diff --git a/Cryptlib/Makefile b/Cryptlib/Makefile
index b58ceee42..dda59c4b7 100644
--- a/Cryptlib/Makefile
+++ b/Cryptlib/Makefile
@@ -22,6 +22,7 @@ WERRFLAGS	+= -Wno-error=unused-but-set-variable \
 CFLAGS		= $(FEATUREFLAGS) \
 		  $(OPTIMIZATIONS) \
 		  $(WARNFLAGS) \
+		  $(ARCH_CFLAGS) \
 		  $(WERRFLAGS) \
 		  $(INCLUDES) \
 		  $(DEFINES)
diff --git a/Cryptlib/OpenSSL/Makefile b/Cryptlib/OpenSSL/Makefile
index c17604f9f..663acd0cb 100644
--- a/Cryptlib/OpenSSL/Makefile
+++ b/Cryptlib/OpenSSL/Makefile
@@ -36,6 +36,7 @@ WERRFLAGS	+= -Wno-error=unused-but-set-variable \
 CFLAGS		= $(FEATUREFLAGS) \
 		  $(OPTIMIZATIONS) \
 		  $(WARNFLAGS) \
+		  $(ARCH_CFLAGS) \
 		  $(WERRFLAGS) \
 		  $(INCLUDES) \
 		  $(DEFINES)
diff --git a/Make.defaults b/Make.defaults
index 1d2f188b8..e48a6b1c8 100644
--- a/Make.defaults
+++ b/Make.defaults
@@ -61,9 +61,10 @@ CLANG_BUGS	= $(if $(findstring gcc,$(CC)),-maccumulate-outgoing-args,) \
 COMMIT_ID ?= $(shell if [ -e .git ] ; then git log -1 --pretty=format:%H ; elif [ -f commit ]; then cat commit ; else echo master; fi)
 
 ifeq ($(ARCH),x86_64)
-	ARCH_CFLAGS		?= -mno-mmx -mno-sse -mno-red-zone -nostdinc \
+	ARCH_TEST_CFLAGS	?= -mno-mmx -mno-sse -mno-red-zone -nostdinc \
 				   $(CLANG_BUGS) -m64 \
 				   -DMDE_CPU_X64 -DPAGE_SIZE=4096
+	ARCH_CFLAGS		?= $(ARCH_TEST_CFLAGS) $(if $(findstring gcc,$(CC)),-mabi=ms)
 	ARCH_GNUEFI		?= x86_64
 	ARCH_SUFFIX		?= x64
 	ARCH_SUFFIX_UPPER	?= X64
@@ -71,9 +72,10 @@ ifeq ($(ARCH),x86_64)
 	ARCH_SECTION_ALIGNMENT	?= 0x1000
 endif
 ifeq ($(ARCH),ia32)
-	ARCH_CFLAGS		?= -mno-mmx -mno-sse -mno-red-zone -nostdinc \
+	ARCH_TEST_CFLAGS	?= -mno-mmx -mno-sse -mno-red-zone -nostdinc \
 				   $(CLANG_BUGS) -m32 -malign-double \
 				   -DMDE_CPU_IA32 -DPAGE_SIZE=4096
+	ARCH_CFLAGS		?= $(ARCH_TEST_CFLAGS)
 	ARCH_GNUEFI		?= ia32
 	ARCH_SUFFIX		?= ia32
 	ARCH_SUFFIX_UPPER	?= IA32
@@ -83,6 +85,7 @@ ifeq ($(ARCH),ia32)
 endif
 ifeq ($(ARCH),aarch64)
 	ARCH_CFLAGS		?= -DMDE_CPU_AARCH64 -DPAGE_SIZE=4096 -mstrict-align
+	ARCH_CFLAGS		?= $(ARCH_TEST_CFLAGS)
 	ARCH_GNUEFI		?= aarch64
 	ARCH_SUFFIX		?= aa64
 	ARCH_SUFFIX_UPPER	?= AA64
@@ -91,7 +94,8 @@ ifeq ($(ARCH),aarch64)
 	ARCH_SECTION_ALIGNMENT	?= 0x10000
 endif
 ifeq ($(ARCH),arm)
-	ARCH_CFLAGS		?= -DMDE_CPU_ARM -DPAGE_SIZE=4096 -mno-unaligned-access
+	ARCH_TEST_CFLAGS	?= -DMDE_CPU_ARM -DPAGE_SIZE=4096 -mno-unaligned-access
+	ARCH_CFLAGS		?= $(ARCH_TEST_CFLAGS)
 	ARCH_GNUEFI		?= arm
 	ARCH_SUFFIX		?= arm
 	ARCH_SUFFIX_UPPER	?= ARM
@@ -209,5 +213,7 @@ export VERBOSE
 endif
 
 export DEFINES
+export OPTIMIZATIONS
+export ARCH_CFLAGS
 
 # vim:filetype=make
diff --git a/Makefile b/Makefile
index d7fa2a250..e025566b2 100644
--- a/Makefile
+++ b/Makefile
@@ -254,10 +254,13 @@ gnu-efi/gnuefi/libgnuefi.a gnu-efi/lib/libefi.a:
 		CCC_CC="$(COMPILER)" \
 		CC="$(CC)" \
 		ARCH=$(ARCH_GNUEFI) \
+		OPTIMIZATION_CFLAGS="$(OPTIMIZATIONS)" \
+		DEBUG_CFLAGS="-ggdb -gdwarf-4 -gstrict-dwarf" \
 		NO_GLIBC=1 \
 		TOPDIR=$(TOPDIR)/gnu-efi \
 		VPATH=$(TOPDIR)/gnu-efi \
 		OBJDIR=. \
+		GNU_EFI_EXPORT_MS_ABI=1 \
 		-f $(TOPDIR)/gnu-efi/Makefile \
 		lib gnuefi inc $(IGNORE_COMPILER_ERRORS)
 
@@ -555,5 +558,6 @@ archive: tag
 .PHONY : install-deps shim.key
 
 export ARCH CC CROSS_COMPILE LD OBJCOPY EFI_INCLUDE EFI_INCLUDES OPTIMIZATIONS
+export ARCH_CFLAGS
 export FEATUREFLAGS WARNFLAGS WERRFLAGS
 unexport CFLAGS CPPFLAGS LDFLAGS
diff --git a/elf_x86_64_efi.lds b/elf_x86_64_efi.lds
index 56a1c71bf..efe970d3e 100644
--- a/elf_x86_64_efi.lds
+++ b/elf_x86_64_efi.lds
@@ -40,7 +40,6 @@ SECTIONS
   .data :
   {
    _data = .;
-   *(.rodata*)
    *(.got.plt)
    *(.got)
    *(.data*)
@@ -60,6 +59,13 @@ SECTIONS
    *(.reloc)
   }
 
+  . = ALIGN(4096);
+  .rodata :
+  {
+   _rodata = .;
+   *(.rodata*)
+  }
+
   . = ALIGN(4096);
   .vendor_cert :
   {
diff --git a/gnu-efi b/gnu-efi
index 37cd8f069..ed3ffa376 160000
--- a/gnu-efi
+++ b/gnu-efi
@@ -1 +1 @@
-Subproject commit 37cd8f069bde6715eebdc5e38a8f15ee6de5edcf
+Subproject commit ed3ffa376bbdafa71b75370e6ebedcf6755225e7
diff --git a/include/compiler.h b/include/compiler.h
index 6a19217cb..294a8b5c9 100644
--- a/include/compiler.h
+++ b/include/compiler.h
@@ -255,5 +255,11 @@
                 _ret;                                           \
         })
 
+#if defined(__x86_64__)
+#define SYSVAPI __attribute__((sysv_abi))
+#else
+#define SYSVAPI
+#endif
+
 #endif /* !COMPILER_H_ */
 // vim:fenc=utf-8:tw=75:et
diff --git a/include/test.mk b/include/test.mk
index 7b2338cce..ec009818e 100644
--- a/include/test.mk
+++ b/include/test.mk
@@ -18,8 +18,8 @@ CFLAGS = $(OPTIMIZATIONS) -std=gnu11 \
 	 $(EFI_INCLUDES) \
 	 -Iinclude -iquote . \
 	 -isystem /usr/include \
-	 -isystem $(shell $(CC) $(ARCH_CFLAGS) -print-file-name=include) \
-	 $(ARCH_CFLAGS) \
+	 -isystem $(shell $(CC) $(ARCH_TEST_CFLAGS) -print-file-name=include) \
+	 $(ARCH_TEST_CFLAGS) \
 	 $(CFLAGS_LTO) \
 	 $(CFLAGS_GCOV) \
 	 -fshort-wchar \
@@ -48,13 +48,13 @@ CFLAGS = $(OPTIMIZATIONS) -std=gnu11 \
 
 # On some systems (e.g. Arch Linux), limits.h is in the "include-fixed" instead
 # of the "include" directory
-INCLUDE_FIXED = $(shell $(CC) $(ARCH_CFLAGS) -print-file-name=include-fixed)
+INCLUDE_FIXED = $(shell $(CC) $(ARCH_TEST_CFLAGS) -print-file-name=include-fixed)
 ifneq ($(strip $(INCLUDE_FIXED)),include-fixed)
 CFLAGS += -isystem $(INCLUDE_FIXED)
 endif
 
 # And on Debian also check the multi-arch include path
-MULTIARCH_ISYSTEM = $(if $(findstring gcc,$(CC)),$(shell $(CC) $(ARCH_CFLAGS) -print-multiarch))
+MULTIARCH_ISYSTEM = $(if $(findstring gcc,$(CC)),$(shell $(CC) $(ARCH_TEST_CFLAGS) -print-multiarch))
 ifneq ($(strip $(MULTIARCH_ISYSTEM)),)
 CFLAGS += -isystem /usr/include/$(MULTIARCH_ISYSTEM)
 endif
diff --git a/include/verify.h b/include/verify.h
index 96f4db54b..9cef33155 100644
--- a/include/verify.h
+++ b/include/verify.h
@@ -27,14 +27,14 @@ init_openssl(void);
  * If secure boot is enabled, verify that the provided buffer is signed
  * with a trusted key.
  */
-EFI_STATUS
+SYSVAPI EFI_STATUS
 shim_verify(void *buffer, UINT32 size);
 
-EFI_STATUS
+SYSVAPI EFI_STATUS
 shim_hash(char *data, int datasize, PE_COFF_LOADER_IMAGE_CONTEXT *context,
           UINT8 *sha256hash, UINT8 *sha1hash);
 
-EFI_STATUS
+SYSVAPI EFI_STATUS
 shim_read_header(void *data, unsigned int datasize,
                  PE_COFF_LOADER_IMAGE_CONTEXT *context);
 
diff --git a/lib/Makefile b/lib/Makefile
index ca6420584..1e08098ac 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -41,6 +41,8 @@ LDFLAGS		= -nostdlib -znocombreloc
 CFLAGS		= $(FEATUREFLAGS) \
 		  $(OPTIMIZATIONS) \
 		  $(WARNFLAGS) \
+		  $(if $(findstring clang,$(CC)),$(CLANG_WARNINGS)) \
+		  $(ARCH_CFLAGS) \
 		  $(WERRFLAGS) \
 		  $(INCLUDES) \
 		  $(DEFINES)
diff --git a/pe.c b/pe.c
index 22ad0fe48..952e449ec 100644
--- a/pe.c
+++ b/pe.c
@@ -856,6 +856,13 @@ handle_image (void *data, unsigned int datasize,
 			if (size < Section->Misc.VirtualSize)
 				ZeroMem(base + size, Section->Misc.VirtualSize - size);
 		}
+		char name[9];
+		memcpy(name, Section->Name, 8);
+		name[8] = '\0';
+
+		dprint(L"Loading section %d \"%c%c%c%c%c%c%c%c\" at 0x%lx\n", i,
+		       name[0], name[1], name[2], name[3], name[4], name[5], name[6], name[7],
+		       base);
 	}
 
 	if (context.NumberOfRvaAndSizes <= EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC) {
diff --git a/shim.c b/shim.c
index 2a92d4b73..c0a1f48c0 100644
--- a/shim.c
+++ b/shim.c
@@ -1057,9 +1057,6 @@ shim_fini(void)
 	console_fini();
 }
 
-extern EFI_STATUS
-efi_main(EFI_HANDLE passed_image_handle, EFI_SYSTEM_TABLE *passed_systab);
-
 static void
 __attribute__((__optimize__("0")))
 debug_hook(void)
diff --git a/shim.h b/shim.h
index d3d6aa32a..f3e1ea2f9 100644
--- a/shim.h
+++ b/shim.h
@@ -226,14 +226,14 @@
 INTERFACE_DECL(_SHIM_LOCK);
 
 typedef
-EFI_STATUS
+SYSVAPI EFI_STATUS
 (*EFI_SHIM_LOCK_VERIFY) (
 	IN VOID *buffer,
 	IN UINT32 size
 	);
 
 typedef
-EFI_STATUS
+SYSVAPI EFI_STATUS
 (*EFI_SHIM_LOCK_HASH) (
 	IN char *data,
 	IN int datasize,
@@ -243,7 +243,7 @@ EFI_STATUS
 	);
 
 typedef
-EFI_STATUS
+SYSVAPI EFI_STATUS
 (*EFI_SHIM_LOCK_CONTEXT) (
 	IN VOID *data,
 	IN unsigned int datasize,
diff --git a/verify.c b/verify.c
index 6de675f9c..c414d11de 100644
--- a/verify.c
+++ b/verify.c
@@ -736,7 +736,7 @@ verify_buffer (char *data, int datasize,
  * Protocol entry point. If secure boot is enabled, verify that the provided
  * buffer is signed with a trusted key.
  */
-EFI_STATUS
+SYSVAPI EFI_STATUS
 shim_verify(void *buffer, UINT32 size)
 {
 	EFI_STATUS efi_status = EFI_SUCCESS;
@@ -782,7 +782,7 @@ shim_verify(void *buffer, UINT32 size)
 	return efi_status;
 }
 
-EFI_STATUS
+SYSVAPI EFI_STATUS
 shim_hash(char *data, int datasize, PE_COFF_LOADER_IMAGE_CONTEXT *context,
           UINT8 *sha256hash, UINT8 *sha1hash)
 {
@@ -799,7 +799,7 @@ shim_hash(char *data, int datasize, PE_COFF_LOADER_IMAGE_CONTEXT *context,
 	return efi_status;
 }
 
-EFI_STATUS
+SYSVAPI EFI_STATUS
 shim_read_header(void *data, unsigned int datasize,
                  PE_COFF_LOADER_IMAGE_CONTEXT *context)
 {