diff --git a/src/drivers/net/ipoib.c b/src/drivers/net/ipoib.c
index 47090bb2..812c11c9 100644
--- a/src/drivers/net/ipoib.c
+++ b/src/drivers/net/ipoib.c
@@ -153,21 +153,20 @@ static struct ipoib_mac ipoib_broadcast = {
  * Add IPoIB link-layer header
  *
  * @v iobuf		I/O buffer
- * @v netdev		Network device
- * @v net_protocol	Network-layer protocol
  * @v ll_dest		Link-layer destination address
+ * @v ll_source		Source link-layer address
+ * @v net_proto		Network-layer protocol, in network-byte order
+ * @ret rc		Return status code
  */
-static int ipoib_push ( struct io_buffer *iobuf,
-			struct net_device *netdev __unused,
-			struct net_protocol *net_protocol,
-			const void *ll_dest ) {
+static int ipoib_push ( struct io_buffer *iobuf, const void *ll_dest,
+			const void *ll_source __unused, uint16_t net_proto ) {
 	struct ipoib_hdr *ipoib_hdr =
 		iob_push ( iobuf, sizeof ( *ipoib_hdr ) );
 
 	/* Build IPoIB header */
 	memcpy ( &ipoib_hdr->pseudo.peer, ll_dest,
 		 sizeof ( ipoib_hdr->pseudo.peer ) );
-	ipoib_hdr->real.proto = net_protocol->net_proto;
+	ipoib_hdr->real.proto = net_proto;
 	ipoib_hdr->real.reserved = 0;
 
 	return 0;
@@ -177,14 +176,13 @@ static int ipoib_push ( struct io_buffer *iobuf,
  * Remove IPoIB link-layer header
  *
  * @v iobuf		I/O buffer
- * @v netdev		Network device
- * @v net_proto		Network-layer protocol, in network-byte order
- * @v ll_source		Source link-layer address
+ * @ret ll_dest		Link-layer destination address
+ * @ret ll_source	Source link-layer address
+ * @ret net_proto	Network-layer protocol, in network-byte order
  * @ret rc		Return status code
  */
-static int ipoib_pull ( struct io_buffer *iobuf,
-			struct net_device *netdev __unused,
-			uint16_t *net_proto, const void **ll_source ) {
+static int ipoib_pull ( struct io_buffer *iobuf, const void **ll_dest,
+			const void **ll_source, uint16_t *net_proto ) {
 	struct ipoib_hdr *ipoib_hdr = iobuf->data;
 
 	/* Sanity check */
@@ -198,8 +196,9 @@ static int ipoib_pull ( struct io_buffer *iobuf,
 	iob_pull ( iobuf, sizeof ( *ipoib_hdr ) );
 
 	/* Fill in required fields */
-	*net_proto = ipoib_hdr->real.proto;
+	*ll_dest = &ipoib_broadcast; /* Doesn't really exist in packet */
 	*ll_source = &ipoib_hdr->pseudo.peer;
+	*net_proto = ipoib_hdr->real.proto;
 
 	return 0;
 }
diff --git a/src/include/gpxe/netdevice.h b/src/include/gpxe/netdevice.h
index 3109db83..c4f4a7be 100644
--- a/src/include/gpxe/netdevice.h
+++ b/src/include/gpxe/netdevice.h
@@ -79,34 +79,24 @@ struct ll_protocol {
 	 * Add link-layer header
 	 *
 	 * @v iobuf		I/O buffer
-	 * @v netdev		Network device
-	 * @v net_protocol	Network-layer protocol
 	 * @v ll_dest		Link-layer destination address
+	 * @v ll_source		Source link-layer address
+	 * @v net_proto		Network-layer protocol, in network-byte order
 	 * @ret rc		Return status code
-	 *
-	 * This method should prepend in the link-layer header
-	 * (e.g. the Ethernet DIX header).
 	 */
-	int ( * push ) ( struct io_buffer *iobuf, struct net_device *netdev,
-			 struct net_protocol *net_protocol,
-			 const void *ll_dest );
+	int ( * push ) ( struct io_buffer *iobuf, const void *ll_dest,
+			 const void *ll_source, uint16_t net_proto );
 	/**
 	 * Remove link-layer header
 	 *
-	 * @v iobuf	I/O buffer
-	 * @v netdev	Network device
-	 * @v net_proto	Network-layer protocol, in network-byte order
-	 * @v ll_source	Source link-layer address
-	 * @ret rc	Return status code
-	 *
-	 * This method should strip off the link-layer header
-	 * (e.g. the Ethernet DIX header) and return the protocol and
-	 * source link-layer address.  The method must not alter the
-	 * packet content, and may return the link-layer address as a
-	 * pointer to data within the packet.
+	 * @v iobuf		I/O buffer
+	 * @ret ll_dest		Link-layer destination address
+	 * @ret ll_source	Source link-layer address
+	 * @ret net_proto	Network-layer protocol, in network-byte order
+	 * @ret rc		Return status code
 	 */
-	int ( * pull ) ( struct io_buffer *iobuf, struct net_device *netdev,
-			 uint16_t *net_proto, const void **ll_source );
+	int ( * pull ) ( struct io_buffer *iobuf, const void **ll_dest,
+			 const void **ll_source, uint16_t *net_proto );
 	/**
 	 * Transcribe link-layer address
 	 *
diff --git a/src/interface/pxe/pxe_undi.c b/src/interface/pxe/pxe_undi.c
index 5d06f2d8..f3210629 100644
--- a/src/interface/pxe/pxe_undi.c
+++ b/src/interface/pxe/pxe_undi.c
@@ -199,9 +199,10 @@ PXENV_EXIT_t pxenv_undi_transmit ( struct s_PXENV_UNDI_TRANSMIT
 	struct DataBlk *datablk;
 	struct io_buffer *iobuf;
 	struct net_protocol *net_protocol;
+	struct ll_protocol *ll_protocol = pxe_netdev->ll_protocol;
 	char destaddr[MAX_LL_ADDR_LEN];
 	const void *ll_dest;
-	size_t ll_hlen = pxe_netdev->ll_protocol->ll_header_len;
+	size_t ll_hlen = ll_protocol->ll_header_len;
 	size_t len;
 	unsigned int i;
 	int rc;
@@ -259,17 +260,17 @@ PXENV_EXIT_t pxenv_undi_transmit ( struct s_PXENV_UNDI_TRANSMIT
 			copy_from_real ( destaddr,
 					 undi_transmit->DestAddr.segment,
 					 undi_transmit->DestAddr.offset,
-					 pxe_netdev->ll_protocol->ll_addr_len );
+					 ll_protocol->ll_addr_len );
 			ll_dest = destaddr;
 		} else {
 			DBG ( " BCAST" );
-			ll_dest = pxe_netdev->ll_protocol->ll_broadcast;
+			ll_dest = ll_protocol->ll_broadcast;
 		}
 
 		/* Add link-layer header */
-		if ( ( rc = pxe_netdev->ll_protocol->push ( iobuf, pxe_netdev,
-							    net_protocol,
-							    ll_dest )) != 0 ){
+		if ( ( rc = ll_protocol->push ( iobuf, ll_dest,
+						pxe_netdev->ll_addr,
+						net_protocol->net_proto ))!=0){
 			free_iob ( iobuf );
 			undi_transmit->Status = PXENV_STATUS ( rc );
 			return PXENV_EXIT_FAILURE;
@@ -545,6 +546,7 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 	struct io_buffer *iobuf;
 	size_t len;
 	struct ll_protocol *ll_protocol;
+	const void *ll_dest;
 	const void *ll_source;
 	uint16_t net_proto;
 	size_t ll_hlen;
@@ -625,9 +627,8 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 
 		/* Strip link-layer header */
 		ll_protocol = pxe_netdev->ll_protocol;
-		if ( ( rc = ll_protocol->pull ( iobuf, pxe_netdev,
-						&net_proto,
-						&ll_source ) ) != 0 ) {
+		if ( ( rc = ll_protocol->pull ( iobuf, &ll_dest, &ll_source,
+						&net_proto ) ) != 0 ) {
 			/* Assume unknown net_proto and no ll_source */
 			net_proto = 0;
 			ll_source = NULL;
diff --git a/src/net/ethernet.c b/src/net/ethernet.c
index ebb551f0..3b289705 100644
--- a/src/net/ethernet.c
+++ b/src/net/ethernet.c
@@ -42,19 +42,19 @@ static uint8_t eth_broadcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
  * Add Ethernet link-layer header
  *
  * @v iobuf		I/O buffer
- * @v netdev		Network device
- * @v net_protocol	Network-layer protocol
  * @v ll_dest		Link-layer destination address
+ * @v ll_source		Source link-layer address
+ * @v net_proto		Network-layer protocol, in network-byte order
+ * @ret rc		Return status code
  */
-static int eth_push ( struct io_buffer *iobuf, struct net_device *netdev,
-		      struct net_protocol *net_protocol,
-		      const void *ll_dest ) {
+static int eth_push ( struct io_buffer *iobuf, const void *ll_dest,
+		      const void *ll_source, uint16_t net_proto ) {
 	struct ethhdr *ethhdr = iob_push ( iobuf, sizeof ( *ethhdr ) );
 
 	/* Build Ethernet header */
 	memcpy ( ethhdr->h_dest, ll_dest, ETH_ALEN );
-	memcpy ( ethhdr->h_source, netdev->ll_addr, ETH_ALEN );
-	ethhdr->h_protocol = net_protocol->net_proto;
+	memcpy ( ethhdr->h_source, ll_source, ETH_ALEN );
+	ethhdr->h_protocol = net_proto;
 
 	return 0;
 }
@@ -63,14 +63,13 @@ static int eth_push ( struct io_buffer *iobuf, struct net_device *netdev,
  * Remove Ethernet link-layer header
  *
  * @v iobuf		I/O buffer
- * @v netdev		Network device
- * @v net_proto		Network-layer protocol, in network-byte order
- * @v ll_source		Source link-layer address
+ * @ret ll_dest		Link-layer destination address
+ * @ret ll_source	Source link-layer address
+ * @ret net_proto	Network-layer protocol, in network-byte order
  * @ret rc		Return status code
  */
-static int eth_pull ( struct io_buffer *iobuf,
-		      struct net_device *netdev __unused,
-		      uint16_t *net_proto, const void **ll_source ) {
+static int eth_pull ( struct io_buffer *iobuf, const void **ll_dest,
+		      const void **ll_source, uint16_t *net_proto ) {
 	struct ethhdr *ethhdr = iobuf->data;
 
 	/* Sanity check */
@@ -84,8 +83,9 @@ static int eth_pull ( struct io_buffer *iobuf,
 	iob_pull ( iobuf, sizeof ( *ethhdr ) );
 
 	/* Fill in required fields */
-	*net_proto = ethhdr->h_protocol;
+	*ll_dest = ethhdr->h_dest;
 	*ll_source = ethhdr->h_source;
+	*net_proto = ethhdr->h_protocol;
 
 	return 0;
 }
diff --git a/src/net/netdevice.c b/src/net/netdevice.c
index 3721b334..6ea90b41 100644
--- a/src/net/netdevice.c
+++ b/src/net/netdevice.c
@@ -439,6 +439,7 @@ struct net_device * find_netdev_by_location ( unsigned int bus_type,
  */
 int net_tx ( struct io_buffer *iobuf, struct net_device *netdev,
 	     struct net_protocol *net_protocol, const void *ll_dest ) {
+	struct ll_protocol *ll_protocol = netdev->ll_protocol;
 	int rc;
 
 	/* Force a poll on the netdevice to (potentially) clear any
@@ -449,8 +450,8 @@ int net_tx ( struct io_buffer *iobuf, struct net_device *netdev,
 	netdev_poll ( netdev );
 
 	/* Add link-layer header */
-	if ( ( rc = netdev->ll_protocol->push ( iobuf, netdev, net_protocol,
-						ll_dest ) ) != 0 ) {
+	if ( ( rc = ll_protocol->push ( iobuf, ll_dest, netdev->ll_addr,
+					net_protocol->net_proto ) ) != 0 ) {
 		free_iob ( iobuf );
 		return rc;
 	}
@@ -495,8 +496,9 @@ static void net_step ( struct process *process __unused ) {
 	struct net_device *netdev;
 	struct io_buffer *iobuf;
 	struct ll_protocol *ll_protocol;
-	uint16_t net_proto;
+	const void *ll_dest;
 	const void *ll_source;
+	uint16_t net_proto;
 	int rc;
 
 	/* Poll and process each network device */
@@ -519,9 +521,9 @@ static void net_step ( struct process *process __unused ) {
 
 			/* Remove link-layer header */
 			ll_protocol = netdev->ll_protocol;
-			if ( ( rc = ll_protocol->pull ( iobuf, netdev,
-							&net_proto,
-							&ll_source ) ) != 0 ) {
+			if ( ( rc = ll_protocol->pull ( iobuf, &ll_dest,
+							&ll_source,
+							&net_proto ) ) != 0 ) {
 				free_iob ( iobuf );
 				continue;
 			}