diff --git a/packages/web/lib/fog/system.class.php b/packages/web/lib/fog/system.class.php
index f4e0630c12..6b0030cbcf 100644
--- a/packages/web/lib/fog/system.class.php
+++ b/packages/web/lib/fog/system.class.php
@@ -53,7 +53,7 @@ private static function _versionCompare()
     public function __construct()
     {
         self::_versionCompare();
-        define('FOG_VERSION', '1.5.10.30');
+        define('FOG_VERSION', '1.5.10.31');
         define('FOG_SCHEMA', 270);
         define('FOG_BCACHE_VER', 140);
         define('FOG_CLIENT_VERSION', '0.13.0');
diff --git a/src/ipxe/src-efi/Makefile.housekeeping b/src/ipxe/src-efi/Makefile.housekeeping
new file mode 100644
index 0000000000..22027386fa
--- /dev/null
+++ b/src/ipxe/src-efi/Makefile.housekeeping
@@ -0,0 +1,1604 @@
+# -*- makefile -*- : Force emacs to use Makefile mode
+#
+# This file contains various boring housekeeping functions that would
+# otherwise seriously clutter up the main Makefile.
+
+###############################################################################
+#
+# Find a usable "echo -e" substitute.
+#
+TAB 			:= $(shell $(PRINTF) '\t')
+ECHO_E_ECHO		:= $(ECHO)
+ECHO_E_ECHO_E		:= $(ECHO) -e
+ECHO_E_BIN_ECHO 	:= /bin/echo
+ECHO_E_BIN_ECHO_E 	:= /bin/echo -e
+ECHO_E_ECHO_TAB		:= $(shell $(ECHO_E_ECHO) '\t' | cat)
+ECHO_E_ECHO_E_TAB	:= $(shell $(ECHO_E_ECHO_E) '\t' | cat)
+ECHO_E_BIN_ECHO_TAB 	:= $(shell $(ECHO_E_BIN_ECHO) '\t')
+ECHO_E_BIN_ECHO_E_TAB 	:= $(shell $(ECHO_E_BIN_ECHO_E) '\t')
+
+ifeq ($(ECHO_E_ECHO_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_ECHO)
+endif
+ifeq ($(ECHO_E_ECHO_E_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_ECHO_E)
+endif
+ifeq ($(ECHO_E_BIN_ECHO_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_BIN_ECHO)
+endif
+ifeq ($(ECHO_E_BIN_ECHO_E_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_BIN_ECHO_E)
+endif
+
+.echocheck :
+ifdef ECHO_E
+	@$(TOUCH) $@
+else
+	@$(PRINTF) '%24s : x%sx\n' 'tab' '$(TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_ECHO) \t"' \
+				    '$(ECHO_E_ECHO_TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_ECHO_E) \t"' \
+				    '$(ECHO_E_ECHO_E_TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_BIN_ECHO) \t"' \
+				    '$(ECHO_E_BIN_ECHO_TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_BIN_ECHO_E) \t"' \
+				    '$(ECHO_E_BIN_ECHO_E_TAB)'
+	@$(ECHO) "No usable \"echo -e\" substitute found"
+	@exit 1
+endif
+MAKEDEPS	+= .echocheck
+VERYCLEANUP	+= .echocheck
+
+echo :
+	@$(ECHO) "Using \"$(ECHO_E)\" for \"echo -e\""
+
+###############################################################################
+#
+# Generate a usable "seq" substitute
+#
+define seq
+	$(shell awk 'BEGIN { for ( i = $(1) ; i <= $(2) ; i++ ) print i }')
+endef
+
+###############################################################################
+#
+# Determine host OS
+#
+HOST_OS		:= $(shell uname -s)
+hostos :
+	@$(ECHO) $(HOST_OS)
+
+###############################################################################
+#
+# Determine compiler
+
+CCDEFS		:= $(shell $(CC) -E -x c -c /dev/null -dM | cut -d" " -f2)
+ccdefs:
+	@$(ECHO) $(CCDEFS)
+
+ifeq ($(filter __GNUC__,$(CCDEFS)),__GNUC__)
+CCTYPE		:= gcc
+endif
+cctype:
+	@$(ECHO) $(CCTYPE)
+
+###############################################################################
+#
+# Check for tools that can cause failed builds
+#
+
+ifeq ($(CCTYPE),gcc)
+GCC_2_96_BANNER := $(shell $(CC) -v 2>&1 | grep -is 'gcc version 2\.96')
+ifneq ($(GCC_2_96_BANNER),)
+$(warning gcc 2.96 is unsuitable for compiling iPXE)
+$(warning Use gcc 2.95 or a newer version instead)
+$(error Unsuitable build environment found)
+endif
+endif
+
+PERL_UNICODE_CHECK := $(shell $(PERL) -e 'use bytes; print chr(255)' | wc -c)
+ifeq ($(PERL_UNICODE_CHECK),2)
+$(warning Your Perl version has a Unicode handling bug)
+$(warning Execute this command before building iPXE:)
+$(warning export LANG=$${LANG%.UTF-8})
+$(error Unsuitable build environment found)
+endif
+
+LD_GOLD_BANNER := $(shell $(LD) -v 2>&1 | grep 'GNU gold')
+ifneq ($(LD_GOLD_BANNER),)
+$(warning GNU gold is unsuitable for building iPXE)
+$(warning Use GNU ld instead)
+$(error Unsuitable build environment found)
+endif
+
+OBJCOPY_ETC_BANNER := $(shell $(OBJCOPY) --version | grep 'elftoolchain')
+ifneq ($(OBJCOPY_ETC_BANNER),)
+$(warning The elftoolchain objcopy is unsuitable for building iPXE)
+$(warning Use binutils objcopy instead)
+$(error Unsuitable build environment found)
+endif
+
+###############################################################################
+#
+# Check if $(eval ...) is available to use
+#
+
+HAVE_EVAL :=
+ifndef NO_EVAL
+$(eval HAVE_EVAL := yes)
+endif
+eval :
+	@$(ECHO) $(HAVE_EVAL)
+
+###############################################################################
+#
+# Check for various tool workarounds
+#
+
+WORKAROUND_CFLAGS := -Wno-error=maybe-uninitialized
+WORKAROUND_ASFLAGS :=
+WORKAROUND_LDFLAGS :=
+
+# Make syntax does not allow use of comma or space in certain places.
+# This ugly workaround is suggested in the manual.
+#
+COMMA	:= ,
+EMPTY	:=
+SPACE	:= $(EMPTY) $(EMPTY)
+HASH	:= \#
+define NEWLINE
+
+
+endef
+
+# gcc 4.4 generates .eh_frame sections by default, which distort the
+# output of "size".  Inhibit this.
+#
+ifeq ($(CCTYPE),gcc)
+CFI_TEST = $(CC) -fno-dwarf2-cfi-asm -fno-exceptions -fno-unwind-tables \
+		 -fno-asynchronous-unwind-tables -x c -c /dev/null \
+		 -o /dev/null >/dev/null 2>&1
+CFI_FLAGS := $(shell $(CFI_TEST) && \
+	       $(ECHO) '-fno-dwarf2-cfi-asm -fno-exceptions ' \
+		       '-fno-unwind-tables -fno-asynchronous-unwind-tables')
+WORKAROUND_CFLAGS += $(CFI_FLAGS)
+endif
+
+# gcc 4.6 generates spurious warnings if -Waddress is in force.
+# Inhibit this.
+#
+ifeq ($(CCTYPE),gcc)
+WNA_TEST = $(CC) -Waddress -x c -c /dev/null -o /dev/null >/dev/null 2>&1
+WNA_FLAGS := $(shell $(WNA_TEST) && $(ECHO) '-Wno-address')
+WORKAROUND_CFLAGS += $(WNA_FLAGS)
+
+# gcc 8.0 generates warnings for certain suspect string operations. Our
+# sources have been vetted for correct usage.  Turn off these warnings.
+#
+WNST_TEST = $(CC) -Wstringop-truncation -x c -c /dev/null -o /dev/null \
+		  >/dev/null 2>&1
+WNST_FLAGS := $(shell $(WNST_TEST) && $(ECHO) '-Wno-stringop-truncation')
+WORKAROUND_CFLAGS += $(WNST_FLAGS)
+
+# gcc 9.1 generates warnings for taking address of packed member which
+# may result in an unaligned pointer value.  Inhibit the warnings.
+#
+WNAPM_TEST = $(CC) -Wno-address-of-packed-member -x c -c /dev/null \
+		   -o /dev/null >/dev/null 2>&1
+WNAPM_FLAGS := $(shell $(WNAPM_TEST) && \
+		 $(ECHO) '-Wno-address-of-packed-member')
+WORKAROUND_CFLAGS += $(WNAPM_FLAGS)
+endif
+
+# Some versions of gas choke on division operators, treating them as
+# comment markers.  Specifying --divide will work around this problem,
+# but isn't available on older gas versions.
+#
+DIVIDE_TEST = $(AS) --divide /dev/null -o /dev/null 2>/dev/null
+DIVIDE_FLAGS := $(shell $(DIVIDE_TEST) && $(ECHO) '--divide')
+WORKAROUND_ASFLAGS += $(DIVIDE_FLAGS)
+
+###############################################################################
+#
+# Build verbosity
+#
+ifeq ($(V),1)
+Q :=
+QM := @\#
+else
+Q := @
+QM := @
+endif
+
+###############################################################################
+#
+# Checker
+#
+ifeq ($(C),1)
+export REAL_CC := $(CC)
+CC := cgcc
+CFLAGS += -Wno-decl
+endif
+
+###############################################################################
+#
+# Set BIN according to whatever was specified on the command line as
+# the build target.
+#
+
+# Determine how many different BIN directories are mentioned in the
+# make goals.
+#
+BIN_GOALS	:= $(filter bin bin/% bin-%,$(MAKECMDGOALS))
+BIN_GOALS_BINS	:= $(sort $(foreach BG,$(BIN_GOALS),\
+				    $(firstword $(subst /, ,$(BG)))))
+NUM_BINS	:= $(words $(BIN_GOALS_BINS))
+
+ifeq ($(NUM_BINS),0)
+
+# No BIN directory was specified.  Set BIN to "bin" as a sensible
+# default.
+
+BIN		:= bin
+
+else # NUM_BINS == 0
+
+ifeq ($(NUM_BINS),1)
+
+# If exactly one BIN directory was specified, set BIN to match this
+# directory.
+#
+BIN		:= $(firstword $(BIN_GOALS_BINS))
+
+else # NUM_BINS == 1
+
+# More than one BIN directory was specified.  We cannot handle the
+# latter case within a single make invocation, so set up recursive
+# targets for each BIN directory.  Use exactly one target for each BIN
+# directory since running multiple make invocations within the same
+# BIN directory is likely to cause problems.
+#
+# Leave $(BIN) undefined.  This has implications for any target that
+# depends on $(BIN); such targets should be made conditional upon the
+# existence of $(BIN).
+#
+BIN_GOALS_FIRST	:= $(foreach BGB,$(BIN_GOALS_BINS),\
+			     $(firstword $(filter $(BGB)/%,$(BIN_GOALS))))
+BIN_GOALS_OTHER	:= $(filter-out $(BIN_GOALS_FIRST),$(BIN_GOALS))
+
+$(BIN_GOALS_FIRST) : % : BIN_RECURSE
+	$(Q)$(MAKE) --no-print-directory BIN=$(firstword $(subst /, ,$@)) \
+	    $(filter $(firstword $(subst /, ,$@))/%, $(BIN_GOALS))
+$(BIN_GOALS_OTHER) : % : BIN_RECURSE
+	$(Q)$(TRUE)
+.PHONY : BIN_RECURSE
+
+endif # NUM_BINS == 1
+endif # NUM_BINS == 0
+
+ifdef BIN
+
+# Create $(BIN) directory if it doesn't exist yet
+#
+ifeq ($(wildcard $(BIN)),)
+$(shell $(MKDIR) -p $(BIN))
+endif
+
+# Target to allow e.g. "make bin-efi arch"
+#
+$(BIN) :
+	@# Do nothing, silently
+.PHONY : $(BIN)
+
+# Remove everything in $(BIN) for a "make clean"
+#
+CLEANUP	+= $(BIN)/*.* # Avoid picking up directories
+
+endif # defined(BIN)
+
+# Determine whether or not we need to include the dependency files
+#
+NO_DEP_TARGETS	:= $(BIN) clean veryclean
+ifeq ($(MAKECMDGOALS),)
+NEED_DEPS	:= 1
+endif
+ifneq ($(strip $(filter-out $(NO_DEP_TARGETS),$(MAKECMDGOALS))),)
+NEED_DEPS	:= 1
+endif
+
+###############################################################################
+#
+# Select build architecture and platform based on $(BIN)
+#
+# BIN has the form bin[-[<arch>-]<platform>[-sb]]
+
+ARCHS		:= $(patsubst arch/%,%,$(wildcard arch/*))
+PLATFORMS	:= $(patsubst config/defaults/%.h,%,\
+		     $(wildcard config/defaults/*.h))
+archs :
+	@$(ECHO) $(ARCHS)
+
+platforms :
+	@$(ECHO) $(PLATFORMS)
+
+ifdef BIN
+
+# Split $(BIN) into architecture, platform, and security flag (where present)
+BIN_ELEMENTS	:= $(subst -,$(SPACE),$(BIN))
+BIN_APS		:= $(wordlist 2,4,$(BIN_ELEMENTS))
+ifeq ($(lastword $(BIN_APS)),sb)
+BIN_AP		:= $(wordlist 2,$(words $(BIN_APS)),discard $(BIN_APS))
+BIN_SECUREBOOT	:= 1
+else
+BIN_AP		:= $(BIN_APS)
+BIN_SECUREBOOT	:= 0
+endif
+BIN_PLATFORM	:= $(lastword $(BIN_AP))
+BIN_ARCH	:= $(wordlist 2,$(words $(BIN_AP)),discard $(BIN_AP))
+
+# Determine build architecture
+DEFAULT_ARCH	:= i386
+ARCH		:= $(firstword $(BIN_ARCH) $(DEFAULT_ARCH))
+CFLAGS		+= -DARCH=$(ARCH)
+arch :
+	@$(ECHO) $(ARCH)
+.PHONY : arch
+
+# Determine build platform
+DEFAULT_PLATFORM := pcbios
+PLATFORM	:= $(firstword $(BIN_PLATFORM) $(DEFAULT_PLATFORM))
+CFLAGS		+= -DPLATFORM=$(PLATFORM) -DPLATFORM_$(PLATFORM)
+platform :
+	@$(ECHO) $(PLATFORM)
+
+# Determine security flag
+DEFAULT_SECUREBOOT := 0
+SECUREBOOT	:= $(firstword $(BIN_SECUREBOOT) $(DEFAULT_SECUREBOOT))
+CFLAGS		+= -DSECUREBOOT=$(SECUREBOOT)
+secureboot :
+	@$(ECHO) $(SECUREBOOT)
+
+endif # defined(BIN)
+
+# Include architecture-specific Makefile
+ifdef ARCH
+MAKEDEPS	+= arch/$(ARCH)/Makefile
+include arch/$(ARCH)/Makefile
+endif
+
+# Include architecture-specific include path
+ifdef ARCH
+INCDIRS		+= arch/$(ARCH)/include
+endif
+
+###############################################################################
+#
+# Especially ugly workarounds
+
+# Some widespread patched versions of gcc include -fPIE -Wl,-pie by
+# default.  Note that gcc will exit *successfully* if it fails to
+# recognise an option that starts with "no", so we have to test for
+# output on stderr instead of checking the exit status.
+#
+# Current versions of gcc require -no-pie; older versions require
+# -nopie.  We therefore test for both.
+#
+# This workaround must be determined only after the
+# architecture-specific Makefile has been included, since some
+# platforms (e.g. bin-x86_64-efi) will explicitly require the use of
+# -fpie.
+#
+ifeq ($(filter -fpie,$(CFLAGS)),)
+ifeq ($(CCTYPE),gcc)
+PIE_TEST = [ -z "`$(CC) -fno-PIE -no-pie -x c -c /dev/null -o /dev/null 2>&1`" ]
+PIE_FLAGS := $(shell $(PIE_TEST) && $(ECHO) '-fno-PIE -no-pie')
+PIE_TEST2 = [ -z "`$(CC) -fno-PIE -nopie -x c -c /dev/null -o /dev/null 2>&1`" ]
+PIE_FLAGS2 := $(shell $(PIE_TEST2) && $(ECHO) '-fno-PIE -nopie')
+WORKAROUND_CFLAGS += $(PIE_FLAGS) $(PIE_FLAGS2)
+endif
+endif
+
+# Some widespread patched versions of gcc include -fcf-protection=full
+# by default.
+#
+ifeq ($(CCTYPE),gcc)
+CFP_TEST = $(CC) -fcf-protection=none -x c -c /dev/null -o /dev/null \
+		 >/dev/null 2>&1
+CFP_FLAGS := $(shell $(CFP_TEST) && $(ECHO) '-fcf-protection=none')
+WORKAROUND_CFLAGS += $(CFP_FLAGS)
+endif
+
+###############################################################################
+#
+# Source file handling
+
+# Exclude known-insecure files from Secure Boot builds
+ifeq ($(SECUREBOOT),0)
+SRCDIRS		+= $(SRCDIRS_INSEC)
+endif
+
+# SRCDIRS lists all directories containing source files.
+srcdirs :
+	@$(ECHO) $(SRCDIRS)
+
+# SRCS lists all .c or .S files found in any SRCDIR
+#
+SRCS	+= $(wildcard $(patsubst %,%/*.c,$(SRCDIRS)))
+SRCS	+= $(wildcard $(patsubst %,%/*.S,$(SRCDIRS)))
+srcs :
+	@$(ECHO) $(SRCS)
+
+# AUTO_SRCS lists all files in SRCS that are not mentioned in
+# NON_AUTO_SRCS.  Files should be added to NON_AUTO_SRCS if they
+# cannot be built using the standard build template.
+#
+AUTO_SRCS = $(filter-out $(NON_AUTO_SRCS),$(SRCS))
+autosrcs :
+	@$(ECHO) $(AUTO_SRCS)
+
+# Just about everything else in this section depends upon having
+# $(BIN) set
+
+ifdef BIN
+
+# INCDIRS lists the include path
+incdirs :
+	@$(ECHO) $(INCDIRS)
+
+# Inhibit -fstack-protector (which is implicitly enabled in some
+# patched gcc versions) unless explicitly mentioned in CFLAGS.
+#
+ifeq ($(findstring -fstack-protector,$(CFLAGS)),)
+CFLAGS		+= -fno-stack-protector
+endif
+
+# Common flags
+#
+CFLAGS		+= $(foreach INC,$(INCDIRS),-I$(INC))
+CFLAGS		+= -Os
+CFLAGS		+= -g
+ifeq ($(CCTYPE),gcc)
+CFLAGS		+= -ffreestanding
+CFLAGS		+= -fcommon
+CFLAGS		+= -Wall -W -Wformat-nonliteral
+CFLAGS		+= -Wno-array-bounds -Wno-dangling-pointer
+HOST_CFLAGS	+= -Wall -W -Wformat-nonliteral
+HOST_CFLAGS	+= -Wno-array-bounds -Wno-dangling-pointer
+endif
+CFLAGS		+= $(WORKAROUND_CFLAGS) $(EXTRA_CFLAGS)
+ASFLAGS		+= $(WORKAROUND_ASFLAGS) $(EXTRA_ASFLAGS)
+LDFLAGS		+= $(WORKAROUND_LDFLAGS) $(EXTRA_LDFLAGS)
+HOST_CFLAGS	+= -O2 -g
+
+# Inhibit -Werror if NO_WERROR is specified on make command line
+#
+ifneq ($(NO_WERROR),1)
+CFLAGS		+= -Werror
+ASFLAGS		+= --fatal-warnings
+HOST_CFLAGS	+= -Werror
+endif
+
+# Enable per-item sections and section garbage collection.  Note that
+# some older versions of gcc support -fdata-sections but treat it as
+# implying -fno-common, which would break our build.  Some other older
+# versions issue a spurious and uninhibitable warning if
+# -ffunction-sections is used with -g, which would also break our
+# build since we use -Werror.
+#
+ifeq ($(CCTYPE),gcc)
+DS_TEST		= $(ECHO) 'char x;' | \
+		  $(CC) -fdata-sections -S -x c - -o - 2>/dev/null | \
+		  grep -E '\.comm' > /dev/null
+DS_FLAGS	:= $(shell $(DS_TEST) && $(ECHO) '-fdata-sections')
+FS_TEST		= $(CC) -ffunction-sections -g -c -x c /dev/null \
+		  -o /dev/null 2>/dev/null
+FS_FLAGS	:= $(shell $(FS_TEST) && $(ECHO) '-ffunction-sections')
+CFLAGS		+= $(FS_FLAGS) $(DS_FLAGS)
+endif
+LDFLAGS		+= --gc-sections
+
+# Force creation of static binaries (required for OpenBSD, does no
+# harm on other platforms).
+#
+LDFLAGS		+= -static
+
+# Use separate code segment if supported by linker
+#
+ZSC_TEST	= $(LD) -z separate-code --version 2>&1 > /dev/null
+ZSC_FLAGS	:= $(shell [ -z "`$(ZSC_TEST)`" ] && \
+		     $(ECHO) '-z separate-code -z max-page-size=4096')
+LDFLAGS		+= $(ZSC_FLAGS)
+
+# compiler.h is needed for our linking and debugging system
+#
+CFLAGS		+= -include include/compiler.h
+
+# The section type character (e.g. "@" in "@progbits") varies by
+# architecture.
+#
+CFLAGS		+= -DASM_TCHAR='$(ASM_TCHAR)' -DASM_TCHAR_OPS='$(ASM_TCHAR_OPS)'
+
+# Inhibit the default -Dlinux
+#
+CFLAGS		+= -Ulinux
+
+# CFLAGS for specific object types
+#
+CFLAGS_c	+=
+CFLAGS_S 	+= -DASSEMBLY
+
+# Base object name of the current target
+#
+OBJECT		= $(firstword $(subst ., ,$(@F)))
+
+# CFLAGS for specific object files.  You can define
+# e.g. CFLAGS_rtl8139, and have those flags automatically used when
+# compiling bin/rtl8139.o.
+#
+OBJ_CFLAGS	= $(CFLAGS_$(OBJECT)) -DOBJECT=$(subst -,_,$(OBJECT))
+$(BIN)/%.flags :
+	@$(ECHO) $(OBJ_CFLAGS)
+
+# Debug level calculations
+#
+DBGLVL_MAX	= -DDBGLVL_MAX=$(firstword $(subst ., ,$(1)))
+DBGLVL_DFLT	= -DDBGLVL_DFLT=$(lastword $(subst ., ,$(1)))
+DBGLVL		= $(call DBGLVL_MAX,$(1)) $(call DBGLVL_DFLT,$(1))
+
+# Rules for specific object types.
+#
+COMPILE_c	= $(CC) $(CFLAGS) $(CFLAGS_c) $(OBJ_CFLAGS)
+RULE_c		= $(Q)$(COMPILE_c) -c $< -o $@
+RULE_c_to_ids.o = $(Q)$(ECHO_E) '$(OBJ_IDS_ASM_NL)' | $(ASSEMBLE_S) -o $@
+RULE_c_to_dbg%.o= $(Q)$(COMPILE_c) $(call DBGLVL,$*) -c $< -o $@
+RULE_c_to_c	= $(Q)$(COMPILE_c) -E -c $< > $@
+RULE_c_to_s	= $(Q)$(COMPILE_c) -S -g0 -c $< -o $@
+
+PREPROCESS_S	= $(CPP) $(CFLAGS) $(CFLAGS_S) $(OBJ_CFLAGS)
+ASSEMBLE_S	= $(AS) $(ASFLAGS)
+RULE_S		= $(Q)$(PREPROCESS_S) $< | $(ASSEMBLE_S) -o $@
+RULE_S_to_dbg%.o= $(Q)$(PREPROCESS_S) $(call DBGLVL,$*) $< | $(ASSEMBLE_S) -o $@
+RULE_S_to_s	= $(Q)$(PREPROCESS_S) $< > $@
+
+GENERIC_TARGETS	+= ids.o dbg%.o c s
+
+# List of embedded images included in the last build of embedded.o.
+# This is needed in order to correctly rebuild embedded.o whenever the
+# list of objects changes.
+#
+EMBED		:= $(EMBEDDED_IMAGE) # Maintain backwards compatibility
+EMBEDDED_LIST	:= $(BIN)/.embedded.list
+ifeq ($(wildcard $(EMBEDDED_LIST)),)
+EMBED_OLD := <invalid>
+else
+EMBED_OLD := $(shell cat $(EMBEDDED_LIST))
+endif
+ifneq ($(EMBED_OLD),$(EMBED))
+$(shell $(ECHO) "$(EMBED)" > $(EMBEDDED_LIST))
+endif
+
+$(EMBEDDED_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(EMBEDDED_LIST)
+
+EMBEDDED_FILES	:= $(subst $(COMMA), ,$(EMBED))
+EMBED_ALL	:= $(foreach i,$(call seq,1,$(words $(EMBEDDED_FILES))),\
+		     EMBED ( $(i), \"$(word $(i), $(EMBEDDED_FILES))\",\
+			     \"$(notdir $(word $(i),$(EMBEDDED_FILES)))\" ))
+
+embedded_DEPS += $(EMBEDDED_FILES) $(EMBEDDED_LIST)
+
+CFLAGS_embedded = -DEMBED_ALL="$(EMBED_ALL)"
+
+# List of trusted root certificates
+#
+TRUSTED_LIST	:= $(BIN)/.trusted.list
+ifeq ($(wildcard $(TRUSTED_LIST)),)
+TRUST_OLD := <invalid>
+else
+TRUST_OLD := $(shell cat $(TRUSTED_LIST))
+endif
+ifneq ($(TRUST_OLD),$(TRUST))
+$(shell $(ECHO) "$(TRUST)" > $(TRUSTED_LIST))
+endif
+
+$(TRUSTED_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(TRUSTED_LIST)
+
+# Trusted root certificate fingerprints
+#
+TRUSTED_CERTS	:= $(subst $(COMMA), ,$(TRUST))
+TRUSTED_FPS	:= $(foreach CERT,$(TRUSTED_CERTS),\
+		     0x$(subst :,$(COMMA) 0x,$(lastword $(subst =, ,\
+			 $(shell $(OPENSSL) x509 -in $(CERT) -noout -sha256 \
+				 -fingerprint))))$(COMMA))
+
+rootcert_DEPS += $(TRUSTED_FILES) $(TRUSTED_LIST)
+
+CFLAGS_rootcert = $(if $(TRUSTED_FPS),-DTRUSTED="$(TRUSTED_FPS)")
+
+# List of embedded certificates
+#
+CERT_LIST := $(BIN)/.certificate.list
+ifeq ($(wildcard $(CERT_LIST)),)
+CERT_OLD := <invalid>
+else
+CERT_OLD := $(shell cat $(CERT_LIST))
+endif
+ifneq ($(CERT_OLD),$(CERT))
+$(shell $(ECHO) "$(CERT)" > $(CERT_LIST))
+endif
+
+$(CERT_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(CERT_LIST)
+
+# Embedded certificates concatenated and then split into one file per
+# certificate (even if original files contained certificate chains)
+#
+CERT_FILES := $(subst $(COMMA), ,$(CERT))
+CERT_CONCAT := $(BIN)/.certificates.pem
+
+ifneq ($(CERT),)
+
+CERT_COUNT := $(shell grep "BEGIN CERTIFICATE" $(CERT_FILES) | wc -l)
+
+$(CERT_CONCAT) : $(CERT_FILES) $(CERT_LIST)
+	$(Q)cat $(CERT_FILES) > $@
+
+# We must use an (otherwise unnecessary) pattern rule here to encode
+# the fact that one "csplit" command generates multiple targets
+CERT_PEMS := $(foreach i,$(call seq,1,$(CERT_COUNT)),\
+	       $(BIN)/.certificate.pem.$(i))
+$(subst .pem.,.%.,$(CERT_PEMS)) : $(BIN)/.certificates.%
+	$(Q)$(CSPLIT) -q -n 1 -f $(BIN)/.certificate.pem. $< \
+		'/BEGIN CERTIFICATE/' '{*}'
+
+CERT_DERS := $(subst .certificate.pem.,.certificate.der.,$(CERT_PEMS))
+$(BIN)/.certificate.der.% : $(BIN)/.certificate.pem.%
+	$(Q)$(OPENSSL) x509 -in $< -outform DER -out $@
+
+CERT_ALL := $(foreach i,$(call seq,1,$(CERT_COUNT)),\
+	      CERT ( $(i), \"$(word $(i),$(CERT_DERS))\" ))
+
+endif
+
+certstore_DEPS += $(CERT_LIST) $(CERT_FILES) $(CERT_PEMS) $(CERT_DERS)
+
+CFLAGS_certstore += -DCERT_ALL="$(CERT_ALL)"
+
+CLEANUP += $(BIN)/.certificate.* $(BIN)/.certificates.*
+
+# (Single-element) list of private keys
+#
+ifdef KEY
+PRIVKEY	:= $(KEY) # Maintain backwards compatibility
+endif
+PRIVKEY_LIST := $(BIN)/.private_key.list
+ifeq ($(wildcard $(PRIVKEY_LIST)),)
+PRIVKEY_OLD := <invalid>
+else
+PRIVKEY_OLD := $(shell cat $(PRIVKEY_LIST))
+endif
+ifneq ($(PRIVKEY_OLD),$(PRIVKEY))
+$(shell $(ECHO) "$(PRIVKEY)" > $(PRIVKEY_LIST))
+endif
+
+$(PRIVKEY_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(PRIVKEY_LIST)
+
+# Embedded private key
+#
+PRIVKEY_INC := $(BIN)/.private_key.der
+
+ifdef PRIVKEY
+$(PRIVKEY_INC) : $(PRIVKEY) $(PRIVKEY_LIST)
+	$(Q)$(OPENSSL) rsa -in $< -outform DER -out $@
+
+privkey_DEPS += $(PRIVKEY_INC)
+endif
+
+CLEANUP += $(BIN)/.private_key.*
+
+privkey_DEPS += $(PRIVKEY_LIST)
+
+CFLAGS_privkey += $(if $(PRIVKEY),-DPRIVATE_KEY="\"$(PRIVKEY_INC)\"")
+
+# (Single-element) list of named configurations
+#
+CONFIG_LIST := $(BIN)/.config.list
+ifeq ($(wildcard $(CONFIG_LIST)),)
+CONFIG_OLD := <invalid>
+else
+CONFIG_OLD := $(shell cat $(CONFIG_LIST))
+endif
+ifneq ($(CONFIG_OLD),$(CONFIG))
+$(shell $(ECHO) "$(CONFIG)" > $(CONFIG_LIST))
+endif
+
+$(CONFIG_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(CONFIG_LIST)
+
+# Named configurations
+#
+ifneq ($(CONFIG),)
+ifneq ($(wildcard config/$(CONFIG)),)
+CFLAGS	+= -DCONFIG=$(CONFIG)
+endif
+CFLAGS	+= -DLOCAL_CONFIG=$(CONFIG)
+endif
+
+config/named.h : $(CONFIG_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : config/named.h
+
+# (Single-element) list of assertion configuration
+#
+ASSERT_LIST := $(BIN)/.assert.list
+ifeq ($(wildcard $(ASSERT_LIST)),)
+ASSERT_OLD := <invalid>
+else
+ASSERT_OLD := $(shell cat $(ASSERT_LIST))
+endif
+ifneq ($(ASSERT_OLD),$(ASSERT))
+$(shell $(ECHO) "$(ASSERT)" > $(ASSERT_LIST))
+endif
+
+$(ASSERT_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(ASSERT_LIST)
+
+# Assertion configuration
+#
+ifneq ($(ASSERT),)
+CFLAGS	+= -DASSERTING=$(ASSERT)
+endif
+
+include/assert.h : $(ASSERT_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : include/assert.h
+
+# (Single-element) list of profiling configuration
+#
+PROFILE_LIST := $(BIN)/.profile.list
+ifeq ($(wildcard $(PROFILE_LIST)),)
+PROFILE_OLD := <invalid>
+else
+PROFILE_OLD := $(shell cat $(PROFILE_LIST))
+endif
+ifneq ($(PROFILE_OLD),$(PROFILE))
+$(shell $(ECHO) "$(PROFILE)" > $(PROFILE_LIST))
+endif
+
+$(PROFILE_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(PROFILE_LIST)
+
+# Profiling configuration
+#
+ifneq ($(PROFILE),)
+CFLAGS	+= -DPROFILING=$(PROFILE)
+endif
+
+include/ipxe/profile.h : $(PROFILE_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : include/ipxe/profile.h
+
+# (Single-element) list of function recorder configuration
+#
+FNREC_LIST := $(BIN)/.fnrec.list
+ifeq ($(wildcard $(FNREC_LIST)),)
+FNREC_OLD := <invalid>
+else
+FNREC_OLD := $(shell cat $(FNREC_LIST))
+endif
+ifneq ($(FNREC_OLD),$(FNREC))
+$(shell $(ECHO) "$(FNREC)" > $(FNREC_LIST))
+endif
+
+$(FNREC_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(FNREC_LIST)
+
+# Function recorder configuration
+#
+ifeq ($(FNREC),1)
+# Enabling -finstrument-functions affects gcc's analysis and leads to spurious
+# warnings about use of uninitialised variables.
+#
+CFLAGS		+= -Wno-uninitialized
+CFLAGS		+= -finstrument-functions
+CFLAGS		+= -finstrument-functions-exclude-file-list=core/fnrec.c
+endif
+
+include/compiler.h : $(FNREC_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : include/compiler.h
+
+# These files use .incbin inline assembly to include a binary file.
+# Unfortunately ccache does not detect this dependency and caches
+# builds even when the binary file has changed.
+#
+$(BIN)/embedded.% : override CC := env CCACHE_DISABLE=1 $(CC)
+$(BIN)/certstore.% : override CC := env CCACHE_DISABLE=1 $(CC)
+$(BIN)/privkey.% : override CC := env CCACHE_DISABLE=1 $(CC)
+
+# Debug message autocolourisation range
+#
+DBGCOL_LIST	:= $(BIN)/.dbgcol.list
+ifeq ($(wildcard $(DBGCOL_LIST)),)
+DBGCOL_OLD := <invalid>
+else
+DBGCOL_OLD := $(shell cat $(DBGCOL_LIST))
+endif
+ifneq ($(DBGCOL_OLD),$(DBGCOL))
+$(shell $(ECHO) "$(DBGCOL)" > $(DBGCOL_LIST))
+endif
+
+$(DBGCOL_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(DBGCOL_LIST)
+
+DBGCOL_COLOURS := $(subst -, ,$(DBGCOL))
+DBGCOL_MIN := $(firstword $(DBGCOL_COLOURS))
+DBGCOL_MAX := $(lastword $(DBGCOL_COLOURS))
+
+debug_DEPS += $(DBGCOL_LIST)
+
+CFLAGS_debug += $(if $(DBGCOL_MIN),-DDBGCOL_MIN=$(DBGCOL_MIN))
+CFLAGS_debug += $(if $(DBGCOL_MAX),-DDBGCOL_MAX=$(DBGCOL_MAX))
+
+# We automatically generate rules for any file mentioned in AUTO_SRCS
+# using the following set of templates.  We use $(eval ...) if
+# available, otherwise we generate separate Makefile fragments and
+# include them.
+
+# deps_template : generate dependency list for a given source file
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+#
+define deps_template_file
+$(call deps_template_parts,$(1),$(subst .,,$(suffix $(1))),$(basename $(notdir $(1))))
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+# $(2) is the source type (e.g. "c")
+# $(3) is the source base name (e.g. "rtl8139")
+#
+define deps_template_parts
+	@$(ECHO) "  [DEPS] $(1)"
+	@$(MKDIR) -p $(BIN)/deps/$(dir $(1))
+	$(Q)$(CPP) $(CFLAGS) $(CFLAGS_$(2)) $(CFLAGS_$(3)) -DOBJECT=$(3) \
+		-Wno-error -M $(1) -MG -MP | \
+		sed 's/\.o[[:blank:]]*:/_DEPS +=/' > $(BIN)/deps/$(1).d
+endef
+
+# rules_template : generate rules for a given source file
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+#
+define rules_template
+$(call rules_template_parts,$(1),$(subst .,,$(suffix $(1))),$(basename $(notdir $(1))))
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+# $(2) is the source type (e.g. "c")
+# $(3) is the source base name (e.g. "rtl8139")
+#
+define rules_template_parts
+$$(BIN)/$(3).o : $(1) $$(MAKEDEPS) $$($(3)_DEPS)
+	$$(QM)$(ECHO) "  [BUILD] $$@"
+	$$(RULE_$(2))
+BOBJS += $$(BIN)/$(3).o
+$(foreach TGT,$(GENERIC_TARGETS),$(if $(RULE_$(2)_to_$(TGT)),$(NEWLINE)$(call rules_template_target,$(1),$(2),$(3),$(TGT))))
+$$(BIN)/deps/$(1).d : $$($(3)_DEPS)
+TAGS : $$($(3)_DEPS)
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+# $(2) is the source type (e.g. "c")
+# $(3) is the source base name (e.g. "rtl8139")
+# $(4) is the destination type (e.g. "dbg%.o")
+#
+define rules_template_target
+$$(BIN)/$(3).$(4) : $(1) $$(MAKEDEPS) $$($(3)_DEPS)
+	$$(QM)$(ECHO) "  [BUILD] $$@"
+	$$(RULE_$(2)_to_$(4))
+$(TGT)_OBJS += $$(BIN)/$(3).$(4)
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+#
+define rules_template_file
+	@$(ECHO) "  [RULES] $(1)"
+	@$(MKDIR) -p $(BIN)/rules/$(dir $(1))
+	@$(ECHO_E) '$(subst $(NEWLINE),\n,$(call rules_template,$(1)))' \
+		 > $(BIN)/rules/$(1).r
+endef
+
+# Generate the dependency files
+#
+$(BIN)/deps/%.d : % $(MAKEDEPS)
+	$(call deps_template_file,$<)
+
+# Calculate list of dependency files
+#
+AUTO_DEPS	= $(patsubst %,$(BIN)/deps/%.d,$(AUTO_SRCS) core/version.c)
+autodeps :
+	@$(ECHO) $(AUTO_DEPS)
+VERYCLEANUP	+= $(BIN)/deps
+
+# Include dependency files
+#
+ifdef NEED_DEPS
+ifneq ($(AUTO_DEPS),)
+-include $(AUTO_DEPS)
+endif
+endif
+
+# Generate the rules files
+#
+$(BIN)/rules/%.r : % $(MAKEDEPS)
+	$(call rules_template_file,$<)
+
+# Calculate list of rules files
+#
+AUTO_RULES	= $(patsubst %,$(BIN)/rules/%.r,$(AUTO_SRCS))
+autorules :
+	@$(ECHO) $(AUTO_RULES)
+VERYCLEANUP	+= $(BIN)/rules
+
+# Evaluate rules (or include rules files)
+#
+ifdef NEED_DEPS
+ifneq ($(AUTO_RULES),)
+ifneq ($(HAVE_EVAL),)
+$(foreach SRC,$(AUTO_SRCS),$(eval $(call rules_template,$(SRC))))
+else
+-include $(AUTO_RULES)
+endif
+endif
+endif
+
+# Files to be parsed using parserom.pl
+#
+ROM_SRCS	= $(foreach SRC,$(AUTO_SRCS),\
+		    $(if $(findstring drivers/,$(SRC)),$(SRC)))
+romsrcs :
+	@$(ECHO) $(ROM_SRCS)
+
+# List of files to be parsed using parserom.pl
+#
+ROM_SRCS_LIST	:= $(BIN)/.rom.list
+ifeq ($(wildcard $(ROM_SRCS_LIST)),)
+ROM_SRCS_OLD := <invalid>
+else
+ROM_SRCS_OLD := $(shell cat $(ROM_SRCS_LIST))
+endif
+ifneq ($(ROM_SRCS_OLD),$(ROM_SRCS))
+$(shell $(ECHO) "$(ROM_SRCS)" > $(ROM_SRCS_LIST))
+endif
+
+$(ROM_SRCS_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(ROM_SRCS_LIST)
+
+# ROM definition file
+#
+ROMDEFS		= $(BIN)/.rom.defs
+$(ROMDEFS) : $(ROM_SRCS) $(ROM_SRCS_LIST) $(PARSEROM) $(MAKEDEPS)
+	$(QM)$(ECHO) "  [PARSEROM]"
+	$(Q)$(PERL) $(PARSEROM) $(ROM_SRCS) > $@
+
+VERYCLEANUP	+= $(ROMDEFS)
+
+# Evaluate ROM definition file
+ifdef NEED_DEPS
+ifneq ($(ROM_SRCS),)
+-include $(ROMDEFS)
+endif
+endif
+
+# Device ID tables (using IDs from ROM definition file)
+#
+define obj_pci_id_asm
+	.section ".note.GNU-stack", "", $(ASM_TCHAR)progbits
+	.section ".pci_devlist.$(1)", "a", $(ASM_TCHAR)progbits
+	.globl pci_devlist_$(1)
+pci_devlist_$(1):
+	.short ( 0x$(1) & 0xffff )
+
+endef
+define obj_isa_id_asm
+endef
+OBJ_IDS_ASM	= $(foreach ROM,$(ROMS_$(OBJECT)),$(call obj_$(ROM_TYPE_$(ROM))_id_asm,$(ROM)))
+OBJ_IDS_ASM_NL	= $(subst $(NEWLINE),\n,$(OBJ_IDS_ASM))
+$(BIN)/%.ids :
+	@$(ECHO_E) '$(OBJ_IDS_ASM_NL)'
+
+BOBJS	+= $(patsubst %,$(BIN)/%.ids.o,$(DRIVERS))
+
+# The following variables are created by the autogenerated rules
+#
+bobjs :
+	@$(ECHO) $(BOBJS)
+drivers_% :
+	@$(ECHO) $(DRIVERS_$*)
+drivers :
+	@$(ECHO) $(DRIVERS)
+.PHONY : drivers
+roms :
+	@$(ECHO) $(ROMS)
+
+# Generate error usage information
+#
+$(BIN)/%.einfo : $(BIN)/%.o
+	$(QM)$(ECHO) "  [EINFO] $@"
+	$(Q)$(OBJCOPY) -O binary -j .einfo --set-section-flags .einfo=alloc \
+		$< $@
+
+EINFOS		:= $(patsubst $(BIN)/%.o,$(BIN)/%.einfo,$(BOBJS))
+$(BIN)/errors : $(EINFOS) $(EINFO)
+	$(QM)$(ECHO) "  [EINFO] $@"
+	$(Q)$(EINFO) $(EINFOS) | sort > $@
+CLEANUP		+= $(BIN)/errors	# Doesn't match the $(BIN)/*.* pattern
+
+# Generate the NIC file from the parsed source files.  The NIC file is
+# only for rom-o-matic.
+#
+$(BIN)/NIC : $(AUTO_DEPS)
+	@$(ECHO) '# This is an automatically generated file, do not edit' > $@
+	@$(ECHO) '# It does not affect anything in the build, ' \
+	     'it is only for rom-o-matic' >> $@
+	@$(ECHO) >> $@
+	@perl -ne 'chomp; print "$$1\n" if /\# NIC\t(.*)$$/' $^ >> $@
+CLEANUP		+= $(BIN)/NIC	# Doesn't match the $(BIN)/*.* pattern
+
+# Analyse a target name (e.g. "bin/dfe538--prism2_pci.rom.tmp") and
+# derive the variables:
+# 
+# TGT_ELEMENTS : the elements of the target (e.g. "dfe538 prism2_pci")
+# TGT_PREFIX   : the prefix type (e.g. "pcirom")
+# TGT_DRIVERS  : the driver for each element (e.g. "rtl8139 prism2_pci")
+# TGT_ROM_NAME : the ROM name (e.g. "dfe538")
+#
+TGT_ELEMENTS	= $(subst --, ,$(firstword $(subst ., ,$(notdir $@))))
+TGT_ROM_NAME	= $(firstword $(TGT_ELEMENTS))
+TGT_DRIVERS	= $(strip $(foreach TGT_ELEMENT,$(TGT_ELEMENTS), \
+				    $(if $(DRIVERS_$(TGT_ELEMENT)), \
+					 $(DRIVERS_$(TGT_ELEMENT)), \
+					 $(firstword $(DRIVER_$(TGT_ELEMENT)) \
+						     $(TGT_ELEMENT)))))
+TGT_PREFIX_NAME	= $(word 2,$(subst ., ,$(notdir $@)))
+TGT_PREFIX	= $(strip $(if $(filter rom,$(TGT_PREFIX_NAME)), \
+			       $(ROM_TYPE_$(TGT_ROM_NAME))rom, \
+			       $(TGT_PREFIX_NAME)))
+
+# Look up ROM IDs for the current target
+# (e.g. "bin/dfe538--prism2_pci.rom.tmp") and derive the variables:
+#
+# TGT_PCI_VENDOR : the PCI vendor ID (e.g. "0x1186")
+# TGT_PCI_DEVICE : the PCI device ID (e.g. "0x1300")
+#
+TGT_PCI_VENDOR	= $(PCI_VENDOR_$(TGT_ROM_NAME))
+TGT_PCI_DEVICE	= $(PCI_DEVICE_$(TGT_ROM_NAME))
+
+# Calculate link-time options for the current target
+# (e.g. "bin/dfe538--prism2_pci.rom.tmp") and derive the variables:
+#
+# TGT_LD_DRIVERS : symbols to require in order to drag in the relevant drivers
+#		   (e.g. "obj_rtl8139 obj_prism2_pci")
+# TGT_LD_IDS :     symbols to define in order to fill in ID structures in the
+#		   ROM header (e.g."pci_vendor_id=0x1186 pci_device_id=0x1300")
+#
+TGT_LD_DRIVERS	= $(subst -,_,$(patsubst %,obj_%,$(TGT_DRIVERS)))
+TGT_LD_IDS	= pci_vendor_id=$(firstword $(TGT_PCI_VENDOR) 0) \
+		  pci_device_id=$(firstword $(TGT_PCI_DEVICE) 0)
+TGT_LD_DEVLIST	= $(foreach ELEM,$(TGT_ELEMENTS),$(if $(PCI_VENDOR_$(ELEM)),\
+		    pci_devlist_$(patsubst 0x%,%,$(PCI_VENDOR_$(ELEM)))$(patsubst 0x%,%,$(PCI_DEVICE_$(ELEM)))))
+TGT_LD_ENTRY	= _$(TGT_PREFIX)_start
+
+# Calculate linker flags based on link-time options for the current
+# target type (e.g. "bin/dfe538--prism2_pci.rom.tmp") and derive the
+# variables:
+#
+# TGT_LD_FLAGS : target-specific flags to pass to linker (e.g.
+#		 "-u obj_zpciprefix -u obj_rtl8139 -u obj_prism2_pci
+#		  --defsym pci_vendor=0x1186 --defsym pci_device=0x1300")
+#
+TGT_LD_FLAGS	= $(foreach SYM,$(TGT_LD_ENTRY) $(TGT_LD_DRIVERS) \
+		    $(TGT_LD_DEVLIST) obj_config obj_config_$(PLATFORM),\
+		    -u $(SYMBOL_PREFIX)$(SYM) \
+		    --defsym check_$(SYM)=$(SYMBOL_PREFIX)$(SYM) ) \
+		  $(patsubst %,--defsym %,$(TGT_LD_IDS)) \
+		  -e $(SYMBOL_PREFIX)$(TGT_LD_ENTRY)
+
+# Calculate list of debugging versions of objects to be included in
+# the target.
+#
+DEBUG_LIST	= $(subst $(COMMA), ,$(DEBUG))
+DEBUG_MAX	= $(firstword $(word 2,$(subst :, ,$(1))) 1)
+DEBUG_DFLT	= $(if $(word 3,$(subst :, ,$(1))),.$(word 3,$(subst :, ,$(1))))
+DEBUG_LEVEL	= $(call DEBUG_MAX,$(1))$(call DEBUG_DFLT,$(1))
+DEBUG_BASE	= $(firstword $(subst :, ,$(1))).dbg$(call DEBUG_LEVEL,$(1))
+DEBUG_OBJ	= $(BIN)/$(call DEBUG_BASE,$(1)).o
+DEBUG_ORIG_OBJ	= $(BIN)/$(firstword $(subst :, ,$(1))).o
+DEBUG_OBJS	= $(foreach D,$(DEBUG_LIST),$(call DEBUG_OBJ,$(D)))
+DEBUG_ORIG_OBJS	= $(foreach D,$(DEBUG_LIST),$(call DEBUG_ORIG_OBJ,$(D)))
+BLIB_OBJS	= $(DEBUG_OBJS) $(filter-out $(DEBUG_ORIG_OBJS),$(BOBJS))
+
+# Print out all derived information for a given target.
+#
+$(BIN)/%.info :
+	@$(ECHO) 'Elements             : $(TGT_ELEMENTS)'
+	@$(ECHO) 'Prefix               : $(TGT_PREFIX)'
+	@$(ECHO) 'Drivers              : $(TGT_DRIVERS)'
+	@$(ECHO) 'ROM name             : $(TGT_ROM_NAME)'
+	@$(ECHO)
+	@$(ECHO) 'PCI vendor           : $(TGT_PCI_VENDOR)'
+	@$(ECHO) 'PCI device           : $(TGT_PCI_DEVICE)'
+	@$(ECHO)
+	@$(ECHO) 'LD driver symbols    : $(TGT_LD_DRIVERS)'
+	@$(ECHO) 'LD ID symbols        : $(TGT_LD_IDS)'
+	@$(ECHO) 'LD devlist symbols   : $(TGT_LD_DEVLIST)'
+	@$(ECHO) 'LD entry point       : $(TGT_LD_ENTRY)'
+	@$(ECHO)
+	@$(ECHO) 'LD target flags      : $(TGT_LD_FLAGS)'
+	@$(ECHO)
+	@$(ECHO) 'Debugging objects    : $(DEBUG_OBJS)'
+	@$(ECHO) 'Replaced objects     : $(DEBUG_ORIG_OBJS)'
+
+# List of objects included in the last build of blib.  This is needed
+# in order to correctly rebuild blib whenever the list of objects
+# changes.
+#
+BLIB_LIST	:= $(BIN)/.blib.list
+ifeq ($(wildcard $(BLIB_LIST)),)
+BLIB_OBJS_OLD	:= <invalid>
+else
+BLIB_OBJS_OLD	:= $(shell cat $(BLIB_LIST))
+endif
+ifneq ($(BLIB_OBJS_OLD),$(BLIB_OBJS))
+$(shell $(ECHO) "$(BLIB_OBJS)" > $(BLIB_LIST))
+endif
+
+$(BLIB_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(BLIB_LIST)
+
+# Library of all objects
+#
+BLIB		= $(BIN)/blib.a
+$(BLIB) : $(BLIB_OBJS) $(BLIB_LIST) $(MAKEDEPS)
+	$(Q)$(RM) $(BLIB)
+	$(QM)$(ECHO) "  [AR] $@"
+	$(Q)$(AR) rcD $@ $(sort $(BLIB_OBJS))
+	$(Q)$(OBJCOPY) --enable-deterministic-archives \
+		       --prefix-symbols=$(SYMBOL_PREFIX) $@
+	$(Q)$(RANLIB) -D $@
+blib : $(BLIB)
+
+# Command to generate build ID.  Must be unique for each $(BIN)/%.tmp,
+# even within the same build run.
+#
+# The build ID is supposed to be collision-free across all ROMs that
+# might ever end up installed in the same system.  It doesn't just
+# disambiguate targets within a single build; it also disambiguates
+# different builds (such as builds for multiple ROMs all built from
+# the same blib.a).
+#
+BUILD_ID_CMD = cat $^ | cksum | awk '{print $$1}'
+
+# Build timestamp
+#
+# Used as a means to automatically select the newest version of iPXE
+# if multiple iPXE drivers are loaded concurrently in a UEFI system.
+#
+# It gets rounded down to the nearest minute when used for this
+# purpose.
+#
+ifdef SOURCE_DATE_EPOCH
+BUILD_TIMESTAMP := $(SOURCE_DATE_EPOCH)
+else ifdef GITVERSION
+BUILD_TIMESTAMP := $(shell git log -1 --pretty=%ct)
+else
+BUILD_TIMESTAMP := $(shell date +%s)
+endif
+
+# Build version
+#
+GIT_INDEX := $(if $(GITVERSION),$(if $(wildcard ../.git/index),../.git/index))
+$(BIN)/version.%.o : core/version.c $(MAKEDEPS) $(version_DEPS) $(GIT_INDEX)
+	$(QM)$(ECHO) "  [VERSION] $@"
+	$(Q)$(COMPILE_c) -DBUILD_NAME="\"$*\"" \
+		-DVERSION_MAJOR=$(VERSION_MAJOR) \
+		-DVERSION_MINOR=$(VERSION_MINOR) \
+		-DVERSION_PATCH=$(VERSION_PATCH) \
+		-DVERSION="\"$(VERSION)\"" \
+		-c $< -o $@
+	$(Q)$(OBJCOPY) --prefix-symbols=$(SYMBOL_PREFIX) $@
+
+# Build an intermediate object file from the objects required for the
+# specified target.
+#
+$(BIN)/%.tmp : $(BIN)/version.%.o $(BLIB) $(MAKEDEPS) $(LDSCRIPT)
+	$(QM)$(ECHO) "  [LD] $@"
+	$(Q)$(LD) $(LDFLAGS) -T $(LDSCRIPT) $(TGT_LD_FLAGS) $< $(BLIB) -o $@ \
+		--defsym _build_id=$(shell $(BUILD_ID_CMD)) \
+		--defsym _build_timestamp=$(BUILD_TIMESTAMP) \
+		-Map $(BIN)/$*.tmp.map
+	$(Q)$(OBJDUMP) -ht $@ | $(PERL) $(SORTOBJDUMP) >> $(BIN)/$*.tmp.map
+
+# Keep intermediate object file (useful for debugging)
+.PRECIOUS : $(BIN)/%.tmp
+
+# Show a linker map for the specified target
+#
+$(BIN)/%.map : $(BIN)/%.tmp
+	@less $(BIN)/$*.tmp.map
+
+# Get objects list for the specified target
+#
+define objs_list
+	$(sort $(foreach OBJ_SYMBOL,\
+		 $(filter obj_%,$(shell $(NM) $(1) | cut -d" " -f3)),\
+		 $(patsubst obj_%,%,$(OBJ_SYMBOL))))
+endef
+$(BIN)/%.objs : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call objs_list,$<)
+$(BIN)/%.sizes : $(BIN)/%.tmp
+	$(Q)$(SIZE) -t $(foreach OBJ,$(call objs_list,$<),$(wildcard $(BIN)/$(subst _,?,$(OBJ)).o)) | \
+		sort -g
+
+# Get dependency list for the specified target
+#
+define deps_list
+	$(sort $(foreach OBJ,$(call objs_list,$(1)),$($(OBJ)_DEPS)))
+endef
+$(BIN)/%.deps : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call deps_list,$<)
+
+# Get unneeded source files for the specified target
+#
+define nodeps_list
+	$(sort $(filter-out $(call deps_list,$(1)),\
+		 $(foreach BOBJ,$(BOBJS),\
+		   $($(basename $(notdir $(BOBJ)))_DEPS))))
+endef
+$(BIN)/%.nodeps : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call nodeps_list,$<)
+
+# Get licensing verdict for the specified target
+#
+define licensable_deps_list
+	$(filter-out config/local/%.h,\
+	  $(filter-out $(BIN)/.%.list,\
+	    $(call deps_list,$(1))))
+endef
+define unlicensed_deps_list
+	$(shell grep -L FILE_LICENCE $(call licensable_deps_list,$(1)))
+endef
+define licence_list
+	$(sort $(foreach LICENCE,\
+		 $(filter __licence__%,$(shell $(NM) $(1) | cut -d" " -f3)),\
+		 $(word 2,$(subst __, ,$(LICENCE)))))
+endef
+$(BIN)/%.licence_list : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call licence_list,$<)
+$(BIN)/%.licence : $(BIN)/%.tmp
+	$(QM)$(ECHO) "  [LICENCE] $@"
+	$(Q)$(if $(strip $(call unlicensed_deps_list,$<)),\
+		echo -n "Unable to determine licence because the following " ;\
+		echo "files are missing a licence declaration:" ;\
+		echo $(call unlicensed_deps_list,$<);\
+		exit 1,\
+		$(PERL) $(LICENCE) $(call licence_list,$<))
+
+# Extract compression information from intermediate object file
+#
+$(BIN)/%.zinfo : $(BIN)/%.tmp
+	$(QM)$(ECHO) "  [ZINFO] $@"
+	$(Q)$(OBJCOPY) -O binary -j .zinfo $< $@
+
+# Build raw binary file from intermediate object file
+#
+$(BIN)/%.bin : $(BIN)/%.tmp
+	$(QM)$(ECHO) "  [BIN] $@"
+	$(Q)$(OBJCOPY) -O binary -R .zinfo $< $@
+
+# Compress raw binary file
+#
+$(BIN)/%.zbin : $(BIN)/%.bin $(BIN)/%.zinfo $(ZBIN)
+	$(QM)$(ECHO) "  [ZBIN] $@"
+	$(Q)$(ZBIN) $(BIN)/$*.bin $(BIN)/$*.zinfo > $@
+
+# Rules for each media format.  These are generated and placed in an
+# external Makefile fragment.  We could do this via $(eval ...), but
+# that would require make >= 3.80.
+# 
+# Note that there's an alternative way to generate most .rom images:
+# they can be copied from their 'master' ROM image using cp and
+# reprocessed with makerom to add the PCI IDs and ident string.  The
+# relevant rule would look something like:
+#
+#   $(BIN)/dfe538%rom : $(BIN)/rtl8139%rom
+#	cat $< $@
+#	$(FINALISE_rom)
+# 
+# You can derive the ROM/driver relationships using the variables
+# DRIVER_<rom> and/or ROMS_<driver>.
+# 
+# We don't currently do this, because (a) it would require generating
+# yet more Makefile fragments (since you need a rule for each ROM in
+# ROMS), and (b) the linker is so fast that it probably wouldn't make
+# much difference to the overall build time.
+
+# Add NON_AUTO_MEDIA to the media list, so that they show up in the
+# output of "make"
+#
+MEDIA		+= $(NON_AUTO_MEDIA)
+
+media :
+	@$(ECHO) $(MEDIA)
+
+AUTO_MEDIA	= $(filter-out $(NON_AUTO_MEDIA),$(MEDIA))
+automedia :
+	@$(ECHO) $(AUTO_MEDIA)
+
+# media_template : create media rules
+#
+# $(1) is the media name (e.g. "rom")
+#
+define media_template
+$(if $(filter $(1),$(AUTO_MEDIA)),$(call auto_media_template,$(1)))
+LIST_$(1) := $$(if $$(LIST_NAME_$(1)),$$($$(LIST_NAME_$(1))),$$(DRIVERS))
+ALL_$(1) = $$(foreach ITEM,$$(LIST_$(1)),$$(BIN)/$$(ITEM).$(1))
+$$(BIN)/all$(1)s : $$(ALL_$(1))
+$$(BIN)/allall : $$(BIN)/all$(1)s
+all$(1)s : $$(BIN)/all$(1)s
+allall : $$(BIN)/allall
+endef
+#
+# $(1) is the media name (e.g. "rom")
+#
+define auto_media_template
+$$(BIN)/%.$(1) : $$(BIN)/%.$(1).zbin
+	$$(QM)echo "  [FINISH] $$@"
+	$$(Q)$$(CP) $$< $$@
+	$$(Q)$$(if $$(PAD_$(1)),$$(PAD_$(1)) $$@)
+	$$(Q)$$(if $$(FINALISE_$(1)),$$(FINALISE_$(1)) $$@)
+endef
+#
+# $(1) is the media name (e.g. "rom")
+#
+define media_template_file
+	@$(ECHO) "  [MEDIARULES] $(1)"
+	@$(MKDIR) -p $(BIN)/rules/$(dir $(1))
+	@$(ECHO_E) '$(subst $(NEWLINE),\n,$(call media_template,$(1)))' \
+		> $(BIN)/rules/$(1).media.r
+endef
+
+# Generate media rules files
+#
+$(BIN)/rules/%.media.r : $(MAKEDEPS)
+	$(call media_template_file,$*)
+
+# Calculate list of media rules files
+#
+MEDIA_RULES		= $(patsubst %,$(BIN)/rules/%.media.r,$(MEDIA))
+mediarules :
+	@$(ECHO) $(MEDIA_RULES)
+
+# Evaluate media rules (or include media rules files)
+#
+ifdef NEED_DEPS
+ifneq ($(MEDIA_RULES),)
+ifneq ($(HAVE_EVAL),)
+$(foreach MEDIUM,$(MEDIA),$(eval $(call media_template,$(MEDIUM))))
+else
+-include $(MEDIA_RULES)
+endif
+endif
+endif
+
+# Alias for ipxe.%
+#
+$(BIN)/etherboot.% : $(BIN)/ipxe.%
+	ln -sf $(notdir $<) $@
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# The compression utilities
+#
+
+ZBIN_LDFLAGS := -llzma
+
+$(ZBIN) : util/zbin.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) $< $(ZBIN_LDFLAGS) -o $@
+CLEANUP += $(ZBIN)
+
+###############################################################################
+#
+# The EFI image converter
+#
+
+$(ELF2EFI32) : util/elf2efi.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -DEFI_TARGET32 $< -o $@
+CLEANUP += $(ELF2EFI32)
+
+$(ELF2EFI64) : util/elf2efi.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -DEFI_TARGET64 $< -o $@
+CLEANUP += $(ELF2EFI64)
+
+$(EFIROM) : util/efirom.c util/eficompress.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -o $@ $<
+CLEANUP += $(EFIROM)
+
+$(EFIFATBIN) : util/efifatbin.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -o $@ $<
+CLEANUP += $(EFIFATBIN)
+
+###############################################################################
+#
+# The error usage information utility
+#
+$(EINFO) : util/einfo.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -o $@ $<
+CLEANUP += $(EINFO)
+
+###############################################################################
+#
+# Local configs
+#
+CONFIG_HEADERS := $(patsubst config/%,%,$(wildcard config/*.h))
+CONFIG_LOCAL_HEADERS := $(foreach HEADER,$(CONFIG_HEADERS),\
+				  config/local/$(HEADER))
+
+$(CONFIG_LOCAL_HEADERS) :
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : $(CONFIG_LOCAL_HEADERS)
+
+ifneq ($(CONFIG),)
+
+CONFIG_LOCAL_NAMED_HEADERS := $(foreach HEADER,$(CONFIG_HEADERS),\
+					config/local/$(CONFIG)/$(HEADER))
+
+$(CONFIG_LOCAL_NAMED_HEADERS) :
+	$(Q)$(MKDIR) -p $(dir $@)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : $(CONFIG_LOCAL_NAMED_HEADERS)
+
+endif
+
+###############################################################################
+#
+# Build the TAGS file(s) for emacs
+#
+TAGS :
+	ctags -e -R -f $@ --exclude=bin
+
+CLEANUP	+= TAGS
+
+###############################################################################
+#
+# Force rebuild for any given target
+#
+%.rebuild :
+	rm -f $*
+	$(Q)$(MAKE) $*
+
+###############################################################################
+#
+# Symbol table checks
+#
+
+ifdef BIN
+
+SYMTAB	= $(BIN)/symtab
+$(SYMTAB) : $(BLIB)
+	$(OBJDUMP) -w -t $< > $@
+
+CLEANUP	+= $(BIN)/symtab
+
+symcheck : $(SYMTAB)
+	$(PERL) $(SYMCHECK) $<
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# Build bochs symbol table
+#
+
+ifdef BIN
+
+$(BIN)/%.bxs : $(BIN)/%.tmp
+	$(NM) $< | cut -d" " -f1,3 > $@
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# Documentation
+#
+
+ifdef BIN
+
+$(BIN)/doxygen.cfg : doxygen.cfg $(MAKEDEPS)
+	$(Q)$(PERL) -pe 's{\@SRCDIRS\@}{$(SRCDIRS)}; ' \
+		-e  's{\@INCDIRS\@}{$(filter-out .,$(INCDIRS))}; ' \
+		-e  's{\@BIN\@}{$(BIN)}; ' \
+		-e  's{\@ARCH\@}{$(ARCH)}; ' \
+		$< > $@
+
+$(BIN)/doc : $(BIN)/doxygen.cfg
+	$(Q)$(DOXYGEN) $<
+
+.PHONY : $(BIN)/doc
+
+doc : $(BIN)/doc
+
+doc-clean :
+	$(Q)$(RM) -r $(BIN)/doc
+
+VERYCLEANUP	+= $(BIN)/doc
+
+docview :
+	@[ -f $(BIN)/doc/html/index.html ] || $(MAKE) $(BIN)/doc
+	@if [ -n "$$BROWSER" ] ; then \
+		( $$BROWSER $(BIN)/doc/html/index.html & ) ; \
+	else \
+		$(ECHO) "Documentation index in $(BIN)/doc/html/index.html" ; \
+	fi
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# Keyboard maps
+#
+
+hci/keymap/keymap_%.c :
+	$(Q)$(PYTHON) $(GENKEYMAP) $* > $@
+
+###############################################################################
+#
+# Force deletion of incomplete targets
+#
+
+.DELETE_ON_ERROR :
+
+###############################################################################
+#
+# Clean-up
+#
+
+ifeq ($(NUM_BINS),0)
+ALLBINS		:= bin bin-*
+ALLBIN		= $(foreach B,$(ALLBINS),$(patsubst $(BIN)/%,$(B)/%,$(1)))
+CLEANUP		:= $(foreach C,$(CLEANUP),$(call ALLBIN,$(C)))
+VERYCLEANUP	:= $(foreach V,$(VERYCLEANUP),$(call ALLBIN,$(V)))
+endif
+
+clean :
+	$(RM) -r $(CLEANUP)
+
+veryclean : clean
+	$(RM) -r $(VERYCLEANUP)
diff --git a/src/ipxe/src-efi/config/console.h b/src/ipxe/src-efi/config/console.h
index cf6908996e..bfc00d76cd 100644
--- a/src/ipxe/src-efi/config/console.h
+++ b/src/ipxe/src-efi/config/console.h
@@ -53,7 +53,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 //#define	CONSOLE_PC_KBD		/* Direct access to PC keyboard */
 
 /* Keyboard map (available maps in hci/keymap/) */
-#define	KEYBOARD_MAP	dynamic
+#define	KEYBOARD_MAP	us
 
 /* Control which syslog() messages are generated.
  *
diff --git a/src/ipxe/src/Makefile.housekeeping b/src/ipxe/src/Makefile.housekeeping
new file mode 100644
index 0000000000..22027386fa
--- /dev/null
+++ b/src/ipxe/src/Makefile.housekeeping
@@ -0,0 +1,1604 @@
+# -*- makefile -*- : Force emacs to use Makefile mode
+#
+# This file contains various boring housekeeping functions that would
+# otherwise seriously clutter up the main Makefile.
+
+###############################################################################
+#
+# Find a usable "echo -e" substitute.
+#
+TAB 			:= $(shell $(PRINTF) '\t')
+ECHO_E_ECHO		:= $(ECHO)
+ECHO_E_ECHO_E		:= $(ECHO) -e
+ECHO_E_BIN_ECHO 	:= /bin/echo
+ECHO_E_BIN_ECHO_E 	:= /bin/echo -e
+ECHO_E_ECHO_TAB		:= $(shell $(ECHO_E_ECHO) '\t' | cat)
+ECHO_E_ECHO_E_TAB	:= $(shell $(ECHO_E_ECHO_E) '\t' | cat)
+ECHO_E_BIN_ECHO_TAB 	:= $(shell $(ECHO_E_BIN_ECHO) '\t')
+ECHO_E_BIN_ECHO_E_TAB 	:= $(shell $(ECHO_E_BIN_ECHO_E) '\t')
+
+ifeq ($(ECHO_E_ECHO_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_ECHO)
+endif
+ifeq ($(ECHO_E_ECHO_E_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_ECHO_E)
+endif
+ifeq ($(ECHO_E_BIN_ECHO_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_BIN_ECHO)
+endif
+ifeq ($(ECHO_E_BIN_ECHO_E_TAB),$(TAB))
+ECHO_E		:= $(ECHO_E_BIN_ECHO_E)
+endif
+
+.echocheck :
+ifdef ECHO_E
+	@$(TOUCH) $@
+else
+	@$(PRINTF) '%24s : x%sx\n' 'tab' '$(TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_ECHO) \t"' \
+				    '$(ECHO_E_ECHO_TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_ECHO_E) \t"' \
+				    '$(ECHO_E_ECHO_E_TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_BIN_ECHO) \t"' \
+				    '$(ECHO_E_BIN_ECHO_TAB)'
+	@$(PRINTF) '%24s : x%sx\n' '"$(ECHO_E_BIN_ECHO_E) \t"' \
+				    '$(ECHO_E_BIN_ECHO_E_TAB)'
+	@$(ECHO) "No usable \"echo -e\" substitute found"
+	@exit 1
+endif
+MAKEDEPS	+= .echocheck
+VERYCLEANUP	+= .echocheck
+
+echo :
+	@$(ECHO) "Using \"$(ECHO_E)\" for \"echo -e\""
+
+###############################################################################
+#
+# Generate a usable "seq" substitute
+#
+define seq
+	$(shell awk 'BEGIN { for ( i = $(1) ; i <= $(2) ; i++ ) print i }')
+endef
+
+###############################################################################
+#
+# Determine host OS
+#
+HOST_OS		:= $(shell uname -s)
+hostos :
+	@$(ECHO) $(HOST_OS)
+
+###############################################################################
+#
+# Determine compiler
+
+CCDEFS		:= $(shell $(CC) -E -x c -c /dev/null -dM | cut -d" " -f2)
+ccdefs:
+	@$(ECHO) $(CCDEFS)
+
+ifeq ($(filter __GNUC__,$(CCDEFS)),__GNUC__)
+CCTYPE		:= gcc
+endif
+cctype:
+	@$(ECHO) $(CCTYPE)
+
+###############################################################################
+#
+# Check for tools that can cause failed builds
+#
+
+ifeq ($(CCTYPE),gcc)
+GCC_2_96_BANNER := $(shell $(CC) -v 2>&1 | grep -is 'gcc version 2\.96')
+ifneq ($(GCC_2_96_BANNER),)
+$(warning gcc 2.96 is unsuitable for compiling iPXE)
+$(warning Use gcc 2.95 or a newer version instead)
+$(error Unsuitable build environment found)
+endif
+endif
+
+PERL_UNICODE_CHECK := $(shell $(PERL) -e 'use bytes; print chr(255)' | wc -c)
+ifeq ($(PERL_UNICODE_CHECK),2)
+$(warning Your Perl version has a Unicode handling bug)
+$(warning Execute this command before building iPXE:)
+$(warning export LANG=$${LANG%.UTF-8})
+$(error Unsuitable build environment found)
+endif
+
+LD_GOLD_BANNER := $(shell $(LD) -v 2>&1 | grep 'GNU gold')
+ifneq ($(LD_GOLD_BANNER),)
+$(warning GNU gold is unsuitable for building iPXE)
+$(warning Use GNU ld instead)
+$(error Unsuitable build environment found)
+endif
+
+OBJCOPY_ETC_BANNER := $(shell $(OBJCOPY) --version | grep 'elftoolchain')
+ifneq ($(OBJCOPY_ETC_BANNER),)
+$(warning The elftoolchain objcopy is unsuitable for building iPXE)
+$(warning Use binutils objcopy instead)
+$(error Unsuitable build environment found)
+endif
+
+###############################################################################
+#
+# Check if $(eval ...) is available to use
+#
+
+HAVE_EVAL :=
+ifndef NO_EVAL
+$(eval HAVE_EVAL := yes)
+endif
+eval :
+	@$(ECHO) $(HAVE_EVAL)
+
+###############################################################################
+#
+# Check for various tool workarounds
+#
+
+WORKAROUND_CFLAGS := -Wno-error=maybe-uninitialized
+WORKAROUND_ASFLAGS :=
+WORKAROUND_LDFLAGS :=
+
+# Make syntax does not allow use of comma or space in certain places.
+# This ugly workaround is suggested in the manual.
+#
+COMMA	:= ,
+EMPTY	:=
+SPACE	:= $(EMPTY) $(EMPTY)
+HASH	:= \#
+define NEWLINE
+
+
+endef
+
+# gcc 4.4 generates .eh_frame sections by default, which distort the
+# output of "size".  Inhibit this.
+#
+ifeq ($(CCTYPE),gcc)
+CFI_TEST = $(CC) -fno-dwarf2-cfi-asm -fno-exceptions -fno-unwind-tables \
+		 -fno-asynchronous-unwind-tables -x c -c /dev/null \
+		 -o /dev/null >/dev/null 2>&1
+CFI_FLAGS := $(shell $(CFI_TEST) && \
+	       $(ECHO) '-fno-dwarf2-cfi-asm -fno-exceptions ' \
+		       '-fno-unwind-tables -fno-asynchronous-unwind-tables')
+WORKAROUND_CFLAGS += $(CFI_FLAGS)
+endif
+
+# gcc 4.6 generates spurious warnings if -Waddress is in force.
+# Inhibit this.
+#
+ifeq ($(CCTYPE),gcc)
+WNA_TEST = $(CC) -Waddress -x c -c /dev/null -o /dev/null >/dev/null 2>&1
+WNA_FLAGS := $(shell $(WNA_TEST) && $(ECHO) '-Wno-address')
+WORKAROUND_CFLAGS += $(WNA_FLAGS)
+
+# gcc 8.0 generates warnings for certain suspect string operations. Our
+# sources have been vetted for correct usage.  Turn off these warnings.
+#
+WNST_TEST = $(CC) -Wstringop-truncation -x c -c /dev/null -o /dev/null \
+		  >/dev/null 2>&1
+WNST_FLAGS := $(shell $(WNST_TEST) && $(ECHO) '-Wno-stringop-truncation')
+WORKAROUND_CFLAGS += $(WNST_FLAGS)
+
+# gcc 9.1 generates warnings for taking address of packed member which
+# may result in an unaligned pointer value.  Inhibit the warnings.
+#
+WNAPM_TEST = $(CC) -Wno-address-of-packed-member -x c -c /dev/null \
+		   -o /dev/null >/dev/null 2>&1
+WNAPM_FLAGS := $(shell $(WNAPM_TEST) && \
+		 $(ECHO) '-Wno-address-of-packed-member')
+WORKAROUND_CFLAGS += $(WNAPM_FLAGS)
+endif
+
+# Some versions of gas choke on division operators, treating them as
+# comment markers.  Specifying --divide will work around this problem,
+# but isn't available on older gas versions.
+#
+DIVIDE_TEST = $(AS) --divide /dev/null -o /dev/null 2>/dev/null
+DIVIDE_FLAGS := $(shell $(DIVIDE_TEST) && $(ECHO) '--divide')
+WORKAROUND_ASFLAGS += $(DIVIDE_FLAGS)
+
+###############################################################################
+#
+# Build verbosity
+#
+ifeq ($(V),1)
+Q :=
+QM := @\#
+else
+Q := @
+QM := @
+endif
+
+###############################################################################
+#
+# Checker
+#
+ifeq ($(C),1)
+export REAL_CC := $(CC)
+CC := cgcc
+CFLAGS += -Wno-decl
+endif
+
+###############################################################################
+#
+# Set BIN according to whatever was specified on the command line as
+# the build target.
+#
+
+# Determine how many different BIN directories are mentioned in the
+# make goals.
+#
+BIN_GOALS	:= $(filter bin bin/% bin-%,$(MAKECMDGOALS))
+BIN_GOALS_BINS	:= $(sort $(foreach BG,$(BIN_GOALS),\
+				    $(firstword $(subst /, ,$(BG)))))
+NUM_BINS	:= $(words $(BIN_GOALS_BINS))
+
+ifeq ($(NUM_BINS),0)
+
+# No BIN directory was specified.  Set BIN to "bin" as a sensible
+# default.
+
+BIN		:= bin
+
+else # NUM_BINS == 0
+
+ifeq ($(NUM_BINS),1)
+
+# If exactly one BIN directory was specified, set BIN to match this
+# directory.
+#
+BIN		:= $(firstword $(BIN_GOALS_BINS))
+
+else # NUM_BINS == 1
+
+# More than one BIN directory was specified.  We cannot handle the
+# latter case within a single make invocation, so set up recursive
+# targets for each BIN directory.  Use exactly one target for each BIN
+# directory since running multiple make invocations within the same
+# BIN directory is likely to cause problems.
+#
+# Leave $(BIN) undefined.  This has implications for any target that
+# depends on $(BIN); such targets should be made conditional upon the
+# existence of $(BIN).
+#
+BIN_GOALS_FIRST	:= $(foreach BGB,$(BIN_GOALS_BINS),\
+			     $(firstword $(filter $(BGB)/%,$(BIN_GOALS))))
+BIN_GOALS_OTHER	:= $(filter-out $(BIN_GOALS_FIRST),$(BIN_GOALS))
+
+$(BIN_GOALS_FIRST) : % : BIN_RECURSE
+	$(Q)$(MAKE) --no-print-directory BIN=$(firstword $(subst /, ,$@)) \
+	    $(filter $(firstword $(subst /, ,$@))/%, $(BIN_GOALS))
+$(BIN_GOALS_OTHER) : % : BIN_RECURSE
+	$(Q)$(TRUE)
+.PHONY : BIN_RECURSE
+
+endif # NUM_BINS == 1
+endif # NUM_BINS == 0
+
+ifdef BIN
+
+# Create $(BIN) directory if it doesn't exist yet
+#
+ifeq ($(wildcard $(BIN)),)
+$(shell $(MKDIR) -p $(BIN))
+endif
+
+# Target to allow e.g. "make bin-efi arch"
+#
+$(BIN) :
+	@# Do nothing, silently
+.PHONY : $(BIN)
+
+# Remove everything in $(BIN) for a "make clean"
+#
+CLEANUP	+= $(BIN)/*.* # Avoid picking up directories
+
+endif # defined(BIN)
+
+# Determine whether or not we need to include the dependency files
+#
+NO_DEP_TARGETS	:= $(BIN) clean veryclean
+ifeq ($(MAKECMDGOALS),)
+NEED_DEPS	:= 1
+endif
+ifneq ($(strip $(filter-out $(NO_DEP_TARGETS),$(MAKECMDGOALS))),)
+NEED_DEPS	:= 1
+endif
+
+###############################################################################
+#
+# Select build architecture and platform based on $(BIN)
+#
+# BIN has the form bin[-[<arch>-]<platform>[-sb]]
+
+ARCHS		:= $(patsubst arch/%,%,$(wildcard arch/*))
+PLATFORMS	:= $(patsubst config/defaults/%.h,%,\
+		     $(wildcard config/defaults/*.h))
+archs :
+	@$(ECHO) $(ARCHS)
+
+platforms :
+	@$(ECHO) $(PLATFORMS)
+
+ifdef BIN
+
+# Split $(BIN) into architecture, platform, and security flag (where present)
+BIN_ELEMENTS	:= $(subst -,$(SPACE),$(BIN))
+BIN_APS		:= $(wordlist 2,4,$(BIN_ELEMENTS))
+ifeq ($(lastword $(BIN_APS)),sb)
+BIN_AP		:= $(wordlist 2,$(words $(BIN_APS)),discard $(BIN_APS))
+BIN_SECUREBOOT	:= 1
+else
+BIN_AP		:= $(BIN_APS)
+BIN_SECUREBOOT	:= 0
+endif
+BIN_PLATFORM	:= $(lastword $(BIN_AP))
+BIN_ARCH	:= $(wordlist 2,$(words $(BIN_AP)),discard $(BIN_AP))
+
+# Determine build architecture
+DEFAULT_ARCH	:= i386
+ARCH		:= $(firstword $(BIN_ARCH) $(DEFAULT_ARCH))
+CFLAGS		+= -DARCH=$(ARCH)
+arch :
+	@$(ECHO) $(ARCH)
+.PHONY : arch
+
+# Determine build platform
+DEFAULT_PLATFORM := pcbios
+PLATFORM	:= $(firstword $(BIN_PLATFORM) $(DEFAULT_PLATFORM))
+CFLAGS		+= -DPLATFORM=$(PLATFORM) -DPLATFORM_$(PLATFORM)
+platform :
+	@$(ECHO) $(PLATFORM)
+
+# Determine security flag
+DEFAULT_SECUREBOOT := 0
+SECUREBOOT	:= $(firstword $(BIN_SECUREBOOT) $(DEFAULT_SECUREBOOT))
+CFLAGS		+= -DSECUREBOOT=$(SECUREBOOT)
+secureboot :
+	@$(ECHO) $(SECUREBOOT)
+
+endif # defined(BIN)
+
+# Include architecture-specific Makefile
+ifdef ARCH
+MAKEDEPS	+= arch/$(ARCH)/Makefile
+include arch/$(ARCH)/Makefile
+endif
+
+# Include architecture-specific include path
+ifdef ARCH
+INCDIRS		+= arch/$(ARCH)/include
+endif
+
+###############################################################################
+#
+# Especially ugly workarounds
+
+# Some widespread patched versions of gcc include -fPIE -Wl,-pie by
+# default.  Note that gcc will exit *successfully* if it fails to
+# recognise an option that starts with "no", so we have to test for
+# output on stderr instead of checking the exit status.
+#
+# Current versions of gcc require -no-pie; older versions require
+# -nopie.  We therefore test for both.
+#
+# This workaround must be determined only after the
+# architecture-specific Makefile has been included, since some
+# platforms (e.g. bin-x86_64-efi) will explicitly require the use of
+# -fpie.
+#
+ifeq ($(filter -fpie,$(CFLAGS)),)
+ifeq ($(CCTYPE),gcc)
+PIE_TEST = [ -z "`$(CC) -fno-PIE -no-pie -x c -c /dev/null -o /dev/null 2>&1`" ]
+PIE_FLAGS := $(shell $(PIE_TEST) && $(ECHO) '-fno-PIE -no-pie')
+PIE_TEST2 = [ -z "`$(CC) -fno-PIE -nopie -x c -c /dev/null -o /dev/null 2>&1`" ]
+PIE_FLAGS2 := $(shell $(PIE_TEST2) && $(ECHO) '-fno-PIE -nopie')
+WORKAROUND_CFLAGS += $(PIE_FLAGS) $(PIE_FLAGS2)
+endif
+endif
+
+# Some widespread patched versions of gcc include -fcf-protection=full
+# by default.
+#
+ifeq ($(CCTYPE),gcc)
+CFP_TEST = $(CC) -fcf-protection=none -x c -c /dev/null -o /dev/null \
+		 >/dev/null 2>&1
+CFP_FLAGS := $(shell $(CFP_TEST) && $(ECHO) '-fcf-protection=none')
+WORKAROUND_CFLAGS += $(CFP_FLAGS)
+endif
+
+###############################################################################
+#
+# Source file handling
+
+# Exclude known-insecure files from Secure Boot builds
+ifeq ($(SECUREBOOT),0)
+SRCDIRS		+= $(SRCDIRS_INSEC)
+endif
+
+# SRCDIRS lists all directories containing source files.
+srcdirs :
+	@$(ECHO) $(SRCDIRS)
+
+# SRCS lists all .c or .S files found in any SRCDIR
+#
+SRCS	+= $(wildcard $(patsubst %,%/*.c,$(SRCDIRS)))
+SRCS	+= $(wildcard $(patsubst %,%/*.S,$(SRCDIRS)))
+srcs :
+	@$(ECHO) $(SRCS)
+
+# AUTO_SRCS lists all files in SRCS that are not mentioned in
+# NON_AUTO_SRCS.  Files should be added to NON_AUTO_SRCS if they
+# cannot be built using the standard build template.
+#
+AUTO_SRCS = $(filter-out $(NON_AUTO_SRCS),$(SRCS))
+autosrcs :
+	@$(ECHO) $(AUTO_SRCS)
+
+# Just about everything else in this section depends upon having
+# $(BIN) set
+
+ifdef BIN
+
+# INCDIRS lists the include path
+incdirs :
+	@$(ECHO) $(INCDIRS)
+
+# Inhibit -fstack-protector (which is implicitly enabled in some
+# patched gcc versions) unless explicitly mentioned in CFLAGS.
+#
+ifeq ($(findstring -fstack-protector,$(CFLAGS)),)
+CFLAGS		+= -fno-stack-protector
+endif
+
+# Common flags
+#
+CFLAGS		+= $(foreach INC,$(INCDIRS),-I$(INC))
+CFLAGS		+= -Os
+CFLAGS		+= -g
+ifeq ($(CCTYPE),gcc)
+CFLAGS		+= -ffreestanding
+CFLAGS		+= -fcommon
+CFLAGS		+= -Wall -W -Wformat-nonliteral
+CFLAGS		+= -Wno-array-bounds -Wno-dangling-pointer
+HOST_CFLAGS	+= -Wall -W -Wformat-nonliteral
+HOST_CFLAGS	+= -Wno-array-bounds -Wno-dangling-pointer
+endif
+CFLAGS		+= $(WORKAROUND_CFLAGS) $(EXTRA_CFLAGS)
+ASFLAGS		+= $(WORKAROUND_ASFLAGS) $(EXTRA_ASFLAGS)
+LDFLAGS		+= $(WORKAROUND_LDFLAGS) $(EXTRA_LDFLAGS)
+HOST_CFLAGS	+= -O2 -g
+
+# Inhibit -Werror if NO_WERROR is specified on make command line
+#
+ifneq ($(NO_WERROR),1)
+CFLAGS		+= -Werror
+ASFLAGS		+= --fatal-warnings
+HOST_CFLAGS	+= -Werror
+endif
+
+# Enable per-item sections and section garbage collection.  Note that
+# some older versions of gcc support -fdata-sections but treat it as
+# implying -fno-common, which would break our build.  Some other older
+# versions issue a spurious and uninhibitable warning if
+# -ffunction-sections is used with -g, which would also break our
+# build since we use -Werror.
+#
+ifeq ($(CCTYPE),gcc)
+DS_TEST		= $(ECHO) 'char x;' | \
+		  $(CC) -fdata-sections -S -x c - -o - 2>/dev/null | \
+		  grep -E '\.comm' > /dev/null
+DS_FLAGS	:= $(shell $(DS_TEST) && $(ECHO) '-fdata-sections')
+FS_TEST		= $(CC) -ffunction-sections -g -c -x c /dev/null \
+		  -o /dev/null 2>/dev/null
+FS_FLAGS	:= $(shell $(FS_TEST) && $(ECHO) '-ffunction-sections')
+CFLAGS		+= $(FS_FLAGS) $(DS_FLAGS)
+endif
+LDFLAGS		+= --gc-sections
+
+# Force creation of static binaries (required for OpenBSD, does no
+# harm on other platforms).
+#
+LDFLAGS		+= -static
+
+# Use separate code segment if supported by linker
+#
+ZSC_TEST	= $(LD) -z separate-code --version 2>&1 > /dev/null
+ZSC_FLAGS	:= $(shell [ -z "`$(ZSC_TEST)`" ] && \
+		     $(ECHO) '-z separate-code -z max-page-size=4096')
+LDFLAGS		+= $(ZSC_FLAGS)
+
+# compiler.h is needed for our linking and debugging system
+#
+CFLAGS		+= -include include/compiler.h
+
+# The section type character (e.g. "@" in "@progbits") varies by
+# architecture.
+#
+CFLAGS		+= -DASM_TCHAR='$(ASM_TCHAR)' -DASM_TCHAR_OPS='$(ASM_TCHAR_OPS)'
+
+# Inhibit the default -Dlinux
+#
+CFLAGS		+= -Ulinux
+
+# CFLAGS for specific object types
+#
+CFLAGS_c	+=
+CFLAGS_S 	+= -DASSEMBLY
+
+# Base object name of the current target
+#
+OBJECT		= $(firstword $(subst ., ,$(@F)))
+
+# CFLAGS for specific object files.  You can define
+# e.g. CFLAGS_rtl8139, and have those flags automatically used when
+# compiling bin/rtl8139.o.
+#
+OBJ_CFLAGS	= $(CFLAGS_$(OBJECT)) -DOBJECT=$(subst -,_,$(OBJECT))
+$(BIN)/%.flags :
+	@$(ECHO) $(OBJ_CFLAGS)
+
+# Debug level calculations
+#
+DBGLVL_MAX	= -DDBGLVL_MAX=$(firstword $(subst ., ,$(1)))
+DBGLVL_DFLT	= -DDBGLVL_DFLT=$(lastword $(subst ., ,$(1)))
+DBGLVL		= $(call DBGLVL_MAX,$(1)) $(call DBGLVL_DFLT,$(1))
+
+# Rules for specific object types.
+#
+COMPILE_c	= $(CC) $(CFLAGS) $(CFLAGS_c) $(OBJ_CFLAGS)
+RULE_c		= $(Q)$(COMPILE_c) -c $< -o $@
+RULE_c_to_ids.o = $(Q)$(ECHO_E) '$(OBJ_IDS_ASM_NL)' | $(ASSEMBLE_S) -o $@
+RULE_c_to_dbg%.o= $(Q)$(COMPILE_c) $(call DBGLVL,$*) -c $< -o $@
+RULE_c_to_c	= $(Q)$(COMPILE_c) -E -c $< > $@
+RULE_c_to_s	= $(Q)$(COMPILE_c) -S -g0 -c $< -o $@
+
+PREPROCESS_S	= $(CPP) $(CFLAGS) $(CFLAGS_S) $(OBJ_CFLAGS)
+ASSEMBLE_S	= $(AS) $(ASFLAGS)
+RULE_S		= $(Q)$(PREPROCESS_S) $< | $(ASSEMBLE_S) -o $@
+RULE_S_to_dbg%.o= $(Q)$(PREPROCESS_S) $(call DBGLVL,$*) $< | $(ASSEMBLE_S) -o $@
+RULE_S_to_s	= $(Q)$(PREPROCESS_S) $< > $@
+
+GENERIC_TARGETS	+= ids.o dbg%.o c s
+
+# List of embedded images included in the last build of embedded.o.
+# This is needed in order to correctly rebuild embedded.o whenever the
+# list of objects changes.
+#
+EMBED		:= $(EMBEDDED_IMAGE) # Maintain backwards compatibility
+EMBEDDED_LIST	:= $(BIN)/.embedded.list
+ifeq ($(wildcard $(EMBEDDED_LIST)),)
+EMBED_OLD := <invalid>
+else
+EMBED_OLD := $(shell cat $(EMBEDDED_LIST))
+endif
+ifneq ($(EMBED_OLD),$(EMBED))
+$(shell $(ECHO) "$(EMBED)" > $(EMBEDDED_LIST))
+endif
+
+$(EMBEDDED_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(EMBEDDED_LIST)
+
+EMBEDDED_FILES	:= $(subst $(COMMA), ,$(EMBED))
+EMBED_ALL	:= $(foreach i,$(call seq,1,$(words $(EMBEDDED_FILES))),\
+		     EMBED ( $(i), \"$(word $(i), $(EMBEDDED_FILES))\",\
+			     \"$(notdir $(word $(i),$(EMBEDDED_FILES)))\" ))
+
+embedded_DEPS += $(EMBEDDED_FILES) $(EMBEDDED_LIST)
+
+CFLAGS_embedded = -DEMBED_ALL="$(EMBED_ALL)"
+
+# List of trusted root certificates
+#
+TRUSTED_LIST	:= $(BIN)/.trusted.list
+ifeq ($(wildcard $(TRUSTED_LIST)),)
+TRUST_OLD := <invalid>
+else
+TRUST_OLD := $(shell cat $(TRUSTED_LIST))
+endif
+ifneq ($(TRUST_OLD),$(TRUST))
+$(shell $(ECHO) "$(TRUST)" > $(TRUSTED_LIST))
+endif
+
+$(TRUSTED_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(TRUSTED_LIST)
+
+# Trusted root certificate fingerprints
+#
+TRUSTED_CERTS	:= $(subst $(COMMA), ,$(TRUST))
+TRUSTED_FPS	:= $(foreach CERT,$(TRUSTED_CERTS),\
+		     0x$(subst :,$(COMMA) 0x,$(lastword $(subst =, ,\
+			 $(shell $(OPENSSL) x509 -in $(CERT) -noout -sha256 \
+				 -fingerprint))))$(COMMA))
+
+rootcert_DEPS += $(TRUSTED_FILES) $(TRUSTED_LIST)
+
+CFLAGS_rootcert = $(if $(TRUSTED_FPS),-DTRUSTED="$(TRUSTED_FPS)")
+
+# List of embedded certificates
+#
+CERT_LIST := $(BIN)/.certificate.list
+ifeq ($(wildcard $(CERT_LIST)),)
+CERT_OLD := <invalid>
+else
+CERT_OLD := $(shell cat $(CERT_LIST))
+endif
+ifneq ($(CERT_OLD),$(CERT))
+$(shell $(ECHO) "$(CERT)" > $(CERT_LIST))
+endif
+
+$(CERT_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(CERT_LIST)
+
+# Embedded certificates concatenated and then split into one file per
+# certificate (even if original files contained certificate chains)
+#
+CERT_FILES := $(subst $(COMMA), ,$(CERT))
+CERT_CONCAT := $(BIN)/.certificates.pem
+
+ifneq ($(CERT),)
+
+CERT_COUNT := $(shell grep "BEGIN CERTIFICATE" $(CERT_FILES) | wc -l)
+
+$(CERT_CONCAT) : $(CERT_FILES) $(CERT_LIST)
+	$(Q)cat $(CERT_FILES) > $@
+
+# We must use an (otherwise unnecessary) pattern rule here to encode
+# the fact that one "csplit" command generates multiple targets
+CERT_PEMS := $(foreach i,$(call seq,1,$(CERT_COUNT)),\
+	       $(BIN)/.certificate.pem.$(i))
+$(subst .pem.,.%.,$(CERT_PEMS)) : $(BIN)/.certificates.%
+	$(Q)$(CSPLIT) -q -n 1 -f $(BIN)/.certificate.pem. $< \
+		'/BEGIN CERTIFICATE/' '{*}'
+
+CERT_DERS := $(subst .certificate.pem.,.certificate.der.,$(CERT_PEMS))
+$(BIN)/.certificate.der.% : $(BIN)/.certificate.pem.%
+	$(Q)$(OPENSSL) x509 -in $< -outform DER -out $@
+
+CERT_ALL := $(foreach i,$(call seq,1,$(CERT_COUNT)),\
+	      CERT ( $(i), \"$(word $(i),$(CERT_DERS))\" ))
+
+endif
+
+certstore_DEPS += $(CERT_LIST) $(CERT_FILES) $(CERT_PEMS) $(CERT_DERS)
+
+CFLAGS_certstore += -DCERT_ALL="$(CERT_ALL)"
+
+CLEANUP += $(BIN)/.certificate.* $(BIN)/.certificates.*
+
+# (Single-element) list of private keys
+#
+ifdef KEY
+PRIVKEY	:= $(KEY) # Maintain backwards compatibility
+endif
+PRIVKEY_LIST := $(BIN)/.private_key.list
+ifeq ($(wildcard $(PRIVKEY_LIST)),)
+PRIVKEY_OLD := <invalid>
+else
+PRIVKEY_OLD := $(shell cat $(PRIVKEY_LIST))
+endif
+ifneq ($(PRIVKEY_OLD),$(PRIVKEY))
+$(shell $(ECHO) "$(PRIVKEY)" > $(PRIVKEY_LIST))
+endif
+
+$(PRIVKEY_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(PRIVKEY_LIST)
+
+# Embedded private key
+#
+PRIVKEY_INC := $(BIN)/.private_key.der
+
+ifdef PRIVKEY
+$(PRIVKEY_INC) : $(PRIVKEY) $(PRIVKEY_LIST)
+	$(Q)$(OPENSSL) rsa -in $< -outform DER -out $@
+
+privkey_DEPS += $(PRIVKEY_INC)
+endif
+
+CLEANUP += $(BIN)/.private_key.*
+
+privkey_DEPS += $(PRIVKEY_LIST)
+
+CFLAGS_privkey += $(if $(PRIVKEY),-DPRIVATE_KEY="\"$(PRIVKEY_INC)\"")
+
+# (Single-element) list of named configurations
+#
+CONFIG_LIST := $(BIN)/.config.list
+ifeq ($(wildcard $(CONFIG_LIST)),)
+CONFIG_OLD := <invalid>
+else
+CONFIG_OLD := $(shell cat $(CONFIG_LIST))
+endif
+ifneq ($(CONFIG_OLD),$(CONFIG))
+$(shell $(ECHO) "$(CONFIG)" > $(CONFIG_LIST))
+endif
+
+$(CONFIG_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(CONFIG_LIST)
+
+# Named configurations
+#
+ifneq ($(CONFIG),)
+ifneq ($(wildcard config/$(CONFIG)),)
+CFLAGS	+= -DCONFIG=$(CONFIG)
+endif
+CFLAGS	+= -DLOCAL_CONFIG=$(CONFIG)
+endif
+
+config/named.h : $(CONFIG_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : config/named.h
+
+# (Single-element) list of assertion configuration
+#
+ASSERT_LIST := $(BIN)/.assert.list
+ifeq ($(wildcard $(ASSERT_LIST)),)
+ASSERT_OLD := <invalid>
+else
+ASSERT_OLD := $(shell cat $(ASSERT_LIST))
+endif
+ifneq ($(ASSERT_OLD),$(ASSERT))
+$(shell $(ECHO) "$(ASSERT)" > $(ASSERT_LIST))
+endif
+
+$(ASSERT_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(ASSERT_LIST)
+
+# Assertion configuration
+#
+ifneq ($(ASSERT),)
+CFLAGS	+= -DASSERTING=$(ASSERT)
+endif
+
+include/assert.h : $(ASSERT_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : include/assert.h
+
+# (Single-element) list of profiling configuration
+#
+PROFILE_LIST := $(BIN)/.profile.list
+ifeq ($(wildcard $(PROFILE_LIST)),)
+PROFILE_OLD := <invalid>
+else
+PROFILE_OLD := $(shell cat $(PROFILE_LIST))
+endif
+ifneq ($(PROFILE_OLD),$(PROFILE))
+$(shell $(ECHO) "$(PROFILE)" > $(PROFILE_LIST))
+endif
+
+$(PROFILE_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(PROFILE_LIST)
+
+# Profiling configuration
+#
+ifneq ($(PROFILE),)
+CFLAGS	+= -DPROFILING=$(PROFILE)
+endif
+
+include/ipxe/profile.h : $(PROFILE_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : include/ipxe/profile.h
+
+# (Single-element) list of function recorder configuration
+#
+FNREC_LIST := $(BIN)/.fnrec.list
+ifeq ($(wildcard $(FNREC_LIST)),)
+FNREC_OLD := <invalid>
+else
+FNREC_OLD := $(shell cat $(FNREC_LIST))
+endif
+ifneq ($(FNREC_OLD),$(FNREC))
+$(shell $(ECHO) "$(FNREC)" > $(FNREC_LIST))
+endif
+
+$(FNREC_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(FNREC_LIST)
+
+# Function recorder configuration
+#
+ifeq ($(FNREC),1)
+# Enabling -finstrument-functions affects gcc's analysis and leads to spurious
+# warnings about use of uninitialised variables.
+#
+CFLAGS		+= -Wno-uninitialized
+CFLAGS		+= -finstrument-functions
+CFLAGS		+= -finstrument-functions-exclude-file-list=core/fnrec.c
+endif
+
+include/compiler.h : $(FNREC_LIST)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : include/compiler.h
+
+# These files use .incbin inline assembly to include a binary file.
+# Unfortunately ccache does not detect this dependency and caches
+# builds even when the binary file has changed.
+#
+$(BIN)/embedded.% : override CC := env CCACHE_DISABLE=1 $(CC)
+$(BIN)/certstore.% : override CC := env CCACHE_DISABLE=1 $(CC)
+$(BIN)/privkey.% : override CC := env CCACHE_DISABLE=1 $(CC)
+
+# Debug message autocolourisation range
+#
+DBGCOL_LIST	:= $(BIN)/.dbgcol.list
+ifeq ($(wildcard $(DBGCOL_LIST)),)
+DBGCOL_OLD := <invalid>
+else
+DBGCOL_OLD := $(shell cat $(DBGCOL_LIST))
+endif
+ifneq ($(DBGCOL_OLD),$(DBGCOL))
+$(shell $(ECHO) "$(DBGCOL)" > $(DBGCOL_LIST))
+endif
+
+$(DBGCOL_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP += $(DBGCOL_LIST)
+
+DBGCOL_COLOURS := $(subst -, ,$(DBGCOL))
+DBGCOL_MIN := $(firstword $(DBGCOL_COLOURS))
+DBGCOL_MAX := $(lastword $(DBGCOL_COLOURS))
+
+debug_DEPS += $(DBGCOL_LIST)
+
+CFLAGS_debug += $(if $(DBGCOL_MIN),-DDBGCOL_MIN=$(DBGCOL_MIN))
+CFLAGS_debug += $(if $(DBGCOL_MAX),-DDBGCOL_MAX=$(DBGCOL_MAX))
+
+# We automatically generate rules for any file mentioned in AUTO_SRCS
+# using the following set of templates.  We use $(eval ...) if
+# available, otherwise we generate separate Makefile fragments and
+# include them.
+
+# deps_template : generate dependency list for a given source file
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+#
+define deps_template_file
+$(call deps_template_parts,$(1),$(subst .,,$(suffix $(1))),$(basename $(notdir $(1))))
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+# $(2) is the source type (e.g. "c")
+# $(3) is the source base name (e.g. "rtl8139")
+#
+define deps_template_parts
+	@$(ECHO) "  [DEPS] $(1)"
+	@$(MKDIR) -p $(BIN)/deps/$(dir $(1))
+	$(Q)$(CPP) $(CFLAGS) $(CFLAGS_$(2)) $(CFLAGS_$(3)) -DOBJECT=$(3) \
+		-Wno-error -M $(1) -MG -MP | \
+		sed 's/\.o[[:blank:]]*:/_DEPS +=/' > $(BIN)/deps/$(1).d
+endef
+
+# rules_template : generate rules for a given source file
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+#
+define rules_template
+$(call rules_template_parts,$(1),$(subst .,,$(suffix $(1))),$(basename $(notdir $(1))))
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+# $(2) is the source type (e.g. "c")
+# $(3) is the source base name (e.g. "rtl8139")
+#
+define rules_template_parts
+$$(BIN)/$(3).o : $(1) $$(MAKEDEPS) $$($(3)_DEPS)
+	$$(QM)$(ECHO) "  [BUILD] $$@"
+	$$(RULE_$(2))
+BOBJS += $$(BIN)/$(3).o
+$(foreach TGT,$(GENERIC_TARGETS),$(if $(RULE_$(2)_to_$(TGT)),$(NEWLINE)$(call rules_template_target,$(1),$(2),$(3),$(TGT))))
+$$(BIN)/deps/$(1).d : $$($(3)_DEPS)
+TAGS : $$($(3)_DEPS)
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+# $(2) is the source type (e.g. "c")
+# $(3) is the source base name (e.g. "rtl8139")
+# $(4) is the destination type (e.g. "dbg%.o")
+#
+define rules_template_target
+$$(BIN)/$(3).$(4) : $(1) $$(MAKEDEPS) $$($(3)_DEPS)
+	$$(QM)$(ECHO) "  [BUILD] $$@"
+	$$(RULE_$(2)_to_$(4))
+$(TGT)_OBJS += $$(BIN)/$(3).$(4)
+endef
+#
+# $(1) is the full path to the source file (e.g. "drivers/net/rtl8139.c")
+#
+define rules_template_file
+	@$(ECHO) "  [RULES] $(1)"
+	@$(MKDIR) -p $(BIN)/rules/$(dir $(1))
+	@$(ECHO_E) '$(subst $(NEWLINE),\n,$(call rules_template,$(1)))' \
+		 > $(BIN)/rules/$(1).r
+endef
+
+# Generate the dependency files
+#
+$(BIN)/deps/%.d : % $(MAKEDEPS)
+	$(call deps_template_file,$<)
+
+# Calculate list of dependency files
+#
+AUTO_DEPS	= $(patsubst %,$(BIN)/deps/%.d,$(AUTO_SRCS) core/version.c)
+autodeps :
+	@$(ECHO) $(AUTO_DEPS)
+VERYCLEANUP	+= $(BIN)/deps
+
+# Include dependency files
+#
+ifdef NEED_DEPS
+ifneq ($(AUTO_DEPS),)
+-include $(AUTO_DEPS)
+endif
+endif
+
+# Generate the rules files
+#
+$(BIN)/rules/%.r : % $(MAKEDEPS)
+	$(call rules_template_file,$<)
+
+# Calculate list of rules files
+#
+AUTO_RULES	= $(patsubst %,$(BIN)/rules/%.r,$(AUTO_SRCS))
+autorules :
+	@$(ECHO) $(AUTO_RULES)
+VERYCLEANUP	+= $(BIN)/rules
+
+# Evaluate rules (or include rules files)
+#
+ifdef NEED_DEPS
+ifneq ($(AUTO_RULES),)
+ifneq ($(HAVE_EVAL),)
+$(foreach SRC,$(AUTO_SRCS),$(eval $(call rules_template,$(SRC))))
+else
+-include $(AUTO_RULES)
+endif
+endif
+endif
+
+# Files to be parsed using parserom.pl
+#
+ROM_SRCS	= $(foreach SRC,$(AUTO_SRCS),\
+		    $(if $(findstring drivers/,$(SRC)),$(SRC)))
+romsrcs :
+	@$(ECHO) $(ROM_SRCS)
+
+# List of files to be parsed using parserom.pl
+#
+ROM_SRCS_LIST	:= $(BIN)/.rom.list
+ifeq ($(wildcard $(ROM_SRCS_LIST)),)
+ROM_SRCS_OLD := <invalid>
+else
+ROM_SRCS_OLD := $(shell cat $(ROM_SRCS_LIST))
+endif
+ifneq ($(ROM_SRCS_OLD),$(ROM_SRCS))
+$(shell $(ECHO) "$(ROM_SRCS)" > $(ROM_SRCS_LIST))
+endif
+
+$(ROM_SRCS_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(ROM_SRCS_LIST)
+
+# ROM definition file
+#
+ROMDEFS		= $(BIN)/.rom.defs
+$(ROMDEFS) : $(ROM_SRCS) $(ROM_SRCS_LIST) $(PARSEROM) $(MAKEDEPS)
+	$(QM)$(ECHO) "  [PARSEROM]"
+	$(Q)$(PERL) $(PARSEROM) $(ROM_SRCS) > $@
+
+VERYCLEANUP	+= $(ROMDEFS)
+
+# Evaluate ROM definition file
+ifdef NEED_DEPS
+ifneq ($(ROM_SRCS),)
+-include $(ROMDEFS)
+endif
+endif
+
+# Device ID tables (using IDs from ROM definition file)
+#
+define obj_pci_id_asm
+	.section ".note.GNU-stack", "", $(ASM_TCHAR)progbits
+	.section ".pci_devlist.$(1)", "a", $(ASM_TCHAR)progbits
+	.globl pci_devlist_$(1)
+pci_devlist_$(1):
+	.short ( 0x$(1) & 0xffff )
+
+endef
+define obj_isa_id_asm
+endef
+OBJ_IDS_ASM	= $(foreach ROM,$(ROMS_$(OBJECT)),$(call obj_$(ROM_TYPE_$(ROM))_id_asm,$(ROM)))
+OBJ_IDS_ASM_NL	= $(subst $(NEWLINE),\n,$(OBJ_IDS_ASM))
+$(BIN)/%.ids :
+	@$(ECHO_E) '$(OBJ_IDS_ASM_NL)'
+
+BOBJS	+= $(patsubst %,$(BIN)/%.ids.o,$(DRIVERS))
+
+# The following variables are created by the autogenerated rules
+#
+bobjs :
+	@$(ECHO) $(BOBJS)
+drivers_% :
+	@$(ECHO) $(DRIVERS_$*)
+drivers :
+	@$(ECHO) $(DRIVERS)
+.PHONY : drivers
+roms :
+	@$(ECHO) $(ROMS)
+
+# Generate error usage information
+#
+$(BIN)/%.einfo : $(BIN)/%.o
+	$(QM)$(ECHO) "  [EINFO] $@"
+	$(Q)$(OBJCOPY) -O binary -j .einfo --set-section-flags .einfo=alloc \
+		$< $@
+
+EINFOS		:= $(patsubst $(BIN)/%.o,$(BIN)/%.einfo,$(BOBJS))
+$(BIN)/errors : $(EINFOS) $(EINFO)
+	$(QM)$(ECHO) "  [EINFO] $@"
+	$(Q)$(EINFO) $(EINFOS) | sort > $@
+CLEANUP		+= $(BIN)/errors	# Doesn't match the $(BIN)/*.* pattern
+
+# Generate the NIC file from the parsed source files.  The NIC file is
+# only for rom-o-matic.
+#
+$(BIN)/NIC : $(AUTO_DEPS)
+	@$(ECHO) '# This is an automatically generated file, do not edit' > $@
+	@$(ECHO) '# It does not affect anything in the build, ' \
+	     'it is only for rom-o-matic' >> $@
+	@$(ECHO) >> $@
+	@perl -ne 'chomp; print "$$1\n" if /\# NIC\t(.*)$$/' $^ >> $@
+CLEANUP		+= $(BIN)/NIC	# Doesn't match the $(BIN)/*.* pattern
+
+# Analyse a target name (e.g. "bin/dfe538--prism2_pci.rom.tmp") and
+# derive the variables:
+# 
+# TGT_ELEMENTS : the elements of the target (e.g. "dfe538 prism2_pci")
+# TGT_PREFIX   : the prefix type (e.g. "pcirom")
+# TGT_DRIVERS  : the driver for each element (e.g. "rtl8139 prism2_pci")
+# TGT_ROM_NAME : the ROM name (e.g. "dfe538")
+#
+TGT_ELEMENTS	= $(subst --, ,$(firstword $(subst ., ,$(notdir $@))))
+TGT_ROM_NAME	= $(firstword $(TGT_ELEMENTS))
+TGT_DRIVERS	= $(strip $(foreach TGT_ELEMENT,$(TGT_ELEMENTS), \
+				    $(if $(DRIVERS_$(TGT_ELEMENT)), \
+					 $(DRIVERS_$(TGT_ELEMENT)), \
+					 $(firstword $(DRIVER_$(TGT_ELEMENT)) \
+						     $(TGT_ELEMENT)))))
+TGT_PREFIX_NAME	= $(word 2,$(subst ., ,$(notdir $@)))
+TGT_PREFIX	= $(strip $(if $(filter rom,$(TGT_PREFIX_NAME)), \
+			       $(ROM_TYPE_$(TGT_ROM_NAME))rom, \
+			       $(TGT_PREFIX_NAME)))
+
+# Look up ROM IDs for the current target
+# (e.g. "bin/dfe538--prism2_pci.rom.tmp") and derive the variables:
+#
+# TGT_PCI_VENDOR : the PCI vendor ID (e.g. "0x1186")
+# TGT_PCI_DEVICE : the PCI device ID (e.g. "0x1300")
+#
+TGT_PCI_VENDOR	= $(PCI_VENDOR_$(TGT_ROM_NAME))
+TGT_PCI_DEVICE	= $(PCI_DEVICE_$(TGT_ROM_NAME))
+
+# Calculate link-time options for the current target
+# (e.g. "bin/dfe538--prism2_pci.rom.tmp") and derive the variables:
+#
+# TGT_LD_DRIVERS : symbols to require in order to drag in the relevant drivers
+#		   (e.g. "obj_rtl8139 obj_prism2_pci")
+# TGT_LD_IDS :     symbols to define in order to fill in ID structures in the
+#		   ROM header (e.g."pci_vendor_id=0x1186 pci_device_id=0x1300")
+#
+TGT_LD_DRIVERS	= $(subst -,_,$(patsubst %,obj_%,$(TGT_DRIVERS)))
+TGT_LD_IDS	= pci_vendor_id=$(firstword $(TGT_PCI_VENDOR) 0) \
+		  pci_device_id=$(firstword $(TGT_PCI_DEVICE) 0)
+TGT_LD_DEVLIST	= $(foreach ELEM,$(TGT_ELEMENTS),$(if $(PCI_VENDOR_$(ELEM)),\
+		    pci_devlist_$(patsubst 0x%,%,$(PCI_VENDOR_$(ELEM)))$(patsubst 0x%,%,$(PCI_DEVICE_$(ELEM)))))
+TGT_LD_ENTRY	= _$(TGT_PREFIX)_start
+
+# Calculate linker flags based on link-time options for the current
+# target type (e.g. "bin/dfe538--prism2_pci.rom.tmp") and derive the
+# variables:
+#
+# TGT_LD_FLAGS : target-specific flags to pass to linker (e.g.
+#		 "-u obj_zpciprefix -u obj_rtl8139 -u obj_prism2_pci
+#		  --defsym pci_vendor=0x1186 --defsym pci_device=0x1300")
+#
+TGT_LD_FLAGS	= $(foreach SYM,$(TGT_LD_ENTRY) $(TGT_LD_DRIVERS) \
+		    $(TGT_LD_DEVLIST) obj_config obj_config_$(PLATFORM),\
+		    -u $(SYMBOL_PREFIX)$(SYM) \
+		    --defsym check_$(SYM)=$(SYMBOL_PREFIX)$(SYM) ) \
+		  $(patsubst %,--defsym %,$(TGT_LD_IDS)) \
+		  -e $(SYMBOL_PREFIX)$(TGT_LD_ENTRY)
+
+# Calculate list of debugging versions of objects to be included in
+# the target.
+#
+DEBUG_LIST	= $(subst $(COMMA), ,$(DEBUG))
+DEBUG_MAX	= $(firstword $(word 2,$(subst :, ,$(1))) 1)
+DEBUG_DFLT	= $(if $(word 3,$(subst :, ,$(1))),.$(word 3,$(subst :, ,$(1))))
+DEBUG_LEVEL	= $(call DEBUG_MAX,$(1))$(call DEBUG_DFLT,$(1))
+DEBUG_BASE	= $(firstword $(subst :, ,$(1))).dbg$(call DEBUG_LEVEL,$(1))
+DEBUG_OBJ	= $(BIN)/$(call DEBUG_BASE,$(1)).o
+DEBUG_ORIG_OBJ	= $(BIN)/$(firstword $(subst :, ,$(1))).o
+DEBUG_OBJS	= $(foreach D,$(DEBUG_LIST),$(call DEBUG_OBJ,$(D)))
+DEBUG_ORIG_OBJS	= $(foreach D,$(DEBUG_LIST),$(call DEBUG_ORIG_OBJ,$(D)))
+BLIB_OBJS	= $(DEBUG_OBJS) $(filter-out $(DEBUG_ORIG_OBJS),$(BOBJS))
+
+# Print out all derived information for a given target.
+#
+$(BIN)/%.info :
+	@$(ECHO) 'Elements             : $(TGT_ELEMENTS)'
+	@$(ECHO) 'Prefix               : $(TGT_PREFIX)'
+	@$(ECHO) 'Drivers              : $(TGT_DRIVERS)'
+	@$(ECHO) 'ROM name             : $(TGT_ROM_NAME)'
+	@$(ECHO)
+	@$(ECHO) 'PCI vendor           : $(TGT_PCI_VENDOR)'
+	@$(ECHO) 'PCI device           : $(TGT_PCI_DEVICE)'
+	@$(ECHO)
+	@$(ECHO) 'LD driver symbols    : $(TGT_LD_DRIVERS)'
+	@$(ECHO) 'LD ID symbols        : $(TGT_LD_IDS)'
+	@$(ECHO) 'LD devlist symbols   : $(TGT_LD_DEVLIST)'
+	@$(ECHO) 'LD entry point       : $(TGT_LD_ENTRY)'
+	@$(ECHO)
+	@$(ECHO) 'LD target flags      : $(TGT_LD_FLAGS)'
+	@$(ECHO)
+	@$(ECHO) 'Debugging objects    : $(DEBUG_OBJS)'
+	@$(ECHO) 'Replaced objects     : $(DEBUG_ORIG_OBJS)'
+
+# List of objects included in the last build of blib.  This is needed
+# in order to correctly rebuild blib whenever the list of objects
+# changes.
+#
+BLIB_LIST	:= $(BIN)/.blib.list
+ifeq ($(wildcard $(BLIB_LIST)),)
+BLIB_OBJS_OLD	:= <invalid>
+else
+BLIB_OBJS_OLD	:= $(shell cat $(BLIB_LIST))
+endif
+ifneq ($(BLIB_OBJS_OLD),$(BLIB_OBJS))
+$(shell $(ECHO) "$(BLIB_OBJS)" > $(BLIB_LIST))
+endif
+
+$(BLIB_LIST) : $(MAKEDEPS)
+
+VERYCLEANUP	+= $(BLIB_LIST)
+
+# Library of all objects
+#
+BLIB		= $(BIN)/blib.a
+$(BLIB) : $(BLIB_OBJS) $(BLIB_LIST) $(MAKEDEPS)
+	$(Q)$(RM) $(BLIB)
+	$(QM)$(ECHO) "  [AR] $@"
+	$(Q)$(AR) rcD $@ $(sort $(BLIB_OBJS))
+	$(Q)$(OBJCOPY) --enable-deterministic-archives \
+		       --prefix-symbols=$(SYMBOL_PREFIX) $@
+	$(Q)$(RANLIB) -D $@
+blib : $(BLIB)
+
+# Command to generate build ID.  Must be unique for each $(BIN)/%.tmp,
+# even within the same build run.
+#
+# The build ID is supposed to be collision-free across all ROMs that
+# might ever end up installed in the same system.  It doesn't just
+# disambiguate targets within a single build; it also disambiguates
+# different builds (such as builds for multiple ROMs all built from
+# the same blib.a).
+#
+BUILD_ID_CMD = cat $^ | cksum | awk '{print $$1}'
+
+# Build timestamp
+#
+# Used as a means to automatically select the newest version of iPXE
+# if multiple iPXE drivers are loaded concurrently in a UEFI system.
+#
+# It gets rounded down to the nearest minute when used for this
+# purpose.
+#
+ifdef SOURCE_DATE_EPOCH
+BUILD_TIMESTAMP := $(SOURCE_DATE_EPOCH)
+else ifdef GITVERSION
+BUILD_TIMESTAMP := $(shell git log -1 --pretty=%ct)
+else
+BUILD_TIMESTAMP := $(shell date +%s)
+endif
+
+# Build version
+#
+GIT_INDEX := $(if $(GITVERSION),$(if $(wildcard ../.git/index),../.git/index))
+$(BIN)/version.%.o : core/version.c $(MAKEDEPS) $(version_DEPS) $(GIT_INDEX)
+	$(QM)$(ECHO) "  [VERSION] $@"
+	$(Q)$(COMPILE_c) -DBUILD_NAME="\"$*\"" \
+		-DVERSION_MAJOR=$(VERSION_MAJOR) \
+		-DVERSION_MINOR=$(VERSION_MINOR) \
+		-DVERSION_PATCH=$(VERSION_PATCH) \
+		-DVERSION="\"$(VERSION)\"" \
+		-c $< -o $@
+	$(Q)$(OBJCOPY) --prefix-symbols=$(SYMBOL_PREFIX) $@
+
+# Build an intermediate object file from the objects required for the
+# specified target.
+#
+$(BIN)/%.tmp : $(BIN)/version.%.o $(BLIB) $(MAKEDEPS) $(LDSCRIPT)
+	$(QM)$(ECHO) "  [LD] $@"
+	$(Q)$(LD) $(LDFLAGS) -T $(LDSCRIPT) $(TGT_LD_FLAGS) $< $(BLIB) -o $@ \
+		--defsym _build_id=$(shell $(BUILD_ID_CMD)) \
+		--defsym _build_timestamp=$(BUILD_TIMESTAMP) \
+		-Map $(BIN)/$*.tmp.map
+	$(Q)$(OBJDUMP) -ht $@ | $(PERL) $(SORTOBJDUMP) >> $(BIN)/$*.tmp.map
+
+# Keep intermediate object file (useful for debugging)
+.PRECIOUS : $(BIN)/%.tmp
+
+# Show a linker map for the specified target
+#
+$(BIN)/%.map : $(BIN)/%.tmp
+	@less $(BIN)/$*.tmp.map
+
+# Get objects list for the specified target
+#
+define objs_list
+	$(sort $(foreach OBJ_SYMBOL,\
+		 $(filter obj_%,$(shell $(NM) $(1) | cut -d" " -f3)),\
+		 $(patsubst obj_%,%,$(OBJ_SYMBOL))))
+endef
+$(BIN)/%.objs : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call objs_list,$<)
+$(BIN)/%.sizes : $(BIN)/%.tmp
+	$(Q)$(SIZE) -t $(foreach OBJ,$(call objs_list,$<),$(wildcard $(BIN)/$(subst _,?,$(OBJ)).o)) | \
+		sort -g
+
+# Get dependency list for the specified target
+#
+define deps_list
+	$(sort $(foreach OBJ,$(call objs_list,$(1)),$($(OBJ)_DEPS)))
+endef
+$(BIN)/%.deps : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call deps_list,$<)
+
+# Get unneeded source files for the specified target
+#
+define nodeps_list
+	$(sort $(filter-out $(call deps_list,$(1)),\
+		 $(foreach BOBJ,$(BOBJS),\
+		   $($(basename $(notdir $(BOBJ)))_DEPS))))
+endef
+$(BIN)/%.nodeps : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call nodeps_list,$<)
+
+# Get licensing verdict for the specified target
+#
+define licensable_deps_list
+	$(filter-out config/local/%.h,\
+	  $(filter-out $(BIN)/.%.list,\
+	    $(call deps_list,$(1))))
+endef
+define unlicensed_deps_list
+	$(shell grep -L FILE_LICENCE $(call licensable_deps_list,$(1)))
+endef
+define licence_list
+	$(sort $(foreach LICENCE,\
+		 $(filter __licence__%,$(shell $(NM) $(1) | cut -d" " -f3)),\
+		 $(word 2,$(subst __, ,$(LICENCE)))))
+endef
+$(BIN)/%.licence_list : $(BIN)/%.tmp
+	$(Q)$(ECHO) $(call licence_list,$<)
+$(BIN)/%.licence : $(BIN)/%.tmp
+	$(QM)$(ECHO) "  [LICENCE] $@"
+	$(Q)$(if $(strip $(call unlicensed_deps_list,$<)),\
+		echo -n "Unable to determine licence because the following " ;\
+		echo "files are missing a licence declaration:" ;\
+		echo $(call unlicensed_deps_list,$<);\
+		exit 1,\
+		$(PERL) $(LICENCE) $(call licence_list,$<))
+
+# Extract compression information from intermediate object file
+#
+$(BIN)/%.zinfo : $(BIN)/%.tmp
+	$(QM)$(ECHO) "  [ZINFO] $@"
+	$(Q)$(OBJCOPY) -O binary -j .zinfo $< $@
+
+# Build raw binary file from intermediate object file
+#
+$(BIN)/%.bin : $(BIN)/%.tmp
+	$(QM)$(ECHO) "  [BIN] $@"
+	$(Q)$(OBJCOPY) -O binary -R .zinfo $< $@
+
+# Compress raw binary file
+#
+$(BIN)/%.zbin : $(BIN)/%.bin $(BIN)/%.zinfo $(ZBIN)
+	$(QM)$(ECHO) "  [ZBIN] $@"
+	$(Q)$(ZBIN) $(BIN)/$*.bin $(BIN)/$*.zinfo > $@
+
+# Rules for each media format.  These are generated and placed in an
+# external Makefile fragment.  We could do this via $(eval ...), but
+# that would require make >= 3.80.
+# 
+# Note that there's an alternative way to generate most .rom images:
+# they can be copied from their 'master' ROM image using cp and
+# reprocessed with makerom to add the PCI IDs and ident string.  The
+# relevant rule would look something like:
+#
+#   $(BIN)/dfe538%rom : $(BIN)/rtl8139%rom
+#	cat $< $@
+#	$(FINALISE_rom)
+# 
+# You can derive the ROM/driver relationships using the variables
+# DRIVER_<rom> and/or ROMS_<driver>.
+# 
+# We don't currently do this, because (a) it would require generating
+# yet more Makefile fragments (since you need a rule for each ROM in
+# ROMS), and (b) the linker is so fast that it probably wouldn't make
+# much difference to the overall build time.
+
+# Add NON_AUTO_MEDIA to the media list, so that they show up in the
+# output of "make"
+#
+MEDIA		+= $(NON_AUTO_MEDIA)
+
+media :
+	@$(ECHO) $(MEDIA)
+
+AUTO_MEDIA	= $(filter-out $(NON_AUTO_MEDIA),$(MEDIA))
+automedia :
+	@$(ECHO) $(AUTO_MEDIA)
+
+# media_template : create media rules
+#
+# $(1) is the media name (e.g. "rom")
+#
+define media_template
+$(if $(filter $(1),$(AUTO_MEDIA)),$(call auto_media_template,$(1)))
+LIST_$(1) := $$(if $$(LIST_NAME_$(1)),$$($$(LIST_NAME_$(1))),$$(DRIVERS))
+ALL_$(1) = $$(foreach ITEM,$$(LIST_$(1)),$$(BIN)/$$(ITEM).$(1))
+$$(BIN)/all$(1)s : $$(ALL_$(1))
+$$(BIN)/allall : $$(BIN)/all$(1)s
+all$(1)s : $$(BIN)/all$(1)s
+allall : $$(BIN)/allall
+endef
+#
+# $(1) is the media name (e.g. "rom")
+#
+define auto_media_template
+$$(BIN)/%.$(1) : $$(BIN)/%.$(1).zbin
+	$$(QM)echo "  [FINISH] $$@"
+	$$(Q)$$(CP) $$< $$@
+	$$(Q)$$(if $$(PAD_$(1)),$$(PAD_$(1)) $$@)
+	$$(Q)$$(if $$(FINALISE_$(1)),$$(FINALISE_$(1)) $$@)
+endef
+#
+# $(1) is the media name (e.g. "rom")
+#
+define media_template_file
+	@$(ECHO) "  [MEDIARULES] $(1)"
+	@$(MKDIR) -p $(BIN)/rules/$(dir $(1))
+	@$(ECHO_E) '$(subst $(NEWLINE),\n,$(call media_template,$(1)))' \
+		> $(BIN)/rules/$(1).media.r
+endef
+
+# Generate media rules files
+#
+$(BIN)/rules/%.media.r : $(MAKEDEPS)
+	$(call media_template_file,$*)
+
+# Calculate list of media rules files
+#
+MEDIA_RULES		= $(patsubst %,$(BIN)/rules/%.media.r,$(MEDIA))
+mediarules :
+	@$(ECHO) $(MEDIA_RULES)
+
+# Evaluate media rules (or include media rules files)
+#
+ifdef NEED_DEPS
+ifneq ($(MEDIA_RULES),)
+ifneq ($(HAVE_EVAL),)
+$(foreach MEDIUM,$(MEDIA),$(eval $(call media_template,$(MEDIUM))))
+else
+-include $(MEDIA_RULES)
+endif
+endif
+endif
+
+# Alias for ipxe.%
+#
+$(BIN)/etherboot.% : $(BIN)/ipxe.%
+	ln -sf $(notdir $<) $@
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# The compression utilities
+#
+
+ZBIN_LDFLAGS := -llzma
+
+$(ZBIN) : util/zbin.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) $< $(ZBIN_LDFLAGS) -o $@
+CLEANUP += $(ZBIN)
+
+###############################################################################
+#
+# The EFI image converter
+#
+
+$(ELF2EFI32) : util/elf2efi.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -DEFI_TARGET32 $< -o $@
+CLEANUP += $(ELF2EFI32)
+
+$(ELF2EFI64) : util/elf2efi.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -DEFI_TARGET64 $< -o $@
+CLEANUP += $(ELF2EFI64)
+
+$(EFIROM) : util/efirom.c util/eficompress.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -o $@ $<
+CLEANUP += $(EFIROM)
+
+$(EFIFATBIN) : util/efifatbin.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -o $@ $<
+CLEANUP += $(EFIFATBIN)
+
+###############################################################################
+#
+# The error usage information utility
+#
+$(EINFO) : util/einfo.c $(MAKEDEPS)
+	$(QM)$(ECHO) "  [HOSTCC] $@"
+	$(Q)$(HOST_CC) $(HOST_CFLAGS) -idirafter include -o $@ $<
+CLEANUP += $(EINFO)
+
+###############################################################################
+#
+# Local configs
+#
+CONFIG_HEADERS := $(patsubst config/%,%,$(wildcard config/*.h))
+CONFIG_LOCAL_HEADERS := $(foreach HEADER,$(CONFIG_HEADERS),\
+				  config/local/$(HEADER))
+
+$(CONFIG_LOCAL_HEADERS) :
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : $(CONFIG_LOCAL_HEADERS)
+
+ifneq ($(CONFIG),)
+
+CONFIG_LOCAL_NAMED_HEADERS := $(foreach HEADER,$(CONFIG_HEADERS),\
+					config/local/$(CONFIG)/$(HEADER))
+
+$(CONFIG_LOCAL_NAMED_HEADERS) :
+	$(Q)$(MKDIR) -p $(dir $@)
+	$(Q)$(TOUCH) $@
+
+.PRECIOUS : $(CONFIG_LOCAL_NAMED_HEADERS)
+
+endif
+
+###############################################################################
+#
+# Build the TAGS file(s) for emacs
+#
+TAGS :
+	ctags -e -R -f $@ --exclude=bin
+
+CLEANUP	+= TAGS
+
+###############################################################################
+#
+# Force rebuild for any given target
+#
+%.rebuild :
+	rm -f $*
+	$(Q)$(MAKE) $*
+
+###############################################################################
+#
+# Symbol table checks
+#
+
+ifdef BIN
+
+SYMTAB	= $(BIN)/symtab
+$(SYMTAB) : $(BLIB)
+	$(OBJDUMP) -w -t $< > $@
+
+CLEANUP	+= $(BIN)/symtab
+
+symcheck : $(SYMTAB)
+	$(PERL) $(SYMCHECK) $<
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# Build bochs symbol table
+#
+
+ifdef BIN
+
+$(BIN)/%.bxs : $(BIN)/%.tmp
+	$(NM) $< | cut -d" " -f1,3 > $@
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# Documentation
+#
+
+ifdef BIN
+
+$(BIN)/doxygen.cfg : doxygen.cfg $(MAKEDEPS)
+	$(Q)$(PERL) -pe 's{\@SRCDIRS\@}{$(SRCDIRS)}; ' \
+		-e  's{\@INCDIRS\@}{$(filter-out .,$(INCDIRS))}; ' \
+		-e  's{\@BIN\@}{$(BIN)}; ' \
+		-e  's{\@ARCH\@}{$(ARCH)}; ' \
+		$< > $@
+
+$(BIN)/doc : $(BIN)/doxygen.cfg
+	$(Q)$(DOXYGEN) $<
+
+.PHONY : $(BIN)/doc
+
+doc : $(BIN)/doc
+
+doc-clean :
+	$(Q)$(RM) -r $(BIN)/doc
+
+VERYCLEANUP	+= $(BIN)/doc
+
+docview :
+	@[ -f $(BIN)/doc/html/index.html ] || $(MAKE) $(BIN)/doc
+	@if [ -n "$$BROWSER" ] ; then \
+		( $$BROWSER $(BIN)/doc/html/index.html & ) ; \
+	else \
+		$(ECHO) "Documentation index in $(BIN)/doc/html/index.html" ; \
+	fi
+
+endif # defined(BIN)
+
+###############################################################################
+#
+# Keyboard maps
+#
+
+hci/keymap/keymap_%.c :
+	$(Q)$(PYTHON) $(GENKEYMAP) $* > $@
+
+###############################################################################
+#
+# Force deletion of incomplete targets
+#
+
+.DELETE_ON_ERROR :
+
+###############################################################################
+#
+# Clean-up
+#
+
+ifeq ($(NUM_BINS),0)
+ALLBINS		:= bin bin-*
+ALLBIN		= $(foreach B,$(ALLBINS),$(patsubst $(BIN)/%,$(B)/%,$(1)))
+CLEANUP		:= $(foreach C,$(CLEANUP),$(call ALLBIN,$(C)))
+VERYCLEANUP	:= $(foreach V,$(VERYCLEANUP),$(call ALLBIN,$(V)))
+endif
+
+clean :
+	$(RM) -r $(CLEANUP)
+
+veryclean : clean
+	$(RM) -r $(VERYCLEANUP)
diff --git a/src/ipxe/src/config/console.h b/src/ipxe/src/config/console.h
index 937307ed9a..9c497bc7ce 100644
--- a/src/ipxe/src/config/console.h
+++ b/src/ipxe/src/config/console.h
@@ -53,7 +53,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 //#define	CONSOLE_PC_KBD		/* Direct access to PC keyboard */
 
 /* Keyboard map (available maps in hci/keymap/) */
-#define	KEYBOARD_MAP	dynamic
+#define	KEYBOARD_MAP	us
 
 /* Control which syslog() messages are generated.
  *
diff --git a/src/ipxe/src/config/general.h b/src/ipxe/src/config/general.h
index 82c351d047..d49b6676e9 100644
--- a/src/ipxe/src/config/general.h
+++ b/src/ipxe/src/config/general.h
@@ -35,10 +35,12 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 
 #define	NET_PROTO_IPV4		/* IPv4 protocol */
-#undef	NET_PROTO_IPV6		/* IPv6 protocol */
+#undef  NET_PROTO_IPV6	    /* IPv6 protocol */
 #undef	NET_PROTO_FCOE		/* Fibre Channel over Ethernet protocol */
 #define	NET_PROTO_STP		/* Spanning Tree protocol */
 #define	NET_PROTO_LACP		/* Link Aggregation control protocol */
+#define	NET_PROTO_EAPOL		/* EAP over LAN protocol */
+#define NET_PROTO_LLDP	    /* Link Layer Discovery protocol */
 
 /*
  * PXE support
@@ -89,6 +91,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define	CRYPTO_80211_WPA	/* WPA Personal, authenticating with passphrase */
 #define	CRYPTO_80211_WPA2	/* Add support for stronger WPA cryptography */
 
+/*
+ * 802.1x EAP authentication methods
+ *
+ */
+#define EAP_METHOD_MD5		/* MD5-Challenge port authentication */
+//#define EAP_METHOD_MSCHAPV2	/* MS-CHAPv2 port authentication */
+
 /*
  * Name resolution modules
  *
@@ -116,6 +125,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define	IMAGE_PNG		/* PNG image support */
 #define	IMAGE_DER		/* DER image support */
 #define	IMAGE_PEM		/* PEM image support */
+#define	IMAGE_ZLIB		/* ZLIB image support */
+#define	IMAGE_GZIP		/* GZIP image support */
+//#define	IMAGE_UCODE		/* Microcode update image support */
 
 /*
  * Command-line commands to include
@@ -133,6 +145,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define DHCP_CMD		/* DHCP management commands */
 #define SANBOOT_CMD		/* SAN boot commands */
 #define MENU_CMD		/* Menu commands */
+#define FORM_CMD		/* Form commands */
 #define LOGIN_CMD		/* Login command */
 #define SYNC_CMD		/* Sync command */
 #define SHELL_CMD		/* Shell command */
@@ -146,7 +159,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define POWEROFF_CMD		/* Power off command */
 #define IMAGE_TRUST_CMD	/* Image trust management commands */
 #define PCI_CMD		/* PCI commands */
-#define PARAM_CMD		/* Form parameter commands */
+#define PARAM_CMD		/* Request parameter commands */
 #define NEIGHBOUR_CMD		/* Neighbour management commands */
 #define PING_CMD		/* Ping command */
 #define CONSOLE_CMD		/* Console command */
@@ -154,6 +167,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 //#define PROFSTAT_CMD		/* Profiling commands */
 #define NTP_CMD		/* NTP commands */
 #define CERT_CMD		/* Certificate management commands */
+#define IMAGE_MEM_CMD		/* Read memory command */
+#define IMAGE_ARCHIVE_CMD	/* Archive image management commands */
+#define SHIM_CMD		/* EFI shim command (or dummy command) */
 
 /*
  * ROM-specific options
diff --git a/src/ipxe/src/config/settings.h b/src/ipxe/src/config/settings.h
index d9c86a384c..d7f787d38e 100644
--- a/src/ipxe/src/config/settings.h
+++ b/src/ipxe/src/config/settings.h
@@ -9,6 +9,8 @@
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
+#include <config/defaults.h>
+
 #define	PCI_SETTINGS	/* PCI device settings */
 //#define	CPUID_SETTINGS	/* CPUID settings */
 //#define	MEMMAP_SETTINGS	/* Memory map settings */
diff --git a/utils/FOGiPXE/buildipxe.sh b/utils/FOGiPXE/buildipxe.sh
index 807f66f264..53f039f71e 100755
--- a/utils/FOGiPXE/buildipxe.sh
+++ b/utils/FOGiPXE/buildipxe.sh
@@ -29,6 +29,7 @@ fi
 
 # Get current header and script from fogproject repo
 echo "Copy (overwrite) iPXE headers and scripts..."
+cp ${FOGDIR}/src/ipxe/src/Makefile.housekeeping .
 cp ${FOGDIR}/src/ipxe/src/ipxescript .
 cp ${FOGDIR}/src/ipxe/src/ipxescript10sec .
 cp ${FOGDIR}/src/ipxe/src/config/general.h config/
@@ -37,7 +38,7 @@ cp ${FOGDIR}/src/ipxe/src/config/console.h config/
 
 # Build the files
 make EMBED=ipxescript bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb ${BUILDOPTS}
-[[ $? -eq 0 ]] || exit 1
+[[ $? -eq 0 ]] || exit 40
 
 # Copy files to repo location as required
 cp bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb ${FOGDIR}/packages/tftp/
@@ -45,7 +46,7 @@ cp bin/ipxe.lkrn ${FOGDIR}/packages/tftp/ipxe.krn
 
 # Build with 10 second delay
 make EMBED=ipxescript10sec bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb ${BUILDOPTS}
-[[ $? -eq 0 ]] || exit 1
+[[ $? -eq 0 ]] || exit 48
 
 # Copy files to repo location as required
 cp bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb ${FOGDIR}/packages/tftp/10secdelay/
@@ -69,6 +70,7 @@ fi
 
 # Get current header and script from fogproject repo
 echo "Copy (overwrite) iPXE headers and scripts..."
+cp ${FOGDIR}/src/ipxe/src-efi/Makefile.housekeeping .
 cp ${FOGDIR}/src/ipxe/src-efi/ipxescript .
 cp ${FOGDIR}/src/ipxe/src-efi/ipxescript10sec .
 cp ${FOGDIR}/src/ipxe/src-efi/config/general.h config/
@@ -77,20 +79,20 @@ cp ${FOGDIR}/src/ipxe/src-efi/config/console.h config/
 
 # Build the files
 make EMBED=ipxescript bin-{i386,x86_64}-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${BUILDOPTS}
-[[ $? -eq 0 ]] || exit 1
+[[ $? -eq 0 ]] || exit 80
 [[ "x$armsupport" == "x1" ]] && make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm64 EMBED=ipxescript bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${BUILDOPTS} || true
-[[ $? -eq 0 ]] || exit 1
+[[ $? -eq 0 ]] || exit 82
 
 # Copy the files to upload
-[[ "x$armsupport" == "x1" ]] && cp bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/arm64-efi/ || true
+[[ "x$armsupport" == "x1" ]] && cp bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/arm64-efi/
 cp bin-i386-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/i386-efi/
 cp bin-x86_64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/
 
 # Build with 10 second delay
 make EMBED=ipxescript10sec bin-{i386,x86_64}-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${BUILDOPTS}
-[[ $? -eq 0 ]] || exit 1
+[[ $? -eq 0 ]] || exit 91
 [[ "x$armsupport" == "x1" ]] && make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm64 EMBED=ipxescript10sec bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${BUILDOPTS} || true
-[[ $? -eq 0 ]] || exit 1
+[[ $? -eq 0 ]] || exit 93
 
 # Copy the files to upload
 [[ "x$armsupport" == "x1" ]] && cp bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/10secdelay/arm64-efi/
diff --git a/utils/FOGiPXE/buildipxe_forpublish.sh b/utils/FOGiPXE/buildipxe_forpublish.sh
new file mode 100755
index 0000000000..32ea1301e0
--- /dev/null
+++ b/utils/FOGiPXE/buildipxe_forpublish.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+IPXEGIT="https://github.com/ipxe/ipxe"
+
+# Change directory to base ipxe files
+SCRIPT=$(readlink -f "$BASH_SOURCE")
+FOGDIR=$(dirname $(dirname $(dirname "$SCRIPT") ) )
+BASE=$(dirname "$FOGDIR")
+
+if [[ -d ${BASE}/ipxe ]]; then
+  cd ${BASE}/ipxe
+  git clean -fd
+  git reset --hard
+  git pull
+  cd src/
+else
+  git clone ${IPXEGIT} ${BASE}/ipxe
+  cd ${BASE}/ipxe/src/
+fi
+
+
+# Get current header and script from fogproject repo
+echo "Copy (overwrite) iPXE headers and scripts..."
+cp ${FOGDIR}/src/ipxe/src/Makefile.housekeeping .
+cp ${FOGDIR}/src/ipxe/src/ipxescript .
+cp ${FOGDIR}/src/ipxe/src/ipxescript10sec .
+cp ${FOGDIR}/src/ipxe/src/config/general.h config/
+cp ${FOGDIR}/src/ipxe/src/config/settings.h config/
+cp ${FOGDIR}/src/ipxe/src/config/console.h config/
+
+# Build the files
+make EMBED=ipxescript bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb
+[[ $? -eq 0 ]] || exit 40
+
+# Copy files to repo location as required
+cp bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb ${FOGDIR}/packages/tftp/
+cp bin/ipxe.lkrn ${FOGDIR}/packages/tftp/ipxe.krn
+
+# Build with 10 second delay
+make EMBED=ipxescript10sec bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb
+[[ $? -eq 0 ]] || exit 48
+
+# Copy files to repo location as required
+cp bin/ipxe.iso bin/{undionly,ipxe,intel,realtek}.{,k,kk}pxe bin/ipxe.lkrn bin/ipxe.usb ${FOGDIR}/packages/tftp/10secdelay/
+cp bin/ipxe.lkrn ${FOGDIR}/packages/tftp/10secdelay/ipxe.krn
+
+
+
+# Change to the efi layout
+if [[ -d ${BASE}/ipxe-efi ]]; then
+  cd ${BASE}/ipxe-efi/
+  git clean -fd
+  git reset --hard
+  git pull
+  cd src/
+else
+  git clone ${IPXEGIT} ${BASE}/ipxe-efi
+  cd ${BASE}/ipxe-efi/src/
+fi
+
+# Get current header and script from fogproject repo
+echo "Copy (overwrite) iPXE headers and scripts..."
+cp ${FOGDIR}/src/ipxe/src-efi/Makefile.housekeeping .
+cp ${FOGDIR}/src/ipxe/src-efi/ipxescript .
+cp ${FOGDIR}/src/ipxe/src-efi/ipxescript10sec .
+cp ${FOGDIR}/src/ipxe/src-efi/config/general.h config/
+cp ${FOGDIR}/src/ipxe/src-efi/config/settings.h config/
+cp ${FOGDIR}/src/ipxe/src-efi/config/console.h config/
+
+# Build the files
+make EMBED=ipxescript bin-{i386,x86_64}-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi
+[[ $? -eq 0 ]] || exit 80
+[[ "x$armsupport" == "x1" ]] && make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm64 EMBED=ipxescript bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi || true
+[[ $? -eq 0 ]] || exit 82
+
+# Copy the files to upload
+[[ "x$armsupport" == "x1" ]] && cp bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/arm64-efi/
+cp bin-i386-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/i386-efi/
+cp bin-x86_64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/
+
+# Build with 10 second delay
+make EMBED=ipxescript10sec bin-{i386,x86_64}-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi
+[[ $? -eq 0 ]] || exit 91
+[[ "x$armsupport" == "x1" ]] && make CROSS_COMPILE=aarch64-linux-gnu- ARCH=arm64 EMBED=ipxescript10sec bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi || true
+[[ $? -eq 0 ]] || exit 93
+
+# Copy the files to upload
+[[ "x$armsupport" == "x1" ]] && cp bin-arm64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/10secdelay/arm64-efi/
+cp bin-i386-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/10secdelay/i386-efi/
+cp bin-x86_64-efi/{snp{,only},ipxe,intel,realtek,ncm--ecm--axge}.efi ${FOGDIR}/packages/tftp/10secdelay/