diff --git a/artiq/compiler/embedding.py b/artiq/compiler/embedding.py
index 7c6b7f617..4a5208c4a 100644
--- a/artiq/compiler/embedding.py
+++ b/artiq/compiler/embedding.py
@@ -994,8 +994,24 @@ class Stitcher:
         else:
             assert False
 
+        is_async = False
+        if hasattr(host_function, "artiq_embedded") and \
+                "async" in host_function.artiq_embedded.flags:
+            is_async = True
+
+        if not builtins.is_none(ret_type) and is_async:
+            note = diagnostic.Diagnostic("note",
+                "function called here", {},
+                loc)
+            diag = diagnostic.Diagnostic("fatal",
+                "functions that return a value cannot be defined as async RPCs", {},
+                self._function_loc(host_function.artiq_embedded.function),
+                notes=[note])
+            self.engine.process(diag)
+
         function_type = types.TRPC(ret_type,
-                                   service=self.embedding_map.store_object(host_function))
+                                   service=self.embedding_map.store_object(host_function),
+                                   async=is_async)
         self.functions[function] = function_type
         return function_type
 
@@ -1007,7 +1023,11 @@ class Stitcher:
 
         if function in self.functions:
             pass
-        elif not hasattr(host_function, "artiq_embedded"):
+        elif not hasattr(host_function, "artiq_embedded") or \
+                (host_function.artiq_embedded.core_name is None and
+                 host_function.artiq_embedded.portable is False and
+                 host_function.artiq_embedded.syscall is None and
+                 host_function.artiq_embedded.forbidden is False):
             self._quote_rpc(function, loc)
         elif host_function.artiq_embedded.function is not None:
             if host_function.__name__ == "<lambda>":
diff --git a/artiq/compiler/module.py b/artiq/compiler/module.py
index 0e07a5b60..e169a656e 100644
--- a/artiq/compiler/module.py
+++ b/artiq/compiler/module.py
@@ -40,7 +40,8 @@ class Source:
             return cls(source.Buffer(f.read(), filename, 1), engine=engine)
 
 class Module:
-    def __init__(self, src, ref_period=1e-6):
+    def __init__(self, src, ref_period=1e-6, attribute_writeback=True):
+        self.attribute_writeback = attribute_writeback
         self.engine = src.engine
         self.embedding_map = src.embedding_map
         self.name = src.name
@@ -79,7 +80,8 @@ class Module:
         llvm_ir_generator = transforms.LLVMIRGenerator(
             engine=self.engine, module_name=self.name, target=target,
             embedding_map=self.embedding_map)
-        return llvm_ir_generator.process(self.artiq_ir, attribute_writeback=True)
+        return llvm_ir_generator.process(self.artiq_ir,
+            attribute_writeback=self.attribute_writeback)
 
     def __repr__(self):
         printer = types.TypePrinter()
diff --git a/artiq/compiler/prelude.py b/artiq/compiler/prelude.py
index 8c46176f9..e19ef6706 100644
--- a/artiq/compiler/prelude.py
+++ b/artiq/compiler/prelude.py
@@ -31,6 +31,7 @@ def globals():
         # ARTIQ decorators
         "kernel":               builtins.fn_kernel(),
         "portable":             builtins.fn_kernel(),
+        "rpc":                  builtins.fn_kernel(),
 
         # ARTIQ context managers
         "parallel":             builtins.obj_parallel(),
diff --git a/artiq/compiler/targets.py b/artiq/compiler/targets.py
index aab813737..0fd2aa0fe 100644
--- a/artiq/compiler/targets.py
+++ b/artiq/compiler/targets.py
@@ -86,14 +86,11 @@ class Target:
         llmachine = lltarget.create_target_machine(
                         features=",".join(["+{}".format(f) for f in self.features]),
                         reloc="pic", codemodel="default")
-        llmachine.set_verbose(True)
+        llmachine.set_asm_verbosity(True)
         return llmachine
 
     def optimize(self, llmodule):
-        llmachine = self.target_machine()
         llpassmgr = llvm.create_module_pass_manager()
-        llmachine.target_data.add_pass(llpassmgr)
-        llmachine.add_analysis_passes(llpassmgr)
 
         # Register our alias analysis passes.
         llpassmgr.add_basic_alias_analysis_pass()
diff --git a/artiq/compiler/transforms/artiq_ir_generator.py b/artiq/compiler/transforms/artiq_ir_generator.py
index 330ff0ecf..4575c381c 100644
--- a/artiq/compiler/transforms/artiq_ir_generator.py
+++ b/artiq/compiler/transforms/artiq_ir_generator.py
@@ -452,30 +452,30 @@ class ARTIQIRGenerator(algorithm.Visitor):
             self.current_block = body
             self.visit(node.body)
             post_body = self.current_block
-
-            if any(node.orelse):
-                else_tail = self.add_block("while.else")
-                self.current_block = else_tail
-                self.visit(node.orelse)
-                post_else_tail = self.current_block
-
-            tail = self.add_block("while.tail")
-            self.current_block = tail
-
-            if any(node.orelse):
-                if not post_else_tail.is_terminated():
-                    post_else_tail.append(ir.Branch(tail))
-            else:
-                else_tail = tail
-
-            post_head.append(ir.BranchIf(cond, body, else_tail))
-            if not post_body.is_terminated():
-                post_body.append(ir.Branch(head))
-            break_block.append(ir.Branch(tail))
         finally:
             self.break_target = old_break
             self.continue_target = old_continue
 
+        if any(node.orelse):
+            else_tail = self.add_block("while.else")
+            self.current_block = else_tail
+            self.visit(node.orelse)
+            post_else_tail = self.current_block
+
+        tail = self.add_block("while.tail")
+        self.current_block = tail
+
+        if any(node.orelse):
+            if not post_else_tail.is_terminated():
+                post_else_tail.append(ir.Branch(tail))
+        else:
+            else_tail = tail
+
+        post_head.append(ir.BranchIf(cond, body, else_tail))
+        if not post_body.is_terminated():
+            post_body.append(ir.Branch(head))
+        break_block.append(ir.Branch(tail))
+
     def iterable_len(self, value, typ=_size_type):
         if builtins.is_listish(value.type):
             if isinstance(value, ir.Constant):
@@ -541,33 +541,33 @@ class ARTIQIRGenerator(algorithm.Visitor):
                 self.current_assign = None
             self.visit(node.body)
             post_body = self.current_block
-
-            if any(node.orelse):
-                else_tail = self.add_block("for.else")
-                self.current_block = else_tail
-                self.visit(node.orelse)
-                post_else_tail = self.current_block
-
-            tail = self.add_block("for.tail")
-            self.current_block = tail
-
-            if any(node.orelse):
-                if not post_else_tail.is_terminated():
-                    post_else_tail.append(ir.Branch(tail))
-            else:
-                else_tail = tail
-
-            if node.trip_count is not None:
-                head.append(ir.Loop(node.trip_count, phi, cond, body, else_tail))
-            else:
-                head.append(ir.BranchIf(cond, body, else_tail))
-            if not post_body.is_terminated():
-                post_body.append(ir.Branch(continue_block))
-            break_block.append(ir.Branch(tail))
         finally:
             self.break_target = old_break
             self.continue_target = old_continue
 
+        if any(node.orelse):
+            else_tail = self.add_block("for.else")
+            self.current_block = else_tail
+            self.visit(node.orelse)
+            post_else_tail = self.current_block
+
+        tail = self.add_block("for.tail")
+        self.current_block = tail
+
+        if any(node.orelse):
+            if not post_else_tail.is_terminated():
+                post_else_tail.append(ir.Branch(tail))
+        else:
+            else_tail = tail
+
+        if node.trip_count is not None:
+            head.append(ir.Loop(node.trip_count, phi, cond, body, else_tail))
+        else:
+            head.append(ir.BranchIf(cond, body, else_tail))
+        if not post_body.is_terminated():
+            post_body.append(ir.Branch(continue_block))
+        break_block.append(ir.Branch(tail))
+
     def visit_Break(self, node):
         self.append(ir.Branch(self.break_target))
 
diff --git a/artiq/compiler/transforms/asttyped_rewriter.py b/artiq/compiler/transforms/asttyped_rewriter.py
index 199ea2ef9..3c840673e 100644
--- a/artiq/compiler/transforms/asttyped_rewriter.py
+++ b/artiq/compiler/transforms/asttyped_rewriter.py
@@ -509,7 +509,7 @@ class ASTTypedRewriter(algorithm.Transformer):
     visit_DictComp = visit_unsupported
     visit_Ellipsis = visit_unsupported
     visit_GeneratorExp = visit_unsupported
-    visit_Set = visit_unsupported
+    # visit_Set = visit_unsupported
     visit_SetComp = visit_unsupported
     visit_Starred = visit_unsupported
     visit_Yield = visit_unsupported
diff --git a/artiq/compiler/transforms/llvm_ir_generator.py b/artiq/compiler/transforms/llvm_ir_generator.py
index f935ef2b7..0a41479b8 100644
--- a/artiq/compiler/transforms/llvm_ir_generator.py
+++ b/artiq/compiler/transforms/llvm_ir_generator.py
@@ -37,9 +37,16 @@ def memoize(generator):
 class DebugInfoEmitter:
     def __init__(self, llmodule):
         self.llmodule = llmodule
-        self.llsubprograms = []
+        self.llcompileunit = None
         self.cache = {}
 
+        llident = self.llmodule.add_named_metadata('llvm.ident')
+        llident.add(self.emit_metadata(["ARTIQ"]))
+
+        llflags = self.llmodule.add_named_metadata('llvm.module.flags')
+        llflags.add(self.emit_metadata([2, "Debug Info Version", 3]))
+        llflags.add(self.emit_metadata([2, "Dwarf Version", 4]))
+
     def emit_metadata(self, operands):
         def map_operand(operand):
             if operand is None:
@@ -67,14 +74,13 @@ class DebugInfoEmitter:
         })
 
     @memoize
-    def emit_compile_unit(self, source_buffer, llsubprograms):
+    def emit_compile_unit(self, source_buffer):
         return self.emit_debug_info("DICompileUnit", {
             "language":        ll.DIToken("DW_LANG_Python"),
             "file":            self.emit_file(source_buffer),
             "producer":        "ARTIQ",
             "runtimeVersion":  0,
             "emissionKind":    2, # full=1, lines only=2
-            "subprograms":     self.emit_metadata(llsubprograms)
         }, is_distinct=True)
 
     @memoize
@@ -86,21 +92,26 @@ class DebugInfoEmitter:
     @memoize
     def emit_subprogram(self, func, llfunc):
         source_buffer = func.loc.source_buffer
+
+        if self.llcompileunit is None:
+            self.llcompileunit = self.emit_compile_unit(source_buffer)
+            llcompileunits = self.llmodule.add_named_metadata('llvm.dbg.cu')
+            llcompileunits.add(self.llcompileunit)
+
         display_name = "{}{}".format(func.name, types.TypePrinter().name(func.type))
-        llsubprogram = self.emit_debug_info("DISubprogram", {
+        return self.emit_debug_info("DISubprogram", {
             "name":            func.name,
             "linkageName":     llfunc.name,
             "type":            self.emit_subroutine_type(func.type),
             "file":            self.emit_file(source_buffer),
             "line":            func.loc.line(),
+            "unit":            self.llcompileunit,
             "scope":           self.emit_file(source_buffer),
             "scopeLine":       func.loc.line(),
             "isLocal":         func.is_internal,
             "isDefinition":    True,
             "variables":       self.emit_metadata([])
         }, is_distinct=True)
-        self.llsubprograms.append(llsubprogram)
-        return llsubprogram
 
     @memoize
     def emit_loc(self, loc, scope):
@@ -110,18 +121,6 @@ class DebugInfoEmitter:
             "scope":           scope
         })
 
-    def finalize(self, source_buffer):
-        llident = self.llmodule.add_named_metadata('llvm.ident')
-        llident.add(self.emit_metadata(["ARTIQ"]))
-
-        llflags = self.llmodule.add_named_metadata('llvm.module.flags')
-        llflags.add(self.emit_metadata([2, "Debug Info Version", 3]))
-        llflags.add(self.emit_metadata([2, "Dwarf Version", 4]))
-
-        llcompile_units = self.llmodule.add_named_metadata('llvm.dbg.cu')
-        llcompile_units.add(self.emit_compile_unit(source_buffer, tuple(self.llsubprograms)))
-
-
 class LLVMIRGenerator:
     def __init__(self, engine, module_name, target, embedding_map):
         self.engine = engine
@@ -323,6 +322,8 @@ class LLVMIRGenerator:
             llty = ll.FunctionType(llvoid, [])
         elif name == "llvm.floor.f64":
             llty = ll.FunctionType(lldouble, [lldouble])
+        elif name == "llvm.round.f64":
+            llty = ll.FunctionType(lldouble, [lldouble])
         elif name == "llvm.pow.f64":
             llty = ll.FunctionType(lldouble, [lldouble, lldouble])
         elif name == "llvm.powi.f64":
@@ -347,10 +348,10 @@ class LLVMIRGenerator:
             llty = ll.FunctionType(lli32, [llptr])
         elif name == "strcmp":
             llty = ll.FunctionType(lli32, [llptr, llptr])
-        elif name == "lround":
-            llty = ll.FunctionType(lli32, [lldouble])
         elif name == "send_rpc":
             llty = ll.FunctionType(llvoid, [lli32, llptr, llptrptr])
+        elif name == "send_async_rpc":
+            llty = ll.FunctionType(llvoid, [lli32, llptr, llptrptr])
         elif name == "recv_rpc":
             llty = ll.FunctionType(lli32, [llptr])
         elif name == "now":
@@ -366,7 +367,8 @@ class LLVMIRGenerator:
             llglobal = ll.Function(self.llmodule, llty, name)
             if name in ("__artiq_raise", "__artiq_reraise", "llvm.trap"):
                 llglobal.attributes.add("noreturn")
-            if name in ("rtio_log", "send_rpc", "watchdog_set", "watchdog_clear",
+            if name in ("rtio_log", "send_rpc", "send_async_rpc",
+                        "watchdog_set", "watchdog_clear",
                         self.target.print_function):
                 llglobal.attributes.add("nounwind")
         else:
@@ -407,9 +409,6 @@ class LLVMIRGenerator:
         for func in functions:
             self.process_function(func)
 
-        if any(functions):
-            self.debug_info_emitter.finalize(functions[0].loc.source_buffer)
-
         if attribute_writeback and self.embedding_map is not None:
             self.emit_attribute_writeback()
 
@@ -652,7 +651,7 @@ class LLVMIRGenerator:
             llptr = self.llbuilder.gep(llenv, [self.llindex(0), self.llindex(outer_index)],
                                        inbounds=True)
             llouterenv = self.llbuilder.load(llptr)
-            llouterenv.set_metadata('invariant.load', self.empty_metadata)
+            llouterenv.set_metadata('unconditionally.invariant.load', self.empty_metadata)
             llouterenv.set_metadata('nonnull', self.empty_metadata)
             return self.llptr_to_var(llouterenv, env_ty.params["$outer"], var_name)
 
@@ -796,7 +795,7 @@ class LLVMIRGenerator:
                                            inbounds=True, name="ptr.{}".format(insn.name))
                 llvalue = self.llbuilder.load(llptr, name="val.{}".format(insn.name))
                 if types.is_instance(typ) and attr in typ.constant_attributes:
-                    llvalue.set_metadata('invariant.load', self.empty_metadata)
+                    llvalue.set_metadata('unconditionally.invariant.load', self.empty_metadata)
                 if isinstance(llvalue.type, ll.PointerType):
                     self.mark_dereferenceable(llvalue)
                 return llvalue
@@ -1041,8 +1040,9 @@ class LLVMIRGenerator:
                                          name=insn.name)
         elif insn.op == "round":
             llarg = self.map(insn.operands[0])
-            return self.llbuilder.call(self.llbuiltin("lround"), [llarg],
-                                       name=insn.name)
+            llvalue = self.llbuilder.call(self.llbuiltin("llvm.round.f64"), [llarg])
+            return self.llbuilder.fptosi(llvalue, self.llty_of_type(insn.type),
+                                         name=insn.name)
         elif insn.op == "globalenv":
             def get_outer(llenv, env_ty):
                 if "$outer" in env_ty.params:
@@ -1050,7 +1050,7 @@ class LLVMIRGenerator:
                     llptr = self.llbuilder.gep(llenv, [self.llindex(0), self.llindex(outer_index)],
                                                inbounds=True)
                     llouterenv = self.llbuilder.load(llptr)
-                    llouterenv.set_metadata('invariant.load', self.empty_metadata)
+                    llouterenv.set_metadata('unconditionally.invariant.load', self.empty_metadata)
                     llouterenv.set_metadata('nonnull', self.empty_metadata)
                     return self.llptr_to_var(llouterenv, env_ty.params["$outer"], var_name)
                 else:
@@ -1248,17 +1248,26 @@ class LLVMIRGenerator:
             llargptr = self.llbuilder.gep(llargs, [ll.Constant(lli32, index)])
             self.llbuilder.store(llargslot, llargptr)
 
-        self.llbuilder.call(self.llbuiltin("send_rpc"),
-                            [llservice, lltag, llargs])
+        if fun_type.async:
+            self.llbuilder.call(self.llbuiltin("send_async_rpc"),
+                                [llservice, lltag, llargs])
+        else:
+            self.llbuilder.call(self.llbuiltin("send_rpc"),
+                                [llservice, lltag, llargs])
 
         # Don't waste stack space on saved arguments.
         self.llbuilder.call(self.llbuiltin("llvm.stackrestore"), [llstackptr])
 
+        if fun_type.async:
+            return ll.Undefined
+
         # T result = {
-        #   void *ptr = NULL;
-        #   loop: int size = rpc_recv("tag", ptr);
+        #   void *ret_ptr = alloca(sizeof(T));
+        #   void *ptr = ret_ptr;
+        #   loop: int size = recv_rpc(ptr);
+        #   // Non-zero: Provide `size` bytes of extra storage for variable-length data.
         #   if(size) { ptr = alloca(size); goto loop; }
-        #   else *(T*)ptr
+        #   else *(T*)ret_ptr
         # }
         llprehead   = self.llbuilder.basic_block
         llhead      = self.llbuilder.append_basic_block(name="rpc.head")
@@ -1273,7 +1282,7 @@ class LLVMIRGenerator:
         self.llbuilder.branch(llhead)
 
         self.llbuilder.position_at_end(llhead)
-        llphi = self.llbuilder.phi(llslotgen.type, name="rpc.size")
+        llphi = self.llbuilder.phi(llslotgen.type, name="rpc.ptr")
         llphi.add_incoming(llslotgen, llprehead)
         if llunwindblock:
             llsize = self.llbuilder.invoke(self.llbuiltin("recv_rpc"), [llphi],
@@ -1375,6 +1384,7 @@ class LLVMIRGenerator:
         def _quote_attributes():
             llglobal = None
             llfields = []
+            emit_as_constant = True
             for attr in typ.attributes:
                 if attr == "__objectid__":
                     objectid = self.embedding_map.store_object(value)
@@ -1395,6 +1405,8 @@ class LLVMIRGenerator:
                                          not types.is_c_function(typ.attributes[attr]))
                     if is_class_function:
                         attrvalue = self.embedding_map.specialize_function(typ.instance, attrvalue)
+                    if not (types.is_instance(typ) and attr in typ.constant_attributes):
+                        emit_as_constant = False
                     llattrvalue = self._quote(attrvalue, typ.attributes[attr],
                                               lambda: path() + [attr])
                     llfields.append(llattrvalue)
@@ -1402,6 +1414,7 @@ class LLVMIRGenerator:
                         llclosureptr = self.get_global_closure_ptr(typ, attr)
                         llclosureptr.initializer = llattrvalue
 
+            llglobal.global_constant = emit_as_constant
             llglobal.initializer = ll.Constant(llty.pointee, llfields)
             llglobal.linkage = "private"
             return llglobal
diff --git a/artiq/compiler/types.py b/artiq/compiler/types.py
index e1781116e..05640b2ae 100644
--- a/artiq/compiler/types.py
+++ b/artiq/compiler/types.py
@@ -308,20 +308,22 @@ class TRPC(Type):
     :ivar ret: (:class:`Type`)
         return type
     :ivar service: (int) RPC service number
+    :ivar async: (bool) whether the RPC blocks until return
     """
 
     attributes = OrderedDict()
 
-    def __init__(self, ret, service):
+    def __init__(self, ret, service, async=False):
         assert isinstance(ret, Type)
-        self.ret, self.service = ret, service
+        self.ret, self.service, self.async = ret, service, async
 
     def find(self):
         return self
 
     def unify(self, other):
         if isinstance(other, TRPC) and \
-                self.service == other.service:
+                self.service == other.service and \
+                self.async == other.async:
             self.ret.unify(other.ret)
         elif isinstance(other, TVar):
             other.unify(self)
@@ -337,7 +339,8 @@ class TRPC(Type):
 
     def __eq__(self, other):
         return isinstance(other, TRPC) and \
-                self.service == other.service
+                self.service == other.service and \
+                self.async == other.async
 
     def __ne__(self, other):
         return not (self == other)
@@ -727,7 +730,9 @@ class TypePrinter(object):
             elif isinstance(typ, TFunction):
                 return signature
         elif isinstance(typ, TRPC):
-            return "[rpc #{}](...)->{}".format(typ.service, self.name(typ.ret, depth + 1))
+            return "[rpc{} #{}](...)->{}".format(typ.service,
+                                                 " async" if typ.async else "",
+                                                 self.name(typ.ret, depth + 1))
         elif isinstance(typ, TBuiltinFunction):
             return "<function {}>".format(typ.name)
         elif isinstance(typ, (TConstructor, TExceptionConstructor)):
diff --git a/artiq/coredevice/comm_generic.py b/artiq/coredevice/comm_generic.py
index 3163b1ba8..8afa8c096 100644
--- a/artiq/coredevice/comm_generic.py
+++ b/artiq/coredevice/comm_generic.py
@@ -141,6 +141,9 @@ class CommGeneric:
         (value, ) = struct.unpack(">d", self._read_chunk(8))
         return value
 
+    def _read_bool(self):
+        return True if self._read_int8() else False
+
     def _read_bytes(self):
         return self._read_chunk(self._read_int32())
 
@@ -177,6 +180,9 @@ class CommGeneric:
     def _write_float64(self, value):
         self.write(struct.pack(">d", value))
 
+    def _write_bool(self, value):
+        self.write(struct.pack("B", value))
+
     def _write_bytes(self, value):
         self._write_int32(len(value))
         self.write(value)
@@ -405,24 +411,29 @@ class CommGeneric:
             raise IOError("Unknown RPC value tag: {}".format(repr(tag)))
 
     def _serve_rpc(self, embedding_map):
-        service_id  = self._read_int32()
-        if service_id == 0:
-            service = lambda obj, attr, value: setattr(obj, attr, value)
-        else:
-            service = embedding_map.retrieve_object(service_id)
-
+        async        = self._read_bool()
+        service_id   = self._read_int32()
         args, kwargs = self._receive_rpc_args(embedding_map)
         return_tags  = self._read_bytes()
-        logger.debug("rpc service: [%d]%r %r %r -> %s", service_id, service, args, kwargs, return_tags)
+
+        if service_id is 0:
+            service  = lambda obj, attr, value: setattr(obj, attr, value)
+        else:
+            service  = embedding_map.retrieve_object(service_id)
+        logger.debug("rpc service: [%d]%r%s %r %r -> %s", service_id, service,
+                     (" (async)" if async else ""), args, kwargs, return_tags)
+
+        if async:
+            service(*args, **kwargs)
+            return
 
         try:
             result = service(*args, **kwargs)
-            logger.debug("rpc service: %d %r %r == %r", service_id, args, kwargs, result)
+            logger.debug("rpc service: %d %r %r = %r", service_id, args, kwargs, result)
 
-            if service_id != 0:
-                self._write_header(_H2DMsgType.RPC_REPLY)
-                self._write_bytes(return_tags)
-                self._send_rpc_value(bytearray(return_tags), result, result, service)
+            self._write_header(_H2DMsgType.RPC_REPLY)
+            self._write_bytes(return_tags)
+            self._send_rpc_value(bytearray(return_tags), result, result, service)
         except Exception as exn:
             logger.debug("rpc service: %d %r %r ! %r", service_id, args, kwargs, exn)
 
diff --git a/artiq/coredevice/core.py b/artiq/coredevice/core.py
index 8f9330287..58c2ca7a9 100644
--- a/artiq/coredevice/core.py
+++ b/artiq/coredevice/core.py
@@ -81,7 +81,7 @@ class Core:
         self.core = self
         self.comm.core = self
 
-    def compile(self, function, args, kwargs, set_result=None, with_attr_writeback=True):
+    def compile(self, function, args, kwargs, set_result=None, attribute_writeback=True):
         try:
             engine = _DiagnosticEngine(all_errors_are_fatal=True)
 
@@ -89,7 +89,9 @@ class Core:
             stitcher.stitch_call(function, args, kwargs, set_result)
             stitcher.finalize()
 
-            module = Module(stitcher, ref_period=self.ref_period)
+            module = Module(stitcher,
+                ref_period=self.ref_period,
+                attribute_writeback=attribute_writeback)
             target = OR1KTarget()
 
             library = target.compile_and_link([module])
@@ -103,6 +105,7 @@ class Core:
 
     def run(self, function, args, kwargs):
         result = None
+        @rpc(flags={"async"})
         def set_result(new_result):
             nonlocal result
             result = new_result
diff --git a/artiq/dashboard/moninj.py b/artiq/dashboard/moninj.py
index b821865b0..22c0bb963 100644
--- a/artiq/dashboard/moninj.py
+++ b/artiq/dashboard/moninj.py
@@ -23,35 +23,26 @@ _mode_enc = {
 }
 
 
-class _MoninjWidget(QtWidgets.QFrame):
-    def __init__(self):
-        QtWidgets.QFrame.__init__(self)
-        qfm = QtGui.QFontMetrics(self.font())
-        self._size = QtCore.QSize(
-            18*qfm.averageCharWidth(),
-            6*qfm.lineSpacing())
-        self.setSizePolicy(QtWidgets.QSizePolicy.Fixed, QtWidgets.QSizePolicy.Fixed)
-
-        self.setFrameShape(QtWidgets.QFrame.Box)
-        self.setFrameShadow(QtWidgets.QFrame.Raised)
-
-    def sizeHint(self):
-        return self._size
-
-
-class _TTLWidget(_MoninjWidget):
+class _TTLWidget(QtWidgets.QFrame):
     def __init__(self, channel, send_to_device, force_out, title):
+        QtWidgets.QFrame.__init__(self)
+
         self.channel = channel
         self.send_to_device = send_to_device
         self.force_out = force_out
 
-        _MoninjWidget.__init__(self)
+        self.setFrameShape(QtWidgets.QFrame.Box)
+        self.setFrameShadow(QtWidgets.QFrame.Raised)
 
         grid = QtWidgets.QGridLayout()
+        grid.setContentsMargins(0, 0, 0, 0)
+        grid.setHorizontalSpacing(0)
+        grid.setVerticalSpacing(0)
         self.setLayout(grid)
         label = QtWidgets.QLabel(title)
         label.setAlignment(QtCore.Qt.AlignCenter)
-        label.setWordWrap(True)
+        label.setSizePolicy(QtWidgets.QSizePolicy.Ignored,
+                            QtWidgets.QSizePolicy.Preferred)
         grid.addWidget(label, 1, 1)
 
         self.stack = QtWidgets.QStackedWidget()
@@ -62,9 +53,18 @@ class _TTLWidget(_MoninjWidget):
         self.stack.addWidget(self.direction)
 
         grid_cb = LayoutWidget()
-        self.override = QtWidgets.QCheckBox("Override")
+        grid_cb.layout.setContentsMargins(0, 0, 0, 0)
+        grid_cb.layout.setHorizontalSpacing(0)
+        grid_cb.layout.setVerticalSpacing(0)
+        self.override = QtWidgets.QToolButton()
+        self.override.setText("OVR")
+        self.override.setCheckable(True)
+        self.override.setToolTip("Override")
         grid_cb.addWidget(self.override, 3, 1)
-        self.level = QtWidgets.QCheckBox("Level")
+        self.level = QtWidgets.QToolButton()
+        self.level.setText("LVL")
+        self.level.setCheckable(True)
+        self.level.setToolTip("Level")
         grid_cb.addWidget(self.level, 3, 2)
         self.stack.addWidget(grid_cb)
 
@@ -78,19 +78,19 @@ class _TTLWidget(_MoninjWidget):
         grid.setRowStretch(4, 1)
 
         self.programmatic_change = False
-        self.override.stateChanged.connect(self.override_toggled)
-        self.level.stateChanged.connect(self.level_toggled)
+        self.override.clicked.connect(self.override_toggled)
+        self.level.clicked.connect(self.level_toggled)
 
         self.set_value(0, False, False)
 
     def enterEvent(self, event):
         self.stack.setCurrentIndex(1)
-        _MoninjWidget.enterEvent(self, event)
+        QtWidgets.QFrame.enterEvent(self, event)
 
     def leaveEvent(self, event):
         if not self.override.isChecked():
             self.stack.setCurrentIndex(0)
-        _MoninjWidget.leaveEvent(self, event)
+        QtWidgets.QFrame.leaveEvent(self, event)
 
     def override_toggled(self, override):
         if self.programmatic_change:
@@ -125,11 +125,11 @@ class _TTLWidget(_MoninjWidget):
             color = " color=\"red\""
         else:
             color = ""
-        self.value.setText("<font size=\"9\"{}>{}</font>".format(
+        self.value.setText("<font size=\"5\"{}>{}</font>".format(
                             color, value_s))
         oe = oe or self.force_out
         direction = "OUT" if oe else "IN"
-        self.direction.setText("<font size=\"1\">" + direction + "</font>")
+        self.direction.setText("<font size=\"2\">" + direction + "</font>")
 
         self.programmatic_change = True
         try:
@@ -144,24 +144,30 @@ class _TTLWidget(_MoninjWidget):
         return self.channel
 
 
-class _DDSWidget(_MoninjWidget):
+class _DDSWidget(QtWidgets.QFrame):
     def __init__(self, bus_channel, channel, sysclk, title):
+        QtWidgets.QFrame.__init__(self)
+
         self.bus_channel = bus_channel
         self.channel = channel
         self.sysclk = sysclk
 
-        _MoninjWidget.__init__(self)
+        self.setFrameShape(QtWidgets.QFrame.Box)
+        self.setFrameShadow(QtWidgets.QFrame.Raised)
 
         grid = QtWidgets.QGridLayout()
+        grid.setContentsMargins(0, 0, 0, 0)
+        grid.setHorizontalSpacing(0)
+        grid.setVerticalSpacing(0)
         self.setLayout(grid)
         label = QtWidgets.QLabel(title)
         label.setAlignment(QtCore.Qt.AlignCenter)
-        label.setWordWrap(True)
+        label.setSizePolicy(QtWidgets.QSizePolicy.Ignored,
+                    QtWidgets.QSizePolicy.Preferred)
         grid.addWidget(label, 1, 1)
 
         self.value = QtWidgets.QLabel()
         self.value.setAlignment(QtCore.Qt.AlignCenter)
-        self.value.setWordWrap(True)
         grid.addWidget(self.value, 2, 1, 6, 1)
 
         grid.setRowStretch(1, 1)
@@ -172,7 +178,7 @@ class _DDSWidget(_MoninjWidget):
 
     def set_value(self, ftw):
         frequency = ftw*self.sysclk()/2**32
-        self.value.setText("<font size=\"5\">{:.7f} MHz</font>"
+        self.value.setText("<font size=\"4\">{:.7f}</font><font size=\"2\"> MHz</font>"
                            .format(frequency/1e6))
 
     def sort_key(self):
diff --git a/artiq/frontend/artiq_compile.py b/artiq/frontend/artiq_compile.py
index 16d211399..ef801516c 100755
--- a/artiq/frontend/artiq_compile.py
+++ b/artiq/frontend/artiq_compile.py
@@ -55,7 +55,7 @@ def main():
 
         object_map, kernel_library, _, _ = \
             core.compile(exp.run, [exp_inst], {},
-                         with_attr_writeback=False)
+                         attribute_writeback=False)
     except CompileError as error:
         return
     finally:
diff --git a/artiq/frontend/artiq_devtool.py b/artiq/frontend/artiq_devtool.py
new file mode 100644
index 000000000..7d4d71f5a
--- /dev/null
+++ b/artiq/frontend/artiq_devtool.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python3.5
+
+# This script makes the following assumptions:
+#  * miniconda is installed remotely at ~/miniconda
+#  * misoc and artiq are installed remotely via conda
+
+import sys
+import argparse
+import subprocess
+import socket
+import select
+import threading
+import paramiko
+
+from artiq.tools import verbosity_args, init_logger, logger
+from random import Random
+
+
+def get_argparser():
+    parser = argparse.ArgumentParser(description="ARTIQ core device "
+                                                 "development tool")
+
+    verbosity_args(parser)
+
+    parser.add_argument("--host", nargs=1, metavar="HOST",
+                        type=str, default="lab.m-labs.hk",
+                        help="SSH host where the development board is located")
+    parser.add_argument("--serial", nargs=1, metavar="SERIAL",
+                        type=str, default="/dev/ttyUSB0",
+                        help="TTY device corresponding to the development board")
+    parser.add_argument("--ip", nargs=1, metavar="IP",
+                        type=str, default="kc705.lab.m-labs.hk",
+                        help="IP address corresponding to the development board")
+
+    parser.add_argument("actions", metavar="ACTION",
+                        type=str, default=[], nargs="+",
+                        help="actions to perform (sequence of: build boot connect)")
+
+    return parser
+
+
+def main():
+    args = get_argparser().parse_args()
+    init_logger(args)
+
+    ssh = None
+    def get_ssh():
+        nonlocal ssh
+        if ssh is not None:
+            return ssh
+        ssh = paramiko.SSHClient()
+        ssh.load_system_host_keys()
+        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        ssh.connect(args.host)
+        return ssh
+
+    sftp = None
+    def get_sftp():
+        nonlocal sftp
+        if sftp is not None:
+            return sftp
+        sftp = get_ssh().open_sftp()
+        return sftp
+
+    rng = Random()
+    tmp = "artiq" + "".join([rng.choice("ABCDEFGHIJKLMNOPQRSTUVWXYZ") for _ in range(6)])
+    env = "bash -c 'export PATH=$HOME/miniconda/bin:$PATH; exec $0 $*' "
+
+    def run_command(cmd):
+        logger.info("Executing {}".format(cmd))
+        chan = get_ssh().get_transport().open_session()
+        chan.set_combine_stderr(True)
+        chan.exec_command(cmd.format(tmp=tmp, env=env, serial=args.serial, ip=args.ip))
+        return chan.makefile()
+
+    def drain(chan):
+        while True:
+            char = chan.read(1)
+            if char == b"":
+                break
+            sys.stderr.write(char.decode("utf-8"))
+
+    for action in args.actions:
+        if action == "build":
+            logger.info("Building runtime")
+            try:
+                subprocess.check_call(["python3", "-m", "artiq.gateware.targets.kc705",
+                                            "-H", "nist_clock",
+                                            "--no-compile-gateware",
+                                            "--output-dir", "/tmp/kc705"])
+            except subprocess.CalledProcessError:
+                logger.error("Build failed")
+                sys.exit(1)
+
+        elif action == "boot":
+            logger.info("Uploading runtime")
+            get_sftp().mkdir("/tmp/{tmp}".format(tmp=tmp))
+            get_sftp().put("/tmp/kc705/software/runtime/runtime.bin",
+                           "/tmp/{tmp}/runtime.bin".format(tmp=tmp))
+
+            logger.info("Booting runtime")
+            flterm = run_command(
+                "{env} python3 flterm.py {serial} " +
+                "--kernel /tmp/{tmp}/runtime.bin --upload-only")
+            artiq_flash = run_command(
+                "{env} artiq_flash start")
+            drain(flterm)
+
+        elif action == "connect":
+            def forwarder(port):
+                listener = socket.socket()
+                listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                listener.bind(('localhost', port))
+                listener.listen(1)
+                while True:
+                    local_stream, peer_addr = listener.accept()
+                    logger.info("Accepting %s:%s and opening SSH channel to %s:%s",
+                                *peer_addr, args.ip, port)
+                    remote_stream = get_ssh().get_transport() \
+                        .open_channel('direct-tcpip', (args.ip, port), peer_addr)
+                    while True:
+                        try:
+                            r, w, x = select.select([local_stream, remote_stream], [], [])
+                            if local_stream in r:
+                                data = local_stream.recv(1024)
+                                if data == b"":
+                                    break
+                                remote_stream.send(data)
+                            if remote_stream in r:
+                                data = remote_stream.recv(1024)
+                                if data == b"":
+                                    break
+                                local_stream.send(data)
+                        except Exception as e:
+                            logger.exception("Forward error on port %s", port)
+                    local_stream.close()
+                    remote_stream.close()
+
+            for port in (1381, 1382):
+                thread = threading.Thread(target=forwarder, args=(port,),
+                                          name="port-{}".format(port), daemon=True)
+                thread.start()
+
+            logger.info("Connecting to device")
+            flterm = run_command(
+                "{env} python3 flterm.py {serial} --output-only")
+            drain(flterm)
+
+        else:
+            logger.error("Unknown action {}".format(action))
+            sys.exit(1)
+
+if __name__ == "__main__":
+    main()
diff --git a/artiq/frontend/artiq_run.py b/artiq/frontend/artiq_run.py
index 4972a5cd7..004171a0f 100755
--- a/artiq/frontend/artiq_run.py
+++ b/artiq/frontend/artiq_run.py
@@ -73,8 +73,7 @@ class LLVMIRRunner(FileRunner):
         with open(self.file, "r") as f:
             llmodule = llvm.parse_assembly(f.read())
         llmodule.verify()
-        return self.target.link([self.target.assemble(llmodule)],
-                                init_fn="__modinit__")
+        return self.target.link([self.target.assemble(llmodule)])
 
 
 class LLVMBitcodeRunner(FileRunner):
@@ -82,8 +81,7 @@ class LLVMBitcodeRunner(FileRunner):
         with open(self.file, "rb") as f:
             llmodule = llvm.parse_bitcode(f.read())
         llmodule.verify()
-        return self.target.link([self.target.assemble(llmodule)],
-                                init_fn="__modinit__")
+        return self.target.link([self.target.assemble(llmodule)])
 
 
 class DummyScheduler:
diff --git a/artiq/gateware/amp/kernel_cpu.py b/artiq/gateware/amp/kernel_cpu.py
index 2736027e3..6aca00d32 100644
--- a/artiq/gateware/amp/kernel_cpu.py
+++ b/artiq/gateware/amp/kernel_cpu.py
@@ -7,7 +7,7 @@ from misoc.integration.soc_core import mem_decoder
 
 class KernelCPU(Module):
     def __init__(self, platform,
-                 exec_address=0x40400000,
+                 exec_address=0x40800000,
                  main_mem_origin=0x40000000,
                  l2_size=8192):
         self._reset = CSRStorage(reset=1)
diff --git a/artiq/gateware/amp/mailbox.py b/artiq/gateware/amp/mailbox.py
index 6f4a8987f..7c60056d1 100644
--- a/artiq/gateware/amp/mailbox.py
+++ b/artiq/gateware/amp/mailbox.py
@@ -12,10 +12,10 @@ class Mailbox(Module):
         values = Array([Signal(32) for _ in range(size)])
         for i in self.i1, self.i2:
             self.sync += [
-                i.dat_r.eq(values[i.adr]),
+                i.dat_r.eq(values[i.adr[:bits_for(size-1)]]),
                 i.ack.eq(0),
                 If(i.cyc & i.stb & ~i.ack,
                     i.ack.eq(1),
-                    If(i.we, values[i.adr].eq(i.dat_w))
+                    If(i.we, values[i.adr[:bits_for(size-1)]].eq(i.dat_w))
                 )
             ]
diff --git a/artiq/gateware/rtio/core.py b/artiq/gateware/rtio/core.py
index 69babebac..a248632da 100644
--- a/artiq/gateware/rtio/core.py
+++ b/artiq/gateware/rtio/core.py
@@ -24,10 +24,8 @@ class _GrayCodeTransfer(Module):
         self.sync.rtio += value_gray_rtio.eq(self.i ^ self.i[1:])
         # transfer to system clock domain
         value_gray_sys = Signal(width)
-        self.specials += [
-            NoRetiming(value_gray_rtio),
-            MultiReg(value_gray_rtio, value_gray_sys)
-        ]
+        value_gray_rtio.attr.add("no_retiming")
+        self.specials += MultiReg(value_gray_rtio, value_gray_sys)
         # convert back to binary
         value_sys = Signal(width)
         self.comb += value_sys[-1].eq(value_gray_sys[-1])
diff --git a/artiq/gateware/targets/kc705.py b/artiq/gateware/targets/kc705.py
index 0e1e33c16..b8c73d825 100755
--- a/artiq/gateware/targets/kc705.py
+++ b/artiq/gateware/targets/kc705.py
@@ -8,7 +8,6 @@ from migen.genlib.cdc import MultiReg
 from migen.build.generic_platform import *
 from migen.build.xilinx.vivado import XilinxVivadoToolchain
 from migen.build.xilinx.ise import XilinxISEToolchain
-from migen.fhdl.specials import Keep
 from migen.genlib.io import DifferentialInput
 
 from jesd204b.common import (JESD204BTransportSettings,
@@ -149,10 +148,10 @@ class _NIST_Ions(MiniSoC, AMPSoC):
         self.register_kernel_cpu_csrdevice("i2c")
         self.config["I2C_BUS_COUNT"] = 1
 
-    def add_rtio(self, rtio_channels, rtio_crg=None):
-        if rtio_crg is None:
-            rtio_crg = _RTIOCRG(self.platform, self.crg.cd_sys.clk)
-        self.submodules.rtio_crg = rtio_crg
+        self.config["HAS_DDS"] = None
+
+    def add_rtio(self, rtio_channels):
+        self.submodules.rtio_crg = _RTIOCRG(self.platform, self.crg.cd_sys.clk)
         self.csr_devices.append("rtio_crg")
         self.submodules.rtio = rtio.RTIO(rtio_channels)
         self.register_kernel_cpu_csrdevice("rtio")
@@ -160,22 +159,11 @@ class _NIST_Ions(MiniSoC, AMPSoC):
         self.submodules.rtio_moninj = rtio.MonInj(rtio_channels)
         self.csr_devices.append("rtio_moninj")
 
-        self.specials += [
-            Keep(self.rtio.cd_rsys.clk),
-            Keep(self.rtio_crg.cd_rtio.clk),
-            Keep(self.ethphy.crg.cd_eth_rx.clk),
-            Keep(self.ethphy.crg.cd_eth_tx.clk),
-        ]
-
-        self.platform.add_period_constraint(self.rtio.cd_rsys.clk, 8.)
+        self.rtio_crg.cd_rtio.clk.attr.add("keep")
         self.platform.add_period_constraint(self.rtio_crg.cd_rtio.clk, 8.)
-        self.platform.add_period_constraint(self.ethphy.crg.cd_eth_rx.clk, 8.)
-        self.platform.add_period_constraint(self.ethphy.crg.cd_eth_tx.clk, 8.)
         self.platform.add_false_path_constraints(
-            self.rtio.cd_rsys.clk,
-            self.rtio_crg.cd_rtio.clk,
-            self.ethphy.crg.cd_eth_rx.clk,
-            self.ethphy.crg.cd_eth_tx.clk)
+            self.crg.cd_sys.clk,
+            self.rtio_crg.cd_rtio.clk)
 
         self.submodules.rtio_analyzer = rtio.Analyzer(self.rtio,
             self.get_native_sdram_if())
@@ -223,7 +211,7 @@ class NIST_QC1(_NIST_Ions):
         self.config["RTIO_FIRST_DDS_CHANNEL"] = len(rtio_channels)
         self.config["RTIO_DDS_COUNT"] = 1
         self.config["DDS_CHANNELS_PER_BUS"] = 8
-        self.config["DDS_AD9858"] = True
+        self.config["DDS_AD9858"] = None
         phy = dds.AD9858(platform.request("dds"), 8)
         self.submodules += phy
         rtio_channels.append(rtio.Channel.from_phy(phy,
@@ -297,8 +285,8 @@ class NIST_CLOCK(_NIST_Ions):
         self.config["RTIO_FIRST_DDS_CHANNEL"] = len(rtio_channels)
         self.config["RTIO_DDS_COUNT"] = 1
         self.config["DDS_CHANNELS_PER_BUS"] = 11
-        self.config["DDS_AD9914"] = True
-        self.config["DDS_ONEHOT_SEL"] = True
+        self.config["DDS_AD9914"] = None
+        self.config["DDS_ONEHOT_SEL"] = None
         phy = dds.AD9914(platform.request("dds"), 11, onehot=True)
         self.submodules += phy
         rtio_channels.append(rtio.Channel.from_phy(phy,
@@ -375,8 +363,8 @@ class NIST_QC2(_NIST_Ions):
         self.config["RTIO_FIRST_DDS_CHANNEL"] = len(rtio_channels)
         self.config["RTIO_DDS_COUNT"] = 2
         self.config["DDS_CHANNELS_PER_BUS"] = 12
-        self.config["DDS_AD9914"] = True
-        self.config["DDS_ONEHOT_SEL"] = True
+        self.config["DDS_AD9914"] = None
+        self.config["DDS_ONEHOT_SEL"] = None
         for backplane_offset in range(2):
             phy = dds.AD9914(
                 platform.request("dds", backplane_offset), 12, onehot=True)
@@ -394,11 +382,10 @@ class NIST_QC2(_NIST_Ions):
 
 
 class _PhaserCRG(Module, AutoCSR):
-    def __init__(self, platform, rtio_internal_clk):
+    def __init__(self, platform, refclk):
         self._clock_sel = CSRStorage()
         self._pll_reset = CSRStorage(reset=1)
         self._pll_locked = CSRStatus()
-        self.refclk = Signal()
         self.clock_domains.cd_rtio = ClockDomain()
         self.clock_domains.cd_rtiox4 = ClockDomain(reset_less=True)
 
@@ -411,7 +398,7 @@ class _PhaserCRG(Module, AutoCSR):
 
                      p_REF_JITTER1=0.01, p_REF_JITTER2=0.01,
                      p_CLKIN1_PERIOD=4.0, p_CLKIN2_PERIOD=4.0,
-                     i_CLKIN1=0, i_CLKIN2=self.refclk,
+                     i_CLKIN1=0, i_CLKIN2=refclk,
                      # Warning: CLKINSEL=0 means CLKIN2 is selected
                      i_CLKINSEL=~self._clock_sel.storage,
 
@@ -431,6 +418,8 @@ class _PhaserCRG(Module, AutoCSR):
             MultiReg(pll_locked | ~self._clock_sel.storage,
                      self._pll_locked.status)
         ]
+        self.cd_rtio.clk.attr.add("keep")
+        platform.add_period_constraint(self.cd_rtio.clk, 8.)
 
 
 class AD9154JESD(Module, AutoCSR):
@@ -444,28 +433,29 @@ class AD9154JESD(Module, AutoCSR):
 
         sync_pads = platform.request("ad9154_sync")
         self.jsync = Signal()
-        self.refclk = Signal()
         self.specials += DifferentialInput(
             sync_pads.p, sync_pads.n, self.jsync)
 
+        refclk = Signal()
         self.clock_domains.cd_jesd = ClockDomain()
         refclk_pads = platform.request("ad9154_refclk")
-        platform.add_period_constraint(refclk_pads.p, 1e9/refclk_freq)
 
         self.specials += [
             Instance("IBUFDS_GTE2", i_CEB=0,
-                     i_I=refclk_pads.p, i_IB=refclk_pads.n, o_O=self.refclk),
-            Instance("BUFG", i_I=self.refclk, o_O=self.cd_jesd.clk),
+                     i_I=refclk_pads.p, i_IB=refclk_pads.n, o_O=refclk),
+            Instance("BUFG", i_I=refclk, o_O=self.cd_jesd.clk),
             AsyncResetSynchronizer(self.cd_jesd, ResetSignal("rio_phy")),
         ]
+        self.cd_jesd.clk.attr.add("keep")
         platform.add_period_constraint(self.cd_jesd.clk, 1e9/refclk_freq)
 
-        qpll = GTXQuadPLL(self.refclk, refclk_freq, linerate)
+        qpll = GTXQuadPLL(refclk, refclk_freq, linerate)
         self.submodules += qpll
         phys = []
         for i in range(4):
             phy = JESD204BPhyTX(
                 qpll, platform.request("ad9154_jesd", i), fabric_freq)
+            phy.gtx.cd_tx.clk.attr.add("keep")
             platform.add_period_constraint(phy.gtx.cd_tx.clk, 40*1e9/linerate)
             platform.add_false_path_constraints(self.cd_jesd.clk,
                                                 phy.gtx.cd_tx.clk)
@@ -484,16 +474,15 @@ class AD9154JESD(Module, AutoCSR):
 
         # blinking leds for transceiver reset status
         for i in range(4):
-            led = platform.request("user_led", 4 + i)
-            counter = Signal(max=fabric_freq//2 + 1)
+            counter = Signal(max=fabric_freq)
+            self.comb += platform.request("user_led", 4 + i).eq(counter[-1])
             sync = getattr(self.sync, "phy{}_tx".format(i))
-            sync += \
+            sync += [
+                counter.eq(counter - 1),
                 If(counter == 0,
-                    led.eq(~led),
-                    counter.eq(fabric_freq//2)
-                ).Else(
-                    counter.eq(counter - 1)
+                    counter.eq(fabric_freq - 1)
                 )
+            ]
 
 
 class AD9154(Module, AutoCSR):
@@ -517,18 +506,43 @@ class AD9154(Module, AutoCSR):
             self.sync.jesd += conv.eq(Mux(z, Cat(ch.o[:2]), Cat(ch.o[2:])))
 
 
-class Phaser(_NIST_Ions):
+class Phaser(MiniSoC, AMPSoC):
     mem_map = {
-        "ad9154":   0x50000000,
+        "timer_kernel":  0x10000000, # (shadow @0x90000000)
+        "rtio":          0x20000000, # (shadow @0xa0000000)
+        "i2c":           0x30000000, # (shadow @0xb0000000)
+        "mailbox":       0x70000000, # (shadow @0xf0000000)
+        "ad9154":        0x50000000,
     }
-    mem_map.update(_NIST_Ions.mem_map)
+    mem_map.update(MiniSoC.mem_map)
 
     def __init__(self, cpu_type="or1k", **kwargs):
-        _NIST_Ions.__init__(self, cpu_type, **kwargs)
+        MiniSoC.__init__(self,
+                         cpu_type=cpu_type,
+                         sdram_controller_type="minicon",
+                         l2_size=128*1024,
+                         with_timer=False,
+                         ident=artiq_version,
+                         **kwargs)
+        AMPSoC.__init__(self)
+        self.platform.toolchain.bitstream_commands.extend([
+            "set_property BITSTREAM.GENERAL.COMPRESS True [current_design]",
+        ])
 
         platform = self.platform
+        platform.add_extension(_ams101_dac)
         platform.add_extension(phaser.fmc_adapter_io)
 
+        self.submodules.leds = gpio.GPIOOut(Cat(
+            platform.request("user_led", 0),
+            platform.request("user_led", 1)))
+        self.csr_devices.append("leds")
+
+        i2c = platform.request("i2c")
+        self.submodules.i2c = gpio.GPIOTristate([i2c.scl, i2c.sda])
+        self.register_kernel_cpu_csrdevice("i2c")
+        self.config["I2C_BUS_COUNT"] = 1
+
         self.submodules.ad9154 = AD9154(platform)
         self.register_kernel_cpu_csrdevice("ad9154")
         self.config["AD9154_DAC_CS"] = 1 << 0
@@ -566,17 +580,25 @@ class Phaser(_NIST_Ions):
         self.config["RTIO_LOG_CHANNEL"] = len(rtio_channels)
         rtio_channels.append(rtio.LogChannel())
 
-        # FIXME: dummy
         self.config["RTIO_FIRST_DDS_CHANNEL"] = 0
         self.config["RTIO_DDS_COUNT"] = 1
         self.config["DDS_CHANNELS_PER_BUS"] = 1
-        self.config["DDS_AD9914"] = True
-        self.config["DDS_ONEHOT_SEL"] = True
-        self.config["DDS_RTIO_CLK_RATIO"] = 3
+        self.config["DDS_ONEHOT_SEL"] = 1
+        self.config["DDS_RTIO_CLK_RATIO"] = 8
 
-        self.add_rtio(rtio_channels, _PhaserCRG(platform, self.crg.cd_sys.clk))
+        self.submodules.rtio_crg = _PhaserCRG(platform, self.ad9154.jesd.cd_jesd.clk)
+        self.csr_devices.append("rtio_crg")
+        self.submodules.rtio = rtio.RTIO(rtio_channels)
+        self.register_kernel_cpu_csrdevice("rtio")
+        self.submodules.rtio_moninj = rtio.MonInj(rtio_channels)
+        self.csr_devices.append("rtio_moninj")
+        self.submodules.rtio_analyzer = rtio.Analyzer(self.rtio,
+            self.get_native_sdram_if())
+        self.csr_devices.append("rtio_analyzer")
 
-        self.comb += self.rtio_crg.refclk.eq(self.ad9154.jesd.cd_jesd.clk)
+        platform.add_false_path_constraints(
+            self.crg.cd_sys.clk,
+            self.rtio_crg.cd_rtio.clk)
 
 
 def main():
diff --git a/artiq/gateware/targets/pipistrello.py b/artiq/gateware/targets/pipistrello.py
index f9afa683b..a0a5f0134 100755
--- a/artiq/gateware/targets/pipistrello.py
+++ b/artiq/gateware/targets/pipistrello.py
@@ -206,10 +206,11 @@ trce -v 12 -fastpaths -tsi {build_name}.tsi -o {build_name}.twr {build_name}.ncd
         rtio_channels.append(rtio.Channel.from_phy(
             phy, ofifo_depth=64, ififo_depth=64))
 
+        self.config["HAS_DDS"] = None
         self.config["RTIO_FIRST_DDS_CHANNEL"] = len(rtio_channels)
         self.config["RTIO_DDS_COUNT"] = 1
         self.config["DDS_CHANNELS_PER_BUS"] = 8
-        self.config["DDS_AD9858"] = True
+        self.config["DDS_AD9858"] = None
         dds_pins = platform.request("dds")
         self.comb += dds_pins.p.eq(0)
         phy = dds.AD9858(dds_pins, 8)
diff --git a/artiq/language/core.py b/artiq/language/core.py
index b08da2147..c1c19c802 100644
--- a/artiq/language/core.py
+++ b/artiq/language/core.py
@@ -7,7 +7,7 @@ from functools import wraps
 import numpy
 
 
-__all__ = ["kernel", "portable", "syscall", "host_only",
+__all__ = ["kernel", "portable", "rpc", "syscall", "host_only",
            "set_time_manager", "set_watchdog_factory",
            "TerminationRequested"]
 
@@ -22,7 +22,7 @@ __all__.extend(kernel_globals)
 
 
 _ARTIQEmbeddedInfo = namedtuple("_ARTIQEmbeddedInfo",
-                                "core_name function syscall forbidden flags")
+                                "core_name portable function syscall forbidden flags")
 
 def kernel(arg=None, flags={}):
     """
@@ -53,7 +53,7 @@ def kernel(arg=None, flags={}):
             def run_on_core(self, *k_args, **k_kwargs):
                 return getattr(self, arg).run(run_on_core, ((self,) + k_args), k_kwargs)
             run_on_core.artiq_embedded = _ARTIQEmbeddedInfo(
-                core_name=arg, function=function, syscall=None,
+                core_name=arg, portable=False, function=function, syscall=None,
                 forbidden=False, flags=set(flags))
             return run_on_core
         return inner_decorator
@@ -83,7 +83,23 @@ def portable(arg=None, flags={}):
         return inner_decorator
     else:
         arg.artiq_embedded = \
-            _ARTIQEmbeddedInfo(core_name=None, function=arg, syscall=None,
+            _ARTIQEmbeddedInfo(core_name=None, portable=True, function=arg, syscall=None,
+                               forbidden=False, flags=set(flags))
+        return arg
+
+def rpc(arg=None, flags={}):
+    """
+    This decorator marks a function for execution on the host interpreter.
+    This is also the default behavior of ARTIQ; however, this decorator allows
+    specifying additional flags.
+    """
+    if arg is None:
+        def inner_decorator(function):
+            return rpc(function, flags)
+        return inner_decorator
+    else:
+        arg.artiq_embedded = \
+            _ARTIQEmbeddedInfo(core_name=None, portable=False, function=arg, syscall=None,
                                forbidden=False, flags=set(flags))
         return arg
 
@@ -101,7 +117,7 @@ def syscall(arg=None, flags={}):
     if isinstance(arg, str):
         def inner_decorator(function):
             function.artiq_embedded = \
-                _ARTIQEmbeddedInfo(core_name=None, function=None,
+                _ARTIQEmbeddedInfo(core_name=None, portable=False, function=None,
                                    syscall=function.__name__, forbidden=False,
                                    flags=set(flags))
             return function
@@ -119,7 +135,7 @@ def host_only(function):
     in the host Python interpreter.
     """
     function.artiq_embedded = \
-        _ARTIQEmbeddedInfo(core_name=None, function=None, syscall=None,
+        _ARTIQEmbeddedInfo(core_name=None, portable=False, function=None, syscall=None,
                            forbidden=True, flags={})
     return function
 
diff --git a/artiq/language/environment.py b/artiq/language/environment.py
index 822279e48..626af2550 100644
--- a/artiq/language/environment.py
+++ b/artiq/language/environment.py
@@ -3,6 +3,7 @@ from inspect import isclass
 
 from artiq.protocols import pyon
 from artiq.language import units
+from artiq.language.core import rpc
 
 
 __all__ = ["NoDefault",
@@ -274,6 +275,7 @@ class HasEnvironment:
         kernel_invariants = getattr(self, "kernel_invariants", set())
         self.kernel_invariants = kernel_invariants | {key}
 
+    @rpc(flags={"async"})
     def set_dataset(self, key, value,
                     broadcast=False, persist=False, save=True):
         """Sets the contents and handling modes of a dataset.
@@ -290,6 +292,7 @@ class HasEnvironment:
         """
         self.__dataset_mgr.set(key, value, broadcast, persist, save)
 
+    @rpc(flags={"async"})
     def mutate_dataset(self, key, index, value):
         """Mutate an existing dataset at the given index (e.g. set a value at
         a given position in a NumPy array)
diff --git a/artiq/runtime.rs/Cargo.toml b/artiq/runtime.rs/Cargo.toml
index 29d415a15..5a459d204 100644
--- a/artiq/runtime.rs/Cargo.toml
+++ b/artiq/runtime.rs/Cargo.toml
@@ -13,7 +13,7 @@ crate-type = ["staticlib"]
 path = "src/lib.rs"
 
 [dependencies]
-std_artiq = { path = "libstd_artiq" }
+std_artiq = { path = "libstd_artiq", features = ["alloc"] }
 lwip = { path = "liblwip", default-features = false }
 fringe = { version = "= 1.1.0", default-features = false, features = ["alloc"] }
 log = { version = "0.3", default-features = false, features = ["max_level_debug"] }
diff --git a/artiq/runtime.rs/libksupport/Cargo.lock b/artiq/runtime.rs/libksupport/Cargo.lock
index da7d2b081..df5a6a1bb 100644
--- a/artiq/runtime.rs/libksupport/Cargo.lock
+++ b/artiq/runtime.rs/libksupport/Cargo.lock
@@ -1,4 +1,26 @@
 [root]
 name = "ksupport"
 version = "0.0.0"
+dependencies = [
+ "byteorder 0.5.3 (registry+https://github.com/rust-lang/crates.io-index)",
+ "std_artiq 0.0.0",
+]
 
+[[package]]
+name = "alloc_artiq"
+version = "0.0.0"
+
+[[package]]
+name = "byteorder"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "std_artiq"
+version = "0.0.0"
+dependencies = [
+ "alloc_artiq 0.0.0",
+]
+
+[metadata]
+"checksum byteorder 0.5.3 (registry+https://github.com/rust-lang/crates.io-index)" = "0fc10e8cc6b2580fda3f36eb6dc5316657f812a3df879a44a66fc9f0fdbc4855"
diff --git a/artiq/runtime.rs/libksupport/Cargo.toml b/artiq/runtime.rs/libksupport/Cargo.toml
index e5a29ff08..9ba7d5f65 100644
--- a/artiq/runtime.rs/libksupport/Cargo.toml
+++ b/artiq/runtime.rs/libksupport/Cargo.toml
@@ -8,6 +8,10 @@ name = "ksupport"
 path = "lib.rs"
 crate-type = ["staticlib"]
 
+[dependencies]
+std_artiq = { path = "../libstd_artiq" }
+byteorder = { version = "0.5", default-features = false }
+
 [profile.dev]
 panic = 'unwind'
 opt-level = 2
diff --git a/artiq/runtime.rs/libksupport/api.rs b/artiq/runtime.rs/libksupport/api.rs
index 4670a20ea..c1899deac 100644
--- a/artiq/runtime.rs/libksupport/api.rs
+++ b/artiq/runtime.rs/libksupport/api.rs
@@ -74,7 +74,7 @@ static mut API: &'static [(&'static str, *const ())] = &[
 
     /* libm */
     api!(sqrt),
-    api!(lround),
+    api!(round),
 
     /* exceptions */
     api!(_Unwind_Resume),
@@ -91,6 +91,7 @@ static mut API: &'static [(&'static str, *const ())] = &[
     api!(watchdog_clear = ::watchdog_clear),
 
     api!(send_rpc = ::send_rpc),
+    api!(send_async_rpc = ::send_async_rpc),
     api!(recv_rpc = ::recv_rpc),
 
     api!(cache_get = ::cache_get),
@@ -104,13 +105,16 @@ static mut API: &'static [(&'static str, *const ())] = &[
     api!(rtio_input_timestamp),
     api!(rtio_input_data),
 
-// #if ((defined CONFIG_RTIO_DDS_COUNT) && (CONFIG_RTIO_DDS_COUNT > 0))
+    #[cfg(has_dds)]
     api!(dds_init),
+    #[cfg(has_dds)]
     api!(dds_init_sync),
+    #[cfg(has_dds)]
     api!(dds_batch_enter),
+    #[cfg(has_dds)]
     api!(dds_batch_exit),
+    #[cfg(has_dds)]
     api!(dds_set),
-// #endif
 
     api!(i2c_init),
     api!(i2c_start),
diff --git a/artiq/runtime.rs/libksupport/dyld.rs b/artiq/runtime.rs/libksupport/dyld.rs
index c25f7daea..c73653a19 100644
--- a/artiq/runtime.rs/libksupport/dyld.rs
+++ b/artiq/runtime.rs/libksupport/dyld.rs
@@ -1,5 +1,4 @@
 use core::{ptr, slice, str};
-use core::slice::SliceExt;
 use libc::{c_void, c_char, c_int, size_t};
 
 #[allow(non_camel_case_types)]
diff --git a/artiq/runtime.rs/libksupport/lib.rs b/artiq/runtime.rs/libksupport/lib.rs
index 5b12c360e..7e4d66b59 100644
--- a/artiq/runtime.rs/libksupport/lib.rs
+++ b/artiq/runtime.rs/libksupport/lib.rs
@@ -1,25 +1,49 @@
-#![feature(lang_items, needs_panic_runtime, asm, libc, core_slice_ext)]
+#![feature(lang_items, needs_panic_runtime, asm, libc, stmt_expr_attributes)]
 
 #![no_std]
 #![needs_panic_runtime]
 
+#[macro_use]
+extern crate std_artiq as std;
 extern crate libc;
+extern crate byteorder;
 
 #[path = "../src/board.rs"]
 mod board;
 #[path = "../src/mailbox.rs"]
 mod mailbox;
+
+#[path = "../src/proto.rs"]
+mod proto;
 #[path = "../src/kernel_proto.rs"]
 mod kernel_proto;
+#[path = "../src/rpc_proto.rs"]
+mod rpc_proto;
 
 mod dyld;
 mod api;
 
 use core::{mem, ptr, slice, str};
+use std::io::Cursor;
 use libc::{c_char, size_t};
 use kernel_proto::*;
 use dyld::Library;
 
+#[no_mangle]
+pub extern "C" fn malloc(_size: usize) -> *mut libc::c_void {
+    unimplemented!()
+}
+
+#[no_mangle]
+pub extern "C" fn realloc(_ptr: *mut libc::c_void, _size: usize) -> *mut libc::c_void {
+    unimplemented!()
+}
+
+#[no_mangle]
+pub extern "C" fn free(_ptr: *mut libc::c_void) {
+    unimplemented!()
+}
+
 fn send(request: &Message) {
     unsafe { mailbox::send(request as *const _ as usize) }
     while !mailbox::acknowledged() {}
@@ -46,7 +70,7 @@ macro_rules! recv {
 }
 
 macro_rules! print {
-    ($($arg:tt)*) => ($crate::send(&Log(format_args!($($arg)*))));
+    ($($arg:tt)*) => ($crate::send(&$crate::kernel_proto::Log(format_args!($($arg)*))));
 }
 
 macro_rules! println {
@@ -54,6 +78,9 @@ macro_rules! println {
     ($fmt:expr, $($arg:tt)*) => (print!(concat!($fmt, "\n"), $($arg)*));
 }
 
+#[path = "../src/rpc_queue.rs"]
+mod rpc_queue;
+
 #[lang = "panic_fmt"]
 extern fn panic_fmt(args: core::fmt::Arguments, file: &'static str, line: u32) -> ! {
     println!("panic at {}:{}: {}", file, line, args);
@@ -80,14 +107,40 @@ extern fn send_rpc(service: u32, tag: *const u8, data: *const *const ()) {
     extern { fn strlen(s: *const c_char) -> size_t; }
     let tag = unsafe { slice::from_raw_parts(tag, strlen(tag as *const c_char)) };
 
+    while !rpc_queue::empty() {}
     send(&RpcSend {
-        service: service as u32,
-        batch:   service == 0,
+        async:   false,
+        service: service,
         tag:     tag,
         data:    data
     })
 }
 
+extern fn send_async_rpc(service: u32, tag: *const u8, data: *const *const ()) {
+    extern { fn strlen(s: *const c_char) -> size_t; }
+    let tag = unsafe { slice::from_raw_parts(tag, strlen(tag as *const c_char)) };
+
+    while rpc_queue::full() {}
+    rpc_queue::enqueue(|mut slice| {
+        let length = {
+            let mut writer = Cursor::new(&mut slice[4..]);
+            try!(rpc_proto::send_args(&mut writer, service, tag, data));
+            writer.position()
+        };
+        proto::write_u32(&mut slice, length as u32)
+    }).unwrap_or_else(|err| {
+        assert!(err.kind() == std::io::ErrorKind::WriteZero);
+
+        while !rpc_queue::empty() {}
+        send(&RpcSend {
+            async:   true,
+            service: service,
+            tag:     tag,
+            data:    data
+        })
+    })
+}
+
 extern fn recv_rpc(slot: *mut ()) -> usize {
     send(&RpcRecvRequest(slot));
     recv!(&RpcRecvReply(ref result) => {
@@ -206,7 +259,7 @@ unsafe fn attribute_writeback(typeinfo: *const ()) {
                 attributes = attributes.offset(1);
 
                 if !(*attribute).tag.is_null() {
-                    send_rpc(0, (*attribute).tag, [
+                    send_async_rpc(0, (*attribute).tag, [
                         &object as *const _ as *const (),
                         &(*attribute).name as *const _ as *const (),
                         (object as usize + (*attribute).offset) as *const ()
diff --git a/artiq/runtime.rs/liblwip-sys/lib.rs b/artiq/runtime.rs/liblwip-sys/lib.rs
index 82a7c5bcf..912b7c381 100644
--- a/artiq/runtime.rs/liblwip-sys/lib.rs
+++ b/artiq/runtime.rs/liblwip-sys/lib.rs
@@ -149,6 +149,7 @@ extern {
     // nonstandard
     pub fn tcp_sndbuf_(pcb: *mut tcp_pcb) -> u16;
     pub fn tcp_so_options_(pcb: *mut tcp_pcb) -> *mut u8;
+    pub fn tcp_nagle_disable_(pcb: *mut tcp_pcb);
 
     pub fn udp_new() -> *mut udp_pcb;
     pub fn udp_new_ip_type(type_: ip_addr_type) -> *mut udp_pcb;
diff --git a/artiq/runtime.rs/liblwip/Cargo.toml b/artiq/runtime.rs/liblwip/Cargo.toml
index 886f69415..8d00166eb 100644
--- a/artiq/runtime.rs/liblwip/Cargo.toml
+++ b/artiq/runtime.rs/liblwip/Cargo.toml
@@ -9,7 +9,7 @@ path = "lib.rs"
 
 [dependencies]
 lwip-sys = { path = "../liblwip-sys" }
-std_artiq = { path = "../libstd_artiq" }
+std_artiq = { path = "../libstd_artiq", features = ["alloc"] }
 
 [features]
 default = ["preemption"]
diff --git a/artiq/runtime.rs/liblwip/lib.rs b/artiq/runtime.rs/liblwip/lib.rs
index f94b65dac..7eed9497b 100644
--- a/artiq/runtime.rs/liblwip/lib.rs
+++ b/artiq/runtime.rs/liblwip/lib.rs
@@ -549,6 +549,7 @@ impl TcpStream {
             lwip_sys::tcp_recv(raw, Some(recv));
             lwip_sys::tcp_sent(raw, Some(sent));
             lwip_sys::tcp_err(raw, Some(err));
+            lwip_sys::tcp_nagle_disable_(raw);
             TcpStream { raw: raw, state: state }
         }
     }
diff --git a/artiq/runtime.rs/libstd_artiq/Cargo.toml b/artiq/runtime.rs/libstd_artiq/Cargo.toml
index dfd38df4a..a6435b1f5 100644
--- a/artiq/runtime.rs/libstd_artiq/Cargo.toml
+++ b/artiq/runtime.rs/libstd_artiq/Cargo.toml
@@ -9,3 +9,6 @@ path = "lib.rs"
 
 [dependencies]
 alloc_artiq = { path = "../liballoc_artiq" }
+
+[features]
+alloc = []
diff --git a/artiq/runtime.rs/libstd_artiq/io/error.rs b/artiq/runtime.rs/libstd_artiq/io/error.rs
index f8684a4ec..37ecc4507 100644
--- a/artiq/runtime.rs/libstd_artiq/io/error.rs
+++ b/artiq/runtime.rs/libstd_artiq/io/error.rs
@@ -8,7 +8,8 @@
 // option. This file may not be copied, modified, or distributed
 // except according to those terms.
 
- use alloc::boxed::Box;
+#[cfg(feature="alloc")] use alloc::boxed::Box;
+#[cfg(not(feature="alloc"))] use ::FakeBox as Box;
 use core::convert::Into;
 use core::fmt;
 use core::marker::{Send, Sync};
@@ -62,13 +63,19 @@ pub struct Error {
 enum Repr {
     Os(i32),
 
+    #[cfg(feature="alloc")]
     Custom(Box<Custom>),
+    #[cfg(not(feature="alloc"))]
+    Custom(Custom),
 }
 
 #[derive(Debug)]
 struct Custom {
     kind: ErrorKind,
+    #[cfg(feature="alloc")]
     error: Box<error::Error+Send+Sync>,
+    #[cfg(not(feature="alloc"))]
+    error: &'static str
 }
 
 /// A list specifying general categories of I/O error.
@@ -162,12 +169,21 @@ impl Error {
     /// // errors can also be created from other errors
     /// let custom_error2 = Error::new(ErrorKind::Interrupted, custom_error);
     /// ```
+    #[cfg(feature="alloc")]
     pub fn new<E>(kind: ErrorKind, error: E) -> Error
         where E: Into<Box<error::Error+Send+Sync>>
     {
         Self::_new(kind, error.into())
     }
 
+    #[cfg(not(feature="alloc"))]
+    pub fn new<E>(kind: ErrorKind, error: E) -> Error
+        where E: Into<&'static str>
+    {
+        Self::_new(kind, error.into())
+    }
+
+    #[cfg(feature="alloc")]
     fn _new(kind: ErrorKind, error: Box<error::Error+Send+Sync>) -> Error {
         Error {
             repr: Repr::Custom(Box::new(Custom {
@@ -177,6 +193,16 @@ impl Error {
         }
     }
 
+    #[cfg(not(feature="alloc"))]
+    fn _new(kind: ErrorKind, error: &'static str) -> Error {
+        Error {
+            repr: Repr::Custom(Box::new(Custom {
+                kind: kind,
+                error: error,
+            }))
+        }
+    }
+
     /// Creates a new instance of an `Error` from a particular OS error code.
     pub fn from_raw_os_error(code: i32) -> Error {
         Error { repr: Repr::Os(code) }
@@ -198,6 +224,7 @@ impl Error {
     ///
     /// If this `Error` was constructed via `new` then this function will
     /// return `Some`, otherwise it will return `None`.
+    #[cfg(feature="alloc")]
     pub fn get_ref(&self) -> Option<&(error::Error+Send+Sync+'static)> {
         match self.repr {
             Repr::Os(..) => None,
@@ -210,6 +237,7 @@ impl Error {
     ///
     /// If this `Error` was constructed via `new` then this function will
     /// return `Some`, otherwise it will return `None`.
+    #[cfg(feature="alloc")]
     pub fn get_mut(&mut self) -> Option<&mut (error::Error+Send+Sync+'static)> {
         match self.repr {
             Repr::Os(..) => None,
@@ -221,6 +249,7 @@ impl Error {
     ///
     /// If this `Error` was constructed via `new` then this function will
     /// return `Some`, otherwise it will return `None`.
+    #[cfg(feature="alloc")]
     pub fn into_inner(self) -> Option<Box<error::Error+Send+Sync>> {
         match self.repr {
             Repr::Os(..) => None,
@@ -282,14 +311,24 @@ impl error::Error for Error {
                 ErrorKind::UnexpectedEof => "unexpected end of file",
                 ErrorKind::__Nonexhaustive => unreachable!()
             },
-            Repr::Custom(ref c) => c.error.description(),
+            Repr::Custom(ref c) => {
+                #[cfg(feature="alloc")]
+                { c.error.description() }
+                #[cfg(not(feature="alloc"))]
+                { c.error }
+            },
         }
     }
 
     fn cause(&self) -> Option<&error::Error> {
         match self.repr {
             Repr::Os(..) => None,
-            Repr::Custom(ref c) => c.error.cause(),
+            Repr::Custom(ref _c) => {
+                #[cfg(feature="alloc")]
+                { _c.error.cause() }
+                #[cfg(not(feature="alloc"))]
+                { None }
+            }
         }
     }
 }
diff --git a/artiq/runtime.rs/libstd_artiq/lib.rs b/artiq/runtime.rs/libstd_artiq/lib.rs
index 568dc8663..648baa61e 100644
--- a/artiq/runtime.rs/libstd_artiq/lib.rs
+++ b/artiq/runtime.rs/libstd_artiq/lib.rs
@@ -1,6 +1,7 @@
 #![feature(lang_items, asm, alloc, collections, libc, needs_panic_runtime,
            question_mark, unicode, reflect_marker, raw, int_error_internals,
-           try_from, try_borrow, macro_reexport, allow_internal_unstable)]
+           try_from, try_borrow, macro_reexport, allow_internal_unstable,
+           stmt_expr_attributes)]
 #![no_std]
 #![needs_panic_runtime]
 
@@ -8,7 +9,7 @@ extern crate rustc_unicode;
 extern crate alloc_artiq;
 extern crate alloc;
 #[macro_use]
-#[macro_reexport(vec)]
+#[macro_reexport(vec, format)]
 extern crate collections;
 extern crate libc;
 
@@ -32,51 +33,12 @@ pub mod prelude {
 pub mod error;
 pub mod io;
 
-use core::fmt::Write;
-
-#[macro_export]
-macro_rules! print {
-    ($($arg:tt)*) => ($crate::print_fmt(format_args!($($arg)*)));
-}
-
-#[macro_export]
-macro_rules! println {
-    ($fmt:expr) => (print!(concat!($fmt, "\n")));
-    ($fmt:expr, $($arg:tt)*) => (print!(concat!($fmt, "\n"), $($arg)*));
-}
-
-extern {
-    fn putchar(c: libc::c_int) -> libc::c_int;
-    fn readchar() -> libc::c_char;
-}
-
-pub struct Console;
-
-impl core::fmt::Write for Console {
-    fn write_str(&mut self, s: &str) -> Result<(), core::fmt::Error> {
-        for c in s.bytes() { unsafe { putchar(c as i32); } }
-        Ok(())
+// Provide Box::new wrapper
+#[cfg(not(feature="alloc"))]
+struct FakeBox<T>(core::marker::PhantomData<T>);
+#[cfg(not(feature="alloc"))]
+impl<T> FakeBox<T> {
+    fn new(val: T) -> T {
+        val
     }
 }
-
-pub fn print_fmt(args: self::core::fmt::Arguments) {
-    let _ = Console.write_fmt(args);
-}
-
-#[lang = "panic_fmt"]
-extern fn panic_fmt(args: self::core::fmt::Arguments, file: &'static str, line: u32) -> ! {
-    let _ = write!(Console, "panic at {}:{}: {}\n", file, line, args);
-    let _ = write!(Console, "waiting for debugger...\n");
-    unsafe {
-        let _ = readchar();
-        loop { asm!("l.trap 0") }
-    }
-}
-
-// Allow linking with crates that are built as -Cpanic=unwind even when the root crate
-// is built with -Cpanic=abort.
-#[allow(non_snake_case)]
-#[no_mangle]
-pub extern "C" fn _Unwind_Resume() -> ! {
-    loop {}
-}
diff --git a/artiq/runtime.rs/src/clock.rs b/artiq/runtime.rs/src/clock.rs
index 3c203a196..40e56eea9 100644
--- a/artiq/runtime.rs/src/clock.rs
+++ b/artiq/runtime.rs/src/clock.rs
@@ -12,6 +12,13 @@ pub fn init() {
     }
 }
 
+pub fn get_us() -> u64 {
+    unsafe {
+        csr::timer0::update_value_write(1);
+        (INIT - csr::timer0::value_read()) / (FREQ / 1_000_000)
+    }
+}
+
 pub fn get_ms() -> u64 {
     unsafe {
         csr::timer0::update_value_write(1);
diff --git a/artiq/runtime.rs/src/kernel.rs b/artiq/runtime.rs/src/kernel.rs
index e50902cf5..5d7e17696 100644
--- a/artiq/runtime.rs/src/kernel.rs
+++ b/artiq/runtime.rs/src/kernel.rs
@@ -1,6 +1,7 @@
 use core::ptr;
 use board::csr;
 use mailbox;
+use rpc_queue;
 
 use kernel_proto::{KERNELCPU_EXEC_ADDRESS, KERNELCPU_LAST_ADDRESS, KSUPPORT_HEADER_SIZE};
 
@@ -16,6 +17,8 @@ pub unsafe fn start() {
     ptr::copy_nonoverlapping(ksupport_image.as_ptr(), ksupport_addr, ksupport_image.len());
 
     csr::kernel_cpu::reset_write(0);
+
+    rpc_queue::init();
 }
 
 pub fn stop() {
diff --git a/artiq/runtime.rs/src/kernel_proto.rs b/artiq/runtime.rs/src/kernel_proto.rs
index a75875738..afaf7c35e 100644
--- a/artiq/runtime.rs/src/kernel_proto.rs
+++ b/artiq/runtime.rs/src/kernel_proto.rs
@@ -3,8 +3,8 @@
 use core::marker::PhantomData;
 use core::fmt;
 
-pub const KERNELCPU_EXEC_ADDRESS:    usize = 0x40400000;
-pub const KERNELCPU_PAYLOAD_ADDRESS: usize = 0x40440000;
+pub const KERNELCPU_EXEC_ADDRESS:    usize = 0x40800000;
+pub const KERNELCPU_PAYLOAD_ADDRESS: usize = 0x40840000;
 pub const KERNELCPU_LAST_ADDRESS:    usize = 0x4fffffff;
 pub const KSUPPORT_HEADER_SIZE:      usize = 0x80;
 
@@ -42,8 +42,8 @@ pub enum Message<'a> {
     WatchdogClear      { id: usize },
 
     RpcSend {
+        async: bool,
         service: u32,
-        batch: bool,
         tag: &'a [u8],
         data: *const *const ()
     },
diff --git a/artiq/runtime.rs/src/lib.rs b/artiq/runtime.rs/src/lib.rs
index 278b738e6..b3350dfc8 100644
--- a/artiq/runtime.rs/src/lib.rs
+++ b/artiq/runtime.rs/src/lib.rs
@@ -1,5 +1,6 @@
 #![no_std]
-#![feature(libc, const_fn, try_borrow, stmt_expr_attributes, repr_simd, asm)]
+#![feature(libc, const_fn, try_borrow, stmt_expr_attributes, repr_simd, asm,
+           lang_items)]
 
 #[macro_use]
 extern crate std_artiq as std;
@@ -11,13 +12,54 @@ extern crate byteorder;
 extern crate fringe;
 extern crate lwip;
 
+use core::fmt::Write;
 use logger::BufferLogger;
 
+extern {
+    fn putchar(c: libc::c_int) -> libc::c_int;
+    fn readchar() -> libc::c_char;
+}
+
+#[macro_export]
+macro_rules! print {
+    ($($arg:tt)*) => ($crate::print_fmt(format_args!($($arg)*)));
+}
+
+#[macro_export]
+macro_rules! println {
+    ($fmt:expr) => (print!(concat!($fmt, "\n")));
+    ($fmt:expr, $($arg:tt)*) => (print!(concat!($fmt, "\n"), $($arg)*));
+}
+
+pub struct Console;
+
+impl core::fmt::Write for Console {
+    fn write_str(&mut self, s: &str) -> Result<(), core::fmt::Error> {
+        for c in s.bytes() { unsafe { putchar(c as i32); } }
+        Ok(())
+    }
+}
+
+pub fn print_fmt(args: self::core::fmt::Arguments) {
+    let _ = Console.write_fmt(args);
+}
+
+#[lang = "panic_fmt"]
+extern fn panic_fmt(args: self::core::fmt::Arguments, file: &'static str, line: u32) -> ! {
+    let _ = write!(Console, "panic at {}:{}: {}\n", file, line, args);
+    let _ = write!(Console, "waiting for debugger...\n");
+    unsafe {
+        let _ = readchar();
+        loop { asm!("l.trap 0") }
+    }
+}
+
 mod board;
 mod config;
 mod clock;
 mod rtio_crg;
 mod mailbox;
+mod rpc_queue;
 
 mod urc;
 mod sched;
@@ -29,10 +71,11 @@ mod kernel_proto;
 mod session_proto;
 mod moninj_proto;
 mod analyzer_proto;
+mod rpc_proto;
 
 mod kernel;
-mod rpc;
 mod session;
+#[cfg(has_rtio_moninj)]
 mod moninj;
 #[cfg(has_rtio_analyzer)]
 mod analyzer;
@@ -44,9 +87,17 @@ extern {
 
 include!(concat!(env!("OUT_DIR"), "/git_info.rs"));
 
+// Allow linking with crates that are built as -Cpanic=unwind even if we use -Cpanic=abort.
+// This is never called.
+#[allow(non_snake_case)]
+#[no_mangle]
+pub extern "C" fn _Unwind_Resume() -> ! {
+    loop {}
+}
+
 #[no_mangle]
 pub unsafe extern fn rust_main() {
-    static mut LOG_BUFFER: [u8; 4096] = [0; 4096];
+    static mut LOG_BUFFER: [u8; 65536] = [0; 65536];
     BufferLogger::new(&mut LOG_BUFFER[..])
                  .register(move || {
         info!("booting ARTIQ...");
@@ -59,6 +110,7 @@ pub unsafe extern fn rust_main() {
 
         let mut scheduler = sched::Scheduler::new();
         scheduler.spawner().spawn(16384, session::thread);
+        #[cfg(has_rtio_moninj)]
         scheduler.spawner().spawn(4096, moninj::thread);
         #[cfg(has_rtio_analyzer)]
         scheduler.spawner().spawn(4096, analyzer::thread);
diff --git a/artiq/runtime.rs/src/logger.rs b/artiq/runtime.rs/src/logger.rs
index d09995bf7..77d1d01d5 100644
--- a/artiq/runtime.rs/src/logger.rs
+++ b/artiq/runtime.rs/src/logger.rs
@@ -1,7 +1,8 @@
 use core::{mem, ptr};
 use core::cell::RefCell;
-use log::{self, Log, LogMetadata, LogRecord, LogLevelFilter};
+use log::{self, Log, LogLevel, LogMetadata, LogRecord, LogLevelFilter};
 use log_buffer::LogBuffer;
+use clock;
 
 pub struct BufferLogger {
     buffer: RefCell<LogBuffer<&'static mut [u8]>>
@@ -57,10 +58,13 @@ impl Log for BufferLogger {
     fn log(&self, record: &LogRecord) {
         if self.enabled(record.metadata()) {
             use core::fmt::Write;
-            writeln!(self.buffer.borrow_mut(), "{:>5}({}): {}",
-                     record.level(), record.target(), record.args()).unwrap();
-            println!("{:>5}({}): {}",
-                     record.level(), record.target(), record.args());
+            writeln!(self.buffer.borrow_mut(),
+                     "[{:12}us] {:>5}({}): {}",
+                     clock::get_us(), record.level(), record.target(), record.args()).unwrap();
+            if record.level() <= LogLevel::Info {
+                println!("[{:12}us] {:>5}({}): {}",
+                         clock::get_us(), record.level(), record.target(), record.args());
+            }
         }
     }
 }
diff --git a/artiq/runtime.rs/src/proto.rs b/artiq/runtime.rs/src/proto.rs
index e3b40c3c1..9d59b6ad6 100644
--- a/artiq/runtime.rs/src/proto.rs
+++ b/artiq/runtime.rs/src/proto.rs
@@ -67,7 +67,8 @@ pub fn write_bytes(writer: &mut Write, value: &[u8]) -> io::Result<()> {
 
 pub fn read_string(reader: &mut Read) -> io::Result<String> {
     let bytes = try!(read_bytes(reader));
-    String::from_utf8(bytes).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))
+    String::from_utf8(bytes)
+           .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "invalid UTF-8"))
 }
 
 pub fn write_string(writer: &mut Write, value: &str) -> io::Result<()> {
diff --git a/artiq/runtime.rs/src/rpc.rs b/artiq/runtime.rs/src/rpc_proto.rs
similarity index 97%
rename from artiq/runtime.rs/src/rpc.rs
rename to artiq/runtime.rs/src/rpc_proto.rs
index 21b966dc9..d302d389d 100644
--- a/artiq/runtime.rs/src/rpc.rs
+++ b/artiq/runtime.rs/src/rpc_proto.rs
@@ -1,5 +1,7 @@
-use std::slice;
-use std::io::{self, Read, Write, BufWriter};
+#![allow(dead_code)]
+
+use core::slice;
+use std::io::{self, Read, Write};
 use proto::*;
 use self::tag::{Tag, TagIterator, split_tag};
 
@@ -74,6 +76,7 @@ unsafe fn recv_value(reader: &mut Read, tag: Tag, data: &mut *mut (),
 pub fn recv_return(reader: &mut Read, tag_bytes: &[u8], data: *mut (),
                    alloc: &Fn(usize) -> io::Result<*mut ()>) -> io::Result<()> {
     let mut it = TagIterator::new(tag_bytes);
+    #[cfg(not(ksupport))]
     trace!("recv ...->{}", it);
 
     let tag = it.next().expect("truncated tag");
@@ -98,7 +101,6 @@ unsafe fn send_value(writer: &mut Write, tag: Tag, data: &mut *const ()) -> io::
         })
     }
 
-    let writer = &mut BufWriter::new(writer);
     try!(write_u8(writer, tag.as_u8()));
     match tag {
         Tag::None => Ok(()),
@@ -161,14 +163,16 @@ unsafe fn send_value(writer: &mut Write, tag: Tag, data: &mut *const ()) -> io::
     }
 }
 
-pub fn send_args(writer: &mut Write, tag_bytes: &[u8],
+pub fn send_args(writer: &mut Write, service: u32, tag_bytes: &[u8],
                  data: *const *const ()) -> io::Result<()> {
     let (arg_tags_bytes, return_tag_bytes) = split_tag(tag_bytes);
 
     let mut args_it = TagIterator::new(arg_tags_bytes);
     let return_it = TagIterator::new(return_tag_bytes);
-    trace!("send ({})->{}", args_it, return_it);
+    #[cfg(not(ksupport))]
+    trace!("send<{}>({})->{}", service, args_it, return_it);
 
+    try!(write_u32(writer, service));
     for index in 0.. {
         if let Some(arg_tag) = args_it.next() {
             let mut data = unsafe { *data.offset(index) };
diff --git a/artiq/runtime.rs/src/rpc_queue.rs b/artiq/runtime.rs/src/rpc_queue.rs
new file mode 100644
index 000000000..3155813eb
--- /dev/null
+++ b/artiq/runtime.rs/src/rpc_queue.rs
@@ -0,0 +1,61 @@
+#![allow(dead_code)]
+
+use core::ptr::{read_volatile, write_volatile};
+use core::slice;
+use board;
+
+const SEND_MAILBOX: *mut usize = (board::mem::MAILBOX_BASE + 4) as *mut usize;
+const RECV_MAILBOX: *mut usize = (board::mem::MAILBOX_BASE + 8) as *mut usize;
+
+const QUEUE_BEGIN: usize = 0x40400000;
+const QUEUE_END:   usize = 0x407fff80;
+const QUEUE_CHUNK: usize = 0x1000;
+
+pub unsafe fn init() {
+    write_volatile(SEND_MAILBOX, QUEUE_BEGIN);
+    write_volatile(RECV_MAILBOX, QUEUE_BEGIN);
+}
+
+fn next(mut addr: usize) -> usize {
+    debug_assert!(addr % QUEUE_CHUNK == 0);
+    debug_assert!(addr >= QUEUE_BEGIN && addr < QUEUE_END);
+
+    addr += QUEUE_CHUNK;
+    if addr >= QUEUE_END { addr = QUEUE_BEGIN }
+    addr
+}
+
+pub fn empty() -> bool {
+    unsafe { read_volatile(SEND_MAILBOX) == read_volatile(RECV_MAILBOX) }
+}
+
+pub fn full() -> bool {
+    unsafe { next(read_volatile(SEND_MAILBOX)) == read_volatile(RECV_MAILBOX) }
+}
+
+pub fn enqueue<T, E, F>(f: F) -> Result<T, E>
+        where F: FnOnce(&mut [u8]) -> Result<T, E> {
+    debug_assert!(!full());
+
+    unsafe {
+        let slice = slice::from_raw_parts_mut(read_volatile(SEND_MAILBOX) as *mut u8, QUEUE_CHUNK);
+        f(slice).and_then(|x| {
+            write_volatile(SEND_MAILBOX, next(read_volatile(SEND_MAILBOX)));
+            Ok(x)
+        })
+    }
+}
+
+pub fn dequeue<T, E, F>(f: F) -> Result<T, E>
+        where F: FnOnce(&mut [u8]) -> Result<T, E> {
+    debug_assert!(!empty());
+
+    unsafe {
+        board::flush_cpu_dcache();
+        let slice = slice::from_raw_parts_mut(read_volatile(RECV_MAILBOX) as *mut u8, QUEUE_CHUNK);
+        f(slice).and_then(|x| {
+            write_volatile(RECV_MAILBOX, next(read_volatile(RECV_MAILBOX)));
+            Ok(x)
+        })
+    }
+}
diff --git a/artiq/runtime.rs/src/session.rs b/artiq/runtime.rs/src/session.rs
index 0c05f4a5c..8589971a0 100644
--- a/artiq/runtime.rs/src/session.rs
+++ b/artiq/runtime.rs/src/session.rs
@@ -1,16 +1,16 @@
 use std::prelude::v1::*;
 use std::{mem, str};
 use std::cell::RefCell;
-use std::fmt::Write;
-use std::io::{self, Read};
-use {config, rtio_crg, clock, mailbox, kernel};
+use std::io::{self, Read, Write, BufWriter};
+use {config, rtio_crg, clock, mailbox, rpc_queue, kernel};
 use logger::BufferLogger;
 use cache::Cache;
 use urc::Urc;
 use sched::{ThreadHandle, Waiter, Spawner};
 use sched::{TcpListener, TcpStream, SocketAddr, IP_ANY};
+use byteorder::{ByteOrder, NetworkEndian};
 
-use rpc;
+use rpc_proto as rpc;
 use session_proto as host;
 use kernel_proto as kern;
 
@@ -114,7 +114,7 @@ fn host_read(stream: &mut TcpStream) -> io::Result<host::Request> {
     Ok(request)
 }
 
-fn host_write(stream: &mut TcpStream, reply: host::Reply) -> io::Result<()> {
+fn host_write(stream: &mut Write, reply: host::Reply) -> io::Result<()> {
     trace!("comm->host {:?}", reply);
     reply.write_to(stream)
 }
@@ -132,7 +132,8 @@ fn kern_recv_notrace<R, F>(waiter: Waiter, f: F) -> io::Result<R>
         where F: FnOnce(&kern::Message) -> io::Result<R> {
     try!(waiter.until(|| mailbox::receive() != 0));
     if !kernel::validate(mailbox::receive()) {
-        return Err(io::Error::new(io::ErrorKind::InvalidData, "invalid kernel CPU pointer"))
+        let message = format!("invalid kernel CPU pointer 0x{:x}", mailbox::receive());
+        return Err(io::Error::new(io::ErrorKind::InvalidData, message))
     }
 
     f(unsafe { mem::transmute::<usize, &kern::Message>(mailbox::receive()) })
@@ -352,6 +353,7 @@ fn process_kern_message(waiter: Waiter,
         kern_recv_dotrace(request);
         match request {
             &kern::Log(args) => {
+                use std::fmt::Write;
                 try!(session.log_buffer.write_fmt(args)
                         .map_err(|_| io_error("cannot append to session log buffer")));
                 session.flush_log_buffer();
@@ -383,15 +385,14 @@ fn process_kern_message(waiter: Waiter,
                 kern_acknowledge()
             }
 
-            &kern::RpcSend { service, batch, tag, data } => {
+            &kern::RpcSend { async, service, tag, data } => {
                 match stream {
                     None => unexpected!("unexpected RPC in flash kernel"),
                     Some(ref mut stream) => {
-                        try!(host_write(stream, host::Reply::RpcRequest {
-                            service: service
-                        }));
-                        try!(rpc::send_args(stream, tag, data));
-                        if !batch {
+                        let writer = &mut BufWriter::new(stream);
+                        try!(host_write(writer, host::Reply::RpcRequest { async: async }));
+                        try!(rpc::send_args(writer, service, tag, data));
+                        if !async {
                             session.kernel_state = KernelState::RpcWait
                         }
                         kern_acknowledge()
@@ -465,12 +466,28 @@ fn process_kern_message(waiter: Waiter,
     })
 }
 
+fn process_kern_queued_rpc(stream: &mut TcpStream,
+                           session: &mut Session) -> io::Result<()> {
+    rpc_queue::dequeue(|slice| {
+        trace!("comm<-kern (async RPC)");
+        let length = NetworkEndian::read_u32(slice) as usize;
+        try!(host_write(stream, host::Reply::RpcRequest { async: true }));
+        trace!("{:?}" ,&slice[4..][..length]);
+        try!(stream.write(&slice[4..][..length]));
+        Ok(())
+    })
+}
+
 fn host_kernel_worker(waiter: Waiter,
                       stream: &mut TcpStream,
                       congress: &mut Congress) -> io::Result<()> {
     let mut session = Session::new(congress);
 
     loop {
+        while !rpc_queue::empty() {
+            try!(process_kern_queued_rpc(stream, &mut session))
+        }
+
         if stream.readable() {
             try!(process_host_message(waiter, stream, &mut session));
         }
@@ -509,6 +526,10 @@ fn flash_kernel_worker(waiter: Waiter,
     try!(kern_run(&mut session));
 
     loop {
+        if !rpc_queue::empty() {
+            return Err(io_error("unexpected background RPC in flash kernel"))
+        }
+
         if mailbox::receive() != 0 {
             if try!(process_kern_message(waiter, None, &mut session)) {
                 return Ok(())
diff --git a/artiq/runtime.rs/src/session_proto.rs b/artiq/runtime.rs/src/session_proto.rs
index 7babdc35a..fd48c46b3 100644
--- a/artiq/runtime.rs/src/session_proto.rs
+++ b/artiq/runtime.rs/src/session_proto.rs
@@ -107,7 +107,7 @@ pub enum Reply<'a> {
         backtrace: &'a [usize]
     },
 
-    RpcRequest { service: u32 },
+    RpcRequest { async: bool },
 
     FlashRead(&'a [u8]),
     FlashOk,
@@ -170,9 +170,9 @@ impl<'a> Reply<'a> {
                 }
             },
 
-            Reply::RpcRequest { service } => {
+            Reply::RpcRequest { async } => {
                 try!(write_u8(writer, 10));
-                try!(write_u32(writer, service));
+                try!(write_u8(writer, async as u8));
             },
 
             Reply::FlashRead(ref bytes) => {
diff --git a/artiq/runtime/Makefile b/artiq/runtime/Makefile
index fbf88b804..e3933ae44 100644
--- a/artiq/runtime/Makefile
+++ b/artiq/runtime/Makefile
@@ -7,6 +7,8 @@ OBJECTS := flash_storage.o main.o
 OBJECTS_KSUPPORT := ksupport_glue.o artiq_personality.o rtio.o dds.o i2c.o ad9154.o
 
 RUSTOUT_DIRECTORY := cargo/or1k-unknown-none/debug
+CORE_IO_COMMIT := d40c593f42fafbac1ff3d827f6df96338b5b7d8b
+export CORE_IO_COMMIT
 
 CFLAGS += \
 	-I$(LIBALLOC_DIRECTORY) \
@@ -54,6 +56,7 @@ $(RUSTOUT_DIRECTORY)/libksupport.a:
 			--manifest-path $(realpath $(RUNTIME_DIRECTORY)/../runtime.rs/libksupport/Cargo.toml) \
 			--target=or1k-unknown-none -- \
 			$(shell cat $(BUILDINC_DIRECTORY)/generated/rust-cfg) \
+			--cfg ksupport \
 			-C target-feature=+mul,+div,+ffl1,+cmov,+addc -C opt-level=s \
 			-L../libcompiler-rt
 
diff --git a/artiq/runtime/ksupport.ld b/artiq/runtime/ksupport.ld
index de2267304..333db0739 100644
--- a/artiq/runtime/ksupport.ld
+++ b/artiq/runtime/ksupport.ld
@@ -6,10 +6,14 @@ INCLUDE generated/regions.ld
 
 /* First 4M of main memory are reserved for runtime
  * code/data/heap, then comes kernel memory.
+ * Next 4M of main memory are reserved for
+ * the background RPC queue.
  * First 256K of kernel memory are for support code.
+ * Support code is loaded at ORIGIN-0x80 so that ELF headers
+ * are also loaded.
  */
 MEMORY {
-    ksupport (RWX) : ORIGIN = 0x40400000, LENGTH = 0x40000
+    ksupport (RWX) : ORIGIN = 0x40800000, LENGTH = 0x40000
 }
 
 /* Kernel stack is at the end of main RAM. */
diff --git a/artiq/runtime/ksupport_glue.c b/artiq/runtime/ksupport_glue.c
index 9de97b75d..f0d496dc3 100644
--- a/artiq/runtime/ksupport_glue.c
+++ b/artiq/runtime/ksupport_glue.c
@@ -8,8 +8,8 @@
 
 void send_to_log(const char *ptr, size_t length);
 
-#define KERNELCPU_EXEC_ADDRESS    0x40400000
-#define KERNELCPU_PAYLOAD_ADDRESS 0x40440000
+#define KERNELCPU_EXEC_ADDRESS    0x40800000
+#define KERNELCPU_PAYLOAD_ADDRESS 0x40840000
 #define KERNELCPU_LAST_ADDRESS    0x4fffffff
 #define KSUPPORT_HEADER_SIZE      0x80
 
@@ -70,10 +70,33 @@ int dl_iterate_phdr (int (*callback)(struct dl_phdr_info *, size_t, void *), voi
 }
 
 /* called by kernel */
-long lround(double x);
-long lround(double x)
+double round(double x);
+double round(double x)
 {
-    return x < 0 ? floor(x) : ceil(x);
+    union {double f; uint64_t i;} u = {x};
+    int e = u.i >> 52 & 0x7ff;
+    double y;
+
+    if (e >= 0x3ff+52)
+        return x;
+    if (u.i >> 63)
+        x = -x;
+    if (e < 0x3ff-1) {
+        /* we don't do it in ARTIQ */
+        /* raise inexact if x!=0 */
+        // FORCE_EVAL(x + 0x1p52);
+        return 0*u.f;
+    }
+    y = (double)(x + 0x1p52) - 0x1p52 - x;
+    if (y > 0.5)
+        y = y + x - 1;
+    else if (y <= -0.5)
+        y = y + x + 1;
+    else
+        y = y + x;
+    if (u.i >> 63)
+        y = -y;
+    return y;
 }
 
 /* called by kernel */
diff --git a/artiq/runtime/main.c b/artiq/runtime/main.c
index d5db5e5dc..c9f6f0951 100644
--- a/artiq/runtime/main.c
+++ b/artiq/runtime/main.c
@@ -177,6 +177,10 @@ u8_t* tcp_so_options_(struct tcp_pcb *pcb) {
     return &pcb->so_options;
 }
 
+void tcp_nagle_disable_(struct tcp_pcb *pcb) {
+    tcp_nagle_disable(pcb);
+}
+
 int main(void)
 {
     irq_setmask(0);
diff --git a/artiq/runtime/rtio.c b/artiq/runtime/rtio.c
index 09f71d9d4..ac5168224 100644
--- a/artiq/runtime/rtio.c
+++ b/artiq/runtime/rtio.c
@@ -124,6 +124,7 @@ unsigned int rtio_input_data(int channel)
 
 void rtio_log_va(long long int timestamp, const char *fmt, va_list args)
 {
+#ifdef CONFIG_RTIO_LOG_CHANNEL
     // This executes on the kernel CPU's stack, which is specifically designed
     // for allocation of this kind of massive buffers.
     int   len = vsnprintf(NULL, 0, fmt, args);
@@ -152,6 +153,7 @@ void rtio_log_va(long long int timestamp, const char *fmt, va_list args)
             i = 0;
         }
     }
+#endif
 }
 
 void rtio_log(long long int timestamp, const char *fmt, ...)
diff --git a/artiq/runtime/runtime.ld b/artiq/runtime/runtime.ld
index 5d3d00e08..42e7e2cd2 100644
--- a/artiq/runtime/runtime.ld
+++ b/artiq/runtime/runtime.ld
@@ -74,9 +74,7 @@ SECTIONS
     .heap :
     {
         _fheap = .;
-        . = ORIGIN(runtime) + LENGTH(runtime)
-        /* Leave room for ksupport headers. */
-            - 0x1000;
+        . = ORIGIN(runtime) + LENGTH(runtime);
         _eheap = .;
     } > runtime
 
diff --git a/artiq/test/coredevice/test_embedding.py b/artiq/test/coredevice/test_embedding.py
index 683468b1d..8ad7cef63 100644
--- a/artiq/test/coredevice/test_embedding.py
+++ b/artiq/test/coredevice/test_embedding.py
@@ -217,6 +217,27 @@ class AnnotationTest(ExperimentCase):
         exp = self.create(_Annotation)
         self.assertEqual(exp.overflow(1), True)
 
+class _Async(EnvExperiment):
+    def build(self):
+        self.setattr_device("core")
+
+    @rpc(flags={"async"})
+    def recv_async(self, data):
+        pass
+
+    @kernel
+    def run(self):
+        # fast async path
+        self.recv_async([0]*128)
+        # slow async path
+        self.recv_async([0]*4096)
+
+
+class AsyncTest(ExperimentCase):
+    def test_args(self):
+        exp = self.create(_RPCTypes)
+        exp.run()
+
 
 class _Payload1MB(EnvExperiment):
     def build(self):
diff --git a/artiq/test/coredevice/test_rtio.py b/artiq/test/coredevice/test_rtio.py
index f60abd643..061d5fc3c 100644
--- a/artiq/test/coredevice/test_rtio.py
+++ b/artiq/test/coredevice/test_rtio.py
@@ -450,6 +450,8 @@ class RPCTest(ExperimentCase):
                          "timings are dependent on CPU load and network conditions")
     def test_rpc_timing(self):
         self.execute(RPCTiming)
-        self.assertGreater(self.dataset_mgr.get("rpc_time_mean"), 100*ns)
-        self.assertLess(self.dataset_mgr.get("rpc_time_mean"), 15*ms)
-        self.assertLess(self.dataset_mgr.get("rpc_time_stddev"), 2*ms)
+        rpc_time_mean = self.dataset_mgr.get("rpc_time_mean")
+        print(rpc_time_mean)
+        self.assertGreater(rpc_time_mean, 100*ns)
+        self.assertLess(rpc_time_mean, 2*ms)
+        self.assertLess(self.dataset_mgr.get("rpc_time_stddev"), 1*ms)
diff --git a/artiq/test/lit/embedding/async_rpc.py b/artiq/test/lit/embedding/async_rpc.py
new file mode 100644
index 000000000..691a093c3
--- /dev/null
+++ b/artiq/test/lit/embedding/async_rpc.py
@@ -0,0 +1,15 @@
+# RUN: env ARTIQ_DUMP_LLVM=%t %python -m artiq.compiler.testbench.embedding +compile %s
+# RUN: OutputCheck %s --file-to-check=%t.ll
+
+from artiq.language.core import *
+from artiq.language.types import *
+
+# CHECK: call void @send_async_rpc
+
+@rpc(flags={"async"})
+def foo():
+    pass
+
+@kernel
+def entrypoint():
+    foo()
diff --git a/artiq/test/lit/embedding/error_rpc_async_return.py b/artiq/test/lit/embedding/error_rpc_async_return.py
new file mode 100644
index 000000000..72f3c79c3
--- /dev/null
+++ b/artiq/test/lit/embedding/error_rpc_async_return.py
@@ -0,0 +1,15 @@
+# RUN: %python -m artiq.compiler.testbench.embedding +diag %s 2>%t
+# RUN: OutputCheck %s --file-to-check=%t
+
+from artiq.language.core import *
+from artiq.language.types import *
+
+# CHECK-L: ${LINE:+2}: fatal: functions that return a value cannot be defined as async RPCs
+@rpc(flags={"async"})
+def foo() -> TInt32:
+    pass
+
+@kernel
+def entrypoint():
+    # CHECK-L: ${LINE:+1}: note: function called here
+    foo()
diff --git a/artiq/test/lit/embedding/invariant_propagation.py b/artiq/test/lit/embedding/invariant_propagation.py
new file mode 100644
index 000000000..e1af5c9c1
--- /dev/null
+++ b/artiq/test/lit/embedding/invariant_propagation.py
@@ -0,0 +1,26 @@
+# RUN: env ARTIQ_DUMP_LLVM=%t %python -m artiq.compiler.testbench.embedding +compile %s
+# RUN: OutputCheck %s --file-to-check=%t.ll
+
+from artiq.language.core import *
+from artiq.language.types import *
+
+class Class:
+    kernel_invariants = {"foo"}
+
+    def __init__(self):
+        self.foo = True
+
+    @kernel
+    def run(self):
+        if self.foo:
+            print("bar")
+        else:
+            # Make sure all the code for this branch will be completely elided:
+            # CHECK-NOT: baz
+            print("baz")
+
+obj = Class()
+
+@kernel
+def entrypoint():
+    obj.run()
diff --git a/artiq/test/lit/integration/for.py b/artiq/test/lit/integration/for.py
index 9c305f5da..7156bee5d 100644
--- a/artiq/test/lit/integration/for.py
+++ b/artiq/test/lit/integration/for.py
@@ -27,3 +27,27 @@ for x in range(10):
     assert False
 else:
     assert False
+
+# Verify continue target is reset in else block.
+cond = False
+while True:
+    if cond:
+        break
+    cond = True
+    for _ in range(1):
+        pass
+    else:
+        continue
+    assert False
+else:
+    assert False
+
+# Verify for target is reset in else block.
+while True:
+    for _ in range(1):
+        pass
+    else:
+        break
+    assert False
+else:
+    assert False
diff --git a/artiq/test/lit/integration/while.py b/artiq/test/lit/integration/while.py
index 7cd2ac626..e7d03c0d7 100644
--- a/artiq/test/lit/integration/while.py
+++ b/artiq/test/lit/integration/while.py
@@ -29,3 +29,27 @@ while cond:
     cond = False
     continue
     assert False
+
+# Verify continue target is reset in else block.
+cond = False
+while True:
+    if cond:
+        break
+    cond = True
+    while False:
+        assert False
+    else:
+        continue
+    assert False
+else:
+    assert False
+
+# Verify break target is reset in else block.
+while True:
+    while False:
+        assert False
+    else:
+        break
+    assert False
+else:
+    assert False
diff --git a/conda/artiq/meta.yaml b/conda/artiq/meta.yaml
index ca300b8d3..0d85408bb 100644
--- a/conda/artiq/meta.yaml
+++ b/conda/artiq/meta.yaml
@@ -18,7 +18,7 @@ requirements:
     - binutils-or1k-linux
   run:
     - python >=3.5.2
-    - llvmlite-artiq 0.10.0.dev py35_24
+    - llvmlite-artiq 0.12.0.dev py35_29
     - lit
     - outputcheck
     - scipy
@@ -37,7 +37,7 @@ requirements:
     - pygit2
     - aiohttp
     - binutils-or1k-linux
-    - pythonparser
+    - pythonparser 1.0
     - levenshtein
 
 test:
diff --git a/doc/manual/compiler.rst b/doc/manual/compiler.rst
index 6a8271a5f..02c56e516 100644
--- a/doc/manual/compiler.rst
+++ b/doc/manual/compiler.rst
@@ -47,6 +47,19 @@ The Python types correspond to ARTIQ type annotations as follows:
 | range       | TRange32, TRange64      |
 +-------------+-------------------------+
 
+Asynchronous RPCs
+-----------------
+
+If an RPC returns no value, it can be invoked in a way that does not block until the RPC finishes
+execution, but only until it is queued. (Submitting asynchronous RPCs too rapidly, as well as
+submitting asynchronous RPCs with arguments that are too large, can still block until completion.)
+
+To define an asynchronous RPC, use the ``@rpc`` annotation with a flag: ::
+
+    @rpc(flags={"async"})
+    def record_result(x):
+        self.results.append(x)
+
 Additional optimizations
 ------------------------
 
@@ -74,7 +87,7 @@ Kernel invariants
 
 The compiler attempts to remove or hoist out of loops any redundant memory load operations, as well as propagate known constants into function bodies, which can enable further optimization. However, it must make conservative assumptions about code that it is unable to observe, because such code can change the value of the attribute, making the optimization invalid.
 
-When an attribute is known to never change while the kernel is running, it can be marked as a *kernel invariant* to enable more aggressive optimization for this specific attribute: ::
+When an attribute is known to never change while the kernel is running, it can be marked as a *kernel invariant* to enable more aggressive optimization for this specific attribute. ::
 
     class Converter:
         kernel_invariants = {"ratio"}
@@ -86,4 +99,32 @@ When an attribute is known to never change while the kernel is running, it can b
         def convert(self, value):
             return value * self.ratio ** 2
 
-In the synthetic example above, the compiler will be able to detect that the result of evaluating ``self.ratio ** 2`` never changes and replace it with a constant, removing an expensive floating-point operation.
+In the synthetic example above, the compiler will be able to detect that the result of evaluating ``self.ratio ** 2`` never changes and replace it with a constant, removing an expensive floating-point operation. ::
+
+    class Worker:
+        kernel_invariants = {"interval"}
+
+        def __init__(self, interval=1.0*us):
+            self.interval = interval
+
+        def work(self):
+            # something useful
+
+    class Looper:
+        def __init__(self, worker):
+            self.worker = worker
+
+        @kernel
+        def loop(self):
+            for _ in range(100):
+                delay(self.worker.interval / 5.0)
+                self.worker.work()
+
+In the synthetic example above, the compiler will be able to detect that the result of evaluating ``self.interval / 5.0`` never changes, even though it neither knows the value of ``self.worker.interval`` beforehand nor can it see through the ``self.worker.work()`` function call, and hoist the expensive floating-point division out of the loop, transforming the code for ``loop`` into an equivalent of the following: ::
+
+        @kernel
+        def loop(self):
+            precomputed_delay_mu = seconds_to_mu(self.worker.interval / 5.0)
+            for _ in range(100):
+                delay_mu(precomputed_delay_mu)
+                self.worker.work()
diff --git a/doc/manual/installing_from_source.rst b/doc/manual/installing_from_source.rst
index 2836e085c..32d1e3481 100644
--- a/doc/manual/installing_from_source.rst
+++ b/doc/manual/installing_from_source.rst
@@ -33,7 +33,7 @@ and the ARTIQ kernels.
         $ wget https://ftp.gnu.org/gnu/binutils/binutils-2.27.tar.bz2
         $ tar xvf binutils-2.27.tar.bz2
         $ cd binutils-2.27
-        $ curl -L 'https://github.com/m-labs/conda-recipes/blob/ece4cefbcce5548c5bd7fd4740d71ecd6930065e/conda/binutils-or1k-linux/fix-R_OR1K_GOTOFF-relocations.patch' | patch -p1
+        $ curl -L https://raw.githubusercontent.com/m-labs/conda-recipes/ece4cefbcce5548c5bd7fd4740d71ecd6930065e/conda/binutils-or1k-linux/fix-R_OR1K_GOTOFF-relocations.patch' | patch -p1
 
         $ mkdir build
         $ cd build
@@ -62,18 +62,24 @@ and the ARTIQ kernels.
 
         $ cd ~/artiq-dev
         $ git clone https://github.com/m-labs/rust
+        $ cd rust
         $ git checkout artiq
+        $ git submodule update --init
         $ mkdir build
         $ cd build
-        $ ../configure --prefix=/usr/local/rust-or1k --llvm-root=/usr/local/llvm-or1k/bin/llvm-config --disable-manage-submodules
+        $ ../configure --prefix=/usr/local/rust-or1k --llvm-root=/usr/local/llvm-or1k --disable-manage-submodules
         $ sudo make install -j4
-        $ libs="libcore liballoc librustc_unicode libcollections liblibc_mini libunwind libpanic_unwind"
 
+        $ libs="libcore liballoc librustc_unicode libcollections liblibc_mini libunwind"
+        $ rustc="/usr/local/rust-or1k/bin/rustc --target or1k-unknown-none -g -C target-feature=+mul,+div,+ffl1,+cmov,+addc -C opt-level=s -L ."
+        $ destdir="/usr/local/rust-or1k/lib/rustlib/or1k-unknown-none/lib/"
         $ mkdir ../build-or1k
         $ cd ../build-or1k
-        $ for lib in ${libs}; do /usr/local/rust-or1k/bin/rustc src/${lib}/lib.rs; done
-        $ /usr/local/rust-or1k/bin/rustc -Cpanic=abort src/libpanic_abort/lib.rs
-        $ sudo cp * /usr/local/rust-or1k/lib/rustlib/or1k-unknown-none/lib/
+        $ for lib in ${libs}; do ${rustc} ../src/${lib}/lib.rs; done
+        $ ${rustc} -Cpanic=abort ../src/libpanic_abort/lib.rs
+        $ ${rustc} -Cpanic=unwind ../src/libpanic_unwind/lib.rs --cfg llvm_libunwind
+        $ sudo mkdir -p ${destdir}
+        $ sudo cp *.rlib ${destdir}
 
 .. note::
     Compilation of LLVM can take more than 30 min on some machines. Compilation of Rust can take more than two hours.
@@ -167,7 +173,7 @@ These steps are required to generate gateware bitstream (``.bit``) files, build
 
         $ python3.5 -m artiq.gateware.targets.kc705 -H nist_qc1  # or nist_qc2
 
-    .. note:: Add ``--toolchain vivado`` if you wish to use Vivado instead of ISE.
+    .. note:: Add ``--toolchain ise`` if you wish to use ISE instead of Vivado.
 
 * Then, gather the binaries and flash them: ::
 
diff --git a/setup.py b/setup.py
index c3c50e8c1..00ecb3355 100755
--- a/setup.py
+++ b/setup.py
@@ -27,6 +27,7 @@ console_scripts = [
     "artiq_coreconfig=artiq.frontend.artiq_coreconfig:main",
     "artiq_corelog=artiq.frontend.artiq_corelog:main",
     "artiq_ctlmgr=artiq.frontend.artiq_ctlmgr:main",
+    "artiq_devtool=artiq.frontend.artiq_devtool:main",
     "artiq_influxdb=artiq.frontend.artiq_influxdb:main",
     "artiq_master=artiq.frontend.artiq_master:main",
     "artiq_mkfs=artiq.frontend.artiq_mkfs:main",