discard_c )
+				 "=&c" ( discard_c ), "+m" ( *value )
 			       : "r" ( value0 ), "1" ( subtrahend0 ),
 				 "2" ( size )
 			       : "eax" );
@@ -104,15 +111,18 @@ bigint_subtract_raw ( const uint32_t *subtrahend0, uint32_t *value0,
  */
 static inline __attribute__ (( always_inline )) void
 bigint_rol_raw ( uint32_t *value0, unsigned int size ) {
+	bigint_t ( size ) __attribute__ (( may_alias )) *value =
+		( ( void * ) value0 );
 	long index;
 	long discard_c;
 
 	__asm__ __volatile__ ( "xor %0, %0\n\t" /* Zero %0 and clear CF */
 			       "\n1:\n\t"
-			       "rcll $1, (%2,%0,4)\n\t"
+			       "rcll $1, (%3,%0,4)\n\t"
 			       "inc %0\n\t" /* Does not affect CF */
 			       "loop 1b\n\t"
-			       : "=&r" ( index ), "=&c" ( discard_c )
+			       : "=&r" ( index ), "=&c" ( discard_c ),
+				 "+m" ( *value )
 			       : "r" ( value0 ), "1" ( size ) );
 }
 
@@ -124,13 +134,15 @@ bigint_rol_raw ( uint32_t *value0, unsigned int size ) {
  */
 static inline __attribute__ (( always_inline )) void
 bigint_ror_raw ( uint32_t *value0, unsigned int size ) {
+	bigint_t ( size ) __attribute__ (( may_alias )) *value =
+		( ( void * ) value0 );
 	long discard_c;
 
 	__asm__ __volatile__ ( "clc\n\t"
 			       "\n1:\n\t"
-			       "rcrl $1, -4(%1,%0,4)\n\t"
+			       "rcrl $1, -4(%2,%0,4)\n\t"
 			       "loop 1b\n\t"
-			       : "=&c" ( discard_c )
+			       : "=&c" ( discard_c ), "+m" ( *value )
 			       : "r" ( value0 ), "0" ( size ) );
 }
 
@@ -239,6 +251,8 @@ bigint_max_set_bit_raw ( const uint32_t *value0, unsigned int size ) {
 static inline __attribute__ (( always_inline )) void
 bigint_grow_raw ( const uint32_t *source0, unsigned int source_size,
 		  uint32_t *dest0, unsigned int dest_size ) {
+	bigint_t ( dest_size ) __attribute__ (( may_alias )) *dest =
+		( ( void * ) dest0 );
 	long pad_size = ( dest_size - source_size );
 	void *discard_D;
 	void *discard_S;
@@ -246,10 +260,10 @@ bigint_grow_raw ( const uint32_t *source0, unsigned int source_size,
 
 	__asm__ __volatile__ ( "rep movsl\n\t"
 			       "xorl %%eax, %%eax\n\t"
-			       "mov %3, %2\n\t"
+			       "mov %4, %2\n\t"
 			       "rep stosl\n\t"
 			       : "=&D" ( discard_D ), "=&S" ( discard_S ),
-				 "=&c" ( discard_c )
+				 "=&c" ( discard_c ), "+m" ( *dest )
 			       : "g" ( pad_size ), "0" ( dest0 ),
 				 "1" ( source0 ), "2" ( source_size )
 			       : "eax" );
@@ -266,13 +280,15 @@ bigint_grow_raw ( const uint32_t *source0, unsigned int source_size,
 static inline __attribute__ (( always_inline )) void
 bigint_shrink_raw ( const uint32_t *source0, unsigned int source_size __unused,
 		    uint32_t *dest0, unsigned int dest_size ) {
+	bigint_t ( dest_size ) __attribute__ (( may_alias )) *dest =
+		( ( void * ) dest0 );
 	void *discard_D;
 	void *discard_S;
 	long discard_c;
 
 	__asm__ __volatile__ ( "rep movsl\n\t"
 			       : "=&D" ( discard_D ), "=&S" ( discard_S ),
-				 "=&c" ( discard_c )
+				 "=&c" ( discard_c ), "+m" ( *dest )
 			       : "0" ( dest0 ), "1" ( source0 ),
 				 "2" ( dest_size )
 			       : "eax" );
@@ -289,15 +305,19 @@ bigint_shrink_raw ( const uint32_t *source0, unsigned int source_size __unused,
 static inline __attribute__ (( always_inline )) void
 bigint_done_raw ( const uint32_t *value0, unsigned int size __unused,
 		  void *out, size_t len ) {
+	struct {
+		uint8_t bytes[len];
+	} __attribute__ (( may_alias )) *out_bytes = out;
 	void *discard_D;
 	long discard_c;
 
 	/* Copy raw data in reverse order */
 	__asm__ __volatile__ ( "\n1:\n\t"
-			       "movb -1(%2,%1), %%al\n\t"
+			       "movb -1(%3,%1), %%al\n\t"
 			       "stosb\n\t"
 			       "loop 1b\n\t"
-			       : "=&D" ( discard_D ), "=&c" ( discard_c )
+			       : "=&D" ( discard_D ), "=&c" ( discard_c ),
+				 "+m" ( *out_bytes )
 			       : "r" ( value0 ), "0" ( out ), "1" ( len )
 			       : "eax" );
 }
diff --git a/src/arch/x86/include/initrd.h b/src/arch/x86/include/initrd.h
index ddb3e5a..2fb9d3d 100644
--- a/src/arch/x86/include/initrd.h
+++ b/src/arch/x86/include/initrd.h
@@ -11,13 +11,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #include <ipxe/uaccess.h>
 
-/** Minimum alignment for initrds
- *
- * Some versions of Linux complain about initrds that are not
- * page-aligned.
- */
-#define INITRD_ALIGN 4096
-
 /** Minimum free space required to reshuffle initrds
  *
  * Chosen to avoid absurdly long reshuffling times
diff --git a/src/arch/x86/include/ipxe/cpuid.h b/src/arch/x86/include/ipxe/cpuid.h
index b5403bd..3983dfb 100644
--- a/src/arch/x86/include/ipxe/cpuid.h
+++ b/src/arch/x86/include/ipxe/cpuid.h
@@ -42,6 +42,9 @@ struct x86_features {
 /** Hypervisor is present */
 #define CPUID_FEATURES_INTEL_ECX_HYPERVISOR 0x80000000UL
 
+/** TSC is present */
+#define CPUID_FEATURES_INTEL_EDX_TSC 0x00000010UL
+
 /** FXSAVE and FXRSTOR are supported */
 #define CPUID_FEATURES_INTEL_EDX_FXSR 0x01000000UL
 
diff --git a/src/arch/x86/interface/pcbios/acpipwr.c b/src/arch/x86/interface/pcbios/acpipwr.c
index dc164c7..3dac6b6 100644
--- a/src/arch/x86/interface/pcbios/acpipwr.c
+++ b/src/arch/x86/interface/pcbios/acpipwr.c
@@ -43,6 +43,69 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define S5_SIGNATURE ACPI_SIGNATURE ( '_', 'S', '5', '_' )
 
 /**
+ * Extract \_Sx value from DSDT/SSDT
+ *
+ * @v zsdt		DSDT or SSDT
+ * @v len		Length of DSDT/SSDT
+ * @v offset		Offset of signature within DSDT/SSDT
+ * @v data		Data buffer
+ * @ret rc		Return status code
+ *
+ * In theory, extracting the \_Sx value from the DSDT/SSDT requires a
+ * full ACPI parser plus some heuristics to work around the various
+ * broken encodings encountered in real ACPI implementations.
+ *
+ * In practice, we can get the same result by scanning through the
+ * DSDT/SSDT for the signature (e.g. "_S5_"), extracting the first
+ * four bytes, removing any bytes with bit 3 set, and treating
+ * whatever is left as a little-endian value.  This is one of the
+ * uglier hacks I have ever implemented, but it's still prettier than
+ * the ACPI specification itself.
+ */
+static int acpi_extract_sx ( userptr_t zsdt, size_t len, size_t offset,
+			     void *data ) {
+	unsigned int *sx = data;
+	uint8_t bytes[4];
+	uint8_t *byte;
+
+	/* Skip signature and package header */
+	offset += ( 4 /* signature */ + 3 /* package header */ );
+
+	/* Sanity check */
+	if ( ( offset + sizeof ( bytes ) /* value */ ) > len ) {
+		return -EINVAL;
+	}
+
+	/* Read first four bytes of value */
+	copy_from_user ( bytes, zsdt, offset, sizeof ( bytes ) );
+	DBGC ( colour, "ACPI found \\_Sx containing %02x:%02x:%02x:%02x\n",
+	       bytes[0], bytes[1], bytes[2], bytes[3] );
+
+	/* Extract \Sx value.  There are three potential encodings
+	 * that we might encounter:
+	 *
+	 * - SLP_TYPa, SLP_TYPb, rsvd, rsvd
+	 *
+	 * - <byteprefix>, SLP_TYPa, <byteprefix>, SLP_TYPb, ...
+	 *
+	 * - <dwordprefix>, SLP_TYPa, SLP_TYPb, 0, 0
+	 *
+	 * Since <byteprefix> and <dwordprefix> both have bit 3 set,
+	 * and valid SLP_TYPx must have bit 3 clear (since SLP_TYPx is
+	 * a 3-bit field), we can just skip any bytes with bit 3 set.
+	 */
+	byte = bytes;
+	if ( *byte & 0x08 )
+		byte++;
+	*sx = *(byte++);
+	if ( *byte & 0x08 )
+		byte++;
+	*sx |= ( *byte << 8 );
+
+	return 0;
+}
+
+/**
  * Power off the computer using ACPI
  *
  * @ret rc		Return status code
@@ -56,7 +119,7 @@ int acpi_poweroff ( void ) {
 	unsigned int pm1b_cnt;
 	unsigned int slp_typa;
 	unsigned int slp_typb;
-	int s5;
+	unsigned int s5;
 	int rc;
 
 	/* Locate FADT */
@@ -74,9 +137,8 @@ int acpi_poweroff ( void ) {
 	pm1b_cnt = ( pm1b_cnt_blk + ACPI_PM1_CNT );
 
 	/* Extract \_S5 from DSDT or any SSDT */
-	s5 = acpi_sx ( S5_SIGNATURE );
-	if ( s5 < 0 ) {
-		rc = s5;
+	if ( ( rc = acpi_extract ( S5_SIGNATURE, &s5,
+				   acpi_extract_sx ) ) != 0 ) {
 		DBGC ( colour, "ACPI could not extract \\_S5: %s\n",
 		       strerror ( rc ) );
 		return rc;
diff --git a/src/arch/x86/interface/pcbios/bios_cachedhcp.c b/src/arch/x86/interface/pcbios/bios_cachedhcp.c
index 3d38699..277c40d 100644
--- a/src/arch/x86/interface/pcbios/bios_cachedhcp.c
+++ b/src/arch/x86/interface/pcbios/bios_cachedhcp.c
@@ -59,7 +59,8 @@ static void cachedhcp_init ( void ) {
 	}
 
 	/* Record cached DHCPACK */
-	if ( ( rc = cachedhcp_record ( phys_to_user ( cached_dhcpack_phys ),
+	if ( ( rc = cachedhcp_record ( &cached_dhcpack,
+				       phys_to_user ( cached_dhcpack_phys ),
 				       sizeof ( BOOTPLAYER_t ) ) ) != 0 ) {
 		DBGC ( colour, "CACHEDHCP could not record DHCPACK: %s\n",
 		       strerror ( rc ) );
diff --git a/src/arch/x86/interface/pcbios/rtc_entropy.c b/src/arch/x86/interface/pcbios/rtc_entropy.c
index e9e6baa..e0c1756 100644
--- a/src/arch/x86/interface/pcbios/rtc_entropy.c
+++ b/src/arch/x86/interface/pcbios/rtc_entropy.c
@@ -36,6 +36,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <biosint.h>
 #include <pic8259.h>
 #include <rtc.h>
+#include <ipxe/cpuid.h>
 #include <ipxe/entropy.h>
 
 /** Maximum time to wait for an RTC interrupt, in milliseconds */
@@ -174,8 +175,17 @@ static int rtc_entropy_check ( void ) {
  * @ret rc		Return status code
  */
 static int rtc_entropy_enable ( void ) {
+	struct x86_features features;
 	int rc;
 
+	/* Check that TSC is supported */
+	x86_features ( &features );
+	if ( ! ( features.intel.edx & CPUID_FEATURES_INTEL_EDX_TSC ) ) {
+		DBGC ( &rtc_flag, "RTC has no TSC\n" );
+		rc = -ENOTSUP;
+		goto err_no_tsc;
+	}
+
 	/* Hook ISR and enable RTC interrupts */
 	rtc_hook_isr();
 	enable_irq ( RTC_IRQ );
@@ -191,6 +201,7 @@ static int rtc_entropy_enable ( void ) {
 	rtc_disable_int();
 	disable_irq ( RTC_IRQ );
 	rtc_unhook_isr();
+ err_no_tsc:
 	return rc;
 }
 
diff --git a/src/arch/x86/interface/syslinux/comboot_call.c b/src/arch/x86/interface/syslinux/comboot_call.c
index dc308da..b75e8ef 100644
--- a/src/arch/x86/interface/syslinux/comboot_call.c
+++ b/src/arch/x86/interface/syslinux/comboot_call.c
@@ -47,7 +47,7 @@ static char __bss16_array ( syslinux_version, [32] );
 #define syslinux_version __use_data16 ( syslinux_version )
 
 /** The "SYSLINUX" copyright string */
-static char __data16_array ( syslinux_copyright, [] ) = " http://ipxe.org";
+static char __data16_array ( syslinux_copyright, [] ) = " https://ipxe.org";
 #define syslinux_copyright __use_data16 ( syslinux_copyright )
 
 static char __data16_array ( syslinux_configuration_file, [] ) = "";
diff --git a/src/arch/x86/prefix/romprefix.S b/src/arch/x86/prefix/romprefix.S
index a9934a7..4e8793c 100644
--- a/src/arch/x86/prefix/romprefix.S
+++ b/src/arch/x86/prefix/romprefix.S
@@ -161,7 +161,7 @@ pnpheader:
 
 /* Manufacturer string */
 mfgstr:
-	.asciz	"http://ipxe.org"
+	.asciz	"https://ipxe.org"
 	.size mfgstr, . - mfgstr
 
 /* Product string
@@ -607,7 +607,7 @@ get_pmm_decompress_to:
  * strings PRODUCT_NAME and PRODUCT_SHORT_NAME in config/branding.h.
  *
  * While nothing in the GPL prevents you from removing all references
- * to iPXE or http://ipxe.org, we prefer you not to do so.
+ * to iPXE or https://ipxe.org, we prefer you not to do so.
  *
  * If you have an OEM-mandated branding requirement that cannot be
  * satisfied simply by defining PRODUCT_NAME and PRODUCT_SHORT_NAME,
diff --git a/src/arch/x86/prefix/unlzma.S b/src/arch/x86/prefix/unlzma.S
index 956eeb2..979f699 100644
--- a/src/arch/x86/prefix/unlzma.S
+++ b/src/arch/x86/prefix/unlzma.S
@@ -44,7 +44,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 
 	.text
-	.arch i586
+	.arch i486
 	.section ".prefix.lib", "ax", @progbits
 
 #ifdef CODE16
diff --git a/src/config/branding.h b/src/config/branding.h
index 73f00af..e503dff 100644
--- a/src/config/branding.h
+++ b/src/config/branding.h
@@ -26,7 +26,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 #define PRODUCT_NAME ""
 #define PRODUCT_SHORT_NAME "iPXE"
-#define PRODUCT_URI "http://ipxe.org"
+#define PRODUCT_URI "https://ipxe.org"
 
 /*
  * Tag line
@@ -44,15 +44,15 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  * (e.g. "Permission denied") and a 32-bit error number.  This number
  * is incorporated into an error URI such as
  *
- *   "No such file or directory (http://ipxe.org/2d0c613b)"
+ *   "No such file or directory (https://ipxe.org/2d0c613b)"
  *
  * or
  *
- *   "Operation not supported (http://ipxe.org/3c092003)"
+ *   "Operation not supported (https://ipxe.org/3c092003)"
  *
  * Users may browse to the URI within the error message, which is
  * provided by a database running on the iPXE web site
- * (http://ipxe.org).  This database provides details for all possible
+ * (https://ipxe.org).  This database provides details for all possible
  * errors generated by iPXE, including:
  *
  * - the detailed error message (e.g. "Not an OCSP signing
@@ -74,13 +74,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  * If you have a customer support team and would like your customers
  * to contact your support team for all problems, instead of using the
- * existing support infrastructure provided by http://ipxe.org, then
+ * existing support infrastructure provided by https://ipxe.org, then
  * you may define a custom URI to be included within error messages.
  *
  * Note that the custom URI is a printf() format string which must
  * include a format specifier for the 32-bit error number.
  */
-#define PRODUCT_ERROR_URI "http://ipxe.org/%08x"
+#define PRODUCT_ERROR_URI "https://ipxe.org/%08x"
 
 /*
  * Command help messages
@@ -88,7 +88,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  * iPXE command help messages include a URI constructed from the
  * command name, such as
  *
- *   "See http://ipxe.org/cmd/vcreate for further information"
+ *   "See https://ipxe.org/cmd/vcreate for further information"
  *
  * The iPXE web site includes documentation for the commands provided
  * by the iPXE shell, including:
@@ -113,7 +113,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  * If you want to provide your own documentation for all of the
  * commands provided by the iPXE shell, rather than using the existing
- * support infrastructure provided by http://ipxe.org, then you may
+ * support infrastructure provided by https://ipxe.org, then you may
  * define a custom URI to be included within command help messages.
  *
  * Note that the custom URI is a printf() format string which must
@@ -124,7 +124,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *   iPXE project and prohibit the alteration or removal of any
  *   references to "iPXE". ]
  */
-#define PRODUCT_COMMAND_URI "http://ipxe.org/cmd/%s"
+#define PRODUCT_COMMAND_URI "https://ipxe.org/cmd/%s"
 
 /*
  * Setting help messages
@@ -132,7 +132,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  * iPXE setting help messages include a URI constructed from the
  * setting name, such as
  *
- *   "http://ipxe.org/cfg/initiator-iqn"
+ *   "https://ipxe.org/cfg/initiator-iqn"
  *
  * The iPXE web site includes documentation for the settings used by
  * iPXE, including:
@@ -156,7 +156,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  * If you want to provide your own documentation for all of the
  * settings used by iPXE, rather than using the existing support
- * infrastructure provided by http://ipxe.org, then you may define a
+ * infrastructure provided by https://ipxe.org, then you may define a
  * custom URI to be included within setting help messages.
  *
  * Note that the custom URI is a printf() format string which must
@@ -167,7 +167,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *   iPXE project and prohibit the alteration or removal of any
  *   references to "iPXE". ]
  */
-#define PRODUCT_SETTING_URI "http://ipxe.org/cfg/%s"
+#define PRODUCT_SETTING_URI "https://ipxe.org/cfg/%s"
 
 #include <config/local/branding.h>
 
diff --git a/src/config/cloud/aws.ipxe b/src/config/cloud/aws.ipxe
index 2c96e38..6c00739 100644
--- a/src/config/cloud/aws.ipxe
+++ b/src/config/cloud/aws.ipxe
@@ -3,6 +3,22 @@
 echo Amazon EC2 - iPXE boot via user-data
 echo CPU: ${cpuvendor} ${cpumodel}
 ifstat ||
-dhcp ||
+
+set attempt:int8 1
+:dhcp_retry
+echo DHCP attempt ${attempt}
+dhcp --timeout 5000 && goto dhcp_ok ||
+ifstat ||
+inc attempt
+iseq ${attempt} 10 || goto dhcp_retry
+
+:dhcp_fail
+echo DHCP failed - rebooting
+reboot ||
+exit
+
+:dhcp_ok
 route ||
-chain -ar http://169.254.169.254/latest/user-data
+chain -ar http://169.254.169.254/latest/user-data ||
+ifstat ||
+exit
diff --git a/src/config/cloud/gce.ipxe b/src/config/cloud/gce.ipxe
index 88e12b5..65e2e57 100644
--- a/src/config/cloud/gce.ipxe
+++ b/src/config/cloud/gce.ipxe
@@ -5,4 +5,5 @@ echo CPU: ${cpuvendor} ${cpumodel}
 ifstat ||
 dhcp ||
 route ||
-chain -ar http://metadata.google.internal/computeMetadata/v1/instance/attributes/ipxeboot
+chain -ar http://metadata.google.internal/computeMetadata/v1/instance/attributes/ipxeboot ||
+ifstat ||
diff --git a/src/config/cloud/settings.h b/src/config/cloud/settings.h
index 34deeb0..c9d6bdc 100644
--- a/src/config/cloud/settings.h
+++ b/src/config/cloud/settings.h
@@ -1,4 +1,6 @@
 /* It can often be useful to know the CPU on which a cloud instance is
  * running (e.g. to isolate problems with Azure AMD instances).
  */
+#if defined ( __i386__ ) || defined ( __x86_64__ )
 #define CPUID_SETTINGS
+#endif
diff --git a/src/config/config.c b/src/config/config.c
index 5e7a3ec..a818661 100644
--- a/src/config/config.c
+++ b/src/config/config.c
@@ -182,6 +182,12 @@ REQUIRE_OBJECT ( efi_image );
 #ifdef IMAGE_SDI
 REQUIRE_OBJECT ( sdi );
 #endif
+#ifdef IMAGE_ZLIB
+REQUIRE_OBJECT ( zlib );
+#endif
+#ifdef IMAGE_GZIP
+REQUIRE_OBJECT ( gzip );
+#endif
 
 /*
  * Drag in all requested commands
diff --git a/src/config/config_archive.c b/src/config/config_archive.c
new file mode 100644
index 0000000..746fc7e
--- /dev/null
+++ b/src/config/config_archive.c
@@ -0,0 +1,36 @@
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <config/general.h>
+
+/** @file
+ *
+ * Archive image configuration
+ *
+ */
+
+PROVIDE_REQUIRING_SYMBOL();
+
+#ifdef IMAGE_ARCHIVE_CMD
+REQUIRE_OBJECT ( image_archive_cmd );
+#endif
diff --git a/src/config/general.h b/src/config/general.h
index 9b21f12..2d15f50 100644
--- a/src/config/general.h
+++ b/src/config/general.h
@@ -117,6 +117,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define	IMAGE_PNG		/* PNG image support */
 #define	IMAGE_DER		/* DER image support */
 #define	IMAGE_PEM		/* PEM image support */
+//#define	IMAGE_ZLIB		/* ZLIB image support */
+//#define	IMAGE_GZIP		/* GZIP image support */
 
 /*
  * Command-line commands to include
@@ -156,6 +158,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 //#define NTP_CMD		/* NTP commands */
 //#define CERT_CMD		/* Certificate management commands */
 //#define IMAGE_MEM_CMD		/* Read memory command */
+#define IMAGE_ARCHIVE_CMD	/* Archive image management commands */
 
 /*
  * ROM-specific options
diff --git a/src/core/acpi.c b/src/core/acpi.c
index 52eb63a..aa486da 100644
--- a/src/core/acpi.c
+++ b/src/core/acpi.c
@@ -169,33 +169,22 @@ userptr_t acpi_find_via_rsdt ( uint32_t signature, unsigned int index ) {
 }
 
 /**
- * Extract \_Sx value from DSDT/SSDT
+ * Extract value from DSDT/SSDT
  *
  * @v zsdt		DSDT or SSDT
  * @v signature		Signature (e.g. "_S5_")
- * @ret sx		\_Sx value, or negative error
- *
- * In theory, extracting the \_Sx value from the DSDT/SSDT requires a
- * full ACPI parser plus some heuristics to work around the various
- * broken encodings encountered in real ACPI implementations.
- *
- * In practice, we can get the same result by scanning through the
- * DSDT/SSDT for the signature (e.g. "_S5_"), extracting the first
- * four bytes, removing any bytes with bit 3 set, and treating
- * whatever is left as a little-endian value.  This is one of the
- * uglier hacks I have ever implemented, but it's still prettier than
- * the ACPI specification itself.
+ * @v data		Data buffer
+ * @v extract		Extraction method
+ * @ret rc		Return status code
  */
-static int acpi_sx_zsdt ( userptr_t zsdt, uint32_t signature ) {
+static int acpi_zsdt ( userptr_t zsdt, uint32_t signature, void *data,
+		       int ( * extract ) ( userptr_t zsdt, size_t len,
+					   size_t offset, void *data ) ) {
 	struct acpi_header acpi;
-	union {
-		uint32_t dword;
-		uint8_t byte[4];
-	} buf;
+	uint32_t buf;
 	size_t offset;
 	size_t len;
-	unsigned int sx;
-	uint8_t *byte;
+	int rc;
 
 	/* Read table header */
 	copy_from_user ( &acpi, zsdt, 0, sizeof ( acpi ) );
@@ -203,75 +192,51 @@ static int acpi_sx_zsdt ( userptr_t zsdt, uint32_t signature ) {
 
 	/* Locate signature */
 	for ( offset = sizeof ( acpi ) ;
-	      ( ( offset + sizeof ( buf ) /* signature */ + 3 /* pkg header */
-		  + sizeof ( buf ) /* value */ ) < len ) ;
+	      ( ( offset + sizeof ( buf ) /* signature */ ) < len ) ;
 	      offset++ ) {
 
 		/* Check signature */
 		copy_from_user ( &buf, zsdt, offset, sizeof ( buf ) );
-		if ( buf.dword != cpu_to_le32 ( signature ) )
+		if ( buf != cpu_to_le32 ( signature ) )
 			continue;
 		DBGC ( zsdt, "DSDT/SSDT %#08lx found %s at offset %#zx\n",
 		       user_to_phys ( zsdt, 0 ), acpi_name ( signature ),
 		       offset );
-		offset += sizeof ( buf );
-
-		/* Read first four bytes of value */
-		copy_from_user ( &buf, zsdt, ( offset + 3 /* pkg header */ ),
-				 sizeof ( buf ) );
-		DBGC ( zsdt, "DSDT/SSDT %#08lx found %s containing "
-		       "%02x:%02x:%02x:%02x\n", user_to_phys ( zsdt, 0 ),
-		       acpi_name ( signature ), buf.byte[0], buf.byte[1],
-		       buf.byte[2], buf.byte[3] );
-
-		/* Extract \Sx value.  There are three potential
-		 * encodings that we might encounter:
-		 *
-		 * - SLP_TYPa, SLP_TYPb, rsvd, rsvd
-		 *
-		 * - <byteprefix>, SLP_TYPa, <byteprefix>, SLP_TYPb, ...
-		 *
-		 * - <dwordprefix>, SLP_TYPa, SLP_TYPb, 0, 0
-		 *
-		 * Since <byteprefix> and <dwordprefix> both have bit
-		 * 3 set, and valid SLP_TYPx must have bit 3 clear
-		 * (since SLP_TYPx is a 3-bit field), we can just skip
-		 * any bytes with bit 3 set.
-		 */
-		byte = &buf.byte[0];
-		if ( *byte & 0x08 )
-			byte++;
-		sx = *(byte++);
-		if ( *byte & 0x08 )
-			byte++;
-		sx |= ( *byte << 8 );
-		return sx;
+
+		/* Attempt to extract data */
+		if ( ( rc = extract ( zsdt, len, offset, data ) ) == 0 )
+			return 0;
 	}
 
 	return -ENOENT;
 }
 
 /**
- * Extract \_Sx value from DSDT/SSDT
+ * Extract value from DSDT/SSDT
  *
  * @v signature		Signature (e.g. "_S5_")
- * @ret sx		\_Sx value, or negative error
+ * @v data		Data buffer
+ * @v extract		Extraction method
+ * @ret rc		Return status code
  */
-int acpi_sx ( uint32_t signature ) {
+int acpi_extract ( uint32_t signature, void *data,
+		   int ( * extract ) ( userptr_t zsdt, size_t len,
+				       size_t offset, void *data ) ) {
 	struct acpi_fadt fadtab;
 	userptr_t fadt;
 	userptr_t dsdt;
 	userptr_t ssdt;
 	unsigned int i;
-	int sx;
+	int rc;
 
 	/* Try DSDT first */
 	fadt = acpi_find ( FADT_SIGNATURE, 0 );
 	if ( fadt ) {
 		copy_from_user ( &fadtab, fadt, 0, sizeof ( fadtab ) );
 		dsdt = phys_to_user ( fadtab.dsdt );
-		if ( ( sx = acpi_sx_zsdt ( dsdt, signature ) ) >= 0 )
-			return sx;
+		if ( ( rc = acpi_zsdt ( dsdt, signature, data,
+					extract ) ) == 0 )
+			return 0;
 	}
 
 	/* Try all SSDTs */
@@ -279,11 +244,12 @@ int acpi_sx ( uint32_t signature ) {
 		ssdt = acpi_find ( SSDT_SIGNATURE, i );
 		if ( ! ssdt )
 			break;
-		if ( ( sx = acpi_sx_zsdt ( ssdt, signature ) ) >= 0 )
-			return sx;
+		if ( ( rc = acpi_zsdt ( ssdt, signature, data,
+					extract ) ) == 0 )
+			return 0;
 	}
 
-	DBGC ( colour, "ACPI could not find \\_Sx \"%s\"\n",
+	DBGC ( colour, "ACPI could not find \"%s\"\n",
 	       acpi_name ( signature ) );
 	return -ENOENT;
 }
diff --git a/src/core/acpimac.c b/src/core/acpimac.c
new file mode 100644
index 0000000..1cc8220
--- /dev/null
+++ b/src/core/acpimac.c
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2021 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <string.h>
+#include <errno.h>
+#include <ipxe/acpi.h>
+#include <ipxe/base16.h>
+#include <ipxe/ethernet.h>
+#include <ipxe/if_ether.h>
+#include <ipxe/acpimac.h>
+
+/** @file
+ *
+ * ACPI MAC address
+ *
+ */
+
+/** Colour for debug messages */
+#define colour FADT_SIGNATURE
+
+/** AMAC signature */
+#define AMAC_SIGNATURE ACPI_SIGNATURE ( 'A', 'M', 'A', 'C' )
+
+/** MACA signature */
+#define MACA_SIGNATURE ACPI_SIGNATURE ( 'M', 'A', 'C', 'A' )
+
+/** Maximum number of bytes to skip after AMAC/MACA signature
+ *
+ * This is entirely empirical.
+ */
+#define AUXMAC_MAX_SKIP 8
+
+/**
+ * Extract MAC address from DSDT/SSDT
+ *
+ * @v zsdt		DSDT or SSDT
+ * @v len		Length of DSDT/SSDT
+ * @v offset		Offset of signature within DSDT/SSDT
+ * @v data		Data buffer
+ * @ret rc		Return status code
+ *
+ * Some vendors provide a "system MAC address" within the DSDT/SSDT,
+ * to be used to override the MAC address for a USB docking station.
+ *
+ * A full implementation would require an ACPI bytecode interpreter,
+ * since at least one OEM allows the MAC address to be constructed by
+ * executable ACPI bytecode (rather than a fixed data structure).
+ *
+ * We instead attempt to extract a plausible-looking "_AUXMAC_#.....#"
+ * string that appears shortly after an "AMAC" or "MACA" signature.
+ * This should work for most implementations encountered in practice.
+ */
+static int acpi_extract_mac ( userptr_t zsdt, size_t len, size_t offset,
+			      void *data ) {
+	static const char prefix[9] = "_AUXMAC_#";
+	uint8_t *hw_addr = data;
+	size_t skip = 0;
+	char auxmac[ sizeof ( prefix ) /* "_AUXMAC_#" */ +
+		     ( ETH_ALEN * 2 ) /* MAC */ + 1 /* "#" */ + 1 /* NUL */ ];
+	char *mac = &auxmac[ sizeof ( prefix ) ];
+	int decoded_len;
+	int rc;
+
+	/* Skip signature and at least one tag byte */
+	offset += ( 4 /* signature */ + 1 /* tag byte */ );
+
+	/* Scan for "_AUXMAC_#.....#" close to signature */
+	for ( skip = 0 ;
+	      ( ( skip < AUXMAC_MAX_SKIP ) &&
+		( offset + skip + sizeof ( auxmac ) ) < len ) ;
+	      skip++ ) {
+
+		/* Read value */
+		copy_from_user ( auxmac, zsdt, ( offset + skip ),
+				 sizeof ( auxmac ) );
+
+		/* Check for expected format */
+		if ( memcmp ( auxmac, prefix, sizeof ( prefix ) ) != 0 )
+			continue;
+		if ( auxmac[ sizeof ( auxmac ) - 2 ] != '#' )
+			continue;
+		if ( auxmac[ sizeof ( auxmac ) - 1 ] != '\0' )
+			continue;
+		DBGC ( colour, "ACPI found MAC string \"%s\"\n", auxmac );
+
+		/* Terminate MAC address string */
+		mac = &auxmac[ sizeof ( prefix ) ];
+		mac[ ETH_ALEN * 2 ] = '\0';
+
+		/* Decode MAC address */
+		decoded_len = base16_decode ( mac, hw_addr, ETH_ALEN );
+		if ( decoded_len < 0 ) {
+			rc = decoded_len;
+			DBGC ( colour, "ACPI could not decode MAC \"%s\": %s\n",
+			       mac, strerror ( rc ) );
+			return rc;
+		}
+
+		/* Check MAC address validity */
+		if ( ! is_valid_ether_addr ( hw_addr ) ) {
+			DBGC ( colour, "ACPI has invalid MAC %s\n",
+			       eth_ntoa ( hw_addr ) );
+			return -EINVAL;
+		}
+
+		return 0;
+	}
+
+	return -ENOENT;
+}
+
+/**
+ * Extract MAC address from DSDT/SSDT
+ *
+ * @v hw_addr		MAC address to fill in
+ * @ret rc		Return status code
+ */
+int acpi_mac ( uint8_t *hw_addr ) {
+	int rc;
+
+	/* Look for an "AMAC" address */
+	if ( ( rc = acpi_extract ( AMAC_SIGNATURE, hw_addr,
+				   acpi_extract_mac ) ) == 0 )
+		return 0;
+
+	/* Look for a "MACA" address */
+	if ( ( rc = acpi_extract ( MACA_SIGNATURE, hw_addr,
+				   acpi_extract_mac ) ) == 0 )
+		return 0;
+
+	return -ENOENT;
+}
diff --git a/src/core/archive.c b/src/core/archive.c
new file mode 100644
index 0000000..bb62c7e
--- /dev/null
+++ b/src/core/archive.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2021 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <string.h>
+#include <errno.h>
+#include <ipxe/image.h>
+
+/** @file
+ *
+ * Archive images
+ *
+ */
+
+/**
+ * Extract archive image
+ *
+ * @v image		Image
+ * @v name		Extracted image name
+ * @v extracted		Extracted image to fill in
+ * @ret rc		Return status code
+ */
+int image_extract ( struct image *image, const char *name,
+		    struct image **extracted ) {
+	char *dot;
+	int rc;
+
+	/* Check that this image can be used to extract an archive image */
+	if ( ! ( image->type && image->type->extract ) ) {
+		rc = -ENOTSUP;
+		goto err_unsupported;
+	}
+
+	/* Allocate new image */
+	*extracted = alloc_image ( image->uri );
+	if ( ! *extracted ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+
+	/* Set image name */
+	if ( ( rc = image_set_name ( *extracted,
+				     ( name ? name : image->name ) ) ) != 0 ) {
+		goto err_set_name;
+	}
+
+	/* Strip any archive or compression suffix from implicit name */
+	if ( ( ! name ) && ( (*extracted)->name ) &&
+	     ( ( dot = strrchr ( (*extracted)->name, '.' ) ) != NULL ) ) {
+		*dot = '\0';
+	}
+
+	/* Try extracting archive image */
+	if ( ( rc = image->type->extract ( image, *extracted ) ) != 0 ) {
+		DBGC ( image, "IMAGE %s could not extract image: %s\n",
+		       image->name, strerror ( rc ) );
+		goto err_extract;
+	}
+
+	/* Register image */
+	if ( ( rc = register_image ( *extracted ) ) != 0 )
+		goto err_register;
+
+	/* Propagate trust flag */
+	if ( image->flags & IMAGE_TRUSTED )
+		image_trust ( *extracted );
+
+	/* Drop local reference to image */
+	image_put ( *extracted );
+
+	return 0;
+
+	unregister_image ( *extracted );
+ err_register:
+ err_extract:
+ err_set_name:
+	image_put ( *extracted );
+ err_alloc:
+ err_unsupported:
+	return rc;
+}
+
+/**
+ * Extract and execute image
+ *
+ * @v image		Image
+ * @ret rc		Return status code
+ */
+int image_extract_exec ( struct image *image ) {
+	struct image *extracted;
+	int rc;
+
+	/* Extract image */
+	if ( ( rc = image_extract ( image, NULL, &extracted ) ) != 0 )
+		goto err_extract;
+
+	/* Set image command line */
+	if ( ( rc = image_set_cmdline ( extracted, image->cmdline ) ) != 0 )
+		goto err_set_cmdline;
+
+	/* Set auto-unregister flag */
+	extracted->flags |= IMAGE_AUTO_UNREGISTER;
+
+	/* Tail-recurse into extracted image */
+	return image_exec ( extracted );
+
+ err_set_cmdline:
+	unregister_image ( extracted );
+ err_extract:
+	return rc;
+}
+
+/* Drag in objects via image_extract() */
+REQUIRING_SYMBOL ( image_extract );
+
+/* Drag in archive image formats */
+REQUIRE_OBJECT ( config_archive );
diff --git a/src/core/base64.c b/src/core/base64.c
index e452f7d..ec11be2 100644
--- a/src/core/base64.c
+++ b/src/core/base64.c
@@ -36,7 +36,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  */
 
-static const char base64[64] =
+static const char base64[ 64 + 1 /* NUL */ ] =
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 /**
diff --git a/src/core/cachedhcp.c b/src/core/cachedhcp.c
index 0e7da4b..2fa9b0c 100644
--- a/src/core/cachedhcp.c
+++ b/src/core/cachedhcp.c
@@ -37,29 +37,121 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  */
 
+/** A cached DHCP packet */
+struct cached_dhcp_packet {
+	/** Settings block name */
+	const char *name;
+	/** DHCP packet (if any) */
+	struct dhcp_packet *dhcppkt;
+};
+
 /** Cached DHCPACK */
-static struct dhcp_packet *cached_dhcpack;
+struct cached_dhcp_packet cached_dhcpack = {
+	.name = DHCP_SETTINGS_NAME,
+};
+
+/** Cached ProxyDHCPOFFER */
+struct cached_dhcp_packet cached_proxydhcp = {
+	.name = PROXYDHCP_SETTINGS_NAME,
+};
+
+/** Cached PXEBSACK */
+struct cached_dhcp_packet cached_pxebs = {
+	.name = PXEBS_SETTINGS_NAME,
+};
+
+/** List of cached DHCP packets */
+static struct cached_dhcp_packet *cached_packets[] = {
+	&cached_dhcpack,
+	&cached_proxydhcp,
+	&cached_pxebs,
+};
 
 /** Colour for debug messages */
 #define colour &cached_dhcpack
 
 /**
- * Record cached DHCPACK
+ * Free cached DHCP packet
  *
+ * @v cache		Cached DHCP packet
+ */
+static void cachedhcp_free ( struct cached_dhcp_packet *cache ) {
+
+	dhcppkt_put ( cache->dhcppkt );
+	cache->dhcppkt = NULL;
+}
+
+/**
+ * Apply cached DHCP packet settings
+ *
+ * @v cache		Cached DHCP packet
+ * @v netdev		Network device, or NULL
+ * @ret rc		Return status code
+ */
+static int cachedhcp_apply ( struct cached_dhcp_packet *cache,
+			     struct net_device *netdev ) {
+	struct settings *settings;
+	int rc;
+
+	/* Do nothing if cache is empty */
+	if ( ! cache->dhcppkt )
+		return 0;
+
+	/* Do nothing unless cached packet's MAC address matches this
+	 * network device, if specified.
+	 */
+	if ( netdev ) {
+		if ( memcmp ( netdev->ll_addr, cache->dhcppkt->dhcphdr->chaddr,
+			      netdev->ll_protocol->ll_addr_len ) != 0 ) {
+			DBGC ( colour, "CACHEDHCP %s does not match %s\n",
+			       cache->name, netdev->name );
+			return 0;
+		}
+		DBGC ( colour, "CACHEDHCP %s is for %s\n",
+		       cache->name, netdev->name );
+	}
+
+	/* Select appropriate parent settings block */
+	settings = ( netdev ? netdev_settings ( netdev ) : NULL );
+
+	/* Register settings */
+	if ( ( rc = register_settings ( &cache->dhcppkt->settings, settings,
+					cache->name ) ) != 0 ) {
+		DBGC ( colour, "CACHEDHCP %s could not register settings: %s\n",
+		       cache->name, strerror ( rc ) );
+		return rc;
+	}
+
+	/* Free cached DHCP packet */
+	cachedhcp_free ( cache );
+
+	return 0;
+}
+
+/**
+ * Record cached DHCP packet
+ *
+ * @v cache		Cached DHCP packet
  * @v data		DHCPACK packet buffer
  * @v max_len		Maximum possible length
  * @ret rc		Return status code
  */
-int cachedhcp_record ( userptr_t data, size_t max_len ) {
+int cachedhcp_record ( struct cached_dhcp_packet *cache, userptr_t data,
+		       size_t max_len ) {
 	struct dhcp_packet *dhcppkt;
 	struct dhcp_packet *tmp;
 	struct dhcphdr *dhcphdr;
+	unsigned int i;
 	size_t len;
 
+	/* Free any existing cached packet */
+	cachedhcp_free ( cache );
+
 	/* Allocate and populate DHCP packet */
 	dhcppkt = zalloc ( sizeof ( *dhcppkt ) + max_len );
 	if ( ! dhcppkt ) {
-		DBGC ( colour, "CACHEDHCP could not allocate copy\n" );
+		DBGC ( colour, "CACHEDHCP %s could not allocate copy\n",
+		       cache->name );
 		return -ENOMEM;
 	}
 	dhcphdr = ( ( ( void * ) dhcppkt ) + sizeof ( *dhcppkt ) );
@@ -80,10 +172,26 @@ int cachedhcp_record ( userptr_t data, size_t max_len ) {
 	dhcphdr = ( ( ( void * ) dhcppkt ) + sizeof ( *dhcppkt ) );
 	dhcppkt_init ( dhcppkt, dhcphdr, len );
 
-	/* Store as cached DHCPACK, and mark original copy as consumed */
-	DBGC ( colour, "CACHEDHCP found cached DHCPACK at %#08lx+%#zx/%#zx\n",
+	/* Discard duplicate packets, since some PXE stacks (including
+	 * iPXE itself) will report the DHCPACK packet as the PXEBSACK
+	 * if no separate PXEBSACK exists.
+	 */
+	for ( i = 0 ; i < ( sizeof ( cached_packets ) /
+			    sizeof ( cached_packets[0] ) ) ; i++ ) {
+		tmp = cached_packets[i]->dhcppkt;
+		if ( tmp && ( dhcppkt_len ( tmp ) == len ) &&
+		     ( memcmp ( tmp->dhcphdr, dhcppkt->dhcphdr, len ) == 0 ) ) {
+			DBGC ( colour, "CACHEDHCP %s duplicates %s\n",
+			       cache->name, cached_packets[i]->name );
+			dhcppkt_put ( dhcppkt );
+			return -EEXIST;
+		}
+	}
+
+	/* Store as cached packet */
+	DBGC ( colour, "CACHEDHCP %s at %#08lx+%#zx/%#zx\n", cache->name,
 	       user_to_phys ( data, 0 ), len, max_len );
-	cached_dhcpack = dhcppkt;
+	cache->dhcppkt = dhcppkt;
 
 	return 0;
 }
@@ -94,14 +202,20 @@ int cachedhcp_record ( userptr_t data, size_t max_len ) {
  */
 static void cachedhcp_startup ( void ) {
 
-	/* If cached DHCP packet was not claimed by any network device
-	 * during startup, then free it.
-	 */
-	if ( cached_dhcpack ) {
-		DBGC ( colour, "CACHEDHCP freeing unclaimed cached DHCPACK\n" );
-		dhcppkt_put ( cached_dhcpack );
-		cached_dhcpack = NULL;
+	/* Apply cached ProxyDHCPOFFER, if any */
+	cachedhcp_apply ( &cached_proxydhcp, NULL );
+
+	/* Apply cached PXEBSACK, if any */
+	cachedhcp_apply ( &cached_pxebs, NULL );
+
+	/* Free any remaining cached packets */
+	if ( cached_dhcpack.dhcppkt ) {
+		DBGC ( colour, "CACHEDHCP %s unclaimed\n",
+		       cached_dhcpack.name );
 	}
+	cachedhcp_free ( &cached_dhcpack );
+	cachedhcp_free ( &cached_proxydhcp );
+	cachedhcp_free ( &cached_pxebs );
 }
 
 /** Cached DHCPACK startup function */
@@ -117,38 +231,9 @@ struct startup_fn cachedhcp_startup_fn __startup_fn ( STARTUP_LATE ) = {
  * @ret rc		Return status code
  */
 static int cachedhcp_probe ( struct net_device *netdev ) {
-	struct ll_protocol *ll_protocol = netdev->ll_protocol;
-	int rc;
 
-	/* Do nothing unless we have a cached DHCPACK */
-	if ( ! cached_dhcpack )
-		return 0;
-
-	/* Do nothing unless cached DHCPACK's MAC address matches this
-	 * network device.
-	 */
-	if ( memcmp ( netdev->ll_addr, cached_dhcpack->dhcphdr->chaddr,
-		      ll_protocol->ll_addr_len ) != 0 ) {
-		DBGC ( colour, "CACHEDHCP cached DHCPACK does not match %s\n",
-		       netdev->name );
-		return 0;
-	}
-	DBGC ( colour, "CACHEDHCP cached DHCPACK is for %s\n", netdev->name );
-
-	/* Register as DHCP settings for this network device */
-	if ( ( rc = register_settings ( &cached_dhcpack->settings,
-					netdev_settings ( netdev ),
-					DHCP_SETTINGS_NAME ) ) != 0 ) {
-		DBGC ( colour, "CACHEDHCP could not register settings: %s\n",
-		       strerror ( rc ) );
-		return rc;
-	}
-
-	/* Claim cached DHCPACK */
-	dhcppkt_put ( cached_dhcpack );
-	cached_dhcpack = NULL;
-
-	return 0;
+	/* Apply cached DHCPACK to network device, if applicable */
+	return cachedhcp_apply ( &cached_dhcpack, netdev );
 }
 
 /** Cached DHCP packet network device driver */
diff --git a/src/core/console.c b/src/core/console.c
index 7fd0003..2b90809 100644
--- a/src/core/console.c
+++ b/src/core/console.c
@@ -20,11 +20,12 @@ unsigned int console_height = CONSOLE_DEFAULT_HEIGHT;
  * Write a single character to each console device
  *
  * @v character		Character to be written
+ * @ret character	Character written
  *
  * The character is written out to all enabled console devices, using
  * each device's console_driver::putchar() method.
  */
-void putchar ( int character ) {
+int putchar ( int character ) {
 	struct console_driver *console;
 
 	/* Automatic LF -> CR,LF translation */
@@ -37,6 +38,8 @@ void putchar ( int character ) {
 		     console->putchar )
 			console->putchar ( character );
 	}
+
+	return character;
 }
 
 /**
diff --git a/src/core/cpio.c b/src/core/cpio.c
index 080c72d..27aee75 100644
--- a/src/core/cpio.c
+++ b/src/core/cpio.c
@@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 #include <ipxe/cpio.h>
 
@@ -45,3 +46,87 @@ void cpio_set_field ( char *field, unsigned long value ) {
 	snprintf ( buf, sizeof ( buf ), "%08lx", value );
 	memcpy ( field, buf, 8 );
 }
+
+/**
+ * Get CPIO image filename
+ *
+ * @v image		Image
+ * @ret len		CPIO filename length (0 for no filename)
+ */
+size_t cpio_name_len ( struct image *image ) {
+	const char *name = cpio_name ( image );
+	char *sep;
+	size_t len;
+
+	/* Check for existence of CPIO filename */
+	if ( ! name )
+		return 0;
+
+	/* Locate separator (if any) */
+	sep = strchr ( name, ' ' );
+	len = ( sep ? ( ( size_t ) ( sep - name ) ) : strlen ( name ) );
+
+	return len;
+}
+
+/**
+ * Parse CPIO image parameters
+ *
+ * @v image		Image
+ * @v cpio		CPIO header to fill in
+ */
+static void cpio_parse_cmdline ( struct image *image,
+				 struct cpio_header *cpio ) {
+	const char *cmdline;
+	char *arg;
+	char *end;
+	unsigned int mode;
+
+	/* Skip image filename */
+	cmdline = ( cpio_name ( image ) + cpio_name_len ( image ) );
+
+	/* Look for "mode=" */
+	if ( ( arg = strstr ( cmdline, "mode=" ) ) ) {
+		arg += 5;
+		mode = strtoul ( arg, &end, 8 /* Octal for file mode */ );
+		if ( *end && ( *end != ' ' ) ) {
+			DBGC ( image, "CPIO %p strange \"mode=\" "
+			       "terminator '%c'\n", image, *end );
+		}
+		cpio_set_field ( cpio->c_mode, ( 0100000 | mode ) );
+	}
+}
+
+/**
+ * Construct CPIO header for image, if applicable
+ *
+ * @v image		Image
+ * @v cpio		CPIO header to fill in
+ * @ret len		Length of magic CPIO header (including filename)
+ */
+size_t cpio_header ( struct image *image, struct cpio_header *cpio ) {
+	size_t name_len;
+	size_t len;
+
+	/* Get filename length */
+	name_len = cpio_name_len ( image );
+
+	/* Images with no filename are assumed to already be CPIO archives */
+	if ( ! name_len )
+		return 0;
+
+	/* Construct CPIO header */
+	memset ( cpio, '0', sizeof ( *cpio ) );
+	memcpy ( cpio->c_magic, CPIO_MAGIC, sizeof ( cpio->c_magic ) );
+	cpio_set_field ( cpio->c_mode, 0100644 );
+	cpio_set_field ( cpio->c_nlink, 1 );
+	cpio_set_field ( cpio->c_filesize, image->len );
+	cpio_set_field ( cpio->c_namesize, ( name_len + 1 /* NUL */ ) );
+	cpio_parse_cmdline ( image, cpio );
+
+	/* Calculate total length */
+	len = ( ( sizeof ( *cpio ) + name_len + 1 /* NUL */ + CPIO_ALIGN - 1 )
+		& ~( CPIO_ALIGN - 1 ) );
+
+	return len;
+}
diff --git a/src/core/image.c b/src/core/image.c
index 9fe77c5..ce8cf86 100644
--- a/src/core/image.c
+++ b/src/core/image.c
@@ -176,14 +176,13 @@ int image_set_cmdline ( struct image *image, const char *cmdline ) {
 }
 
 /**
- * Set image data
+ * Set image length
  *
  * @v image		Image
- * @v data		Image data
  * @v len		Length of image data
  * @ret rc		Return status code
  */
-int image_set_data ( struct image *image, userptr_t data, size_t len ) {
+int image_set_len ( struct image *image, size_t len ) {
 	userptr_t new;
 
 	/* (Re)allocate image data */
@@ -191,10 +190,28 @@ int image_set_data ( struct image *image, userptr_t data, size_t len ) {
 	if ( ! new )
 		return -ENOMEM;
 	image->data = new;
+	image->len = len;
+
+	return 0;
+}
+
+/**
+ * Set image data
+ *
+ * @v image		Image
+ * @v data		Image data
+ * @v len		Length of image data
+ * @ret rc		Return status code
+ */
+int image_set_data ( struct image *image, userptr_t data, size_t len ) {
+	int rc;
+
+	/* Set image length */
+	if ( ( rc = image_set_len ( image, len ) ) != 0 )
+		return rc;
 
 	/* Copy in new image data */
 	memcpy_user ( image->data, 0, data, 0, len );
-	image->len = len;
 
 	return 0;
 }
diff --git a/src/core/open.c b/src/core/open.c
index c27d8a0..f9198c9 100644
--- a/src/core/open.c
+++ b/src/core/open.c
@@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #include <stdarg.h>
 #include <string.h>
+#include <strings.h>
 #include <errno.h>
 #include <ipxe/xfer.h>
 #include <ipxe/uri.h>
@@ -47,7 +48,7 @@ struct uri_opener * xfer_uri_opener ( const char *scheme ) {
 	struct uri_opener *opener;
 
 	for_each_table_entry ( opener, URI_OPENERS ) {
-		if ( strcmp ( scheme, opener->scheme ) == 0 )
+		if ( strcasecmp ( scheme, opener->scheme ) == 0 )
 			return opener;
 	}
 	return NULL;
diff --git a/src/core/settings.c b/src/core/settings.c
index 430cdc8..fcdf98d 100644
--- a/src/core/settings.c
+++ b/src/core/settings.c
@@ -2199,7 +2199,7 @@ const struct setting_type setting_type_base64 __setting_type = {
 };
 
 /**
- * Format UUID setting value
+ * Format UUID/GUID setting value
  *
  * @v type		Setting type
  * @v raw		Raw setting value
@@ -2208,17 +2208,24 @@ const struct setting_type setting_type_base64 __setting_type = {
  * @v len		Length of buffer
  * @ret len		Length of formatted value, or negative error
  */
-static int format_uuid_setting ( const struct setting_type *type __unused,
+static int format_uuid_setting ( const struct setting_type *type,
 				 const void *raw, size_t raw_len, char *buf,
 				 size_t len ) {
-	const union uuid *uuid = raw;
+	union uuid uuid;
 
 	/* Range check */
-	if ( raw_len != sizeof ( *uuid ) )
+	if ( raw_len != sizeof ( uuid ) )
 		return -ERANGE;
 
+	/* Copy value */
+	memcpy ( &uuid, raw, sizeof ( uuid ) );
+
+	/* Mangle GUID byte ordering */
+	if ( type == &setting_type_guid )
+		uuid_mangle ( &uuid );
+
 	/* Format value */
-	return snprintf ( buf, len, "%s", uuid_ntoa ( uuid ) );
+	return snprintf ( buf, len, "%s", uuid_ntoa ( &uuid ) );
 }
 
 /** UUID setting type */
@@ -2227,6 +2234,12 @@ const struct setting_type setting_type_uuid __setting_type = {
 	.format = format_uuid_setting,
 };
 
+/** GUID setting type */
+const struct setting_type setting_type_guid __setting_type = {
+	.name = "guid",
+	.format = format_uuid_setting,
+};
+
 /**
  * Format PCI bus:dev.fn setting value
  *
diff --git a/src/core/string.c b/src/core/string.c
index 188fe08..9a1b9b7 100644
--- a/src/core/string.c
+++ b/src/core/string.c
@@ -27,6 +27,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#include <strings.h>
 #include <ctype.h>
 
 /** @file
@@ -205,11 +206,24 @@ int strncmp ( const char *first, const char *second, size_t max ) {
  * @ret diff		Difference
  */
 int strcasecmp ( const char *first, const char *second ) {
+
+	return strncasecmp ( first, second, ~( ( size_t ) 0 ) );
+}
+
+/**
+ * Compare case-insensitive strings
+ *
+ * @v first		First string
+ * @v second		Second string
+ * @v max		Maximum length to compare
+ * @ret diff		Difference
+ */
+int strncasecmp ( const char *first, const char *second, size_t max ) {
 	const uint8_t *first_bytes = ( ( const uint8_t * ) first );
 	const uint8_t *second_bytes = ( ( const uint8_t * ) second );
 	int diff;
 
-	for ( ; ; first_bytes++, second_bytes++ ) {
+	for ( ; max-- ; first_bytes++, second_bytes++ ) {
 		diff = ( toupper ( *first_bytes ) -
 			 toupper ( *second_bytes ) );
 		if ( diff )
@@ -217,6 +231,7 @@ int strcasecmp ( const char *first, const char *second ) {
 		if ( ! *first_bytes )
 			return 0;
 	}
+	return 0;
 }
 
 /**
diff --git a/src/core/uri.c b/src/core/uri.c
index e9e512a..a0f79e9 100644
--- a/src/core/uri.c
+++ b/src/core/uri.c
@@ -79,12 +79,10 @@ size_t uri_decode ( const char *encoded, void *buf, size_t len ) {
 /**
  * Decode URI field in-place
  *
- * @v uri		URI
- * @v field		URI field index
+ * @v encoded		Encoded field, or NULL
  */
-static void uri_decode_inplace ( struct uri *uri, unsigned int field ) {
-	const char *encoded = uri_field ( uri, field );
-	char *decoded = ( ( char * ) encoded );
+static void uri_decode_inplace ( char *encoded ) {
+	char *decoded = encoded;
 	size_t len;
 
 	/* Do nothing if field is not present */
@@ -150,7 +148,7 @@ static int uri_character_escaped ( char c, unsigned int field ) {
 	 * parser but for any other URI parsers (e.g. HTTP query
 	 * string parsers, which care about '=' and '&').
 	 */
-	static const char *escaped[URI_FIELDS] = {
+	static const char *escaped[URI_EPATH] = {
 		/* Scheme or default: escape everything */
 		[URI_SCHEME]	= "/#:@?=&",
 		/* Opaque part: escape characters which would affect
@@ -172,20 +170,21 @@ static int uri_character_escaped ( char c, unsigned int field ) {
 		 * appears within paths.
 		 */
 		[URI_PATH]	= "#:@?",
-		/* Query: escape everything except '/', which
-		 * sometimes appears within queries.
-		 */
-		[URI_QUERY]	= "#:@?",
-		/* Fragment: escape everything */
-		[URI_FRAGMENT]	= "/#:@?",
 	};
 
-	return ( /* Always escape non-printing characters and whitespace */
-		 ( ! isprint ( c ) ) || ( c == ' ' ) ||
-		 /* Always escape '%' */
-		 ( c == '%' ) ||
-		 /* Escape field-specific characters */
-		 strchr ( escaped[field], c ) );
+	/* Always escape non-printing characters and whitespace */
+	if ( ( ! isprint ( c ) ) || ( c == ' ' ) )
+		return 1;
+
+	/* Escape nothing else in already-escaped fields */
+	if ( field >= URI_EPATH )
+		return 0;
+
+	/* Escape '%' and any field-specific characters */
+	if ( ( c == '%' ) || strchr ( escaped[field], c ) )
+		return 1;
+
+	return 0;
 }
 
 /**
@@ -262,10 +261,12 @@ static void uri_dump ( const struct uri *uri ) {
 		DBGC ( uri, " port \"%s\"", uri->port );
 	if ( uri->path )
 		DBGC ( uri, " path \"%s\"", uri->path );
-	if ( uri->query )
-		DBGC ( uri, " query \"%s\"", uri->query );
-	if ( uri->fragment )
-		DBGC ( uri, " fragment \"%s\"", uri->fragment );
+	if ( uri->epath )
+		DBGC ( uri, " epath \"%s\"", uri->epath );
+	if ( uri->equery )
+		DBGC ( uri, " equery \"%s\"", uri->equery );
+	if ( uri->efragment )
+		DBGC ( uri, " efragment \"%s\"", uri->efragment );
 	if ( uri->params )
 		DBGC ( uri, " params \"%s\"", uri->params->name );
 }
@@ -298,17 +299,19 @@ struct uri * parse_uri ( const char *uri_string ) {
 	char *raw;
 	char *tmp;
 	char *path;
+	char *epath;
 	char *authority;
 	size_t raw_len;
 	unsigned int field;
 
-	/* Allocate space for URI struct and a copy of the string */
+	/* Allocate space for URI struct and two copies of the string */
 	raw_len = ( strlen ( uri_string ) + 1 /* NUL */ );
-	uri = zalloc ( sizeof ( *uri ) + raw_len );
+	uri = zalloc ( sizeof ( *uri ) + ( 2 * raw_len ) );
 	if ( ! uri )
 		return NULL;
 	ref_init ( &uri->refcnt, uri_free );
 	raw = ( ( ( void * ) uri ) + sizeof ( *uri ) );
+	path = ( raw + raw_len );
 
 	/* Copy in the raw string */
 	memcpy ( raw, uri_string, raw_len );
@@ -328,7 +331,7 @@ struct uri * parse_uri ( const char *uri_string ) {
 	/* Chop off the fragment, if it exists */
 	if ( ( tmp = strchr ( raw, '#' ) ) ) {
 		*(tmp++) = '\0';
-		uri->fragment = tmp;
+		uri->efragment = tmp;
 	}
 
 	/* Identify absolute/relative URI */
@@ -338,47 +341,47 @@ struct uri * parse_uri ( const char *uri_string ) {
 		*(tmp++) = '\0';
 		if ( *tmp == '/' ) {
 			/* Absolute URI with hierarchical part */
-			path = tmp;
+			epath = tmp;
 		} else {
 			/* Absolute URI with opaque part */
 			uri->opaque = tmp;
-			path = NULL;
+			epath = NULL;
 		}
 	} else {
 		/* Relative URI */
-		path = raw;
+		epath = raw;
 	}
 
 	/* If we don't have a path (i.e. we have an absolute URI with
 	 * an opaque portion, we're already finished processing
 	 */
-	if ( ! path )
+	if ( ! epath )
 		goto done;
 
 	/* Chop off the query, if it exists */
-	if ( ( tmp = strchr ( path, '?' ) ) ) {
+	if ( ( tmp = strchr ( epath, '?' ) ) ) {
 		*(tmp++) = '\0';
-		uri->query = tmp;
+		uri->equery = tmp;
 	}
 
 	/* If we have no path remaining, then we're already finished
 	 * processing.
 	 */
-	if ( ! path[0] )
+	if ( ! epath[0] )
 		goto done;
 
 	/* Identify net/absolute/relative path */
-	if ( uri->scheme && ( strncmp ( path, "//", 2 ) == 0 ) ) {
+	if ( uri->scheme && ( strncmp ( epath, "//", 2 ) == 0 ) ) {
 		/* Net path.  If this is terminated by the first '/'
 		 * of an absolute path, then we have no space for a
 		 * terminator after the authority field, so shuffle
 		 * the authority down by one byte, overwriting one of
 		 * the two slashes.
 		 */
-		authority = ( path + 2 );
+		authority = ( epath + 2 );
 		if ( ( tmp = strchr ( authority, '/' ) ) ) {
 			/* Shuffle down */
-			uri->path = tmp;
+			uri->epath = tmp;
 			memmove ( ( authority - 1 ), authority,
 				  ( tmp - authority ) );
 			authority--;
@@ -386,10 +389,16 @@ struct uri * parse_uri ( const char *uri_string ) {
 		}
 	} else {
 		/* Absolute/relative path */
-		uri->path = path;
+		uri->epath = epath;
 		authority = NULL;
 	}
 
+	/* Create copy of path for decoding */
+	if ( uri->epath ) {
+		strcpy ( path, uri->epath );
+		uri->path = path;
+	}
+
 	/* If we don't have an authority (i.e. we have a non-net
 	 * path), we're already finished processing
 	 */
@@ -421,8 +430,8 @@ struct uri * parse_uri ( const char *uri_string ) {
 
  done:
 	/* Decode fields in-place */
-	for ( field = 0 ; field < URI_FIELDS ; field++ )
-		uri_decode_inplace ( uri, field );
+	for ( field = 0 ; field < URI_EPATH ; field++ )
+		uri_decode_inplace ( ( char * ) uri_field ( uri, field ) );
 
 	DBGC ( uri, "URI parsed \"%s\" to", uri_string );
 	uri_dump ( uri );
@@ -458,8 +467,8 @@ size_t format_uri ( const struct uri *uri, char *buf, size_t len ) {
 	static const char prefixes[URI_FIELDS] = {
 		[URI_PASSWORD] = ':',
 		[URI_PORT] = ':',
-		[URI_QUERY] = '?',
-		[URI_FRAGMENT] = '#',
+		[URI_EQUERY] = '?',
+		[URI_EFRAGMENT] = '#',
 	};
 	char prefix;
 	size_t used = 0;
@@ -480,6 +489,10 @@ size_t format_uri ( const struct uri *uri, char *buf, size_t len ) {
 		if ( ! uri_field ( uri, field ) )
 			continue;
 
+		/* Skip path field if encoded path is present */
+		if ( ( field == URI_PATH ) && uri->epath )
+			continue;
+
 		/* Prefix this field, if applicable */
 		prefix = prefixes[field];
 		if ( ( field == URI_HOST ) && ( uri->user != NULL ) )
@@ -676,6 +689,7 @@ char * resolve_path ( const char *base_path,
 struct uri * resolve_uri ( const struct uri *base_uri,
 			   struct uri *relative_uri ) {
 	struct uri tmp_uri;
+	char *tmp_epath = NULL;
 	char *tmp_path = NULL;
 	struct uri *new_uri;
 
@@ -685,20 +699,27 @@ struct uri * resolve_uri ( const struct uri *base_uri,
 
 	/* Mangle URI */
 	memcpy ( &tmp_uri, base_uri, sizeof ( tmp_uri ) );
-	if ( relative_uri->path ) {
-		tmp_path = resolve_path ( ( base_uri->path ?
-					    base_uri->path : "/" ),
-					  relative_uri->path );
+	if ( relative_uri->epath ) {
+		tmp_epath = resolve_path ( ( base_uri->epath ?
+					     base_uri->epath : "/" ),
+					   relative_uri->epath );
+		if ( ! tmp_epath )
+			goto err_epath;
+		tmp_path = strdup ( tmp_epath );
+		if ( ! tmp_path )
+			goto err_path;
+		uri_decode_inplace ( tmp_path );
+		tmp_uri.epath = tmp_epath;
 		tmp_uri.path = tmp_path;
-		tmp_uri.query = relative_uri->query;
-		tmp_uri.fragment = relative_uri->fragment;
+		tmp_uri.equery = relative_uri->equery;
+		tmp_uri.efragment = relative_uri->efragment;
 		tmp_uri.params = relative_uri->params;
-	} else if ( relative_uri->query ) {
-		tmp_uri.query = relative_uri->query;
-		tmp_uri.fragment = relative_uri->fragment;
+	} else if ( relative_uri->equery ) {
+		tmp_uri.equery = relative_uri->equery;
+		tmp_uri.efragment = relative_uri->efragment;
 		tmp_uri.params = relative_uri->params;
-	} else if ( relative_uri->fragment ) {
-		tmp_uri.fragment = relative_uri->fragment;
+	} else if ( relative_uri->efragment ) {
+		tmp_uri.efragment = relative_uri->efragment;
 		tmp_uri.params = relative_uri->params;
 	} else if ( relative_uri->params ) {
 		tmp_uri.params = relative_uri->params;
@@ -707,7 +728,14 @@ struct uri * resolve_uri ( const struct uri *base_uri,
 	/* Create demangled URI */
 	new_uri = uri_dup ( &tmp_uri );
 	free ( tmp_path );
+	free ( tmp_epath );
 	return new_uri;
+
+	free ( tmp_path );
+ err_path:
+	free ( tmp_epath );
+ err_epath:
+	return NULL;
 }
 
 /**
@@ -746,6 +774,7 @@ static struct uri * tftp_uri ( struct sockaddr *sa_server,
 	if ( asprintf ( &path, "/%s", filename ) < 0 )
 		goto err_path;
 	tmp.path = path;
+	tmp.epath = path;
 
 	/* Demangle URI */
 	uri = uri_dup ( &tmp );
diff --git a/src/crypto/x509.c b/src/crypto/x509.c
index 17d8c7a..1f017eb 100644
--- a/src/crypto/x509.c
+++ b/src/crypto/x509.c
@@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #include <stdlib.h>
 #include <string.h>
+#include <strings.h>
 #include <errno.h>
 #include <assert.h>
 #include <ipxe/list.h>
@@ -1464,7 +1465,7 @@ static int x509_check_dnsname ( struct x509_certificate *cert,
 
 	/* Compare names */
 	if ( ! ( ( strlen ( name ) == len ) &&
-		 ( memcmp ( name, dnsname, len ) == 0 ) ) )
+		 ( strncasecmp ( name, dnsname, len ) == 0 ) ) )
 		return -ENOENT;
 
 	if ( name != fullname ) {
diff --git a/src/drivers/bus/virtio-pci.c b/src/drivers/bus/virtio-pci.c
index 5d2d627..8b34c72 100644
--- a/src/drivers/bus/virtio-pci.c
+++ b/src/drivers/bus/virtio-pci.c
@@ -17,37 +17,47 @@
 #include "ipxe/io.h"
 #include "ipxe/iomap.h"
 #include "ipxe/pci.h"
+#include "ipxe/dma.h"
 #include "ipxe/reboot.h"
 #include "ipxe/virtio-pci.h"
 #include "ipxe/virtio-ring.h"
 
-static int vp_alloc_vq(struct vring_virtqueue *vq, u16 num)
+static int vp_alloc_vq(struct vring_virtqueue *vq, u16 num, size_t header_size)
 {
-    size_t queue_size = PAGE_MASK + vring_size(num);
+    size_t ring_size = PAGE_MASK + vring_size(num);
     size_t vdata_size = num * sizeof(void *);
+    size_t queue_size = ring_size + vdata_size + header_size;
 
-    vq->queue = zalloc(queue_size + vdata_size);
+    vq->queue = dma_alloc(vq->dma, &vq->map, queue_size, queue_size);
     if (!vq->queue) {
         return -ENOMEM;
     }
 
+    memset ( vq->queue, 0, queue_size );
+    vq->queue_size = queue_size;
+
     /* vdata immediately follows the ring */
-    vq->vdata = (void **)(vq->queue + queue_size);
+    vq->vdata = (void **)(vq->queue + ring_size);
+
+    /* empty header immediately follows vdata */
+    vq->empty_header = (struct virtio_net_hdr_modern *)(vq->queue + ring_size + vdata_size);
 
     return 0;
 }
 
 void vp_free_vq(struct vring_virtqueue *vq)
 {
-    if (vq->queue) {
-        free(vq->queue);
+    if (vq->queue && vq->queue_size) {
+        dma_free(&vq->map, vq->queue, vq->queue_size);
         vq->queue = NULL;
         vq->vdata = NULL;
+        vq->queue_size = 0;
     }
 }
 
 int vp_find_vq(unsigned int ioaddr, int queue_index,
-               struct vring_virtqueue *vq)
+               struct vring_virtqueue *vq, struct dma_device *dma_dev,
+               size_t header_size)
 {
    struct vring * vr = &vq->vring;
    u16 num;
@@ -73,9 +83,10 @@ int vp_find_vq(unsigned int ioaddr, int queue_index,
    }
 
    vq->queue_index = queue_index;
+   vq->dma = dma_dev;
 
    /* initialize the queue */
-   rc = vp_alloc_vq(vq, num);
+   rc = vp_alloc_vq(vq, num, header_size);
    if (rc) {
            DBG("VIRTIO-PCI ERROR: failed to allocate queue memory\n");
            return rc;
@@ -87,8 +98,7 @@ int vp_find_vq(unsigned int ioaddr, int queue_index,
     * NOTE: vr->desc is initialized by vring_init()
     */
 
-   outl((unsigned long)virt_to_phys(vr->desc) >> PAGE_SHIFT,
-        ioaddr + VIRTIO_PCI_QUEUE_PFN);
+   outl(dma(&vq->map, vr->desc) >> PAGE_SHIFT, ioaddr + VIRTIO_PCI_QUEUE_PFN);
 
    return num;
 }
@@ -348,7 +358,8 @@ void vpm_notify(struct virtio_pci_modern_device *vdev,
 }
 
 int vpm_find_vqs(struct virtio_pci_modern_device *vdev,
-                 unsigned nvqs, struct vring_virtqueue *vqs)
+                 unsigned nvqs, struct vring_virtqueue *vqs,
+                 struct dma_device *dma_dev, size_t header_size)
 {
     unsigned i;
     struct vring_virtqueue *vq;
@@ -392,11 +403,12 @@ int vpm_find_vqs(struct virtio_pci_modern_device *vdev,
 
         vq = &vqs[i];
         vq->queue_index = i;
+        vq->dma = dma_dev;
 
         /* get offset of notification word for this vq */
         off = vpm_ioread16(vdev, &vdev->common, COMMON_OFFSET(queue_notify_off));
 
-        err = vp_alloc_vq(vq, size);
+        err = vp_alloc_vq(vq, size, header_size);
         if (err) {
             DBG("VIRTIO-PCI %p: failed to allocate queue memory\n", vdev);
             return err;
@@ -406,13 +418,16 @@ int vpm_find_vqs(struct virtio_pci_modern_device *vdev,
         /* activate the queue */
         vpm_iowrite16(vdev, &vdev->common, size, COMMON_OFFSET(queue_size));
 
-        vpm_iowrite64(vdev, &vdev->common, virt_to_phys(vq->vring.desc),
+        vpm_iowrite64(vdev, &vdev->common,
+                      dma(&vq->map, vq->vring.desc),
                       COMMON_OFFSET(queue_desc_lo),
                       COMMON_OFFSET(queue_desc_hi));
-        vpm_iowrite64(vdev, &vdev->common, virt_to_phys(vq->vring.avail),
+        vpm_iowrite64(vdev, &vdev->common,
+                      dma(&vq->map, vq->vring.avail),
                       COMMON_OFFSET(queue_avail_lo),
                       COMMON_OFFSET(queue_avail_hi));
-        vpm_iowrite64(vdev, &vdev->common, virt_to_phys(vq->vring.used),
+        vpm_iowrite64(vdev, &vdev->common,
+                      dma(&vq->map, vq->vring.used),
                       COMMON_OFFSET(queue_used_lo),
                       COMMON_OFFSET(queue_used_hi));
 
diff --git a/src/drivers/bus/virtio-ring.c b/src/drivers/bus/virtio-ring.c
index 98e787e..e448c34 100644
--- a/src/drivers/bus/virtio-ring.c
+++ b/src/drivers/bus/virtio-ring.c
@@ -98,7 +98,7 @@ void vring_add_buf(struct vring_virtqueue *vq,
    for (i = head; out; i = vr->desc[i].next, out--) {
 
            vr->desc[i].flags = VRING_DESC_F_NEXT;
-           vr->desc[i].addr = (u64)virt_to_phys(list->addr);
+           vr->desc[i].addr = list->addr;
            vr->desc[i].len = list->length;
            prev = i;
            list++;
@@ -106,7 +106,7 @@ void vring_add_buf(struct vring_virtqueue *vq,
    for ( ; in; i = vr->desc[i].next, in--) {
 
            vr->desc[i].flags = VRING_DESC_F_NEXT|VRING_DESC_F_WRITE;
-           vr->desc[i].addr = (u64)virt_to_phys(list->addr);
+           vr->desc[i].addr = list->addr;
            vr->desc[i].len = list->length;
            prev = i;
            list++;
diff --git a/src/drivers/net/ath/ath5k/ath5k_eeprom.c b/src/drivers/net/ath/ath5k/ath5k_eeprom.c
index 12519bc..46f33d1 100644
--- a/src/drivers/net/ath/ath5k/ath5k_eeprom.c
+++ b/src/drivers/net/ath/ath5k/ath5k_eeprom.c
@@ -39,6 +39,9 @@ static int ath5k_hw_eeprom_read(struct ath5k_hw *ah, u32 offset, u16 *data)
 {
 	u32 status, timeout;
 
+	/* Avoid returning uninitialised data on error */
+	*data = 0xffff;
+
 	/*
 	 * Initialize EEPROM access
 	 */
diff --git a/src/drivers/net/bnxt/bnxt.c b/src/drivers/net/bnxt/bnxt.c
index b8663c0..e387650 100644
--- a/src/drivers/net/bnxt/bnxt.c
+++ b/src/drivers/net/bnxt/bnxt.c
@@ -23,16 +23,74 @@ static void bnxt_adv_cq_index ( struct bnxt *bp, u16 cnt );
 static int bnxt_rx_complete ( struct net_device *dev, struct rx_pkt_cmpl *rx );
 void bnxt_link_evt ( struct bnxt *bp, struct hwrm_async_event_cmpl *evt );
 
+static struct pci_device_id bnxt_nics[] = {
+	PCI_ROM( 0x14e4, 0x16c0, "14e4-16C0", "14e4-16C0", 0 ),
+	PCI_ROM( 0x14e4, 0x16c1, "14e4-16C1", "14e4-16C1", BNXT_FLAG_PCI_VF ),
+	PCI_ROM( 0x14e4, 0x16c8, "14e4-16C8", "14e4-16C8", 0 ),
+	PCI_ROM( 0x14e4, 0x16c9, "14e4-16C9", "14e4-16C9", 0 ),
+	PCI_ROM( 0x14e4, 0x16ca, "14e4-16CA", "14e4-16CA", 0 ),
+	PCI_ROM( 0x14e4, 0x16cc, "14e4-16CC", "14e4-16CC", 0 ),
+	PCI_ROM( 0x14e4, 0x16cd, "14e4-16CD", "14e4-16CD", 0 ),
+	PCI_ROM( 0x14e4, 0x16ce, "14e4-16CE", "14e4-16CE", 0 ),
+	PCI_ROM( 0x14e4, 0x16cf, "14e4-16CF", "14e4-16CF", 0 ),
+	PCI_ROM( 0x14e4, 0x16d0, "14e4-16D0", "14e4-16D0", 0 ),
+	PCI_ROM( 0x14e4, 0x16d1, "14e4-16D1", "14e4-16D1", 0 ),
+	PCI_ROM( 0x14e4, 0x16d2, "14e4-16D2", "14e4-16D2", 0 ),
+	PCI_ROM( 0x14e4, 0x16d4, "14e4-16D4", "14e4-16D4", 0 ),
+	PCI_ROM( 0x14e4, 0x16d5, "14e4-16D5", "14e4-16D5", 0 ),
+	PCI_ROM( 0x14e4, 0x16d6, "14e4-16D6", "14e4-16D6", 0 ),
+	PCI_ROM( 0x14e4, 0x16d7, "14e4-16D7", "14e4-16D7", 0 ),
+	PCI_ROM( 0x14e4, 0x16d8, "14e4-16D8", "14e4-16D8", 0 ),
+	PCI_ROM( 0x14e4, 0x16d9, "14e4-16D9", "14e4-16D9", 0 ),
+	PCI_ROM( 0x14e4, 0x16da, "14e4-16DA", "14e4-16DA", 0 ),
+	PCI_ROM( 0x14e4, 0x16db, "14e4-16DB", "14e4-16DB", 0 ),
+	PCI_ROM( 0x14e4, 0x16dc, "14e4-16DC", "14e4-16DC", BNXT_FLAG_PCI_VF ),
+	PCI_ROM( 0x14e4, 0x16de, "14e4-16DE", "14e4-16DE", 0 ),
+	PCI_ROM( 0x14e4, 0x16df, "14e4-16DF", "14e4-16DF", 0 ),
+	PCI_ROM( 0x14e4, 0x16e0, "14e4-16E0", "14e4-16E0", 0 ),
+	PCI_ROM( 0x14e4, 0x16e2, "14e4-16E2", "14e4-16E2", 0 ),
+	PCI_ROM( 0x14e4, 0x16e3, "14e4-16E3", "14e4-16E3", 0 ),
+	PCI_ROM( 0x14e4, 0x16e4, "14e4-16E4", "14e4-16E4", 0 ),
+	PCI_ROM( 0x14e4, 0x16e7, "14e4-16E7", "14e4-16E7", 0 ),
+	PCI_ROM( 0x14e4, 0x16e8, "14e4-16E8", "14e4-16E8", 0 ),
+	PCI_ROM( 0x14e4, 0x16e9, "14e4-16E9", "14e4-16E9", 0 ),
+	PCI_ROM( 0x14e4, 0x16ea, "14e4-16EA", "14e4-16EA", 0 ),
+	PCI_ROM( 0x14e4, 0x16eb, "14e4-16EB", "14e4-16EB", 0 ),
+	PCI_ROM( 0x14e4, 0x16ec, "14e4-16EC", "14e4-16EC", 0 ),
+	PCI_ROM( 0x14e4, 0x16ed, "14e4-16ED", "14e4-16ED", 0 ),
+	PCI_ROM( 0x14e4, 0x16ee, "14e4-16EE", "14e4-16EE", 0 ),
+	PCI_ROM( 0x14e4, 0x16ef, "14e4-16EF", "14e4-16EF", 0 ),
+	PCI_ROM( 0x14e4, 0x16f0, "14e4-16F0", "14e4-16F0", 0 ),
+	PCI_ROM( 0x14e4, 0x16f1, "14e4-16F1", "14e4-16F1", 0 ),
+	PCI_ROM( 0x14e4, 0x1604, "14e4-1604", "14e4-1604", 0 ),
+	PCI_ROM( 0x14e4, 0x1605, "14e4-1605", "14e4-1605", 0 ),
+	PCI_ROM( 0x14e4, 0x1606, "14e4-1606", "14e4-1606", 0 ),
+	PCI_ROM( 0x14e4, 0x1609, "14e4-1609", "14e4-1609", 0 ),
+	PCI_ROM( 0x14e4, 0x1614, "14e4-1614", "14e4-1614", 0 ),
+	PCI_ROM( 0x14e4, 0xd802, "14e4-D802", "14e4-D802", 0 ),
+	PCI_ROM( 0x14e4, 0xd804, "14e4-D804", "14e4-D804", 0 ),
+	PCI_ROM( 0x14e4, 0x1750, "14e4-1750", "14e4-1750", 0 ),
+	PCI_ROM( 0x14e4, 0x1802, "14e4-1802", "14e4-1802", 0 ),
+	PCI_ROM( 0x14e4, 0x1805, "14e4-1805", "14e4-1805", 0 ),
+	PCI_ROM( 0x14e4, 0x1751, "14e4-1751", "14e4-1751", 0 ),
+	PCI_ROM( 0x14e4, 0x1801, "14e4-1801", "14e4-1801", 0 ),
+	PCI_ROM( 0x14e4, 0x1804, "14e4-1804", "14e4-1804", 0 ),
+	PCI_ROM( 0x14e4, 0x1752, "14e4-1752", "14e4-1752", 0 ),
+	PCI_ROM( 0x14e4, 0x1800, "14e4-1800", "14e4-1800", 0 ),
+	PCI_ROM( 0x14e4, 0x1803, "14e4-1803", "14e4-1803", 0 ),
+	PCI_ROM( 0x14e4, 0x1806, "14e4-1806", "14e4-1806", BNXT_FLAG_PCI_VF ),
+	PCI_ROM( 0x14e4, 0x1807, "14e4-1807", "14e4-1807", BNXT_FLAG_PCI_VF ),
+	PCI_ROM( 0x14e4, 0x1808, "14e4-1808", "14e4-1808", BNXT_FLAG_PCI_VF ),
+	PCI_ROM( 0x14e4, 0x1809, "14e4-1809", "14e4-1809", BNXT_FLAG_PCI_VF ),
+};
+
 /**
  * Check if Virtual Function
  */
 u8 bnxt_is_pci_vf ( struct pci_device *pdev )
 {
-	u16 i;
-
-	for ( i = 0; i < ARRAY_SIZE ( bnxt_vf_nics ); i++ ) {
-		if ( pdev->device == bnxt_vf_nics[i] )
-			return 1;
+	if ( FLAG_TEST ( pdev->id->driver_data, BNXT_FLAG_PCI_VF ) ) {
+		return 1;
 	}
 	return 0;
 }
diff --git a/src/drivers/net/bnxt/bnxt.h b/src/drivers/net/bnxt/bnxt.h
index 4cca07b..2cbaec5 100644
--- a/src/drivers/net/bnxt/bnxt.h
+++ b/src/drivers/net/bnxt/bnxt.h
@@ -51,6 +51,7 @@ union dma_addr64_t {
 #define BNXT_FLAG_MULTI_HOST                    0x0008
 #define BNXT_FLAG_NPAR_MODE                     0x0010
 #define BNXT_FLAG_ATOMICS_ENABLE                0x0020
+#define BNXT_FLAG_PCI_VF                        0x0040
 /*******************************************************************************
  * Status codes.
  ******************************************************************************/
@@ -867,140 +868,4 @@ struct bnxt {
 	FUNC_VF_CFG_REQ_ENABLES_ASYNC_EVENT_CR | \
 	FUNC_VF_CFG_REQ_ENABLES_DFLT_MAC_ADDR)
 
-/* Device ID's */
-#define PCI_VID_BCOM         0x14e4
 #define CHIP_NUM_57500       0x1750
-
-#define DID_57508            0x1750
-#define DID_57508_MF         0x1802
-#define DID_57508_MF_RDMA    0x1805
-#define DID_57504            0x1751
-#define DID_57504_MF         0x1801
-#define DID_57504_MF_RDMA    0x1804
-#define DID_57502            0x1752
-#define DID_57502_MF         0x1800
-#define DID_57502_MF_RDMA    0x1803
-#define DID_57508_VF         0x1806
-#define DID_57508_VF_RDMA    0x1807
-#define DID_57508_VF_HV      0x1806
-#define DID_57508_VF_RDMA_HV 0x1807
-/* Stratus Device IDs */
-#define DID_57320_1         0x16F0
-#define DID_57320_2         0x16F1
-#define DID_57454_MHB       0x1604
-#define DID_57454_MHB_RDMA  0x1605
-#define DID_57454_VF_RDMA   0x1606
-#define DID_57454_VF        0x1609
-#define DID_57454           0x1614
-#define DID_58802           0xD802
-#define DID_58804           0xD804
-
-#define DID_57417_RDMA_MF   0x16C0
-#define DID_57417_VF_RDMA   0x16c1
-#define DID_57301           0x16C8
-#define DID_57302           0x16C9
-#define DID_57304           0x16CA
-#define DID_57417_MF        0x16CC
-#define DID_58700           0x16CD
-#define DID_57311           0x16CE
-#define DID_57312           0x16CF
-#define DID_57402           0x16D0
-#define DID_57404           0x16D1
-#define DID_57406           0x16D2
-#define DID_57402_MF        0x16D4
-#define DID_57407C          0x16D5
-#define DID_57412           0x16D6
-#define DID_57414           0x16D7
-#define DID_57416C          0x16D8
-#define DID_57417C          0x16D9
-#define DID_57402L          0x16DA
-#define DID_57404L          0x16DB
-#define DID_57417_VF        0x16dc
-#define DID_57412_MF        0x16DE
-#define DID_57314           0x16DF
-#define DID_57317C          0x16E0
-#define DID_57417F          0x16E2
-#define DID_57416F          0x16E3
-#define DID_57317F          0x16E4
-#define DID_57404_MF        0x16E7
-#define DID_57406_MF        0x16E8
-#define DID_57407F          0x16E9
-#define DID_57407_MF        0x16EA
-#define DID_57412_RDMA_MF   0x16EB
-#define DID_57414_MF        0x16EC
-#define DID_57414_RDMA_MF   0x16ED
-#define DID_57416_MF        0x16EE
-#define DID_57416_RDMA_MF   0x16EF
-
-static struct pci_device_id bnxt_nics[] = {
-	PCI_ROM(PCI_VID_BCOM, DID_57417_RDMA_MF, "14e4-16C0", "14e4-16C0", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57417_VF_RDMA, "14e4-16C1", "14e4-16C1", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57301,         "14e4-16C8", "14e4-16C8", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57302,         "14e4-16C9", "14e4-16C9", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57304,         "14e4-16CA", "14e4-16CA", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57417_MF,      "14e4-16CC", "14e4-16CC", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_58700,         "14e4-16CD", "14e4-16CD", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57311,         "14e4-16CE", "14e4-16CE", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57312,         "14e4-16CF", "14e4-16CF", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57402,         "14e4-16D0", "14e4-16D0", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57404,         "14e4-16D1", "14e4-16D1", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57406,         "14e4-16D2", "14e4-16D2", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57402_MF,      "14e4-16D4", "14e4-16D4", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57407C,        "14e4-16D5", "14e4-16D5", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57412,         "14e4-16D6", "14e4-16D6", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57414,         "14e4-16D7", "14e4-16D7", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57416C,        "14e4-16D8", "14e4-16D8", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57417C,        "14e4-16D9", "14e4-16D9", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57402L,        "14e4-16DA", "14e4-16DA", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57404L,        "14e4-16DB", "14e4-16DB", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57417_VF,      "14e4-16DC", "14e4-16DC", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57412_MF,      "14e4-16DE", "14e4-16DE", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57314,         "14e4-16DF", "14e4-16DF", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57317C,        "14e4-16E0", "14e4-16E0", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57417F,        "14e4-16E2", "14e4-16E2", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57416F,        "14e4-16E3", "14e4-16E3", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57317F,        "14e4-16E4", "14e4-16E4", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57404_MF,      "14e4-16E7", "14e4-16E7", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57406_MF,      "14e4-16E8", "14e4-16E8", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57407F,        "14e4-16E9", "14e4-16E9", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57407_MF,      "14e4-16EA", "14e4-16EA", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57412_RDMA_MF, "14e4-16EB", "14e4-16EB", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57414_MF,      "14e4-16EC", "14e4-16EC", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57414_RDMA_MF, "14e4-16ED", "14e4-16ED", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57416_MF,      "14e4-16EE", "14e4-16EE", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57416_RDMA_MF, "14e4-16EF", "14e4-16EF", 0),
-
-	PCI_ROM(PCI_VID_BCOM, DID_57320_1,        "14e4-16F0", "14e4-16F0", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57320_2,        "14e4-16F1", "14e4-16F1", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57454_MHB,      "14e4-1604", "14e4-1604", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57454_MHB_RDMA, "14e4-1605", "14e4-1605", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57454_VF_RDMA,  "14e4-1606", "14e4-1606", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57454_VF,       "14e4-1609", "14e4-1609", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57454,          "14e4-1614", "14e4-1614", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_58802,          "14e4-D802", "14e4-D802", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_58804,          "14e4-D804", "14e4-D804", 0),
-
-	PCI_ROM(PCI_VID_BCOM, DID_57508,          "14e4-1750", "14e4-1750", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57508_MF,       "14e4-1802", "14e4-1802", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57508_MF_RDMA,  "14e4-1805", "14e4-1805", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57504,          "14e4-1751", "14e4-1751", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57504_MF,       "14e4-1801", "14e4-1801", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57504_MF_RDMA,  "14e4-1804", "14e4-1804", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57502,          "14e4-1752", "14e4-1752", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57502_MF,       "14e4-1800", "14e4-1800", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57502_MF_RDMA,  "14e4-1803", "14e4-1803", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57508_VF,       "14e4-1806", "14e4-1806", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57508_VF_RDMA,  "14e4-1807", "14e4-1807", 0),
-	PCI_ROM(PCI_VID_BCOM, DID_57508_VF_HV,    "14e4-1808", "14e4-1808", 0),
-	PCI_ROM(PCI_VID_BCOM,
-		DID_57508_VF_RDMA_HV, "14e4-1809", "14e4-1809", 0),
-};
-
-static u16 bnxt_vf_nics[] = {
-	DID_57508_VF,
-	DID_57508_VF_RDMA,
-	DID_57508_VF_HV,
-	DID_57508_VF_RDMA_HV,
-	DID_57417_VF,
-	DID_57417_VF_RDMA,
-};
diff --git a/src/drivers/net/ecm.c b/src/drivers/net/ecm.c
index 847a45b..826b3b1 100644
--- a/src/drivers/net/ecm.c
+++ b/src/drivers/net/ecm.c
@@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <ipxe/if_ether.h>
 #include <ipxe/base16.h>
 #include <ipxe/profile.h>
+#include <ipxe/acpimac.h>
 #include <ipxe/usb.h>
 #include "ecm.h"
 
@@ -81,17 +82,26 @@ ecm_ethernet_descriptor ( struct usb_configuration_descriptor *config,
 /**
  * Get hardware MAC address
  *
- * @v usb		USB device
+ * @v func		USB function
  * @v desc		Ethernet functional descriptor
  * @v hw_addr		Hardware address to fill in
  * @ret rc		Return status code
  */
-int ecm_fetch_mac ( struct usb_device *usb,
+int ecm_fetch_mac ( struct usb_function *func,
 		    struct ecm_ethernet_descriptor *desc, uint8_t *hw_addr ) {
+	struct usb_device *usb = func->usb;
 	char buf[ base16_encoded_len ( ETH_ALEN ) + 1 /* NUL */ ];
 	int len;
 	int rc;
 
+	/* Use system-specific MAC address, if present and not already used */
+	if ( ( ( rc = acpi_mac ( hw_addr ) ) == 0 ) &&
+	     ! find_netdev_by_ll_addr ( &ethernet_protocol, hw_addr ) ) {
+		DBGC ( usb, "USB %s using system-specific MAC %s\n",
+		       func->name, eth_ntoa ( hw_addr ) );
+		return 0;
+	}
+
 	/* Fetch MAC address string */
 	len = usb_get_string_descriptor ( usb, desc->mac, 0, buf,
 					  sizeof ( buf ) );
@@ -103,7 +113,7 @@ int ecm_fetch_mac ( struct usb_device *usb,
 	/* Sanity check */
 	if ( len != ( ( int ) ( sizeof ( buf ) - 1 /* NUL */ ) ) ) {
 		DBGC ( usb, "USB %s has invalid ECM MAC \"%s\"\n",
-		       usb->name, buf );
+		       func->name, buf );
 		return -EINVAL;
 	}
 
@@ -112,7 +122,7 @@ int ecm_fetch_mac ( struct usb_device *usb,
 	if ( len < 0 ) {
 		rc = len;
 		DBGC ( usb, "USB %s could not decode ECM MAC \"%s\": %s\n",
-		       usb->name, buf, strerror ( rc ) );
+		       func->name, buf, strerror ( rc ) );
 		return rc;
 	}
 
@@ -464,7 +474,7 @@ static int ecm_probe ( struct usb_function *func,
 	}
 
 	/* Fetch MAC address */
-	if ( ( rc = ecm_fetch_mac ( usb, ethernet, netdev->hw_addr ) ) != 0 ) {
+	if ( ( rc = ecm_fetch_mac ( func, ethernet, netdev->hw_addr ) ) != 0 ) {
 		DBGC ( ecm, "ECM %p could not fetch MAC address: %s\n",
 		       ecm, strerror ( rc ) );
 		goto err_fetch_mac;
diff --git a/src/drivers/net/ecm.h b/src/drivers/net/ecm.h
index 83d324b..0ad3ddb 100644
--- a/src/drivers/net/ecm.h
+++ b/src/drivers/net/ecm.h
@@ -86,7 +86,7 @@ struct ecm_device {
 extern struct ecm_ethernet_descriptor *
 ecm_ethernet_descriptor ( struct usb_configuration_descriptor *config,
 			  struct usb_interface_descriptor *interface );
-extern int ecm_fetch_mac ( struct usb_device *usb,
+extern int ecm_fetch_mac ( struct usb_function *func,
 			   struct ecm_ethernet_descriptor *desc,
 			   uint8_t *hw_addr );
 
diff --git a/src/drivers/net/efi/nii.c b/src/drivers/net/efi/nii.c
index b9f3465..833462e 100644
--- a/src/drivers/net/efi/nii.c
+++ b/src/drivers/net/efi/nii.c
@@ -576,7 +576,7 @@ static int nii_issue_cpb_db ( struct nii_nic *nii, unsigned int op, void *cpb,
 	cdb.IFnum = nii->nii->IfNum;
 
 	/* Raise task priority level */
-	tpl = bs->RaiseTPL ( TPL_CALLBACK );
+	tpl = bs->RaiseTPL ( efi_internal_tpl );
 
 	/* Issue command */
 	DBGC2 ( nii, "NII %s issuing %02x:%04x ifnum %d%s%s\n",
diff --git a/src/drivers/net/efi/snpnet.c b/src/drivers/net/efi/snpnet.c
index fb52402..69ec6f5 100644
--- a/src/drivers/net/efi/snpnet.c
+++ b/src/drivers/net/efi/snpnet.c
@@ -164,6 +164,10 @@ static int snpnet_transmit ( struct net_device *netdev,
 	EFI_STATUS efirc;
 	int rc;
 
+	/* Do nothing if shutdown is in progress */
+	if ( efi_shutdown_in_progress )
+		return -ECANCELED;
+
 	/* Defer the packet if there is already a transmission in progress */
 	if ( snp->txbuf ) {
 		netdev_tx_defer ( netdev, iobuf );
@@ -283,6 +287,10 @@ static void snpnet_poll_rx ( struct net_device *netdev ) {
  */
 static void snpnet_poll ( struct net_device *netdev ) {
 
+	/* Do nothing if shutdown is in progress */
+	if ( efi_shutdown_in_progress )
+		return;
+
 	/* Process any TX completions */
 	snpnet_poll_tx ( netdev );
 
@@ -426,8 +434,9 @@ static void snpnet_close ( struct net_device *netdev ) {
 	EFI_STATUS efirc;
 	int rc;
 
-	/* Shut down NIC */
-	if ( ( efirc = snp->snp->Shutdown ( snp->snp ) ) != 0 ) {
+	/* Shut down NIC (unless whole system shutdown is in progress) */
+	if ( ( ! efi_shutdown_in_progress ) &&
+	     ( ( efirc = snp->snp->Shutdown ( snp->snp ) ) != 0 ) ) {
 		rc = -EEFI ( efirc );
 		DBGC ( snp, "SNP %s could not shut down: %s\n",
 		       netdev->name, strerror ( rc ) );
@@ -589,8 +598,9 @@ void snpnet_stop ( struct efi_device *efidev ) {
 	/* Unregister network device */
 	unregister_netdev ( netdev );
 
-	/* Stop SNP protocol */
-	if ( ( efirc = snp->snp->Stop ( snp->snp ) ) != 0 ) {
+	/* Stop SNP protocol (unless whole system shutdown is in progress) */
+	if ( ( ! efi_shutdown_in_progress ) &&
+	     ( ( efirc = snp->snp->Stop ( snp->snp ) ) != 0 ) ) {
 		rc = -EEFI ( efirc );
 		DBGC ( device, "SNP %s could not stop: %s\n",
 		       efi_handle_name ( device ), strerror ( rc ) );
diff --git a/src/drivers/net/intel.c b/src/drivers/net/intel.c
index 8349296..ea3ebf6 100644
--- a/src/drivers/net/intel.c
+++ b/src/drivers/net/intel.c
@@ -1025,6 +1025,12 @@ static struct pci_device_id intel_nics[] = {
 	PCI_ROM ( 0x8086, 0x043a, "dh8900cc-f", "DH8900CC Fiber", 0 ),
 	PCI_ROM ( 0x8086, 0x043c, "dh8900cc-b", "DH8900CC Backplane", 0 ),
 	PCI_ROM ( 0x8086, 0x0440, "dh8900cc-s", "DH8900CC SFP", 0 ),
+	PCI_ROM ( 0x8086, 0x0d4c, "i219lm-11", "I219-LM (11)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x0d4d, "i219v-11", "I219-V (11)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x0d4e, "i219lm-10", "I219-LM (10)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x0d4f, "i219v-10", "I219-V (10)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x0d53, "i219lm-12", "I219-LM (12)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x0d55, "i219v-12", "I219-V (12)", INTEL_I219 ),
 	PCI_ROM ( 0x8086, 0x1000, "82542-f", "82542 (Fiber)", 0 ),
 	PCI_ROM ( 0x8086, 0x1001, "82543gc-f", "82543GC (Fiber)", 0 ),
 	PCI_ROM ( 0x8086, 0x1004, "82543gc", "82543GC (Copper)", 0 ),
@@ -1161,6 +1167,12 @@ static struct pci_device_id intel_nics[] = {
 	PCI_ROM ( 0x8086, 0x15e1, "i219lm-9", "I219-LM (9)", INTEL_I219 ),
 	PCI_ROM ( 0x8086, 0x15e2, "i219v-9", "I219-V (9)", INTEL_I219 ),
 	PCI_ROM ( 0x8086, 0x15e3, "i219lm-5", "I219-LM (5)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15f4, "i219lm-15", "I219-LM (15)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15f5, "i219v-15", "I219-V (15)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15f9, "i219lm-14", "I219-LM (14)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15fa, "i219v-14", "I219-V (14)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15fb, "i219lm-13", "I219-LM (13)", INTEL_I219 ),
+	PCI_ROM ( 0x8086, 0x15fc, "i219v-13", "I219-V (13)", INTEL_I219 ),
 	PCI_ROM ( 0x8086, 0x1f41, "i354", "I354", INTEL_NO_ASDE ),
 	PCI_ROM ( 0x8086, 0x294c, "82566dc-2", "82566DC-2", 0 ),
 	PCI_ROM ( 0x8086, 0x2e6e, "cemedia", "CE Media Processor", 0 ),
diff --git a/src/drivers/net/intelx.c b/src/drivers/net/intelx.c
index ccf6b06..f4dad88 100644
--- a/src/drivers/net/intelx.c
+++ b/src/drivers/net/intelx.c
@@ -481,6 +481,7 @@ static struct pci_device_id intelx_nics[] = {
 	PCI_ROM ( 0x8086, 0x15ab, "x552", "X552", 0 ),
 	PCI_ROM ( 0x8086, 0x15c8, "x553t", "X553/X557-AT", 0 ),
 	PCI_ROM ( 0x8086, 0x15ce, "x553-sfp", "X553 (SFP+)", 0 ),
+	PCI_ROM ( 0x8086, 0x15e4, "x553a", "X553", 0 ),
 	PCI_ROM ( 0x8086, 0x15e5, "x553", "X553", 0 ),
 };
 
diff --git a/src/drivers/net/ncm.c b/src/drivers/net/ncm.c
index cc07a43..1e8088d 100644
--- a/src/drivers/net/ncm.c
+++ b/src/drivers/net/ncm.c
@@ -598,7 +598,7 @@ static int ncm_probe ( struct usb_function *func,
 	}
 
 	/* Fetch MAC address */
-	if ( ( rc = ecm_fetch_mac ( usb, ethernet, netdev->hw_addr ) ) != 0 ) {
+	if ( ( rc = ecm_fetch_mac ( func, ethernet, netdev->hw_addr ) ) != 0 ) {
 		DBGC ( ncm, "NCM %p could not fetch MAC address: %s\n",
 		       ncm, strerror ( rc ) );
 		goto err_fetch_mac;
diff --git a/src/drivers/net/rdc.c b/src/drivers/net/rdc.c
new file mode 100644
index 0000000..c3239c0
--- /dev/null
+++ b/src/drivers/net/rdc.c
@@ -0,0 +1,694 @@
+/*
+ * Copyright (C) 2021 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <byteswap.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/ethernet.h>
+#include <ipxe/if_ether.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/malloc.h>
+#include <ipxe/pci.h>
+#include "rdc.h"
+
+/** @file
+ *
+ * RDC R6040 network driver
+ *
+ */
+
+/******************************************************************************
+ *
+ * Device reset
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Reset hardware
+ *
+ * @v rdc		RDC device
+ * @ret rc		Return status code
+ */
+static int rdc_reset ( struct rdc_nic *rdc ) {
+	unsigned int i;
+
+	/* Reset NIC */
+	writew ( RDC_MCR1_RST, rdc->regs + RDC_MCR1 );
+
+	/* Wait for reset to complete */
+	for ( i = 0 ; i < RDC_RESET_MAX_WAIT_MS ; i++ ) {
+
+		/* Check for reset completion */
+		if ( readw ( rdc->regs + RDC_MCR1 ) & RDC_MCR1_RST ) {
+			mdelay ( 1 );
+			continue;
+		}
+
+		/* Reset internal state machine */
+		writew ( RDC_MACSM_RST, rdc->regs + RDC_MACSM );
+		writew ( 0, rdc->regs + RDC_MACSM );
+		mdelay ( RDC_MACSM_RESET_DELAY_MS );
+
+		return 0;
+	}
+
+	DBGC ( rdc, "RDC %p timed out waiting for reset\n", rdc );
+	return -ETIMEDOUT;
+}
+
+/******************************************************************************
+ *
+ * MII interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Read from MII register
+ *
+ * @v mdio		MII interface
+ * @v phy		PHY address
+ * @v reg		Register address
+ * @ret value		Data read, or negative error
+ */
+static int rdc_mii_read ( struct mii_interface *mdio, unsigned int phy,
+			  unsigned int reg ) {
+	struct rdc_nic *rdc = container_of ( mdio, struct rdc_nic, mdio );
+	uint16_t mmdio;
+	unsigned int i;
+
+	/* Initiate read */
+	mmdio = ( RDC_MMDIO_MIIRD | RDC_MMDIO_PHYAD ( phy ) |
+		  RDC_MMDIO_REGAD ( reg ) );
+	writew ( mmdio, rdc->regs + RDC_MMDIO );
+
+	/* Wait for read to complete */
+	for ( i = 0 ; i < RDC_MII_MAX_WAIT_US ; i++ ) {
+
+		/* Check for read completion */
+		if ( readw ( rdc->regs + RDC_MMDIO ) & RDC_MMDIO_MIIRD ) {
+			udelay ( 1 );
+			continue;
+		}
+
+		/* Return register value */
+		return ( readw ( rdc->regs + RDC_MMRD ) );
+	}
+
+	DBGC ( rdc, "RDC %p timed out waiting for MII read\n", rdc );
+	return -ETIMEDOUT;
+}
+
+/**
+ * Write to MII register
+ *
+ * @v mdio		MII interface
+ * @v phy		PHY address
+ * @v reg		Register address
+ * @v data		Data to write
+ * @ret rc		Return status code
+ */
+static int rdc_mii_write ( struct mii_interface *mdio, unsigned int phy,
+			   unsigned int reg, unsigned int data ) {
+	struct rdc_nic *rdc = container_of ( mdio, struct rdc_nic, mdio );
+	uint16_t mmdio;
+	unsigned int i;
+
+	/* Initiate write */
+	mmdio = ( RDC_MMDIO_MIIWR | RDC_MMDIO_PHYAD ( phy ) |
+		  RDC_MMDIO_REGAD ( reg ) );
+	writew ( data, rdc->regs + RDC_MMWD );
+	writew ( mmdio, rdc->regs + RDC_MMDIO );
+
+	/* Wait for write to complete */
+	for ( i = 0 ; i < RDC_MII_MAX_WAIT_US ; i++ ) {
+
+		/* Check for write completion */
+		if ( readw ( rdc->regs + RDC_MMDIO ) & RDC_MMDIO_MIIWR ) {
+			udelay ( 1 );
+			continue;
+		}
+
+		return 0;
+	}
+
+	DBGC ( rdc, "RDC %p timed out waiting for MII write\n", rdc );
+	return -ETIMEDOUT;
+}
+
+/** RDC MII operations */
+static struct mii_operations rdc_mii_operations = {
+	.read = rdc_mii_read,
+	.write = rdc_mii_write,
+};
+
+/******************************************************************************
+ *
+ * Link state
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Initialise PHY
+ *
+ * @v rdc		RDC device
+ * @ret rc		Return status code
+ */
+static int rdc_init_phy ( struct rdc_nic *rdc ) {
+	int rc;
+
+	/* Find PHY address */
+	if ( ( rc = mii_find ( &rdc->mii ) ) != 0 ) {
+		DBGC ( rdc, "RDC %p could not find PHY address: %s\n",
+		       rdc, strerror ( rc ) );
+		return rc;
+	}
+
+	/* Reset PHY */
+	if ( ( rc = mii_reset ( &rdc->mii ) ) != 0 ) {
+		DBGC ( rdc, "RDC %p could not reset PHY: %s\n",
+		       rdc, strerror ( rc ) );
+		return rc;
+	}
+
+	return 0;
+}
+
+/**
+ * Check link state
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int rdc_check_link ( struct net_device *netdev ) {
+	struct rdc_nic *rdc = netdev->priv;
+	int rc;
+
+	/* Check link state */
+	if ( ( rc = mii_check_link ( &rdc->mii, netdev ) ) != 0 ) {
+		DBGC ( rdc, "RDC %p could not check link: %s\n",
+		       rdc, strerror ( rc ) );
+		return rc;
+	}
+
+	return 0;
+}
+
+/******************************************************************************
+ *
+ * Network device interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Create descriptor ring
+ *
+ * @v rdc		RDC device
+ * @v ring		Descriptor ring
+ * @ret rc		Return status code
+ */
+static int rdc_create_ring ( struct rdc_nic *rdc, struct rdc_ring *ring ) {
+	size_t len = ( ring->count * sizeof ( ring->desc[0] ) );
+	struct rdc_descriptor *desc;
+	struct rdc_descriptor *next;
+	physaddr_t start;
+	unsigned int i;
+
+	/* Allocate descriptor ring */
+	ring->desc = dma_alloc ( rdc->dma, &ring->map, len, len );
+	if ( ! ring->desc )
+		return -ENOMEM;
+
+	/* Initialise descriptor ring */
+	memset ( ring->desc, 0, len );
+	for ( i = 0 ; i < ring->count ; i++ ) {
+		desc = &ring->desc[i];
+		next = &ring->desc[ ( i + 1 ) & ( ring->count - 1 ) ];
+		desc->next = cpu_to_le32 ( dma ( &ring->map, next ) );
+	}
+
+	/* Program ring address */
+	start = dma ( &ring->map, ring->desc );
+	writew ( ( start >> 0 ), ( rdc->regs + ring->reg + RDC_MxDSA_LO ) );
+	writew ( ( start >> 16 ), ( rdc->regs + ring->reg + RDC_MxDSA_HI ) );
+
+	DBGC ( rdc, "RDC %p ring %#02x is at [%08lx,%08lx)\n",
+	       rdc, ring->reg, virt_to_phys ( ring->desc ),
+	       ( virt_to_phys ( ring->desc ) + len ) );
+	return 0;
+}
+
+/**
+ * Destroy descriptor ring
+ *
+ * @v rdc		RDC device
+ * @v ring		Descriptor ring
+ */
+static void rdc_destroy_ring ( struct rdc_nic *rdc, struct rdc_ring *ring ) {
+	size_t len = ( ring->count * sizeof ( ring->desc[0] ) );
+
+	/* Clear ring address */
+	writew ( 0, ( rdc->regs + ring->reg + RDC_MxDSA_LO ) );
+	writew ( 0, ( rdc->regs + ring->reg + RDC_MxDSA_HI ) );
+
+	/* Free descriptors */
+	dma_free ( &ring->map, ring->desc, len );
+	ring->desc = NULL;
+
+	/* Reset ring */
+	ring->prod = 0;
+	ring->cons = 0;
+}
+
+/**
+ * Refill receive descriptor ring
+ *
+ * @v rdc		RDC device
+ */
+static void rdc_refill_rx ( struct rdc_nic *rdc ) {
+	struct rdc_descriptor *rx;
+	struct io_buffer *iobuf;
+	unsigned int rx_idx;
+
+	/* Refill ring */
+	while ( ( rdc->rx.prod - rdc->rx.cons ) < RDC_NUM_RX_DESC ) {
+
+		/* Allocate I/O buffer */
+		iobuf = alloc_rx_iob ( RDC_RX_MAX_LEN, rdc->dma );
+		if ( ! iobuf ) {
+			/* Wait for next refill */
+			break;
+		}
+
+		/* Get next receive descriptor */
+		rx_idx = ( rdc->rx.prod++ % RDC_NUM_RX_DESC );
+		rx = &rdc->rx.desc[rx_idx];
+
+		/* Populate receive descriptor */
+		rx->len = cpu_to_le16 ( RDC_RX_MAX_LEN );
+		rx->addr = cpu_to_le32 ( iob_dma ( iobuf ) );
+		wmb();
+		rx->flags = cpu_to_le16 ( RDC_FL_OWNED );
+
+		/* Record I/O buffer */
+		assert ( rdc->rx_iobuf[rx_idx] == NULL );
+		rdc->rx_iobuf[rx_idx] = iobuf;
+
+		DBGC2 ( rdc, "RDC %p RX %d is [%lx,%lx)\n",
+			rdc, rx_idx, virt_to_phys ( iobuf->data ),
+			( virt_to_phys ( iobuf->data ) + RDC_RX_MAX_LEN ) );
+	}
+}
+
+/**
+ * Open network device
+ *
+ * @v netdev		Network device
+ * @ret rc		Return status code
+ */
+static int rdc_open ( struct net_device *netdev ) {
+	struct rdc_nic *rdc = netdev->priv;
+	int rc;
+
+	/* Create transmit descriptor ring */
+	if ( ( rc = rdc_create_ring ( rdc, &rdc->tx ) ) != 0 )
+		goto err_create_tx;
+
+	/* Create receive descriptor ring */
+	if ( ( rc = rdc_create_ring ( rdc, &rdc->rx ) ) != 0 )
+		goto err_create_rx;
+
+	/* Program receive buffer length */
+	writew ( RDC_RX_MAX_LEN, rdc->regs + RDC_MRBSR );
+
+	/* Enable transmit and receive */
+	writew ( ( RDC_MCR0_FD | RDC_MCR0_TXEN | RDC_MCR0_PROMISC |
+		   RDC_MCR0_RXEN ),
+		 rdc->regs + RDC_MCR0 );
+
+	/* Enable PHY status polling */
+	writew ( ( RDC_MPSCCR_EN | RDC_MPSCCR_PHYAD ( rdc->mii.address ) |
+		   RDC_MPSCCR_SLOW ),
+		 rdc->regs + RDC_MPSCCR );
+
+	/* Fill receive ring */
+	rdc_refill_rx ( rdc );
+
+	/* Update link state */
+	rdc_check_link ( netdev );
+
+	return 0;
+
+	rdc_destroy_ring ( rdc, &rdc->rx );
+ err_create_rx:
+	rdc_destroy_ring ( rdc, &rdc->tx );
+ err_create_tx:
+	return rc;
+}
+
+/**
+ * Close network device
+ *
+ * @v netdev		Network device
+ */
+static void rdc_close ( struct net_device *netdev ) {
+	struct rdc_nic *rdc = netdev->priv;
+	unsigned int i;
+
+	/* Disable NIC */
+	writew ( 0, rdc->regs + RDC_MCR0 );
+
+	/* Destroy receive descriptor ring */
+	rdc_destroy_ring ( rdc, &rdc->rx );
+
+	/* Discard any unused receive buffers */
+	for ( i = 0 ; i < RDC_NUM_RX_DESC ; i++ ) {
+		if ( rdc->rx_iobuf[i] )
+			free_rx_iob ( rdc->rx_iobuf[i] );
+		rdc->rx_iobuf[i] = NULL;
+	}
+
+	/* Destroy transmit descriptor ring */
+	rdc_destroy_ring ( rdc, &rdc->tx );
+}
+
+/**
+ * Transmit packet
+ *
+ * @v netdev		Network device
+ * @v iobuf		I/O buffer
+ * @ret rc		Return status code
+ */
+static int rdc_transmit ( struct net_device *netdev, struct io_buffer *iobuf ) {
+	struct rdc_nic *rdc = netdev->priv;
+	struct rdc_descriptor *tx;
+	unsigned int tx_idx;
+	int rc;
+
+	/* Get next transmit descriptor */
+	if ( ( rdc->tx.prod - rdc->tx.cons ) >= RDC_NUM_TX_DESC ) {
+		DBGC ( rdc, "RDC %p out of transmit descriptors\n", rdc );
+		return -ENOBUFS;
+	}
+	tx_idx = ( rdc->tx.prod % RDC_NUM_TX_DESC );
+	tx = &rdc->tx.desc[tx_idx];
+
+	/* Pad to minimum length */
+	iob_pad ( iobuf, ETH_ZLEN );
+
+	/* Map I/O buffer */
+	if ( ( rc = iob_map_tx ( iobuf, rdc->dma ) ) != 0 )
+		return rc;
+
+	/* Update producer index */
+	rdc->tx.prod++;
+
+	/* Populate transmit descriptor */
+	tx->len = cpu_to_le16 ( iob_len ( iobuf ) );
+	tx->addr = cpu_to_le32 ( iob_dma ( iobuf ) );
+	wmb();
+	tx->flags = cpu_to_le16 ( RDC_FL_OWNED );
+	wmb();
+
+	/* Notify card that there are packets ready to transmit */
+	writew ( RDC_MTPR_TM2TX, rdc->regs + RDC_MTPR );
+
+	return 0;
+}
+
+/**
+ * Poll for completed packets
+ *
+ * @v netdev		Network device
+ */
+static void rdc_poll_tx ( struct net_device *netdev ) {
+	struct rdc_nic *rdc = netdev->priv;
+	struct rdc_descriptor *tx;
+	unsigned int tx_idx;
+
+	/* Check for completed packets */
+	while ( rdc->tx.cons != rdc->tx.prod ) {
+
+		/* Get next transmit descriptor */
+		tx_idx = ( rdc->tx.cons % RDC_NUM_TX_DESC );
+		tx = &rdc->tx.desc[tx_idx];
+
+		/* Stop if descriptor is still in use */
+		if ( tx->flags & cpu_to_le16 ( RDC_FL_OWNED ) )
+			return;
+		DBGC2 ( rdc, "RDC %p TX %d complete\n", rdc, tx_idx );
+
+		/* Complete transmit descriptor */
+		rdc->tx.cons++;
+		netdev_tx_complete_next ( netdev );
+	}
+}
+
+/**
+ * Poll for received packets
+ *
+ * @v netdev		Network device
+ */
+static void rdc_poll_rx ( struct net_device *netdev ) {
+	struct rdc_nic *rdc = netdev->priv;
+	struct rdc_descriptor *rx;
+	struct io_buffer *iobuf;
+	unsigned int rx_idx;
+	size_t len;
+
+	/* Check for received packets */
+	while ( rdc->rx.cons != rdc->rx.prod ) {
+
+		/* Get next receive descriptor */
+		rx_idx = ( rdc->rx.cons % RDC_NUM_RX_DESC );
+		rx = &rdc->rx.desc[rx_idx];
+
+		/* Stop if descriptor is still in use */
+		if ( rx->flags & cpu_to_le16 ( RDC_FL_OWNED ) )
+			return;
+
+		/* Populate I/O buffer */
+		iobuf = rdc->rx_iobuf[rx_idx];
+		rdc->rx_iobuf[rx_idx] = NULL;
+		len = le16_to_cpu ( rx->len );
+		iob_put ( iobuf, len );
+		iob_unput ( iobuf, 4 /* strip CRC */ );
+
+		/* Hand off to network stack */
+		if ( rx->flags & cpu_to_le16 ( RDC_FL_OK ) ) {
+			DBGC2 ( rdc, "RDC %p RX %d complete (length %zd)\n",
+				rdc, rx_idx, len );
+			netdev_rx ( netdev, iobuf );
+		} else {
+			DBGC2 ( rdc, "RDC %p RX %d error (length %zd, "
+				"flags %#04x)\n", rdc, rx_idx, len,
+				le16_to_cpu ( rx->flags ) );
+			netdev_rx_err ( netdev, iobuf, -EIO );
+		}
+		rdc->rx.cons++;
+	}
+}
+
+/**
+ * Poll for completed and received packets
+ *
+ * @v netdev		Network device
+ */
+static void rdc_poll ( struct net_device *netdev ) {
+	struct rdc_nic *rdc = netdev->priv;
+	uint16_t misr;
+
+	/* Check for (and acknowledge) interrupts */
+	misr = readw ( rdc->regs + RDC_MISR );
+
+	/* Poll for TX completions, if applicable */
+	if ( misr & RDC_MIRQ_TX )
+		rdc_poll_tx ( netdev );
+
+	/* Poll for RX completions, if applicable */
+	if ( misr & RDC_MIRQ_RX )
+		rdc_poll_rx ( netdev );
+
+	/* Check link state, if applicable */
+	if ( misr & RDC_MIRQ_LINK )
+		rdc_check_link ( netdev );
+
+	/* Check for unexpected interrupts */
+	if ( misr & ~( RDC_MIRQ_LINK | RDC_MIRQ_TX | RDC_MIRQ_RX_EARLY |
+		       RDC_MIRQ_RX_EMPTY | RDC_MIRQ_RX ) ) {
+		DBGC ( rdc, "RDC %p unexpected MISR %#04x\n", rdc, misr );
+		/* Report as a TX error */
+		netdev_tx_err ( netdev, NULL, -ENOTSUP );
+	}
+
+	/* Refill receive ring */
+	rdc_refill_rx ( rdc );
+}
+
+/**
+ * Enable or disable interrupts
+ *
+ * @v netdev		Network device
+ * @v enable		Interrupts should be enabled
+ */
+static void rdc_irq ( struct net_device *netdev, int enable ) {
+	struct rdc_nic *rdc = netdev->priv;
+	uint16_t mier;
+
+	/* Enable/disable interrupts */
+	mier = ( enable ? ( RDC_MIRQ_LINK | RDC_MIRQ_TX | RDC_MIRQ_RX ) : 0 );
+	writew ( mier, rdc->regs + RDC_MIER );
+}
+
+/** RDC network device operations */
+static struct net_device_operations rdc_operations = {
+	.open		= rdc_open,
+	.close		= rdc_close,
+	.transmit	= rdc_transmit,
+	.poll		= rdc_poll,
+	.irq		= rdc_irq,
+};
+
+/******************************************************************************
+ *
+ * PCI interface
+ *
+ ******************************************************************************
+ */
+
+/**
+ * Probe PCI device
+ *
+ * @v pci		PCI device
+ * @ret rc		Return status code
+ */
+static int rdc_probe ( struct pci_device *pci ) {
+	struct net_device *netdev;
+	struct rdc_nic *rdc;
+	union rdc_mac mac;
+	int rc;
+
+	/* Allocate and initialise net device */
+	netdev = alloc_etherdev ( sizeof ( *rdc ) );
+	if ( ! netdev ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+	netdev_init ( netdev, &rdc_operations );
+	rdc = netdev->priv;
+	pci_set_drvdata ( pci, netdev );
+	netdev->dev = &pci->dev;
+	memset ( rdc, 0, sizeof ( *rdc ) );
+	rdc->dma = &pci->dma;
+	mdio_init ( &rdc->mdio, &rdc_mii_operations );
+	mii_init ( &rdc->mii, &rdc->mdio, 0 );
+	rdc_init_ring ( &rdc->tx, RDC_NUM_TX_DESC, RDC_MTDSA );
+	rdc_init_ring ( &rdc->rx, RDC_NUM_RX_DESC, RDC_MRDSA );
+
+	/* Fix up PCI device */
+	adjust_pci_device ( pci );
+
+	/* Map registers */
+	rdc->regs = pci_ioremap ( pci, pci->membase, RDC_BAR_SIZE );
+	if ( ! rdc->regs ) {
+		rc = -ENODEV;
+		goto err_ioremap;
+	}
+
+	/* Fetch MAC address */
+	mac.mid[0] = cpu_to_le16 ( readw ( rdc->regs + RDC_MID0 ) );
+	mac.mid[1] = cpu_to_le16 ( readw ( rdc->regs + RDC_MID1 ) );
+	mac.mid[2] = cpu_to_le16 ( readw ( rdc->regs + RDC_MID2 ) );
+	memcpy ( netdev->hw_addr, mac.raw, ETH_ALEN );
+
+	/* Reset the NIC */
+	if ( ( rc = rdc_reset ( rdc ) ) != 0 )
+		goto err_reset;
+
+	/* Initialise PHY */
+	if ( ( rc = rdc_init_phy ( rdc ) ) != 0 )
+		goto err_init_phy;
+
+	/* Register network device */
+	if ( ( rc = register_netdev ( netdev ) ) != 0 )
+		goto err_register_netdev;
+
+	/* Set initial link state */
+	rdc_check_link ( netdev );
+
+	return 0;
+
+	unregister_netdev ( netdev );
+ err_register_netdev:
+ err_init_phy:
+	rdc_reset ( rdc );
+ err_reset:
+	iounmap ( rdc->regs );
+ err_ioremap:
+	netdev_nullify ( netdev );
+	netdev_put ( netdev );
+ err_alloc:
+	return rc;
+}
+
+/**
+ * Remove PCI device
+ *
+ * @v pci		PCI device
+ */
+static void rdc_remove ( struct pci_device *pci ) {
+	struct net_device *netdev = pci_get_drvdata ( pci );
+	struct rdc_nic *rdc = netdev->priv;
+
+	/* Unregister network device */
+	unregister_netdev ( netdev );
+
+	/* Reset card */
+	rdc_reset ( rdc );
+
+	/* Free network device */
+	iounmap ( rdc->regs );
+	netdev_nullify ( netdev );
+	netdev_put ( netdev );
+}
+
+/** RDC PCI device IDs */
+static struct pci_device_id rdc_nics[] = {
+	PCI_ROM ( 0x17f3, 0x6040, "r6040", "RDC R6040", 0 ),
+};
+
+/** RDC PCI driver */
+struct pci_driver rdc_driver __pci_driver = {
+	.ids = rdc_nics,
+	.id_count = ( sizeof ( rdc_nics ) / sizeof ( rdc_nics[0] ) ),
+	.probe = rdc_probe,
+	.remove = rdc_remove,
+};
diff --git a/src/drivers/net/rdc.h b/src/drivers/net/rdc.h
new file mode 100644
index 0000000..ee1671f
--- /dev/null
+++ b/src/drivers/net/rdc.h
@@ -0,0 +1,194 @@
+#ifndef _RDC_H
+#define _RDC_H
+
+/** @file
+ *
+ * RDC R6040 network driver
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <ipxe/if_ether.h>
+#include <ipxe/mii.h>
+
+/** RDC BAR size */
+#define RDC_BAR_SIZE 256
+
+/** An RDC descriptor */
+struct rdc_descriptor {
+	/** Flags */
+	uint16_t flags;
+	/** Length */
+	uint16_t len;
+	/** Address */
+	uint32_t addr;
+	/** Next descriptor */
+	uint32_t next;
+	/** Reserved */
+	uint32_t reserved;
+} __attribute__ (( packed ));
+
+/** Descriptor is owned by NIC */
+#define RDC_FL_OWNED 0x8000
+
+/** Packet OK */
+#define RDC_FL_OK 0x4000
+
+/** MAC control register 0 */
+#define RDC_MCR0 0x00
+#define RDC_MCR0_FD		0x8000	/**< Full duplex */
+#define RDC_MCR0_TXEN		0x1000	/**< Transmit enable */
+#define RDC_MCR0_PROMISC	0x0020	/**< Promiscuous mode */
+#define RDC_MCR0_RXEN		0x0002	/**< Receive enable */
+
+/** MAC control register 1 */
+#define RDC_MCR1 0x04
+#define RDC_MCR1_RST		0x0001	/**< MAC reset */
+
+/** Maximum time to wait for reset */
+#define RDC_RESET_MAX_WAIT_MS 10
+
+/** MAC transmit poll command register */
+#define RDC_MTPR 0x14
+#define RDC_MTPR_TM2TX		0x0001	/**< Trigger MAC to transmit */
+
+/** MAC receive buffer size register */
+#define RDC_MRBSR 0x18
+
+/** MAC MDIO control register */
+#define RDC_MMDIO 0x20
+#define RDC_MMDIO_MIIWR		0x4000	/**< MDIO write */
+#define RDC_MMDIO_MIIRD		0x2000	/**< MDIO read */
+#define RDC_MMDIO_PHYAD(x) ( (x) << 8 )	/**< PHY address */
+#define RDC_MMDIO_REGAD(x) ( (x) << 0 )	/**< Register address */
+
+/** Maximum time to wait for an MII read or write */
+#define RDC_MII_MAX_WAIT_US 2048
+
+/** MAC MDIO read data register */
+#define RDC_MMRD 0x24
+
+/** MAC MDIO write data register */
+#define RDC_MMWD 0x28
+
+/** MAC transmit descriptor start address */
+#define RDC_MTDSA 0x2c
+
+/** MAC receive descriptor start address */
+#define RDC_MRDSA 0x34
+
+/** MAC descriptor start address low half */
+#define RDC_MxDSA_LO 0x0
+
+/** MAC descriptor start address low half */
+#define RDC_MxDSA_HI 0x4
+
+/** MAC interrupt status register */
+#define RDC_MISR 0x3c
+#define RDC_MIRQ_LINK		0x0200	/**< Link status changed */
+#define RDC_MIRQ_TX		0x0010	/**< Transmit complete */
+#define RDC_MIRQ_RX_EARLY	0x0008	/**< Receive early interrupt */
+#define RDC_MIRQ_RX_EMPTY	0x0002	/**< Receive descriptor unavailable */
+#define RDC_MIRQ_RX		0x0001	/**< Receive complete */
+
+/** MAC interrupt enable register */
+#define RDC_MIER 0x40
+
+/** MAC address word 0 */
+#define RDC_MID0 0x68
+
+/** MAC address word 1 */
+#define RDC_MID1 0x6a
+
+/** MAC address word 2 */
+#define RDC_MID2 0x6c
+
+/** MAC PHY status change configuration register */
+#define RDC_MPSCCR 0x88
+#define RDC_MPSCCR_EN		0x8000	/**< PHY status change enable */
+#define RDC_MPSCCR_PHYAD(x) ( (x) << 8 ) /**< PHY address */
+#define RDC_MPSCCR_SLOW		0x0007	/**< Poll slowly */
+
+/** MAC state machine register */
+#define RDC_MACSM 0xac
+#define RDC_MACSM_RST		0x0002	/**< Reset state machine */
+
+/** Time to wait after resetting MAC state machine */
+#define RDC_MACSM_RESET_DELAY_MS 10
+
+/** A MAC address */
+union rdc_mac {
+	/** Raw bytes */
+	uint8_t raw[ETH_ALEN];
+	/** MIDx registers */
+	uint16_t mid[ ETH_ALEN / 2 ];
+};
+
+/** A descriptor ring */
+struct rdc_ring {
+	/** Descriptors */
+	struct rdc_descriptor *desc;
+	/** Descriptor ring DMA mapping */
+	struct dma_mapping map;
+	/** Producer index */
+	unsigned int prod;
+	/** Consumer index */
+	unsigned int cons;
+
+	/** Number of descriptors */
+	unsigned int count;
+	/** Start address register 0 */
+	unsigned int reg;
+};
+
+/**
+ * Initialise descriptor ring
+ *
+ * @v ring		Descriptor ring
+ * @v count		Number of descriptors
+ * @v reg		Start address register 0
+ */
+static inline __attribute__ (( always_inline )) void
+rdc_init_ring ( struct rdc_ring *ring, unsigned int count, unsigned int reg ) {
+
+	ring->count = count;
+	ring->reg = reg;
+}
+
+/** Number of transmit descriptors
+ *
+ * This is a policy decision.
+ */
+#define RDC_NUM_TX_DESC 16
+
+/** Number of receive descriptors
+ *
+ * This is a policy decision.
+ */
+#define RDC_NUM_RX_DESC 8
+
+/** Receive buffer length */
+#define RDC_RX_MAX_LEN ( ETH_FRAME_LEN + 4 /* VLAN */ + 4 /* CRC */ )
+
+/** An RDC network card */
+struct rdc_nic {
+	/** Registers */
+	void *regs;
+	/** DMA device */
+	struct dma_device *dma;
+	/** MII interface */
+	struct mii_interface mdio;
+	/** MII device */
+	struct mii_device mii;
+
+	/** Transmit descriptor ring */
+	struct rdc_ring tx;
+	/** Receive descriptor ring */
+	struct rdc_ring rx;
+	/** Receive I/O buffers */
+	struct io_buffer *rx_iobuf[RDC_NUM_RX_DESC];
+};
+
+#endif /* _RDC_H */
diff --git a/src/drivers/net/realtek.c b/src/drivers/net/realtek.c
index 0af3416..a43efb6 100644
--- a/src/drivers/net/realtek.c
+++ b/src/drivers/net/realtek.c
@@ -420,6 +420,16 @@ static int realtek_phy_reset ( struct realtek_nic *rtl ) {
 		 */
 	}
 
+	/* Some cards (e.g. RTL8211B) have a hardware errata that
+	 * requires the MII_MMD_DATA register to be cleared before the
+	 * link will come up.
+	 */
+	if ( ( rc = mii_write ( &rtl->mii, MII_MMD_DATA, 0 ) ) != 0 ) {
+		/* Ignore failures, since the register may not be
+		 * present on all PHYs.
+		 */
+	}
+
 	/* Restart autonegotiation */
 	if ( ( rc = mii_restart ( &rtl->mii ) ) != 0 ) {
 		DBGC ( rtl, "REALTEK %p could not restart MII: %s\n",
diff --git a/src/drivers/net/virtio-net.c b/src/drivers/net/virtio-net.c
index 78ec9ac..0c45419 100644
--- a/src/drivers/net/virtio-net.c
+++ b/src/drivers/net/virtio-net.c
@@ -29,6 +29,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <ipxe/iobuf.h>
 #include <ipxe/netdevice.h>
 #include <ipxe/pci.h>
+#include <ipxe/dma.h>
 #include <ipxe/if_ether.h>
 #include <ipxe/ethernet.h>
 #include <ipxe/virtio-pci.h>
@@ -99,8 +100,9 @@ struct virtnet_nic {
 	/** Pending rx packet count */
 	unsigned int rx_num_iobufs;
 
-	/** Virtio net dummy packet headers */
-	struct virtio_net_hdr_modern empty_header[QUEUE_NB];
+	/** DMA device */
+	struct dma_device *dma;
+
 };
 
 /** Add an iobuf to a virtqueue
@@ -115,7 +117,7 @@ static void virtnet_enqueue_iob ( struct net_device *netdev,
 				  int vq_idx, struct io_buffer *iobuf ) {
 	struct virtnet_nic *virtnet = netdev->priv;
 	struct vring_virtqueue *vq = &virtnet->virtqueue[vq_idx];
-	struct virtio_net_hdr_modern *header = &virtnet->empty_header[vq_idx];
+	struct virtio_net_hdr_modern *header = vq->empty_header;
 	unsigned int out = ( vq_idx == TX_INDEX ) ? 2 : 0;
 	unsigned int in = ( vq_idx == TX_INDEX ) ? 0 : 2;
 	size_t header_len = ( virtnet->virtio_version ?
@@ -132,11 +134,11 @@ static void virtnet_enqueue_iob ( struct net_device *netdev,
 			 * to header->flags for received packets.  Work around
 			 * this by using separate RX and TX headers.
 			 */
-			.addr = ( char* ) header,
+			.addr = dma ( &vq->map, header ),
 			.length = header_len,
 		},
 		{
-			.addr = ( char* ) iobuf->data,
+			.addr = iob_dma ( iobuf ),
 			.length = iob_len ( iobuf ),
 		},
 	};
@@ -161,7 +163,7 @@ static void virtnet_refill_rx_virtqueue ( struct net_device *netdev ) {
 		struct io_buffer *iobuf;
 
 		/* Try to allocate a buffer, stop for now if out of memory */
-		iobuf = alloc_iob ( len );
+		iobuf = alloc_rx_iob ( len, virtnet->dma );
 		if ( ! iobuf )
 			break;
 
@@ -215,7 +217,8 @@ static int virtnet_open_legacy ( struct net_device *netdev ) {
 
 	/* Initialize rx/tx virtqueues */
 	for ( i = 0; i < QUEUE_NB; i++ ) {
-		if ( vp_find_vq ( ioaddr, i, &virtnet->virtqueue[i] ) == -1 ) {
+		if ( vp_find_vq ( ioaddr, i, &virtnet->virtqueue[i], virtnet->dma,
+                                  sizeof ( struct virtio_net_hdr_modern ) ) == -1 ) {
 			DBGC ( virtnet, "VIRTIO-NET %p cannot register queue %d\n",
 			       virtnet, i );
 			virtnet_free_virtqueues ( netdev );
@@ -280,7 +283,8 @@ static int virtnet_open_modern ( struct net_device *netdev ) {
 	}
 
 	/* Initialize rx/tx virtqueues */
-	if ( vpm_find_vqs ( &virtnet->vdev, QUEUE_NB, virtnet->virtqueue ) ) {
+	if ( vpm_find_vqs ( &virtnet->vdev, QUEUE_NB, virtnet->virtqueue,
+                            virtnet->dma, sizeof ( struct virtio_net_hdr_modern ) ) ) {
 		DBGC ( virtnet, "VIRTIO-NET %p cannot register queues\n",
 		       virtnet );
 		virtnet_free_virtqueues ( netdev );
@@ -335,7 +339,7 @@ static void virtnet_close ( struct net_device *netdev ) {
 
 	/* Free rx iobufs */
 	list_for_each_entry_safe ( iobuf, next_iobuf, &virtnet->rx_iobufs, list ) {
-		free_iob ( iobuf );
+		free_rx_iob ( iobuf );
 	}
 	INIT_LIST_HEAD ( &virtnet->rx_iobufs );
 	virtnet->rx_num_iobufs = 0;
@@ -478,6 +482,12 @@ static int virtnet_probe_legacy ( struct pci_device *pci ) {
 
 	/* Enable PCI bus master and reset NIC */
 	adjust_pci_device ( pci );
+
+	/* Configure DMA */
+	virtnet->dma =  &pci->dma;
+	dma_set_mask_64bit ( virtnet->dma );
+	netdev->dma = virtnet->dma;
+
 	vp_reset ( ioaddr );
 
 	/* Load MAC address and MTU */
@@ -506,7 +516,7 @@ static int virtnet_probe_legacy ( struct pci_device *pci ) {
 	return 0;
 
 	unregister_netdev ( netdev );
- err_register_netdev:
+err_register_netdev:
 	vp_reset ( ioaddr );
 	netdev_nullify ( netdev );
 	netdev_put ( netdev );
@@ -586,6 +596,11 @@ static int virtnet_probe_modern ( struct pci_device *pci, int *found_dev ) {
 	/* Enable the PCI device */
 	adjust_pci_device ( pci );
 
+	/* Configure DMA */
+	virtnet->dma =  &pci->dma;
+	dma_set_mask_64bit ( virtnet->dma );
+	netdev->dma = virtnet->dma;
+
 	/* Reset the device and set initial status bits */
 	vpm_reset ( &virtnet->vdev );
 	vpm_add_status ( &virtnet->vdev, VIRTIO_CONFIG_S_ACKNOWLEDGE );
@@ -633,7 +648,6 @@ err_mac_address:
 	vpm_reset ( &virtnet->vdev );
 	netdev_nullify ( netdev );
 	netdev_put ( netdev );
-
 	virtio_pci_unmap_capability ( &virtnet->vdev.device );
 err_map_device:
 	virtio_pci_unmap_capability ( &virtnet->vdev.isr );
diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c
index cc48af0..3247ee6 100644
--- a/src/drivers/usb/xhci.c
+++ b/src/drivers/usb/xhci.c
@@ -1165,6 +1165,31 @@ static int xhci_reset ( struct xhci_device *xhci ) {
 	return -ETIMEDOUT;
 }
 
+/**
+ * Mark xHCI device as permanently failed
+ *
+ * @v xhci		xHCI device
+ * @ret rc		Return status code
+ */
+static int xhci_fail ( struct xhci_device *xhci ) {
+	size_t len;
+	int rc;
+
+	/* Mark command mechanism as permanently failed */
+	xhci->failed = 1;
+
+	/* Reset device */
+	if ( ( rc = xhci_reset ( xhci ) ) != 0 )
+		return rc;
+
+	/* Discard DCBAA entries since DCBAAP has been cleared */
+	assert ( xhci->dcbaa.context != NULL );
+	len = ( ( xhci->slots + 1 ) * sizeof ( xhci->dcbaa.context[0] ) );
+	memset ( xhci->dcbaa.context, 0, len );
+
+	return 0;
+}
+
 /******************************************************************************
  *
  * Transfer request blocks
@@ -1720,6 +1745,10 @@ static void xhci_event_poll ( struct xhci_device *xhci ) {
 	unsigned int consumed;
 	unsigned int type;
 
+	/* Do nothing if device has permanently failed */
+	if ( xhci->failed )
+		return;
+
 	/* Poll for events */
 	profile_start ( &xhci_event_profiler );
 	for ( consumed = 0 ; ; consumed++ ) {
@@ -1778,6 +1807,7 @@ static void xhci_event_poll ( struct xhci_device *xhci ) {
  */
 static void xhci_abort ( struct xhci_device *xhci ) {
 	physaddr_t crp;
+	uint32_t crcr;
 
 	/* Abort the command */
 	DBGC2 ( xhci, "XHCI %s aborting command\n", xhci->name );
@@ -1786,8 +1816,18 @@ static void xhci_abort ( struct xhci_device *xhci ) {
 	/* Allow time for command to abort */
 	mdelay ( XHCI_COMMAND_ABORT_DELAY_MS );
 
-	/* Sanity check */
-	assert ( ( readl ( xhci->op + XHCI_OP_CRCR ) & XHCI_CRCR_CRR ) == 0 );
+	/* Check for failure to abort */
+	crcr = readl ( xhci->op + XHCI_OP_CRCR );
+	if ( crcr & XHCI_CRCR_CRR ) {
+
+		/* Device has failed to abort a command and is almost
+		 * certainly beyond repair.  Reset device, abandoning
+		 * all state, and mark device as failed to avoid
+		 * delays on any future command attempts.
+		 */
+		DBGC ( xhci, "XHCI %s failed to abort command\n", xhci->name );
+		xhci_fail ( xhci );
+	}
 
 	/* Consume (and ignore) any final command status */
 	xhci_event_poll ( xhci );
@@ -1813,6 +1853,12 @@ static int xhci_command ( struct xhci_device *xhci, union xhci_trb *trb ) {
 	unsigned int i;
 	int rc;
 
+	/* Immediately fail all commands if command mechanism has failed */
+	if ( xhci->failed ) {
+		rc = -EPIPE;
+		goto err_failed;
+	}
+
 	/* Sanity check */
 	if ( xhci->pending ) {
 		DBGC ( xhci, "XHCI %s command ring busy\n", xhci->name );
@@ -1863,6 +1909,7 @@ static int xhci_command ( struct xhci_device *xhci, union xhci_trb *trb ) {
  err_enqueue:
 	xhci->pending = NULL;
  err_pending:
+ err_failed:
 	return rc;
 }
 
@@ -3412,14 +3459,36 @@ static int xhci_probe ( struct pci_device *pci ) {
 static void xhci_remove ( struct pci_device *pci ) {
 	struct xhci_device *xhci = pci_get_drvdata ( pci );
 	struct usb_bus *bus = xhci->bus;
+	uint16_t command;
+
+	/* Some systems are observed to disable bus mastering on
+	 * Thunderbolt controllers before we get a chance to shut
+	 * down.  Detect this and avoid attempting any DMA operations,
+	 * which are guaranteed to fail and may end up spuriously
+	 * completing after the operating system kernel starts up.
+	 */
+	pci_read_config_word ( pci, PCI_COMMAND, &command );
+	if ( ! ( command & PCI_COMMAND_MASTER ) ) {
+		DBGC ( xhci, "XHCI %s DMA was disabled\n", xhci->name );
+		xhci_fail ( xhci );
+	}
 
+	/* Unregister and free USB bus */
 	unregister_usb_bus ( bus );
 	free_usb_bus ( bus );
+
+	/* Reset device and undo any PCH-specific fixes */
 	xhci_reset ( xhci );
 	if ( xhci->quirks & XHCI_PCH )
 		xhci_pch_undo ( xhci, pci );
+
+	/* Release ownership back to BIOS */
 	xhci_legacy_release ( xhci );
+
+	/* Unmap registers */
 	iounmap ( xhci->regs );
+
+	/* Free device */
 	free ( xhci );
 }
 
diff --git a/src/drivers/usb/xhci.h b/src/drivers/usb/xhci.h
index 6e02d70..a3c8888 100644
--- a/src/drivers/usb/xhci.h
+++ b/src/drivers/usb/xhci.h
@@ -1115,6 +1115,8 @@ struct xhci_device {
 	struct xhci_event_ring event;
 	/** Current command (if any) */
 	union xhci_trb *pending;
+	/** Command mechanism has permanently failed */
+	int failed;
 
 	/** Device slots, indexed by slot ID */
 	struct xhci_slot **slot;
diff --git a/src/hci/commands/image_archive_cmd.c b/src/hci/commands/image_archive_cmd.c
new file mode 100644
index 0000000..a2212ae
--- /dev/null
+++ b/src/hci/commands/image_archive_cmd.c
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2021 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <getopt.h>
+#include <ipxe/command.h>
+#include <ipxe/parseopt.h>
+#include <usr/imgmgmt.h>
+#include <usr/imgarchive.h>
+
+/** @file
+ *
+ * Archive image commands
+ *
+ */
+
+/** "imgextract" options */
+struct imgextract_options {
+	/** Image name */
+	char *name;
+	/** Keep original image */
+	int keep;
+	/** Download timeout */
+	unsigned long timeout;
+};
+
+/** "imgextract" option list */
+static struct option_descriptor imgextract_opts[] = {
+	OPTION_DESC ( "name", 'n', required_argument,
+		      struct imgextract_options, name, parse_string ),
+	OPTION_DESC ( "keep", 'k', no_argument,
+		      struct imgextract_options, keep, parse_flag ),
+	OPTION_DESC ( "timeout", 't', required_argument,
+		      struct imgextract_options, timeout, parse_timeout ),
+};
+
+/** "imgextract" command descriptor */
+static struct command_descriptor imgextract_cmd =
+	COMMAND_DESC ( struct imgextract_options, imgextract_opts, 1, 1, NULL );
+
+/**
+ * The "imgextract" command
+ *
+ * @v argc		Argument count
+ * @v argv		Argument list
+ * @ret rc		Return status code
+ */
+static int imgextract_exec ( int argc, char **argv ) {
+	struct imgextract_options opts;
+	struct image *image;
+	int rc;
+
+	/* Parse options */
+	if ( ( rc = parse_options ( argc, argv, &imgextract_cmd,
+				    &opts ) ) != 0 )
+		goto err_parse;
+
+	/* Acquire image */
+	if ( ( rc = imgacquire ( argv[optind], opts.timeout, &image ) ) != 0 )
+		goto err_acquire;
+
+	/* Extract archive image */
+	if ( ( rc = imgextract ( image, opts.name ) ) != 0 )
+		goto err_extract;
+
+	/* Success */
+	rc = 0;
+
+ err_extract:
+	/* Discard original image unless --keep was specified */
+	if ( ! opts.keep )
+		unregister_image ( image );
+ err_acquire:
+ err_parse:
+	return rc;
+}
+
+/** Archive image commands */
+struct command image_archive_commands[] __command = {
+	{
+		.name = "imgextract",
+		.exec = imgextract_exec,
+	},
+};
diff --git a/src/hci/readline.c b/src/hci/readline.c
index 852c450..ecc72d4 100644
--- a/src/hci/readline.c
+++ b/src/hci/readline.c
@@ -38,7 +38,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  *
  */
 
-#define READLINE_MAX 256
+#define READLINE_MAX 1024
 
 /**
  * Synchronise console with edited string
@@ -258,8 +258,8 @@ void history_free ( struct readline_history *history ) {
 int readline_history ( const char *prompt, const char *prefill,
 		       struct readline_history *history, unsigned long timeout,
 		       char **line ) {
-	char buf[READLINE_MAX];
 	struct edit_string string;
+	char *buf;
 	int key;
 	int move_by;
 	const char *new_string;
@@ -275,10 +275,14 @@ int readline_history ( const char *prompt, const char *prefill,
 	/* Ensure cursor is visible */
 	printf ( "\033[?25h" );
 
-	/* Initialise editable string */
+	/* Allocate buffer and initialise editable string */
+	buf = zalloc ( READLINE_MAX );
+	if ( ! buf ) {
+		rc = -ENOMEM;
+		goto done;
+	}
 	memset ( &string, 0, sizeof ( string ) );
-	init_editstring ( &string, buf, sizeof ( buf ) );
-	buf[0] = '\0';
+	init_editstring ( &string, buf, READLINE_MAX );
 
 	/* Prefill string, if applicable */
 	if ( prefill ) {
@@ -303,8 +307,13 @@ int readline_history ( const char *prompt, const char *prefill,
 		switch ( key ) {
 		case CR:
 		case LF:
-			*line = strdup ( buf );
-			rc = ( ( *line ) ? 0 : -ENOMEM );
+			/* Shrink string (ignoring failures) */
+			*line = realloc ( buf,
+					  ( strlen ( buf ) + 1 /* NUL */ ) );
+			if ( ! *line )
+				*line = buf;
+			buf = NULL;
+			rc = 0;
 			goto done;
 		case CTRL_C:
 			rc = -ECANCELED;
@@ -332,6 +341,7 @@ int readline_history ( const char *prompt, const char *prefill,
 
  done:
 	putchar ( '\n' );
+	free ( buf );
 	if ( history ) {
 		if ( *line && (*line)[0] )
 			history_append ( history, *line );
diff --git a/src/image/gzip.c b/src/image/gzip.c
new file mode 100644
index 0000000..98376e1
--- /dev/null
+++ b/src/image/gzip.c
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2021 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdlib.h>
+#include <errno.h>
+#include <assert.h>
+#include <ipxe/deflate.h>
+#include <ipxe/uaccess.h>
+#include <ipxe/image.h>
+#include <ipxe/zlib.h>
+#include <ipxe/gzip.h>
+
+/** @file
+ *
+ * gzip compressed images
+ *
+ */
+
+/**
+ * Extract gzip image
+ *
+ * @v image		Image
+ * @v extracted		Extracted image
+ * @ret rc		Return status code
+ */
+static int gzip_extract ( struct image *image, struct image *extracted ) {
+	struct gzip_header header;
+	struct gzip_extra_header extra;
+	struct gzip_crc_header crc;
+	struct gzip_footer footer;
+	struct deflate_chunk in;
+	unsigned int strings;
+	size_t offset;
+	size_t len;
+	off_t nul;
+	int rc;
+
+	/* Sanity check */
+	assert ( image->len >= ( sizeof ( header ) + sizeof ( footer ) ) );
+
+	/* Extract footer */
+	len = ( image->len - sizeof ( footer ) );
+	copy_from_user ( &footer, image->data, len, sizeof ( footer ) );
+
+	/* Extract fixed header */
+	copy_from_user ( &header, image->data, 0, sizeof ( header ) );
+	offset = sizeof ( header );
+	assert ( offset <= ( image->len - sizeof ( footer ) ) );
+
+	/* Skip extra header, if present */
+	if ( header.flags & GZIP_FL_EXTRA ) {
+		copy_from_user ( &extra, image->data, offset,
+				 sizeof ( extra ) );
+		offset += sizeof ( extra );
+		offset += le16_to_cpu ( extra.len );
+		if ( offset > len ) {
+			DBGC ( image, "GZIP %p overlength extra header\n",
+			       image );
+			return -EINVAL;
+		}
+	}
+	assert ( offset <= ( image->len - sizeof ( footer ) ) );
+
+	/* Skip name and/or comment, if present */
+	strings = 0;
+	if ( header.flags & GZIP_FL_NAME )
+		strings++;
+	if ( header.flags & GZIP_FL_COMMENT )
+		strings++;
+	while ( strings-- ) {
+		nul = memchr_user ( image->data, offset, 0, ( len - offset ) );
+		if ( nul < 0 ) {
+			DBGC ( image, "GZIP %p overlength name/comment\n",
+			       image );
+			return -EINVAL;
+		}
+		offset = ( nul + 1 /* NUL */ );
+	}
+	assert ( offset <= ( image->len - sizeof ( footer ) ) );
+
+	/* Skip CRC, if present */
+	if ( header.flags & GZIP_FL_HCRC ) {
+		offset += sizeof ( crc );
+		if ( offset > len ) {
+			DBGC ( image, "GZIP %p overlength CRC header\n",
+			       image );
+			return -EINVAL;
+		}
+	}
+
+	/* Initialise input chunk */
+	deflate_chunk_init ( &in, userptr_add ( image->data, offset ), 0, len );
+
+	/* Presize extracted image */
+	if ( ( rc = image_set_len ( extracted,
+				    le32_to_cpu ( footer.len ) ) ) != 0 ) {
+		DBGC ( image, "GZIP %p could not presize: %s\n",
+		       image, strerror ( rc ) );
+		return rc;
+	}
+
+	/* Decompress image (expanding if necessary) */
+	if ( ( rc = zlib_deflate ( DEFLATE_RAW, &in, extracted ) ) != 0 ) {
+		DBGC ( image, "GZIP %p could not decompress: %s\n",
+		       image, strerror ( rc ) );
+		return rc;
+	}
+
+	return 0;
+}
+
+/**
+ * Probe gzip image
+ *
+ * @v image		gzip image
+ * @ret rc		Return status code
+ */
+static int gzip_probe ( struct image *image ) {
+	struct gzip_header header;
+	struct gzip_footer footer;
+
+	/* Sanity check */
+	if ( image->len < ( sizeof ( header ) + sizeof ( footer ) ) ) {
+		DBGC ( image, "GZIP %p image too short\n", image );
+		return -ENOEXEC;
+	}
+
+	/* Check magic header */
+	copy_from_user ( &header.magic, image->data, 0,
+			 sizeof ( header.magic ) );
+	if ( header.magic != cpu_to_be16 ( GZIP_MAGIC ) ) {
+		DBGC ( image, "GZIP %p invalid magic\n", image );
+		return -ENOEXEC;
+	}
+
+	return 0;
+}
+
+/** gzip image type */
+struct image_type gzip_image_type __image_type ( PROBE_NORMAL ) = {
+	.name = "gzip",
+	.probe = gzip_probe,
+	.extract = gzip_extract,
+	.exec = image_extract_exec,
+};
diff --git a/src/image/zlib.c b/src/image/zlib.c
new file mode 100644
index 0000000..a42c47e
--- /dev/null
+++ b/src/image/zlib.c
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2021 Michael Brown <[e-mail]>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdlib.h>
+#include <errno.h>
+#include <assert.h>
+#include <ipxe/deflate.h>
+#include <ipxe/uaccess.h>
+#include <ipxe/image.h>
+#include <ipxe/zlib.h>
+
+/** @file
+ *
+ * zlib compressed images
+ *
+ */
+
+/**
+ * Extract compressed data to image
+ *
+ * @v format		Compression format code
+ * @v in		Compressed input chunk
+ * @v extracted		Extracted image
+ * @ret rc		Return status code
+ */
+int zlib_deflate ( enum deflate_format format, struct deflate_chunk *in,
+		   struct image *extracted ) {
+	struct deflate *deflate;
+	struct deflate_chunk out;
+	int rc;
+
+	/* Allocate and initialise decompressor */
+	deflate = zalloc ( sizeof ( *deflate ) );
+	if ( ! deflate ) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+
+	/* Decompress data, (re)allocating if necessary */
+	while ( 1 ) {
+
+		/* (Re)initialise decompressor */
+		deflate_init ( deflate, format );
+
+		/* (Re)initialise input chunk */
+		in->offset = 0;
+
+		/* Initialise output chunk */
+		deflate_chunk_init ( &out, extracted->data, 0, extracted->len );
+
+		/* Decompress data */
+		if ( ( rc = deflate_inflate ( deflate, in, &out ) ) != 0 ) {
+			DBGC ( extracted, "ZLIB %p could not decompress: %s\n",
+			       extracted, strerror ( rc ) );
+			goto err_inflate;
+		}
+
+		/* Check that decompression is valid */
+		if ( ! deflate_finished ( deflate ) ) {
+			DBGC ( extracted, "ZLIB %p decompression incomplete\n",
+			       extracted );
+			rc = -EINVAL;
+			goto err_unfinished;
+		}
+
+		/* Finish if output image size was correct */
+		if ( out.offset == extracted->len )
+			break;
+
+		/* Otherwise, resize output image and retry */
+		if ( ( rc = image_set_len ( extracted, out.offset ) ) != 0 ) {
+			DBGC ( extracted, "ZLIB %p could not resize: %s\n",
+			       extracted, strerror ( rc ) );
+			goto err_set_size;
+		}
+	}
+
+	/* Success */
+	rc = 0;
+
+ err_set_size:
+ err_unfinished:
+ err_inflate:
+	free ( deflate );
+ err_alloc:
+	return rc;
+}
+
+/**
+ * Extract zlib image
+ *
+ * @v image		Image
+ * @v extracted		Extracted image
+ * @ret rc		Return status code
+ */
+static int zlib_extract ( struct image *image, struct image *extracted ) {
+	struct deflate_chunk in;
+	int rc;
+
+	/* Initialise input chunk */
+	deflate_chunk_init ( &in, image->data, 0, image->len );
+
+	/* Decompress image */
+	if ( ( rc = zlib_deflate ( DEFLATE_ZLIB, &in, extracted ) ) != 0 )
+		return rc;
+
+	return 0;
+}
+
+/**
+ * Probe zlib image
+ *
+ * @v image		zlib image
+ * @ret rc		Return status code
+ */
+static int zlib_probe ( struct image *image ) {
+	union zlib_magic magic;
+
+	/* Sanity check */
+	if ( image->len < sizeof ( magic ) ) {
+		DBGC ( image, "ZLIB %p image too short\n", image );
+		return -ENOEXEC;
+	}
+
+	/* Check magic header */
+	copy_from_user ( &magic, image->data, 0, sizeof ( magic ) );
+	if ( ! zlib_magic_is_valid ( &magic ) ) {
+		DBGC ( image, "ZLIB %p invalid magic data\n", image );
+		return -ENOEXEC;
+	}
+
+	return 0;
+}
+
+/** zlib image type */
+struct image_type zlib_image_type __image_type ( PROBE_NORMAL ) = {
+	.name = "zlib",
+	.probe = zlib_probe,
+	.extract = zlib_extract,
+	.exec = image_extract_exec,
+};
diff --git a/src/include/endian.h b/src/include/endian.h
index 79c3163..bdae9de 100644
--- a/src/include/endian.h
+++ b/src/include/endian.h
@@ -8,14 +8,18 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  * Little-endian systems should define BYTE_ORDER as LITTLE_ENDIAN.
  * This constant is intended to be used only at compile time.
  */
+#ifndef __LITTLE_ENDIAN
 #define __LITTLE_ENDIAN 0x44332211UL
+#endif
 
 /** Constant representing big-endian byte order
  *
  * Big-endian systems should define BYTE_ORDER as BIG_ENDIAN.
  * This constant is intended to be used only at compile time.
  */
+#ifndef __BIG_ENDIAN
 #define __BIG_ENDIAN 0x11223344UL
+#endif
 
 #include "bits/endian.h"
 
diff --git a/src/include/ipxe/acpi.h b/src/include/ipxe/acpi.h
index 81ef7ff..7df3ec2 100644
--- a/src/include/ipxe/acpi.h
+++ b/src/include/ipxe/acpi.h
@@ -387,7 +387,9 @@ acpi_describe ( struct interface *interface );
 	typeof ( struct acpi_descriptor * ( object_type ) )
 
 extern void acpi_fix_checksum ( struct acpi_header *acpi );
-extern int acpi_sx ( uint32_t signature );
+extern int acpi_extract ( uint32_t signature, void *data,
+			  int ( * extract ) ( userptr_t zsdt, size_t len,
+					      size_t offset, void *data ) );
 extern void acpi_add ( struct acpi_descriptor *desc );
 extern void acpi_del ( struct acpi_descriptor *desc );
 extern int acpi_install ( int ( * install ) ( struct acpi_header *acpi ) );
diff --git a/src/include/ipxe/acpimac.h b/src/include/ipxe/acpimac.h
new file mode 100644
index 0000000..de673eb
--- /dev/null
+++ b/src/include/ipxe/acpimac.h
@@ -0,0 +1,14 @@
+#ifndef _IPXE_ACPIMAC_H
+#define _IPXE_ACPIMAC_H
+
+/** @file
+ *
+ * ACPI MAC address
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+extern int acpi_mac ( uint8_t *hw_addr );
+
+#endif /* _IPXE_ACPIMAC_H */
diff --git a/src/include/ipxe/cachedhcp.h b/src/include/ipxe/cachedhcp.h
index 7765c64..39ce745 100644
--- a/src/include/ipxe/cachedhcp.h
+++ b/src/include/ipxe/cachedhcp.h
@@ -12,6 +12,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #include <stddef.h>
 #include <ipxe/uaccess.h>
 
-extern int cachedhcp_record ( userptr_t data, size_t max_len );
+struct cached_dhcp_packet;
+
+extern struct cached_dhcp_packet cached_dhcpack;
+extern struct cached_dhcp_packet cached_proxydhcp;
+extern struct cached_dhcp_packet cached_pxebs;
+
+extern int cachedhcp_record ( struct cached_dhcp_packet *cache, userptr_t data,
+			      size_t max_len );
 
 #endif /* _IPXE_CACHEDHCP_H */
diff --git a/src/include/ipxe/cpio.h b/src/include/ipxe/cpio.h
index 0637c53..9c5e22d 100644
--- a/src/include/ipxe/cpio.h
+++ b/src/include/ipxe/cpio.h
@@ -9,6 +9,8 @@
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
+#include <ipxe/image.h>
+
 /** A CPIO archive header
  *
  * All field are hexadecimal ASCII numbers padded with '0' on the
@@ -48,6 +50,25 @@ struct cpio_header {
 /** CPIO magic */
 #define CPIO_MAGIC "070701"
 
+/** CPIO header length alignment */
+#define CPIO_ALIGN 4
+
+/** Alignment for CPIO archives within an initrd */
+#define INITRD_ALIGN 4096
+
+/**
+ * Get CPIO image name
+ *
+ * @v image		Image
+ * @ret name		Image name (not NUL terminated)
+ */
+static inline __attribute__ (( always_inline )) const char *
+cpio_name ( struct image *image ) {
+	return image->cmdline;
+}
+
 extern void cpio_set_field ( char *field, unsigned long value );
+extern size_t cpio_name_len ( struct image *image );
+extern size_t cpio_header ( struct image *image, struct cpio_header *cpio );
 
 #endif /* _IPXE_CPIO_H */
diff --git a/src/include/ipxe/dhcppkt.h b/src/include/ipxe/dhcppkt.h
index f13dfc9..8607596 100644
--- a/src/include/ipxe/dhcppkt.h
+++ b/src/include/ipxe/dhcppkt.h
@@ -56,7 +56,7 @@ dhcppkt_put ( struct dhcp_packet *dhcppkt ) {
  * @v dhcppkt		DHCP packet
  * @ret len		Used length
  */
-static inline int dhcppkt_len ( struct dhcp_packet *dhcppkt ) {
+static inline size_t dhcppkt_len ( struct dhcp_packet *dhcppkt ) {
 	return ( offsetof ( struct dhcphdr, options ) +
 		 dhcppkt->options.used_len );
 }
diff --git a/src/include/ipxe/efi/efi.h b/src/include/ipxe/efi/efi.h
index a83fa0f..1dd0d44 100644
--- a/src/include/ipxe/efi/efi.h
+++ b/src/include/ipxe/efi/efi.h
@@ -223,6 +223,7 @@ extern EFI_HANDLE efi_image_handle;
 extern EFI_LOADED_IMAGE_PROTOCOL *efi_loaded_image;
 extern EFI_DEVICE_PATH_PROTOCOL *efi_loaded_image_path;
 extern EFI_SYSTEM_TABLE *efi_systab;
+extern EFI_TPL efi_internal_tpl;
 extern EFI_TPL efi_external_tpl;
 extern int efi_shutdown_in_progress;
 
diff --git a/src/include/ipxe/efi/efi_wrap.h b/src/include/ipxe/efi/efi_wrap.h
index 6c7ccf2..2747a9e 100644
--- a/src/include/ipxe/efi/efi_wrap.h
+++ b/src/include/ipxe/efi/efi_wrap.h
@@ -10,7 +10,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 #include <ipxe/efi/efi.h>
 
-extern EFI_SYSTEM_TABLE * efi_wrap_systab ( void );
+extern EFI_BOOT_SERVICES * efi_wrap_bs ( void );
 extern void efi_wrap ( EFI_HANDLE handle );
 
 #endif /* _IPXE_EFI_WRAP_H */
diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h
index e3bf9f5..23e406b 100644
--- a/src/include/ipxe/errfile.h
+++ b/src/include/ipxe/errfile.h
@@ -77,6 +77,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define ERRFILE_fdt		       ( ERRFILE_CORE | 0x00250000 )
 #define ERRFILE_dma		       ( ERRFILE_CORE | 0x00260000 )
 #define ERRFILE_cachedhcp	       ( ERRFILE_CORE | 0x00270000 )
+#define ERRFILE_acpimac		       ( ERRFILE_CORE | 0x00280000 )
 
 #define ERRFILE_eisa		     ( ERRFILE_DRIVER | 0x00000000 )
 #define ERRFILE_isa		     ( ERRFILE_DRIVER | 0x00010000 )
@@ -213,6 +214,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define ERRFILE_usbblk		     ( ERRFILE_DRIVER | 0x00ce0000 )
 #define ERRFILE_iphone		     ( ERRFILE_DRIVER | 0x00cf0000 )
 #define ERRFILE_slirp		     ( ERRFILE_DRIVER | 0x00d00000 )
+#define ERRFILE_rdc		     ( ERRFILE_DRIVER | 0x00d10000 )
 
 #define ERRFILE_aoe			( ERRFILE_NET | 0x00000000 )
 #define ERRFILE_arp			( ERRFILE_NET | 0x00010000 )
@@ -301,6 +303,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define ERRFILE_png		      ( ERRFILE_IMAGE | 0x00070000 )
 #define ERRFILE_der		      ( ERRFILE_IMAGE | 0x00080000 )
 #define ERRFILE_pem		      ( ERRFILE_IMAGE | 0x00090000 )
+#define ERRFILE_archive		      ( ERRFILE_IMAGE | 0x000a0000 )
+#define ERRFILE_zlib		      ( ERRFILE_IMAGE | 0x000b0000 )
+#define ERRFILE_gzip		      ( ERRFILE_IMAGE | 0x000c0000 )
 
 #define ERRFILE_asn1		      ( ERRFILE_OTHER | 0x00000000 )
 #define ERRFILE_chap		      ( ERRFILE_OTHER | 0x00010000 )
diff --git a/src/include/ipxe/gzip.h b/src/include/ipxe/gzip.h
new file mode 100644
index 0000000..c8cf641
--- /dev/null
+++ b/src/include/ipxe/gzip.h
@@ -0,0 +1,71 @@
+#ifndef _IPXE_GZIP_H
+#define _IPXE_GZIP_H
+
+/** @file
+ *
+ * gzip compressed images
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdint.h>
+#include <ipxe/image.h>
+
+/** gzip header */
+struct gzip_header {
+	/** Magic ID */
+	uint16_t magic;
+	/** Compression method */
+	uint8_t method;
+	/** Flags */
+	uint8_t flags;
+	/** Modification time */
+	uint32_t mtime;
+	/** Extra flags */
+	uint8_t extra;
+	/** Operating system */
+	uint8_t os;
+} __attribute__ (( packed ));
+
+/** Magic ID */
+#define GZIP_MAGIC 0x1f8b
+
+/** Compression method */
+#define GZIP_METHOD_DEFLATE 0x08
+
+/** CRC header is present */
+#define GZIP_FL_HCRC 0x02
+
+/** Extra header is present */
+#define GZIP_FL_EXTRA 0x04
+
+/** File name is present */
+#define GZIP_FL_NAME 0x08
+
+/** File comment is present */
+#define GZIP_FL_COMMENT 0x10
+
+/** gzip extra header */
+struct gzip_extra_header {
+	/** Extra header length (excluding this field) */
+	uint16_t len;
+} __attribute__ (( packed ));
+
+/** gzip CRC header */
+struct gzip_crc_header {
+	/** CRC-16 */
+	uint16_t crc;
+} __attribute__ (( packed ));
+
+/** gzip footer */
+struct gzip_footer {
+	/** CRC-32 */
+	uint32_t crc;
+	/** Uncompressed size (modulo 2^32) */
+	uint32_t len;
+} __attribute__ (( packed ));
+
+extern struct image_type gzip_image_type __image_type ( PROBE_NORMAL );
+
+#endif /* _IPXE_GZIP_H */
diff --git a/src/include/ipxe/image.h b/src/include/ipxe/image.h
index 4fd2700..0a5a260 100644
--- a/src/include/ipxe/image.h
+++ b/src/include/ipxe/image.h
@@ -113,6 +113,14 @@ struct image_type {
 	 */
 	int ( * asn1 ) ( struct image *image, size_t offset,
 			 struct asn1_cursor **cursor );
+	/**
+	 * Extract archive image
+	 *
+	 * @v image		Image
+	 * @v extracted		Extracted image
+	 * @ret rc		Return status code
+	 */
+	int ( * extract ) ( struct image *image, struct image *extracted );
 };
 
 /**
@@ -175,6 +183,7 @@ extern struct image * alloc_image ( struct uri *uri );
 extern int image_set_uri ( struct image *image, struct uri *uri );
 extern int image_set_name ( struct image *image, const char *name );
 extern int image_set_cmdline ( struct image *image, const char *cmdline );
+extern int image_set_len ( struct image *image, size_t len );
 extern int image_set_data ( struct image *image, userptr_t data, size_t len );
 extern int register_image ( struct image *image );
 extern void unregister_image ( struct image *image );
@@ -189,6 +198,9 @@ extern struct image * image_memory ( const char *name, userptr_t data,
 extern int image_pixbuf ( struct image *image, struct pixel_buffer **pixbuf );
 extern int image_asn1 ( struct image *image, size_t offset,
 			struct asn1_cursor **cursor );
+extern int image_extract ( struct image *image, const char *name,
+			   struct image **extracted );
+extern int image_extract_exec ( struct image *image );
 
 /**
  * Increment reference count on an image
diff --git a/src/include/ipxe/rndis.h b/src/include/ipxe/rndis.h
index bcb6d8e..e8ece1e 100644
--- a/src/include/ipxe/rndis.h
+++ b/src/include/ipxe/rndis.h
@@ -84,7 +84,7 @@ struct rndis_initialise_completion {
 	/** Packet alignment factor */
 	uint32_t align;
 	/** Reserved */
-	uint32_t reserved;
+	uint32_t reserved[2];
 } __attribute__ (( packed ));
 
 /** RNDIS halt message */
@@ -237,7 +237,7 @@ struct rndis_packet_message {
 	/** Per-packet information record */
 	struct rndis_packet_field ppi;
 	/** Reserved */
-	uint32_t reserved;
+	uint32_t reserved[2];
 } __attribute__ (( packed ));
 
 /** RNDIS packet record */
diff --git a/src/include/ipxe/settings.h b/src/include/ipxe/settings.h
index f463e66..e042b97 100644
--- a/src/include/ipxe/settings.h
+++ b/src/include/ipxe/settings.h
@@ -426,6 +426,7 @@ extern const struct setting_type setting_type_hexhyp __setting_type;
 extern const struct setting_type setting_type_hexraw __setting_type;
 extern const struct setting_type setting_type_base64 __setting_type;
 extern const struct setting_type setting_type_uuid __setting_type;
+extern const struct setting_type setting_type_guid __setting_type;
 extern const struct setting_type setting_type_busdevfn __setting_type;
 extern const struct setting_type setting_type_dnssl __setting_type;
 
diff --git a/src/include/ipxe/srp.h b/src/include/ipxe/srp.h
index 3abb099..1f66a22 100644
--- a/src/include/ipxe/srp.h
+++ b/src/include/ipxe/srp.h
@@ -774,7 +774,7 @@ struct srp_aer_rsp {
  * The working draft specification for the SRP boot firmware table can
  * be found at
  *
- *   http://ipxe.org/wiki/srp/sbft
+ *   https://ipxe.org/wiki/srp/sbft