diff --git a/RELEASE_NOTES.rst b/RELEASE_NOTES.rst
index f9922a5cf..8ccbc3347 100644
--- a/RELEASE_NOTES.rst
+++ b/RELEASE_NOTES.rst
@@ -9,13 +9,13 @@ ARTIQ-8 (Unreleased)
 Highlights:
 
 * Hardware support:
-  - Implemented Phaser-servo. This requires recent gateware on Phaser.
-  - Implemented Phaser-MIQRO support. This requires the Phaser MIQRO gateware
-    variant.
-  - Sampler: fixed ADC MU to Volt conversion factor for Sampler v2.2+.
-    For earlier hardware versions, specify the hardware version in the device
-    database file (e.g. ``"hw_rev": "v2.1"``) to use the correct conversion factor.
-  - Metlino and Sayma support has been dropped due to complications with synchronous RTIO clocking.
+   - Implemented Phaser-servo. This requires recent gateware on Phaser.
+   - Implemented Phaser-MIQRO support. This requires the Phaser MIQRO gateware
+     variant.
+   - Sampler: fixed ADC MU to Volt conversion factor for Sampler v2.2+.
+     For earlier hardware versions, specify the hardware version in the device
+     database file (e.g. ``"hw_rev": "v2.1"``) to use the correct conversion factor.
+   - Metlino and Sayma support has been dropped due to complications with synchronous RTIO clocking.
 * CPU (on softcore platforms) and AXI bus (on Zynq) are now clocked synchronously with the RTIO
   clock, to facilitate implementation of local processing on DRTIO satellites, and to slightly
   reduce RTIO latency.
diff --git a/artiq/coredevice/coredevice_generic.schema.json b/artiq/coredevice/coredevice_generic.schema.json
index 12047d04a..5b72329d3 100644
--- a/artiq/coredevice/coredevice_generic.schema.json
+++ b/artiq/coredevice/coredevice_generic.schema.json
@@ -302,6 +302,12 @@
                         "pll_n": {
                             "type": "integer"
                         },
+                        "pll_en": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 1,
+                            "default": 1
+                        },
                         "pll_vco": {
                             "type": "integer"
                         },
@@ -364,6 +370,12 @@
                             "type": "integer",
                             "default": 32
                         },
+                        "pll_en": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 1,
+                            "default": 1
+                        },
                         "pll_vco": {
                             "type": "integer"
                         }
diff --git a/artiq/firmware/Cargo.lock b/artiq/firmware/Cargo.lock
index c6f71926e..71d4a3af5 100644
--- a/artiq/firmware/Cargo.lock
+++ b/artiq/firmware/Cargo.lock
@@ -347,6 +347,7 @@ dependencies = [
 name = "satman"
 version = "0.0.0"
 dependencies = [
+ "alloc_list",
  "board_artiq",
  "board_misoc",
  "build_misoc",
diff --git a/artiq/firmware/bootloader/main.rs b/artiq/firmware/bootloader/main.rs
index 89d2002e1..355b94076 100644
--- a/artiq/firmware/bootloader/main.rs
+++ b/artiq/firmware/bootloader/main.rs
@@ -18,8 +18,8 @@ use board_misoc::slave_fpga;
 use board_misoc::{clock, ethmac, net_settings};
 use board_misoc::uart_console::Console;
 use riscv::register::{mcause, mepc, mtval};
-use smoltcp::iface::SocketStorage;
-use smoltcp::wire::{HardwareAddress, IpAddress, Ipv4Address};
+use smoltcp::iface::{Routes, SocketStorage};
+use smoltcp::wire::{HardwareAddress, IpAddress, Ipv4Address, Ipv6Address};
 
 fn check_integrity() -> bool {
     extern {
@@ -411,28 +411,29 @@ fn network_boot() {
     println!("Network addresses: {}", net_addresses);
     let mut ip_addrs = [
         IpCidr::new(IpAddress::Ipv4(Ipv4Address::UNSPECIFIED), 0),
-        IpCidr::new(net_addresses.ipv6_ll_addr, 0),
-        IpCidr::new(net_addresses.ipv6_ll_addr, 0)
+        net_addresses.ipv6_ll_addr,
+        IpCidr::new(IpAddress::Ipv6(Ipv6Address::UNSPECIFIED), 0)
     ];
     if let net_settings::Ipv4AddrConfig::Static(ipv4) = net_addresses.ipv4_addr {
-        ip_addrs[0] = IpCidr::new(IpAddress::Ipv4(ipv4), 0);
+        ip_addrs[0] = IpCidr::Ipv4(ipv4);
     }
-    let mut interface = match net_addresses.ipv6_addr {
-        Some(addr) => {
-            ip_addrs[2] = IpCidr::new(addr, 0);
-            smoltcp::iface::InterfaceBuilder::new(net_device, &mut sockets[..])
-                       .hardware_addr(HardwareAddress::Ethernet(net_addresses.hardware_addr))
-                       .ip_addrs(&mut ip_addrs[..])
-                       .neighbor_cache(neighbor_cache)
-                       .finalize()
-        }
-        None =>
-            smoltcp::iface::InterfaceBuilder::new(net_device, &mut sockets[..])
-                       .hardware_addr(HardwareAddress::Ethernet(net_addresses.hardware_addr))
-                       .ip_addrs(&mut ip_addrs[..2])
-                       .neighbor_cache(neighbor_cache)
-                       .finalize()
+    if let Some(ipv6) =  net_addresses.ipv6_addr {
+        ip_addrs[2] = IpCidr::Ipv6(ipv6);
     };
+    let mut routes = [None; 2];
+    let mut interface = smoltcp::iface::InterfaceBuilder::new(net_device, &mut sockets[..])
+        .hardware_addr(HardwareAddress::Ethernet(net_addresses.hardware_addr))
+        .ip_addrs(&mut ip_addrs[..])
+        .neighbor_cache(neighbor_cache)
+        .routes(Routes::new(&mut routes[..]))
+        .finalize();
+
+    if let Some(default_route) = net_addresses.ipv4_default_route {
+        interface.routes_mut().add_default_ipv4_route(default_route).unwrap();
+    }
+    if let Some(default_route) = net_addresses.ipv6_default_route {
+        interface.routes_mut().add_default_ipv6_route(default_route).unwrap();
+    }
 
     let mut rx_storage = [0; 4096];
     let mut tx_storage = [0; 128];
diff --git a/artiq/firmware/libboard_misoc/config.rs b/artiq/firmware/libboard_misoc/config.rs
index 51f71ac33..e5e62ad0c 100644
--- a/artiq/firmware/libboard_misoc/config.rs
+++ b/artiq/firmware/libboard_misoc/config.rs
@@ -163,7 +163,7 @@ mod imp {
             while let Some(result) = iter.next() {
                 let (record_key, record_value) = result?;
                 if key.as_bytes() == record_key {
-                    found = true;
+                    found = !record_value.is_empty();
                     // last write wins
                     value = record_value
                 }
diff --git a/artiq/firmware/libboard_misoc/net_settings.rs b/artiq/firmware/libboard_misoc/net_settings.rs
index 36c85319f..bab8fb28b 100644
--- a/artiq/firmware/libboard_misoc/net_settings.rs
+++ b/artiq/firmware/libboard_misoc/net_settings.rs
@@ -2,7 +2,7 @@ use core::fmt;
 use core::fmt::{Display, Formatter};
 use core::str::FromStr;
 
-use smoltcp::wire::{EthernetAddress, IpAddress, Ipv4Address};
+use smoltcp::wire::{EthernetAddress, IpAddress, IpCidr, Ipv4Address, Ipv4Cidr, Ipv6Address, Ipv6Cidr};
 
 use config;
 #[cfg(soc_platform = "kasli")]
@@ -10,18 +10,22 @@ use i2c_eeprom;
 
 pub enum Ipv4AddrConfig {
     UseDhcp,
-    Static(Ipv4Address),
+    Static(Ipv4Cidr),
 }
 
 impl FromStr for Ipv4AddrConfig {
     type Err = ();
 
     fn from_str(s: &str) -> Result<Self, Self::Err> {
-        Ok(if s == "use_dhcp" {
-            Ipv4AddrConfig::UseDhcp
+        if s == "use_dhcp" {
+            Ok(Ipv4AddrConfig::UseDhcp)
+        } else if let Ok(cidr) = Ipv4Cidr::from_str(s) {
+            Ok(Ipv4AddrConfig::Static(cidr))
+        } else if let Ok(addr) = Ipv4Address::from_str(s) {
+            Ok(Ipv4AddrConfig::Static(Ipv4Cidr::new(addr, 0)))
         } else {
-            Ipv4AddrConfig::Static(Ipv4Address::from_str(s)?)
-        })
+            Err(())
+        }
     }
 }
 
@@ -38,8 +42,10 @@ impl Display for Ipv4AddrConfig {
 pub struct NetAddresses {
     pub hardware_addr: EthernetAddress,
     pub ipv4_addr: Ipv4AddrConfig,
-    pub ipv6_ll_addr: IpAddress,
-    pub ipv6_addr: Option<IpAddress>
+    pub ipv6_ll_addr: IpCidr,
+    pub ipv6_addr: Option<Ipv6Cidr>,
+    pub ipv4_default_route: Option<Ipv4Address>,
+    pub ipv6_default_route: Option<Ipv6Address>,
 }
 
 impl fmt::Display for NetAddresses {
@@ -72,28 +78,39 @@ pub fn get_adresses() -> NetAddresses {
         }
     }
 
-    let ipv4_addr;
-    match config::read_str("ip", |r| r.map(|s| s.parse())) {
-        Ok(Ok(addr)) => ipv4_addr = addr,
-        _ => ipv4_addr = Ipv4AddrConfig::UseDhcp,
-    }
+    let ipv4_addr = match config::read_str("ip", |r| r.map(|s| s.parse())) {
+        Ok(Ok(addr)) => addr,
+        _ => Ipv4AddrConfig::UseDhcp,
+    };
 
-    let ipv6_ll_addr = IpAddress::v6(
+    let ipv4_default_route = match config::read_str("ipv4_default_route", |r| r.map(|s| s.parse())) {
+        Ok(Ok(addr)) => Some(addr),
+        _ => None,
+    };
+
+    let ipv6_ll_addr = IpCidr::new(IpAddress::v6(
         0xfe80, 0x0000, 0x0000, 0x0000,
         (((hardware_addr.0[0] ^ 0x02) as u16) << 8) | (hardware_addr.0[1] as u16),
         ((hardware_addr.0[2] as u16) << 8) | 0x00ff,
         0xfe00 | (hardware_addr.0[3] as u16),
-        ((hardware_addr.0[4] as u16) << 8) | (hardware_addr.0[5] as u16));
+        ((hardware_addr.0[4] as u16) << 8) | (hardware_addr.0[5] as u16)), 10);
 
     let ipv6_addr = match config::read_str("ip6", |r| r.map(|s| s.parse())) {
         Ok(Ok(addr)) => Some(addr),
         _ => None
     };
 
+    let ipv6_default_route = match config::read_str("ipv6_default_route", |r| r.map(|s| s.parse())) {
+        Ok(Ok(addr)) => Some(addr),
+        _ => None,
+    };
+
     NetAddresses {
-        hardware_addr: hardware_addr,
-        ipv4_addr: ipv4_addr,
-        ipv6_ll_addr: ipv6_ll_addr,
-        ipv6_addr: ipv6_addr
+        hardware_addr,
+        ipv4_addr,
+        ipv6_ll_addr,
+        ipv6_addr,
+        ipv4_default_route,
+        ipv6_default_route,
     }
 }
diff --git a/artiq/firmware/libproto_artiq/drtioaux_proto.rs b/artiq/firmware/libproto_artiq/drtioaux_proto.rs
index dbfe4a5ad..f5b232db9 100644
--- a/artiq/firmware/libproto_artiq/drtioaux_proto.rs
+++ b/artiq/firmware/libproto_artiq/drtioaux_proto.rs
@@ -14,6 +14,9 @@ impl<T> From<IoError<T>> for Error<T> {
     }
 }
 
+/* 512 (max size) - 4 (CRC) - 1 (packet ID) - 4 (trace ID) - 1 (last) - 2 (length) */
+const DMA_TRACE_MAX_SIZE: usize = 500;
+
 #[derive(PartialEq, Debug)]
 pub enum Packet {
     EchoRequest,
@@ -55,8 +58,14 @@ pub enum Packet {
     SpiReadReply { succeeded: bool, data: u32 },
     SpiBasicReply { succeeded: bool },
 
-    JdacBasicRequest { destination: u8, dacno: u8, reqno: u8, param: u8 },
-    JdacBasicReply { succeeded: bool, retval: u8 },
+    DmaAddTraceRequest { id: u32, last: bool, length: u16, trace: [u8; DMA_TRACE_MAX_SIZE] },
+    DmaAddTraceReply { succeeded: bool },
+    DmaRemoveTraceRequest { id: u32 },
+    DmaRemoveTraceReply { succeeded: bool },
+    DmaPlaybackRequest { id: u32, timestamp: u64 },
+    DmaPlaybackReply { succeeded: bool },
+    DmaPlaybackStatus { id: u32, error: u8, channel: u32, timestamp: u64 }
+
 }
 
 impl Packet {
@@ -188,15 +197,40 @@ impl Packet {
                 succeeded: reader.read_bool()?
             },
 
-            0xa0 => Packet::JdacBasicRequest {
-                destination: reader.read_u8()?,
-                dacno: reader.read_u8()?,
-                reqno: reader.read_u8()?,
-                param: reader.read_u8()?,
+            0xb0 => { 
+                let id = reader.read_u32()?;
+                let last = reader.read_bool()?;
+                let length = reader.read_u16()?;
+                let mut trace: [u8; DMA_TRACE_MAX_SIZE] = [0; DMA_TRACE_MAX_SIZE];
+                reader.read_exact(&mut trace[0..length as usize])?;
+                Packet::DmaAddTraceRequest {
+                    id: id,
+                    last: last,
+                    length: length as u16,
+                    trace: trace,
+                }
             },
-            0xa1 => Packet::JdacBasicReply {
-                succeeded: reader.read_bool()?,
-                retval: reader.read_u8()?
+            0xb1 => Packet::DmaAddTraceReply {
+                succeeded: reader.read_bool()?
+            },
+            0xb2 => Packet::DmaRemoveTraceRequest {
+                id: reader.read_u32()?
+            },
+            0xb3 => Packet::DmaRemoveTraceReply {
+                succeeded: reader.read_bool()?
+            },
+            0xb4 => Packet::DmaPlaybackRequest {
+                id: reader.read_u32()?,
+                timestamp: reader.read_u64()?
+            },
+            0xb5 => Packet::DmaPlaybackReply {
+                succeeded: reader.read_bool()?
+            },
+            0xb6 => Packet::DmaPlaybackStatus {
+                id: reader.read_u32()?,
+                error: reader.read_u8()?,
+                channel: reader.read_u32()?,
+                timestamp: reader.read_u64()?
             },
 
             ty => return Err(Error::UnknownPacket(ty))
@@ -358,18 +392,43 @@ impl Packet {
                 writer.write_bool(succeeded)?;
             },
 
-            Packet::JdacBasicRequest { destination, dacno, reqno, param } => {
-                writer.write_u8(0xa0)?;
-                writer.write_u8(destination)?;
-                writer.write_u8(dacno)?;
-                writer.write_u8(reqno)?;
-                writer.write_u8(param)?;
-            }
-            Packet::JdacBasicReply { succeeded, retval } => {
-                writer.write_u8(0xa1)?;
-                writer.write_bool(succeeded)?;
-                writer.write_u8(retval)?;
+            Packet::DmaAddTraceRequest { id, last, trace, length } => {
+                writer.write_u8(0xb0)?;
+                writer.write_u32(id)?;
+                writer.write_bool(last)?;
+                // trace may be broken down to fit within drtio aux memory limit
+                // will be reconstructed by satellite
+                writer.write_u16(length)?;
+                writer.write_all(&trace[0..length as usize])?;
             },
+            Packet::DmaAddTraceReply { succeeded } => {
+                writer.write_u8(0xb1)?;
+                writer.write_bool(succeeded)?;
+            },
+            Packet::DmaRemoveTraceRequest { id } => {
+                writer.write_u8(0xb2)?;
+                writer.write_u32(id)?;
+            },
+            Packet::DmaRemoveTraceReply { succeeded } => {
+                writer.write_u8(0xb3)?;
+                writer.write_bool(succeeded)?;
+            },
+            Packet::DmaPlaybackRequest { id, timestamp } => {
+                writer.write_u8(0xb4)?;
+                writer.write_u32(id)?;
+                writer.write_u64(timestamp)?;
+            },
+            Packet::DmaPlaybackReply { succeeded } => {
+                writer.write_u8(0xb5)?;
+                writer.write_bool(succeeded)?;
+            },
+            Packet::DmaPlaybackStatus { id, error, channel, timestamp } => {
+                writer.write_u8(0xb6)?;
+                writer.write_u32(id)?;
+                writer.write_u8(error)?;
+                writer.write_u32(channel)?;
+                writer.write_u64(timestamp)?;
+            }
         }
         Ok(())
     }
diff --git a/artiq/firmware/runtime/dhcp.rs b/artiq/firmware/runtime/dhcp.rs
index 0e7d3e438..5b5fc6263 100644
--- a/artiq/firmware/runtime/dhcp.rs
+++ b/artiq/firmware/runtime/dhcp.rs
@@ -1,12 +1,25 @@
 use board_misoc::clock;
 use sched;
 use sched::Dhcpv4Socket;
-use smoltcp::socket::Dhcpv4Event;
+use core::fmt::{Display, Formatter};
+use smoltcp::socket::{Dhcpv4Config, Dhcpv4Event};
 use smoltcp::wire::{Ipv4Address, Ipv4Cidr};
 
+struct OptionalIpAddressDisplay<'a> (&'a Option<Ipv4Address>);
+
+impl<'a> Display for OptionalIpAddressDisplay<'a> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> core::fmt::Result {
+        match self.0 {
+            Some(ip) => write!(f, "{}", ip),
+            None => write!(f, "<not set>"),
+        }
+    }
+}
+
+
 pub fn dhcp_thread(io: sched::Io) {
     let mut socket = Dhcpv4Socket::new(&io);
-    let mut last_ip: Option<Ipv4Cidr> = None;
+    let mut last_config: Option<Dhcpv4Config> = None;
     let mut done_reset = false;
     let start_time = clock::get_ms();
 
@@ -15,8 +28,8 @@ pub fn dhcp_thread(io: sched::Io) {
         // by the server. This is likely to be because the ethernet device isn't quite
         // ready at the point that it is sent. The following makes recovery from
         // that faster.
-        if !done_reset && last_ip.is_none() && start_time + 1000 < clock::get_ms() {
-            info!("Didn't get initial IP in first second. Assuming packet loss, trying a reset.");
+        if !done_reset && last_config.is_none() && start_time + 1000 < clock::get_ms() {
+            info!("Didn't get initial config in first second. Assuming packet loss, trying a reset.");
             socket.reset();
             done_reset = true;
         }
@@ -26,27 +39,45 @@ pub fn dhcp_thread(io: sched::Io) {
                     // Only compare the ip address in the config with previous config because we
                     // ignore the rest of the config i.e. we don't do any DNS or require a default
                     // gateway.
-                    let changed = if let Some(last_ip) = last_ip {
-                        if config.address != last_ip {
-                            info!("IP address changed {} -> {}", last_ip, config.address);
-                            true
-                        } else {
-                            false
+                    let changed = if let Some(last_config) = last_config {
+                        let mut changed = false;
+                        if config.address != last_config.address {
+                            info!("IP address changed {} -> {}", last_config.address, config.address);
+                            changed = true;
                         }
+                        if config.router != last_config.router {
+                            info!("Default route changed {} -> {}",
+                                OptionalIpAddressDisplay(&last_config.router),
+                                OptionalIpAddressDisplay(&config.router),
+                            );
+                            changed = true;
+                        }
+                        changed
                     } else {
-                        info!("Acquired IP address: None -> {}", config.address);
+                        info!("Acquired DHCP config IP address: None -> {} default route: None -> {}",
+                            config.address,
+                            OptionalIpAddressDisplay(&config.router),
+                        );
                         true
                     };
                     if changed {
-                        last_ip = Some(config.address);
+                        last_config = Some(config);
                         io.set_ipv4_address(&config.address);
+                        match config.router {
+                            Some(route) => { io.set_ipv4_default_route(route).unwrap(); }
+                            None => { io.remove_ipv4_default_route(); }
+                        }
                     }
                 }
                 Dhcpv4Event::Deconfigured => {
-                    if let Some(ip) = last_ip {
-                        info!("Lost IP address {} -> None", ip);
+                    if let Some(config) = last_config {
+                        info!("Lost DHCP config IP address {} -> None; default route {} -> None",
+                            config.address,
+                            OptionalIpAddressDisplay(&config.router),
+                        );
                         io.set_ipv4_address(&Ipv4Cidr::new(Ipv4Address::UNSPECIFIED, 0));
-                        last_ip = None;
+                        io.remove_ipv4_default_route();
+                        last_config = None;
                     }
                     // We always get one of these events at the start, ignore that one
                 }
diff --git a/artiq/firmware/runtime/ip_addr_storage.rs b/artiq/firmware/runtime/ip_addr_storage.rs
index 310c21941..e51c6e86f 100644
--- a/artiq/firmware/runtime/ip_addr_storage.rs
+++ b/artiq/firmware/runtime/ip_addr_storage.rs
@@ -1,6 +1,6 @@
 use smoltcp::iface::{Interface, InterfaceBuilder};
 use smoltcp::phy::Device;
-use smoltcp::wire::{IpAddress, IpCidr, Ipv4Address, Ipv4Cidr};
+use smoltcp::wire::{IpAddress, IpCidr, Ipv4Address, Ipv4Cidr, Ipv6Cidr};
 use board_misoc::net_settings::{Ipv4AddrConfig, NetAddresses};
 
 
@@ -16,14 +16,14 @@ pub trait InterfaceBuilderEx {
 impl<'a, DeviceT: for<'d> Device<'d>> InterfaceBuilderEx for InterfaceBuilder<'a, DeviceT> {
     fn init_ip_addrs(self, net_addresses: &NetAddresses) -> Self {
         let mut storage = [
-            IpCidr::new(IpAddress::Ipv4(Ipv4Address::UNSPECIFIED), 0);  IP_ADDRESS_STORAGE_SIZE
+            IpCidr::new(IpAddress::Ipv4(Ipv4Address::UNSPECIFIED), 32);  IP_ADDRESS_STORAGE_SIZE
         ];
         if let Ipv4AddrConfig::Static(ipv4) = net_addresses.ipv4_addr {
-            storage[IPV4_INDEX] = IpCidr::new(IpAddress::Ipv4(ipv4), 0);
+            storage[IPV4_INDEX] = IpCidr::Ipv4(ipv4);
         }
-        storage[IPV6_LL_INDEX] = IpCidr::new(net_addresses.ipv6_ll_addr, 0);
+        storage[IPV6_LL_INDEX] = net_addresses.ipv6_ll_addr;
         if let Some(ipv6) = net_addresses.ipv6_addr {
-            storage[IPV6_INDEX] = IpCidr::new(ipv6, 0);
+            storage[IPV6_INDEX] = IpCidr::Ipv6(ipv6);
         }
         self.ip_addrs(storage)
     }
@@ -31,10 +31,14 @@ impl<'a, DeviceT: for<'d> Device<'d>> InterfaceBuilderEx for InterfaceBuilder<'a
 
 pub trait InterfaceEx {
     fn update_ipv4_addr(&mut self, addr: &Ipv4Cidr);
+    fn update_ipv6_addr(&mut self, addr: &Ipv6Cidr);
 }
 
 impl<'a, DeviceT: for<'d> Device<'d>> InterfaceEx for Interface<'a, DeviceT> {
     fn update_ipv4_addr(&mut self, addr: &Ipv4Cidr) {
         self.update_ip_addrs(|storage| storage[IPV4_INDEX] = IpCidr::Ipv4(*addr))
     }
+    fn update_ipv6_addr(&mut self, addr: &Ipv6Cidr) {
+        self.update_ip_addrs(|storage| storage[IPV6_INDEX] = IpCidr::Ipv6(*addr))
+    }
 }
diff --git a/artiq/firmware/runtime/main.rs b/artiq/firmware/runtime/main.rs
index 6738d7c55..3ae50dcad 100644
--- a/artiq/firmware/runtime/main.rs
+++ b/artiq/firmware/runtime/main.rs
@@ -25,6 +25,7 @@ extern crate logger_artiq;
 extern crate proto_artiq;
 extern crate riscv;
 
+use alloc::collections::BTreeMap;
 use core::cell::RefCell;
 use core::convert::TryFrom;
 use smoltcp::wire::HardwareAddress;
@@ -42,6 +43,7 @@ use proto_artiq::{mgmt_proto, moninj_proto, rpc_proto, session_proto, kernel_pro
 use proto_artiq::analyzer_proto;
 
 use riscv::register::{mcause, mepc, mtval};
+use smoltcp::iface::Routes;
 use ip_addr_storage::InterfaceBuilderEx;
 
 mod rtio_clocking;
@@ -151,12 +153,23 @@ fn startup() {
     } else {
         false
     };
-    let interface = smoltcp::iface::InterfaceBuilder::new(net_device, vec![])
+    let mut interface = smoltcp::iface::InterfaceBuilder::new(net_device, vec![])
         .hardware_addr(HardwareAddress::Ethernet(net_addresses.hardware_addr))
         .init_ip_addrs(&net_addresses)
         .neighbor_cache(neighbor_cache)
+        .routes(Routes::new(BTreeMap::new()))
         .finalize();
 
+    if !use_dhcp {
+        if let Some(ipv4_default_route) = net_addresses.ipv4_default_route {
+            interface.routes_mut().add_default_ipv4_route(ipv4_default_route).unwrap();
+        }
+    }
+
+    if let Some(ipv6_default_route) = net_addresses.ipv6_default_route {
+        interface.routes_mut().add_default_ipv6_route(ipv6_default_route).unwrap();
+    }
+
     #[cfg(has_drtio)]
     let drtio_routing_table = urc::Urc::new(RefCell::new(
         drtio_routing::config_routing_table(csr::DRTIO.len())));
diff --git a/artiq/firmware/runtime/sched.rs b/artiq/firmware/runtime/sched.rs
index 1f9c79bc2..0adeaddd1 100644
--- a/artiq/firmware/runtime/sched.rs
+++ b/artiq/firmware/runtime/sched.rs
@@ -8,8 +8,8 @@ use fringe::OwnedStack;
 use fringe::generator::{Generator, Yielder, State as GeneratorState};
 use smoltcp::time::Duration;
 use smoltcp::Error as NetworkError;
-use smoltcp::wire::{IpEndpoint, Ipv4Cidr};
-use smoltcp::iface::{Interface, SocketHandle};
+use smoltcp::wire::{IpEndpoint, Ipv4Address, Ipv4Cidr};
+use smoltcp::iface::{Interface, Route, SocketHandle};
 
 use io::{Read, Write};
 use board_misoc::clock;
@@ -278,6 +278,14 @@ impl<'a> Io<'a> {
     pub fn set_ipv4_address(&self, addr: &Ipv4Cidr) {
         self.network.borrow_mut().update_ipv4_addr(addr)
     }
+
+    pub fn set_ipv4_default_route(&self, addr: Ipv4Address) -> Result<Option<Route>, Error> {
+        Ok(self.network.borrow_mut().routes_mut().add_default_ipv4_route(addr)?)
+    }
+
+    pub fn remove_ipv4_default_route(&self) -> Option<Route> {
+        self.network.borrow_mut().routes_mut().remove_default_ipv4_route()
+    }
 }
 
 #[derive(Clone)]
diff --git a/artiq/firmware/runtime/session.rs b/artiq/firmware/runtime/session.rs
index c0f009a96..df3865f6b 100644
--- a/artiq/firmware/runtime/session.rs
+++ b/artiq/firmware/runtime/session.rs
@@ -607,25 +607,18 @@ pub fn thread(io: Io, aux_mutex: &Mutex,
 
     let mut kernel_thread = None;
     {
-        let aux_mutex = aux_mutex.clone();
-        let routing_table = routing_table.clone();
-        let up_destinations = up_destinations.clone();
-        let congress = congress.clone();
-        respawn(&io, &mut kernel_thread, move |io| {
-            let routing_table = routing_table.borrow();
-            let mut congress = congress.borrow_mut();
-            info!("running startup kernel");
-            match flash_kernel_worker(&io, &aux_mutex, &routing_table, &up_destinations, &mut congress, "startup_kernel") {
-                Ok(()) =>
-                    info!("startup kernel finished"),
-                Err(Error::KernelNotFound) =>
-                    info!("no startup kernel found"),
-                Err(err) => {
-                    congress.finished_cleanly.set(false);
-                    error!("startup kernel aborted: {}", err);
-                }
+        let mut congress = congress.borrow_mut();
+        info!("running startup kernel");
+        match flash_kernel_worker(&io, &aux_mutex, &routing_table.borrow(), &up_destinations, &mut congress, "startup_kernel") {
+            Ok(()) =>
+                info!("startup kernel finished"),
+            Err(Error::KernelNotFound) =>
+                info!("no startup kernel found"),
+            Err(err) => {
+                congress.finished_cleanly.set(false);
+                error!("startup kernel aborted: {}", err);
             }
-        })
+        }
     }
 
     loop {
diff --git a/artiq/firmware/satman/Cargo.toml b/artiq/firmware/satman/Cargo.toml
index 0db54cd40..53b08d7b5 100644
--- a/artiq/firmware/satman/Cargo.toml
+++ b/artiq/firmware/satman/Cargo.toml
@@ -16,4 +16,5 @@ build_misoc = { path = "../libbuild_misoc" }
 log = { version = "0.4", default-features = false }
 board_misoc = { path = "../libboard_misoc", features = ["uart_console", "log"] }
 board_artiq = { path = "../libboard_artiq" }
+alloc_list = { path = "../liballoc_list" }
 riscv = { version = "0.6.0", features = ["inline-asm"] }
diff --git a/artiq/firmware/satman/dma.rs b/artiq/firmware/satman/dma.rs
new file mode 100644
index 000000000..c0a0affcf
--- /dev/null
+++ b/artiq/firmware/satman/dma.rs
@@ -0,0 +1,151 @@
+use board_misoc::csr;
+use alloc::{vec::Vec, collections::btree_map::BTreeMap};
+
+const ALIGNMENT: usize = 64;
+
+#[derive(Debug, PartialEq)]
+enum ManagerState {
+    Idle,
+    Playback
+}
+
+pub struct RtioStatus {
+    pub id: u32, 
+    pub error: u8, 
+    pub channel: u32, 
+    pub timestamp: u64
+}
+
+pub enum Error {
+    IdNotFound,
+    PlaybackInProgress,
+    EntryNotComplete
+}
+
+#[derive(Debug)]
+struct Entry {
+    trace: Vec<u8>,
+    padding_len: usize,
+    complete: bool
+}
+
+#[derive(Debug)]
+pub struct Manager {
+    entries: BTreeMap<u32, Entry>,
+    state: ManagerState,
+    currentid: u32
+}
+
+impl Manager {
+    pub fn new() -> Manager {
+        // in case Manager is created during a DMA in progress
+        // wait for it to end
+        unsafe {
+            while csr::rtio_dma::enable_read() != 0 {} 
+        }
+        Manager {
+            entries: BTreeMap::new(),
+            currentid: 0,
+            state: ManagerState::Idle,
+        }
+    }
+
+    pub fn add(&mut self, id: u32, last: bool, trace: &[u8], trace_len: usize) -> Result<(), Error> {
+        let entry = match self.entries.get_mut(&id) {
+            Some(entry) => entry,
+            None => {
+                self.entries.insert(id, Entry {
+                    trace: Vec::new(),
+                    padding_len: 0,
+                    complete: false });
+                self.entries.get_mut(&id).unwrap()
+            },
+        };
+        entry.trace.extend(&trace[0..trace_len]);
+
+        if last {
+            entry.trace.push(0);
+            let data_len = entry.trace.len();
+    
+            // Realign.
+            entry.trace.reserve(ALIGNMENT - 1);
+            let padding = ALIGNMENT - entry.trace.as_ptr() as usize % ALIGNMENT;
+            let padding = if padding == ALIGNMENT { 0 } else { padding };
+            for _ in 0..padding {
+                // Vec guarantees that this will not reallocate
+                entry.trace.push(0)
+            }
+            for i in 1..data_len + 1 {
+                entry.trace[data_len + padding - i] = entry.trace[data_len - i]
+            }
+            entry.complete = true;
+            entry.padding_len = padding;
+        }
+        Ok(())
+    }
+
+    pub fn erase(&mut self, id: u32) -> Result<(), Error> {
+        match self.entries.remove(&id) {
+            Some(_) => Ok(()),
+            None => Err(Error::IdNotFound)
+        }
+    }
+
+    pub fn playback(&mut self, id: u32, timestamp: u64) -> Result<(), Error> {
+        if self.state != ManagerState::Idle {
+            return Err(Error::PlaybackInProgress);
+        }
+
+        let entry = match self.entries.get(&id){
+            Some(entry) => entry,
+            None => { return Err(Error::IdNotFound); }
+        };
+        if !entry.complete {
+            return Err(Error::EntryNotComplete);
+        }
+        let ptr = entry.trace[entry.padding_len..].as_ptr();
+        assert!(ptr as u32 % 64 == 0);
+
+        self.state = ManagerState::Playback;
+        self.currentid = id;
+
+        unsafe {
+            csr::rtio_dma::base_address_write(ptr as u64);
+            csr::rtio_dma::time_offset_write(timestamp as u64);
+    
+            csr::cri_con::selected_write(1);
+            csr::rtio_dma::enable_write(1);
+            // playback has begun here, for status call check_state
+        }
+        Ok(())
+    }
+
+    pub fn check_state(&mut self) -> Option<RtioStatus> {
+        if self.state != ManagerState::Playback {
+            // nothing to report
+            return None;
+        }
+        let dma_enable = unsafe { csr::rtio_dma::enable_read() };
+        if dma_enable != 0 {
+            return None;
+        }
+        else {
+            self.state = ManagerState::Idle;
+            unsafe { 
+                csr::cri_con::selected_write(0);
+                let error =  csr::rtio_dma::error_read();
+                let channel = csr::rtio_dma::error_channel_read();
+                let timestamp = csr::rtio_dma::error_timestamp_read();
+                if error != 0 {
+                    csr::rtio_dma::error_write(1);
+                }
+                return Some(RtioStatus { 
+                    id: self.currentid, 
+                    error: error,
+                    channel: channel, 
+                    timestamp: timestamp });
+            }
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/artiq/firmware/satman/main.rs b/artiq/firmware/satman/main.rs
index b4ca3386f..6f7ed4e6a 100644
--- a/artiq/firmware/satman/main.rs
+++ b/artiq/firmware/satman/main.rs
@@ -1,4 +1,4 @@
-#![feature(never_type, panic_info_message, llvm_asm)]
+#![feature(never_type, panic_info_message, llvm_asm, default_alloc_error_handler)]
 #![no_std]
 
 #[macro_use]
@@ -7,6 +7,7 @@ extern crate log;
 extern crate board_misoc;
 extern crate board_artiq;
 extern crate riscv;
+extern crate alloc;
 
 use core::convert::TryFrom;
 use board_misoc::{csr, ident, clock, uart_logger, i2c, pmp};
@@ -15,8 +16,13 @@ use board_artiq::si5324;
 use board_artiq::{spi, drtioaux};
 use board_artiq::drtio_routing;
 use riscv::register::{mcause, mepc, mtval};
+use dma::Manager as DmaManager;
+
+#[global_allocator]
+static mut ALLOC: alloc_list::ListAlloc = alloc_list::EMPTY;
 
 mod repeater;
+mod dma;
 
 fn drtiosat_reset(reset: bool) {
     unsafe {
@@ -67,7 +73,7 @@ macro_rules! forward {
     ($routing_table:expr, $destination:expr, $rank:expr, $repeaters:expr, $packet:expr) => {}
 }
 
-fn process_aux_packet(_repeaters: &mut [repeater::Repeater],
+fn process_aux_packet(_manager: &mut DmaManager, _repeaters: &mut [repeater::Repeater],
         _routing_table: &mut drtio_routing::RoutingTable, _rank: &mut u8,
         packet: drtioaux::Packet) -> Result<(), drtioaux::Error<!>> {
     // In the code below, *_chan_sel_write takes an u8 if there are fewer than 256 channels,
@@ -294,6 +300,24 @@ fn process_aux_packet(_repeaters: &mut [repeater::Repeater],
                     &drtioaux::Packet::SpiReadReply { succeeded: false, data: 0 })
             }
         }
+        #[cfg(has_rtio_dma)]
+        drtioaux::Packet::DmaAddTraceRequest { id, last, length, trace } => {
+            let succeeded = _manager.add(id, last, &trace, length as usize).is_ok();
+            drtioaux::send(0,
+                &drtioaux::Packet::DmaAddTraceReply { succeeded: succeeded })
+        }
+        #[cfg(has_rtio_dma)]
+        drtioaux::Packet::DmaRemoveTraceRequest { id } => {
+            let succeeded = _manager.erase(id).is_ok();
+            drtioaux::send(0,
+                &drtioaux::Packet::DmaRemoveTraceReply { succeeded: succeeded })
+        }
+        #[cfg(has_rtio_dma)]
+        drtioaux::Packet::DmaPlaybackRequest { id, timestamp } => {
+            let succeeded = _manager.playback(id, timestamp).is_ok();
+            drtioaux::send(0,
+                &drtioaux::Packet::DmaPlaybackReply { succeeded: succeeded })
+        }
 
         _ => {
             warn!("received unexpected aux packet");
@@ -302,12 +326,12 @@ fn process_aux_packet(_repeaters: &mut [repeater::Repeater],
     }
 }
 
-fn process_aux_packets(repeaters: &mut [repeater::Repeater],
+fn process_aux_packets(dma_manager: &mut DmaManager, repeaters: &mut [repeater::Repeater],
         routing_table: &mut drtio_routing::RoutingTable, rank: &mut u8) {
     let result =
         drtioaux::recv(0).and_then(|packet| {
             if let Some(packet) = packet {
-                process_aux_packet(repeaters, routing_table, rank, packet)
+                process_aux_packet(dma_manager, repeaters, routing_table, rank, packet)
             } else {
                 Ok(())
             }
@@ -432,10 +456,13 @@ fn sysclk_setup() {
 #[no_mangle]
 pub extern fn main() -> i32 {
     extern {
+        static mut _fheap: u8;
+        static mut _eheap: u8;
         static mut _sstack_guard: u8;
     }
 
     unsafe {
+        ALLOC.add_range(&mut _fheap, &mut _eheap);
         pmp::init_stack_guard(&_sstack_guard as *const u8 as usize);
     }
 
@@ -511,13 +538,18 @@ pub extern fn main() -> i32 {
             si5324::siphaser::calibrate_skew().expect("failed to calibrate skew");
         }
 
+        // DMA manager created here, so when link is dropped, all DMA traces
+        // are cleared out for a clean slate on subsequent connections,
+        // without a manual intervention.
+        let mut dma_manager = DmaManager::new();
+
         drtioaux::reset(0);
         drtiosat_reset(false);
         drtiosat_reset_phy(false);
 
         while drtiosat_link_rx_up() {
             drtiosat_process_errors();
-            process_aux_packets(&mut repeaters, &mut routing_table, &mut rank);
+            process_aux_packets(&mut dma_manager, &mut repeaters, &mut routing_table, &mut rank);
             for rep in repeaters.iter_mut() {
                 rep.service(&routing_table, rank);
             }
@@ -538,6 +570,12 @@ pub extern fn main() -> i32 {
                     error!("aux packet error: {}", e);
                 }
             }
+            if let Some(status) = dma_manager.check_state() {
+                if let Err(e) = drtioaux::send(0, &drtioaux::Packet::DmaPlaybackStatus { 
+                    id: status.id, error: status.error, channel: status.channel, timestamp: status.timestamp }) {
+                    error!("error sending DMA playback status: {}", e);
+                }
+            }
         }
 
         drtiosat_reset_phy(true);
diff --git a/artiq/firmware/satman/satman.ld b/artiq/firmware/satman/satman.ld
index 37de797c2..4834c36a1 100644
--- a/artiq/firmware/satman/satman.ld
+++ b/artiq/firmware/satman/satman.ld
@@ -66,4 +66,12 @@ SECTIONS
         . += 0x10000;
         _fstack = . - 16;
     } > main_ram
+
+    /* 64MB heap for alloc use */
+    .heap (NOLOAD) : ALIGN(16)
+    {
+        _fheap = .;
+        . = . + 0x4000000;
+        _eheap = .;
+    } > main_ram
 }
diff --git a/artiq/frontend/artiq_ddb_template.py b/artiq/frontend/artiq_ddb_template.py
index 3c6491739..ab9762814 100755
--- a/artiq/frontend/artiq_ddb_template.py
+++ b/artiq/frontend/artiq_ddb_template.py
@@ -250,6 +250,7 @@ class PeripheralManager:
                         "class": "AD9910",
                         "arguments": {{
                             "pll_n": {pll_n},
+                            "pll_en": {pll_en},
                             "chip_select": {chip_select},
                             "cpld_device": "{name}_cpld"{sw}{pll_vco}{sync_delay_seed}{io_update_delay}
                         }}
@@ -259,7 +260,7 @@ class PeripheralManager:
                     uchn=i,
                     sw=",\n        \"sw_device\": \"ttl_{name}_sw{uchn}\"".format(name=urukul_name, uchn=i) if len(peripheral["ports"]) > 1 else "",
                     pll_vco=",\n        \"pll_vco\": {}".format(pll_vco) if pll_vco is not None else "",
-                    pll_n=peripheral.get("pll_n", 32),
+                    pll_n=peripheral.get("pll_n", 32), pll_en=peripheral.get("pll_en", 1),
                     sync_delay_seed=",\n        \"sync_delay_seed\": \"eeprom_{}:{}\"".format(urukul_name, 64 + 4*i) if synchronization else "",
                     io_update_delay=",\n        \"io_update_delay\": \"eeprom_{}:{}\"".format(urukul_name, 64 + 4*i) if synchronization else "")
             elif dds == "ad9912":
@@ -270,6 +271,7 @@ class PeripheralManager:
                         "class": "AD9912",
                         "arguments": {{
                             "pll_n": {pll_n},
+                            "pll_en": {pll_en},
                             "chip_select": {chip_select},
                             "cpld_device": "{name}_cpld"{sw}{pll_vco}
                         }}
@@ -279,7 +281,7 @@ class PeripheralManager:
                     uchn=i,
                     sw=",\n        \"sw_device\": \"ttl_{name}_sw{uchn}\"".format(name=urukul_name, uchn=i) if len(peripheral["ports"]) > 1 else "",
                     pll_vco=",\n        \"pll_vco\": {}".format(pll_vco) if pll_vco is not None else "",
-                    pll_n=peripheral.get("pll_n", 8))
+                    pll_n=peripheral.get("pll_n", 8), pll_en=peripheral.get("pll_en", 1))
             else:
                 raise ValueError
         return next(channel)
@@ -463,6 +465,7 @@ class PeripheralManager:
                     "class": "AD9910",
                     "arguments": {{
                         "pll_n": {pll_n},
+                        "pll_en": {pll_en},
                         "chip_select": 3,
                         "cpld_device": "{urukul_name}_cpld"{pll_vco}
                     }}
@@ -472,7 +475,7 @@ class PeripheralManager:
                 refclk=peripheral.get("refclk", self.master_description["rtio_frequency"]),
                 clk_sel=peripheral["clk_sel"],
                 pll_vco=",\n        \"pll_vco\": {}".format(pll_vco) if pll_vco is not None else "",
-                pll_n=peripheral["pll_n"])
+                pll_n=peripheral["pll_n"],  pll_en=peripheral.get("pll_en", 1))
         return next(channel)
 
     def process_zotino(self, rtio_offset, peripheral):
diff --git a/artiq/gateware/rtio/core.py b/artiq/gateware/rtio/core.py
index c4dae4dc1..1d9cfc006 100644
--- a/artiq/gateware/rtio/core.py
+++ b/artiq/gateware/rtio/core.py
@@ -66,7 +66,7 @@ class Core(Module, AutoCSR):
             interface=self.cri)
         self.submodules += outputs
         self.comb += outputs.coarse_timestamp.eq(tsc.coarse_ts)
-        self.sync += outputs.minimum_coarse_timestamp.eq(tsc.coarse_ts + 16)
+        self.sync += outputs.minimum_coarse_timestamp.eq(tsc.coarse_ts + 12)
 
         inputs = InputCollector(tsc, channels,
             quash_channels=quash_channels,
diff --git a/artiq/gateware/targets/kasli.py b/artiq/gateware/targets/kasli.py
index f26e839dd..ecb49451f 100755
--- a/artiq/gateware/targets/kasli.py
+++ b/artiq/gateware/targets/kasli.py
@@ -567,8 +567,10 @@ class SatelliteBase(BaseSoC):
 
         self.submodules.local_io = SyncRTIO(self.rtio_tsc, rtio_channels, lane_count=sed_lanes)
         self.comb += self.drtiosat.async_errors.eq(self.local_io.async_errors)
+        self.submodules.rtio_dma = rtio.DMA(self.get_native_sdram_if(), self.cpu_dw)
+        self.csr_devices.append("rtio_dma")
         self.submodules.cri_con = rtio.CRIInterconnectShared(
-            [self.drtiosat.cri],
+            [self.drtiosat.cri, self.rtio_dma.cri],
             [self.local_io.cri] + self.drtio_cri,
             enable_routing=True)
         self.csr_devices.append("cri_con")
diff --git a/artiq/gateware/targets/kc705.py b/artiq/gateware/targets/kc705.py
index 074abc9f4..6444410cd 100755
--- a/artiq/gateware/targets/kc705.py
+++ b/artiq/gateware/targets/kc705.py
@@ -451,8 +451,10 @@ class _SatelliteBase(BaseSoC):
 
         self.submodules.local_io = SyncRTIO(self.rtio_tsc, rtio_channels)
         self.comb += self.drtiosat.async_errors.eq(self.local_io.async_errors)
+        self.submodules.rtio_dma = rtio.DMA(self.get_native_sdram_if(), self.cpu_dw)
+        self.csr_devices.append("rtio_dma")
         self.submodules.cri_con = rtio.CRIInterconnectShared(
-            [self.drtiosat.cri],
+            [self.drtiosat.cri, self.rtio_dma.cri],
             [self.local_io.cri] + self.drtio_cri,
             enable_routing=True)
         self.csr_devices.append("cri_con")
diff --git a/doc/manual/developing_a_ndsp.rst b/doc/manual/developing_a_ndsp.rst
index 16ca2162b..274222470 100644
--- a/doc/manual/developing_a_ndsp.rst
+++ b/doc/manual/developing_a_ndsp.rst
@@ -132,7 +132,7 @@ We suggest that you define a function ``get_argparser`` that returns the argumen
 Logging
 -------
 
-For the debug, information and warning messages, use the ``logging`` Python module and print the log on the standard error output (the default setting). The logging level is by default "WARNING", meaning that only warning messages and more critical messages will get printed (and no debug nor information messages). By calling ``sipyco.common_args.verbosity_args`` with the parser as argument, you add support for the ``--verbose`` (``-v``) and ``--quiet`` (``-q``) arguments in the parser. Each occurence of ``-v`` (resp. ``-q``) in the arguments will increase (resp. decrease) the log level of the logging module. For instance, if only one ``-v`` is present in the arguments, then more messages (info, warning and above) will get printed. If only one ``-q`` is present in the arguments, then only errors and critical messages will get printed. If ``-qq`` is present in the arguments, then only critical messages will get printed, but no debug/info/warning/error.
+For the debug, information and warning messages, use the ``logging`` Python module and print the log on the standard error output (the default setting). The logging level is by default "WARNING", meaning that only warning messages and more critical messages will get printed (and no debug nor information messages). By calling ``sipyco.common_args.verbosity_args`` with the parser as argument, you add support for the ``--verbose`` (``-v``) and ``--quiet`` (``-q``) arguments in the parser. Each occurrence of ``-v`` (resp. ``-q``) in the arguments will increase (resp. decrease) the log level of the logging module. For instance, if only one ``-v`` is present in the arguments, then more messages (info, warning and above) will get printed. If only one ``-q`` is present in the arguments, then only errors and critical messages will get printed. If ``-qq`` is present in the arguments, then only critical messages will get printed, but no debug/info/warning/error.
 
 The program below exemplifies how to use logging: ::
 
diff --git a/doc/manual/installing.rst b/doc/manual/installing.rst
index 1a672d6f1..c9923a4f3 100644
--- a/doc/manual/installing.rst
+++ b/doc/manual/installing.rst
@@ -24,14 +24,11 @@ Installing multiple packages and making them visible to the ARTIQ commands requi
 ::
 
   {
-    inputs.artiq.url = "git+https://github.com/m-labs/artiq.git";
     inputs.extrapkg.url = "git+https://git.m-labs.hk/M-Labs/artiq-extrapkg.git";
-    inputs.extrapkg.inputs.artiq.follows = "artiq";
-    outputs = { self, artiq, extrapkg }:
+    outputs = { self, extrapkg }:
       let
-        pkgs = artiq.inputs.nixpkgs.legacyPackages.x86_64-linux;
-        aqmain = artiq.packages.x86_64-linux;
-        aqextra = extrapkg.packages.x86_64-linux;
+        pkgs = extrapkg.pkgs;
+        artiq = extrapkg.packages.x86_64-linux;
       in {
         defaultPackage.x86_64-linux = pkgs.buildEnv {
           name = "artiq-env";
@@ -41,9 +38,11 @@ Installing multiple packages and making them visible to the ARTIQ commands requi
             # ========================================
             (pkgs.python3.withPackages(ps: [
               # List desired Python packages here.
-              aqmain.artiq
+              artiq.artiq
               #ps.paramiko  # needed if and only if flashing boards remotely (artiq_flash -H)
-              #aqextra.flake8-artiq
+              #artiq.flake8-artiq
+              #artiq.dax
+              #artiq.dax-applets
 
               # The NixOS package collection contains many other packages that you may find
               # interesting. Here are some examples:
@@ -52,17 +51,18 @@ Installing multiple packages and making them visible to the ARTIQ commands requi
               #ps.scipy
               #ps.numba
               #ps.matplotlib
+              #ps.jsonschema # required by artiq_ddb_template
               # or if you need Qt (will recompile):
               #(ps.matplotlib.override { enableQt = true; })
               #ps.bokeh
               #ps.cirq
               #ps.qiskit
             ]))
-            #aqextra.korad_ka3005p
-            #aqextra.novatech409b
+            #artiq.korad_ka3005p
+            #artiq.novatech409b
             # List desired non-Python packages here
-            #aqmain.openocd-bscanspi  # needed if and only if flashing boards
-            # Other potentially interesting packages from the NixOS package collection:
+            #artiq.openocd-bscanspi  # needed if and only if flashing boards
+            # Other potentially interesting non-Python packages from the NixOS package collection:
             #pkgs.gtkwave
             #pkgs.spyder
             #pkgs.R
@@ -231,20 +231,26 @@ If you purchased a Kasli device from M-Labs, it usually comes with the IP addres
 
 and then reboot the device (with ``artiq_flash start`` or a power cycle).
 
-If the ip config field is not set, or set to "use_dhcp" then the device will attempt to obtain an IP address using
-DHCP. If a static IP address is wanted, install OpenOCD as before, and flash the IP (and, if necessary, MAC) addresses
-directly: ::
+If the ``ip`` config field is not set, or set to ``use_dhcp`` then the device will
+attempt to obtain an IP address and default gateway using DHCP. If a static IP
+address is wanted, install OpenOCD as before, and flash the IP, default gateway
+(and, if necessary, MAC and IPv6) addresses directly: ::
 
-  $ artiq_mkfs flash_storage.img -s mac xx:xx:xx:xx:xx:xx -s ip xx.xx.xx.xx
+  $ artiq_mkfs flash_storage.img -s mac xx:xx:xx:xx:xx:xx -s ip xx.xx.xx.xx/xx -s ipv4_default_route xx.xx.xx.xx -s ip6 xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/xx -s ipv6_default_route xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
   $ artiq_flash -t [board] -V [variant] -f flash_storage.img storage start
 
 For Kasli devices, flashing a MAC address is not necessary as they can obtain it from their EEPROM.
+If you only want to access the core device from the same subnet you may
+omit the default gateway and IPv4 prefix length: ::
+
+  $ artiq_mkfs flash_storage.img -s mac xx:xx:xx:xx:xx:xx -s ip xx.xx.xx.xx
 
 If DHCP has been used the address can be found in the console output, which can be viewed using: ::
 
   $ python -m misoc.tools.flterm /dev/ttyUSB2
 
-Check that you can ping the device. If ping fails, check that the Ethernet link LED is ON - on Kasli, it is the LED next to the SFP0 connector. As a next step, look at the messages emitted on the UART during boot. Use a program such as flterm or PuTTY to connect to the device's serial port at 115200bps 8-N-1 and reboot the device. On Kasli, the serial port is on FTDI channel 2 with v1.1 hardware (with channel 0 being JTAG) and on FTDI channel 1 with v1.0 hardware.
+
+Check that you can ping the device. If ping fails, check that the Ethernet link LED is ON - on Kasli, it is the LED next to the SFP0 connector. As a next step, look at the messages emitted on the UART during boot. Use a program such as flterm or PuTTY to connect to the device's serial port at 115200bps 8-N-1 and reboot the device. On Kasli, the serial port is on FTDI channel 2 with v1.1 hardware (with channel 0 being JTAG) and on FTDI channel 1 with v1.0 hardware. Note that on Windows you might need to install the `FTDI drivers <https://ftdichip.com/drivers/>`_ first.
 
 If you want to use IPv6, the device also has a link-local address that corresponds to its EUI-64, and an additional arbitrary IPv6 address can be defined by using the ``ip6`` configuration key. All IPv4 and IPv6 addresses can be used at the same time.