[build] Rename gPXE to iPXE

Access to the gpxe.org and etherboot.org domains and associated
resources has been revoked by the registrant of the domain.  Work
around this problem by renaming project from gPXE to iPXE, and
updating URLs to match.

Also update README, LOG and COPYRIGHTS to remove obsolete information.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

185 files changed, 33572 insertions, 0 deletions

diff --git a/src/include/ipxe/acpi.h b/src/include/ipxe/acpi.h
new file mode 100644
index 0000000..eabbec3
--- /dev/null
+++ b/src/include/ipxe/acpi.h
@@ -0,0 +1,43 @@
+#ifndef _IPXE_ACPI_H
+#define _IPXE_ACPI_H
+
+/** @file
+ *
+ * ACPI data structures
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/**
+ * An ACPI description header
+ *
+ * This is the structure common to the start of all ACPI system
+ * description tables.
+ */
+struct acpi_description_header {
+	/** ACPI signature (4 ASCII characters) */
+	char signature[4];
+	/** Length of table, in bytes, including header */
+	uint32_t length;
+	/** ACPI Specification minor version number */
+	uint8_t revision;
+	/** To make sum of entire table == 0 */
+	uint8_t checksum;
+	/** OEM identification */
+	char oem_id[6];
+	/** OEM table identification */
+	char oem_table_id[8];
+	/** OEM revision number */
+	uint32_t oem_revision;
+	/** ASL compiler vendor ID */
+	char asl_compiler_id[4];
+	/** ASL compiler revision number */
+	uint32_t asl_compiler_revision;
+} __attribute__ (( packed ));
+
+extern void acpi_fix_checksum ( struct acpi_description_header *acpi );
+
+#endif /* _IPXE_ACPI_H */
diff --git a/src/include/ipxe/aes.h b/src/include/ipxe/aes.h
new file mode 100644
index 0000000..5d645b2
--- /dev/null
+++ b/src/include/ipxe/aes.h
@@ -0,0 +1,30 @@
+#ifndef _IPXE_AES_H
+#define _IPXE_AES_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct cipher_algorithm;
+
+/** Basic AES blocksize */
+#define AES_BLOCKSIZE 16
+
+#include "crypto/axtls/crypto.h"
+
+/** AES context */
+struct aes_context {
+	/** AES context for AXTLS */
+	AES_CTX axtls_ctx;
+	/** Cipher is being used for decrypting */
+	int decrypting;
+};
+
+/** AES context size */
+#define AES_CTX_SIZE sizeof ( struct aes_context )
+
+extern struct cipher_algorithm aes_algorithm;
+extern struct cipher_algorithm aes_cbc_algorithm;
+
+int aes_wrap ( const void *kek, const void *src, void *dest, int nblk );
+int aes_unwrap ( const void *kek, const void *src, void *dest, int nblk );
+
+#endif /* _IPXE_AES_H */
diff --git a/src/include/ipxe/ansiesc.h b/src/include/ipxe/ansiesc.h
new file mode 100644
index 0000000..35438e4
--- /dev/null
+++ b/src/include/ipxe/ansiesc.h
@@ -0,0 +1,120 @@
+#ifndef _IPXE_ANSIESC_H
+#define _IPXE_ANSIESC_H
+
+/** @file
+ *
+ * ANSI escape sequences
+ *
+ * ANSI X3.64 (aka ECMA-48 or ISO/IEC 6429, available from
+ * http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-048.pdf)
+ * defines escape sequences consisting of:
+ *
+ *     A Control Sequence Introducer (CSI)
+ *
+ *     Zero or more Parameter Bytes (P)
+ *
+ *     Zero or more Intermediate Bytes (I)
+ *
+ *     A Final Byte (F)
+ *
+ * The CSI consists of ESC (0x1b) followed by "[" (0x5b).  The
+ * Parameter Bytes, for a standardised (i.e. not private or
+ * experimental) sequence, consist of a list of ASCII decimal integers
+ * separated by semicolons.  The Intermediate Bytes (in the range 0x20
+ * to 0x2f) and the Final Byte (in the range 0x40 to 0x4f) determine
+ * the control function.
+ * 
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** A handler for an escape sequence */
+struct ansiesc_handler {
+	/** The control function identifier
+	 *
+	 * The control function identifier consists of the
+	 * Intermediate Bytes (if any) and the Final Byte.  In
+	 * practice, no more than one immediate byte is ever used, so
+	 * the byte combination can be efficiently expressed as a
+	 * single integer, in the obvious way (with the Final Byte
+	 * being the least significant byte).
+	 */
+	unsigned int function;
+	/** Handle escape sequence
+	 *
+	 * @v count		Parameter count
+	 * @v params		Parameter list
+	 *
+	 * A negative parameter value indicates that the parameter was
+	 * omitted and that the default value for this control
+	 * function should be used.
+	 *
+	 * Since all parameters are optional, there is no way to
+	 * distinguish between "zero parameters" and "single parameter
+	 * omitted".  Consequently, the parameter list will always
+	 * contain at least one item.
+	 */
+	void ( * handle ) ( unsigned int count, int params[] );
+};
+
+/** Maximum number of parameters within a single escape sequence */
+#define ANSIESC_MAX_PARAMS 4
+
+/**
+ * ANSI escape sequence context
+ *
+ * This provides temporary storage for processing escape sequences,
+ * and points to the list of escape sequence handlers.
+ */
+struct ansiesc_context {
+	/** Array of handlers
+	 *
+	 * Must be terminated by a handler with @c function set to
+	 * zero.
+	 */
+	struct ansiesc_handler *handlers;
+	/** Parameter count
+	 *
+	 * Will be zero when not currently in an escape sequence.
+	 */
+	unsigned int count;
+	/** Parameter list */ 
+	int params[ANSIESC_MAX_PARAMS];
+	/** Control function identifier */
+	unsigned int function;
+};
+
+/** Escape character */
+#define ESC 0x1b
+
+/** Control Sequence Introducer */
+#define CSI "\033["
+
+/**
+ * @defgroup ansifuncs ANSI escape sequence function identifiers
+ * @{
+ */
+
+/** Cursor position */
+#define ANSIESC_CUP 'H'
+
+/** Erase in page */
+#define ANSIESC_ED 'J'
+
+/** Erase from cursor to end of page */
+#define ANSIESC_ED_TO_END 0
+
+/** Erase from start of page to cursor */
+#define ANSIESC_ED_FROM_START 1
+
+/** Erase whole page */
+#define ANSIESC_ED_ALL 2
+
+/** Select graphic rendition */
+#define ANSIESC_SGR 'm'
+
+/** @} */
+
+extern int ansiesc_process ( struct ansiesc_context *ctx, int c );
+
+#endif /* _IPXE_ANSIESC_H */
diff --git a/src/include/ipxe/aoe.h b/src/include/ipxe/aoe.h
new file mode 100644
index 0000000..d2a1285
--- /dev/null
+++ b/src/include/ipxe/aoe.h
@@ -0,0 +1,150 @@
+#ifndef _IPXE_AOE_H
+#define _IPXE_AOE_H
+
+/** @file
+ *
+ * AoE protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/list.h>
+#include <ipxe/if_ether.h>
+#include <ipxe/retry.h>
+#include <ipxe/ata.h>
+
+/** An AoE config command */
+struct aoecfg {
+	/** AoE Queue depth */
+	uint16_t bufcnt;
+	/** ATA target firmware version */
+	uint16_t fwver;
+	/** ATA target sector count */
+	uint8_t scnt;
+	/** AoE config string subcommand */
+	uint8_t aoeccmd;
+	/** AoE config string length */
+	uint16_t cfglen;
+	/** AoE config string */
+	uint8_t data[0];
+} __attribute__ (( packed ));
+
+/** An AoE ATA command */
+struct aoeata {
+	/** AoE command flags */
+	uint8_t aflags;
+	/** ATA error/feature register */
+	uint8_t err_feat;
+	/** ATA sector count register */
+	uint8_t count;
+	/** ATA command/status register */
+	uint8_t cmd_stat;
+	/** Logical block address, in little-endian order */
+	union {
+		uint64_t u64;
+		uint8_t bytes[6];
+	} lba;
+	/** Data payload */
+	uint8_t data[0];
+} __attribute__ (( packed ));
+
+#define AOE_FL_EXTENDED	0x40	/**< LBA48 extended addressing */
+#define AOE_FL_DEV_HEAD	0x10	/**< Device/head flag */
+#define AOE_FL_ASYNC	0x02	/**< Asynchronous write */
+#define AOE_FL_WRITE	0x01	/**< Write command */
+
+/** An AoE command */
+union aoecmd {
+	/** Config command */
+	struct aoecfg cfg;
+	/** ATA command */
+	struct aoeata ata;
+};
+
+/** An AoE header */
+struct aoehdr {
+	/** Protocol version number and flags */
+	uint8_t ver_flags;
+	/** Error code */
+	uint8_t error;
+	/** Major device number, in network byte order */
+	uint16_t major;
+	/** Minor device number */
+	uint8_t minor;
+	/** Command number */
+	uint8_t command;
+	/** Tag, in network byte order */
+	uint32_t tag;
+	/** Payload */
+	union aoecmd cmd[0];
+} __attribute__ (( packed ));
+
+#define AOE_VERSION	0x10	/**< Version 1 */
+#define AOE_VERSION_MASK 0xf0	/**< Version part of ver_flags field */
+
+#define AOE_FL_RESPONSE	0x08	/**< Message is a response */
+#define AOE_FL_ERROR	0x04	/**< Command generated an error */
+
+#define AOE_MAJOR_BROADCAST 0xffff
+#define AOE_MINOR_BROADCAST 0xff
+
+#define AOE_CMD_ATA	0x00	/**< Issue ATA command */
+#define AOE_CMD_CONFIG	0x01	/**< Query Config Information */
+
+#define AOE_TAG_MAGIC	0xebeb0000
+
+#define AOE_ERR_BAD_COMMAND	1 /**< Unrecognised command code */
+#define AOE_ERR_BAD_PARAMETER	2 /**< Bad argument parameter */
+#define AOE_ERR_UNAVAILABLE	3 /**< Device unavailable */
+#define AOE_ERR_CONFIG_EXISTS	4 /**< Config string present */
+#define AOE_ERR_BAD_VERSION	5 /**< Unsupported version */
+
+/** An AoE session */
+struct aoe_session {
+	/** Reference counter */
+	struct refcnt refcnt;
+
+	/** List of all AoE sessions */
+	struct list_head list;
+
+	/** Network device */
+	struct net_device *netdev;
+
+	/** Major number */
+	uint16_t major;
+	/** Minor number */
+	uint8_t minor;
+	/** Target MAC address */
+	uint8_t target[ETH_ALEN];
+
+	/** Tag for current AoE command */
+	uint32_t tag;
+
+	/** Current AOE command */
+	uint8_t aoe_cmd_type;
+	/** Current ATA command */
+	struct ata_command *command;
+	/** Overall status of current ATA command */
+	unsigned int status;
+	/** Byte offset within command's data buffer */
+	unsigned int command_offset;
+	/** Return status code for command */
+	int rc;
+
+	/** Retransmission timer */
+	struct retry_timer timer;
+};
+
+#define AOE_STATUS_ERR_MASK	0x0f /**< Error portion of status code */ 
+#define AOE_STATUS_PENDING	0x80 /**< Command pending */
+
+/** Maximum number of sectors per packet */
+#define AOE_MAX_COUNT 2
+
+extern void aoe_detach ( struct ata_device *ata );
+extern int aoe_attach ( struct ata_device *ata, struct net_device *netdev,
+			const char *root_path );
+
+#endif /* _IPXE_AOE_H */
diff --git a/src/include/ipxe/api.h b/src/include/ipxe/api.h
new file mode 100644
index 0000000..838b893
--- /dev/null
+++ b/src/include/ipxe/api.h
@@ -0,0 +1,84 @@
+#ifndef _IPXE_API_H
+#define _IPXE_API_H
+
+/** @file
+ *
+ * iPXE internal APIs
+ *
+ * There are various formally-defined APIs internal to iPXE, with
+ * several differing implementations specific to particular execution
+ * environments (e.g. PC BIOS, EFI, LinuxBIOS).
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** @defgroup Single-implementation APIs
+ *
+ * These are APIs for which only a single implementation may be
+ * compiled in at any given time.
+ *
+ * @{
+ */
+
+/**
+ * Calculate function implementation name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ *
+ * The subsystem prefix should be an empty string for the currently
+ * selected subsystem, and should be a subsystem-unique string for all
+ * other subsystems.
+ */
+#define SINGLE_API_NAME( _prefix, _api_func ) _prefix ## _api_func
+
+/**
+ * Calculate static inline function name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ */
+#define SINGLE_API_INLINE( _prefix, _api_func )	\
+	SINGLE_API_NAME ( _prefix, _api_func )
+
+/**
+ * Provide an API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_SINGLE_API( _prefix, _api_func, _func )			      \
+	/* Ensure that _api_func exists */				      \
+	typeof ( _api_func ) _api_func;					      \
+	/* Ensure that _func exists */					      \
+	typeof ( _func ) _func;						      \
+	/* Ensure that _func is type-compatible with _api_func */	      \
+	typeof ( _api_func ) _func;					      \
+	/* Ensure that _subsys_func is non-static */			      \
+	extern typeof ( _api_func ) SINGLE_API_NAME ( _prefix, _api_func );   \
+	/* Provide symbol alias from _subsys_func to _func */		      \
+	typeof ( _api_func ) SINGLE_API_NAME ( _prefix, _api_func )	      \
+		__attribute__ (( alias ( #_func ) ));
+
+/**
+ * Provide a static inline API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ */
+#define PROVIDE_SINGLE_API_INLINE( _prefix, _api_func )			      \
+	/* Ensure that _api_func exists */				      \
+	typeof ( _api_func ) _api_func;					      \
+	/* Ensure that _subsys_func exists and is static */		      \
+	static typeof ( SINGLE_API_INLINE ( _prefix, _api_func ) )	      \
+		SINGLE_API_INLINE ( _prefix, _api_func );		      \
+	/* Ensure that _subsys_func is type-compatible with _api_func */      \
+	typeof ( _api_func ) SINGLE_API_INLINE ( _prefix, _api_func );
+
+/** @} */
+
+#endif /* _IPXE_API_H */
diff --git a/src/include/ipxe/arc4.h b/src/include/ipxe/arc4.h
new file mode 100644
index 0000000..9da972b
--- /dev/null
+++ b/src/include/ipxe/arc4.h
@@ -0,0 +1,22 @@
+#ifndef _IPXE_ARC4_H
+#define _IPXE_ARC4_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct cipher_algorithm;
+
+#include <stdint.h>
+
+struct arc4_ctx {
+	int i, j;
+	u8 state[256];
+};
+
+#define ARC4_CTX_SIZE sizeof ( struct arc4_ctx )
+
+extern struct cipher_algorithm arc4_algorithm;
+
+void arc4_skip ( const void *key, size_t keylen, size_t skip,
+		 const void *src, void *dst, size_t msglen );
+
+#endif /* _IPXE_ARC4_H */
diff --git a/src/include/ipxe/arp.h b/src/include/ipxe/arp.h
new file mode 100644
index 0000000..373a95d
--- /dev/null
+++ b/src/include/ipxe/arp.h
@@ -0,0 +1,46 @@
+#ifndef _IPXE_ARP_H
+#define _IPXE_ARP_H
+
+/** @file
+ *
+ * Address Resolution Protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tables.h>
+
+struct net_device;
+struct net_protocol;
+
+/** A network-layer protocol that relies upon ARP */
+struct arp_net_protocol {
+	/** Network-layer protocol */
+	struct net_protocol *net_protocol;
+	/** Check existence of address
+	 *
+	 * @v netdev	Network device
+	 * @v net_addr	Network-layer address
+	 * @ret rc	Return status code
+	 */
+	int ( * check ) ( struct net_device *netdev,
+			  const void *net_addr );
+};
+
+/** ARP protocol table */
+#define ARP_NET_PROTOCOLS \
+	__table ( struct arp_net_protocol, "arp_net_protocols" )
+
+/** Declare an ARP protocol */
+#define __arp_net_protocol __table_entry ( ARP_NET_PROTOCOLS, 01 )
+
+extern struct net_protocol arp_protocol;
+
+extern int arp_resolve ( struct net_device *netdev,
+			 struct net_protocol *net_protocol,
+			 const void *dest_net_addr,
+			 const void *source_net_addr,
+			 void *dest_ll_addr );
+
+#endif /* _IPXE_ARP_H */
diff --git a/src/include/ipxe/asn1.h b/src/include/ipxe/asn1.h
new file mode 100644
index 0000000..85e480e
--- /dev/null
+++ b/src/include/ipxe/asn1.h
@@ -0,0 +1,34 @@
+#ifndef _IPXE_ASN1_H
+#define _IPXE_ASN1_H
+
+/** @file
+ *
+ * ASN.1 encoding
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#define ASN1_INTEGER 0x02
+#define ASN1_BIT_STRING 0x03
+#define ASN1_OCTET_STRING 0x04
+#define ASN1_NULL 0x05
+#define ASN1_OID 0x06
+#define ASN1_SEQUENCE 0x30
+#define ASN1_IP_ADDRESS 0x40
+#define ASN1_EXPLICIT_TAG 0xa0
+
+/**
+ * A DER-encoded ASN.1 object cursor
+ */
+struct asn1_cursor {
+	/** Start of data */
+	void *data;
+	/** Length of data */
+	size_t len;
+};
+
+extern int asn1_enter ( struct asn1_cursor *cursor, unsigned int type );
+extern int asn1_skip ( struct asn1_cursor *cursor, unsigned int type );
+
+#endif /* _IPXE_ASN1_H */
diff --git a/src/include/ipxe/ata.h b/src/include/ipxe/ata.h
new file mode 100644
index 0000000..043e370
--- /dev/null
+++ b/src/include/ipxe/ata.h
@@ -0,0 +1,209 @@
+#ifndef _IPXE_ATA_H
+#define _IPXE_ATA_H
+
+#include <stdint.h>
+#include <ipxe/blockdev.h>
+#include <ipxe/uaccess.h>
+#include <ipxe/refcnt.h>
+
+/** @file
+ *
+ * ATA devices
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/**
+ * An ATA Logical Block Address
+ *
+ * ATA controllers have three byte-wide registers for specifying the
+ * block address: LBA Low, LBA Mid and LBA High.  This allows for a
+ * 24-bit address.  Some devices support the "48-bit address feature
+ * set" (LBA48), in which case each of these byte-wide registers is
+ * actually a two-entry FIFO, and the "previous" byte pushed into the
+ * FIFO is used as the corresponding high-order byte.  So, to set up
+ * the 48-bit address 0x123456abcdef, you would issue
+ *
+ *     0x56 -> LBA Low register
+ *     0xef -> LBA Low register
+ *     0x34 -> LBA Mid register
+ *     0xcd -> LBA Mid register
+ *     0x12 -> LBA High register
+ *     0xab -> LBA High register
+ *
+ * This structure encapsulates this information by providing a single
+ * 64-bit integer in native byte order, unioned with bytes named so
+ * that the sequence becomes
+ *
+ *     low_prev  -> LBA Low register
+ *     low_cur   -> LBA Low register
+ *     mid_prev  -> LBA Mid register
+ *     mid_cur   -> LBA Mid register
+ *     high_prev -> LBA High register
+ *     high_cur  -> LBA High register
+ *
+ * Just to complicate matters further, in non-LBA48 mode it is
+ * possible to have a 28-bit address, in which case bits 27:24 must be
+ * written into the low four bits of the Device register.
+ */
+union ata_lba {
+	/** LBA as a 64-bit integer in native-endian order */
+	uint64_t native;
+	/** ATA registers */
+	struct {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+		uint8_t low_cur;
+		uint8_t mid_cur;
+		uint8_t high_cur;
+		uint8_t low_prev;
+		uint8_t mid_prev;
+		uint8_t high_prev;
+		uint16_t pad;
+#elif __BYTE_ORDER == __BIG_ENDIAN
+		uint16_t pad;
+		uint8_t high_prev;
+		uint8_t mid_prev;
+		uint8_t low_prev;
+		uint8_t high_cur;
+		uint8_t mid_cur;
+		uint8_t low_cur;
+#else
+#error "I need a byte order"
+#endif
+	} bytes;
+};
+
+/** An ATA 2-byte FIFO register */
+union ata_fifo {
+	/** Value in native-endian order */
+	uint16_t native;
+	/** ATA registers */
+	struct {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+		uint8_t cur;
+		uint8_t prev;
+#elif __BYTE_ORDER == __BIG_ENDIAN
+		uint8_t prev;
+		uint8_t cur;
+#else
+#error "I need a byte order"
+#endif
+	} bytes;
+};
+
+/** ATA command block */
+struct ata_cb {
+	/** Logical block address */
+	union ata_lba lba;
+	/** Sector count */
+	union ata_fifo count;
+	/** Error/feature register */
+	union ata_fifo err_feat;
+	/** Device register */
+	uint8_t device;
+	/** Command/status register */
+	uint8_t cmd_stat;
+	/** LBA48 addressing flag */
+	int lba48;
+};
+
+/** Obsolete bits in the ATA device register */
+#define ATA_DEV_OBSOLETE 0xa0
+
+/** LBA flag in the ATA device register */
+#define ATA_DEV_LBA 0x40
+
+/** Slave ("device 1") flag in the ATA device register */
+#define ATA_DEV_SLAVE 0x10
+
+/** Master ("device 0") flag in the ATA device register */
+#define ATA_DEV_MASTER 0x00
+
+/** Mask of non-LBA portion of device register */
+#define ATA_DEV_MASK 0xf0
+
+/** "Read sectors" command */
+#define ATA_CMD_READ 0x20
+
+/** "Read sectors (ext)" command */
+#define ATA_CMD_READ_EXT 0x24
+
+/** "Write sectors" command */
+#define ATA_CMD_WRITE 0x30
+
+/** "Write sectors (ext)" command */
+#define ATA_CMD_WRITE_EXT 0x34
+
+/** "Identify" command */
+#define ATA_CMD_IDENTIFY 0xec
+
+/** An ATA command */
+struct ata_command {
+	/** ATA command block */
+	struct ata_cb cb;
+	/** Data-out buffer (may be NULL)
+	 *
+	 * If non-NULL, this buffer must be ata_command::cb::count
+	 * sectors in size.
+	 */
+	userptr_t data_out;
+	/** Data-in buffer (may be NULL)
+	 *
+	 * If non-NULL, this buffer must be ata_command::cb::count
+	 * sectors in size.
+	 */
+	userptr_t data_in;
+	/** Command status code */
+	int rc;
+};
+
+/**
+ * Structure returned by ATA IDENTIFY command
+ *
+ * This is a huge structure with many fields that we don't care about,
+ * so we implement only a few fields.
+ */
+struct ata_identity {
+	uint16_t ignore_a[60]; /* words 0-59 */
+	uint32_t lba_sectors; /* words 60-61 */
+	uint16_t ignore_b[21]; /* words 62-82 */
+	uint16_t supports_lba48; /* word 83 */
+	uint16_t ignore_c[16]; /* words 84-99 */
+	uint64_t lba48_sectors; /* words 100-103 */
+	uint16_t ignore_d[152]; /* words 104-255 */
+};
+
+/** Supports LBA48 flag */
+#define ATA_SUPPORTS_LBA48 ( 1 << 10 )
+
+/** ATA sector size */
+#define ATA_SECTOR_SIZE 512
+
+/** An ATA device */
+struct ata_device {
+	/** Block device interface */
+	struct block_device blockdev;
+	/** Device number
+	 *
+	 * Must be ATA_DEV_MASTER or ATA_DEV_SLAVE.
+	 */
+	int device;
+	/** LBA48 extended addressing */
+	int lba48;
+	/**
+	 * Issue ATA command
+	 *
+	 * @v ata		ATA device
+	 * @v command		ATA command
+	 * @ret rc		Return status code
+	 */
+	int ( * command ) ( struct ata_device *ata,
+			    struct ata_command *command );
+	/** Backing device */
+	struct refcnt *backend;
+};
+
+extern int init_atadev ( struct ata_device *ata );
+
+#endif /* _IPXE_ATA_H */
diff --git a/src/include/ipxe/base64.h b/src/include/ipxe/base64.h
new file mode 100644
index 0000000..1295941
--- /dev/null
+++ b/src/include/ipxe/base64.h
@@ -0,0 +1,26 @@
+#ifndef _IPXE_BASE64_H
+#define _IPXE_BASE64_H
+
+/** @file
+ *
+ * Base64 encoding
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/**
+ * Calculate length of base64-encoded string
+ *
+ * @v raw_len		Raw string length (excluding NUL)
+ * @ret encoded_len	Encoded string length (excluding NUL)
+ */
+static inline size_t base64_encoded_len ( size_t raw_len ) {
+	return ( ( ( raw_len + 3 - 1 ) / 3 ) * 4 );
+}
+
+extern void base64_encode ( const char *raw, char *encoded );
+
+#endif /* _IPXE_BASE64_H */
diff --git a/src/include/ipxe/bitbash.h b/src/include/ipxe/bitbash.h
new file mode 100644
index 0000000..62b54b1
--- /dev/null
+++ b/src/include/ipxe/bitbash.h
@@ -0,0 +1,52 @@
+#ifndef _IPXE_BITBASH_H
+#define _IPXE_BITBASH_H
+
+/** @file
+ *
+ * Bit-bashing interfaces
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct bit_basher;
+
+/** Bit-bashing operations */
+struct bit_basher_operations {
+	/**
+	 * Set/clear output bit
+	 *
+	 * @v basher		Bit-bashing interface
+	 * @v bit_id		Bit number
+	 * @v data		Value to write
+	 * 
+	 * @c data will be 0 if a logic 0 should be written (i.e. the
+	 * bit should be cleared), or -1UL if a logic 1 should be
+	 * written (i.e. the bit should be set).  This is done so that
+	 * the method may simply binary-AND @c data with the
+	 * appropriate bit mask.
+	 */
+	void ( * write ) ( struct bit_basher *basher, unsigned int bit_id,
+			   unsigned long data );
+	/**
+	 * Read input bit
+	 *
+	 * @v basher		Bit-bashing interface
+	 * @v bit_id		Bit number
+	 * @ret zero		Input is a logic 0
+	 * @ret non-zero	Input is a logic 1
+	 */
+	int ( * read ) ( struct bit_basher *basher, unsigned int bit_id );
+};
+
+/** A bit-bashing interface */
+struct bit_basher {
+	/** Bit-bashing operations */
+	struct bit_basher_operations *op;
+};
+
+extern void write_bit ( struct bit_basher *basher, unsigned int bit_id,
+			unsigned long data );
+extern int read_bit ( struct bit_basher *basher, unsigned int bit_id );
+
+#endif /* _IPXE_BITBASH_H */
diff --git a/src/include/ipxe/bitmap.h b/src/include/ipxe/bitmap.h
new file mode 100644
index 0000000..38d1f22
--- /dev/null
+++ b/src/include/ipxe/bitmap.h
@@ -0,0 +1,85 @@
+#ifndef _IPXE_BITMAP_H
+#define _IPXE_BITMAP_H
+
+/** @file
+ *
+ * Bitmaps for multicast downloads
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+/** A single block of bits within a bitmap */
+typedef unsigned long bitmap_block_t;
+
+/** Size of a block of bits (in bits) */
+#define BITMAP_BLKSIZE ( sizeof ( bitmap_block_t ) * 8 )
+
+/**
+ * Block index within bitmap
+ *
+ * @v bit		Bit index
+ * @ret index		Block index
+ */
+#define BITMAP_INDEX( bit ) ( (bit) / BITMAP_BLKSIZE )
+
+/**
+ * Block mask within bitmap
+ *
+ * @v bit		Bit index
+ * @ret mask		Block mask
+ */
+#define BITMAP_MASK( bit ) ( 1 << ( (bit) % BITMAP_BLKSIZE ) )
+
+/** A bitmap */
+struct bitmap {
+	/** Bitmap data */
+	bitmap_block_t *blocks;
+	/** Length of the bitmap, in bits */
+	unsigned int length;
+	/** Index of first gap in the bitmap */
+	unsigned int first_gap;
+};
+
+extern int bitmap_resize ( struct bitmap *bitmap, unsigned int new_length );
+extern int bitmap_test ( struct bitmap *bitmap, unsigned int bit );
+extern void bitmap_set ( struct bitmap *bitmap, unsigned int bit );
+
+/**
+ * Free bitmap resources
+ *
+ * @v bitmap		Bitmap
+ */
+static inline void bitmap_free ( struct bitmap *bitmap ) {
+	free ( bitmap->blocks );
+}
+
+/**
+ * Get first gap within bitmap
+ *
+ * @v bitmap		Bitmap
+ * @ret first_gap	First gap
+ *
+ * The first gap is the first unset bit within the bitmap.
+ */
+static inline unsigned int bitmap_first_gap ( struct bitmap *bitmap ) {
+	return bitmap->first_gap;
+}
+
+/**
+ * Check to see if bitmap is full
+ *
+ * @v bitmap		Bitmap
+ * @ret is_full		Bitmap is full
+ *
+ * The bitmap is full if it has no gaps (i.e. no unset bits).
+ */
+static inline int bitmap_full ( struct bitmap *bitmap ) {
+	return ( bitmap->first_gap == bitmap->length );
+}
+
+#endif /* _IPXE_BITMAP_H */
diff --git a/src/include/ipxe/bitops.h b/src/include/ipxe/bitops.h
new file mode 100644
index 0000000..0599168
--- /dev/null
+++ b/src/include/ipxe/bitops.h
@@ -0,0 +1,230 @@
+#ifndef _IPXE_BITOPS_H
+#define _IPXE_BITOPS_H
+
+/*
+ * Copyright (C) 2008 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/**
+ * @file
+ *
+ * Bit operations
+ *
+ */
+
+#include <stdint.h>
+#include <byteswap.h>
+
+/* Endianness selection.
+ *
+ * This is a property of the NIC, not a property of the host CPU.
+ */
+#ifdef BITOPS_LITTLE_ENDIAN
+#define cpu_to_BIT64	cpu_to_le64
+#define cpu_to_BIT32	cpu_to_le32
+#define BIT64_to_cpu	le64_to_cpu
+#define BIT32_to_cpu	le32_to_cpu
+#endif
+#ifdef BITOPS_BIG_ENDIAN
+#define cpu_to_BIT64	cpu_to_be64
+#define cpu_to_BIT32	cpu_to_be32
+#define BIT64_to_cpu	be64_to_cpu
+#define BIT32_to_cpu	be32_to_cpu
+#endif
+
+/** Datatype used to represent a bit in the pseudo-structures */
+typedef unsigned char pseudo_bit_t;
+
+/**
+ * Wrapper structure for pseudo_bit_t structures
+ *
+ * This structure provides a wrapper around pseudo_bit_t structures.
+ * It has the correct size, and also encapsulates type information
+ * about the underlying pseudo_bit_t-based structure, which allows the
+ * BIT_FILL() etc. macros to work without requiring explicit type
+ * information.
+ */
+#define PSEUDO_BIT_STRUCT( _structure )					      \
+	union {								      \
+		uint8_t bytes[ sizeof ( _structure ) / 8 ];		      \
+		uint32_t dwords[ sizeof ( _structure ) / 32 ];		      \
+		uint64_t qwords[ sizeof ( _structure ) / 64 ];		      \
+		_structure *dummy[0];					      \
+	} u
+
+/** Get pseudo_bit_t structure type from wrapper structure pointer */
+#define PSEUDO_BIT_STRUCT_TYPE( _ptr )					      \
+	typeof ( *((_ptr)->u.dummy[0]) )
+
+/** Bit offset of a field within a pseudo_bit_t structure */
+#define BIT_OFFSET( _ptr, _field )					      \
+	offsetof ( PSEUDO_BIT_STRUCT_TYPE ( _ptr ), _field )
+
+/** Bit width of a field within a pseudo_bit_t structure */
+#define BIT_WIDTH( _ptr, _field )					      \
+	sizeof ( ( ( PSEUDO_BIT_STRUCT_TYPE ( _ptr ) * ) NULL )->_field )
+
+/** Qword offset of a field within a pseudo_bit_t structure */
+#define QWORD_OFFSET( _ptr, _field )					      \
+	( BIT_OFFSET ( _ptr, _field ) / 64 )
+
+/** Qword bit offset of a field within a pseudo_bit_t structure */
+#define QWORD_BIT_OFFSET( _ptr, _index, _field )			      \
+	( BIT_OFFSET ( _ptr, _field ) - ( 64 * (_index) ) )
+
+/** Bit mask for a field within a pseudo_bit_t structure */
+#define BIT_MASK( _ptr, _field )					      \
+	( ( ~( ( uint64_t ) 0 ) ) >>					      \
+	  ( 64 - BIT_WIDTH ( _ptr, _field ) ) )
+
+/*
+ * Assemble native-endian qword from named fields and values
+ *
+ */
+
+#define BIT_ASSEMBLE_1( _ptr, _index, _field, _value )			      \
+	( ( ( uint64_t) (_value) ) <<					      \
+	  QWORD_BIT_OFFSET ( _ptr, _index, _field ) )
+
+#define BIT_ASSEMBLE_2( _ptr, _index, _field, _value, ... )		      \
+	( BIT_ASSEMBLE_1 ( _ptr, _index, _field, _value ) |		      \
+	  BIT_ASSEMBLE_1 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_ASSEMBLE_3( _ptr, _index, _field, _value, ... )		      \
+	( BIT_ASSEMBLE_1 ( _ptr, _index, _field, _value ) |		      \
+	  BIT_ASSEMBLE_2 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_ASSEMBLE_4( _ptr, _index, _field, _value, ... )		      \
+	( BIT_ASSEMBLE_1 ( _ptr, _index, _field, _value ) |		      \
+	  BIT_ASSEMBLE_3 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_ASSEMBLE_5( _ptr, _index, _field, _value, ... )		      \
+	( BIT_ASSEMBLE_1 ( _ptr, _index, _field, _value ) |		      \
+	  BIT_ASSEMBLE_4 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_ASSEMBLE_6( _ptr, _index, _field, _value, ... )		      \
+	( BIT_ASSEMBLE_1 ( _ptr, _index, _field, _value ) |		      \
+	  BIT_ASSEMBLE_5 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_ASSEMBLE_7( _ptr, _index, _field, _value, ... )		      \
+	( BIT_ASSEMBLE_1 ( _ptr, _index, _field, _value ) |		      \
+	  BIT_ASSEMBLE_6 ( _ptr, _index, __VA_ARGS__ ) )
+
+/*
+ * Build native-endian (positive) qword bitmasks from named fields
+ *
+ */
+
+#define BIT_MASK_1( _ptr, _index, _field )				      \
+	( BIT_MASK ( _ptr, _field ) <<					      \
+	  QWORD_BIT_OFFSET ( _ptr, _index, _field ) )
+
+#define BIT_MASK_2( _ptr, _index, _field, ... )				      \
+	( BIT_MASK_1 ( _ptr, _index, _field ) |				      \
+	  BIT_MASK_1 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_MASK_3( _ptr, _index, _field, ... )				      \
+	( BIT_MASK_1 ( _ptr, _index, _field ) |				      \
+	  BIT_MASK_2 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_MASK_4( _ptr, _index, _field, ... )				      \
+	( BIT_MASK_1 ( _ptr, _index, _field ) |				      \
+	  BIT_MASK_3 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_MASK_5( _ptr, _index, _field, ... )				      \
+	( BIT_MASK_1 ( _ptr, _index, _field ) |				      \
+	  BIT_MASK_4 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_MASK_6( _ptr, _index, _field, ... )				      \
+	( BIT_MASK_1 ( _ptr, _index, _field ) |				      \
+	  BIT_MASK_5 ( _ptr, _index, __VA_ARGS__ ) )
+
+#define BIT_MASK_7( _ptr, _index, _field, ... )				      \
+	( BIT_MASK_1 ( _ptr, _index, _field ) |				      \
+	  BIT_MASK_6 ( _ptr, _index, __VA_ARGS__ ) )
+
+/*
+ * Populate little-endian qwords from named fields and values
+ *
+ */
+
+#define BIT_FILL( _ptr, _index, _assembled ) do {			      \
+		uint64_t *__ptr = &(_ptr)->u.qwords[(_index)];		      \
+		uint64_t __assembled = (_assembled);			      \
+		*__ptr = cpu_to_BIT64 ( __assembled );			      \
+	} while ( 0 )
+
+#define BIT_FILL_1( _ptr, _field1, ... )				      \
+	BIT_FILL ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),		      \
+		   BIT_ASSEMBLE_1 ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),     \
+				    _field1, __VA_ARGS__ ) )
+
+#define BIT_FILL_2( _ptr, _field1, ... )				      \
+	BIT_FILL ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),		      \
+		   BIT_ASSEMBLE_2 ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),     \
+				    _field1, __VA_ARGS__ ) )
+
+#define BIT_FILL_3( _ptr, _field1, ... )				      \
+	BIT_FILL ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),		      \
+		   BIT_ASSEMBLE_3 ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),     \
+				    _field1, __VA_ARGS__ ) )
+
+#define BIT_FILL_4( _ptr, _field1, ... )				      \
+	BIT_FILL ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),		      \
+		   BIT_ASSEMBLE_4 ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),     \
+				    _field1, __VA_ARGS__ ) )
+
+#define BIT_FILL_5( _ptr, _field1, ... )				      \
+	BIT_FILL ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),		      \
+		   BIT_ASSEMBLE_5 ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),     \
+				    _field1, __VA_ARGS__ ) )
+
+#define BIT_FILL_6( _ptr, _field1, ... )				      \
+	BIT_FILL ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),		      \
+		   BIT_ASSEMBLE_6 ( _ptr, QWORD_OFFSET ( _ptr, _field1 ),     \
+				    _field1, __VA_ARGS__ ) )
+
+/** Extract value of named field */
+#define BIT_GET64( _ptr, _field )					      \
+	( {								      \
+		unsigned int __index = QWORD_OFFSET ( _ptr, _field );	      \
+		uint64_t *__ptr = &(_ptr)->u.qwords[__index];		      \
+		uint64_t __value = BIT64_to_cpu ( *__ptr );		      \
+		__value >>=						      \
+		    QWORD_BIT_OFFSET ( _ptr, __index, _field );		      \
+		__value &= BIT_MASK ( _ptr, _field );			      \
+		__value;						      \
+	} )
+
+/** Extract value of named field (for fields up to the size of a long) */
+#define BIT_GET( _ptr, _field )						      \
+	( ( unsigned long ) BIT_GET64 ( _ptr, _field ) )
+
+#define BIT_SET( _ptr, _field, _value ) do {				      \
+		unsigned int __index = QWORD_OFFSET ( _ptr, _field );	      \
+		uint64_t *__ptr = &(_ptr)->u.qwords[__index];		      \
+		unsigned int __shift =					      \
+			QWORD_BIT_OFFSET ( _ptr, __index, _field );	      \
+		uint64_t __value = (_value);				      \
+		*__ptr &= cpu_to_BIT64 ( ~( BIT_MASK ( _ptr, _field ) <<      \
+					    __shift ) );		      \
+		*__ptr |= cpu_to_BIT64 ( __value << __shift );		      \
+	} while ( 0 )
+
+#endif /* _IPXE_BITOPS_H */
diff --git a/src/include/ipxe/blockdev.h b/src/include/ipxe/blockdev.h
new file mode 100644
index 0000000..5c1ab13
--- /dev/null
+++ b/src/include/ipxe/blockdev.h
@@ -0,0 +1,53 @@
+#ifndef _IPXE_BLOCKDEV_H
+#define _IPXE_BLOCKDEV_H
+
+/**
+ * @file
+ *
+ * Block devices
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/uaccess.h>
+
+struct block_device;
+
+/** Block device operations */
+struct block_device_operations {
+	/**
+	 * Read block
+	 *
+	 * @v blockdev	Block device
+	 * @v block	Block number
+	 * @v count	Block count
+	 * @v buffer	Data buffer
+	 * @ret rc	Return status code
+	 */
+	int ( * read ) ( struct block_device *blockdev, uint64_t block,
+			 unsigned long count, userptr_t buffer );
+	/**
+	 * Write block
+	 *
+	 * @v blockdev	Block device
+	 * @v block	Block number
+	 * @v count	Block count
+	 * @v buffer	Data buffer
+	 * @ret rc	Return status code
+	 */
+	int ( * write ) ( struct block_device *blockdev, uint64_t block,
+			  unsigned long count, userptr_t buffer );
+};
+
+/** A block device */
+struct block_device {
+	/** Block device operations */
+	struct block_device_operations *op;
+	/** Block size */
+	size_t blksize;
+	/** Total number of blocks */
+	uint64_t blocks;
+};
+
+#endif /* _IPXE_BLOCKDEV_H */
diff --git a/src/include/ipxe/cbc.h b/src/include/ipxe/cbc.h
new file mode 100644
index 0000000..fae3765
--- /dev/null
+++ b/src/include/ipxe/cbc.h
@@ -0,0 +1,100 @@
+#ifndef _IPXE_CBC_H
+#define _IPXE_CBC_H
+
+/** @file
+ *
+ * Cipher-block chaining
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/crypto.h>
+
+/**
+ * Set key
+ *
+ * @v ctx		Context
+ * @v key		Key
+ * @v keylen		Key length
+ * @v raw_cipher	Underlying cipher algorithm
+ * @v cbc_ctx		CBC context
+ * @ret rc		Return status code
+ */
+static inline int cbc_setkey ( void *ctx, const void *key, size_t keylen,
+			       struct cipher_algorithm *raw_cipher,
+			       void *cbc_ctx __unused ) {
+
+	return cipher_setkey ( raw_cipher, ctx, key, keylen );
+}
+
+/**
+ * Set initialisation vector
+ *
+ * @v ctx		Context
+ * @v iv		Initialisation vector
+ * @v raw_cipher	Underlying cipher algorithm
+ * @v cbc_ctx		CBC context
+ */
+static inline void cbc_setiv ( void *ctx __unused, const void *iv,
+			       struct cipher_algorithm *raw_cipher,
+			       void *cbc_ctx ) {
+	memcpy ( cbc_ctx, iv, raw_cipher->blocksize );
+}
+
+extern void cbc_encrypt ( void *ctx, const void *src, void *dst,
+			  size_t len, struct cipher_algorithm *raw_cipher,
+			  void *cbc_ctx );
+extern void cbc_decrypt ( void *ctx, const void *src, void *dst,
+			  size_t len, struct cipher_algorithm *raw_cipher,
+			  void *cbc_ctx );
+
+/**
+ * Create a cipher-block chaining mode of behaviour of an existing cipher
+ *
+ * @v _cbc_name		Name for the new CBC cipher
+ * @v _cbc_cipher	New cipher algorithm
+ * @v _raw_cipher	Underlying cipher algorithm
+ * @v _raw_context	Context structure for the underlying cipher
+ * @v _blocksize	Cipher block size
+ */
+#define CBC_CIPHER( _cbc_name, _cbc_cipher, _raw_cipher, _raw_context,	\
+		    _blocksize )					\
+struct _cbc_name ## _context {						\
+	_raw_context raw_ctx;						\
+	uint8_t cbc_ctx[_blocksize];					\
+};									\
+static int _cbc_name ## _setkey ( void *ctx, const void *key,		\
+				  size_t keylen ) {			\
+	struct _cbc_name ## _context * _cbc_name ## _ctx = ctx;		\
+	return cbc_setkey ( &_cbc_name ## _ctx->raw_ctx, key, keylen,	\
+			    &_raw_cipher, &_cbc_name ## _ctx->cbc_ctx );\
+}									\
+static void _cbc_name ## _setiv ( void *ctx, const void *iv ) {		\
+	struct _cbc_name ## _context * _cbc_name ## _ctx = ctx;		\
+	cbc_setiv ( &_cbc_name ## _ctx->raw_ctx, iv,			\
+		    &_raw_cipher, &aes_cbc_ctx->cbc_ctx );		\
+}									\
+static void _cbc_name ## _encrypt ( void *ctx, const void *src,		\
+				    void *dst, size_t len ) {		\
+	struct _cbc_name ## _context * _cbc_name ## _ctx = ctx;		\
+	cbc_encrypt ( &_cbc_name ## _ctx->raw_ctx, src, dst, len,	\
+		      &_raw_cipher, &aes_cbc_ctx->cbc_ctx );		\
+}									\
+static void _cbc_name ## _decrypt ( void *ctx, const void *src,		\
+				    void *dst, size_t len ) {		\
+	struct _cbc_name ## _context * _cbc_name ## _ctx = ctx;		\
+	cbc_decrypt ( &_cbc_name ## _ctx->raw_ctx, src, dst, len,	\
+		      &_raw_cipher, &aes_cbc_ctx->cbc_ctx );		\
+}									\
+struct cipher_algorithm _cbc_cipher = {					\
+	.name		= #_cbc_name,					\
+	.ctxsize	= sizeof ( struct _cbc_name ## _context ),	\
+	.blocksize	= _blocksize,					\
+	.setkey		= _cbc_name ## _setkey,				\
+	.setiv		= _cbc_name ## _setiv,				\
+	.encrypt	= _cbc_name ## _encrypt,			\
+	.decrypt	= _cbc_name ## _decrypt,			\
+};
+
+#endif /* _IPXE_CBC_H */
diff --git a/src/include/ipxe/chap.h b/src/include/ipxe/chap.h
new file mode 100644
index 0000000..fce48f3
--- /dev/null
+++ b/src/include/ipxe/chap.h
@@ -0,0 +1,53 @@
+#ifndef _IPXE_CHAP_H
+#define _IPXE_CHAP_H
+
+/** @file
+ *
+ * CHAP protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/md5.h>
+
+struct digest_algorithm;
+
+/** A CHAP response */
+struct chap_response {
+	/** Digest algorithm used for the response */
+	struct digest_algorithm *digest;
+	/** Context used by the digest algorithm */
+	uint8_t *digest_context;
+	/** CHAP response */
+	uint8_t *response;
+	/** Length of CHAP response */
+	size_t response_len;
+};
+
+extern int chap_init ( struct chap_response *chap,
+		       struct digest_algorithm *digest );
+extern void chap_update ( struct chap_response *chap, const void *data,
+			  size_t len );
+extern void chap_respond ( struct chap_response *chap );
+extern void chap_finish ( struct chap_response *chap );
+
+/**
+ * Add identifier data to the CHAP challenge
+ *
+ * @v chap		CHAP response
+ * @v identifier	CHAP identifier
+ *
+ * The CHAP identifier is the first byte of the CHAP challenge.  This
+ * function is a notational convenience for calling chap_update() for
+ * the identifier byte.
+ */
+static inline void chap_set_identifier ( struct chap_response *chap,
+					 unsigned int identifier ) {
+	uint8_t ident_byte = identifier;
+
+	chap_update ( chap, &ident_byte, sizeof ( ident_byte ) );
+}
+
+#endif /* _IPXE_CHAP_H */
diff --git a/src/include/ipxe/command.h b/src/include/ipxe/command.h
new file mode 100644
index 0000000..a7d0ae4
--- /dev/null
+++ b/src/include/ipxe/command.h
@@ -0,0 +1,26 @@
+#ifndef _IPXE_COMMAND_H
+#define _IPXE_COMMAND_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tables.h>
+
+/** A command-line command */
+struct command {
+	/** Name of the command */
+	const char *name;
+	/**
+	 * Function implementing the command
+	 *
+	 * @v argc		Argument count
+	 * @v argv		Argument list
+	 * @ret rc		Return status code
+	 */
+	int ( * exec ) ( int argc, char **argv );
+};
+
+#define COMMANDS __table ( struct command, "commands" )
+
+#define __command __table_entry ( COMMANDS, 01 )
+
+#endif /* _IPXE_COMMAND_H */
diff --git a/src/include/ipxe/cpio.h b/src/include/ipxe/cpio.h
new file mode 100644
index 0000000..2772328
--- /dev/null
+++ b/src/include/ipxe/cpio.h
@@ -0,0 +1,53 @@
+#ifndef _IPXE_CPIO_H
+#define _IPXE_CPIO_H
+
+/** @file
+ *
+ * CPIO archives
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** A CPIO archive header
+ *
+ * All field are hexadecimal ASCII numbers padded with '0' on the
+ * left to the full width of the field.
+ */
+struct cpio_header {
+	/** The string "070701" or "070702" */
+	char c_magic[6];
+	/** File inode number */
+	char c_ino[8];
+	/** File mode and permissions */
+	char c_mode[8];
+	/** File uid */
+	char c_uid[8];
+	/** File gid */
+	char c_gid[8];
+	/** Number of links */
+	char c_nlink[8];
+	/** Modification time */
+	char c_mtime[8];
+	/** Size of data field */
+	char c_filesize[8];
+	/** Major part of file device number */
+	char c_maj[8];
+	/** Minor part of file device number */
+	char c_min[8];
+	/** Major part of device node reference */
+	char c_rmaj[8];
+	/** Minor part of device node reference */
+	char c_rmin[8];
+	/** Length of filename, including final NUL */
+	char c_namesize[8];
+	/** Checksum of data field if c_magic is 070702, othersize zero */
+	char c_chksum[8];
+} __attribute__ (( packed ));
+
+/** CPIO magic */
+#define CPIO_MAGIC "070701"
+
+extern void cpio_set_field ( char *field, unsigned long value );
+
+#endif /* _IPXE_CPIO_H */
diff --git a/src/include/ipxe/crc32.h b/src/include/ipxe/crc32.h
new file mode 100644
index 0000000..38ac1b3
--- /dev/null
+++ b/src/include/ipxe/crc32.h
@@ -0,0 +1,10 @@
+#ifndef _IPXE_CRC32_H
+#define _IPXE_CRC32_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+u32 crc32_le ( u32 seed, const void *data, size_t len );
+
+#endif
diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h
new file mode 100644
index 0000000..9383c07
--- /dev/null
+++ b/src/include/ipxe/crypto.h
@@ -0,0 +1,156 @@
+#ifndef _IPXE_CRYPTO_H
+#define _IPXE_CRYPTO_H
+
+/** @file
+ *
+ * Cryptographic API
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <stddef.h>
+
+/** A message digest algorithm */
+struct digest_algorithm {
+	/** Algorithm name */
+	const char *name;
+	/** Context size */
+	size_t ctxsize;
+	/** Block size */
+	size_t blocksize;
+	/** Digest size */
+	size_t digestsize;
+	/** Initialise digest
+	 *
+	 * @v ctx		Context
+	 */
+	void ( * init ) ( void *ctx );
+	/** Update digest with new data
+	 *
+	 * @v ctx		Context
+	 * @v src		Data to digest
+	 * @v len		Length of data
+	 *
+	 * @v len is not necessarily a multiple of @c blocksize.
+	 */
+	void ( * update ) ( void *ctx, const void *src, size_t len );
+	/** Finalise digest
+	 *
+	 * @v ctx		Context
+	 * @v out		Buffer for digest output
+	 */
+	void ( * final ) ( void *ctx, void *out );
+};
+
+/** A cipher algorithm */
+struct cipher_algorithm {
+	/** Algorithm name */
+	const char *name;
+	/** Context size */
+	size_t ctxsize;
+	/** Block size */
+	size_t blocksize;
+	/** Set key
+	 *
+	 * @v ctx		Context
+	 * @v key		Key
+	 * @v keylen		Key length
+	 * @ret rc		Return status code
+	 */
+	int ( * setkey ) ( void *ctx, const void *key, size_t keylen );
+	/** Set initialisation vector
+	 *
+	 * @v ctx		Context
+	 * @v iv		Initialisation vector
+	 */
+	void ( * setiv ) ( void *ctx, const void *iv );
+	/** Encrypt data
+	 *
+	 * @v ctx		Context
+	 * @v src		Data to encrypt
+	 * @v dst		Buffer for encrypted data
+	 * @v len		Length of data
+	 *
+	 * @v len is guaranteed to be a multiple of @c blocksize.
+	 */
+	void ( * encrypt ) ( void *ctx, const void *src, void *dst,
+			     size_t len );
+	/** Decrypt data
+	 *
+	 * @v ctx		Context
+	 * @v src		Data to decrypt
+	 * @v dst		Buffer for decrypted data
+	 * @v len		Length of data
+	 *
+	 * @v len is guaranteed to be a multiple of @c blocksize.
+	 */
+	void ( * decrypt ) ( void *ctx, const void *src, void *dst,
+			     size_t len );
+};
+
+/** A public key algorithm */
+struct pubkey_algorithm {
+	/** Algorithm name */
+	const char *name;
+	/** Context size */
+	size_t ctxsize;
+};
+
+static inline void digest_init ( struct digest_algorithm *digest,
+				 void *ctx ) {
+	digest->init ( ctx );
+}
+
+static inline void digest_update ( struct digest_algorithm *digest,
+				   void *ctx, const void *data, size_t len ) {
+	digest->update ( ctx, data, len );
+}
+
+static inline void digest_final ( struct digest_algorithm *digest,
+				  void *ctx, void *out ) {
+	digest->final ( ctx, out );
+}
+
+static inline int cipher_setkey ( struct cipher_algorithm *cipher,
+				  void *ctx, const void *key, size_t keylen ) {
+	return cipher->setkey ( ctx, key, keylen );
+}
+
+static inline void cipher_setiv ( struct cipher_algorithm *cipher,
+				  void *ctx, const void *iv ) {
+	cipher->setiv ( ctx, iv );
+}
+
+static inline void cipher_encrypt ( struct cipher_algorithm *cipher,
+				    void *ctx, const void *src, void *dst,
+				    size_t len ) {
+	cipher->encrypt ( ctx, src, dst, len );
+}
+#define cipher_encrypt( cipher, ctx, src, dst, len ) do {		\
+	assert ( ( (len) & ( (cipher)->blocksize - 1 ) ) == 0 );	\
+	cipher_encrypt ( (cipher), (ctx), (src), (dst), (len) );	\
+	} while ( 0 )
+
+static inline void cipher_decrypt ( struct cipher_algorithm *cipher,
+				    void *ctx, const void *src, void *dst,
+				    size_t len ) {
+	cipher->decrypt ( ctx, src, dst, len );
+}
+#define cipher_decrypt( cipher, ctx, src, dst, len ) do {		\
+	assert ( ( (len) & ( (cipher)->blocksize - 1 ) ) == 0 );	\
+	cipher_decrypt ( (cipher), (ctx), (src), (dst), (len) );	\
+	} while ( 0 )
+
+static inline int is_stream_cipher ( struct cipher_algorithm *cipher ) {
+	return ( cipher->blocksize == 1 );
+}
+
+extern struct digest_algorithm digest_null;
+extern struct cipher_algorithm cipher_null;
+extern struct pubkey_algorithm pubkey_null;
+
+void get_random_bytes ( void *buf, size_t len );
+
+#endif /* _IPXE_CRYPTO_H */
diff --git a/src/include/ipxe/device.h b/src/include/ipxe/device.h
new file mode 100644
index 0000000..8567530
--- /dev/null
+++ b/src/include/ipxe/device.h
@@ -0,0 +1,113 @@
+#ifndef _IPXE_DEVICE_H
+#define _IPXE_DEVICE_H
+
+/**
+ * @file
+ *
+ * Device model
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/list.h>
+#include <ipxe/tables.h>
+
+/** A hardware device description */
+struct device_description {
+	/** Bus type
+	 *
+	 * This must be a BUS_TYPE_XXX constant.
+	 */
+	unsigned int bus_type;
+	/** Location
+	 *
+	 * The interpretation of this field is bus-type-specific.
+	 */
+	unsigned int location;
+	/** Vendor ID */
+	unsigned int vendor;
+	/** Device ID */
+	unsigned int device;
+	/** Device class */
+	unsigned long class;
+	/** I/O address */
+	unsigned long ioaddr;
+	/** IRQ */
+	unsigned int irq;
+};
+
+/** PCI bus type */
+#define BUS_TYPE_PCI 1
+
+/** ISAPnP bus type */
+#define BUS_TYPE_ISAPNP 2
+
+/** EISA bus type */
+#define BUS_TYPE_EISA 3
+
+/** MCA bus type */
+#define BUS_TYPE_MCA 4
+
+/** ISA bus type */
+#define BUS_TYPE_ISA 5
+
+/** A hardware device */
+struct device {
+	/** Name */
+	char name[16];
+	/** Device description */
+	struct device_description desc;
+	/** Devices on the same bus */
+	struct list_head siblings;
+	/** Devices attached to this device */
+	struct list_head children;
+	/** Bus device */
+	struct device *parent;
+};
+
+/**
+ * A root device
+ *
+ * Root devices are system buses such as PCI, EISA, etc.
+ *
+ */
+struct root_device {
+	/** Device chain
+	 *
+	 * A root device has a NULL parent field.
+	 */
+	struct device dev;
+	/** Root device driver */
+	struct root_driver *driver;
+};
+
+/** A root device driver */
+struct root_driver {
+	/**
+	 * Add root device
+	 *
+	 * @v rootdev	Root device
+	 * @ret rc	Return status code
+	 *
+	 * Called from probe_devices() for all root devices in the build.
+	 */
+	int ( * probe ) ( struct root_device *rootdev );
+	/**
+	 * Remove root device
+	 *
+	 * @v rootdev	Root device
+	 *
+	 * Called from remove_device() for all successfully-probed
+	 * root devices.
+	 */
+	void ( * remove ) ( struct root_device *rootdev );
+};
+
+/** Root device table */
+#define ROOT_DEVICES __table ( struct root_device, "root_devices" )
+
+/** Declare a root device */
+#define __root_device __table_entry ( ROOT_DEVICES, 01 )
+
+#endif /* _IPXE_DEVICE_H */
diff --git a/src/include/ipxe/dhcp.h b/src/include/ipxe/dhcp.h
new file mode 100644
index 0000000..bbfa293
--- /dev/null
+++ b/src/include/ipxe/dhcp.h
@@ -0,0 +1,637 @@
+#ifndef _IPXE_DHCP_H
+#define _IPXE_DHCP_H
+
+/** @file
+ *
+ * Dynamic Host Configuration Protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/in.h>
+#include <ipxe/list.h>
+#include <ipxe/refcnt.h>
+#include <ipxe/tables.h>
+#include <ipxe/uuid.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/uaccess.h>
+
+struct job_interface;
+struct dhcp_options;
+struct dhcp_packet;
+
+/** BOOTP/DHCP server port */
+#define BOOTPS_PORT 67
+
+/** BOOTP/DHCP client port */
+#define BOOTPC_PORT 68
+
+/** PXE server port */
+#define PXE_PORT 4011
+
+/** Construct a tag value for an encapsulated option
+ *
+ * This tag value can be passed to Etherboot functions when searching
+ * for DHCP options in order to search for a tag within an
+ * encapsulated options block.
+ */
+#define DHCP_ENCAP_OPT( encapsulator, encapsulated ) \
+	( ( (encapsulator) << 8 ) | (encapsulated) )
+/** Extract encapsulating option block tag from encapsulated tag value */
+#define DHCP_ENCAPSULATOR( encap_opt ) ( (encap_opt) >> 8 )
+/** Extract encapsulated option tag from encapsulated tag value */
+#define DHCP_ENCAPSULATED( encap_opt ) ( (encap_opt) & 0xff )
+/** Option is encapsulated */
+#define DHCP_IS_ENCAP_OPT( opt ) DHCP_ENCAPSULATOR( opt )
+
+/**
+ * @defgroup dhcpopts DHCP option tags
+ * @{
+ */
+
+/** Padding
+ *
+ * This tag does not have a length field; it is always only a single
+ * byte in length.
+ */
+#define DHCP_PAD 0
+
+/** Minimum normal DHCP option */
+#define DHCP_MIN_OPTION 1
+
+/** Subnet mask */
+#define DHCP_SUBNET_MASK 1
+
+/** Routers */
+#define DHCP_ROUTERS 3
+
+/** DNS servers */
+#define DHCP_DNS_SERVERS 6
+
+/** Syslog servers */
+#define DHCP_LOG_SERVERS 7
+
+/** Host name */
+#define DHCP_HOST_NAME 12
+
+/** Domain name */
+#define DHCP_DOMAIN_NAME 15
+
+/** Root path */
+#define DHCP_ROOT_PATH 17
+
+/** Vendor encapsulated options */
+#define DHCP_VENDOR_ENCAP 43
+
+/** PXE boot server discovery control */
+#define DHCP_PXE_DISCOVERY_CONTROL DHCP_ENCAP_OPT ( DHCP_VENDOR_ENCAP, 6 )
+
+/** PXE boot server discovery control bits */
+enum dhcp_pxe_discovery_control {
+	/** Inhibit broadcast discovery */
+	PXEBS_NO_BROADCAST = 1,
+	/** Inhibit multicast discovery */
+	PXEBS_NO_MULTICAST = 2,
+	/** Accept only servers in DHCP_PXE_BOOT_SERVERS list */
+	PXEBS_NO_UNKNOWN_SERVERS = 4,
+	/** Skip discovery if filename present */
+	PXEBS_SKIP = 8,
+};
+
+/** PXE boot server multicast address */
+#define DHCP_PXE_BOOT_SERVER_MCAST DHCP_ENCAP_OPT ( DHCP_VENDOR_ENCAP, 7 )
+
+/** PXE boot servers */
+#define DHCP_PXE_BOOT_SERVERS DHCP_ENCAP_OPT ( DHCP_VENDOR_ENCAP, 8 )
+
+/** PXE boot server */
+struct dhcp_pxe_boot_server {
+	/** "Type" */
+	uint16_t type;
+	/** Number of IPv4 addresses */
+	uint8_t num_ip;
+	/** IPv4 addresses */
+	struct in_addr ip[0];
+} __attribute__ (( packed ));
+
+/** PXE boot menu */
+#define DHCP_PXE_BOOT_MENU DHCP_ENCAP_OPT ( DHCP_VENDOR_ENCAP, 9 )
+
+/** PXE boot menu */
+struct dhcp_pxe_boot_menu {
+	/** "Type" */
+	uint16_t type;
+	/** Description length */
+	uint8_t desc_len;
+	/** Description */
+	char desc[0];
+} __attribute__ (( packed ));
+
+/** PXE boot menu prompt */
+#define DHCP_PXE_BOOT_MENU_PROMPT DHCP_ENCAP_OPT ( DHCP_VENDOR_ENCAP, 10 )
+
+/** PXE boot menu prompt */
+struct dhcp_pxe_boot_menu_prompt {
+	/** Timeout
+	 *
+	 * A value of 0 means "time out immediately and select first
+	 * boot item, without displaying the prompt".  A value of 255
+	 * means "display menu immediately with no timeout".  Any
+	 * other value means "display prompt, wait this many seconds
+	 * for keypress, if key is F8, display menu, otherwise select
+	 * first boot item".
+	 */
+	uint8_t timeout;
+	/** Prompt to press F8 */
+	char prompt[0];
+} __attribute__ (( packed ));
+
+/** PXE boot menu item */
+#define DHCP_PXE_BOOT_MENU_ITEM DHCP_ENCAP_OPT ( DHCP_VENDOR_ENCAP, 71 )
+
+/** PXE boot menu item */
+struct dhcp_pxe_boot_menu_item {
+	/** "Type"
+	 *
+	 * This field actually identifies the specific boot server (or
+	 * cluster of boot servers offering identical boot files).
+	 */
+	uint16_t type;
+	/** "Layer"
+	 *
+	 * Just don't ask.
+	 */
+	uint16_t layer;
+} __attribute__ (( packed ));
+
+/** Requested IP address */
+#define DHCP_REQUESTED_ADDRESS 50
+
+/** Lease time */
+#define DHCP_LEASE_TIME 51
+
+/** Option overloading
+ *
+ * The value of this option is the bitwise-OR of zero or more
+ * DHCP_OPTION_OVERLOAD_XXX constants.
+ */
+#define DHCP_OPTION_OVERLOAD 52
+
+/** The "file" field is overloaded to contain extra DHCP options */
+#define DHCP_OPTION_OVERLOAD_FILE 1
+
+/** The "sname" field is overloaded to contain extra DHCP options */
+#define DHCP_OPTION_OVERLOAD_SNAME 2
+
+/** DHCP message type */
+#define DHCP_MESSAGE_TYPE 53
+#define DHCPNONE 0
+#define DHCPDISCOVER 1
+#define DHCPOFFER 2
+#define DHCPREQUEST 3
+#define DHCPDECLINE 4
+#define DHCPACK 5
+#define DHCPNAK 6
+#define DHCPRELEASE 7
+#define DHCPINFORM 8
+
+/** DHCP server identifier */
+#define DHCP_SERVER_IDENTIFIER 54
+
+/** Parameter request list */
+#define DHCP_PARAMETER_REQUEST_LIST 55
+
+/** Maximum DHCP message size */
+#define DHCP_MAX_MESSAGE_SIZE 57
+
+/** Vendor class identifier */
+#define DHCP_VENDOR_CLASS_ID 60
+
+/** Client identifier */
+#define DHCP_CLIENT_ID 61
+
+/** Client identifier */
+struct dhcp_client_id {
+	/** Link-layer protocol */
+	uint8_t ll_proto;
+	/** Link-layer address */
+	uint8_t ll_addr[MAX_LL_ADDR_LEN];
+} __attribute__ (( packed ));
+
+/** TFTP server name
+ *
+ * This option replaces the fixed "sname" field, when that field is
+ * used to contain overloaded options.
+ */
+#define DHCP_TFTP_SERVER_NAME 66
+
+/** Bootfile name
+ *
+ * This option replaces the fixed "file" field, when that field is
+ * used to contain overloaded options.
+ */
+#define DHCP_BOOTFILE_NAME 67
+
+/** User class identifier */
+#define DHCP_USER_CLASS_ID 77
+
+/** Client system architecture */
+#define DHCP_CLIENT_ARCHITECTURE 93
+
+/** Client network device interface */
+#define DHCP_CLIENT_NDI 94
+
+/** UUID client identifier */
+#define DHCP_CLIENT_UUID 97
+
+/** UUID client identifier */
+struct dhcp_client_uuid {
+	/** Identifier type */
+	uint8_t type;
+	/** UUID */
+	union uuid uuid;
+} __attribute__ (( packed ));
+
+#define DHCP_CLIENT_UUID_TYPE 0
+
+/** Etherboot-specific encapsulated options
+ *
+ * This encapsulated options field is used to contain all options
+ * specific to Etherboot (i.e. not assigned by IANA or other standards
+ * bodies).
+ */
+#define DHCP_EB_ENCAP 175
+
+/** Priority of this options block
+ *
+ * This is a signed 8-bit integer field indicating the priority of
+ * this block of options.  It can be used to specify the relative
+ * priority of multiple option blocks (e.g. options from non-volatile
+ * storage versus options from a DHCP server).
+ */
+#define DHCP_EB_PRIORITY DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0x01 )
+
+/** "Your" IP address
+ *
+ * This option is used internally to contain the value of the "yiaddr"
+ * field, in order to provide a consistent approach to storing and
+ * processing options.  It should never be present in a DHCP packet.
+ */
+#define DHCP_EB_YIADDR DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0x02 )
+
+/** "Server" IP address
+ *
+ * This option is used internally to contain the value of the "siaddr"
+ * field, in order to provide a consistent approach to storing and
+ * processing options.  It should never be present in a DHCP packet.
+ */
+#define DHCP_EB_SIADDR DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0x03 )
+
+/** Keep SAN drive registered
+ *
+ * If set to a non-zero value, iPXE will not detach any SAN drive
+ * after failing to boot from it.  (This option is required in order
+ * to perform a Windows Server 2008 installation direct to an iSCSI
+ * target.)
+ */
+#define DHCP_EB_KEEP_SAN DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0x08 )
+
+/*
+ * Tags in the range 0x10-0x7f are reserved for feature markers
+ *
+ */
+
+/** Skip PXE DHCP protocol extensions such as ProxyDHCP
+ *
+ * If set to a non-zero value, iPXE will not wait for ProxyDHCP offers
+ * and will ignore any PXE-specific DHCP options that it receives.
+ */
+#define DHCP_EB_NO_PXEDHCP DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xb0 )
+
+/** Network device descriptor
+ *
+ * Byte 0 is the bus type ID; remaining bytes depend on the bus type.
+ *
+ * PCI devices:
+ * Byte 0 : 1 (PCI)
+ * Byte 1 : PCI vendor ID MSB
+ * Byte 2 : PCI vendor ID LSB
+ * Byte 3 : PCI device ID MSB
+ * Byte 4 : PCI device ID LSB
+ */
+#define DHCP_EB_BUS_ID DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xb1 )
+
+/** Network device descriptor */
+struct dhcp_netdev_desc {
+	/** Bus type ID */
+	uint8_t type;
+	/** Vendor ID */
+	uint16_t vendor;
+	/** Device ID */
+	uint16_t device;
+} __attribute__ (( packed ));
+
+/** Use cached network settings
+ *
+ * Cached network settings may be available from a prior DHCP request
+ * (if running as a PXE NBP), non-volatile storage on the NIC, or
+ * settings set via the command line or an embedded image. If this
+ * flag is not set, it will be assumed that those sources are
+ * insufficient and that DHCP should still be run when autobooting.
+ */
+#define DHCP_EB_USE_CACHED DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xb2 )
+
+/** BIOS drive number
+ *
+ * This is the drive number for a drive emulated via INT 13.  0x80 is
+ * the first hard disk, 0x81 is the second hard disk, etc.
+ */
+#define DHCP_EB_BIOS_DRIVE DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xbd )
+
+/** Username
+ *
+ * This will be used as the username for any required authentication.
+ * It is expected that this option's value will be held in
+ * non-volatile storage, rather than transmitted as part of a DHCP
+ * packet.
+ */
+#define DHCP_EB_USERNAME DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xbe )
+
+/** Password
+ *
+ * This will be used as the password for any required authentication.
+ * It is expected that this option's value will be held in
+ * non-volatile storage, rather than transmitted as part of a DHCP
+ * packet.
+ */
+#define DHCP_EB_PASSWORD DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xbf )
+
+/** Reverse username
+ *
+ * This will be used as the reverse username (i.e. the username
+ * provided by the server) for any required authentication.  It is
+ * expected that this option's value will be held in non-volatile
+ * storage, rather than transmitted as part of a DHCP packet.
+ */
+#define DHCP_EB_REVERSE_USERNAME DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xc0 )
+
+/** Reverse password
+ *
+ * This will be used as the reverse password (i.e. the password
+ * provided by the server) for any required authentication.  It is
+ * expected that this option's value will be held in non-volatile
+ * storage, rather than transmitted as part of a DHCP packet.
+ */
+#define DHCP_EB_REVERSE_PASSWORD DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xc1 )
+
+/** iPXE version number */
+#define DHCP_EB_VERSION DHCP_ENCAP_OPT ( DHCP_EB_ENCAP, 0xeb )
+
+/** iSCSI primary target IQN */
+#define DHCP_ISCSI_PRIMARY_TARGET_IQN 201
+
+/** iSCSI secondary target IQN */
+#define DHCP_ISCSI_SECONDARY_TARGET_IQN 202
+
+/** iSCSI initiator IQN */
+#define DHCP_ISCSI_INITIATOR_IQN 203
+
+/** Maximum normal DHCP option */
+#define DHCP_MAX_OPTION 254
+
+/** End of options
+ *
+ * This tag does not have a length field; it is always only a single
+ * byte in length.
+ */
+#define DHCP_END 255
+
+/** @} */
+
+/**
+ * Count number of arguments to a variadic macro
+ *
+ * This rather neat, non-iterative solution is courtesy of Laurent
+ * Deniau.
+ *
+ */
+#define _VA_ARG_COUNT(  _1,  _2,  _3,  _4,  _5,  _6,  _7,  _8,		\
+		        _9, _10, _11, _12, _13, _14, _15, _16,		\
+		       _17, _18, _19, _20, _21, _22, _23, _24,		\
+		       _25, _26, _27, _28, _29, _30, _31, _32,		\
+		       _33, _34, _35, _36, _37, _38, _39, _40,		\
+		       _41, _42, _43, _44, _45, _46, _47, _48,		\
+		       _49, _50, _51, _52, _53, _54, _55, _56,		\
+		       _57, _58, _59, _60, _61, _62, _63,   N, ... ) N
+#define VA_ARG_COUNT( ... )						\
+	_VA_ARG_COUNT ( __VA_ARGS__, 					\
+			63, 62, 61, 60, 59, 58, 57, 56,			\
+			55, 54, 53, 52, 51, 50, 49, 48,			\
+			47, 46, 45, 44, 43, 42, 41, 40,			\
+			39, 38, 37, 36, 35, 34, 33, 32,			\
+			31, 30, 29, 28, 27, 26, 25, 24,			\
+			23, 22, 21, 20, 19, 18, 17, 16,			\
+			15, 14, 13, 12, 11, 10,  9,  8,			\
+			 7,  6,  5,  4,  3,  2,  1,  0 )
+
+/** Construct a DHCP option from a list of bytes */
+#define DHCP_OPTION( ... ) VA_ARG_COUNT ( __VA_ARGS__ ), __VA_ARGS__
+
+/** Construct a DHCP option from a list of characters */
+#define DHCP_STRING( ... ) DHCP_OPTION ( __VA_ARGS__ )
+
+/** Construct a byte-valued DHCP option */
+#define DHCP_BYTE( value ) DHCP_OPTION ( value )
+
+/** Construct a word-valued DHCP option */
+#define DHCP_WORD( value ) DHCP_OPTION ( ( ( (value) >> 8 ) & 0xff ),   \
+					 ( ( (value) >> 0 ) & 0xff ) )
+
+/** Construct a dword-valued DHCP option */
+#define DHCP_DWORD( value ) DHCP_OPTION ( ( ( (value) >> 24 ) & 0xff ), \
+					  ( ( (value) >> 16 ) & 0xff ), \
+					  ( ( (value) >> 8  ) & 0xff ), \
+					  ( ( (value) >> 0  ) & 0xff ) )
+
+/** Construct a DHCP encapsulated options field */
+#define DHCP_ENCAP( ... ) DHCP_OPTION ( __VA_ARGS__, DHCP_END )
+
+/**
+ * A DHCP option
+ *
+ * DHCP options consist of a mandatory tag, a length field that is
+ * mandatory for all options except @c DHCP_PAD and @c DHCP_END, and a
+ * payload.  
+ */
+struct dhcp_option {
+	/** Tag
+	 *
+	 * Must be a @c DHCP_XXX value.
+	 */
+	uint8_t tag;
+	/** Length
+	 *
+	 * This is the length of the data field (i.e. excluding the
+	 * tag and length fields).  For the two tags @c DHCP_PAD and
+	 * @c DHCP_END, the length field is implicitly zero and is
+	 * also missing, i.e. these DHCP options are only a single
+	 * byte in length.
+	 */
+	uint8_t len;
+	/** Option data */
+	uint8_t data[0];
+} __attribute__ (( packed ));
+
+/**
+ * Length of a DHCP option header
+ *
+ * The header is the portion excluding the data, i.e. the tag and the
+ * length.
+ */
+#define DHCP_OPTION_HEADER_LEN ( offsetof ( struct dhcp_option, data ) )
+
+/** Maximum length for a single DHCP option */
+#define DHCP_MAX_LEN 0xff
+
+/**
+ * A DHCP header
+ *
+ */
+struct dhcphdr {
+	/** Operation
+	 *
+	 * This must be either @c BOOTP_REQUEST or @c BOOTP_REPLY.
+	 */
+	uint8_t op;
+	/** Hardware address type
+	 *
+	 * This is an ARPHRD_XXX constant.  Note that ARPHRD_XXX
+	 * constants are nominally 16 bits wide; this could be
+	 * considered to be a bug in the BOOTP/DHCP specification.
+	 */
+	uint8_t htype;
+	/** Hardware address length */
+	uint8_t hlen;
+	/** Number of hops from server */
+	uint8_t hops;
+	/** Transaction ID */
+	uint32_t xid;
+	/** Seconds since start of acquisition */
+	uint16_t secs;
+	/** Flags */
+	uint16_t flags;
+	/** "Client" IP address
+	 *
+	 * This is filled in if the client already has an IP address
+	 * assigned and can respond to ARP requests.
+	 */
+	struct in_addr ciaddr;
+	/** "Your" IP address
+	 *
+	 * This is the IP address assigned by the server to the client.
+	 */
+	struct in_addr yiaddr;
+	/** "Server" IP address
+	 *
+	 * This is the IP address of the next server to be used in the
+	 * boot process.
+	 */
+	struct in_addr siaddr;
+	/** "Gateway" IP address
+	 *
+	 * This is the IP address of the DHCP relay agent, if any.
+	 */
+	struct in_addr giaddr;
+	/** Client hardware address */
+	uint8_t chaddr[16];
+	/** Server host name (null terminated)
+	 *
+	 * This field may be overridden and contain DHCP options
+	 */
+	char sname[64];
+	/** Boot file name (null terminated)
+	 *
+	 * This field may be overridden and contain DHCP options
+	 */
+	char file[128];
+	/** DHCP magic cookie
+	 *
+	 * Must have the value @c DHCP_MAGIC_COOKIE.
+	 */
+	uint32_t magic;
+	/** DHCP options
+	 *
+	 * Variable length; extends to the end of the packet.  Minimum
+	 * length (for the sake of sanity) is 1, to allow for a single
+	 * @c DHCP_END tag.
+	 */
+	uint8_t options[0];
+};
+
+/** Opcode for a request from client to server */
+#define BOOTP_REQUEST 1
+
+/** Opcode for a reply from server to client */
+#define BOOTP_REPLY 2
+
+/** BOOTP reply must be broadcast
+ *
+ * Clients that cannot accept unicast BOOTP replies must set this
+ * flag.
+ */
+#define BOOTP_FL_BROADCAST 0x8000
+
+/** DHCP magic cookie */
+#define DHCP_MAGIC_COOKIE 0x63825363UL
+
+/** DHCP minimum packet length
+ *
+ * This is the mandated minimum packet length that a DHCP participant
+ * must be prepared to receive.
+ */
+#define DHCP_MIN_LEN 552
+
+/** Timeouts for sending DHCP packets */
+#define DHCP_MIN_TIMEOUT ( 1 * TICKS_PER_SEC )
+#define DHCP_MAX_TIMEOUT ( 10 * TICKS_PER_SEC )
+
+/** Maximum time that we will wait for ProxyDHCP responses */
+#define PROXYDHCP_MAX_TIMEOUT ( 2 * TICKS_PER_SEC )
+
+/** Maximum time that we will wait for Boot Server responses */
+#define PXEBS_MAX_TIMEOUT ( 3 * TICKS_PER_SEC )
+
+/** Settings block name used for DHCP responses */
+#define DHCP_SETTINGS_NAME "dhcp"
+
+/** Settings block name used for ProxyDHCP responses */
+#define PROXYDHCP_SETTINGS_NAME "proxydhcp"
+
+/** Setting block name used for BootServerDHCP responses */
+#define PXEBS_SETTINGS_NAME "pxebs"
+
+extern void * dhcp_chaddr ( struct net_device *netdev, uint8_t *hlen,
+			    uint16_t *flags );
+extern int dhcp_create_packet ( struct dhcp_packet *dhcppkt,
+				struct net_device *netdev, uint8_t msgtype,
+				const void *options, size_t options_len,
+				void *data, size_t max_len );
+extern int dhcp_create_request ( struct dhcp_packet *dhcppkt,
+				 struct net_device *netdev,
+				 unsigned int msgtype, struct in_addr ciaddr,
+				 void *data, size_t max_len );
+extern int start_dhcp ( struct job_interface *job, struct net_device *netdev );
+extern int start_pxebs ( struct job_interface *job, struct net_device *netdev,
+			 unsigned int pxe_type );
+
+/* In environments that can provide cached DHCP packets, this function
+ * should look for such a packet and call store_cached_dhcpack() with
+ * it if it exists.
+ */
+__weak_decl ( void, get_cached_dhcpack, ( void ), (), );
+
+extern void store_cached_dhcpack ( userptr_t data, size_t len );
+
+#endif /* _IPXE_DHCP_H */
diff --git a/src/include/ipxe/dhcpopts.h b/src/include/ipxe/dhcpopts.h
new file mode 100644
index 0000000..fea99d5
--- /dev/null
+++ b/src/include/ipxe/dhcpopts.h
@@ -0,0 +1,34 @@
+#ifndef _IPXE_DHCPOPTS_H
+#define _IPXE_DHCPOPTS_H
+
+/** @file
+ *
+ * DHCP options
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/** A DHCP options block */
+struct dhcp_options {
+	/** Option block raw data */
+	void *data;
+	/** Option block length */
+	size_t len;
+	/** Option block maximum length */
+	size_t max_len;
+};
+
+extern int dhcpopt_store ( struct dhcp_options *options, unsigned int tag,
+			   const void *data, size_t len );
+extern int dhcpopt_extensible_store ( struct dhcp_options *options,
+				      unsigned int tag,
+				      const void *data, size_t len );
+extern int dhcpopt_fetch ( struct dhcp_options *options, unsigned int tag,
+			   void *data, size_t len );
+extern void dhcpopt_init ( struct dhcp_options *options,
+			   void *data, size_t max_len );
+
+#endif /* _IPXE_DHCPOPTS_H */
diff --git a/src/include/ipxe/dhcppkt.h b/src/include/ipxe/dhcppkt.h
new file mode 100644
index 0000000..5709cc7
--- /dev/null
+++ b/src/include/ipxe/dhcppkt.h
@@ -0,0 +1,64 @@
+#ifndef _IPXE_DHCPPKT_H
+#define _IPXE_DHCPPKT_H
+
+/** @file
+ *
+ * DHCP packets
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/dhcp.h>
+#include <ipxe/dhcpopts.h>
+#include <ipxe/refcnt.h>
+
+/**
+ * A DHCP packet
+ *
+ */
+struct dhcp_packet {
+	/** Reference counter */
+	struct refcnt refcnt;
+	/** The DHCP packet contents */
+	struct dhcphdr *dhcphdr;
+	/** Maximum length of the DHCP packet buffer */
+	size_t max_len;
+	/** Used length of the DHCP packet buffer */
+	size_t len;
+	/** DHCP options */
+	struct dhcp_options options;
+	/** Settings interface */
+	struct settings settings;
+};
+
+/**
+ * Increment reference count on DHCP packet
+ *
+ * @v dhcppkt		DHCP packet
+ * @ret dhcppkt		DHCP packet
+ */
+static inline __attribute__ (( always_inline )) struct dhcp_packet *
+dhcppkt_get ( struct dhcp_packet *dhcppkt ) {
+	ref_get ( &dhcppkt->refcnt );
+	return dhcppkt;
+}
+
+/**
+ * Decrement reference count on DHCP packet
+ *
+ * @v dhcppkt		DHCP packet
+ */
+static inline __attribute__ (( always_inline )) void
+dhcppkt_put ( struct dhcp_packet *dhcppkt ) {
+	ref_put ( &dhcppkt->refcnt );
+}
+
+extern int dhcppkt_store ( struct dhcp_packet *dhcppkt, unsigned int tag,
+			   const void *data, size_t len );
+extern int dhcppkt_fetch ( struct dhcp_packet *dhcppkt, unsigned int tag,
+			   void *data, size_t len );
+extern void dhcppkt_init ( struct dhcp_packet *dhcppkt, 
+			   struct dhcphdr *data, size_t len );
+
+#endif /* _IPXE_DHCPPKT_H */
diff --git a/src/include/ipxe/dns.h b/src/include/ipxe/dns.h
new file mode 100644
index 0000000..1c42760
--- /dev/null
+++ b/src/include/ipxe/dns.h
@@ -0,0 +1,92 @@
+#ifndef _IPXE_DNS_H
+#define _IPXE_DNS_H
+
+/** @file
+ *
+ * DNS protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/in.h>
+
+/*
+ * Constants
+ *
+ */
+
+#define DNS_TYPE_A		1
+#define DNS_TYPE_CNAME		5
+#define DNS_TYPE_ANY		255
+
+#define DNS_CLASS_IN		1
+#define DNS_CLASS_CS		2
+#define DNS_CLASS_CH		3
+#define DNS_CLASS_HS		4
+
+#define DNS_FLAG_QUERY		( 0x00 << 15 )
+#define DNS_FLAG_RESPONSE	( 0x01 << 15 )
+#define DNS_FLAG_QR(flags)	( (flags) & ( 0x01 << 15 ) )
+#define DNS_FLAG_OPCODE_QUERY	( 0x00 << 11 )
+#define DNS_FLAG_OPCODE_IQUERY	( 0x01 << 11 )
+#define DNS_FLAG_OPCODE_STATUS	( 0x02 << 11 )
+#define DNS_FLAG_OPCODE(flags)	( (flags) & ( 0x0f << 11 ) )
+#define DNS_FLAG_RD		( 0x01 << 8 )
+#define DNS_FLAG_RA		( 0x01 << 7 )
+#define DNS_FLAG_RCODE_OK	( 0x00 << 0 )
+#define DNS_FLAG_RCODE_NX	( 0x03 << 0 )
+#define DNS_FLAG_RCODE(flags)	( (flags) & ( 0x0f << 0 ) )
+
+#define	DNS_PORT		53
+#define	DNS_MAX_RETRIES		3
+#define	DNS_MAX_CNAME_RECURSION	0x30
+
+/*
+ * DNS protocol structures
+ *
+ */
+struct dns_header {
+	uint16_t	id;
+	uint16_t	flags;
+	uint16_t	qdcount;
+	uint16_t	ancount;
+	uint16_t	nscount;
+	uint16_t	arcount;
+} __attribute__ (( packed ));
+
+struct dns_query_info {
+	uint16_t	qtype;
+	uint16_t	qclass;
+} __attribute__ (( packed ));
+
+struct dns_query {
+	struct dns_header dns;
+	char		payload[ 256 + sizeof ( struct dns_query_info ) ];
+} __attribute__ (( packed ));
+
+struct dns_rr_info_common {
+	uint16_t	type;
+	uint16_t	class;
+	uint32_t	ttl;
+	uint16_t	rdlength;
+} __attribute__ (( packed ));
+
+struct dns_rr_info_a {
+	struct dns_rr_info_common common;
+	struct in_addr in_addr;
+} __attribute__ (( packed ));
+
+struct dns_rr_info_cname {
+	struct dns_rr_info_common common;
+	char cname[0];
+} __attribute__ (( packed ));
+
+union dns_rr_info {
+	struct dns_rr_info_common common;
+	struct dns_rr_info_a a;
+	struct dns_rr_info_cname cname;
+};
+
+#endif /* _IPXE_DNS_H */
diff --git a/src/include/ipxe/downloader.h b/src/include/ipxe/downloader.h
new file mode 100644
index 0000000..023bf94
--- /dev/null
+++ b/src/include/ipxe/downloader.h
@@ -0,0 +1,19 @@
+#ifndef _IPXE_DOWNLOADER_H
+#define _IPXE_DOWNLOADER_H
+
+/** @file
+ *
+ * Image downloader
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct job_interface;
+struct image;
+
+extern int create_downloader ( struct job_interface *job, struct image *image,
+			       int ( * register_image ) ( struct image *image ),
+			       int type, ... );
+
+#endif /* _IPXE_DOWNLOADER_H */
diff --git a/src/include/ipxe/eapol.h b/src/include/ipxe/eapol.h
new file mode 100644
index 0000000..43d891c
--- /dev/null
+++ b/src/include/ipxe/eapol.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _IPXE_EAPOL_H
+#define _IPXE_EAPOL_H
+
+/** @file
+ *
+ * Definitions for EAPOL (Extensible Authentication Protocol over
+ * LANs) frames. Definitions for the packets usually encapsulated in
+ * them are elsewhere.
+ */
+
+#include <ipxe/tables.h>
+#include <stdint.h>
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+
+/**
+ * @defgroup eapol_type EAPOL archetype identifiers
+ * @{
+ */
+#define EAPOL_TYPE_EAP		0 /**< EAP authentication handshake packet */
+#define EAPOL_TYPE_START	1 /**< Request by Peer to begin (no data) */
+#define EAPOL_TYPE_LOGOFF	2 /**< Request by Peer to terminate (no data) */
+#define EAPOL_TYPE_KEY		3 /**< EAPOL-Key packet */
+/** @} */
+
+/** Expected EAPOL version field value
+ *
+ * Version 2 is often seen and has no format differences from version 1;
+ * however, many older APs will completely drop version-2 packets, so
+ * we advertise ourselves as version 1.
+ */
+#define EAPOL_THIS_VERSION	1
+
+/** Length of an EAPOL frame header */
+#define EAPOL_HDR_LEN		4
+
+/** An EAPOL frame
+ *
+ * This may encapsulate an eap_pkt, an eapol_key_pkt, or a Start or
+ * Logoff request with no data attached. It is transmitted directly in
+ * an Ethernet frame, with no IP packet header.
+ */
+struct eapol_frame
+{
+	/** EAPOL version identifier, always 1 */
+	u8 version;
+
+	/** EAPOL archetype identifier indicating format of payload */
+	u8 type;
+
+	/** Length of payload, in network byte order */
+	u16 length;
+
+	/** Payload, if @a type is EAP or EAPOL-Key */
+	u8 data[0];
+} __attribute__ (( packed ));
+
+
+/** An EAPOL frame type handler
+ *
+ * Normally there will be at most two of these, one for EAP and one
+ * for EAPOL-Key frames. The EAPOL interface code handles Start and
+ * Logoff directly.
+ */
+struct eapol_handler
+{
+	/** EAPOL archetype identifier for payload this handler will handle */
+	u8 type;
+
+	/** Receive EAPOL-encapsulated packet of specified type
+	 *
+	 * @v iob	I/O buffer containing packet payload
+	 * @v netdev	Network device from which packet was received
+	 * @v ll_source	Source link-layer address from which packet was received
+	 * @ret rc	Return status code
+	 *
+	 * The I/O buffer will have the EAPOL header pulled off it, so
+	 * @c iob->data points to the first byte of the payload.
+	 *
+	 * This function takes ownership of the I/O buffer passed to it.
+	 */
+	int ( * rx ) ( struct io_buffer *iob, struct net_device *netdev,
+		       const void *ll_source );
+};
+
+#define EAPOL_HANDLERS	__table ( struct eapol_handler, "eapol_handlers" )
+#define __eapol_handler	__table_entry ( EAPOL_HANDLERS, 01 )
+
+
+extern struct net_protocol eapol_protocol __net_protocol;
+
+
+#endif /* _IPXE_EAPOL_H */
diff --git a/src/include/ipxe/editbox.h b/src/include/ipxe/editbox.h
new file mode 100644
index 0000000..9122dbb
--- /dev/null
+++ b/src/include/ipxe/editbox.h
@@ -0,0 +1,61 @@
+#ifndef _IPXE_EDITBOX_H
+#define _IPXE_EDITBOX_H
+
+/** @file
+ *
+ * Editable text box widget
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <curses.h>
+#include <ipxe/editstring.h>
+
+/** An editable text box widget */
+struct edit_box {
+	/** Editable string */
+	struct edit_string string;
+	/** Containing window */
+	WINDOW *win;
+	/** Row */
+	unsigned int row;
+	/** Starting column */
+	unsigned int col;
+	/** Width */
+	unsigned int width;
+	/** First displayed character */
+	unsigned int first;
+	/** Flags */
+	unsigned int flags;
+};
+
+/** Editable text box widget flags */
+enum edit_box_flags {
+	/** Show stars instead of contents (for password widgets) */
+	EDITBOX_STARS = 0x0001,
+};
+
+extern void init_editbox ( struct edit_box *box, char *buf, size_t len,
+			   WINDOW *win, unsigned int row, unsigned int col,
+			   unsigned int width, unsigned int flags )
+			   __attribute__ (( nonnull (1, 2) ));
+extern void draw_editbox ( struct edit_box *box ) __nonnull;
+static inline int edit_editbox ( struct edit_box *box, int key ) __nonnull;
+
+/**
+ * Edit text box widget
+ *
+ * @v box		Editable text box widget
+ * @v key		Key pressed by user
+ * @ret key		Key returned to application, or zero
+ *
+ * You must call draw_editbox() to update the display after calling
+ * edit_editbox().
+ *
+ */
+static inline int edit_editbox ( struct edit_box *box, int key ) {
+	return edit_string ( &box->string, key );
+}
+
+#endif /* _IPXE_EDITBOX_H */
diff --git a/src/include/ipxe/editstring.h b/src/include/ipxe/editstring.h
new file mode 100644
index 0000000..5c1a18b
--- /dev/null
+++ b/src/include/ipxe/editstring.h
@@ -0,0 +1,33 @@
+#ifndef _IPXE_EDITSTRING_H
+#define _IPXE_EDITSTRING_H
+
+/** @file
+ *
+ * Editable strings
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** An editable string */
+struct edit_string {
+	/** Buffer for string */
+	char *buf;
+	/** Size of buffer (including terminating NUL) */
+	size_t len;
+	/** Cursor position */
+	unsigned int cursor;
+
+	/* The following items are the edit history */
+
+	/** Last cursor position */
+	unsigned int last_cursor;
+	/** Start of modified portion of string */
+	unsigned int mod_start;
+	/** End of modified portion of string */
+	unsigned int mod_end;
+};
+
+extern int edit_string ( struct edit_string *string, int key ) __nonnull;
+
+#endif /* _IPXE_EDITSTRING_H */
diff --git a/src/include/ipxe/efi/Base.h b/src/include/ipxe/efi/Base.h
new file mode 100644
index 0000000..14fd9cb
--- /dev/null
+++ b/src/include/ipxe/efi/Base.h
@@ -0,0 +1,329 @@
+/** @file
+  Root include file for Mde Package Base type modules
+
+  This is the include file for any module of type base. Base modules only use
+  types defined via this include file and can be ported easily to any
+  environment. There are a set of base libraries in the Mde Package that can
+  be used to implement base modules.
+
+Copyright (c) 2006 - 2008, Intel Corporation
+All rights reserved. This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+
+#ifndef __BASE_H__
+#define __BASE_H__
+
+//
+// Include processor specific binding
+//
+#include <ipxe/efi/ProcessorBind.h>
+
+typedef struct {
+  UINT32  Data1;
+  UINT16  Data2;
+  UINT16  Data3;
+  UINT8   Data4[8];
+} GUID;
+
+typedef UINT64 PHYSICAL_ADDRESS;
+
+///
+/// LIST_ENTRY definition
+///
+typedef struct _LIST_ENTRY LIST_ENTRY;
+
+struct _LIST_ENTRY {
+  LIST_ENTRY  *ForwardLink;
+  LIST_ENTRY  *BackLink;
+};
+
+//
+// Modifiers to absract standard types to aid in debug of problems
+//
+#define CONST     const
+#define STATIC    static
+#define VOID      void
+
+//
+// Modifiers for Data Types used to self document code.
+// This concept is borrowed for UEFI specification.
+//
+#define IN
+#define OUT
+#define OPTIONAL
+
+//
+//  UEFI specification claims 1 and 0. We are concerned about the
+//  complier portability so we did it this way.
+//
+#define TRUE  ((BOOLEAN)(1==1))
+#define FALSE ((BOOLEAN)(0==1))
+
+#define NULL  ((VOID *) 0)
+
+#define  BIT0     0x00000001
+#define  BIT1     0x00000002
+#define  BIT2     0x00000004
+#define  BIT3     0x00000008
+#define  BIT4     0x00000010
+#define  BIT5     0x00000020
+#define  BIT6     0x00000040
+#define  BIT7     0x00000080
+#define  BIT8     0x00000100
+#define  BIT9     0x00000200
+#define  BIT10    0x00000400
+#define  BIT11    0x00000800
+#define  BIT12    0x00001000
+#define  BIT13    0x00002000
+#define  BIT14    0x00004000
+#define  BIT15    0x00008000
+#define  BIT16    0x00010000
+#define  BIT17    0x00020000
+#define  BIT18    0x00040000
+#define  BIT19    0x00080000
+#define  BIT20    0x00100000
+#define  BIT21    0x00200000
+#define  BIT22    0x00400000
+#define  BIT23    0x00800000
+#define  BIT24    0x01000000
+#define  BIT25    0x02000000
+#define  BIT26    0x04000000
+#define  BIT27    0x08000000
+#define  BIT28    0x10000000
+#define  BIT29    0x20000000
+#define  BIT30    0x40000000
+#define  BIT31    0x80000000
+#define  BIT32    0x0000000100000000UL
+#define  BIT33    0x0000000200000000UL
+#define  BIT34    0x0000000400000000UL
+#define  BIT35    0x0000000800000000UL
+#define  BIT36    0x0000001000000000UL
+#define  BIT37    0x0000002000000000UL
+#define  BIT38    0x0000004000000000UL
+#define  BIT39    0x0000008000000000UL
+#define  BIT40    0x0000010000000000UL
+#define  BIT41    0x0000020000000000UL
+#define  BIT42    0x0000040000000000UL
+#define  BIT43    0x0000080000000000UL
+#define  BIT44    0x0000100000000000UL
+#define  BIT45    0x0000200000000000UL
+#define  BIT46    0x0000400000000000UL
+#define  BIT47    0x0000800000000000UL
+#define  BIT48    0x0001000000000000UL
+#define  BIT49    0x0002000000000000UL
+#define  BIT50    0x0004000000000000UL
+#define  BIT51    0x0008000000000000UL
+#define  BIT52    0x0010000000000000UL
+#define  BIT53    0x0020000000000000UL
+#define  BIT54    0x0040000000000000UL
+#define  BIT55    0x0080000000000000UL
+#define  BIT56    0x0100000000000000UL
+#define  BIT57    0x0200000000000000UL
+#define  BIT58    0x0400000000000000UL
+#define  BIT59    0x0800000000000000UL
+#define  BIT60    0x1000000000000000UL
+#define  BIT61    0x2000000000000000UL
+#define  BIT62    0x4000000000000000UL
+#define  BIT63    0x8000000000000000UL
+
+//
+//  Support for variable length argument lists using the ANSI standard.
+//
+//  Since we are using the ANSI standard we used the standard nameing and
+//  did not folow the coding convention
+//
+//  VA_LIST  - typedef for argument list.
+//  VA_START (VA_LIST Marker, argument before the ...) - Init Marker for use.
+//  VA_END (VA_LIST Marker) - Clear Marker
+//  VA_ARG (VA_LIST Marker, var arg size) - Use Marker to get an argumnet from
+//    the ... list. You must know the size and pass it in this macro.
+//
+//  example:
+//
+//  UINTN
+//  ExampleVarArg (
+//    IN UINTN  NumberOfArgs,
+//    ...
+//    )
+//  {
+//    VA_LIST Marker;
+//    UINTN   Index;
+//    UINTN   Result;
+//
+//    //
+//    // Initialize the Marker
+//    //
+//    VA_START (Marker, NumberOfArgs);
+//    for (Index = 0, Result = 0; Index < NumberOfArgs; Index++) {
+//      //
+//      // The ... list is a series of UINTN values, so average them up.
+//      //
+//      Result += VA_ARG (Marker, UINTN);
+//    }
+//
+//    VA_END (Marker);
+//    return Result
+//  }
+//
+
+#define _INT_SIZE_OF(n) ((sizeof (n) + sizeof (UINTN) - 1) &~(sizeof (UINTN) - 1))
+
+//
+// Also support coding convention rules for var arg macros
+//
+typedef CHAR8 *VA_LIST;
+#define VA_START(ap, v) (ap = (VA_LIST) & (v) + _INT_SIZE_OF (v))
+#define VA_ARG(ap, t)   (*(t *) ((ap += _INT_SIZE_OF (t)) - _INT_SIZE_OF (t)))
+#define VA_END(ap)      (ap = (VA_LIST) 0)
+
+//
+// Macro that returns the byte offset of a field in a data structure.
+//
+#define OFFSET_OF(TYPE, Field) ((UINTN) &(((TYPE *)0)->Field))
+
+///
+///  CONTAINING_RECORD - returns a pointer to the structure
+///      from one of it's elements.
+///
+#define _CR(Record, TYPE, Field)  ((TYPE *) ((CHAR8 *) (Record) - (CHAR8 *) &(((TYPE *) 0)->Field)))
+
+///
+///  ALIGN_VALUE - aligns a value up to the next boundary of the given alignment.
+///
+#define ALIGN_VALUE(Value, Alignment) ((Value) + (((Alignment) - (Value)) & ((Alignment) - 1)))
+
+///
+///  ALIGN_POINTER - aligns a pointer to the lowest boundry
+///
+#define ALIGN_POINTER(Pointer, Alignment) ((VOID *) (ALIGN_VALUE ((UINTN)(Pointer), (Alignment))))
+
+///
+///  ALIGN_VARIABLE - aligns a variable up to the next natural boundry for int size of a processor
+///
+#define ALIGN_VARIABLE(Value)  ALIGN_VALUE ((Value), sizeof (UINTN))
+
+
+//
+// Return the maximum of two operands.
+// This macro returns the maximum of two operand specified by a and b.
+// Both a and b must be the same numerical types, signed or unsigned.
+//
+#define MAX(a, b)                       \
+  (((a) > (b)) ? (a) : (b))
+
+
+//
+// Return the minimum of two operands.
+// This macro returns the minimal of two operand specified by a and b.
+// Both a and b must be the same numerical types, signed or unsigned.
+//
+#define MIN(a, b)                       \
+  (((a) < (b)) ? (a) : (b))
+
+
+//
+// EFI Error Codes common to all execution phases
+//
+
+typedef INTN RETURN_STATUS;
+
+///
+/// Set the upper bit to indicate EFI Error.
+///
+#define ENCODE_ERROR(a)              (MAX_BIT | (a))
+
+#define ENCODE_WARNING(a)            (a)
+#define RETURN_ERROR(a)              ((INTN) (a) < 0)
+
+#define RETURN_SUCCESS               0
+#define RETURN_LOAD_ERROR            ENCODE_ERROR (1)
+#define RETURN_INVALID_PARAMETER     ENCODE_ERROR (2)
+#define RETURN_UNSUPPORTED           ENCODE_ERROR (3)
+#define RETURN_BAD_BUFFER_SIZE       ENCODE_ERROR (4)
+#define RETURN_BUFFER_TOO_SMALL      ENCODE_ERROR (5)
+#define RETURN_NOT_READY             ENCODE_ERROR (6)
+#define RETURN_DEVICE_ERROR          ENCODE_ERROR (7)
+#define RETURN_WRITE_PROTECTED       ENCODE_ERROR (8)
+#define RETURN_OUT_OF_RESOURCES      ENCODE_ERROR (9)
+#define RETURN_VOLUME_CORRUPTED      ENCODE_ERROR (10)
+#define RETURN_VOLUME_FULL           ENCODE_ERROR (11)
+#define RETURN_NO_MEDIA              ENCODE_ERROR (12)
+#define RETURN_MEDIA_CHANGED         ENCODE_ERROR (13)
+#define RETURN_NOT_FOUND             ENCODE_ERROR (14)
+#define RETURN_ACCESS_DENIED         ENCODE_ERROR (15)
+#define RETURN_NO_RESPONSE           ENCODE_ERROR (16)
+#define RETURN_NO_MAPPING            ENCODE_ERROR (17)
+#define RETURN_TIMEOUT               ENCODE_ERROR (18)
+#define RETURN_NOT_STARTED           ENCODE_ERROR (19)
+#define RETURN_ALREADY_STARTED       ENCODE_ERROR (20)
+#define RETURN_ABORTED               ENCODE_ERROR (21)
+#define RETURN_ICMP_ERROR            ENCODE_ERROR (22)
+#define RETURN_TFTP_ERROR            ENCODE_ERROR (23)
+#define RETURN_PROTOCOL_ERROR        ENCODE_ERROR (24)
+#define RETURN_INCOMPATIBLE_VERSION  ENCODE_ERROR (25)
+#define RETURN_SECURITY_VIOLATION    ENCODE_ERROR (26)
+#define RETURN_CRC_ERROR             ENCODE_ERROR (27)
+#define RETURN_END_OF_MEDIA          ENCODE_ERROR (28)
+#define RETURN_END_OF_FILE           ENCODE_ERROR (31)
+#define RETURN_INVALID_LANGUAGE      ENCODE_ERROR (32)
+
+
+#define RETURN_WARN_UNKNOWN_GLYPH    ENCODE_WARNING (1)
+#define RETURN_WARN_DELETE_FAILURE   ENCODE_WARNING (2)
+#define RETURN_WARN_WRITE_FAILURE    ENCODE_WARNING (3)
+#define RETURN_WARN_BUFFER_TOO_SMALL ENCODE_WARNING (4)
+
+/**
+  Returns a 16-bit signature built from 2 ASCII characters.
+
+  @param  A	   The first ASCII character.
+  @param  B	   The second ASCII character.
+
+  @return A 16-bit value built from the two ASCII characters specified by A and B.
+
+**/
+#define SIGNATURE_16(A, B)        ((A) | (B << 8))
+
+/**
+  Returns a 32-bit signature built from 4 ASCII characters.
+
+  @param  A	   The first ASCII character.
+  @param  B	   The second ASCII character.
+  @param  C	   The third ASCII character.
+  @param  D	   The fourth ASCII character.
+
+  @return A 32-bit value built from the two ASCII characters specified by A, B,
+          C and D.
+
+**/
+#define SIGNATURE_32(A, B, C, D)  (SIGNATURE_16 (A, B) | (SIGNATURE_16 (C, D) << 16))
+
+/**
+  Returns a 64-bit signature built from 8 ASCII characters.
+
+  @param  A	   The first ASCII character.
+  @param  B	   The second ASCII character.
+  @param  C	   The third ASCII character.
+  @param  D	   The fourth ASCII character.
+  @param  E	   The fifth ASCII character.
+  @param  F	   The sixth ASCII character.
+  @param  G	   The seventh ASCII character.
+  @param  H	   The eighth ASCII character.
+
+  @return A 64-bit value built from the two ASCII characters specified by A, B,
+          C, D, E, F, G and H.
+
+**/
+#define SIGNATURE_64(A, B, C, D, E, F, G, H) \
+    (SIGNATURE_32 (A, B, C, D) | ((UINT64) (SIGNATURE_32 (E, F, G, H)) << 32))
+
+#endif
+
diff --git a/src/include/ipxe/efi/Guid/PcAnsi.h b/src/include/ipxe/efi/Guid/PcAnsi.h
new file mode 100644
index 0000000..1dab310
--- /dev/null
+++ b/src/include/ipxe/efi/Guid/PcAnsi.h
@@ -0,0 +1,58 @@
+/** @file
+  Terminal Device Path Vendor Guid.
+
+  Copyright (c) 2006, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  GUIDs defined in UEFI 2.0 spec.
+
+**/
+
+#ifndef __PC_ANSI_H__
+#define __PC_ANSI_H__
+
+#define EFI_PC_ANSI_GUID \
+  { \
+    0xe0c14753, 0xf9be, 0x11d2, {0x9a, 0x0c, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d } \
+  }
+
+#define EFI_VT_100_GUID \
+  { \
+    0xdfa66065, 0xb419, 0x11d3, {0x9a, 0x2d, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d } \
+  }
+
+#define EFI_VT_100_PLUS_GUID \
+  { \
+    0x7baec70b, 0x57e0, 0x4c76, {0x8e, 0x87, 0x2f, 0x9e, 0x28, 0x08, 0x83, 0x43 } \
+  }
+
+#define EFI_VT_UTF8_GUID \
+  { \
+    0xad15a0d6, 0x8bec, 0x4acf, {0xa0, 0x73, 0xd0, 0x1d, 0xe7, 0x7e, 0x2d, 0x88 } \
+  }
+
+#define EFI_UART_DEVICE_PATH_GUID \
+  { \
+    0x37499a9d, 0x542f, 0x4c89, {0xa0, 0x26, 0x35, 0xda, 0x14, 0x20, 0x94, 0xe4 } \
+  }
+
+#define EFI_SAS_DEVICE_PATH_GUID \
+  { \
+    0xd487ddb4, 0x008b, 0x11d9, {0xaf, 0xdc, 0x00, 0x10, 0x83, 0xff, 0xca, 0x4d } \
+  }
+
+extern EFI_GUID gEfiPcAnsiGuid;
+extern EFI_GUID gEfiVT100Guid;
+extern EFI_GUID gEfiVT100PlusGuid;
+extern EFI_GUID gEfiVTUTF8Guid;
+extern EFI_GUID gEfiUartDevicePathGuid;
+extern EFI_GUID gEfiSasDevicePathGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Guid/SmBios.h b/src/include/ipxe/efi/Guid/SmBios.h
new file mode 100644
index 0000000..c6c7f77
--- /dev/null
+++ b/src/include/ipxe/efi/Guid/SmBios.h
@@ -0,0 +1,34 @@
+/** @file
+  GUIDs used to locate the SMBIOS tables in the UEFI 2.0 system table.
+
+  This GUID in the system table is the only legal way to search for and
+  locate the SMBIOS tables. Do not search the 0xF0000 segment to find SMBIOS
+  tables.
+
+  Copyright (c) 2006, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  GUIDs defined in UEFI 2.0 spec.
+
+**/
+
+#ifndef __SMBIOS_GUID_H__
+#define __SMBIOS_GUID_H__
+
+#define EFI_SMBIOS_TABLE_GUID \
+  { \
+    0xeb9d2d31, 0x2d88, 0x11d3, {0x9a, 0x16, 0x0, 0x90, 0x27, 0x3f, 0xc1, 0x4d } \
+  }
+
+#define SMBIOS_TABLE_GUID EFI_SMBIOS_TABLE_GUID
+
+extern EFI_GUID       gEfiSmbiosTableGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Ia32/ProcessorBind.h b/src/include/ipxe/efi/Ia32/ProcessorBind.h
new file mode 100644
index 0000000..5a3a918
--- /dev/null
+++ b/src/include/ipxe/efi/Ia32/ProcessorBind.h
@@ -0,0 +1,215 @@
+/** @file
+  Processor or Compiler specific defines and types for Ia32 architecture.
+
+  Copyright (c) 2006, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PROCESSOR_BIND_H__
+#define __PROCESSOR_BIND_H__
+
+///
+/// Define the processor type so other code can make processor based choices
+///
+#define MDE_CPU_IA32
+
+//
+// Make sure we are useing the correct packing rules per EFI specification
+//
+#ifndef __GNUC__
+#pragma pack()
+#endif
+
+#if __INTEL_COMPILER
+//
+// Disable ICC's remark #869: "Parameter" was never referenced warning.
+// This is legal ANSI C code so we disable the remark that is turned on with -Wall
+//
+#pragma warning ( disable : 869 )
+
+//
+// Disable ICC's remark #1418: external function definition with no prior declaration.
+// This is legal ANSI C code so we disable the remark that is turned on with /W4
+//
+#pragma warning ( disable : 1418 )
+
+//
+// Disable ICC's remark #1419: external declaration in primary source file
+// This is legal ANSI C code so we disable the remark that is turned on with /W4
+//
+#pragma warning ( disable : 1419 )
+
+#endif
+
+
+#if _MSC_EXTENSIONS
+
+//
+// Disable warning that make it impossible to compile at /W4
+// This only works for Microsoft* tools
+//
+
+//
+// Disabling bitfield type checking warnings.
+//
+#pragma warning ( disable : 4214 )
+
+//
+// Disabling the unreferenced formal parameter warnings.
+//
+#pragma warning ( disable : 4100 )
+
+//
+// Disable slightly different base types warning as CHAR8 * can not be set
+// to a constant string.
+//
+#pragma warning ( disable : 4057 )
+
+//
+// ASSERT(FALSE) or while (TRUE) are legal constructes so supress this warning
+//
+#pragma warning ( disable : 4127 )
+
+//
+// This warning is caused by functions defined but not used. For precompiled header only.
+//
+#pragma warning ( disable : 4505 )
+
+//
+// This warning is caused by empty (after preprocessing) souce file. For precompiled header only.
+//
+#pragma warning ( disable : 4206 )
+
+#endif
+
+
+#if !defined(__GNUC__) && (__STDC_VERSION__ < 199901L)
+  //
+  // No ANSI C 2000 stdint.h integer width declarations, so define equivalents
+  //
+
+  #if _MSC_EXTENSIONS
+
+    //
+    // use Microsoft* C complier dependent interger width types
+    //
+    typedef unsigned __int64    UINT64;
+    typedef __int64             INT64;
+    typedef unsigned __int32    UINT32;
+    typedef __int32             INT32;
+    typedef unsigned short      UINT16;
+    typedef unsigned short      CHAR16;
+    typedef short               INT16;
+    typedef unsigned char       BOOLEAN;
+    typedef unsigned char       UINT8;
+    typedef char                CHAR8;
+    typedef char                INT8;
+  #else
+
+    //
+    // Assume standard IA-32 alignment.
+    // Need to check portability of long long
+    //
+    typedef unsigned long long  UINT64;
+    typedef long long           INT64;
+    typedef unsigned int        UINT32;
+    typedef int                 INT32;
+    typedef unsigned short      UINT16;
+    typedef unsigned short      CHAR16;
+    typedef short               INT16;
+    typedef unsigned char       BOOLEAN;
+    typedef unsigned char       UINT8;
+    typedef char                CHAR8;
+    typedef char                INT8;
+  #endif
+
+  #define UINT8_MAX 0xff
+
+#else
+  //
+  // Use ANSI C 2000 stdint.h integer width declarations
+  //
+  #include "stdint.h"
+  typedef uint8_t   BOOLEAN;
+  typedef int8_t    INT8;
+  typedef uint8_t   UINT8;
+  typedef int16_t   INT16;
+  typedef uint16_t  UINT16;
+  typedef int32_t   INT32;
+  typedef uint32_t  UINT32;
+  typedef int64_t   INT64;
+  typedef uint64_t  UINT64;
+  typedef char      CHAR8;
+  typedef uint16_t  CHAR16;
+
+#endif
+
+typedef UINT32  UINTN;
+typedef INT32   INTN;
+
+
+///
+/// Processor specific defines
+///
+#define MAX_BIT     0x80000000
+#define MAX_2_BITS  0xC0000000
+
+///
+/// Maximum legal IA-32 address
+///
+#define MAX_ADDRESS   0xFFFFFFFF
+
+///
+/// The stack alignment required for IA-32
+///
+#define CPU_STACK_ALIGNMENT   sizeof(UINTN)
+
+//
+// Modifier to ensure that all protocol member functions and EFI intrinsics
+// use the correct C calling convention. All protocol member functions and
+// EFI intrinsics are required to modify thier member functions with EFIAPI.
+//
+#if _MSC_EXTENSIONS
+  ///
+  /// Microsoft* compiler requires _EFIAPI useage, __cdecl is Microsoft* specific C.
+  ///
+  #define EFIAPI __cdecl
+#else
+  #if __GNUC__
+    #define EFIAPI __attribute__((cdecl,regparm(0)))
+  #endif
+#endif
+
+//
+// The Microsoft* C compiler can removed references to unreferenced data items
+//  if the /OPT:REF linker option is used. We defined a macro as this is a
+//  a non standard extension
+//
+#if _MSC_EXTENSIONS
+  #define GLOBAL_REMOVE_IF_UNREFERENCED __declspec(selectany)
+#else
+  #define GLOBAL_REMOVE_IF_UNREFERENCED
+#endif
+
+//
+// For symbol name in GNU assembly code, an extra "_" is necessary
+//
+#if __GNUC__
+  #if defined(linux)
+    #define ASM_PFX(name) name
+  #else
+    #define ASM_PFX(name) _##name
+  #endif
+#endif
+
+#define FUNCTION_ENTRY_POINT(p) (p)
+
+#endif
+
diff --git a/src/include/ipxe/efi/IndustryStandard/Pci22.h b/src/include/ipxe/efi/IndustryStandard/Pci22.h
new file mode 100644
index 0000000..5b96a56
--- /dev/null
+++ b/src/include/ipxe/efi/IndustryStandard/Pci22.h
@@ -0,0 +1,601 @@
+/** @file
+  Support for PCI 2.2 standard.
+
+  This file includes the definitions in the following specifications,
+    PCI Local Bus Specification, 2.0
+    PCI-to-PCI Bridge Architecture Specification,
+    PC Card Standard, 8.0
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef _PCI22_H_
+#define _PCI22_H_
+
+#define PCI_MAX_SEGMENT 0
+#define PCI_MAX_BUS     255
+#define PCI_MAX_DEVICE  31
+#define PCI_MAX_FUNC    7
+
+
+#pragma pack(1)
+typedef struct {
+  UINT16  VendorId;
+  UINT16  DeviceId;
+  UINT16  Command;
+  UINT16  Status;
+  UINT8   RevisionID;
+  UINT8   ClassCode[3];
+  UINT8   CacheLineSize;
+  UINT8   LatencyTimer;
+  UINT8   HeaderType;
+  UINT8   BIST;
+} PCI_DEVICE_INDEPENDENT_REGION;
+
+typedef struct {
+  UINT32  Bar[6];
+  UINT32  CISPtr;
+  UINT16  SubsystemVendorID;
+  UINT16  SubsystemID;
+  UINT32  ExpansionRomBar;
+  UINT8   CapabilityPtr;
+  UINT8   Reserved1[3];
+  UINT32  Reserved2;
+  UINT8   InterruptLine;
+  UINT8   InterruptPin;
+  UINT8   MinGnt;
+  UINT8   MaxLat;
+} PCI_DEVICE_HEADER_TYPE_REGION;
+
+typedef struct {
+  PCI_DEVICE_INDEPENDENT_REGION Hdr;
+  PCI_DEVICE_HEADER_TYPE_REGION Device;
+} PCI_TYPE00;
+
+///
+/// defined in PCI-to-PCI Bridge Architecture Specification
+///
+typedef struct {
+  UINT32  Bar[2];
+  UINT8   PrimaryBus;
+  UINT8   SecondaryBus;
+  UINT8   SubordinateBus;
+  UINT8   SecondaryLatencyTimer;
+  UINT8   IoBase;
+  UINT8   IoLimit;
+  UINT16  SecondaryStatus;
+  UINT16  MemoryBase;
+  UINT16  MemoryLimit;
+  UINT16  PrefetchableMemoryBase;
+  UINT16  PrefetchableMemoryLimit;
+  UINT32  PrefetchableBaseUpper32;
+  UINT32  PrefetchableLimitUpper32;
+  UINT16  IoBaseUpper16;
+  UINT16  IoLimitUpper16;
+  UINT8   CapabilityPtr;
+  UINT8   Reserved[3];
+  UINT32  ExpansionRomBAR;
+  UINT8   InterruptLine;
+  UINT8   InterruptPin;
+  UINT16  BridgeControl;
+} PCI_BRIDGE_CONTROL_REGISTER;
+
+typedef struct {
+  PCI_DEVICE_INDEPENDENT_REGION Hdr;
+  PCI_BRIDGE_CONTROL_REGISTER   Bridge;
+} PCI_TYPE01;
+
+typedef union {
+  PCI_TYPE00  Device;
+  PCI_TYPE01  Bridge;
+} PCI_TYPE_GENERIC;
+
+///
+/// CardBus Conroller Configuration Space, defined in PC Card Standard. 8.0
+///
+typedef struct {
+  UINT32  CardBusSocketReg;     ///< Cardus Socket/ExCA Base
+  UINT8   Cap_Ptr;
+  UINT8   Reserved;
+  UINT16  SecondaryStatus;      ///< Secondary Status
+  UINT8   PciBusNumber;         ///< PCI Bus Number
+  UINT8   CardBusBusNumber;     ///< CardBus Bus Number
+  UINT8   SubordinateBusNumber; ///< Subordinate Bus Number
+  UINT8   CardBusLatencyTimer;  ///< CardBus Latency Timer
+  UINT32  MemoryBase0;          ///< Memory Base Register 0
+  UINT32  MemoryLimit0;         ///< Memory Limit Register 0
+  UINT32  MemoryBase1;
+  UINT32  MemoryLimit1;
+  UINT32  IoBase0;
+  UINT32  IoLimit0;             ///< I/O Base Register 0
+  UINT32  IoBase1;              ///< I/O Limit Register 0
+  UINT32  IoLimit1;
+  UINT8   InterruptLine;        ///< Interrupt Line
+  UINT8   InterruptPin;         ///< Interrupt Pin
+  UINT16  BridgeControl;        ///< Bridge Control
+} PCI_CARDBUS_CONTROL_REGISTER;
+
+///
+/// Definitions of PCI class bytes and manipulation macros.
+///
+#define PCI_CLASS_OLD                 0x00
+#define   PCI_CLASS_OLD_OTHER           0x00
+#define   PCI_CLASS_OLD_VGA             0x01
+
+#define PCI_CLASS_MASS_STORAGE        0x01
+#define   PCI_CLASS_MASS_STORAGE_SCSI   0x00
+#define   PCI_CLASS_MASS_STORAGE_IDE    0x01
+#define   PCI_CLASS_MASS_STORAGE_FLOPPY 0x02
+#define   PCI_CLASS_MASS_STORAGE_IPI    0x03
+#define   PCI_CLASS_MASS_STORAGE_RAID   0x04
+#define   PCI_CLASS_MASS_STORAGE_OTHER  0x80
+
+#define PCI_CLASS_NETWORK             0x02
+#define   PCI_CLASS_NETWORK_ETHERNET    0x00
+#define   PCI_CLASS_NETWORK_TOKENRING   0x01
+#define   PCI_CLASS_NETWORK_FDDI        0x02
+#define   PCI_CLASS_NETWORK_ATM         0x03
+#define   PCI_CLASS_NETWORK_ISDN        0x04
+#define   PCI_CLASS_NETWORK_OTHER       0x80
+
+#define PCI_CLASS_DISPLAY             0x03
+#define   PCI_CLASS_DISPLAY_VGA         0x00
+#define     PCI_IF_VGA_VGA                0x00
+#define     PCI_IF_VGA_8514               0x01
+#define   PCI_CLASS_DISPLAY_XGA         0x01
+#define   PCI_CLASS_DISPLAY_3D          0x02
+#define   PCI_CLASS_DISPLAY_OTHER       0x80
+#define   PCI_CLASS_DISPLAY_GFX         0x80
+
+#define PCI_CLASS_MEDIA               0x04
+#define   PCI_CLASS_MEDIA_VIDEO         0x00
+#define   PCI_CLASS_MEDIA_AUDIO         0x01
+#define   PCI_CLASS_MEDIA_TELEPHONE     0x02
+#define   PCI_CLASS_MEDIA_OTHER         0x80
+
+#define PCI_CLASS_MEMORY_CONTROLLER   0x05
+#define   PCI_CLASS_MEMORY_RAM          0x00
+#define   PCI_CLASS_MEMORY_FLASH        0x01
+#define   PCI_CLASS_MEMORY_OTHER        0x80
+
+#define PCI_CLASS_BRIDGE              0x06
+#define   PCI_CLASS_BRIDGE_HOST         0x00
+#define   PCI_CLASS_BRIDGE_ISA          0x01
+#define   PCI_CLASS_BRIDGE_EISA         0x02
+#define   PCI_CLASS_BRIDGE_MCA          0x03
+#define   PCI_CLASS_BRIDGE_P2P          0x04
+#define     PCI_IF_BRIDGE_P2P             0x00
+#define     PCI_IF_BRIDGE_P2P_SUBTRACTIVE 0x01
+#define   PCI_CLASS_BRIDGE_PCMCIA       0x05
+#define   PCI_CLASS_BRIDGE_NUBUS        0x06
+#define   PCI_CLASS_BRIDGE_CARDBUS      0x07
+#define   PCI_CLASS_BRIDGE_RACEWAY      0x08
+#define   PCI_CLASS_BRIDGE_OTHER        0x80
+#define   PCI_CLASS_BRIDGE_ISA_PDECODE  0x80
+
+#define PCI_CLASS_SCC                 0x07  ///< Simple communications controllers
+#define   PCI_SUBCLASS_SERIAL           0x00
+#define     PCI_IF_GENERIC_XT             0x00
+#define     PCI_IF_16450                  0x01
+#define     PCI_IF_16550                  0x02
+#define     PCI_IF_16650                  0x03
+#define     PCI_IF_16750                  0x04
+#define     PCI_IF_16850                  0x05
+#define     PCI_IF_16950                  0x06
+#define   PCI_SUBCLASS_PARALLEL         0x01
+#define     PCI_IF_PARALLEL_PORT          0x00
+#define     PCI_IF_BI_DIR_PARALLEL_PORT   0x01
+#define     PCI_IF_ECP_PARALLEL_PORT      0x02
+#define     PCI_IF_1284_CONTROLLER        0x03
+#define     PCI_IF_1284_DEVICE            0xFE
+#define   PCI_SUBCLASS_MULTIPORT_SERIAL 0x02
+#define   PCI_SUBCLASS_MODEM            0x03
+#define     PCI_IF_GENERIC_MODEM          0x00
+#define     PCI_IF_16450_MODEM            0x01
+#define     PCI_IF_16550_MODEM            0x02
+#define     PCI_IF_16650_MODEM            0x03
+#define     PCI_IF_16750_MODEM            0x04
+#define   PCI_SUBCLASS_SCC_OTHER          0x80
+
+#define PCI_CLASS_SYSTEM_PERIPHERAL   0x08
+#define   PCI_SUBCLASS_PIC              0x00
+#define     PCI_IF_8259_PIC               0x00
+#define     PCI_IF_ISA_PIC                0x01
+#define     PCI_IF_EISA_PIC               0x02
+#define     PCI_IF_APIC_CONTROLLER        0x10  ///< I/O APIC interrupt controller , 32 bye none-prefectable memory.
+#define     PCI_IF_APIC_CONTROLLER2       0x20
+#define   PCI_SUBCLASS_DMA              0x01
+#define     PCI_IF_8237_DMA               0x00
+#define     PCI_IF_ISA_DMA                0x01
+#define     PCI_IF_EISA_DMA               0x02
+#define   PCI_SUBCLASS_TIMER            0x02
+#define     PCI_IF_8254_TIMER             0x00
+#define     PCI_IF_ISA_TIMER              0x01
+#define     PCI_IF_EISA_TIMER             0x02
+#define   PCI_SUBCLASS_RTC              0x03
+#define     PCI_IF_GENERIC_RTC            0x00
+#define     PCI_IF_ISA_RTC                0x00
+#define   PCI_SUBCLASS_PNP_CONTROLLER   0x04    ///< HotPlug Controller
+#define   PCI_SUBCLASS_PERIPHERAL_OTHER 0x80
+
+#define PCI_CLASS_INPUT_DEVICE        0x09
+#define   PCI_SUBCLASS_KEYBOARD         0x00
+#define   PCI_SUBCLASS_PEN              0x01
+#define   PCI_SUBCLASS_MOUSE_CONTROLLER 0x02
+#define   PCI_SUBCLASS_SCAN_CONTROLLER  0x03
+#define   PCI_SUBCLASS_GAMEPORT         0x04
+#define     PCI_IF_GAMEPORT               0x00
+#define     PCI_IF_GAMEPORT1              0x01
+#define   PCI_SUBCLASS_INPUT_OTHER      0x80
+
+#define PCI_CLASS_DOCKING_STATION     0x0A
+
+#define PCI_CLASS_PROCESSOR           0x0B
+#define   PCI_SUBCLASS_PROC_386         0x00
+#define   PCI_SUBCLASS_PROC_486         0x01
+#define   PCI_SUBCLASS_PROC_PENTIUM     0x02
+#define   PCI_SUBCLASS_PROC_ALPHA       0x10
+#define   PCI_SUBCLASS_PROC_POWERPC     0x20
+#define   PCI_SUBCLASS_PROC_MIPS        0x30
+#define   PCI_SUBCLASS_PROC_CO_PORC     0x40 ///< Co-Processor
+
+#define PCI_CLASS_SERIAL              0x0C
+#define   PCI_CLASS_SERIAL_FIREWIRE     0x00
+#define     PCI_IF_1394                   0x00
+#define     PCI_IF_1394_OPEN_HCI          0x10
+#define   PCI_CLASS_SERIAL_ACCESS_BUS   0x01
+#define   PCI_CLASS_SERIAL_SSA          0x02
+#define   PCI_CLASS_SERIAL_USB          0x03
+#define     PCI_IF_UHCI                   0x00
+#define     PCI_IF_OHCI                   0x10
+#define     PCI_IF_USB_OTHER              0x80
+#define     PCI_IF_USB_DEVICE             0xFE
+#define   PCI_CLASS_SERIAL_FIBRECHANNEL 0x04
+#define   PCI_CLASS_SERIAL_SMB          0x05
+
+#define PCI_CLASS_WIRELESS            0x0D
+#define   PCI_SUBCLASS_IRDA             0x00
+#define   PCI_SUBCLASS_IR               0x01
+#define   PCI_SUBCLASS_RF               0x02
+#define   PCI_SUBCLASS_WIRELESS_OTHER   0x80
+
+#define PCI_CLASS_INTELLIGENT_IO      0x0E
+
+#define PCI_CLASS_SATELLITE           0x0F
+#define   PCI_SUBCLASS_TV               0x01
+#define   PCI_SUBCLASS_AUDIO            0x02
+#define   PCI_SUBCLASS_VOICE            0x03
+#define   PCI_SUBCLASS_DATA             0x04
+
+#define PCI_SECURITY_CONTROLLER       0x10   ///< Encryption and decryption controller
+#define   PCI_SUBCLASS_NET_COMPUT       0x00
+#define   PCI_SUBCLASS_ENTERTAINMENT    0x10
+#define   PCI_SUBCLASS_SECURITY_OTHER   0x80
+
+#define PCI_CLASS_DPIO                0x11
+#define   PCI_SUBCLASS_DPIO             0x00
+#define   PCI_SUBCLASS_DPIO_OTHER       0x80
+
+#define IS_CLASS1(_p, c)              ((_p)->Hdr.ClassCode[2] == (c))
+#define IS_CLASS2(_p, c, s)           (IS_CLASS1 (_p, c) && ((_p)->Hdr.ClassCode[1] == (s)))
+#define IS_CLASS3(_p, c, s, p)        (IS_CLASS2 (_p, c, s) && ((_p)->Hdr.ClassCode[0] == (p)))
+
+#define IS_PCI_DISPLAY(_p)            IS_CLASS1 (_p, PCI_CLASS_DISPLAY)
+#define IS_PCI_VGA(_p)                IS_CLASS3 (_p, PCI_CLASS_DISPLAY, PCI_CLASS_DISPLAY_VGA, 0)
+#define IS_PCI_8514(_p)               IS_CLASS3 (_p, PCI_CLASS_DISPLAY, PCI_CLASS_DISPLAY_VGA, 1)
+#define IS_PCI_GFX(_p)                IS_CLASS3 (_p, PCI_CLASS_DISPLAY, PCI_CLASS_DISPLAY_GFX, 0)
+#define IS_PCI_OLD(_p)                IS_CLASS1 (_p, PCI_CLASS_OLD)
+#define IS_PCI_OLD_VGA(_p)            IS_CLASS2 (_p, PCI_CLASS_OLD, PCI_CLASS_OLD_VGA)
+#define IS_PCI_IDE(_p)                IS_CLASS2 (_p, PCI_CLASS_MASS_STORAGE, PCI_CLASS_MASS_STORAGE_IDE)
+#define IS_PCI_SCSI(_p)               IS_CLASS3 (_p, PCI_CLASS_MASS_STORAGE, PCI_CLASS_MASS_STORAGE_SCSI, 0)
+#define IS_PCI_RAID(_p)               IS_CLASS3 (_p, PCI_CLASS_MASS_STORAGE, PCI_CLASS_MASS_STORAGE_RAID, 0)
+#define IS_PCI_LPC(_p)                IS_CLASS3 (_p, PCI_CLASS_BRIDGE, PCI_CLASS_BRIDGE_ISA, 0)
+#define IS_PCI_P2P(_p)                IS_CLASS3 (_p, PCI_CLASS_BRIDGE, PCI_CLASS_BRIDGE_P2P, 0)
+#define IS_PCI_P2P_SUB(_p)            IS_CLASS3 (_p, PCI_CLASS_BRIDGE, PCI_CLASS_BRIDGE_P2P, 1)
+#define IS_PCI_16550_SERIAL(_p)       IS_CLASS3 (_p, PCI_CLASS_SCC, PCI_SUBCLASS_SERIAL, PCI_IF_16550)
+#define IS_PCI_USB(_p)                IS_CLASS2 (_p, PCI_CLASS_SERIAL, PCI_CLASS_SERIAL_USB)
+
+//
+// the definition of Header Type
+//
+#define HEADER_TYPE_DEVICE            0x00
+#define HEADER_TYPE_PCI_TO_PCI_BRIDGE 0x01
+#define HEADER_TYPE_CARDBUS_BRIDGE    0x02
+#define HEADER_TYPE_MULTI_FUNCTION    0x80
+//
+// Mask of Header type
+//
+#define HEADER_LAYOUT_CODE            0x7f
+
+#define IS_PCI_BRIDGE(_p)             (((_p)->Hdr.HeaderType & HEADER_LAYOUT_CODE) == (HEADER_TYPE_PCI_TO_PCI_BRIDGE))
+#define IS_CARDBUS_BRIDGE(_p)         (((_p)->Hdr.HeaderType & HEADER_LAYOUT_CODE) == (HEADER_TYPE_CARDBUS_BRIDGE))
+#define IS_PCI_MULTI_FUNC(_p)         ((_p)->Hdr.HeaderType & HEADER_TYPE_MULTI_FUNCTION)
+
+///
+/// Rom Base Address in Bridge, defined in PCI-to-PCI Bridge Architecure Specification,
+///
+#define PCI_BRIDGE_ROMBAR             0x38
+
+#define PCI_MAX_BAR                   0x0006
+#define PCI_MAX_CONFIG_OFFSET         0x0100
+
+#define PCI_VENDOR_ID_OFFSET                        0x00
+#define PCI_DEVICE_ID_OFFSET                        0x02
+#define PCI_COMMAND_OFFSET                          0x04
+#define PCI_PRIMARY_STATUS_OFFSET                   0x06
+#define PCI_REVISION_ID_OFFSET                      0x08
+#define PCI_CLASSCODE_OFFSET                        0x09
+#define PCI_CACHELINE_SIZE_OFFSET                   0x0C
+#define PCI_LATENCY_TIMER_OFFSET                    0x0D
+#define PCI_HEADER_TYPE_OFFSET                      0x0E
+#define PCI_BIST_OFFSET                             0x0F
+#define PCI_BASE_ADDRESSREG_OFFSET                  0x10
+#define PCI_CARDBUS_CIS_OFFSET                      0x28
+#define PCI_SVID_OFFSET                             0x2C ///< SubSystem Vendor id
+#define PCI_SUBSYSTEM_VENDOR_ID_OFFSET              0x2C
+#define PCI_SID_OFFSET                              0x2E ///< SubSystem ID
+#define PCI_SUBSYSTEM_ID_OFFSET                     0x2E
+#define PCI_EXPANSION_ROM_BASE                      0x30
+#define PCI_CAPBILITY_POINTER_OFFSET                0x34
+#define PCI_INT_LINE_OFFSET                         0x3C ///< Interrupt Line Register
+#define PCI_INT_PIN_OFFSET                          0x3D ///< Interrupt Pin Register
+#define PCI_MAXGNT_OFFSET                           0x3E ///< Max Grant Register
+#define PCI_MAXLAT_OFFSET                           0x3F ///< Max Latency Register
+
+///
+/// defined in PCI-to-PCI Bridge Architecture Specification
+///
+#define PCI_BRIDGE_PRIMARY_BUS_REGISTER_OFFSET      0x18
+#define PCI_BRIDGE_SECONDARY_BUS_REGISTER_OFFSET    0x19
+#define PCI_BRIDGE_SUBORDINATE_BUS_REGISTER_OFFSET  0x1a
+#define PCI_BRIDGE_STATUS_REGISTER_OFFSET           0x1E
+#define PCI_BRIDGE_CONTROL_REGISTER_OFFSET          0x3E
+
+///
+/// Interrupt Line "Unknown" or "No connection" value defined for x86 based system
+///
+#define PCI_INT_LINE_UNKNOWN                        0xFF
+
+typedef union {
+  struct {
+    UINT32  Reg : 8;
+    UINT32  Func : 3;
+    UINT32  Dev : 5;
+    UINT32  Bus : 8;
+    UINT32  Reserved : 7;
+    UINT32  Enable : 1;
+  } Bits;
+  UINT32  Uint32;
+} PCI_CONFIG_ACCESS_CF8;
+
+#pragma pack()
+
+#define EFI_PCI_COMMAND_IO_SPACE                        BIT0   ///< 0x0001
+#define EFI_PCI_COMMAND_MEMORY_SPACE                    BIT1   ///< 0x0002
+#define EFI_PCI_COMMAND_BUS_MASTER                      BIT2   ///< 0x0004
+#define EFI_PCI_COMMAND_SPECIAL_CYCLE                   BIT3   ///< 0x0008
+#define EFI_PCI_COMMAND_MEMORY_WRITE_AND_INVALIDATE     BIT4   ///< 0x0010
+#define EFI_PCI_COMMAND_VGA_PALETTE_SNOOP               BIT5   ///< 0x0020
+#define EFI_PCI_COMMAND_PARITY_ERROR_RESPOND            BIT6   ///< 0x0040
+#define EFI_PCI_COMMAND_STEPPING_CONTROL                BIT7   ///< 0x0080
+#define EFI_PCI_COMMAND_SERR                            BIT8   ///< 0x0100
+#define EFI_PCI_COMMAND_FAST_BACK_TO_BACK               BIT9   ///< 0x0200
+
+///
+/// defined in PCI-to-PCI Bridge Architecture Specification
+///
+#define EFI_PCI_BRIDGE_CONTROL_PARITY_ERROR_RESPONSE    BIT0   ///< 0x0001
+#define EFI_PCI_BRIDGE_CONTROL_SERR                     BIT1   ///< 0x0002
+#define EFI_PCI_BRIDGE_CONTROL_ISA                      BIT2   ///< 0x0004
+#define EFI_PCI_BRIDGE_CONTROL_VGA                      BIT3   ///< 0x0008
+#define EFI_PCI_BRIDGE_CONTROL_VGA_16                   BIT4   ///< 0x0010
+#define EFI_PCI_BRIDGE_CONTROL_MASTER_ABORT             BIT5   ///< 0x0020
+#define EFI_PCI_BRIDGE_CONTROL_RESET_SECONDARY_BUS      BIT6   ///< 0x0040
+#define EFI_PCI_BRIDGE_CONTROL_FAST_BACK_TO_BACK        BIT7   ///< 0x0080
+#define EFI_PCI_BRIDGE_CONTROL_PRIMARY_DISCARD_TIMER    BIT8   ///< 0x0100
+#define EFI_PCI_BRIDGE_CONTROL_SECONDARY_DISCARD_TIMER  BIT9   ///< 0x0200
+#define EFI_PCI_BRIDGE_CONTROL_TIMER_STATUS             BIT10  ///< 0x0400
+#define EFI_PCI_BRIDGE_CONTROL_DISCARD_TIMER_SERR       BIT11  ///< 0x0800
+
+///
+/// Following are the PCI-CARDBUS bridge control bit, defined in PC Card Standard
+///
+#define EFI_PCI_BRIDGE_CONTROL_IREQINT_ENABLE           BIT7   ///< 0x0080
+#define EFI_PCI_BRIDGE_CONTROL_RANGE0_MEMORY_TYPE       BIT8   ///< 0x0100
+#define EFI_PCI_BRIDGE_CONTROL_RANGE1_MEMORY_TYPE       BIT9   ///< 0x0200
+#define EFI_PCI_BRIDGE_CONTROL_WRITE_POSTING_ENABLE     BIT10  ///< 0x0400
+
+//
+// Following are the PCI status control bit
+//
+#define EFI_PCI_STATUS_CAPABILITY                       BIT4   ///< 0x0010
+#define EFI_PCI_STATUS_66MZ_CAPABLE                     BIT5   ///< 0x0020
+#define EFI_PCI_FAST_BACK_TO_BACK_CAPABLE               BIT7   ///< 0x0080
+#define EFI_PCI_MASTER_DATA_PARITY_ERROR                BIT8   ///< 0x0100
+
+///
+/// defined in PC Card Standard
+///
+#define EFI_PCI_CARDBUS_BRIDGE_CAPABILITY_PTR 0x14
+
+#pragma pack(1)
+//
+// PCI Capability List IDs and records
+//
+#define EFI_PCI_CAPABILITY_ID_PMI     0x01
+#define EFI_PCI_CAPABILITY_ID_AGP     0x02
+#define EFI_PCI_CAPABILITY_ID_VPD     0x03
+#define EFI_PCI_CAPABILITY_ID_SLOTID  0x04
+#define EFI_PCI_CAPABILITY_ID_MSI     0x05
+#define EFI_PCI_CAPABILITY_ID_HOTPLUG 0x06
+typedef struct {
+  UINT8 CapabilityID;
+  UINT8 NextItemPtr;
+} EFI_PCI_CAPABILITY_HDR;
+
+///
+/// Capability EFI_PCI_CAPABILITY_ID_PMI, defined in PCI Power Management Interface Specifiction
+///
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  UINT16                  PMC;
+  UINT16                  PMCSR;
+  UINT8                   BridgeExtention;
+  UINT8                   Data;
+} EFI_PCI_CAPABILITY_PMI;
+
+///
+/// Capability EFI_PCI_CAPABILITY_ID_AGP, defined in Accelerated Graphics Port Interface Specification
+///
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  UINT8                   Rev;
+  UINT8                   Reserved;
+  UINT32                  Status;
+  UINT32                  Command;
+} EFI_PCI_CAPABILITY_AGP;
+
+///
+/// Capability EFI_PCI_CAPABILITY_ID_VPD, in PCI2.2 Spec.
+///
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  UINT16                  AddrReg;
+  UINT32                  DataReg;
+} EFI_PCI_CAPABILITY_VPD;
+
+///
+/// Capability EFI_PCI_CAPABILITY_ID_SLOTID, defined in PCI-to-PCI Bridge Architeture Specification
+///
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  UINT8                   ExpnsSlotReg;
+  UINT8                   ChassisNo;
+} EFI_PCI_CAPABILITY_SLOTID;
+
+///
+/// Capability EFI_PCI_CAPABILITY_ID_MSI, defined in PCI2.2
+///
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  UINT16                  MsgCtrlReg;
+  UINT32                  MsgAddrReg;
+  UINT16                  MsgDataReg;
+} EFI_PCI_CAPABILITY_MSI32;
+
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  UINT16                  MsgCtrlReg;
+  UINT32                  MsgAddrRegLsdw;
+  UINT32                  MsgAddrRegMsdw;
+  UINT16                  MsgDataReg;
+} EFI_PCI_CAPABILITY_MSI64;
+
+///
+/// Capability EFI_PCI_CAPABILITY_ID_HOTPLUG, defined in CompactPCI Hot Swap Specification PICMG 2.1, R1.0
+///
+typedef struct {
+  EFI_PCI_CAPABILITY_HDR  Hdr;
+  ///
+  /// not finished - fields need to go here
+  ///
+} EFI_PCI_CAPABILITY_HOTPLUG;
+
+#define DEVICE_ID_NOCARE    0xFFFF
+
+#define PCI_ACPI_UNUSED     0
+#define PCI_BAR_NOCHANGE    0
+#define PCI_BAR_OLD_ALIGN   0xFFFFFFFFFFFFFFFFULL
+#define PCI_BAR_EVEN_ALIGN  0xFFFFFFFFFFFFFFFEULL
+#define PCI_BAR_SQUAD_ALIGN 0xFFFFFFFFFFFFFFFDULL
+#define PCI_BAR_DQUAD_ALIGN 0xFFFFFFFFFFFFFFFCULL
+
+#define PCI_BAR_IDX0        0x00
+#define PCI_BAR_IDX1        0x01
+#define PCI_BAR_IDX2        0x02
+#define PCI_BAR_IDX3        0x03
+#define PCI_BAR_IDX4        0x04
+#define PCI_BAR_IDX5        0x05
+#define PCI_BAR_ALL         0xFF
+
+///
+/// EFI PCI Option ROM definitions
+///
+#define EFI_ROOT_BRIDGE_LIST                            'eprb'
+#define EFI_PCI_EXPANSION_ROM_HEADER_EFISIGNATURE       0x0EF1  ///< defined in UEFI Spec.
+
+typedef struct {
+  UINT8 Register;
+  UINT8 Function;
+  UINT8 Device;
+  UINT8 Bus;
+  UINT8 Reserved[4];
+} DEFIO_PCI_ADDR;
+
+#define PCI_EXPANSION_ROM_HEADER_SIGNATURE              0xaa55
+#define PCI_DATA_STRUCTURE_SIGNATURE                    SIGNATURE_32 ('P', 'C', 'I', 'R')
+#define PCI_CODE_TYPE_PCAT_IMAGE                        0x00
+#define EFI_PCI_EXPANSION_ROM_HEADER_COMPRESSED         0x0001  ///<defined in UEFI spec.
+
+typedef struct {
+  UINT16  Signature;    ///< 0xaa55
+  UINT8   Reserved[0x16];
+  UINT16  PcirOffset;
+} PCI_EXPANSION_ROM_HEADER;
+
+typedef struct {
+  UINT16  Signature;    ///< 0xaa55
+  UINT8   Size512;
+  UINT8   InitEntryPoint[3];
+  UINT8   Reserved[0x12];
+  UINT16  PcirOffset;
+} EFI_LEGACY_EXPANSION_ROM_HEADER;
+
+typedef struct {
+  UINT32  Signature;    ///< "PCIR"
+  UINT16  VendorId;
+  UINT16  DeviceId;
+  UINT16  Reserved0;
+  UINT16  Length;
+  UINT8   Revision;
+  UINT8   ClassCode[3];
+  UINT16  ImageLength;
+  UINT16  CodeRevision;
+  UINT8   CodeType;
+  UINT8   Indicator;
+  UINT16  Reserved1;
+} PCI_DATA_STRUCTURE;
+
+///
+/// defined in EFI/UEFI Spec
+///
+typedef struct {
+  UINT16  Signature;    ///< 0xaa55
+  UINT16  InitializationSize;
+  UINT32  EfiSignature; ///< 0x0EF1
+  UINT16  EfiSubsystem;
+  UINT16  EfiMachineType;
+  UINT16  CompressionType;
+  UINT8   Reserved[8];
+  UINT16  EfiImageHeaderOffset;
+  UINT16  PcirOffset;
+} EFI_PCI_EXPANSION_ROM_HEADER;
+
+typedef union {
+  UINT8                           *Raw;
+  PCI_EXPANSION_ROM_HEADER        *Generic;
+  EFI_PCI_EXPANSION_ROM_HEADER    *Efi;
+  EFI_LEGACY_EXPANSION_ROM_HEADER *PcAt;
+} EFI_PCI_ROM_HEADER;
+
+#pragma pack()
+
+#endif
diff --git a/src/include/ipxe/efi/IndustryStandard/PeImage.h b/src/include/ipxe/efi/IndustryStandard/PeImage.h
new file mode 100644
index 0000000..73b3a5a
--- /dev/null
+++ b/src/include/ipxe/efi/IndustryStandard/PeImage.h
@@ -0,0 +1,752 @@
+/** @file
+  EFI image format for PE32, PE32+ and TE. Please note some data structures are
+  different for PE32 and PE32+. EFI_IMAGE_NT_HEADERS32 is for PE32 and
+  EFI_IMAGE_NT_HEADERS64 is for PE32+.
+
+  This file is coded to the Visual Studio, Microsoft Portable Executable and
+  Common Object File Format Specification, Revision 8.0 - May 16, 2006.
+  This file also includes some definitions in PI Specification, Revision 1.0.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PE_IMAGE_H__
+#define __PE_IMAGE_H__
+
+///
+/// PE32+ Subsystem type for EFI images
+///
+#define EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION         10
+#define EFI_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11
+#define EFI_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER      12
+#define EFI_IMAGE_SUBSYSTEM_EFI_EFI_ROM             13
+
+#define EFI_IMAGE_SUBSYSTEM_SAL_RUNTIME_DRIVER      13 ///< defined PI Specification, 1.0
+
+
+///
+/// PE32+ Machine type for EFI images
+///
+#define IMAGE_FILE_MACHINE_I386     0x014c
+#define IMAGE_FILE_MACHINE_IA64     0x0200
+#define IMAGE_FILE_MACHINE_EBC      0x0EBC
+#define IMAGE_FILE_MACHINE_X64      0x8664
+//
+// Support old names for backward compatible
+//
+#define EFI_IMAGE_MACHINE_IA32      IMAGE_FILE_MACHINE_I386
+#define EFI_IMAGE_MACHINE_IA64      IMAGE_FILE_MACHINE_IA64
+#define EFI_IMAGE_MACHINE_IPF       IMAGE_FILE_MACHINE_IA64
+#define EFI_IMAGE_MACHINE_EBC       IMAGE_FILE_MACHINE_EBC
+#define EFI_IMAGE_MACHINE_X64       IMAGE_FILE_MACHINE_X64
+
+///
+/// EXE file formats
+///
+#define EFI_IMAGE_DOS_SIGNATURE     SIGNATURE_16('M', 'Z')
+#define EFI_IMAGE_OS2_SIGNATURE     SIGNATURE_16('N', 'E')
+#define EFI_IMAGE_OS2_SIGNATURE_LE  SIGNATURE_16('L', 'E')
+#define EFI_IMAGE_NT_SIGNATURE      SIGNATURE_32('P', 'E', '\0', '\0')
+
+///
+/// PE images can start with an optional DOS header, so if an image is run
+/// under DOS it can print an error message.
+///
+typedef struct {
+  UINT16  e_magic;    ///< Magic number
+  UINT16  e_cblp;     ///< Bytes on last page of file
+  UINT16  e_cp;       ///< Pages in file
+  UINT16  e_crlc;     ///< Relocations
+  UINT16  e_cparhdr;  ///< Size of header in paragraphs
+  UINT16  e_minalloc; ///< Minimum extra paragraphs needed
+  UINT16  e_maxalloc; ///< Maximum extra paragraphs needed
+  UINT16  e_ss;       ///< Initial (relative) SS value
+  UINT16  e_sp;       ///< Initial SP value
+  UINT16  e_csum;     ///< Checksum
+  UINT16  e_ip;       ///< Initial IP value
+  UINT16  e_cs;       ///< Initial (relative) CS value
+  UINT16  e_lfarlc;   ///< File address of relocation table
+  UINT16  e_ovno;     ///< Overlay number
+  UINT16  e_res[4];   ///< Reserved words
+  UINT16  e_oemid;    ///< OEM identifier (for e_oeminfo)
+  UINT16  e_oeminfo;  ///< OEM information; e_oemid specific
+  UINT16  e_res2[10]; ///< Reserved words
+  UINT32  e_lfanew;   ///< File address of new exe header
+} EFI_IMAGE_DOS_HEADER;
+
+///
+/// COFF File Header (Object and Image)
+///
+typedef struct {
+  UINT16  Machine;
+  UINT16  NumberOfSections;
+  UINT32  TimeDateStamp;
+  UINT32  PointerToSymbolTable;
+  UINT32  NumberOfSymbols;
+  UINT16  SizeOfOptionalHeader;
+  UINT16  Characteristics;
+} EFI_IMAGE_FILE_HEADER;
+
+///
+/// Size of EFI_IMAGE_FILE_HEADER
+///
+#define EFI_IMAGE_SIZEOF_FILE_HEADER        20
+
+///
+/// Characteristics
+///
+#define EFI_IMAGE_FILE_RELOCS_STRIPPED      BIT0     ///< 0x0001  Relocation info stripped from file.
+#define EFI_IMAGE_FILE_EXECUTABLE_IMAGE     BIT1     ///< 0x0002  File is executable  (i.e. no unresolved externel references).
+#define EFI_IMAGE_FILE_LINE_NUMS_STRIPPED   BIT2     ///< 0x0004  Line nunbers stripped from file.
+#define EFI_IMAGE_FILE_LOCAL_SYMS_STRIPPED  BIT3     ///< 0x0008  Local symbols stripped from file.
+#define EFI_IMAGE_FILE_BYTES_REVERSED_LO    BIT7     ///< 0x0080  Bytes of machine word are reversed.
+#define EFI_IMAGE_FILE_32BIT_MACHINE        BIT8     ///< 0x0100  32 bit word machine.
+#define EFI_IMAGE_FILE_DEBUG_STRIPPED       BIT9     ///< 0x0200  Debugging info stripped from file in .DBG file
+#define EFI_IMAGE_FILE_SYSTEM               BIT12    ///< 0x1000  System File.
+#define EFI_IMAGE_FILE_DLL                  BIT13    ///< 0x2000  File is a DLL.
+#define EFI_IMAGE_FILE_BYTES_REVERSED_HI    BIT15    ///< 0x8000  Bytes of machine word are reversed.
+
+///
+/// Other Machine Types
+///
+#define EFI_IMAGE_FILE_MACHINE_UNKNOWN      0       ///< Any machine type
+#define EFI_IMAGE_FILE_MACHINE_I386         0x14c   ///< Intel 386.
+#define EFI_IMAGE_FILE_MACHINE_R3000        0x162   ///< MIPS* little-endian, 0540 big-endian
+#define EFI_IMAGE_FILE_MACHINE_R4000        0x166   ///< MIPS* little-endian
+#define EFI_IMAGE_FILE_MACHINE_POWERPC      0x1F0   ///< IBM* PowerPC Little-Endian
+//
+// * Other names and brands may be claimed as the property of others.
+//
+
+///
+/// Header Data Directories
+///
+typedef struct {
+  UINT32  VirtualAddress;
+  UINT32  Size;
+} EFI_IMAGE_DATA_DIRECTORY;
+
+#define EFI_IMAGE_ROM_OPTIONAL_HDR_MAGIC      0x107
+
+///
+/// Directory Entries
+///
+#define EFI_IMAGE_DIRECTORY_ENTRY_EXPORT      0
+#define EFI_IMAGE_DIRECTORY_ENTRY_IMPORT      1
+#define EFI_IMAGE_DIRECTORY_ENTRY_RESOURCE    2
+#define EFI_IMAGE_DIRECTORY_ENTRY_EXCEPTION   3
+#define EFI_IMAGE_DIRECTORY_ENTRY_SECURITY    4
+#define EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC   5
+#define EFI_IMAGE_DIRECTORY_ENTRY_DEBUG       6
+#define EFI_IMAGE_DIRECTORY_ENTRY_COPYRIGHT   7
+#define EFI_IMAGE_DIRECTORY_ENTRY_GLOBALPTR   8
+#define EFI_IMAGE_DIRECTORY_ENTRY_TLS         9
+#define EFI_IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10
+
+#define EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES 16
+
+///
+/// @attention
+/// EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC means PE32 and
+/// EFI_IMAGE_OPTIONAL_HEADER32 must be used. The data structures only vary
+/// after NT additional fields.
+///
+#define EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
+
+typedef struct {
+  ///
+  /// Standard fields.
+  ///
+  UINT16                    Magic;
+  UINT8                     MajorLinkerVersion;
+  UINT8                     MinorLinkerVersion;
+  UINT32                    SizeOfCode;
+  UINT32                    SizeOfInitializedData;
+  UINT32                    SizeOfUninitializedData;
+  UINT32                    AddressOfEntryPoint;
+  UINT32                    BaseOfCode;
+  UINT32                    BaseOfData;  ///< PE32 contains this additional field, which is absent in PE32+
+  ///
+  /// NT additional fields.
+  ///
+  UINT32                    ImageBase;
+  UINT32                    SectionAlignment;
+  UINT32                    FileAlignment;
+  UINT16                    MajorOperatingSystemVersion;
+  UINT16                    MinorOperatingSystemVersion;
+  UINT16                    MajorImageVersion;
+  UINT16                    MinorImageVersion;
+  UINT16                    MajorSubsystemVersion;
+  UINT16                    MinorSubsystemVersion;
+  UINT32                    Win32VersionValue;
+  UINT32                    SizeOfImage;
+  UINT32                    SizeOfHeaders;
+  UINT32                    CheckSum;
+  UINT16                    Subsystem;
+  UINT16                    DllCharacteristics;
+  UINT32                    SizeOfStackReserve;
+  UINT32                    SizeOfStackCommit;
+  UINT32                    SizeOfHeapReserve;
+  UINT32                    SizeOfHeapCommit;
+  UINT32                    LoaderFlags;
+  UINT32                    NumberOfRvaAndSizes;
+  EFI_IMAGE_DATA_DIRECTORY  DataDirectory[EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES];
+} EFI_IMAGE_OPTIONAL_HEADER32;
+
+///
+/// @attention
+/// EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC means PE32+ and
+/// EFI_IMAGE_OPTIONAL_HEADER64 must be used. The data structures only vary
+/// after NT additional fields.
+///
+#define EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
+
+typedef struct {
+  //
+  // Standard fields.
+  //
+  UINT16                    Magic;
+  UINT8                     MajorLinkerVersion;
+  UINT8                     MinorLinkerVersion;
+  UINT32                    SizeOfCode;
+  UINT32                    SizeOfInitializedData;
+  UINT32                    SizeOfUninitializedData;
+  UINT32                    AddressOfEntryPoint;
+  UINT32                    BaseOfCode;
+  //
+  // NT additional fields.
+  //
+  UINT64                    ImageBase;
+  UINT32                    SectionAlignment;
+  UINT32                    FileAlignment;
+  UINT16                    MajorOperatingSystemVersion;
+  UINT16                    MinorOperatingSystemVersion;
+  UINT16                    MajorImageVersion;
+  UINT16                    MinorImageVersion;
+  UINT16                    MajorSubsystemVersion;
+  UINT16                    MinorSubsystemVersion;
+  UINT32                    Win32VersionValue;
+  UINT32                    SizeOfImage;
+  UINT32                    SizeOfHeaders;
+  UINT32                    CheckSum;
+  UINT16                    Subsystem;
+  UINT16                    DllCharacteristics;
+  UINT64                    SizeOfStackReserve;
+  UINT64                    SizeOfStackCommit;
+  UINT64                    SizeOfHeapReserve;
+  UINT64                    SizeOfHeapCommit;
+  UINT32                    LoaderFlags;
+  UINT32                    NumberOfRvaAndSizes;
+  EFI_IMAGE_DATA_DIRECTORY  DataDirectory[EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES];
+} EFI_IMAGE_OPTIONAL_HEADER64;
+
+
+///
+/// @attention
+/// EFI_IMAGE_NT_HEADERS32 and EFI_IMAGE_HEADERS64 are for use ONLY
+/// by tools.  All proper EFI code MUST use EFI_IMAGE_NT_HEADERS ONLY!!!
+///
+typedef struct {
+  UINT32                      Signature;
+  EFI_IMAGE_FILE_HEADER       FileHeader;
+  EFI_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
+} EFI_IMAGE_NT_HEADERS32;
+
+#define EFI_IMAGE_SIZEOF_NT_OPTIONAL32_HEADER sizeof (EFI_IMAGE_NT_HEADERS32)
+
+typedef struct {
+  UINT32                      Signature;
+  EFI_IMAGE_FILE_HEADER       FileHeader;
+  EFI_IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+} EFI_IMAGE_NT_HEADERS64;
+
+#define EFI_IMAGE_SIZEOF_NT_OPTIONAL64_HEADER sizeof (EFI_IMAGE_NT_HEADERS64)
+
+
+///
+/// Processor specific definition of EFI_IMAGE_OPTIONAL_HEADER so the
+/// type name EFI_IMAGE_OPTIONAL_HEADER is appropriate to the build.  Same for
+/// EFI_IMAGE_NT_HEADERS.  These definitions MUST be used by ALL EFI code.
+///
+#if   defined (MDE_CPU_IA32)
+
+#define EFI_IMAGE_MACHINE_TYPE_SUPPORTED(Machine) \
+  (((Machine) == EFI_IMAGE_MACHINE_IA32) || ((Machine) == EFI_IMAGE_MACHINE_EBC))
+
+#define EFI_IMAGE_MACHINE_CROSS_TYPE_SUPPORTED(Machine) ((Machine) == EFI_IMAGE_MACHINE_X64)
+
+typedef EFI_IMAGE_NT_HEADERS32    EFI_IMAGE_NT_HEADERS;
+
+#elif defined (MDE_CPU_IPF)
+
+#define EFI_IMAGE_MACHINE_TYPE_SUPPORTED(Machine) \
+  (((Machine) == EFI_IMAGE_MACHINE_IPF) || ((Machine) == EFI_IMAGE_MACHINE_EBC))
+
+#define EFI_IMAGE_MACHINE_CROSS_TYPE_SUPPORTED(Machine) (FALSE)
+
+typedef EFI_IMAGE_NT_HEADERS64    EFI_IMAGE_NT_HEADERS;
+
+#elif defined (MDE_CPU_X64)
+
+#define EFI_IMAGE_MACHINE_TYPE_SUPPORTED(Machine) \
+  (((Machine) == EFI_IMAGE_MACHINE_X64) || ((Machine) == EFI_IMAGE_MACHINE_EBC))
+
+#define EFI_IMAGE_MACHINE_CROSS_TYPE_SUPPORTED(Machine) ((Machine) == EFI_IMAGE_MACHINE_IA32)
+
+typedef EFI_IMAGE_NT_HEADERS64    EFI_IMAGE_NT_HEADERS;
+
+#elif defined (MDE_CPU_EBC)
+
+///
+/// This is just to make sure you can cross compile with the EBC compiiler.
+/// It does not make sense to have a PE loader coded in EBC. You need to
+/// understand the basic
+///
+#define EFI_IMAGE_MACHINE_TYPE_SUPPORTED(Machine) ((Machine) == EFI_IMAGE_MACHINE_EBC)
+
+#define EFI_IMAGE_MACHINE_CROSS_TYPE_SUPPORTED(Machine) (FALSE)
+
+typedef EFI_IMAGE_NT_HEADERS64    EFI_IMAGE_NT_HEADERS;
+
+#else
+#error Unknown Processor Type
+#endif
+
+
+#define EFI_IMAGE_FIRST_SECTION(ntheader) \
+    ( \
+      (EFI_IMAGE_SECTION_HEADER *) \
+        ( \
+          (UINT32) ntheader + \
+          FIELD_OFFSET (EFI_IMAGE_NT_HEADERS, OptionalHeader) + \
+          ((EFI_IMAGE_NT_HEADERS *) (ntheader))->FileHeader.SizeOfOptionalHeader \
+        ) \
+    )
+
+///
+/// Other Windows Subsystem Values
+///
+#define EFI_IMAGE_SUBSYSTEM_UNKNOWN     0
+#define EFI_IMAGE_SUBSYSTEM_NATIVE      1
+#define EFI_IMAGE_SUBSYSTEM_WINDOWS_GUI 2
+#define EFI_IMAGE_SUBSYSTEM_WINDOWS_CUI 3
+#define EFI_IMAGE_SUBSYSTEM_OS2_CUI     5
+#define EFI_IMAGE_SUBSYSTEM_POSIX_CUI   7
+
+///
+/// Section header format.
+///
+#define EFI_IMAGE_SIZEOF_SHORT_NAME 8
+
+typedef struct {
+  UINT8 Name[EFI_IMAGE_SIZEOF_SHORT_NAME];
+  union {
+    UINT32  PhysicalAddress;
+    UINT32  VirtualSize;
+  } Misc;
+  UINT32  VirtualAddress;
+  UINT32  SizeOfRawData;
+  UINT32  PointerToRawData;
+  UINT32  PointerToRelocations;
+  UINT32  PointerToLinenumbers;
+  UINT16  NumberOfRelocations;
+  UINT16  NumberOfLinenumbers;
+  UINT32  Characteristics;
+} EFI_IMAGE_SECTION_HEADER;
+
+///
+/// Size of EFI_IMAGE_SECTION_HEADER
+///
+#define EFI_IMAGE_SIZEOF_SECTION_HEADER       40
+
+///
+/// Section Flags Values
+///
+#define EFI_IMAGE_SCN_TYPE_NO_PAD                  BIT3   ///< 0x00000008  ///< Reserved.
+#define EFI_IMAGE_SCN_CNT_CODE                     BIT5   ///< 0x00000020
+#define EFI_IMAGE_SCN_CNT_INITIALIZED_DATA         BIT6   ///< 0x00000040
+#define EFI_IMAGE_SCN_CNT_UNINITIALIZED_DATA       BIT7   ///< 0x00000080
+
+#define EFI_IMAGE_SCN_LNK_OTHER                    BIT8   ///< 0x00000100  ///< Reserved.
+#define EFI_IMAGE_SCN_LNK_INFO                     BIT9   ///< 0x00000200  ///< Section contains comments or some other type of information.
+#define EFI_IMAGE_SCN_LNK_REMOVE                   BIT10  ///< 0x00000800  ///< Section contents will not become part of image.
+#define EFI_IMAGE_SCN_LNK_COMDAT                   BIT12  ///< 0x00001000
+
+#define EFI_IMAGE_SCN_ALIGN_1BYTES                 BIT20  ///< 0x00100000
+#define EFI_IMAGE_SCN_ALIGN_2BYTES                 BIT21  ///< 0x00200000
+#define EFI_IMAGE_SCN_ALIGN_4BYTES          (BIT20|BIT21) ///< 0x00300000
+#define EFI_IMAGE_SCN_ALIGN_8BYTES                 BIT22  ///< 0x00400000
+#define EFI_IMAGE_SCN_ALIGN_16BYTES         (BIT20|BIT22) ///< 0x00500000
+#define EFI_IMAGE_SCN_ALIGN_32BYTES         (BIT21|BIT22) ///< 0x00600000
+#define EFI_IMAGE_SCN_ALIGN_64BYTES   (BIT20|BIT21|BIT22) ///< 0x00700000
+
+#define EFI_IMAGE_SCN_MEM_DISCARDABLE              BIT25  ///< 0x02000000
+#define EFI_IMAGE_SCN_MEM_NOT_CACHED               BIT26  ///< 0x04000000
+#define EFI_IMAGE_SCN_MEM_NOT_PAGED                BIT27  ///< 0x08000000
+#define EFI_IMAGE_SCN_MEM_SHARED                   BIT28  ///< 0x10000000
+#define EFI_IMAGE_SCN_MEM_EXECUTE                  BIT29  ///< 0x20000000
+#define EFI_IMAGE_SCN_MEM_READ                     BIT30  ///< 0x40000000
+#define EFI_IMAGE_SCN_MEM_WRITE                    BIT31  ///< 0x80000000
+
+///
+/// Size of a Symbol Table Record
+///
+#define EFI_IMAGE_SIZEOF_SYMBOL 18
+
+///
+/// Symbols have a section number of the section in which they are
+/// defined. Otherwise, section numbers have the following meanings:
+///
+#define EFI_IMAGE_SYM_UNDEFINED (UINT16) 0  ///< Symbol is undefined or is common.
+#define EFI_IMAGE_SYM_ABSOLUTE  (UINT16) -1 ///< Symbol is an absolute value.
+#define EFI_IMAGE_SYM_DEBUG     (UINT16) -2 ///< Symbol is a special debug item.
+
+///
+/// Symbol Type (fundamental) values.
+///
+#define EFI_IMAGE_SYM_TYPE_NULL   0   ///< no type.
+#define EFI_IMAGE_SYM_TYPE_VOID   1   ///< no valid type.
+#define EFI_IMAGE_SYM_TYPE_CHAR   2   ///< type character.
+#define EFI_IMAGE_SYM_TYPE_SHORT  3   ///< type short integer.
+#define EFI_IMAGE_SYM_TYPE_INT    4
+#define EFI_IMAGE_SYM_TYPE_LONG   5
+#define EFI_IMAGE_SYM_TYPE_FLOAT  6
+#define EFI_IMAGE_SYM_TYPE_DOUBLE 7
+#define EFI_IMAGE_SYM_TYPE_STRUCT 8
+#define EFI_IMAGE_SYM_TYPE_UNION  9
+#define EFI_IMAGE_SYM_TYPE_ENUM   10  ///< enumeration.
+#define EFI_IMAGE_SYM_TYPE_MOE    11  ///< member of enumeration.
+#define EFI_IMAGE_SYM_TYPE_BYTE   12
+#define EFI_IMAGE_SYM_TYPE_WORD   13
+#define EFI_IMAGE_SYM_TYPE_UINT   14
+#define EFI_IMAGE_SYM_TYPE_DWORD  15
+
+///
+/// Symbol Type (derived) values.
+///
+#define EFI_IMAGE_SYM_DTYPE_NULL      0 ///< no derived type.
+#define EFI_IMAGE_SYM_DTYPE_POINTER   1
+#define EFI_IMAGE_SYM_DTYPE_FUNCTION  2
+#define EFI_IMAGE_SYM_DTYPE_ARRAY     3
+
+///
+/// Storage classes.
+///
+#define EFI_IMAGE_SYM_CLASS_END_OF_FUNCTION   ((UINT8) -1)
+#define EFI_IMAGE_SYM_CLASS_NULL              0
+#define EFI_IMAGE_SYM_CLASS_AUTOMATIC         1
+#define EFI_IMAGE_SYM_CLASS_EXTERNAL          2
+#define EFI_IMAGE_SYM_CLASS_STATIC            3
+#define EFI_IMAGE_SYM_CLASS_REGISTER          4
+#define EFI_IMAGE_SYM_CLASS_EXTERNAL_DEF      5
+#define EFI_IMAGE_SYM_CLASS_LABEL             6
+#define EFI_IMAGE_SYM_CLASS_UNDEFINED_LABEL   7
+#define EFI_IMAGE_SYM_CLASS_MEMBER_OF_STRUCT  8
+#define EFI_IMAGE_SYM_CLASS_ARGUMENT          9
+#define EFI_IMAGE_SYM_CLASS_STRUCT_TAG        10
+#define EFI_IMAGE_SYM_CLASS_MEMBER_OF_UNION   11
+#define EFI_IMAGE_SYM_CLASS_UNION_TAG         12
+#define EFI_IMAGE_SYM_CLASS_TYPE_DEFINITION   13
+#define EFI_IMAGE_SYM_CLASS_UNDEFINED_STATIC  14
+#define EFI_IMAGE_SYM_CLASS_ENUM_TAG          15
+#define EFI_IMAGE_SYM_CLASS_MEMBER_OF_ENUM    16
+#define EFI_IMAGE_SYM_CLASS_REGISTER_PARAM    17
+#define EFI_IMAGE_SYM_CLASS_BIT_FIELD         18
+#define EFI_IMAGE_SYM_CLASS_BLOCK             100
+#define EFI_IMAGE_SYM_CLASS_FUNCTION          101
+#define EFI_IMAGE_SYM_CLASS_END_OF_STRUCT     102
+#define EFI_IMAGE_SYM_CLASS_FILE              103
+#define EFI_IMAGE_SYM_CLASS_SECTION           104
+#define EFI_IMAGE_SYM_CLASS_WEAK_EXTERNAL     105
+
+//
+// type packing constants
+//
+#define EFI_IMAGE_N_BTMASK  017
+#define EFI_IMAGE_N_TMASK   060
+#define EFI_IMAGE_N_TMASK1  0300
+#define EFI_IMAGE_N_TMASK2  0360
+#define EFI_IMAGE_N_BTSHFT  4
+#define EFI_IMAGE_N_TSHIFT  2
+
+///
+/// Communal selection types.
+///
+#define EFI_IMAGE_COMDAT_SELECT_NODUPLICATES    1
+#define EFI_IMAGE_COMDAT_SELECT_ANY             2
+#define EFI_IMAGE_COMDAT_SELECT_SAME_SIZE       3
+#define EFI_IMAGE_COMDAT_SELECT_EXACT_MATCH     4
+#define EFI_IMAGE_COMDAT_SELECT_ASSOCIATIVE     5
+
+///
+/// the following values only be referred in PeCoff, not defined in PECOFF.
+///
+#define EFI_IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY  1
+#define EFI_IMAGE_WEAK_EXTERN_SEARCH_LIBRARY    2
+#define EFI_IMAGE_WEAK_EXTERN_SEARCH_ALIAS      3
+
+///
+/// Relocation format.
+///
+typedef struct {
+  UINT32  VirtualAddress;
+  UINT32  SymbolTableIndex;
+  UINT16  Type;
+} EFI_IMAGE_RELOCATION;
+
+///
+/// Size of EFI_IMAGE_RELOCATION
+///
+#define EFI_IMAGE_SIZEOF_RELOCATION 10
+
+///
+/// I386 relocation types.
+///
+#define EFI_IMAGE_REL_I386_ABSOLUTE 0x0000  ///< Reference is absolute, no relocation is necessary
+#define EFI_IMAGE_REL_I386_DIR16    0x0001  ///< Direct 16-bit reference to the symbols virtual address
+#define EFI_IMAGE_REL_I386_REL16    0x0002  ///< PC-relative 16-bit reference to the symbols virtual address
+#define EFI_IMAGE_REL_I386_DIR32    0x0006  ///< Direct 32-bit reference to the symbols virtual address
+#define EFI_IMAGE_REL_I386_DIR32NB  0x0007  ///< Direct 32-bit reference to the symbols virtual address, base not included
+#define EFI_IMAGE_REL_I386_SEG12    0x0009  ///< Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
+#define EFI_IMAGE_REL_I386_SECTION  0x000A
+#define EFI_IMAGE_REL_I386_SECREL   0x000B
+#define EFI_IMAGE_REL_I386_REL32    0x0014  ///< PC-relative 32-bit reference to the symbols virtual address
+
+///
+/// x64 processor relocation types.
+///
+#define IMAGE_REL_AMD64_ABSOLUTE	0x0000
+#define IMAGE_REL_AMD64_ADDR64	  0x0001
+#define IMAGE_REL_AMD64_ADDR32	  0x0002
+#define IMAGE_REL_AMD64_ADDR32NB	0x0003
+#define IMAGE_REL_AMD64_REL32	    0x0004
+#define IMAGE_REL_AMD64_REL32_1	  0x0005
+#define IMAGE_REL_AMD64_REL32_2	  0x0006
+#define IMAGE_REL_AMD64_REL32_3	  0x0007
+#define IMAGE_REL_AMD64_REL32_4	  0x0008
+#define IMAGE_REL_AMD64_REL32_5	  0x0009
+#define IMAGE_REL_AMD64_SECTION	  0x000A
+#define IMAGE_REL_AMD64_SECREL	  0x000B
+#define IMAGE_REL_AMD64_SECREL7	  0x000C
+#define IMAGE_REL_AMD64_TOKEN	    0x000D
+#define IMAGE_REL_AMD64_SREL32	  0x000E
+#define IMAGE_REL_AMD64_PAIR	    0x000F
+#define IMAGE_REL_AMD64_SSPAN32	  0x0010
+
+///
+/// Based relocation format.
+///
+typedef struct {
+  UINT32  VirtualAddress;
+  UINT32  SizeOfBlock;
+} EFI_IMAGE_BASE_RELOCATION;
+
+///
+/// Size of EFI_IMAGE_BASE_RELOCATION
+///
+#define EFI_IMAGE_SIZEOF_BASE_RELOCATION  8
+
+///
+/// Based relocation types.
+///
+#define EFI_IMAGE_REL_BASED_ABSOLUTE      0
+#define EFI_IMAGE_REL_BASED_HIGH          1
+#define EFI_IMAGE_REL_BASED_LOW           2
+#define EFI_IMAGE_REL_BASED_HIGHLOW       3
+#define EFI_IMAGE_REL_BASED_HIGHADJ       4
+#define EFI_IMAGE_REL_BASED_MIPS_JMPADDR  5
+#define EFI_IMAGE_REL_BASED_IA64_IMM64    9
+#define IMAGE_REL_BASED_MIPS_JMPADDR16    9
+#define EFI_IMAGE_REL_BASED_DIR64         10
+
+///
+/// Line number format.
+///
+typedef struct {
+  union {
+    UINT32  SymbolTableIndex; // Symbol table index of function name if Linenumber is 0.
+    UINT32  VirtualAddress;   // Virtual address of line number.
+  } Type;
+  UINT16  Linenumber;         // Line number.
+} EFI_IMAGE_LINENUMBER;
+
+///
+/// Size of EFI_IMAGE_LINENUMBER
+///
+#define EFI_IMAGE_SIZEOF_LINENUMBER 6
+
+///
+/// Archive format.
+///
+#define EFI_IMAGE_ARCHIVE_START_SIZE        8
+#define EFI_IMAGE_ARCHIVE_START             "!<arch>\n"
+#define EFI_IMAGE_ARCHIVE_END               "`\n"
+#define EFI_IMAGE_ARCHIVE_PAD               "\n"
+#define EFI_IMAGE_ARCHIVE_LINKER_MEMBER     "/               "
+#define EFI_IMAGE_ARCHIVE_LONGNAMES_MEMBER  "//              "
+
+typedef struct {
+  UINT8 Name[16];     ///< File member name - `/' terminated.
+  UINT8 Date[12];     ///< File member date - decimal.
+  UINT8 UserID[6];    ///< File member user id - decimal.
+  UINT8 GroupID[6];   ///< File member group id - decimal.
+  UINT8 Mode[8];      ///< File member mode - octal.
+  UINT8 Size[10];     ///< File member size - decimal.
+  UINT8 EndHeader[2]; ///< String to end header. (0x60 0x0A)
+} EFI_IMAGE_ARCHIVE_MEMBER_HEADER;
+
+///
+/// Size of EFI_IMAGE_ARCHIVE_MEMBER_HEADER
+///
+#define EFI_IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60
+
+
+///
+/// DLL Support
+///
+
+///
+/// Export Directory Table
+///
+typedef struct {
+  UINT32  Characteristics;
+  UINT32  TimeDateStamp;
+  UINT16  MajorVersion;
+  UINT16  MinorVersion;
+  UINT32  Name;
+  UINT32  Base;
+  UINT32  NumberOfFunctions;
+  UINT32  NumberOfNames;
+  UINT32  AddressOfFunctions;
+  UINT32  AddressOfNames;
+  UINT32  AddressOfNameOrdinals;
+} EFI_IMAGE_EXPORT_DIRECTORY;
+
+///
+/// Hint/Name Table
+///
+typedef struct {
+  UINT16  Hint;
+  UINT8   Name[1];
+} EFI_IMAGE_IMPORT_BY_NAME;
+
+typedef struct {
+  union {
+    UINT32                    Function;
+    UINT32                    Ordinal;
+    EFI_IMAGE_IMPORT_BY_NAME  *AddressOfData;
+  } u1;
+} EFI_IMAGE_THUNK_DATA;
+
+#define EFI_IMAGE_ORDINAL_FLAG              BIT31    ///< Flag for PE32
+#define EFI_IMAGE_SNAP_BY_ORDINAL(Ordinal)  ((Ordinal & EFI_IMAGE_ORDINAL_FLAG) != 0)
+#define EFI_IMAGE_ORDINAL(Ordinal)          (Ordinal & 0xffff)
+
+///
+/// Import Directory Table
+///
+typedef struct {
+  UINT32                Characteristics;
+  UINT32                TimeDateStamp;
+  UINT32                ForwarderChain;
+  UINT32                Name;
+  EFI_IMAGE_THUNK_DATA  *FirstThunk;
+} EFI_IMAGE_IMPORT_DESCRIPTOR;
+
+
+///
+/// Debug Direcotry Format
+///
+typedef struct {
+  UINT32  Characteristics;
+  UINT32  TimeDateStamp;
+  UINT16  MajorVersion;
+  UINT16  MinorVersion;
+  UINT32  Type;
+  UINT32  SizeOfData;
+  UINT32  RVA;           ///< The address of the debug data when loaded, relative to the image base
+  UINT32  FileOffset;    ///< The file pointer to the debug data
+} EFI_IMAGE_DEBUG_DIRECTORY_ENTRY;
+
+#define EFI_IMAGE_DEBUG_TYPE_CODEVIEW 2     ///< The Visual C++ debug information
+
+///
+/// Debug Data Structure defined in Microsoft C++
+///
+#define CODEVIEW_SIGNATURE_NB10  SIGNATURE_32('N', 'B', '1', '0')
+typedef struct {
+  UINT32  Signature;                        ///< "NB10"
+  UINT32  Unknown;
+  UINT32  Unknown2;
+  UINT32  Unknown3;
+  //
+  // Filename of .PDB goes here
+  //
+} EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY;
+
+///
+/// Debug Data Structure defined in Microsoft C++
+///
+#define CODEVIEW_SIGNATURE_RSDS  SIGNATURE_32('R', 'S', 'D', 'S')
+typedef struct {
+  UINT32  Signature;                        ///< "RSDS"
+  UINT32  Unknown;
+  UINT32  Unknown2;
+  UINT32  Unknown3;
+  UINT32  Unknown4;
+  UINT32  Unknown5;
+  //
+  // Filename of .PDB goes here
+  //
+} EFI_IMAGE_DEBUG_CODEVIEW_RSDS_ENTRY;
+
+///
+/// Header format for TE images, defined in PI Specification, 1.0
+///
+typedef struct {
+  UINT16                    Signature;            ///< signature for TE format = "VZ"
+  UINT16                    Machine;              ///< from the original file header
+  UINT8                     NumberOfSections;     ///< from the original file header
+  UINT8                     Subsystem;            ///< from original optional header
+  UINT16                    StrippedSize;         ///< how many bytes we removed from the header
+  UINT32                    AddressOfEntryPoint;  ///< offset to entry point -- from original optional header
+  UINT32                    BaseOfCode;           ///< from original image -- required for ITP debug
+  UINT64                    ImageBase;            ///< from original file header
+  EFI_IMAGE_DATA_DIRECTORY  DataDirectory[2];     ///< only base relocation and debug directory
+} EFI_TE_IMAGE_HEADER;
+
+
+#define EFI_TE_IMAGE_HEADER_SIGNATURE  SIGNATURE_16('V', 'Z')
+
+//
+// Data directory indexes in our TE image header
+//
+#define EFI_TE_IMAGE_DIRECTORY_ENTRY_BASERELOC  0
+#define EFI_TE_IMAGE_DIRECTORY_ENTRY_DEBUG      1
+
+
+///
+/// Union of PE32, PE32+, and TE headers
+///
+typedef union {
+  EFI_IMAGE_NT_HEADERS32   Pe32;
+  EFI_IMAGE_NT_HEADERS64   Pe32Plus;
+  EFI_TE_IMAGE_HEADER      Te;
+} EFI_IMAGE_OPTIONAL_HEADER_UNION;
+
+typedef union {
+  EFI_IMAGE_NT_HEADERS32            *Pe32;
+  EFI_IMAGE_NT_HEADERS64            *Pe32Plus;
+  EFI_TE_IMAGE_HEADER               *Te;
+  EFI_IMAGE_OPTIONAL_HEADER_UNION   *Union;
+} EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION;
+
+#endif
diff --git a/src/include/ipxe/efi/LICENCE b/src/include/ipxe/efi/LICENCE
new file mode 100644
index 0000000..6c28e6f
--- /dev/null
+++ b/src/include/ipxe/efi/LICENCE
@@ -0,0 +1,40 @@
+The EFI headers contained herein are copied from the EFI Development
+Kit, available from http://www.tianocore.org and published under the
+following licence:
+
+  BSD License from Intel
+  Copyright (c) 2004, Intel Corporation
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+  Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+
+  Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+  Neither the name of the Intel Corporation nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+  FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+  COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+  ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  POSSIBILITY OF SUCH DAMAGE.
+
+
+This licence applies only to files that are part of the EFI
+Development Kit.  Other files may contain their own licence terms, or
+may fall under the standard iPXE GPL licence.
diff --git a/src/include/ipxe/efi/Pi/PiBootMode.h b/src/include/ipxe/efi/Pi/PiBootMode.h
new file mode 100644
index 0000000..a33bdf4
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiBootMode.h
@@ -0,0 +1,43 @@
+/** @file
+  Present the boot mode values in PI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+
+#ifndef __PI_BOOT_MODE_H__
+#define __PI_BOOT_MODE_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+
+///
+/// EFI boot mode
+///
+typedef UINT32  EFI_BOOT_MODE;
+
+//
+// 0x21 - 0xf..f are reserved.
+//
+#define BOOT_WITH_FULL_CONFIGURATION                  0x00
+#define BOOT_WITH_MINIMAL_CONFIGURATION               0x01
+#define BOOT_ASSUMING_NO_CONFIGURATION_CHANGES        0x02
+#define BOOT_WITH_FULL_CONFIGURATION_PLUS_DIAGNOSTICS 0x03
+#define BOOT_WITH_DEFAULT_SETTINGS                    0x04
+#define BOOT_ON_S4_RESUME                             0x05
+#define BOOT_ON_S5_RESUME                             0x06
+#define BOOT_ON_S2_RESUME                             0x10
+#define BOOT_ON_S3_RESUME                             0x11
+#define BOOT_ON_FLASH_UPDATE                          0x12
+#define BOOT_IN_RECOVERY_MODE                         0x20
+
+#endif
diff --git a/src/include/ipxe/efi/Pi/PiDependency.h b/src/include/ipxe/efi/Pi/PiDependency.h
new file mode 100644
index 0000000..73f6027
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiDependency.h
@@ -0,0 +1,47 @@
+/** @file
+  Present the dependency expression values in PI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+#ifndef __PI_DEPENDENCY_H__
+#define __PI_DEPENDENCY_H__
+
+///
+/// If present, this must be the first and only opcode,
+/// EFI_DEP_BEFORE is only used by DXE driver.
+///
+#define EFI_DEP_BEFORE        0x00
+
+///
+/// If present, this must be the first and only opcode,
+/// EFI_DEP_AFTER is only used by DXE driver.
+///
+#define EFI_DEP_AFTER         0x01
+
+#define EFI_DEP_PUSH          0x02
+#define EFI_DEP_AND           0x03
+#define EFI_DEP_OR            0x04
+#define EFI_DEP_NOT           0x05
+#define EFI_DEP_TRUE          0x06
+#define EFI_DEP_FALSE         0x07
+#define EFI_DEP_END           0x08
+
+
+///
+/// If present, this must be the first opcode,
+/// EFI_DEP_SOR is only used by DXE driver.
+///
+#define EFI_DEP_SOR           0x09
+
+#endif
diff --git a/src/include/ipxe/efi/Pi/PiDxeCis.h b/src/include/ipxe/efi/Pi/PiDxeCis.h
new file mode 100644
index 0000000..514295a
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiDxeCis.h
@@ -0,0 +1,642 @@
+/** @file
+  Include file matches things in PI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+
+#ifndef __PI_DXECIS_H__
+#define __PI_DXECIS_H__
+
+#include <ipxe/efi/Pi/PiMultiPhase.h>
+
+///
+/// Global Coherencey Domain types - Memory type
+///
+typedef enum {
+  EfiGcdMemoryTypeNonExistent,
+  EfiGcdMemoryTypeReserved,
+  EfiGcdMemoryTypeSystemMemory,
+  EfiGcdMemoryTypeMemoryMappedIo,
+  EfiGcdMemoryTypeMaximum
+} EFI_GCD_MEMORY_TYPE;
+
+///
+/// Global Coherencey Domain types - IO type
+///
+typedef enum {
+  EfiGcdIoTypeNonExistent,
+  EfiGcdIoTypeReserved,
+  EfiGcdIoTypeIo,
+  EfiGcdIoTypeMaximum
+} EFI_GCD_IO_TYPE;
+
+///
+/// The type of allocation to perform.
+///
+typedef enum {
+  EfiGcdAllocateAnySearchBottomUp,
+  EfiGcdAllocateMaxAddressSearchBottomUp,
+  EfiGcdAllocateAddress,
+  EfiGcdAllocateAnySearchTopDown,
+  EfiGcdAllocateMaxAddressSearchTopDown,
+  EfiGcdMaxAllocateType
+} EFI_GCD_ALLOCATE_TYPE;
+
+///
+/// EFI_GCD_MEMORY_SPACE_DESCRIPTOR
+///
+typedef struct {
+  ///
+  /// The physical address of the first byte in the memory region. Type
+  /// EFI_PHYSICAL_ADDRESS is defined in the AllocatePages() function
+  /// description in the UEFI 2.0 specification
+  ///
+  EFI_PHYSICAL_ADDRESS  BaseAddress;
+
+  ///
+  /// The number of bytes in the memory region.
+  ///
+  UINT64                Length;
+
+  ///
+  /// The bit mask of attributes that the memory region is capable of supporting. The bit
+  /// mask of available attributes is defined in the GetMemoryMap() function description
+  /// in the UEFI 2.0 specification.
+  ///
+  UINT64                Capabilities;
+  ///
+  /// The bit mask of attributes that the memory region is currently using. The bit mask of
+  /// available attributes is defined in GetMemoryMap().
+  ///
+  UINT64                Attributes;
+  ///
+  /// Type of the memory region. Type EFI_GCD_MEMORY_TYPE is defined in the
+  /// AddMemorySpace() function description
+  ///
+  EFI_GCD_MEMORY_TYPE   GcdMemoryType;
+
+  ///
+  /// The image handle of the agent that allocated the memory resource described by
+  /// PhysicalStart and NumberOfBytes. If this field is NULL, then the memory
+  /// resource is not currently allocated. Type EFI_HANDLE is defined in
+  /// InstallProtocolInterface() in the UEFI 2.0 specification.
+  ///
+  EFI_HANDLE            ImageHandle;
+
+  ///
+  /// The device handle for which the memory resource has been allocated. If
+  /// ImageHandle is NULL, then the memory resource is not currently allocated. If this
+  /// field is NULL, then the memory resource is not associated with a device that is
+  /// described by a device handle. Type EFI_HANDLE is defined in
+  /// InstallProtocolInterface() in the UEFI 2.0 specification.
+  ///
+  EFI_HANDLE            DeviceHandle;
+} EFI_GCD_MEMORY_SPACE_DESCRIPTOR;
+
+///
+/// EFI_GCD_IO_SPACE_DESCRIPTOR
+///
+typedef struct {
+  ///
+  /// Physical address of the first byte in the I/O region. Type
+  /// EFI_PHYSICAL_ADDRESS is defined in the AllocatePages() function
+  /// description in the UEFI 2.0 specification.
+  ///
+  EFI_PHYSICAL_ADDRESS  BaseAddress;
+
+  ///
+  /// Number of bytes in the I/O region.
+  ///
+  UINT64                Length;
+
+  ///
+  /// Type of the I/O region. Type EFI_GCD_IO_TYPE is defined in the
+  /// AddIoSpace() function description.
+  ///
+  EFI_GCD_IO_TYPE       GcdIoType;
+
+  ///
+  /// The image handle of the agent that allocated the I/O resource described by
+  /// PhysicalStart and NumberOfBytes. If this field is NULL, then the I/O
+  /// resource is not currently allocated. Type EFI_HANDLE is defined in
+  /// InstallProtocolInterface() in the UEFI 2.0 specification.
+  ///
+  EFI_HANDLE            ImageHandle;
+
+  ///
+  /// The device handle for which the I/O resource has been allocated. If ImageHandle
+  /// is NULL, then the I/O resource is not currently allocated. If this field is NULL, then
+  /// the I/O resource is not associated with a device that is described by a device handle.
+  /// Type EFI_HANDLE is defined in InstallProtocolInterface() in the UEFI
+  /// 2.0 specification.
+  ///
+  EFI_HANDLE            DeviceHandle;
+} EFI_GCD_IO_SPACE_DESCRIPTOR;
+
+
+/**
+  Adds reserved memory, system memory, or memory-mapped I/O resources to the
+  global coherency domain of the processor.
+
+  @param  GcdMemoryType    The type of memory resource being added.
+  @param  BaseAddress      The physical address that is the start address
+                           of the memory resource being added.
+  @param  Length           The size, in bytes, of the memory resource that
+                           is being added.
+  @param  Capabilities     The bit mask of attributes that the memory
+                           resource region supports.
+
+  @retval EFI_SUCCESS            The memory resource was added to the global
+                                 coherency domain of the processor.
+  @retval EFI_INVALID_PARAMETER  GcdMemoryType is invalid.
+  @retval EFI_INVALID_PARAMETER  Length is zero.
+  @retval EFI_OUT_OF_RESOURCES   There are not enough system resources to add
+                                 the memory resource to the global coherency
+                                 domain of the processor.
+  @retval EFI_UNSUPPORTED        The processor does not support one or more bytes
+                                 of the memory resource range specified by
+                                 BaseAddress and Length.
+  @retval EFI_ACCESS_DENIED      One or more bytes of the memory resource range
+                                 specified by BaseAddress and Length conflicts
+                                 with a memory resource range that was previously
+                                 added to the global coherency domain of the processor.
+  @retval EFI_ACCESS_DENIED      One or more bytes of the memory resource range
+                                 specified by BaseAddress and Length was allocated
+                                 in a prior call to AllocateMemorySpace()..
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_ADD_MEMORY_SPACE)(
+  IN EFI_GCD_MEMORY_TYPE   GcdMemoryType,
+  IN EFI_PHYSICAL_ADDRESS  BaseAddress,
+  IN UINT64                Length,
+  IN UINT64                Capabilities
+  );
+
+/**
+  Allocates nonexistent memory, reserved memory, system memory, or memorymapped
+  I/O resources from the global coherency domain of the processor.
+
+  @param  GcdAllocateType  The type of allocation to perform.
+  @param  GcdMemoryType    The type of memory resource being allocated.
+  @param  Alignment        The log base 2 of the boundary that BaseAddress must
+                           be aligned on output. Align with 2^Alignment.
+  @param  Length           The size in bytes of the memory resource range that
+                           is being allocated.
+  @param  BaseAddress      A pointer to a physical address to allocate.
+  @param  Imagehandle      The image handle of the agent that is allocating
+                           the memory resource.
+  @param  DeviceHandle     The device handle for which the memory resource
+                           is being allocated.
+
+  @retval EFI_INVALID_PARAMETER GcdAllocateType is invalid.
+  @retval EFI_INVALID_PARAMETER GcdMemoryType is invalid.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_INVALID_PARAMETER BaseAddress is NULL.
+  @retval EFI_INVALID_PARAMETER ImageHandle is NULL.
+  @retval EFI_NOT_FOUND         The memory resource request could not be satisfied.
+                                No descriptor contains the desired space.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to allocate the memory
+                                resource from the global coherency domain of the processor.
+  @retval EFI_SUCCESS           The memory resource was allocated from the global coherency
+                                domain of the processor.
+
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_ALLOCATE_MEMORY_SPACE)(
+  IN     EFI_GCD_ALLOCATE_TYPE               GcdAllocateType,
+  IN     EFI_GCD_MEMORY_TYPE                 GcdMemoryType,
+  IN     UINTN                               Alignment,
+  IN     UINT64                              Length,
+  IN OUT EFI_PHYSICAL_ADDRESS                *BaseAddress,
+  IN     EFI_HANDLE                          ImageHandle,
+  IN     EFI_HANDLE                          DeviceHandle OPTIONAL
+  );
+
+/**
+  Frees nonexistent memory, reserved memory, system memory, or memory-mapped
+  I/O resources from the global coherency domain of the processor.
+
+  @param  BaseAddress      The physical address that is the start address of the memory resource being freed.
+  @param  Length           The size in bytes of the memory resource range that is being freed.
+
+  @retval EFI_SUCCESS           The memory resource was freed from the global coherency domain of
+                                the processor.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the memory
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_NOT_FOUND         The memory resource range specified by BaseAddress and
+                                Length was not allocated with previous calls to AllocateMemorySpace().
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to free the memory resource
+                                from the global coherency domain of the processor.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_FREE_MEMORY_SPACE)(
+  IN EFI_PHYSICAL_ADDRESS  BaseAddress,
+  IN UINT64                Length
+  );
+
+/**
+  Removes reserved memory, system memory, or memory-mapped I/O resources from
+  the global coherency domain of the processor.
+
+  @param  BaseAddress      The physical address that is the start address of the memory resource being removed.
+  @param  Length           The size in bytes of the memory resource that is being removed.
+
+  @retval EFI_SUCCESS           The memory resource was removed from the global coherency
+                                domain of the processor.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the memory
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_NOT_FOUND         One or more bytes of the memory resource range specified by
+                                BaseAddress and Length was not added with previous calls to
+                                AddMemorySpace().
+  @retval EFI_ACCESS_DEFINED    One or more bytes of the memory resource range specified by
+                                BaseAddress and Length has been allocated with AllocateMemorySpace().
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to remove the memory
+                                resource from the global coherency domain of the processor.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_REMOVE_MEMORY_SPACE)(
+  IN EFI_PHYSICAL_ADDRESS  BaseAddress,
+  IN UINT64                Length
+  );
+
+/**
+  Retrieves the descriptor for a memory region containing a specified address.
+
+  @param  BaseAddress      The physical address that is the start address of a memory region.
+  @param  Descriptor       A pointer to a caller allocated descriptor.
+
+  @retval EFI_SUCCESS           The descriptor for the memory resource region containing
+                                BaseAddress was returned in Descriptor.
+  @retval EFI_INVALID_PARAMETER Descriptor is NULL.
+  @retval EFI_NOT_FOUND         A memory resource range containing BaseAddress was not found.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_MEMORY_SPACE_DESCRIPTOR)(
+  IN  EFI_PHYSICAL_ADDRESS             BaseAddress,
+  OUT EFI_GCD_MEMORY_SPACE_DESCRIPTOR  *Descriptor
+  );
+
+/**
+  Modifies the attributes for a memory region in the global coherency domain of the
+  processor.
+
+  @param  BaseAddress      The physical address that is the start address of a memory region.
+  @param  Length           The size in bytes of the memory region.
+  @param  Attributes       The bit mask of attributes to set for the memory region.
+
+  @retval EFI_SUCCESS           The attributes were set for the memory region.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the memory
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_UNSUPPORTED       The bit mask of attributes is not support for the memory resource
+                                range specified by BaseAddress and Length.
+  @retval EFI_ACCESS_DEFINED    The attributes for the memory resource range specified by
+                                BaseAddress and Length cannot be modified.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to modify the attributes of
+                                the memory resource range.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_MEMORY_SPACE_ATTRIBUTES)(
+  IN EFI_PHYSICAL_ADDRESS         BaseAddress,
+  IN UINT64                       Length,
+  IN UINT64                       Attributes
+  );
+
+/**
+  Returns a map of the memory resources in the global coherency domain of the
+  processor.
+
+  @param  NumberOfDescriptors A pointer to number of descriptors returned in the MemorySpaceMap buffer.
+  @param  MemorySpaceMap      A pointer to the array of EFI_GCD_MEMORY_SPACE_DESCRIPTORs.
+
+  @retval EFI_SUCCESS           The memory space map was returned in the MemorySpaceMap
+                                buffer, and the number of descriptors in MemorySpaceMap was
+                                returned in NumberOfDescriptors.
+  @retval EFI_INVALID_PARAMETER NumberOfDescriptors is NULL.
+  @retval EFI_INVALID_PARAMETER MemorySpaceMap is NULL.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources to allocate MemorySpaceMap.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_MEMORY_SPACE_MAP)(
+  OUT UINTN                            *NumberOfDescriptors,
+  OUT EFI_GCD_MEMORY_SPACE_DESCRIPTOR  **MemorySpaceMap
+  );
+
+/**
+  Adds reserved I/O or I/O resources to the global coherency domain of the processor.
+
+  @param  GcdIoType        The type of I/O resource being added.
+  @param  BaseAddress      The physical address that is the start address of the I/O resource being added.
+  @param  Length           The size in bytes of the I/O resource that is being added.
+
+  @retval EFI_SUCCESS           The I/O resource was added to the global coherency domain of
+                                the processor.
+  @retval EFI_INVALID_PARAMETER GcdIoType is invalid.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to add the I/O resource to
+                                the global coherency domain of the processor.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the I/O
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_ACCESS_DENIED     One or more bytes of the I/O resource range specified by
+                                BaseAddress and Length conflicts with an I/O resource
+                                range that was previously added to the global coherency domain
+                                of the processor.
+  @retval EFI_ACCESS_DENIED     One or more bytes of the I/O resource range specified by
+                                BaseAddress and Length was allocated in a prior call to
+                                AllocateIoSpace().
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_ADD_IO_SPACE)(
+  IN EFI_GCD_IO_TYPE       GcdIoType,
+  IN EFI_PHYSICAL_ADDRESS  BaseAddress,
+  IN UINT64                Length
+  );
+
+/**
+  Allocates nonexistent I/O, reserved I/O, or I/O resources from the global coherency
+  domain of the processor.
+
+  @param  GcdAllocateType  The type of allocation to perform.
+  @param  GcdIoType        The type of I/O resource being allocated.
+  @param  Alignment        The log base 2 of the boundary that BaseAddress must be aligned on output.
+  @param  Length           The size in bytes of the I/O resource range that is being allocated.
+  @param  BaseAddress      A pointer to a physical address.
+  @param  Imagehandle      The image handle of the agent that is allocating the I/O resource.
+  @param  DeviceHandle     The device handle for which the I/O resource is being allocated.
+
+  @retval EFI_SUCCESS           The I/O resource was allocated from the global coherency domain
+                                of the processor.
+  @retval EFI_INVALID_PARAMETER GcdAllocateType is invalid.
+  @retval EFI_INVALID_PARAMETER GcdIoType is invalid.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_INVALID_PARAMETER BaseAddress is NULL.
+  @retval EFI_INVALID_PARAMETER ImageHandle is NULL.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to allocate the I/O
+                                resource from the global coherency domain of the processor.
+  @retval EFI_NOT_FOUND         The I/O resource request could not be satisfied.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_ALLOCATE_IO_SPACE)(
+  IN     EFI_GCD_ALLOCATE_TYPE               GcdAllocateType,
+  IN     EFI_GCD_IO_TYPE                     GcdIoType,
+  IN     UINTN                               Alignment,
+  IN     UINT64                              Length,
+  IN OUT EFI_PHYSICAL_ADDRESS                *BaseAddress,
+  IN     EFI_HANDLE                          ImageHandle,
+  IN     EFI_HANDLE                          DeviceHandle OPTIONAL
+  );
+
+/**
+  Frees nonexistent I/O, reserved I/O, or I/O resources from the global coherency
+  domain of the processor.
+
+  @param  BaseAddress      The physical address that is the start address of the I/O resource being freed.
+  @param  Length           The size in bytes of the I/O resource range that is being freed.
+
+  @retval EFI_SUCCESS           The I/O resource was freed from the global coherency domain of the
+                                processor.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the I/O resource
+                                range specified by BaseAddress and Length.
+  @retval EFI_NOT_FOUND         The I/O resource range specified by BaseAddress and Length
+                                was not allocated with previous calls to AllocateIoSpace().
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to free the I/O resource from
+                                the global coherency domain of the processor.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_FREE_IO_SPACE)(
+  IN EFI_PHYSICAL_ADDRESS  BaseAddress,
+  IN UINT64                Length
+  );
+
+/**
+  Removes reserved I/O or I/O resources from the global coherency domain of the
+  processor.
+
+  @param  BaseAddress      A pointer to a physical address that is the start address of the I/O resource being
+                           removed.
+  @param Length            The size in bytes of the I/O resource that is being removed.
+
+  @retval EFI_SUCCESS           The I/O resource was removed from the global coherency domain
+                                of the processor.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the I/O
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_NOT_FOUND         One or more bytes of the I/O resource range specified by
+                                BaseAddress and Length was not added with previous
+                                calls to AddIoSpace().
+  @retval EFI_ACCESS_DENIED     One or more bytes of the I/O resource range specified by
+                                BaseAddress and Length has been allocated with
+                                AllocateIoSpace().
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to remove the I/O
+                                resource from the global coherency domain of the processor.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_REMOVE_IO_SPACE)(
+  IN EFI_PHYSICAL_ADDRESS  BaseAddress,
+  IN UINT64                Length
+  );
+
+/**
+  Retrieves the descriptor for an I/O region containing a specified address.
+
+  @param  BaseAddress      The physical address that is the start address of an I/O region.
+  @param  Descriptor       A pointer to a caller allocated descriptor.
+
+  @retval EFI_SUCCESS           The descriptor for the I/O resource region containing
+                                BaseAddress was returned in Descriptor.
+  @retval EFI_INVALID_PARAMETER Descriptor is NULL.
+  @retval EFI_NOT_FOUND         An I/O resource range containing BaseAddress was not found.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_IO_SPACE_DESCRIPTOR)(
+  IN  EFI_PHYSICAL_ADDRESS         BaseAddress,
+  OUT EFI_GCD_IO_SPACE_DESCRIPTOR  *Descriptor
+  );
+
+/**
+  Returns a map of the I/O resources in the global coherency domain of the processor.
+
+  @param  NumberOfDescriptors A pointer to number of descriptors returned in the IoSpaceMap buffer.
+  @param  MemorySpaceMap      A pointer to the array of EFI_GCD_IO_SPACE_DESCRIPTORs.
+
+  @retval EFI_SUCCESS           The I/O space map was returned in the IoSpaceMap buffer, and
+                                the number of descriptors in IoSpaceMap was returned in
+                                NumberOfDescriptors.
+  @retval EFI_INVALID_PARAMETER NumberOfDescriptors is NULL.
+  @retval EFI_INVALID_PARAMETER IoSpaceMap is NULL.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources to allocate IoSpaceMap.
+
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_IO_SPACE_MAP)(
+  OUT UINTN                        *NumberOfDescriptors,
+  OUT EFI_GCD_IO_SPACE_DESCRIPTOR  **IoSpaceMap
+  );
+
+
+
+/**
+  Loads and executed DXE drivers from firmware volumes.
+
+  The Dispatch() function searches for DXE drivers in firmware volumes that have been
+  installed since the last time the Dispatch() service was called. It then evaluates
+  the dependency expressions of all the DXE drivers and loads and executes those DXE
+  drivers whose dependency expression evaluate to TRUE. This service must interact with
+  the Security Architectural Protocol to authenticate DXE drivers before they are executed.
+  This process is continued until no more DXE drivers can be executed.
+
+  @retval EFI_SUCCESS         One or more DXE driver were dispatched.
+  @retval EFI_NOT_FOUND       No DXE drivers were dispatched.
+  @retval EFI_ALREADY_STARTED An attempt is being made to start the DXE Dispatcher recursively.
+                              Thus no action was taken.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_DISPATCH)(
+  VOID
+  );
+
+/**
+  Clears the Schedule on Request (SOR) flag for a component that is stored in a firmware volume.
+
+  @param  FirmwareVolumeHandle The handle of the firmware volume that contains the file specified by FileName.
+  @param  FileName             A pointer to the name of the file in a firmware volume.
+
+  @retval EFI_SUCCESS         The DXE driver was found and its SOR bit was cleared.
+  @retval EFI_NOT_FOUND       The DXE driver does not exist, or the DXE driver exists and its SOR
+                              bit is not set.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SCHEDULE)(
+  IN EFI_HANDLE  FirmwareVolumeHandle,
+  IN CONST EFI_GUID    *FileName
+  );
+
+/**
+  Promotes a file stored in a firmware volume from the untrusted to the trusted state.
+
+  @param  FirmwareVolumeHandle The handle of the firmware volume that contains the file specified by FileName.
+  @param  DriverName           A pointer to the name of the file in a firmware volume.
+
+  @return Status of promoting FFS from untrusted to trusted
+          state.
+  @retval EFI_NOT_FOUND       The file was not found in the untrusted state.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TRUST)(
+  IN EFI_HANDLE  FirmwareVolumeHandle,
+  IN CONST EFI_GUID    *FileName
+  );
+
+/**
+  Creates a firmware volume handle for a firmware volume that is present in system memory.
+
+  @param  FirmwareVolumeHeader A pointer to the header of the firmware volume.
+  @param  Size                 The size, in bytes, of the firmware volume.
+  @param  FirmwareVolumeHandle On output, a pointer to the created handle.
+
+  @retval EFI_SUCCESS          The EFI_FIRMWARE_VOLUME_PROTOCOL and
+                               EFI_DEVICE_PATH_PROTOCOL were installed onto
+                               FirmwareVolumeHandle for the firmware volume described
+                               by FirmwareVolumeHeader and Size.
+  @retval EFI_VOLUME_CORRUPTED The firmware volume described by FirmwareVolumeHeader
+                               and Size is corrupted.
+  @retval EFI_OUT_OF_RESOURCES There are not enough system resources available to produce the
+                               EFI_FIRMWARE_VOLUME_PROTOCOL and EFI_DEVICE_PATH_PROTOCOL
+                               for the firmware volume described by FirmwareVolumeHeader and Size.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PROCESS_FIRMWARE_VOLUME)(
+  IN CONST VOID                       *FirmwareVolumeHeader,
+  IN UINTN                            Size,
+  OUT EFI_HANDLE                      *FirmwareVolumeHandle
+  );
+
+//
+// DXE Services Table
+//
+#define DXE_SERVICES_SIGNATURE  0x565245535f455844ULL
+#define DXE_SERVICES_REVISION   ((1<<16) | (00))
+
+typedef struct {
+  EFI_TABLE_HEADER                Hdr;
+
+  //
+  // Global Coherency Domain Services
+  //
+  EFI_ADD_MEMORY_SPACE            AddMemorySpace;
+  EFI_ALLOCATE_MEMORY_SPACE       AllocateMemorySpace;
+  EFI_FREE_MEMORY_SPACE           FreeMemorySpace;
+  EFI_REMOVE_MEMORY_SPACE         RemoveMemorySpace;
+  EFI_GET_MEMORY_SPACE_DESCRIPTOR GetMemorySpaceDescriptor;
+  EFI_SET_MEMORY_SPACE_ATTRIBUTES SetMemorySpaceAttributes;
+  EFI_GET_MEMORY_SPACE_MAP        GetMemorySpaceMap;
+  EFI_ADD_IO_SPACE                AddIoSpace;
+  EFI_ALLOCATE_IO_SPACE           AllocateIoSpace;
+  EFI_FREE_IO_SPACE               FreeIoSpace;
+  EFI_REMOVE_IO_SPACE             RemoveIoSpace;
+  EFI_GET_IO_SPACE_DESCRIPTOR     GetIoSpaceDescriptor;
+  EFI_GET_IO_SPACE_MAP            GetIoSpaceMap;
+
+  //
+  // Dispatcher Services
+  //
+  EFI_DISPATCH                    Dispatch;
+  EFI_SCHEDULE                    Schedule;
+  EFI_TRUST                       Trust;
+  //
+  // Service to process a single firmware volume found in a capsule
+  //
+  EFI_PROCESS_FIRMWARE_VOLUME     ProcessFirmwareVolume;
+} DXE_SERVICES;
+
+typedef DXE_SERVICES EFI_DXE_SERVICES;
+
+#endif
diff --git a/src/include/ipxe/efi/Pi/PiFirmwareFile.h b/src/include/ipxe/efi/Pi/PiFirmwareFile.h
new file mode 100644
index 0000000..973a2b5
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiFirmwareFile.h
@@ -0,0 +1,242 @@
+/** @file
+  The firmware file related definitions in PI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+
+
+#ifndef __PI_FIRMWARE_FILE_H__
+#define __PI_FIRMWARE_FILE_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+
+#pragma pack(1)
+///
+/// Used to verify the integrity of the file.
+///
+typedef union {
+  struct {
+    UINT8   Header;
+    UINT8   File;
+  } Checksum;
+  UINT16    Checksum16;
+} EFI_FFS_INTEGRITY_CHECK;
+
+typedef UINT8 EFI_FV_FILETYPE;
+typedef UINT8 EFI_FFS_FILE_ATTRIBUTES;
+typedef UINT8 EFI_FFS_FILE_STATE;
+
+///
+/// File Types Definitions
+///
+#define EFI_FV_FILETYPE_ALL                   0x00
+#define EFI_FV_FILETYPE_RAW                   0x01
+#define EFI_FV_FILETYPE_FREEFORM              0x02
+#define EFI_FV_FILETYPE_SECURITY_CORE         0x03
+#define EFI_FV_FILETYPE_PEI_CORE              0x04
+#define EFI_FV_FILETYPE_DXE_CORE              0x05
+#define EFI_FV_FILETYPE_PEIM                  0x06
+#define EFI_FV_FILETYPE_DRIVER                0x07
+#define EFI_FV_FILETYPE_COMBINED_PEIM_DRIVER  0x08
+#define EFI_FV_FILETYPE_APPLICATION           0x09
+#define EFI_FV_FILETYPE_FIRMWARE_VOLUME_IMAGE 0x0B
+#define EFI_FV_FILETYPE_OEM_MIN               0xc0
+#define EFI_FV_FILETYPE_OEM_MAX               0xdf
+#define EFI_FV_FILETYPE_DEBUG_MIN             0xe0
+#define EFI_FV_FILETYPE_DEBUG_MAX             0xef
+#define EFI_FV_FILETYPE_FFS_MIN               0xf0
+#define EFI_FV_FILETYPE_FFS_MAX               0xff
+#define EFI_FV_FILETYPE_FFS_PAD               0xf0
+///
+/// FFS File Attributes.
+///
+#define FFS_ATTRIB_FIXED              0x04
+#define FFS_ATTRIB_DATA_ALIGNMENT     0x38
+#define FFS_ATTRIB_CHECKSUM           0x40
+
+///
+/// FFS File State Bits.
+///
+#define EFI_FILE_HEADER_CONSTRUCTION  0x01
+#define EFI_FILE_HEADER_VALID         0x02
+#define EFI_FILE_DATA_VALID           0x04
+#define EFI_FILE_MARKED_FOR_UPDATE    0x08
+#define EFI_FILE_DELETED              0x10
+#define EFI_FILE_HEADER_INVALID       0x20
+
+
+///
+/// Each file begins with the header that describe the
+/// contents and state of the files.
+///
+typedef struct {
+  EFI_GUID                Name;
+  EFI_FFS_INTEGRITY_CHECK IntegrityCheck;
+  EFI_FV_FILETYPE         Type;
+  EFI_FFS_FILE_ATTRIBUTES Attributes;
+  UINT8                   Size[3];
+  EFI_FFS_FILE_STATE      State;
+} EFI_FFS_FILE_HEADER;
+
+
+typedef UINT8 EFI_SECTION_TYPE;
+
+///
+/// Pseudo type. It is
+/// used as a wild card when retrieving sections. The section
+/// type EFI_SECTION_ALL matches all section types.
+///
+#define EFI_SECTION_ALL                   0x00
+
+///
+/// Encapsulation section Type values
+///
+#define EFI_SECTION_COMPRESSION           0x01
+
+#define EFI_SECTION_GUID_DEFINED          0x02
+
+///
+/// Leaf section Type values
+///
+#define EFI_SECTION_PE32                  0x10
+#define EFI_SECTION_PIC                   0x11
+#define EFI_SECTION_TE                    0x12
+#define EFI_SECTION_DXE_DEPEX             0x13
+#define EFI_SECTION_VERSION               0x14
+#define EFI_SECTION_USER_INTERFACE        0x15
+#define EFI_SECTION_COMPATIBILITY16       0x16
+#define EFI_SECTION_FIRMWARE_VOLUME_IMAGE 0x17
+#define EFI_SECTION_FREEFORM_SUBTYPE_GUID 0x18
+#define EFI_SECTION_RAW                   0x19
+#define EFI_SECTION_PEI_DEPEX             0x1B
+
+///
+/// Common section header
+///
+typedef struct {
+  UINT8             Size[3];
+  EFI_SECTION_TYPE  Type;
+} EFI_COMMON_SECTION_HEADER;
+
+///
+/// Leaf section type that contains an
+/// IA-32 16-bit executable image.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_COMPATIBILITY16_SECTION;
+
+///
+/// CompressionType of EFI_COMPRESSION_SECTION.
+///
+#define EFI_NOT_COMPRESSED        0x00
+#define EFI_STANDARD_COMPRESSION  0x01
+///
+/// An encapsulation section type in which the
+/// section data is compressed.
+///
+typedef struct {
+  EFI_COMMON_SECTION_HEADER   CommonHeader;
+  UINT32                      UncompressedLength;
+  UINT8                       CompressionType;
+} EFI_COMPRESSION_SECTION;
+
+///
+/// Leaf section which could be used to determine the dispatch order of DXEs.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_DXE_DEPEX_SECTION;
+
+///
+/// Leaf section which contains a PI FV.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_FIRMWARE_VOLUME_IMAGE_SECTION;
+
+///
+/// Leaf section which contains a single GUID.
+///
+typedef struct {
+  EFI_COMMON_SECTION_HEADER   CommonHeader;
+  EFI_GUID                    SubTypeGuid;
+} EFI_FREEFORM_SUBTYPE_GUID_SECTION;
+
+///
+/// Attributes of EFI_GUID_DEFINED_SECTION
+///
+#define EFI_GUIDED_SECTION_PROCESSING_REQUIRED  0x01
+#define EFI_GUIDED_SECTION_AUTH_STATUS_VALID    0x02
+///
+/// Leaf section which is encapsulation defined by specific GUID
+///
+typedef struct {
+  EFI_COMMON_SECTION_HEADER   CommonHeader;
+  EFI_GUID                    SectionDefinitionGuid;
+  UINT16                      DataOffset;
+  UINT16                      Attributes;
+} EFI_GUID_DEFINED_SECTION;
+
+///
+/// Leaf section which contains PE32+ image.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_PE32_SECTION;
+
+
+///
+/// Leaf section which used to determine the dispatch order of PEIMs.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_PEI_DEPEX_SECTION;
+
+///
+/// Leaf section which constains the position-independent-code image.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_TE_SECTION;
+
+///
+/// Leaf section which contains an array of zero or more bytes.
+///
+typedef EFI_COMMON_SECTION_HEADER EFI_RAW_SECTION;
+
+///
+/// Leaf section which contains a unicode string that
+/// is human readable file name.
+///
+typedef struct {
+  EFI_COMMON_SECTION_HEADER   CommonHeader;
+
+  ///
+  /// Array of unicode string.
+  ///
+  CHAR16                      FileNameString[1];
+} EFI_USER_INTERFACE_SECTION;
+
+
+///
+/// Leaf section which contains a numeric build number and
+/// an optional unicode string that represents the file revision.
+///
+typedef struct {
+  EFI_COMMON_SECTION_HEADER   CommonHeader;
+  UINT16                      BuildNumber;
+
+  ///
+  /// Array of unicode string.
+  ///
+  CHAR16                      VersionString[1];
+} EFI_VERSION_SECTION;
+
+
+#define SECTION_SIZE(SectionHeaderPtr) \
+    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) SectionHeaderPtr)->Size) & 0x00ffffff))
+
+#pragma pack()
+
+#endif
+
diff --git a/src/include/ipxe/efi/Pi/PiFirmwareVolume.h b/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
new file mode 100644
index 0000000..5f530e6
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
@@ -0,0 +1,154 @@
+/** @file
+  The firmware volume related definitions in PI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+
+#ifndef __PI_FIRMWAREVOLUME_H__
+#define __PI_FIRMWAREVOLUME_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+
+///
+/// EFI_FV_FILE_ATTRIBUTES
+///
+typedef UINT32  EFI_FV_FILE_ATTRIBUTES;
+
+//
+// Value of EFI_FV_FILE_ATTRIBUTES.
+//
+#define EFI_FV_FILE_ATTRIB_ALIGNMENT      0x0000001F
+#define EFI_FV_FILE_ATTRIB_FIXED          0x00000100
+#define EFI_FV_FILE_ATTRIB_MEMORY_MAPPED  0x00000200
+
+///
+/// type of EFI FVB attribute
+///
+typedef UINT32  EFI_FVB_ATTRIBUTES_2;
+
+//
+// Attributes bit definitions
+//
+#define EFI_FVB2_READ_DISABLED_CAP  0x00000001
+#define EFI_FVB2_READ_ENABLED_CAP   0x00000002
+#define EFI_FVB2_READ_STATUS        0x00000004
+#define EFI_FVB2_WRITE_DISABLED_CAP 0x00000008
+#define EFI_FVB2_WRITE_ENABLED_CAP  0x00000010
+#define EFI_FVB2_WRITE_STATUS       0x00000020
+#define EFI_FVB2_LOCK_CAP           0x00000040
+#define EFI_FVB2_LOCK_STATUS        0x00000080
+#define EFI_FVB2_STICKY_WRITE       0x00000200
+#define EFI_FVB2_MEMORY_MAPPED      0x00000400
+#define EFI_FVB2_ERASE_POLARITY     0x00000800
+#define EFI_FVB2_READ_LOCK_CAP      0x00001000
+#define EFI_FVB2_READ_LOCK_STATUS   0x00002000
+#define EFI_FVB2_WRITE_LOCK_CAP     0x00004000
+#define EFI_FVB2_WRITE_LOCK_STATUS  0x00008000
+#define EFI_FVB2_ALIGNMENT          0x001F0000
+#define EFI_FVB2_ALIGNMENT_1        0x00000000
+#define EFI_FVB2_ALIGNMENT_2        0x00010000
+#define EFI_FVB2_ALIGNMENT_4        0x00020000
+#define EFI_FVB2_ALIGNMENT_8        0x00030000
+#define EFI_FVB2_ALIGNMENT_16       0x00040000
+#define EFI_FVB2_ALIGNMENT_32       0x00050000
+#define EFI_FVB2_ALIGNMENT_64       0x00060000
+#define EFI_FVB2_ALIGNMENT_128      0x00070000
+#define EFI_FVB2_ALIGNMENT_256      0x00080000
+#define EFI_FVB2_ALIGNMENT_512      0x00090000
+#define EFI_FVB2_ALIGNMENT_1K       0x000A0000
+#define EFI_FVB2_ALIGNMENT_2K       0x000B0000
+#define EFI_FVB2_ALIGNMENT_4K       0x000C0000
+#define EFI_FVB2_ALIGNMENT_8K       0x000D0000
+#define EFI_FVB2_ALIGNMENT_16K      0x000E0000
+#define EFI_FVB2_ALIGNMENT_32K      0x000F0000
+#define EFI_FVB2_ALIGNMENT_64K      0x00100000
+#define EFI_FVB2_ALIGNMENT_128K     0x00110000
+#define EFI_FVB2_ALIGNMENT_256K     0x00120000
+#define EFI_FVB2_ALIGNMNET_512K     0x00130000
+#define EFI_FVB2_ALIGNMENT_1M       0x00140000
+#define EFI_FVB2_ALIGNMENT_2M       0x00150000
+#define EFI_FVB2_ALIGNMENT_4M       0x00160000
+#define EFI_FVB2_ALIGNMENT_8M       0x00170000
+#define EFI_FVB2_ALIGNMENT_16M      0x00180000
+#define EFI_FVB2_ALIGNMENT_32M      0x00190000
+#define EFI_FVB2_ALIGNMENT_64M      0x001A0000
+#define EFI_FVB2_ALIGNMENT_128M     0x001B0000
+#define EFI_FVB2_ALIGNMENT_256M     0x001C0000
+#define EFI_FVB2_ALIGNMENT_512M     0x001D0000
+#define EFI_FVB2_ALIGNMENT_1G       0x001E0000
+#define EFI_FVB2_ALIGNMENT_2G       0x001F0000
+
+
+typedef struct {
+  UINT32 NumBlocks;
+  UINT32 Length;
+} EFI_FV_BLOCK_MAP_ENTRY;
+
+///
+/// Describes the features and layout of the firmware volume.
+///
+typedef struct {
+  UINT8                     ZeroVector[16];
+  EFI_GUID                  FileSystemGuid;
+  UINT64                    FvLength;
+  UINT32                    Signature;
+  EFI_FVB_ATTRIBUTES_2      Attributes;
+  UINT16                    HeaderLength;
+  UINT16                    Checksum;
+  UINT16                    ExtHeaderOffset;
+  UINT8                     Reserved[1];
+  UINT8                     Revision;
+  EFI_FV_BLOCK_MAP_ENTRY    BlockMap[1];
+} EFI_FIRMWARE_VOLUME_HEADER;
+
+#define EFI_FVH_SIGNATURE EFI_SIGNATURE_32 ('_', 'F', 'V', 'H')
+
+///
+/// Firmware Volume Header Revision definition
+///
+#define EFI_FVH_REVISION  0x02
+
+///
+/// Extension header pointed by ExtHeaderOffset of volume header.
+///
+typedef struct {
+  EFI_GUID  FvName;
+  UINT32    ExtHeaderSize;
+} EFI_FIRMWARE_VOLUME_EXT_HEADER;
+
+///
+/// Entry struture for describing FV extension header
+///
+typedef struct {
+  UINT16    ExtEntrySize;
+  UINT16    ExtEntryType;
+} EFI_FIRMWARE_VOLUME_EXT_ENTRY;
+
+#define EFI_FV_EXT_TYPE_OEM_TYPE  0x01
+///
+/// This extension header provides a mapping between a GUID and an OEM file type.
+///
+typedef struct {
+  EFI_FIRMWARE_VOLUME_EXT_ENTRY Hdr;
+  UINT32    TypeMask;
+
+  //
+  // Array of GUIDs.
+  // Each GUID represents an OEM file type.
+  //
+  EFI_GUID  Types[1];
+} EFI_FIRMWARE_VOLUME_EXT_ENTRY_OEM_TYPE;
+
+
+#endif
diff --git a/src/include/ipxe/efi/Pi/PiHob.h b/src/include/ipxe/efi/Pi/PiHob.h
new file mode 100644
index 0000000..26dc45c
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiHob.h
@@ -0,0 +1,295 @@
+/** @file
+  HOB related definitions in PI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+
+#ifndef __PI_HOB_H__
+#define __PI_HOB_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+#include <ipxe/efi/Pi/PiBootMode.h>
+#include <ipxe/efi/Uefi/UefiBaseType.h>
+#include <ipxe/efi/Uefi/UefiMultiPhase.h>
+
+//
+// HobType of EFI_HOB_GENERIC_HEADER.
+//
+#define EFI_HOB_TYPE_HANDOFF              0x0001
+#define EFI_HOB_TYPE_MEMORY_ALLOCATION    0x0002
+#define EFI_HOB_TYPE_RESOURCE_DESCRIPTOR  0x0003
+#define EFI_HOB_TYPE_GUID_EXTENSION       0x0004
+#define EFI_HOB_TYPE_FV                   0x0005
+#define EFI_HOB_TYPE_CPU                  0x0006
+#define EFI_HOB_TYPE_MEMORY_POOL          0x0007
+#define EFI_HOB_TYPE_FV2                  0x0009
+#define EFI_HOB_TYPE_LOAD_PEIM            0x000A
+#define EFI_HOB_TYPE_UNUSED               0xFFFE
+#define EFI_HOB_TYPE_END_OF_HOB_LIST      0xFFFF
+
+///
+/// Describes the format and size of the data inside the HOB.
+/// All HOBs must contain this generic HOB header.
+///
+typedef struct {
+  UINT16    HobType;
+  UINT16    HobLength;
+  UINT32    Reserved;
+} EFI_HOB_GENERIC_HEADER;
+
+
+///
+/// Value of version ofinEFI_HOB_HANDOFF_INFO_TABLE.
+///
+#define EFI_HOB_HANDOFF_TABLE_VERSION 0x0009
+
+///
+/// Contains general state information used by the HOB producer phase.
+/// This HOB must be the first one in the HOB list.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER  Header;
+  UINT32                  Version;
+  EFI_BOOT_MODE           BootMode;
+  EFI_PHYSICAL_ADDRESS    EfiMemoryTop;
+  EFI_PHYSICAL_ADDRESS    EfiMemoryBottom;
+  EFI_PHYSICAL_ADDRESS    EfiFreeMemoryTop;
+  EFI_PHYSICAL_ADDRESS    EfiFreeMemoryBottom;
+  EFI_PHYSICAL_ADDRESS    EfiEndOfHobList;
+} EFI_HOB_HANDOFF_INFO_TABLE;
+
+///
+/// EFI_HOB_MEMORY_ALLOCATION_HEADER describes the
+/// various attributes of the logical memory allocation. The type field will be used for
+/// subsequent inclusion in the UEFI memory map.
+///
+typedef struct {
+  ///
+  /// A GUID that defines the memory allocation region's type and purpose, as well as
+  /// other fields within the memory allocation HOB. This GUID is used to define the
+  /// additional data within the HOB that may be present for the memory allocation HOB.
+  /// Type EFI_GUID is defined in InstallProtocolInterface() in the UEFI 2.0
+  /// specification.
+  ///
+  EFI_GUID              Name;
+
+  ///
+  /// The base address of memory allocated by this HOB. Type
+  /// EFI_PHYSICAL_ADDRESS is defined in AllocatePages() in the UEFI 2.0
+  /// specification.
+  ///
+  EFI_PHYSICAL_ADDRESS  MemoryBaseAddress;
+
+  ///
+  /// The length in bytes of memory allocated by this HOB.
+  ///
+  UINT64                MemoryLength;
+
+  ///
+  /// Defines the type of memory allocated by this HOB. The memory type definition
+  /// follows the EFI_MEMORY_TYPE definition. Type EFI_MEMORY_TYPE is defined
+  /// in AllocatePages() in the UEFI 2.0 specification.
+  ///
+  EFI_MEMORY_TYPE       MemoryType;
+
+  ///
+  /// Padding for Itanium processor family
+  ///
+  UINT8                 Reserved[4];
+} EFI_HOB_MEMORY_ALLOCATION_HEADER;
+
+///
+/// Describes all memory ranges used during the HOB producer
+/// phase that exist outside the HOB list. This HOB type
+/// describes how memory is used,
+/// not the physical attributes of memory.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER            Header;
+  EFI_HOB_MEMORY_ALLOCATION_HEADER  AllocDescriptor;
+  //
+  // Additional data pertaining to the "Name" Guid memory
+  // may go here.
+  //
+} EFI_HOB_MEMORY_ALLOCATION;
+
+
+///
+/// Describes the memory stack that is produced by the HOB producer
+/// phase and upon which all postmemory-installed executable
+/// content in the HOB producer phase is executing.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER            Header;
+  EFI_HOB_MEMORY_ALLOCATION_HEADER  AllocDescriptor;
+} EFI_HOB_MEMORY_ALLOCATION_STACK;
+
+///
+/// Defines the location of the boot-strap
+/// processor (BSP) BSPStore ("Backing Store Pointer Store").
+/// This HOB is valid for the Itanium processor family only
+/// register overflow store.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER            Header;
+  EFI_HOB_MEMORY_ALLOCATION_HEADER  AllocDescriptor;
+} EFI_HOB_MEMORY_ALLOCATION_BSP_STORE;
+
+///
+/// Defines the location and entry point of the HOB consumer phase.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER            Header;
+  EFI_HOB_MEMORY_ALLOCATION_HEADER  MemoryAllocationHeader;
+  EFI_GUID                          ModuleName;
+  EFI_PHYSICAL_ADDRESS              EntryPoint;
+} EFI_HOB_MEMORY_ALLOCATION_MODULE;
+
+///
+/// Resource type
+///
+typedef UINT32 EFI_RESOURCE_TYPE;
+
+//
+// Value of ResourceType in EFI_HOB_RESOURCE_DESCRIPTOR.
+//
+#define EFI_RESOURCE_SYSTEM_MEMORY          0x00000000
+#define EFI_RESOURCE_MEMORY_MAPPED_IO       0x00000001
+#define EFI_RESOURCE_IO                     0x00000002
+#define EFI_RESOURCE_FIRMWARE_DEVICE        0x00000003
+#define EFI_RESOURCE_MEMORY_MAPPED_IO_PORT  0x00000004
+#define EFI_RESOURCE_MEMORY_RESERVED        0x00000005
+#define EFI_RESOURCE_IO_RESERVED            0x00000006
+#define EFI_RESOURCE_MAX_MEMORY_TYPE        0x00000007
+
+///
+/// type of recount attribute type
+///
+typedef UINT32 EFI_RESOURCE_ATTRIBUTE_TYPE;
+
+//
+// These types can be ORed together as needed.
+//
+// The first three enumerations describe settings
+//
+#define EFI_RESOURCE_ATTRIBUTE_PRESENT              0x00000001
+#define EFI_RESOURCE_ATTRIBUTE_INITIALIZED          0x00000002
+#define EFI_RESOURCE_ATTRIBUTE_TESTED               0x00000004
+//
+// The rest of the settings describe capabilities
+//
+#define EFI_RESOURCE_ATTRIBUTE_SINGLE_BIT_ECC           0x00000008
+#define EFI_RESOURCE_ATTRIBUTE_MULTIPLE_BIT_ECC         0x00000010
+#define EFI_RESOURCE_ATTRIBUTE_ECC_RESERVED_1           0x00000020
+#define EFI_RESOURCE_ATTRIBUTE_ECC_RESERVED_2           0x00000040
+#define EFI_RESOURCE_ATTRIBUTE_READ_PROTECTED           0x00000080
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_PROTECTED          0x00000100
+#define EFI_RESOURCE_ATTRIBUTE_EXECUTION_PROTECTED      0x00000200
+#define EFI_RESOURCE_ATTRIBUTE_UNCACHEABLE              0x00000400
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_COMBINEABLE        0x00000800
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_THROUGH_CACHEABLE  0x00001000
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_BACK_CACHEABLE     0x00002000
+#define EFI_RESOURCE_ATTRIBUTE_16_BIT_IO                0x00004000
+#define EFI_RESOURCE_ATTRIBUTE_32_BIT_IO                0x00008000
+#define EFI_RESOURCE_ATTRIBUTE_64_BIT_IO                0x00010000
+#define EFI_RESOURCE_ATTRIBUTE_UNCACHED_EXPORTED        0x00020000
+
+///
+/// Describes the resource properties of all fixed,
+/// nonrelocatable resource ranges found on the processor
+/// host bus during the HOB producer phase.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER      Header;
+  EFI_GUID                    Owner;
+  EFI_RESOURCE_TYPE           ResourceType;
+  EFI_RESOURCE_ATTRIBUTE_TYPE ResourceAttribute;
+  EFI_PHYSICAL_ADDRESS        PhysicalStart;
+  UINT64                      ResourceLength;
+} EFI_HOB_RESOURCE_DESCRIPTOR;
+
+///
+/// Allows writers of executable content in the HOB producer phase to
+/// maintain and manage HOBs with specific GUID.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER      Header;
+  EFI_GUID                    Name;
+
+  ///
+  /// Guid specific data goes here
+  ///
+} EFI_HOB_GUID_TYPE;
+
+///
+/// Details the location of firmware volumes that contain firmware files.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER Header;
+  EFI_PHYSICAL_ADDRESS   BaseAddress;
+  UINT64                 Length;
+} EFI_HOB_FIRMWARE_VOLUME;
+
+///
+/// Details the location of a firmware volume which was extracted
+/// from a file within another firmware volume.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER  Header;
+  EFI_PHYSICAL_ADDRESS    BaseAddress;
+  UINT64                  Length;
+  EFI_GUID                FvName;
+  EFI_GUID                FileName;
+} EFI_HOB_FIRMWARE_VOLUME2;
+
+
+///
+/// Describes processor information, such as address space and I/O space capabilities.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER  Header;
+  UINT8                   SizeOfMemorySpace;
+  UINT8                   SizeOfIoSpace;
+  UINT8                   Reserved[6];
+} EFI_HOB_CPU;
+
+
+///
+/// Describes pool memory allocations.
+///
+typedef struct {
+  EFI_HOB_GENERIC_HEADER  Header;
+} EFI_HOB_MEMORY_POOL;
+
+///
+/// Union of all the possible HOB Types
+///
+typedef union {
+  EFI_HOB_GENERIC_HEADER              *Header;
+  EFI_HOB_HANDOFF_INFO_TABLE          *HandoffInformationTable;
+  EFI_HOB_MEMORY_ALLOCATION           *MemoryAllocation;
+  EFI_HOB_MEMORY_ALLOCATION_BSP_STORE *MemoryAllocationBspStore;
+  EFI_HOB_MEMORY_ALLOCATION_STACK     *MemoryAllocationStack;
+  EFI_HOB_MEMORY_ALLOCATION_MODULE    *MemoryAllocationModule;
+  EFI_HOB_RESOURCE_DESCRIPTOR         *ResourceDescriptor;
+  EFI_HOB_GUID_TYPE                   *Guid;
+  EFI_HOB_FIRMWARE_VOLUME             *FirmwareVolume;
+  EFI_HOB_FIRMWARE_VOLUME2            *FirmwareVolume2;
+  EFI_HOB_CPU                         *Cpu;
+  EFI_HOB_MEMORY_POOL                 *Pool;
+  UINT8                               *Raw;
+} EFI_PEI_HOB_POINTERS;
+
+
+#endif
diff --git a/src/include/ipxe/efi/Pi/PiMultiPhase.h b/src/include/ipxe/efi/Pi/PiMultiPhase.h
new file mode 100644
index 0000000..9644024
--- /dev/null
+++ b/src/include/ipxe/efi/Pi/PiMultiPhase.h
@@ -0,0 +1,104 @@
+/** @file
+  Include file matches things in PI for multiple module types.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  PI Version 1.0
+
+**/
+
+#ifndef __PI_MULTIPHASE_H__
+#define __PI_MULTIPHASE_H__
+
+#include <ipxe/efi/Uefi/UefiMultiPhase.h>
+
+#include <ipxe/efi/Pi/PiFirmwareVolume.h>
+#include <ipxe/efi/Pi/PiFirmwareFile.h>
+#include <ipxe/efi/Pi/PiBootMode.h>
+
+#include <ipxe/efi/Pi/PiHob.h>
+#include <ipxe/efi/Pi/PiDependency.h>
+
+
+#define EFI_NOT_AVAILABLE_YET   EFIERR (32)
+
+///
+/// Status Code Type Definition
+///
+typedef UINT32  EFI_STATUS_CODE_TYPE;
+
+//
+// A Status Code Type is made up of the code type and severity
+// All values masked by EFI_STATUS_CODE_RESERVED_MASK are
+// reserved for use by this specification.
+//
+#define EFI_STATUS_CODE_TYPE_MASK     0x000000FF
+#define EFI_STATUS_CODE_SEVERITY_MASK 0xFF000000
+#define EFI_STATUS_CODE_RESERVED_MASK 0x00FFFF00
+
+//
+// Definition of code types, all other values masked by
+// EFI_STATUS_CODE_TYPE_MASK are reserved for use by
+// this specification.
+//
+#define EFI_PROGRESS_CODE             0x00000001
+#define EFI_ERROR_CODE                0x00000002
+#define EFI_DEBUG_CODE                0x00000003
+
+//
+// Definitions of severities, all other values masked by
+// EFI_STATUS_CODE_SEVERITY_MASK are reserved for use by
+// this specification.
+// Uncontained errors are major errors that could not contained
+// to the specific component that is reporting the error
+// For example, if a memory error was not detected early enough,
+// the bad data could be consumed by other drivers.
+//
+#define EFI_ERROR_MINOR               0x40000000
+#define EFI_ERROR_MAJOR               0x80000000
+#define EFI_ERROR_UNRECOVERED         0x90000000
+#define EFI_ERROR_UNCONTAINED         0xa0000000
+
+///
+/// Status Code Value Definition
+///
+typedef UINT32 EFI_STATUS_CODE_VALUE;
+
+//
+// A Status Code Value is made up of the class, subclass, and
+// an operation.
+//
+#define EFI_STATUS_CODE_CLASS_MASK      0xFF000000
+#define EFI_STATUS_CODE_SUBCLASS_MASK   0x00FF0000
+#define EFI_STATUS_CODE_OPERATION_MASK  0x0000FFFF
+
+///
+/// Definition of Status Code extended data header.
+/// The data will follow HeaderSize bytes from the beginning of
+/// the structure and is Size bytes long.
+///
+typedef struct {
+  UINT16    HeaderSize;
+  UINT16    Size;
+  EFI_GUID  Type;
+} EFI_STATUS_CODE_DATA;
+
+
+//
+// Bit values for Authentication Status
+//
+#define EFI_AUTH_STATUS_PLATFORM_OVERRIDE   0x01
+#define EFI_AUTH_STATUS_IMAGE_SIGNED        0x02
+#define EFI_AUTH_STATUS_NOT_TESTED          0x04
+#define EFI_AUTH_STATUS_TEST_FAILED         0x08
+#define EFI_AUTH_STATUS_ALL                 0x0f
+
+#endif
diff --git a/src/include/ipxe/efi/PiDxe.h b/src/include/ipxe/efi/PiDxe.h
new file mode 100644
index 0000000..b79a96e
--- /dev/null
+++ b/src/include/ipxe/efi/PiDxe.h
@@ -0,0 +1,25 @@
+/** @file
+
+  Root include file for Mde Package DXE_CORE, DXE, SMM, SAL type modules.
+
+Copyright (c) 2006 - 2007, Intel Corporation
+All rights reserved. This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PI_DXE_H__
+#define __PI_DXE_H__
+
+#include <ipxe/efi/Uefi/UefiBaseType.h>
+#include <ipxe/efi/Uefi/UefiSpec.h>
+
+#include <ipxe/efi/Pi/PiDxeCis.h>
+
+#endif
+
diff --git a/src/include/ipxe/efi/ProcessorBind.h b/src/include/ipxe/efi/ProcessorBind.h
new file mode 100644
index 0000000..bf39cd6
--- /dev/null
+++ b/src/include/ipxe/efi/ProcessorBind.h
@@ -0,0 +1,14 @@
+/*
+ * EFI header files rely on having the CPU architecture directory
+ * present in the search path in order to pick up ProcessorBind.h.  We
+ * use this header file as a quick indirection layer.
+ *  - mcb30
+ */
+
+#if __i386__
+#include <ipxe/efi/Ia32/ProcessorBind.h>
+#endif
+
+#if __x86_64__
+#include <ipxe/efi/X64/ProcessorBind.h>
+#endif
diff --git a/src/include/ipxe/efi/Protocol/ComponentName2.h b/src/include/ipxe/efi/Protocol/ComponentName2.h
new file mode 100644
index 0000000..0f01014
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/ComponentName2.h
@@ -0,0 +1,174 @@
+/** @file
+  UEFI Component Name 2 Protocol as defined in the UEFI 2.1 specification.
+  This protocol is used to retrieve user readable names of drivers
+  and controllers managed by UEFI Drivers.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __EFI_COMPONENT_NAME2_H__
+#define __EFI_COMPONENT_NAME2_H__
+
+///
+/// Global ID for the Component Name Protocol
+///
+#define EFI_COMPONENT_NAME2_PROTOCOL_GUID \
+  {0x6a7a5cff, 0xe8d9, 0x4f70, { 0xba, 0xda, 0x75, 0xab, 0x30, 0x25, 0xce, 0x14 } }
+
+typedef struct _EFI_COMPONENT_NAME2_PROTOCOL  EFI_COMPONENT_NAME2_PROTOCOL;
+
+
+/**
+  Retrieves a Unicode string that is the user readable name of
+  the EFI Driver.
+
+  @param  This       A pointer to the
+                     EFI_COMPONENT_NAME2_PROTOCOL instance.
+
+  @param  Language   A pointer to a Null-terminated ASCII string
+                     array indicating the language. This is the
+                     language of the driver name that the caller
+                     is requesting, and it must match one of the
+                     languages specified in SupportedLanguages.
+                     The number of languages supported by a
+                     driver is up to the driver writer. Language
+                     is specified in RFC 3066 language code
+                     format.
+
+  @param  DriverName A pointer to the Unicode string to return.
+                     This Unicode string is the name of the
+                     driver specified by This in the language
+                     specified by Language.
+
+  @retval EFI_SUCCESS           The Unicode string for the
+                                Driver specified by This and the
+                                language specified by Language
+                                was returned in DriverName.
+
+  @retval EFI_INVALID_PARAMETER Language is NULL.
+
+  @retval EFI_INVALID_PARAMETER DriverName is NULL.
+
+  @retval EFI_UNSUPPORTED       The driver specified by This
+                                does not support the language
+                                specified by Language.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_COMPONENT_NAME2_GET_DRIVER_NAME)(
+  IN EFI_COMPONENT_NAME2_PROTOCOL          *This,
+  IN  CHAR8                                *Language,
+  OUT CHAR16                               **DriverName
+  );
+
+
+/**
+  Retrieves a Unicode string that is the user readable name of
+  the controller that is being managed by an EFI Driver.
+
+  @param  This             A pointer to the
+                           EFI_COMPONENT_NAME2_PROTOCOL instance.
+
+  @param  ControllerHandle The handle of a controller that the
+                           driver specified by This is managing.
+                           This handle specifies the controller
+                           whose name is to be returned.
+
+  @param ChildHandle      The handle of the child controller to
+                           retrieve the name of.  This is an
+                           optional parameter that may be NULL.
+                           It will be NULL for device drivers.
+                           It will also be NULL for a bus
+                           drivers that wish to retrieve the
+                           name of the bus controller.  It will
+                           not be NULL for a bus driver that
+                           wishes to retrieve the name of a
+                           child controller.
+
+  @param  Language         A pointer to a Null-terminated ASCII
+                           string array indicating the language.
+                           This is the language of the driver
+                           name that the caller is requesting,
+                           and it must match one of the
+                           languages specified in
+                           SupportedLanguages. The number of
+                           languages supported by a driver is up
+                           to the driver writer. Language is
+                           specified in RFC 3066 language code
+                           format.
+
+  @param  ControllerName   A pointer to the Unicode string to
+                           return.  This Unicode string is the
+                           name of the controller specified by
+                           ControllerHandle and ChildHandle in
+                           the language specified by Language
+                           from the point of view of the driver
+                           specified by This.
+
+  @retval EFI_SUCCESS           The Unicode string for the user
+                                readable name in the language
+                                specified by Language for the
+                                driver specified by This was
+                                returned in DriverName.
+
+  @retval EFI_INVALID_PARAMETER ControllerHandle is not a valid
+                                EFI_HANDLE.
+
+  @retval EFI_INVALID_PARAMETER ChildHandle is not NULL and it
+                                is not a valid EFI_HANDLE.
+
+  @retval EFI_INVALID_PARAMETER Language is NULL.
+
+  @retval EFI_INVALID_PARAMETER ControllerName is NULL.
+
+  @retval EFI_UNSUPPORTED       The driver specified by This is
+                                not currently managing the
+                                controller specified by
+                                ControllerHandle and
+                                ChildHandle.
+
+  @retval EFI_UNSUPPORTED       The driver specified by This
+                                does not support the language
+                                specified by Language.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_COMPONENT_NAME2_GET_CONTROLLER_NAME)(
+  IN EFI_COMPONENT_NAME2_PROTOCOL *This,
+  IN  EFI_HANDLE                  ControllerHandle,
+  IN  EFI_HANDLE                  ChildHandle        OPTIONAL,
+  IN  CHAR8                       *Language,
+  OUT CHAR16                      **ControllerName
+  );
+
+///
+/// This protocol is used to retrieve user readable names of drivers
+/// and controllers managed by UEFI Drivers.
+///
+struct _EFI_COMPONENT_NAME2_PROTOCOL {
+  EFI_COMPONENT_NAME2_GET_DRIVER_NAME      GetDriverName;
+  EFI_COMPONENT_NAME2_GET_CONTROLLER_NAME  GetControllerName;
+
+  ///
+  /// A Null-terminated ASCII string array that contains one or more
+  /// supported language codes. This is the list of language codes that
+  /// this protocol supports. The number of languages supported by a
+  /// driver is up to the driver writer. SupportedLanguages is
+  /// specified in RFC 3066 format.
+  ///
+  CHAR8                                    *SupportedLanguages;
+};
+
+extern EFI_GUID gEfiComponentName2ProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/Cpu.h b/src/include/ipxe/efi/Protocol/Cpu.h
new file mode 100644
index 0000000..b06c0df
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/Cpu.h
@@ -0,0 +1,291 @@
+/** @file
+  CPU Architectural Protocol as defined in PI spec Volume 2 DXE
+
+  This code abstracts the DXE core from processor implementation details.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __ARCH_PROTOCOL_CPU_H__
+#define __ARCH_PROTOCOL_CPU_H__
+
+#include <ipxe/efi/Protocol/DebugSupport.h>
+
+#define EFI_CPU_ARCH_PROTOCOL_GUID \
+  { 0x26baccb1, 0x6f42, 0x11d4, {0xbc, 0xe7, 0x0, 0x80, 0xc7, 0x3c, 0x88, 0x81 } }
+
+typedef struct _EFI_CPU_ARCH_PROTOCOL   EFI_CPU_ARCH_PROTOCOL;
+
+typedef enum {
+  EfiCpuFlushTypeWriteBackInvalidate,
+  EfiCpuFlushTypeWriteBack,
+  EfiCpuFlushTypeInvalidate,
+  EfiCpuMaxFlushType
+} EFI_CPU_FLUSH_TYPE;
+
+typedef enum {
+  EfiCpuInit,
+  EfiCpuMaxInitType
+} EFI_CPU_INIT_TYPE;
+
+/**
+  EFI_CPU_INTERRUPT_HANDLER that is called when a processor interrupt occurs.
+
+  @param  InterruptType    Defines the type of interrupt or exception that
+                           occurred on the processor.This parameter is processor architecture specific.
+  @param  SystemContext    A pointer to the processor context when
+                           the interrupt occurred on the processor.
+
+  @return None
+
+**/
+typedef
+VOID
+(EFIAPI *EFI_CPU_INTERRUPT_HANDLER)(
+  IN CONST  EFI_EXCEPTION_TYPE  InterruptType,
+  IN CONST  EFI_SYSTEM_CONTEXT  SystemContext
+  );
+
+/**
+  This function flushes the range of addresses from Start to Start+Length
+  from the processor's data cache. If Start is not aligned to a cache line
+  boundary, then the bytes before Start to the preceding cache line boundary
+  are also flushed. If Start+Length is not aligned to a cache line boundary,
+  then the bytes past Start+Length to the end of the next cache line boundary
+  are also flushed. The FlushType of EfiCpuFlushTypeWriteBackInvalidate must be
+  supported. If the data cache is fully coherent with all DMA operations, then
+  this function can just return EFI_SUCCESS. If the processor does not support
+  flushing a range of the data cache, then the entire data cache can be flushed.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+  @param  Start            The beginning physical address to flush from the processor's data
+                           cache.
+  @param  Length           The number of bytes to flush from the processor's data cache. This
+                           function may flush more bytes than Length specifies depending upon
+                           the granularity of the flush operation that the processor supports.
+  @param  FlushType        Specifies the type of flush operation to perform.
+
+  @retval EFI_SUCCESS           The address range from Start to Start+Length was flushed from
+                                the processor's data cache.
+  @retval EFI_UNSUPPORTEDT      The processor does not support the cache flush type specified
+                                by FlushType.
+  @retval EFI_DEVICE_ERROR      The address range from Start to Start+Length could not be flushed
+                                from the processor's data cache.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_FLUSH_DATA_CACHE)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This,
+  IN EFI_PHYSICAL_ADDRESS               Start,
+  IN UINT64                             Length,
+  IN EFI_CPU_FLUSH_TYPE                 FlushType
+  );
+
+
+/**
+  This function enables interrupt processing by the processor.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+
+  @retval EFI_SUCCESS           Interrupts are enabled on the processor.
+  @retval EFI_DEVICE_ERROR      Interrupts could not be enabled on the processor.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_ENABLE_INTERRUPT)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This
+  );
+
+
+/**
+  This function disables interrupt processing by the processor.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+
+  @retval EFI_SUCCESS           Interrupts are disabled on the processor.
+  @retval EFI_DEVICE_ERROR      Interrupts could not be disabled on the processor.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_DISABLE_INTERRUPT)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This
+  );
+
+
+/**
+  This function retrieves the processor's current interrupt state a returns it in
+  State. If interrupts are currently enabled, then TRUE is returned. If interrupts
+  are currently disabled, then FALSE is returned.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+  @param  State            A pointer to the processor's current interrupt state. Set to TRUE if
+                           interrupts are enabled and FALSE if interrupts are disabled.
+
+  @retval EFI_SUCCESS           The processor's current interrupt state was returned in State.
+  @retval EFI_INVALID_PARAMETER State is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_GET_INTERRUPT_STATE)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This,
+  OUT BOOLEAN                           *State
+  );
+
+
+/**
+  This function generates an INIT on the processor. If this function succeeds, then the
+  processor will be reset, and control will not be returned to the caller. If InitType is
+  not supported by this processor, or the processor cannot programmatically generate an
+  INIT without help from external hardware, then EFI_UNSUPPORTED is returned. If an error
+  occurs attempting to generate an INIT, then EFI_DEVICE_ERROR is returned.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+  @param  InitType         The type of processor INIT to perform.
+
+  @retval EFI_SUCCESS           The processor INIT was performed. This return code should never be seen.
+  @retval EFI_UNSUPPORTED       The processor INIT operation specified by InitType is not supported
+                                by this processor.
+  @retval EFI_DEVICE_ERROR      The processor INIT failed.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_INIT)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This,
+  IN EFI_CPU_INIT_TYPE                  InitType
+  );
+
+
+/**
+  This function registers and enables the handler specified by InterruptHandler for a processor
+  interrupt or exception type specified by InterruptType. If InterruptHandler is NULL, then the
+  handler for the processor interrupt or exception type specified by InterruptType is uninstalled.
+  The installed handler is called once for each processor interrupt or exception.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+  @param  InterruptType    A pointer to the processor's current interrupt state. Set to TRUE if interrupts
+                           are enabled and FALSE if interrupts are disabled.
+  @param  InterruptHandler A pointer to a function of type EFI_CPU_INTERRUPT_HANDLER that is called
+                           when a processor interrupt occurs. If this parameter is NULL, then the handler
+                           will be uninstalled.
+
+  @retval EFI_SUCCESS           The handler for the processor interrupt was successfully installed or uninstalled.
+  @retval EFI_ALREADY_STARTED   InterruptHandler is not NULL, and a handler for InterruptType was
+                                previously installed.
+  @retval EFI_INVALID_PARAMETER InterruptHandler is NULL, and a handler for InterruptType was not
+                                previously installed.
+  @retval EFI_UNSUPPORTED       The interrupt specified by InterruptType is not supported.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_REGISTER_INTERRUPT_HANDLER)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This,
+  IN EFI_EXCEPTION_TYPE                 InterruptType,
+  IN EFI_CPU_INTERRUPT_HANDLER          InterruptHandler
+  );
+
+
+/**
+  This function reads the processor timer specified by TimerIndex and returns it in TimerValue.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+  @param  TimerIndex       Specifies which processor timer is to be returned in TimerValue. This parameter
+                           must be between 0 and NumberOfTimers-1.
+  @param  TimerValue       Pointer to the returned timer value.
+  @param  TimerPeriod      A pointer to the amount of time that passes in femtoseconds for each increment
+                           of TimerValue.
+
+  @retval EFI_SUCCESS           The processor timer value specified by TimerIndex was returned in TimerValue.
+  @retval EFI_DEVICE_ERROR      An error occurred attempting to read one of the processor's timers.
+  @retval EFI_INVALID_PARAMETER TimerValue is NULL or TimerIndex is not valid.
+  @retval EFI_UNSUPPORTED       The processor does not have any readable timers.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_GET_TIMER_VALUE)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This,
+  IN UINT32                             TimerIndex,
+  OUT UINT64                            *TimerValue,
+  OUT UINT64                            *TimerPeriod OPTIONAL
+  );
+
+
+/**
+  This function modifies the attributes for the memory region specified by BaseAddress and
+  Length from their current attributes to the attributes specified by Attributes.
+
+  @param  This             The EFI_CPU_ARCH_PROTOCOL instance.
+  @param  BaseAddress      The physical address that is the start address of a memory region.
+  @param  Length           The size in bytes of the memory region.
+  @param  Attributes       The bit mask of attributes to set for the memory region.
+
+  @retval EFI_SUCCESS           The attributes were set for the memory region.
+  @retval EFI_ACCESS_DENIED     The attributes for the memory resource range specified by
+                                BaseAddress and Length cannot be modified.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to modify the attributes of
+                                the memory resource range.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the memory
+                                resource range specified by BaseAddress and Length.
+                                The bit mask of attributes is not support for the memory resource
+                                range specified by BaseAddress and Length.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_SET_MEMORY_ATTRIBUTES)(
+  IN EFI_CPU_ARCH_PROTOCOL              *This,
+  IN  EFI_PHYSICAL_ADDRESS              BaseAddress,
+  IN  UINT64                            Length,
+  IN  UINT64                            Attributes
+  );
+
+
+///
+/// The EFI_CPU_ARCH_PROTOCOL is used to abstract processor-specific functions from the DXE
+/// Foundation. This includes flushing caches, enabling and disabling interrupts, hooking interrupt
+/// vectors and exception vectors, reading internal processor timers, resetting the processor, and
+/// determining the processor frequency.
+///
+struct _EFI_CPU_ARCH_PROTOCOL {
+  EFI_CPU_FLUSH_DATA_CACHE            FlushDataCache;
+  EFI_CPU_ENABLE_INTERRUPT            EnableInterrupt;
+  EFI_CPU_DISABLE_INTERRUPT           DisableInterrupt;
+  EFI_CPU_GET_INTERRUPT_STATE         GetInterruptState;
+  EFI_CPU_INIT                        Init;
+  EFI_CPU_REGISTER_INTERRUPT_HANDLER  RegisterInterruptHandler;
+  EFI_CPU_GET_TIMER_VALUE             GetTimerValue;
+  EFI_CPU_SET_MEMORY_ATTRIBUTES       SetMemoryAttributes;
+  ///
+  /// The number of timers that are available in a processor. The value in this
+  /// field is a constant that must not be modified after the CPU Architectural
+  /// Protocol is installed. All consumers must treat this as a read-only field.
+  ///
+  UINT32                              NumberOfTimers;
+  ///
+  /// The size, in bytes, of the alignment required for DMA buffer allocations.
+  /// This is typically the size of the largest data cache line in the platform.
+  /// The value in this field is a constant that must not be modified after the
+  /// CPU Architectural Protocol is installed. All consumers must treat this as
+  /// a read-only field.
+  ///
+  UINT32                              DmaBufferAlignment;
+};
+
+extern EFI_GUID gEfiCpuArchProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/CpuIo.h b/src/include/ipxe/efi/Protocol/CpuIo.h
new file mode 100644
index 0000000..e3d9610
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/CpuIo.h
@@ -0,0 +1,128 @@
+/** @file
+  This code abstracts the CPU IO Protocol which installed by some platform or chipset-specific
+  PEIM that abstracts the processor-visible I/O operations.
+
+  Copyright (c) 2007, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  Module Name:  CpuIO.h
+
+  @par Revision Reference:
+  CPU IO Protocol is defined in Framework of EFI CPU IO Protocol Spec
+  Version 0.9
+
+**/
+
+#ifndef _CPUIO_H_
+#define _CPUIO_H_
+
+#include <ipxe/efi/PiDxe.h>
+
+#define EFI_CPU_IO_PROTOCOL_GUID \
+  { \
+    0xB0732526, 0x38C8, 0x4b40, {0x88, 0x77, 0x61, 0xC7, 0xB0, 0x6A, 0xAC, 0x45 } \
+  }
+
+typedef struct _EFI_CPU_IO_PROTOCOL EFI_CPU_IO_PROTOCOL;
+
+//
+// *******************************************************
+// EFI_CPU_IO_PROTOCOL_WIDTH
+// *******************************************************
+//
+typedef enum {
+  EfiCpuIoWidthUint8,
+  EfiCpuIoWidthUint16,
+  EfiCpuIoWidthUint32,
+  EfiCpuIoWidthUint64,
+  EfiCpuIoWidthFifoUint8,
+  EfiCpuIoWidthFifoUint16,
+  EfiCpuIoWidthFifoUint32,
+  EfiCpuIoWidthFifoUint64,
+  EfiCpuIoWidthFillUint8,
+  EfiCpuIoWidthFillUint16,
+  EfiCpuIoWidthFillUint32,
+  EfiCpuIoWidthFillUint64,
+  EfiCpuIoWidthMaximum
+} EFI_CPU_IO_PROTOCOL_WIDTH;
+
+//
+// *******************************************************
+// EFI_CPU_IO_PROTOCOL_IO_MEM
+// *******************************************************
+//
+/**
+  Enables a driver to access memory-mapped registers in the EFI system memory space.
+  Or, Enables a driver to access registers in the EFI CPU I/O space.
+
+  @param  This                  A pointer to the EFI_CPU_IO_PROTOCOL instance.
+  @param  Width                 Signifies the width of the I/O or Memory operation.
+  @param  Address               The base address of the I/O or Memoryoperation.
+  @param  Count                 The number of I/O or Memory operations to perform.
+                                The number of bytes moved is Width size * Count, starting at Address.
+  @param  Buffer                For read operations, the destination buffer to store the results.
+                                For write operations, the source buffer from which to write data.
+
+  @retval EFI_SUCCESS           The data was read from or written to the EFI system.
+  @retval EFI_INVALID_PARAMETER Width is invalid for this EFI system.Or Buffer is NULL.
+  @retval EFI_UNSUPPORTED       The Buffer is not aligned for the given Width.
+                                Or,The address range specified by Address, Width, and Count is not valid for this EFI system.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CPU_IO_PROTOCOL_IO_MEM)(
+  IN EFI_CPU_IO_PROTOCOL                *This,
+  IN  EFI_CPU_IO_PROTOCOL_WIDTH         Width,
+  IN  UINT64                            Address,
+  IN  UINTN                             Count,
+  IN  OUT VOID                          *Buffer
+  );
+
+//
+// *******************************************************
+// EFI_CPU_IO_PROTOCOL_ACCESS
+// *******************************************************
+//
+typedef struct {
+  EFI_CPU_IO_PROTOCOL_IO_MEM  Read;
+  EFI_CPU_IO_PROTOCOL_IO_MEM  Write;
+} EFI_CPU_IO_PROTOCOL_ACCESS;
+
+//
+// *******************************************************
+// EFI_CPU_IO_PROTOCOL
+// *******************************************************
+//
+/**
+  @par Protocol Description:
+  Provides the basic memory and I/O interfaces that are used to abstract
+  accesses to devices in a system.
+
+  @param Mem.Read
+  Allows reads from memory-mapped I/O space.
+
+  @param Mem.Write
+  Allows writes to memory-mapped I/O space.
+
+  @param Io.Read
+  Allows reads from I/O space.
+
+  @param Io.Write
+  Allows writes to I/O space.
+
+**/
+struct _EFI_CPU_IO_PROTOCOL {
+  EFI_CPU_IO_PROTOCOL_ACCESS  Mem;
+  EFI_CPU_IO_PROTOCOL_ACCESS  Io;
+};
+
+extern EFI_GUID gEfiCpuIoProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/DebugSupport.h b/src/include/ipxe/efi/Protocol/DebugSupport.h
new file mode 100644
index 0000000..370614d
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/DebugSupport.h
@@ -0,0 +1,634 @@
+/** @file
+  DebugSupport protocol and supporting definitions as defined in the UEFI2.0
+  specification.
+
+  The DebugSupport protocol is used by source level debuggers to abstract the
+  processor and handle context save and restore operations.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __DEBUG_SUPPORT_H__
+#define __DEBUG_SUPPORT_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+#include <ipxe/efi/IndustryStandard/PeImage.h>
+
+typedef struct _EFI_DEBUG_SUPPORT_PROTOCOL EFI_DEBUG_SUPPORT_PROTOCOL;
+
+///
+/// Debug Support protocol {2755590C-6F3C-42FA-9EA4-A3BA543CDA25}
+///
+#define EFI_DEBUG_SUPPORT_PROTOCOL_GUID \
+  { \
+    0x2755590C, 0x6F3C, 0x42FA, {0x9E, 0xA4, 0xA3, 0xBA, 0x54, 0x3C, 0xDA, 0x25 } \
+  }
+
+///
+/// Debug Support definitions
+///
+typedef INTN  EFI_EXCEPTION_TYPE;
+
+//
+//  IA-32 processor exception types
+//
+#define EXCEPT_IA32_DIVIDE_ERROR    0
+#define EXCEPT_IA32_DEBUG           1
+#define EXCEPT_IA32_NMI             2
+#define EXCEPT_IA32_BREAKPOINT      3
+#define EXCEPT_IA32_OVERFLOW        4
+#define EXCEPT_IA32_BOUND           5
+#define EXCEPT_IA32_INVALID_OPCODE  6
+#define EXCEPT_IA32_DOUBLE_FAULT    8
+#define EXCEPT_IA32_INVALID_TSS     10
+#define EXCEPT_IA32_SEG_NOT_PRESENT 11
+#define EXCEPT_IA32_STACK_FAULT     12
+#define EXCEPT_IA32_GP_FAULT        13
+#define EXCEPT_IA32_PAGE_FAULT      14
+#define EXCEPT_IA32_FP_ERROR        16
+#define EXCEPT_IA32_ALIGNMENT_CHECK 17
+#define EXCEPT_IA32_MACHINE_CHECK   18
+#define EXCEPT_IA32_SIMD            19
+
+///
+///  IA-32 processor context definition
+///
+///
+/// FXSAVE_STATE
+/// FP / MMX / XMM registers (see fxrstor instruction definition)
+///
+typedef struct {
+  UINT16  Fcw;
+  UINT16  Fsw;
+  UINT16  Ftw;
+  UINT16  Opcode;
+  UINT32  Eip;
+  UINT16  Cs;
+  UINT16  Reserved1;
+  UINT32  DataOffset;
+  UINT16  Ds;
+  UINT8   Reserved2[10];
+  UINT8   St0Mm0[10], Reserved3[6];
+  UINT8   St1Mm1[10], Reserved4[6];
+  UINT8   St2Mm2[10], Reserved5[6];
+  UINT8   St3Mm3[10], Reserved6[6];
+  UINT8   St4Mm4[10], Reserved7[6];
+  UINT8   St5Mm5[10], Reserved8[6];
+  UINT8   St6Mm6[10], Reserved9[6];
+  UINT8   St7Mm7[10], Reserved10[6];
+  UINT8   Xmm0[16];
+  UINT8   Xmm1[16];
+  UINT8   Xmm2[16];
+  UINT8   Xmm3[16];
+  UINT8   Xmm4[16];
+  UINT8   Xmm5[16];
+  UINT8   Xmm6[16];
+  UINT8   Xmm7[16];
+  UINT8   Reserved11[14 * 16];
+} EFI_FX_SAVE_STATE_IA32;
+
+typedef struct {
+  UINT32                 ExceptionData;
+  EFI_FX_SAVE_STATE_IA32 FxSaveState;
+  UINT32                 Dr0;
+  UINT32                 Dr1;
+  UINT32                 Dr2;
+  UINT32                 Dr3;
+  UINT32                 Dr6;
+  UINT32                 Dr7;
+  UINT32                 Cr0;
+  UINT32                 Cr1;  /* Reserved */
+  UINT32                 Cr2;
+  UINT32                 Cr3;
+  UINT32                 Cr4;
+  UINT32                 Eflags;
+  UINT32                 Ldtr;
+  UINT32                 Tr;
+  UINT32                 Gdtr[2];
+  UINT32                 Idtr[2];
+  UINT32                 Eip;
+  UINT32                 Gs;
+  UINT32                 Fs;
+  UINT32                 Es;
+  UINT32                 Ds;
+  UINT32                 Cs;
+  UINT32                 Ss;
+  UINT32                 Edi;
+  UINT32                 Esi;
+  UINT32                 Ebp;
+  UINT32                 Esp;
+  UINT32                 Ebx;
+  UINT32                 Edx;
+  UINT32                 Ecx;
+  UINT32                 Eax;
+} EFI_SYSTEM_CONTEXT_IA32;
+
+//
+//  X64 processor exception types
+//
+#define EXCEPT_X64_DIVIDE_ERROR    0
+#define EXCEPT_X64_DEBUG           1
+#define EXCEPT_X64_NMI             2
+#define EXCEPT_X64_BREAKPOINT      3
+#define EXCEPT_X64_OVERFLOW        4
+#define EXCEPT_X64_BOUND           5
+#define EXCEPT_X64_INVALID_OPCODE  6
+#define EXCEPT_X64_DOUBLE_FAULT    8
+#define EXCEPT_X64_INVALID_TSS     10
+#define EXCEPT_X64_SEG_NOT_PRESENT 11
+#define EXCEPT_X64_STACK_FAULT     12
+#define EXCEPT_X64_GP_FAULT        13
+#define EXCEPT_X64_PAGE_FAULT      14
+#define EXCEPT_X64_FP_ERROR        16
+#define EXCEPT_X64_ALIGNMENT_CHECK 17
+#define EXCEPT_X64_MACHINE_CHECK   18
+#define EXCEPT_X64_SIMD            19
+
+///
+///  X64 processor context definition
+///
+/// FXSAVE_STATE
+/// FP / MMX / XMM registers (see fxrstor instruction definition)
+///
+typedef struct {
+  UINT16  Fcw;
+  UINT16  Fsw;
+  UINT16  Ftw;
+  UINT16  Opcode;
+  UINT64  Rip;
+  UINT64  DataOffset;
+  UINT8   Reserved1[8];
+  UINT8   St0Mm0[10], Reserved2[6];
+  UINT8   St1Mm1[10], Reserved3[6];
+  UINT8   St2Mm2[10], Reserved4[6];
+  UINT8   St3Mm3[10], Reserved5[6];
+  UINT8   St4Mm4[10], Reserved6[6];
+  UINT8   St5Mm5[10], Reserved7[6];
+  UINT8   St6Mm6[10], Reserved8[6];
+  UINT8   St7Mm7[10], Reserved9[6];
+  UINT8   Xmm0[16];
+  UINT8   Xmm1[16];
+  UINT8   Xmm2[16];
+  UINT8   Xmm3[16];
+  UINT8   Xmm4[16];
+  UINT8   Xmm5[16];
+  UINT8   Xmm6[16];
+  UINT8   Xmm7[16];
+  //
+  // NOTE: UEFI 2.0 spec definition as follows.
+  //
+  UINT8   Reserved11[14 * 16];
+} EFI_FX_SAVE_STATE_X64;
+
+typedef struct {
+  UINT64                ExceptionData;
+  EFI_FX_SAVE_STATE_X64 FxSaveState;
+  UINT64                Dr0;
+  UINT64                Dr1;
+  UINT64                Dr2;
+  UINT64                Dr3;
+  UINT64                Dr6;
+  UINT64                Dr7;
+  UINT64                Cr0;
+  UINT64                Cr1;  /* Reserved */
+  UINT64                Cr2;
+  UINT64                Cr3;
+  UINT64                Cr4;
+  UINT64                Cr8;
+  UINT64                Rflags;
+  UINT64                Ldtr;
+  UINT64                Tr;
+  UINT64                Gdtr[2];
+  UINT64                Idtr[2];
+  UINT64                Rip;
+  UINT64                Gs;
+  UINT64                Fs;
+  UINT64                Es;
+  UINT64                Ds;
+  UINT64                Cs;
+  UINT64                Ss;
+  UINT64                Rdi;
+  UINT64                Rsi;
+  UINT64                Rbp;
+  UINT64                Rsp;
+  UINT64                Rbx;
+  UINT64                Rdx;
+  UINT64                Rcx;
+  UINT64                Rax;
+  UINT64                R8;
+  UINT64                R9;
+  UINT64                R10;
+  UINT64                R11;
+  UINT64                R12;
+  UINT64                R13;
+  UINT64                R14;
+  UINT64                R15;
+} EFI_SYSTEM_CONTEXT_X64;
+
+//
+//  IPF processor exception types
+//
+#define EXCEPT_IPF_VHTP_TRANSLATION       0
+#define EXCEPT_IPF_INSTRUCTION_TLB        1
+#define EXCEPT_IPF_DATA_TLB               2
+#define EXCEPT_IPF_ALT_INSTRUCTION_TLB    3
+#define EXCEPT_IPF_ALT_DATA_TLB           4
+#define EXCEPT_IPF_DATA_NESTED_TLB        5
+#define EXCEPT_IPF_INSTRUCTION_KEY_MISSED 6
+#define EXCEPT_IPF_DATA_KEY_MISSED        7
+#define EXCEPT_IPF_DIRTY_BIT              8
+#define EXCEPT_IPF_INSTRUCTION_ACCESS_BIT 9
+#define EXCEPT_IPF_DATA_ACCESS_BIT        10
+#define EXCEPT_IPF_BREAKPOINT             11
+#define EXCEPT_IPF_EXTERNAL_INTERRUPT     12
+//
+// 13 - 19 reserved
+//
+#define EXCEPT_IPF_PAGE_NOT_PRESENT           20
+#define EXCEPT_IPF_KEY_PERMISSION             21
+#define EXCEPT_IPF_INSTRUCTION_ACCESS_RIGHTS  22
+#define EXCEPT_IPF_DATA_ACCESS_RIGHTS         23
+#define EXCEPT_IPF_GENERAL_EXCEPTION          24
+#define EXCEPT_IPF_DISABLED_FP_REGISTER       25
+#define EXCEPT_IPF_NAT_CONSUMPTION            26
+#define EXCEPT_IPF_SPECULATION                27
+//
+// 28 reserved
+//
+#define EXCEPT_IPF_DEBUG                          29
+#define EXCEPT_IPF_UNALIGNED_REFERENCE            30
+#define EXCEPT_IPF_UNSUPPORTED_DATA_REFERENCE     31
+#define EXCEPT_IPF_FP_FAULT                       32
+#define EXCEPT_IPF_FP_TRAP                        33
+#define EXCEPT_IPF_LOWER_PRIVILEGE_TRANSFER_TRAP  34
+#define EXCEPT_IPF_TAKEN_BRANCH                   35
+#define EXCEPT_IPF_SINGLE_STEP                    36
+//
+// 37 - 44 reserved
+//
+#define EXCEPT_IPF_IA32_EXCEPTION 45
+#define EXCEPT_IPF_IA32_INTERCEPT 46
+#define EXCEPT_IPF_IA32_INTERRUPT 47
+
+///
+///  IPF processor context definition
+///
+typedef struct {
+  //
+  // The first reserved field is necessary to preserve alignment for the correct
+  // bits in UNAT and to insure F2 is 16 byte aligned..
+  //
+  UINT64  Reserved;
+  UINT64  R1;
+  UINT64  R2;
+  UINT64  R3;
+  UINT64  R4;
+  UINT64  R5;
+  UINT64  R6;
+  UINT64  R7;
+  UINT64  R8;
+  UINT64  R9;
+  UINT64  R10;
+  UINT64  R11;
+  UINT64  R12;
+  UINT64  R13;
+  UINT64  R14;
+  UINT64  R15;
+  UINT64  R16;
+  UINT64  R17;
+  UINT64  R18;
+  UINT64  R19;
+  UINT64  R20;
+  UINT64  R21;
+  UINT64  R22;
+  UINT64  R23;
+  UINT64  R24;
+  UINT64  R25;
+  UINT64  R26;
+  UINT64  R27;
+  UINT64  R28;
+  UINT64  R29;
+  UINT64  R30;
+  UINT64  R31;
+
+  UINT64  F2[2];
+  UINT64  F3[2];
+  UINT64  F4[2];
+  UINT64  F5[2];
+  UINT64  F6[2];
+  UINT64  F7[2];
+  UINT64  F8[2];
+  UINT64  F9[2];
+  UINT64  F10[2];
+  UINT64  F11[2];
+  UINT64  F12[2];
+  UINT64  F13[2];
+  UINT64  F14[2];
+  UINT64  F15[2];
+  UINT64  F16[2];
+  UINT64  F17[2];
+  UINT64  F18[2];
+  UINT64  F19[2];
+  UINT64  F20[2];
+  UINT64  F21[2];
+  UINT64  F22[2];
+  UINT64  F23[2];
+  UINT64  F24[2];
+  UINT64  F25[2];
+  UINT64  F26[2];
+  UINT64  F27[2];
+  UINT64  F28[2];
+  UINT64  F29[2];
+  UINT64  F30[2];
+  UINT64  F31[2];
+
+  UINT64  Pr;
+
+  UINT64  B0;
+  UINT64  B1;
+  UINT64  B2;
+  UINT64  B3;
+  UINT64  B4;
+  UINT64  B5;
+  UINT64  B6;
+  UINT64  B7;
+
+  //
+  // application registers
+  //
+  UINT64  ArRsc;
+  UINT64  ArBsp;
+  UINT64  ArBspstore;
+  UINT64  ArRnat;
+
+  UINT64  ArFcr;
+
+  UINT64  ArEflag;
+  UINT64  ArCsd;
+  UINT64  ArSsd;
+  UINT64  ArCflg;
+  UINT64  ArFsr;
+  UINT64  ArFir;
+  UINT64  ArFdr;
+
+  UINT64  ArCcv;
+
+  UINT64  ArUnat;
+
+  UINT64  ArFpsr;
+
+  UINT64  ArPfs;
+  UINT64  ArLc;
+  UINT64  ArEc;
+
+  //
+  // control registers
+  //
+  UINT64  CrDcr;
+  UINT64  CrItm;
+  UINT64  CrIva;
+  UINT64  CrPta;
+  UINT64  CrIpsr;
+  UINT64  CrIsr;
+  UINT64  CrIip;
+  UINT64  CrIfa;
+  UINT64  CrItir;
+  UINT64  CrIipa;
+  UINT64  CrIfs;
+  UINT64  CrIim;
+  UINT64  CrIha;
+
+  //
+  // debug registers
+  //
+  UINT64  Dbr0;
+  UINT64  Dbr1;
+  UINT64  Dbr2;
+  UINT64  Dbr3;
+  UINT64  Dbr4;
+  UINT64  Dbr5;
+  UINT64  Dbr6;
+  UINT64  Dbr7;
+
+  UINT64  Ibr0;
+  UINT64  Ibr1;
+  UINT64  Ibr2;
+  UINT64  Ibr3;
+  UINT64  Ibr4;
+  UINT64  Ibr5;
+  UINT64  Ibr6;
+  UINT64  Ibr7;
+
+  //
+  // virtual registers - nat bits for R1-R31
+  //
+  UINT64  IntNat;
+
+} EFI_SYSTEM_CONTEXT_IPF;
+
+//
+//  EBC processor exception types
+//
+#define EXCEPT_EBC_UNDEFINED            0
+#define EXCEPT_EBC_DIVIDE_ERROR         1
+#define EXCEPT_EBC_DEBUG                2
+#define EXCEPT_EBC_BREAKPOINT           3
+#define EXCEPT_EBC_OVERFLOW             4
+#define EXCEPT_EBC_INVALID_OPCODE       5   // opcode out of range
+#define EXCEPT_EBC_STACK_FAULT          6
+#define EXCEPT_EBC_ALIGNMENT_CHECK      7
+#define EXCEPT_EBC_INSTRUCTION_ENCODING 8   // malformed instruction
+#define EXCEPT_EBC_BAD_BREAK            9   // BREAK 0 or undefined BREAK
+#define EXCEPT_EBC_STEP                 10  // to support debug stepping
+///
+/// For coding convenience, define the maximum valid EBC exception.
+///
+#define MAX_EBC_EXCEPTION EXCEPT_EBC_STEP
+
+///
+///  EBC processor context definition
+///
+typedef struct {
+  UINT64  R0;
+  UINT64  R1;
+  UINT64  R2;
+  UINT64  R3;
+  UINT64  R4;
+  UINT64  R5;
+  UINT64  R6;
+  UINT64  R7;
+  UINT64  Flags;
+  UINT64  ControlFlags;
+  UINT64  Ip;
+} EFI_SYSTEM_CONTEXT_EBC;
+
+///
+/// Universal EFI_SYSTEM_CONTEXT definition
+///
+typedef union {
+  EFI_SYSTEM_CONTEXT_EBC  *SystemContextEbc;
+  EFI_SYSTEM_CONTEXT_IA32 *SystemContextIa32;
+  EFI_SYSTEM_CONTEXT_X64  *SystemContextX64;
+  EFI_SYSTEM_CONTEXT_IPF  *SystemContextIpf;
+} EFI_SYSTEM_CONTEXT;
+
+//
+// DebugSupport callback function prototypes
+//
+
+/**
+  Registers and enables an exception callback function for the specified exception.
+
+  @param  ExceptionType         Exception types in EBC, IA-32, X64, or IPF
+  @param  SystemContext         Exception content.
+
+**/
+typedef
+VOID
+(*EFI_EXCEPTION_CALLBACK)(
+  IN     EFI_EXCEPTION_TYPE               ExceptionType,
+  IN OUT EFI_SYSTEM_CONTEXT               SystemContext
+  );
+
+/**
+  Registers and enables the on-target debug agent's periodic entry point.
+
+  @param  SystemContext         Exception content.
+
+**/
+typedef
+VOID
+(*EFI_PERIODIC_CALLBACK)(
+  IN OUT EFI_SYSTEM_CONTEXT               SystemContext
+  );
+
+///
+/// Machine type definition
+///
+typedef enum {
+  IsaIa32 = IMAGE_FILE_MACHINE_I386,  ///< 0x014C
+  IsaX64  = IMAGE_FILE_MACHINE_X64,   ///< 0x8664
+  IsaIpf  = IMAGE_FILE_MACHINE_IA64,  ///< 0x0200
+  IsaEbc  = IMAGE_FILE_MACHINE_EBC    ///< 0x0EBC
+} EFI_INSTRUCTION_SET_ARCHITECTURE;
+
+
+//
+// DebugSupport member function definitions
+//
+
+/**
+  Returns the maximum value that may be used for the ProcessorIndex parameter in
+  RegisterPeriodicCallback() and RegisterExceptionCallback().
+
+  @param  This                  A pointer to the EFI_DEBUG_SUPPORT_PROTOCOL instance.
+  @param  MaxProcessorIndex     Pointer to a caller-allocated UINTN in which the maximum supported
+                                processor index is returned.
+
+  @retval EFI_SUCCESS           The function completed successfully.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_MAXIMUM_PROCESSOR_INDEX)(
+  IN EFI_DEBUG_SUPPORT_PROTOCOL          *This,
+  OUT UINTN                              *MaxProcessorIndex
+  );
+
+/**
+  Registers a function to be called back periodically in interrupt context.
+
+  @param  This                  A pointer to the EFI_DEBUG_SUPPORT_PROTOCOL instance.
+  @param  ProcessorIndex        Specifies which processor the callback function applies to.
+  @param  PeriodicCallback      A pointer to a function of type PERIODIC_CALLBACK that is the main
+                                periodic entry point of the debug agent.
+
+  @retval EFI_SUCCESS           The function completed successfully.
+  @retval EFI_ALREADY_STARTED   Non-NULL PeriodicCallback parameter when a callback
+                                function was previously registered.
+  @retval EFI_OUT_OF_RESOURCES  System has insufficient memory resources to register new callback
+                                function.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_REGISTER_PERIODIC_CALLBACK)(
+  IN EFI_DEBUG_SUPPORT_PROTOCOL          *This,
+  IN UINTN                               ProcessorIndex,
+  IN EFI_PERIODIC_CALLBACK               PeriodicCallback
+  );
+
+/**
+  Registers a function to be called when a given processor exception occurs.
+
+  @param  This                  A pointer to the EFI_DEBUG_SUPPORT_PROTOCOL instance.
+  @param  ProcessorIndex        Specifies which processor the callback function applies to.
+  @param  PeriodicCallback      A pointer to a function of type EXCEPTION_CALLBACK that is called
+                                when the processor exception specified by ExceptionType occurs.
+  @param  ExceptionType         Specifies which processor exception to hook.
+
+  @retval EFI_SUCCESS           The function completed successfully.
+  @retval EFI_ALREADY_STARTED   Non-NULL PeriodicCallback parameter when a callback
+                                function was previously registered.
+  @retval EFI_OUT_OF_RESOURCES  System has insufficient memory resources to register new callback
+                                function.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_REGISTER_EXCEPTION_CALLBACK)(
+  IN EFI_DEBUG_SUPPORT_PROTOCOL          *This,
+  IN UINTN                               ProcessorIndex,
+  IN EFI_EXCEPTION_CALLBACK              ExceptionCallback,
+  IN EFI_EXCEPTION_TYPE                  ExceptionType
+  );
+
+/**
+  Invalidates processor instruction cache for a memory range. Subsequent execution in this range
+  causes a fresh memory fetch to retrieve code to be executed.
+
+  @param  This                  A pointer to the EFI_DEBUG_SUPPORT_PROTOCOL instance.
+  @param  ProcessorIndex        Specifies which processor's instruction cache is to be invalidated.
+  @param  Start                 Specifies the physical base of the memory range to be invalidated.
+  @param  Length                Specifies the minimum number of bytes in the processor's instruction
+                                cache to invalidate.
+
+  @retval EFI_SUCCESS           The function completed successfully.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_INVALIDATE_INSTRUCTION_CACHE)(
+  IN EFI_DEBUG_SUPPORT_PROTOCOL          *This,
+  IN UINTN                               ProcessorIndex,
+  IN VOID                                *Start,
+  IN UINT64                              Length
+  );
+
+///
+/// This protocol provides the services to allow the debug agent to register
+/// callback functions that are called either periodically or when specific
+/// processor exceptions occur.
+///
+struct _EFI_DEBUG_SUPPORT_PROTOCOL {
+  ///
+  /// Declares the processor architecture for this instance of the EFI Debug Support protocol.
+  ///
+  EFI_INSTRUCTION_SET_ARCHITECTURE  Isa;
+  EFI_GET_MAXIMUM_PROCESSOR_INDEX   GetMaximumProcessorIndex;
+  EFI_REGISTER_PERIODIC_CALLBACK    RegisterPeriodicCallback;
+  EFI_REGISTER_EXCEPTION_CALLBACK   RegisterExceptionCallback;
+  EFI_INVALIDATE_INSTRUCTION_CACHE  InvalidateInstructionCache;
+};
+
+extern EFI_GUID gEfiDebugSupportProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/DevicePath.h b/src/include/ipxe/efi/Protocol/DevicePath.h
new file mode 100644
index 0000000..4d31008
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/DevicePath.h
@@ -0,0 +1,535 @@
+/** @file
+  The device path protocol as defined in UEFI 2.0.
+
+  The device path represents a programatic path to a device. It's the view
+  from a software point of view. It also must persist from boot to boot, so
+  it can not contain things like PCI bus numbers that change from boot to boot.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __EFI_DEVICE_PATH_PROTOCOL_H__
+#define __EFI_DEVICE_PATH_PROTOCOL_H__
+
+#include <ipxe/efi/Guid/PcAnsi.h>
+
+///
+/// Device Path protocol
+///
+#define EFI_DEVICE_PATH_PROTOCOL_GUID \
+  { \
+    0x9576e91, 0x6d3f, 0x11d2, {0x8e, 0x39, 0x0, 0xa0, 0xc9, 0x69, 0x72, 0x3b } \
+  }
+
+//
+// Protocol GUID defined in EFI1.1.
+//
+
+///
+/// Device Path information
+///
+#define DEVICE_PATH_PROTOCOL  EFI_DEVICE_PATH_PROTOCOL_GUID
+
+#pragma pack(1)
+
+/**
+  This protocol can be used on any device handle to obtain generic path/location
+  information concerning the physical device or logical device. If the handle does
+  not logically map to a physical device, the handle may not necessarily support
+  the device path protocol. The device path describes the location of the device
+  the handle is for. The size of the Device Path can be determined from the structures
+  that make up the Device Path.
+**/
+typedef struct {
+  UINT8 Type;       ///< 0x01 Hardware Device Path
+                    ///< 0x02 ACPI Device Path
+                    ///< 0x03 Messaging Device Path
+                    ///< 0x04 Media Device Path
+                    ///< 0x05 BIOS Boot Specification Device Path
+                    ///< 0x7F End of Hardware Device Path
+
+  UINT8 SubType;    ///< Varies by Type
+                    ///< 0xFF End Entire Device Path, or
+                    ///< 0x01 End This Instance of a Device Path and start a new
+                    ///< Device Path
+
+  UINT8 Length[2];  ///< Specific Device Path data. Type and Sub-Type define
+                    ///< type of data. Size of data is included in Length.
+
+} EFI_DEVICE_PATH_PROTOCOL;
+
+///
+/// For backward-compatible with EFI1.1.
+///
+typedef EFI_DEVICE_PATH_PROTOCOL  EFI_DEVICE_PATH;
+
+///
+/// Hardware Device Paths
+///
+#define HARDWARE_DEVICE_PATH      0x01
+
+#define HW_PCI_DP                 0x01
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT8                           Function;
+  UINT8                           Device;
+} PCI_DEVICE_PATH;
+
+#define HW_PCCARD_DP              0x02
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT8                           FunctionNumber;
+} PCCARD_DEVICE_PATH;
+
+#define HW_MEMMAP_DP              0x03
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          MemoryType;
+  EFI_PHYSICAL_ADDRESS            StartingAddress;
+  EFI_PHYSICAL_ADDRESS            EndingAddress;
+} MEMMAP_DEVICE_PATH;
+
+#define HW_VENDOR_DP              0x04
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_GUID                        Guid;
+} VENDOR_DEVICE_PATH;
+
+#define HW_CONTROLLER_DP          0x05
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          ControllerNumber;
+} CONTROLLER_DEVICE_PATH;
+
+///
+/// ACPI Device Paths
+///
+#define ACPI_DEVICE_PATH          0x02
+
+#define ACPI_DP                   0x01
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          HID;
+  UINT32                          UID;
+} ACPI_HID_DEVICE_PATH;
+
+#define ACPI_EXTENDED_DP          0x02
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          HID;
+  UINT32                          UID;
+  UINT32                          CID;
+  ///
+  /// Optional variable length _HIDSTR
+  /// Optional variable length _UIDSTR
+  /// Optional variable length _CIDSTR
+  ///
+} ACPI_EXTENDED_HID_DEVICE_PATH;
+
+//
+//  EISA ID Macro
+//  EISA ID Definition 32-bits
+//   bits[15:0] - three character compressed ASCII EISA ID.
+//   bits[31:16] - binary number
+//    Compressed ASCII is 5 bits per character 0b00001 = 'A' 0b11010 = 'Z'
+//
+#define PNP_EISA_ID_CONST         0x41d0
+#define EISA_ID(_Name, _Num)      ((UINT32)((_Name) | (_Num) << 16))
+#define EISA_PNP_ID(_PNPId)       (EISA_ID(PNP_EISA_ID_CONST, (_PNPId)))
+#define EFI_PNP_ID(_PNPId)        (EISA_ID(PNP_EISA_ID_CONST, (_PNPId)))
+
+#define PNP_EISA_ID_MASK          0xffff
+#define EISA_ID_TO_NUM(_Id)       ((_Id) >> 16)
+
+
+#define ACPI_ADR_DP               0x03
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          ADR;
+} ACPI_ADR_DEVICE_PATH;
+
+#define ACPI_ADR_DISPLAY_TYPE_OTHER             0
+#define ACPI_ADR_DISPLAY_TYPE_VGA               1
+#define ACPI_ADR_DISPLAY_TYPE_TV                2
+#define ACPI_ADR_DISPLAY_TYPE_EXTERNAL_DIGITAL  3
+#define ACPI_ADR_DISPLAY_TYPE_INTERNAL_DIGITAL  4
+
+#define ACPI_DISPLAY_ADR(_DeviceIdScheme, _HeadId, _NonVgaOutput, _BiosCanDetect, _VendorInfo, _Type, _Port, _Index) \
+          ((UINT32)( (((_DeviceIdScheme) & 0x1) << 31) |  \
+                      (((_HeadId)         & 0x7) << 18) |  \
+                      (((_NonVgaOutput)   & 0x1) << 17) |  \
+                      (((_BiosCanDetect)  & 0x1) << 16) |  \
+                      (((_VendorInfo)     & 0xf) << 12) |  \
+                      (((_Type)           & 0xf) << 8)  |  \
+                      (((_Port)           & 0xf) << 4)  |  \
+                       ((_Index)          & 0xf) ))
+
+///
+/// Messaging Device Paths
+///
+#define MESSAGING_DEVICE_PATH     0x03
+
+#define MSG_ATAPI_DP              0x01
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT8                           PrimarySecondary;
+  UINT8                           SlaveMaster;
+  UINT16                          Lun;
+} ATAPI_DEVICE_PATH;
+
+#define MSG_SCSI_DP               0x02
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT16                          Pun;
+  UINT16                          Lun;
+} SCSI_DEVICE_PATH;
+
+#define MSG_FIBRECHANNEL_DP       0x03
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          Reserved;
+  UINT64                          WWN;
+  UINT64                          Lun;
+} FIBRECHANNEL_DEVICE_PATH;
+
+#define MSG_1394_DP               0x04
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          Reserved;
+  UINT64                          Guid;
+} F1394_DEVICE_PATH;
+
+#define MSG_USB_DP                0x05
+typedef struct {
+    EFI_DEVICE_PATH_PROTOCOL      Header;
+    UINT8                         ParentPortNumber;
+    UINT8                         InterfaceNumber;
+} USB_DEVICE_PATH;
+
+#define MSG_USB_CLASS_DP          0x0f
+typedef struct {
+    EFI_DEVICE_PATH_PROTOCOL      Header;
+    UINT16                        VendorId;
+    UINT16                        ProductId;
+    UINT8                         DeviceClass;
+    UINT8                         DeviceSubClass;
+    UINT8                         DeviceProtocol;
+} USB_CLASS_DEVICE_PATH;
+
+#define MSG_USB_WWID_DP           0x10
+typedef struct {
+    EFI_DEVICE_PATH_PROTOCOL      Header;
+    UINT16                        InterfaceNumber;
+    UINT16                        VendorId;
+    UINT16                        ProductId;
+    // CHAR16                     SerialNumber[...];
+} USB_WWID_DEVICE_PATH;
+
+
+#define MSG_DEVICE_LOGICAL_UNIT_DP  0x11
+typedef struct {
+    EFI_DEVICE_PATH_PROTOCOL      Header;
+    UINT8                         Lun;
+} DEVICE_LOGICAL_UNIT_DEVICE_PATH;
+
+#define MSG_SATA_DP               0x12
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT16                          HBAPortNumber;
+  UINT16                          PortMultiplierPortNumber;
+  UINT16                          Lun;
+} SATA_DEVICE_PATH;
+
+#define MSG_I2O_DP                0x06
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          Tid;
+} I2O_DEVICE_PATH;
+
+#define MSG_MAC_ADDR_DP           0x0b
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_MAC_ADDRESS                 MacAddress;
+  UINT8                           IfType;
+} MAC_ADDR_DEVICE_PATH;
+
+#define MSG_IPv4_DP               0x0c
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_IPv4_ADDRESS                LocalIpAddress;
+  EFI_IPv4_ADDRESS                RemoteIpAddress;
+  UINT16                          LocalPort;
+  UINT16                          RemotePort;
+  UINT16                          Protocol;
+  BOOLEAN                         StaticIpAddress;
+} IPv4_DEVICE_PATH;
+
+#define MSG_IPv6_DP               0x0d
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_IPv6_ADDRESS                LocalIpAddress;
+  EFI_IPv6_ADDRESS                RemoteIpAddress;
+  UINT16                          LocalPort;
+  UINT16                          RemotePort;
+  UINT16                          Protocol;
+  BOOLEAN                         StaticIpAddress;
+} IPv6_DEVICE_PATH;
+
+#define MSG_INFINIBAND_DP         0x09
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          ResourceFlags;
+  UINT8                           PortGid[16];
+  UINT64                          ServiceId;
+  UINT64                          TargetPortId;
+  UINT64                          DeviceId;
+} INFINIBAND_DEVICE_PATH;
+
+#define INFINIBAND_RESOURCE_FLAG_IOC_SERVICE                0x01
+#define INFINIBAND_RESOURCE_FLAG_EXTENDED_BOOT_ENVIRONMENT  0x02
+#define INFINIBAND_RESOURCE_FLAG_CONSOLE_PROTOCOL           0x04
+#define INFINIBAND_RESOURCE_FLAG_STORAGE_PROTOCOL           0x08
+#define INFINIBAND_RESOURCE_FLAG_NETWORK_PROTOCOL           0x10
+
+#define MSG_UART_DP               0x0e
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          Reserved;
+  UINT64                          BaudRate;
+  UINT8                           DataBits;
+  UINT8                           Parity;
+  UINT8                           StopBits;
+} UART_DEVICE_PATH;
+
+//
+// Use VENDOR_DEVICE_PATH struct
+//
+#define MSG_VENDOR_DP             0x0a
+typedef VENDOR_DEVICE_PATH        VENDOR_DEFINED_DEVICE_PATH;
+
+#define DEVICE_PATH_MESSAGING_PC_ANSI     EFI_PC_ANSI_GUID
+#define DEVICE_PATH_MESSAGING_VT_100      EFI_VT_100_GUID
+#define DEVICE_PATH_MESSAGING_VT_100_PLUS EFI_VT_100_PLUS_GUID
+#define DEVICE_PATH_MESSAGING_VT_UTF8     EFI_VT_UTF8_GUID
+
+#define DEVICE_PATH_MESSAGING_UART_FLOW_CONTROL   EFI_UART_DEVICE_PATH_GUID
+
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_GUID                        Guid;
+  UINT32                          FlowControlMap;
+} UART_FLOW_CONTROL_DEVICE_PATH;
+
+#define DEVICE_PATH_MESSAGING_SAS                 EFI_SAS_DEVICE_PATH_GUID
+
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_GUID                        Guid;
+  UINT32                          Reserved;
+  UINT64                          SasAddress;
+  UINT64                          Lun;
+  UINT16                          DeviceTopology;
+  UINT16                          RelativeTargetPort;
+} SAS_DEVICE_PATH;
+
+#define MSG_ISCSI_DP              0x13
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT16                          NetworkProtocol;
+  UINT16                          LoginOption;
+  UINT64                          Lun;
+  UINT16                          TargetPortalGroupTag;
+  // CHAR8                        iSCSI Target Name
+} ISCSI_DEVICE_PATH;
+
+#define ISCSI_LOGIN_OPTION_NO_HEADER_DIGEST             0x0000
+#define ISCSI_LOGIN_OPTION_HEADER_DIGEST_USING_CRC32C   0x0002
+#define ISCSI_LOGIN_OPTION_NO_DATA_DIGEST               0x0000
+#define ISCSI_LOGIN_OPTION_DATA_DIGEST_USING_CRC32C     0x0008
+#define ISCSI_LOGIN_OPTION_AUTHMETHOD_CHAP              0x0000
+#define ISCSI_LOGIN_OPTION_AUTHMETHOD_NON               0x1000
+#define ISCSI_LOGIN_OPTION_CHAP_BI                      0x0000
+#define ISCSI_LOGIN_OPTION_CHAP_UNI                     0x2000
+
+//
+// Media Device Path
+//
+#define MEDIA_DEVICE_PATH         0x04
+
+#define MEDIA_HARDDRIVE_DP        0x01
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          PartitionNumber;
+  UINT64                          PartitionStart;
+  UINT64                          PartitionSize;
+  UINT8                           Signature[16];
+  UINT8                           MBRType;
+  UINT8                           SignatureType;
+} HARDDRIVE_DEVICE_PATH;
+
+#define MBR_TYPE_PCAT             0x01
+#define MBR_TYPE_EFI_PARTITION_TABLE_HEADER 0x02
+
+#define SIGNATURE_TYPE_MBR        0x01
+#define SIGNATURE_TYPE_GUID       0x02
+
+#define MEDIA_CDROM_DP            0x02
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT32                          BootEntry;
+  UINT64                          PartitionStart;
+  UINT64                          PartitionSize;
+} CDROM_DEVICE_PATH;
+
+//
+// Use VENDOR_DEVICE_PATH struct
+//
+#define MEDIA_VENDOR_DP           0x03
+
+#define MEDIA_FILEPATH_DP         0x04
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  CHAR16                          PathName[1];
+} FILEPATH_DEVICE_PATH;
+
+#define SIZE_OF_FILEPATH_DEVICE_PATH  EFI_FIELD_OFFSET(FILEPATH_DEVICE_PATH,PathName)
+
+#define MEDIA_PROTOCOL_DP         0x05
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_GUID                        Protocol;
+} MEDIA_PROTOCOL_DEVICE_PATH;
+
+
+#define MEDIA_PIWG_FW_VOL_DP      0x7
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_GUID                        FvName;
+} MEDIA_FW_VOL_DEVICE_PATH;
+
+
+#define MEDIA_PIWG_FW_FILE_DP     0x6
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  EFI_GUID                        FvFileName;
+} MEDIA_FW_VOL_FILEPATH_DEVICE_PATH;
+
+//
+// BBS Device Path
+//
+#define BBS_DEVICE_PATH           0x05
+#define BBS_BBS_DP                0x01
+typedef struct {
+  EFI_DEVICE_PATH_PROTOCOL        Header;
+  UINT16                          DeviceType;
+  UINT16                          StatusFlag;
+  CHAR8                           String[1];
+} BBS_BBS_DEVICE_PATH;
+
+//
+// DeviceType definitions - from BBS specification
+//
+#define BBS_TYPE_FLOPPY           0x01
+#define BBS_TYPE_HARDDRIVE        0x02
+#define BBS_TYPE_CDROM            0x03
+#define BBS_TYPE_PCMCIA           0x04
+#define BBS_TYPE_USB              0x05
+#define BBS_TYPE_EMBEDDED_NETWORK 0x06
+#define BBS_TYPE_BEV              0x80
+#define BBS_TYPE_UNKNOWN          0xFF
+
+
+///
+/// Union of all possible Device Paths and pointers to Device Paths
+///
+
+typedef union {
+  EFI_DEVICE_PATH_PROTOCOL             DevPath;
+  PCI_DEVICE_PATH                      Pci;
+  PCCARD_DEVICE_PATH                   PcCard;
+  MEMMAP_DEVICE_PATH                   MemMap;
+  VENDOR_DEVICE_PATH                   Vendor;
+
+  CONTROLLER_DEVICE_PATH               Controller;
+  ACPI_HID_DEVICE_PATH                 Acpi;
+
+  ATAPI_DEVICE_PATH                    Atapi;
+  SCSI_DEVICE_PATH                     Scsi;
+  ISCSI_DEVICE_PATH                    Iscsi;
+  FIBRECHANNEL_DEVICE_PATH             FibreChannel;
+
+  F1394_DEVICE_PATH                    F1394;
+  USB_DEVICE_PATH                      Usb;
+  SATA_DEVICE_PATH                     Sata;
+  USB_CLASS_DEVICE_PATH                UsbClass;
+  I2O_DEVICE_PATH                      I2O;
+  MAC_ADDR_DEVICE_PATH                 MacAddr;
+  IPv4_DEVICE_PATH                     Ipv4;
+  IPv6_DEVICE_PATH                     Ipv6;
+  INFINIBAND_DEVICE_PATH               InfiniBand;
+  UART_DEVICE_PATH                     Uart;
+
+  HARDDRIVE_DEVICE_PATH                HardDrive;
+  CDROM_DEVICE_PATH                    CD;
+
+  FILEPATH_DEVICE_PATH                 FilePath;
+  MEDIA_PROTOCOL_DEVICE_PATH           MediaProtocol;
+
+  BBS_BBS_DEVICE_PATH                  Bbs;
+} EFI_DEV_PATH;
+
+
+
+typedef union {
+  EFI_DEVICE_PATH_PROTOCOL             *DevPath;
+  PCI_DEVICE_PATH                      *Pci;
+  PCCARD_DEVICE_PATH                   *PcCard;
+  MEMMAP_DEVICE_PATH                   *MemMap;
+  VENDOR_DEVICE_PATH                   *Vendor;
+
+  CONTROLLER_DEVICE_PATH               *Controller;
+  ACPI_HID_DEVICE_PATH                 *Acpi;
+  ACPI_EXTENDED_HID_DEVICE_PATH        *ExtendedAcpi;
+
+  ATAPI_DEVICE_PATH                    *Atapi;
+  SCSI_DEVICE_PATH                     *Scsi;
+  FIBRECHANNEL_DEVICE_PATH             *FibreChannel;
+
+  F1394_DEVICE_PATH                    *F1394;
+  USB_DEVICE_PATH                      *Usb;
+  SATA_DEVICE_PATH                     *Sata;
+  USB_CLASS_DEVICE_PATH                *UsbClass;
+  I2O_DEVICE_PATH                      *I2O;
+  MAC_ADDR_DEVICE_PATH                 *MacAddr;
+  IPv4_DEVICE_PATH                     *Ipv4;
+  IPv6_DEVICE_PATH                     *Ipv6;
+  INFINIBAND_DEVICE_PATH               *InfiniBand;
+  UART_DEVICE_PATH                     *Uart;
+
+  HARDDRIVE_DEVICE_PATH                *HardDrive;
+  CDROM_DEVICE_PATH                    *CD;
+
+  FILEPATH_DEVICE_PATH                 *FilePath;
+  MEDIA_PROTOCOL_DEVICE_PATH           *MediaProtocol;
+
+  BBS_BBS_DEVICE_PATH                  *Bbs;
+  UINT8                                *Raw;
+} EFI_DEV_PATH_PTR;
+
+#pragma pack()
+
+#define END_DEVICE_PATH_TYPE                 0x7f
+#define END_ENTIRE_DEVICE_PATH_SUBTYPE       0xFF
+#define END_INSTANCE_DEVICE_PATH_SUBTYPE     0x01
+
+extern EFI_GUID gEfiDevicePathProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/DriverBinding.h b/src/include/ipxe/efi/Protocol/DriverBinding.h
new file mode 100644
index 0000000..2ee7845
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/DriverBinding.h
@@ -0,0 +1,153 @@
+/** @file
+  UEFI DriverBinding Protocol is defined in UEFI specification.
+
+  This protocol is produced by every driver that follows the UEFI Driver Model,
+  and it is the central component that allows drivers and controllers to be managed.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __EFI_DRIVER_BINDING_H__
+#define __EFI_DRIVER_BINDING_H__
+
+#include <ipxe/efi/Protocol/DevicePath.h>
+///
+/// Global ID for the ControllerHandle Driver Protocol
+///
+#define EFI_DRIVER_BINDING_PROTOCOL_GUID \
+  { \
+    0x18a031ab, 0xb443, 0x4d1a, {0xa5, 0xc0, 0xc, 0x9, 0x26, 0x1e, 0x9f, 0x71 } \
+  }
+
+typedef struct _EFI_DRIVER_BINDING_PROTOCOL  EFI_DRIVER_BINDING_PROTOCOL;
+
+/**
+  Test to see if this driver supports ControllerHandle. This service
+  is called by the EFI boot service ConnectController(). In
+  order to make drivers as small as possible, there are a few calling
+  restrictions for this service. ConnectController() must
+  follow these calling restrictions. If any other agent wishes to call
+  Supported() it must also follow these calling restrictions.
+
+  @param  This                Protocol instance pointer.
+  @param  ControllerHandle    Handle of device to test
+  @param  RemainingDevicePath Optional parameter use to pick a specific child
+                              device to start.
+
+  @retval EFI_SUCCESS         This driver supports this device
+  @retval EFI_ALREADY_STARTED This driver is already running on this device
+  @retval other               This driver does not support this device
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_DRIVER_BINDING_SUPPORTED)(
+  IN EFI_DRIVER_BINDING_PROTOCOL            *This,
+  IN EFI_HANDLE                             ControllerHandle,
+  IN EFI_DEVICE_PATH_PROTOCOL               *RemainingDevicePath OPTIONAL
+  );
+
+/**
+  Start this driver on ControllerHandle. This service is called by the
+  EFI boot service ConnectController(). In order to make
+  drivers as small as possible, there are a few calling restrictions for
+  this service. ConnectController() must follow these
+  calling restrictions. If any other agent wishes to call Start() it
+  must also follow these calling restrictions.
+
+  @param  This                 Protocol instance pointer.
+  @param  ControllerHandle     Handle of device to bind driver to
+  @param  RemainingDevicePath  Optional parameter use to pick a specific child
+                               device to start.
+
+  @retval EFI_SUCCESS          This driver is added to ControllerHandle
+  @retval EFI_ALREADY_STARTED  This driver is already running on ControllerHandle
+  @retval other                This driver does not support this device
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_DRIVER_BINDING_START)(
+  IN EFI_DRIVER_BINDING_PROTOCOL            *This,
+  IN EFI_HANDLE                             ControllerHandle,
+  IN EFI_DEVICE_PATH_PROTOCOL               *RemainingDevicePath OPTIONAL
+  );
+
+/**
+  Stop this driver on ControllerHandle. This service is called by the
+  EFI boot service DisconnectController(). In order to
+  make drivers as small as possible, there are a few calling
+  restrictions for this service. DisconnectController()
+  must follow these calling restrictions. If any other agent wishes
+  to call Stop() it must also follow these calling restrictions.
+
+  @param  This              Protocol instance pointer.
+  @param  ControllerHandle  Handle of device to stop driver on
+  @param  NumberOfChildren  Number of Handles in ChildHandleBuffer. If number of
+                            children is zero stop the entire bus driver.
+  @param  ChildHandleBuffer List of Child Handles to Stop.
+
+  @retval EFI_SUCCESS       This driver is removed ControllerHandle
+  @retval other             This driver was not removed from this device
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_DRIVER_BINDING_STOP)(
+  IN EFI_DRIVER_BINDING_PROTOCOL            *This,
+  IN  EFI_HANDLE                            ControllerHandle,
+  IN  UINTN                                 NumberOfChildren,
+  IN  EFI_HANDLE                            *ChildHandleBuffer OPTIONAL
+  );
+
+///
+/// This protocol provides the services required to determine if a driver supports a given controller.
+/// If a controller is supported, then it also provides routines to start and stop the controller.
+///
+struct _EFI_DRIVER_BINDING_PROTOCOL {
+  EFI_DRIVER_BINDING_SUPPORTED  Supported;
+  EFI_DRIVER_BINDING_START      Start;
+  EFI_DRIVER_BINDING_STOP       Stop;
+
+  ///
+  /// The version number of the UEFI driver that produced the
+  /// EFI_DRIVER_BINDING_PROTOCOL. This field is used by
+  /// the EFI boot service ConnectController() to determine
+  /// the order that driver's Supported() service will be used when
+  /// a controller needs to be started. EFI Driver Binding Protocol
+  /// instances with higher Version values will be used before ones
+  /// with lower Version values. The Version values of 0x0-
+  /// 0x0f and 0xfffffff0-0xffffffff are reserved for
+  /// platform/OEM specific drivers. The Version values of 0x10-
+  /// 0xffffffef are reserved for IHV-developed drivers.
+  ///
+  UINT32                        Version;
+
+  ///
+  /// The image handle of the UEFI driver that produced this instance
+  /// of the EFI_DRIVER_BINDING_PROTOCOL.
+  ///
+  EFI_HANDLE                    ImageHandle;
+
+  ///
+  /// The handle on which this instance of the
+  /// EFI_DRIVER_BINDING_PROTOCOL is installed. In most
+  /// cases, this is the same handle as ImageHandle. However, for
+  /// UEFI drivers that produce more than one instance of the
+  /// EFI_DRIVER_BINDING_PROTOCOL, this value may not be
+  /// the same as ImageHandle.
+  ///
+  EFI_HANDLE                    DriverBindingHandle;
+};
+
+extern EFI_GUID gEfiDriverBindingProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h b/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h
new file mode 100644
index 0000000..e99ec38
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h
@@ -0,0 +1,74 @@
+/** @file
+  EFI Network Interface Identifier Protocol
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+
+**/
+
+#ifndef __EFI_NETWORK_INTERFACE_IDENTIFER_H__
+#define __EFI_NETWORK_INTERFACE_IDENTIFER_H__
+
+
+#define EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL_GUID \
+  { \
+    0xE18541CD, 0xF755, 0x4f73, {0x92, 0x8D, 0x64, 0x3C, 0x8A, 0x79, 0xB2, 0x29 } \
+  }
+
+#define EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL_REVISION    0x00010000
+
+///
+/// Revision defined in EFI1.1.
+///
+#define EFI_NETWORK_INTERFACE_IDENTIFIER_INTERFACE_REVISION   EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL_REVISION
+
+///
+/// Forward reference for pure ANSI compatability
+///
+typedef struct _EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL  EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL;
+
+///
+/// Protocol defined in EFI1.1.
+///
+typedef EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL   EFI_NETWORK_INTERFACE_IDENTIFIER_INTERFACE;
+
+typedef enum {
+  EfiNetworkInterfaceUndi = 1
+} EFI_NETWORK_PROTOCOL_TYPE;
+
+///
+/// An optional protocol that is used to describe details about the software
+/// layer that is used to produce the Simple Network Protocol.
+///
+struct _EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL {
+  UINT64    Revision;   ///< The revision of the EFI_NETWORK_INTERFACE_IDENTIFIER protocol.
+  UINT64    ID;         ///< Address of the first byte of the identifying structure for this network
+                        ///< interface. This is only valid when the network interface is started
+                        ///< (see Start()). When the network interface is not started, this field is set to zero.
+  UINT64    ImageAddr;  ///< Address of the first byte of the identifying structure for this
+                        ///< network interface.  This is set to zero if there is no structure.
+  UINT32    ImageSize;  ///< Size of unrelocated network interface image.
+  CHAR8     StringId[4];///< A four-character ASCII string that is sent in the class identifier field of
+                        ///< option 60 in DHCP. For a Type of EfiNetworkInterfaceUndi, this field is UNDI.
+  UINT8     Type;       ///< Network interface type. This will be set to one of the values
+                        ///< in EFI_NETWORK_INTERFACE_TYPE.
+  UINT8     MajorVer;   ///< Major version number.
+  UINT8     MinorVer;   ///< Minor version number.
+  BOOLEAN   Ipv6Supported; ///< TRUE if the network interface supports IPv6; otherwise FALSE.
+  UINT8     IfNum;      ///< The network interface number that is being identified by this Network
+                        ///< Interface Identifier Protocol. This field must be less than or equal
+                        ///< to the IFcnt field in the !PXE structure.
+
+};
+
+extern EFI_GUID gEfiNetworkInterfaceIdentifierProtocolGuid;
+extern EFI_GUID gEfiNetworkInterfaceIdentifierProtocolGuid_31;
+
+#endif // _EFI_NII_H
diff --git a/src/include/ipxe/efi/Protocol/PciIo.h b/src/include/ipxe/efi/Protocol/PciIo.h
new file mode 100644
index 0000000..5aea5b4
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/PciIo.h
@@ -0,0 +1,519 @@
+/** @file
+  EFI PCI I/O Protocol provides the basic Memory, I/O, PCI configuration,
+  and DMA interfaces that a driver uses to access its PCI controller.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PCI_IO_H__
+#define __PCI_IO_H__
+
+///
+/// Global ID for the PCI I/O Protocol
+///
+#define EFI_PCI_IO_PROTOCOL_GUID \
+  { \
+    0x4cf5b200, 0x68b8, 0x4ca5, {0x9e, 0xec, 0xb2, 0x3e, 0x3f, 0x50, 0x2, 0x9a } \
+  }
+
+typedef struct _EFI_PCI_IO_PROTOCOL  EFI_PCI_IO_PROTOCOL;
+
+///
+/// Prototypes for the PCI I/O Protocol
+///
+typedef enum {
+  EfiPciIoWidthUint8      = 0,
+  EfiPciIoWidthUint16,
+  EfiPciIoWidthUint32,
+  EfiPciIoWidthUint64,
+  EfiPciIoWidthFifoUint8,
+  EfiPciIoWidthFifoUint16,
+  EfiPciIoWidthFifoUint32,
+  EfiPciIoWidthFifoUint64,
+  EfiPciIoWidthFillUint8,
+  EfiPciIoWidthFillUint16,
+  EfiPciIoWidthFillUint32,
+  EfiPciIoWidthFillUint64,
+  EfiPciIoWidthMaximum
+} EFI_PCI_IO_PROTOCOL_WIDTH;
+
+//
+// Complete PCI address generater
+//
+#define EFI_PCI_IO_PASS_THROUGH_BAR               0xff    ///< Special BAR that passes a memory or I/O cycle through unchanged
+#define EFI_PCI_IO_ATTRIBUTE_MASK                 0x077f  ///< All the following I/O and Memory cycles
+#define EFI_PCI_IO_ATTRIBUTE_ISA_MOTHERBOARD_IO   0x0001  ///< I/O cycles 0x0000-0x00FF (10 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_ISA_IO               0x0002  ///< I/O cycles 0x0100-0x03FF or greater (10 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_VGA_PALETTE_IO       0x0004  ///< I/O cycles 0x3C6, 0x3C8, 0x3C9 (10 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_VGA_MEMORY           0x0008  ///< MEM cycles 0xA0000-0xBFFFF (24 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_VGA_IO               0x0010  ///< I/O cycles 0x3B0-0x3BB and 0x3C0-0x3DF (10 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_IDE_PRIMARY_IO       0x0020  ///< I/O cycles 0x1F0-0x1F7, 0x3F6, 0x3F7 (10 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_IDE_SECONDARY_IO     0x0040  ///< I/O cycles 0x170-0x177, 0x376, 0x377 (10 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_MEMORY_WRITE_COMBINE 0x0080  ///< Map a memory range so write are combined
+#define EFI_PCI_IO_ATTRIBUTE_IO                   0x0100  ///< Enable the I/O decode bit in the PCI Config Header
+#define EFI_PCI_IO_ATTRIBUTE_MEMORY               0x0200  ///< Enable the Memory decode bit in the PCI Config Header
+#define EFI_PCI_IO_ATTRIBUTE_BUS_MASTER           0x0400  ///< Enable the DMA bit in the PCI Config Header
+#define EFI_PCI_IO_ATTRIBUTE_MEMORY_CACHED        0x0800  ///< Map a memory range so all r/w accesses are cached
+#define EFI_PCI_IO_ATTRIBUTE_MEMORY_DISABLE       0x1000  ///< Disable a memory range
+#define EFI_PCI_IO_ATTRIBUTE_EMBEDDED_DEVICE      0x2000  ///< Clear for an add-in PCI Device
+#define EFI_PCI_IO_ATTRIBUTE_EMBEDDED_ROM         0x4000  ///< Clear for a physical PCI Option ROM accessed through ROM BAR
+#define EFI_PCI_IO_ATTRIBUTE_DUAL_ADDRESS_CYCLE   0x8000  ///< Clear for PCI controllers that can not genrate a DAC
+#define EFI_PCI_IO_ATTRIBUTE_ISA_IO_16            0x10000 ///< I/O cycles 0x0100-0x03FF or greater (16 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_VGA_PALETTE_IO_16    0x20000 ///< I/O cycles 0x3C6, 0x3C8, 0x3C9 (16 bit decode)
+#define EFI_PCI_IO_ATTRIBUTE_VGA_IO_16            0x30000 ///< I/O cycles 0x3B0-0x3BB and 0x3C0-0x3DF (16 bit decode)
+
+#define EFI_PCI_DEVICE_ENABLE                     (EFI_PCI_IO_ATTRIBUTE_IO | EFI_PCI_IO_ATTRIBUTE_MEMORY | EFI_PCI_IO_ATTRIBUTE_BUS_MASTER)
+#define EFI_VGA_DEVICE_ENABLE                     (EFI_PCI_IO_ATTRIBUTE_VGA_PALETTE_IO | EFI_PCI_IO_ATTRIBUTE_VGA_MEMORY | EFI_PCI_IO_ATTRIBUTE_VGA_IO | EFI_PCI_IO_ATTRIBUTE_IO)
+
+///
+/// *******************************************************
+/// EFI_PCI_IO_PROTOCOL_OPERATION
+/// *******************************************************
+///
+typedef enum {
+  EfiPciIoOperationBusMasterRead,
+  EfiPciIoOperationBusMasterWrite,
+  EfiPciIoOperationBusMasterCommonBuffer,
+  EfiPciIoOperationMaximum
+} EFI_PCI_IO_PROTOCOL_OPERATION;
+
+///
+/// *******************************************************
+/// EFI_PCI_IO_PROTOCOL_ATTRIBUTE_OPERATION
+/// *******************************************************
+///
+typedef enum {
+  EfiPciIoAttributeOperationGet,
+  EfiPciIoAttributeOperationSet,
+  EfiPciIoAttributeOperationEnable,
+  EfiPciIoAttributeOperationDisable,
+  EfiPciIoAttributeOperationSupported,
+  EfiPciIoAttributeOperationMaximum
+} EFI_PCI_IO_PROTOCOL_ATTRIBUTE_OPERATION;
+
+/**
+  Reads from the memory space of a PCI controller. Returns when either the polling exit criteria is
+  satisfied or after a defined duration.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Width                 Signifies the width of the memory or I/O operations.
+  @param  BarIndex              The BAR index of the standard PCI Configuration header to use as the
+                                base address for the memory operation to perform.
+  @param  Offset                The offset within the selected BAR to start the memory operation.
+  @param  Mask                  Mask used for the polling criteria.
+  @param  Value                 The comparison value used for the polling exit criteria.
+  @param  Delay                 The number of 100 ns units to poll.
+  @param  Result                Pointer to the last value read from the memory location.
+
+  @retval EFI_SUCCESS           The last data returned from the access matched the poll exit criteria.
+  @retval EFI_UNSUPPORTED       BarIndex not valid for this PCI controller.
+  @retval EFI_UNSUPPORTED       Offset is not valid for the BarIndex of this PCI controller.
+  @retval EFI_TIMEOUT           Delay expired before a match occurred.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_POLL_IO_MEM)(
+  IN EFI_PCI_IO_PROTOCOL           *This,
+  IN  EFI_PCI_IO_PROTOCOL_WIDTH    Width,
+  IN  UINT8                        BarIndex,
+  IN  UINT64                       Offset,
+  IN  UINT64                       Mask,
+  IN  UINT64                       Value,
+  IN  UINT64                       Delay,
+  OUT UINT64                       *Result
+  );
+
+/**
+  Enable a PCI driver to access PCI controller registers in the PCI memory or I/O space.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Width                 Signifies the width of the memory or I/O operations.
+  @param  BarIndex              The BAR index of the standard PCI Configuration header to use as the
+                                base address for the memory or I/O operation to perform.
+  @param  Offset                The offset within the selected BAR to start the memory or I/O operation.
+  @param  Count                 The number of memory or I/O operations to perform.
+  @param  Buffer                For read operations, the destination buffer to store the results. For write
+                                operations, the source buffer to write data from.
+
+  @retval EFI_SUCCESS           The data was read from or written to the PCI controller.
+  @retval EFI_UNSUPPORTED       BarIndex not valid for this PCI controller.
+  @retval EFI_UNSUPPORTED       The address range specified by Offset, Width, and Count is not
+                                valid for the PCI BAR specified by BarIndex.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_IO_MEM)(
+  IN EFI_PCI_IO_PROTOCOL              *This,
+  IN     EFI_PCI_IO_PROTOCOL_WIDTH    Width,
+  IN     UINT8                        BarIndex,
+  IN     UINT64                       Offset,
+  IN     UINTN                        Count,
+  IN OUT VOID                         *Buffer
+  );
+
+typedef struct {
+  EFI_PCI_IO_PROTOCOL_IO_MEM  Read;
+  EFI_PCI_IO_PROTOCOL_IO_MEM  Write;
+} EFI_PCI_IO_PROTOCOL_ACCESS;
+
+/**
+  Enable a PCI driver to access PCI controller registers in PCI configuration space.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Width                 Signifies the width of the memory operations.
+  @param  Offset                The offset within the PCI configuration space for the PCI controller.
+  @param  Count                 The number of PCI configuration operations to perform.
+  @param  Buffer                For read operations, the destination buffer to store the results. For write
+                                operations, the source buffer to write data from.
+
+
+  @retval EFI_SUCCESS           The data was read from or written to the PCI controller.
+  @retval EFI_UNSUPPORTED       The address range specified by Offset, Width, and Count is not
+                                valid for the PCI configuration header of the PCI controller.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_INVALID_PARAMETER Buffer is NULL or Width is invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_CONFIG)(
+  IN EFI_PCI_IO_PROTOCOL              *This,
+  IN     EFI_PCI_IO_PROTOCOL_WIDTH    Width,
+  IN     UINT32                       Offset,
+  IN     UINTN                        Count,
+  IN OUT VOID                         *Buffer
+  );
+
+typedef struct {
+  EFI_PCI_IO_PROTOCOL_CONFIG  Read;
+  EFI_PCI_IO_PROTOCOL_CONFIG  Write;
+} EFI_PCI_IO_PROTOCOL_CONFIG_ACCESS;
+
+/**
+  Enables a PCI driver to copy one region of PCI memory space to another region of PCI
+  memory space.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Width                 Signifies the width of the memory operations.
+  @param  DestBarIndex          The BAR index in the standard PCI Configuration header to use as the
+                                base address for the memory operation to perform.
+  @param  DestOffset            The destination offset within the BAR specified by DestBarIndex to
+                                start the memory writes for the copy operation.
+  @param  SrcBarIndex           The BAR index in the standard PCI Configuration header to use as the
+                                base address for the memory operation to perform.
+  @param  SrcOffset             The source offset within the BAR specified by SrcBarIndex to start
+                                the memory reads for the copy operation.
+  @param  Count                 The number of memory operations to perform. Bytes moved is Width
+                                size * Count, starting at DestOffset and SrcOffset.
+
+  @retval EFI_SUCCESS           The data was copied from one memory region to another memory region.
+  @retval EFI_UNSUPPORTED       DestBarIndex not valid for this PCI controller.
+  @retval EFI_UNSUPPORTED       SrcBarIndex not valid for this PCI controller.
+  @retval EFI_UNSUPPORTED       The address range specified by DestOffset, Width, and Count
+                                is not valid for the PCI BAR specified by DestBarIndex.
+  @retval EFI_UNSUPPORTED       The address range specified by SrcOffset, Width, and Count is
+                                not valid for the PCI BAR specified by SrcBarIndex.
+  @retval EFI_INVALID_PARAMETER Width is invalid.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_COPY_MEM)(
+  IN EFI_PCI_IO_PROTOCOL              *This,
+  IN     EFI_PCI_IO_PROTOCOL_WIDTH    Width,
+  IN     UINT8                        DestBarIndex,
+  IN     UINT64                       DestOffset,
+  IN     UINT8                        SrcBarIndex,
+  IN     UINT64                       SrcOffset,
+  IN     UINTN                        Count
+  );
+
+/**
+  Provides the PCI controller-Cspecific addresses needed to access system memory.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Operation             Indicates if the bus master is going to read or write to system memory.
+  @param  HostAddress           The system memory address to map to the PCI controller.
+  @param  NumberOfBytes         On input the number of bytes to map. On output the number of bytes
+                                that were mapped.
+  @param  DeviceAddress         The resulting map address for the bus master PCI controller to use to
+                                access the hosts HostAddress.
+  @param  Mapping               A resulting value to pass to Unmap().
+
+  @retval EFI_SUCCESS           The range was mapped for the returned NumberOfBytes.
+  @retval EFI_UNSUPPORTED       The HostAddress cannot be mapped as a common buffer.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_DEVICE_ERROR      The system hardware could not map the requested address.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_MAP)(
+  IN EFI_PCI_IO_PROTOCOL                *This,
+  IN     EFI_PCI_IO_PROTOCOL_OPERATION  Operation,
+  IN     VOID                           *HostAddress,
+  IN OUT UINTN                          *NumberOfBytes,
+  OUT    EFI_PHYSICAL_ADDRESS           *DeviceAddress,
+  OUT    VOID                           **Mapping
+  );
+
+/**
+  Completes the Map() operation and releases any corresponding resources.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Mapping               The mapping value returned from Map().
+
+  @retval EFI_SUCCESS           The range was unmapped.
+  @retval EFI_DEVICE_ERROR      The data was not committed to the target system memory.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_UNMAP)(
+  IN EFI_PCI_IO_PROTOCOL           *This,
+  IN  VOID                         *Mapping
+  );
+
+/**
+  Allocates pages that are suitable for an EfiPciIoOperationBusMasterCommonBuffer
+  mapping.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Type                  This parameter is not used and must be ignored.
+  @param  MemoryType            The type of memory to allocate, EfiBootServicesData or
+                                EfiRuntimeServicesData.
+  @param  Pages                 The number of pages to allocate.
+  @param  HostAddress           A pointer to store the base system memory address of the
+                                allocated range.
+  @param  Attributes            The requested bit mask of attributes for the allocated range.
+
+  @retval EFI_SUCCESS           The requested memory pages were allocated.
+  @retval EFI_UNSUPPORTED       Attributes is unsupported. The only legal attribute bits are
+                                MEMORY_WRITE_COMBINE and MEMORY_CACHED.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_OUT_OF_RESOURCES  The memory pages could not be allocated.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_ALLOCATE_BUFFER)(
+  IN EFI_PCI_IO_PROTOCOL           *This,
+  IN  EFI_ALLOCATE_TYPE            Type,
+  IN  EFI_MEMORY_TYPE              MemoryType,
+  IN  UINTN                        Pages,
+  OUT VOID                         **HostAddress,
+  IN  UINT64                       Attributes
+  );
+
+/**
+  Frees memory that was allocated with AllocateBuffer().
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Pages                 The number of pages to free.
+  @param  HostAddress           The base system memory address of the allocated range.
+
+  @retval EFI_SUCCESS           The requested memory pages were freed.
+  @retval EFI_INVALID_PARAMETER The memory range specified by HostAddress and Pages
+                                was not allocated with AllocateBuffer().
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_FREE_BUFFER)(
+  IN EFI_PCI_IO_PROTOCOL           *This,
+  IN  UINTN                        Pages,
+  IN  VOID                         *HostAddress
+  );
+
+/**
+  Flushes all PCI posted write transactions from a PCI host bridge to system memory.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+
+  @retval EFI_SUCCESS           The PCI posted write transactions were flushed from the PCI host
+                                bridge to system memory.
+  @retval EFI_DEVICE_ERROR      The PCI posted write transactions were not flushed from the PCI
+                                host bridge due to a hardware error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_FLUSH)(
+  IN EFI_PCI_IO_PROTOCOL  *This
+  );
+
+/**
+  Retrieves this PCI controller's current PCI bus number, device number, and function number.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  SegmentNumber         The PCI controller's current PCI segment number.
+  @param  BusNumber             The PCI controller's current PCI bus number.
+  @param  DeviceNumber          The PCI controller's current PCI device number.
+  @param  FunctionNumber        The PCI controller's current PCI function number.
+
+  @retval EFI_SUCCESS           The PCI controller location was returned.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_GET_LOCATION)(
+  IN EFI_PCI_IO_PROTOCOL          *This,
+  OUT UINTN                       *SegmentNumber,
+  OUT UINTN                       *BusNumber,
+  OUT UINTN                       *DeviceNumber,
+  OUT UINTN                       *FunctionNumber
+  );
+
+/**
+  Performs an operation on the attributes that this PCI controller supports. The operations include
+  getting the set of supported attributes, retrieving the current attributes, setting the current
+  attributes, enabling attributes, and disabling attributes.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Operation             The operation to perform on the attributes for this PCI controller.
+  @param  Attributes            The mask of attributes that are used for Set, Enable, and Disable
+                                operations.
+  @param  Result                A pointer to the result mask of attributes that are returned for the Get
+                                and Supported operations.
+
+  @retval EFI_SUCCESS           The operation on the PCI controller's attributes was completed.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_UNSUPPORTED       one or more of the bits set in
+                                Attributes are not supported by this PCI controller or one of
+                                its parent bridges when Operation is Set, Enable or Disable.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_ATTRIBUTES)(
+  IN EFI_PCI_IO_PROTOCOL                       *This,
+  IN  EFI_PCI_IO_PROTOCOL_ATTRIBUTE_OPERATION  Operation,
+  IN  UINT64                                   Attributes,
+  OUT UINT64                                   *Result OPTIONAL
+  );
+
+/**
+  Gets the attributes that this PCI controller supports setting on a BAR using
+  SetBarAttributes(), and retrieves the list of resource descriptors for a BAR.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  BarIndex              The BAR index of the standard PCI Configuration header to use as the
+                                base address for resource range. The legal range for this field is 0..5.
+  @param  Supports              A pointer to the mask of attributes that this PCI controller supports
+                                setting for this BAR with SetBarAttributes().
+  @param  Resources             A pointer to the ACPI 2.0 resource descriptors that describe the current
+                                configuration of this BAR of the PCI controller.
+
+  @retval EFI_SUCCESS           If Supports is not NULL, then the attributes that the PCI
+                                controller supports are returned in Supports. If Resources
+                                is not NULL, then the ACPI 2.0 resource descriptors that the PCI
+                                controller is currently using are returned in Resources.
+  @retval EFI_INVALID_PARAMETER Both Supports and Attributes are NULL.
+  @retval EFI_UNSUPPORTED       BarIndex not valid for this PCI controller.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources available to allocate
+                                Resources.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_GET_BAR_ATTRIBUTES)(
+  IN EFI_PCI_IO_PROTOCOL             *This,
+  IN  UINT8                          BarIndex,
+  OUT UINT64                         *Supports, OPTIONAL
+  OUT VOID                           **Resources OPTIONAL
+  );
+
+/**
+  Sets the attributes for a range of a BAR on a PCI controller.
+
+  @param  This                  A pointer to the EFI_PCI_IO_PROTOCOL instance.
+  @param  Attributes            The mask of attributes to set for the resource range specified by
+                                BarIndex, Offset, and Length.
+  @param  BarIndex              The BAR index of the standard PCI Configuration header to use as the
+                                base address for resource range. The legal range for this field is 0..5.
+  @param  Offset                A pointer to the BAR relative base address of the resource range to be
+                                modified by the attributes specified by Attributes.
+  @param  Length                A pointer to the length of the resource range to be modified by the
+                                attributes specified by Attributes.
+
+  @retval EFI_SUCCESS           The set of attributes specified by Attributes for the resource
+                                range specified by BarIndex, Offset, and Length were
+                                set on the PCI controller, and the actual resource range is returned
+                                in Offset and Length.
+  @retval EFI_INVALID_PARAMETER Offset or Length is NULL.
+  @retval EFI_UNSUPPORTED       BarIndex not valid for this PCI controller.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources to set the attributes on the
+                                resource range specified by BarIndex, Offset, and
+                                Length.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_IO_PROTOCOL_SET_BAR_ATTRIBUTES)(
+  IN EFI_PCI_IO_PROTOCOL              *This,
+  IN     UINT64                       Attributes,
+  IN     UINT8                        BarIndex,
+  IN OUT UINT64                       *Offset,
+  IN OUT UINT64                       *Length
+  );
+
+///
+/// The EFI_PCI_IO_PROTOCOL provides the basic Memory, I/O, PCI configuration,
+/// and DMA interfaces that are used to abstract accesses to PCI controllers.
+/// There is one EFI_PCI_IO_PROTOCOL instance for each PCI controller on a PCI bus.
+/// A device driver that wishes to manage a PCI controller in a system will have to
+/// retrieve the EFI_PCI_IO_PROTOCOL instance that is associated with the PCI controller.
+///
+struct _EFI_PCI_IO_PROTOCOL {
+  EFI_PCI_IO_PROTOCOL_POLL_IO_MEM         PollMem;
+  EFI_PCI_IO_PROTOCOL_POLL_IO_MEM         PollIo;
+  EFI_PCI_IO_PROTOCOL_ACCESS              Mem;
+  EFI_PCI_IO_PROTOCOL_ACCESS              Io;
+  EFI_PCI_IO_PROTOCOL_CONFIG_ACCESS       Pci;
+  EFI_PCI_IO_PROTOCOL_COPY_MEM            CopyMem;
+  EFI_PCI_IO_PROTOCOL_MAP                 Map;
+  EFI_PCI_IO_PROTOCOL_UNMAP               Unmap;
+  EFI_PCI_IO_PROTOCOL_ALLOCATE_BUFFER     AllocateBuffer;
+  EFI_PCI_IO_PROTOCOL_FREE_BUFFER         FreeBuffer;
+  EFI_PCI_IO_PROTOCOL_FLUSH               Flush;
+  EFI_PCI_IO_PROTOCOL_GET_LOCATION        GetLocation;
+  EFI_PCI_IO_PROTOCOL_ATTRIBUTES          Attributes;
+  EFI_PCI_IO_PROTOCOL_GET_BAR_ATTRIBUTES  GetBarAttributes;
+  EFI_PCI_IO_PROTOCOL_SET_BAR_ATTRIBUTES  SetBarAttributes;
+
+  ///
+  /// The size, in bytes, of the ROM image.
+  ///
+  UINT64                                  RomSize;
+
+  ///
+  /// A pointer to the in memory copy of the ROM image. The PCI Bus Driver is responsible
+  /// for allocating memory for the ROM image, and copying the contents of the ROM to memory.
+  /// The contents of this buffer are either from the PCI option ROM that can be accessed
+  /// through the ROM BAR of the PCI controller, or it is from a platform-specific location.
+  /// The Attributes() function can be used to determine from which of these two sources
+  /// the RomImage buffer was initialized.
+  ///
+  VOID                                    *RomImage;
+};
+
+extern EFI_GUID gEfiPciIoProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h b/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h
new file mode 100644
index 0000000..a1150f0
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h
@@ -0,0 +1,393 @@
+/** @file
+  PCI Root Bridge I/O protocol as defined in the UEFI 2.0 specification.
+
+  PCI Root Bridge I/O protocol is used by PCI Bus Driver to perform PCI Memory, PCI I/O,
+  and PCI Configuration cycles on a PCI Root Bridge. It also provides services to perform
+  defferent types of bus mastering DMA
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PCI_ROOT_BRIDGE_IO_H__
+#define __PCI_ROOT_BRIDGE_IO_H__
+
+#define EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_GUID \
+  { \
+    0x2f707ebb, 0x4a1a, 0x11d4, {0x9a, 0x38, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d } \
+  }
+
+typedef struct _EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL;
+
+typedef enum {
+  EfiPciWidthUint8,
+  EfiPciWidthUint16,
+  EfiPciWidthUint32,
+  EfiPciWidthUint64,
+  EfiPciWidthFifoUint8,
+  EfiPciWidthFifoUint16,
+  EfiPciWidthFifoUint32,
+  EfiPciWidthFifoUint64,
+  EfiPciWidthFillUint8,
+  EfiPciWidthFillUint16,
+  EfiPciWidthFillUint32,
+  EfiPciWidthFillUint64,
+  EfiPciWidthMaximum
+} EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH;
+
+typedef enum {
+  EfiPciOperationBusMasterRead,
+  EfiPciOperationBusMasterWrite,
+  EfiPciOperationBusMasterCommonBuffer,
+  EfiPciOperationBusMasterRead64,
+  EfiPciOperationBusMasterWrite64,
+  EfiPciOperationBusMasterCommonBuffer64,
+  EfiPciOperationMaximum
+} EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_OPERATION;
+
+#define EFI_PCI_ATTRIBUTE_ISA_MOTHERBOARD_IO          0x0001
+#define EFI_PCI_ATTRIBUTE_ISA_IO                      0x0002
+#define EFI_PCI_ATTRIBUTE_VGA_PALETTE_IO              0x0004
+#define EFI_PCI_ATTRIBUTE_VGA_MEMORY                  0x0008
+#define EFI_PCI_ATTRIBUTE_VGA_IO                      0x0010
+#define EFI_PCI_ATTRIBUTE_IDE_PRIMARY_IO              0x0020
+#define EFI_PCI_ATTRIBUTE_IDE_SECONDARY_IO            0x0040
+#define EFI_PCI_ATTRIBUTE_MEMORY_WRITE_COMBINE        0x0080
+#define EFI_PCI_ATTRIBUTE_MEMORY_CACHED               0x0800
+#define EFI_PCI_ATTRIBUTE_MEMORY_DISABLE              0x1000
+#define EFI_PCI_ATTRIBUTE_DUAL_ADDRESS_CYCLE          0x8000
+
+#define EFI_PCI_ATTRIBUTE_VALID_FOR_ALLOCATE_BUFFER   (EFI_PCI_ATTRIBUTE_MEMORY_WRITE_COMBINE | EFI_PCI_ATTRIBUTE_MEMORY_CACHED | EFI_PCI_ATTRIBUTE_DUAL_ADDRESS_CYCLE)
+
+#define EFI_PCI_ATTRIBUTE_INVALID_FOR_ALLOCATE_BUFFER (~EFI_PCI_ATTRIBUTE_VALID_FOR_ALLOCATE_BUFFER)
+
+#define EFI_PCI_ADDRESS(bus, dev, func, reg) \
+    ((UINT64) ((((UINTN) bus) << 24) + (((UINTN) dev) << 16) + (((UINTN) func) << 8) + ((UINTN) reg)))
+
+typedef struct {
+  UINT8   Register;
+  UINT8   Function;
+  UINT8   Device;
+  UINT8   Bus;
+  UINT32  ExtendedRegister;
+} EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_PCI_ADDRESS;
+
+/**
+  Reads from the I/O space of a PCI Root Bridge. Returns when either the polling exit criteria is
+  satisfied or after a defined duration.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Width                 Signifies the width of the memory or I/O operations.
+  @param  Address               The base address of the memory or I/O operations.
+  @param  Mask                  Mask used for the polling criteria.
+  @param  Value                 The comparison value used for the polling exit criteria.
+  @param  Delay                 The number of 100 ns units to poll.
+  @param  Result                Pointer to the last value read from the memory location.
+
+  @retval EFI_SUCCESS           The last data returned from the access matched the poll exit criteria.
+  @retval EFI_TIMEOUT           Delay expired before a match occurred.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_POLL_IO_MEM)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL           *This,
+  IN  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH    Width,
+  IN  UINT64                                   Address,
+  IN  UINT64                                   Mask,
+  IN  UINT64                                   Value,
+  IN  UINT64                                   Delay,
+  OUT UINT64                                   *Result
+  );
+
+/**
+  Enables a PCI driver to access PCI controller registers in the PCI root bridge memory space.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Width                 Signifies the width of the memory operations.
+  @param  Address               The base address of the memory operations.
+  @param  Count                 The number of memory operations to perform.
+  @param  Buffer                For read operations, the destination buffer to store the results. For write
+                                operations, the source buffer to write data from.
+
+  @retval EFI_SUCCESS           The data was read from or written to the PCI root bridge.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_IO_MEM)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL              *This,
+  IN     EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH    Width,
+  IN     UINT64                                   Address,
+  IN     UINTN                                    Count,
+  IN OUT VOID                                     *Buffer
+  );
+
+typedef struct {
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_IO_MEM  Read;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_IO_MEM  Write;
+} EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_ACCESS;
+
+/**
+  Enables a PCI driver to copy one region of PCI root bridge memory space to another region of PCI
+  root bridge memory space.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL instance.
+  @param  Width                 Signifies the width of the memory operations.
+  @param  DestAddress           The destination address of the memory operation.
+  @param  SrcAddress            The source address of the memory operation.
+  @param  Count                 The number of memory operations to perform.
+
+  @retval EFI_SUCCESS           The data was copied from one memory region to another memory region.
+  @retval EFI_INVALID_PARAMETER Width is invalid for this PCI root bridge.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_COPY_MEM)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL              *This,
+  IN     EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH    Width,
+  IN     UINT64                                   DestAddress,
+  IN     UINT64                                   SrcAddress,
+  IN     UINTN                                    Count
+  );
+
+/**
+  Provides the PCI controller-Cspecific addresses required to access system memory from a
+  DMA bus master.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Operation             Indicates if the bus master is going to read or write to system memory.
+  @param  HostAddress           The system memory address to map to the PCI controller.
+  @param  NumberOfBytes         On input the number of bytes to map. On output the number of bytes
+                                that were mapped.
+  @param  DeviceAddress         The resulting map address for the bus master PCI controller to use to
+                                access the hosts HostAddress.
+  @param  Mapping               A resulting value to pass to Unmap().
+
+  @retval EFI_SUCCESS           The range was mapped for the returned NumberOfBytes.
+  @retval EFI_UNSUPPORTED       The HostAddress cannot be mapped as a common buffer.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+  @retval EFI_DEVICE_ERROR      The system hardware could not map the requested address.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_MAP)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL                *This,
+  IN     EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_OPERATION  Operation,
+  IN     VOID                                       *HostAddress,
+  IN OUT UINTN                                      *NumberOfBytes,
+  OUT    EFI_PHYSICAL_ADDRESS                       *DeviceAddress,
+  OUT    VOID                                       **Mapping
+  );
+
+/**
+  Completes the Map() operation and releases any corresponding resources.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Mapping               The mapping value returned from Map().
+
+  @retval EFI_SUCCESS           The range was unmapped.
+  @retval EFI_INVALID_PARAMETER Mapping is not a value that was returned by Map().
+  @retval EFI_DEVICE_ERROR      The data was not committed to the target system memory.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_UNMAP)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL           *This,
+  IN  VOID                                     *Mapping
+  );
+
+/**
+  Allocates pages that are suitable for an EfiPciOperationBusMasterCommonBuffer or
+  EfiPciOperationBusMasterCommonBuffer64 mapping.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Type                  This parameter is not used and must be ignored.
+  @param  MemoryType            The type of memory to allocate, EfiBootServicesData or
+                                EfiRuntimeServicesData.
+  @param  Pages                 The number of pages to allocate.
+  @param  HostAddress           A pointer to store the base system memory address of the
+                                allocated range.
+  @param  Attributes            The requested bit mask of attributes for the allocated range.
+
+  @retval EFI_SUCCESS           The requested memory pages were allocated.
+  @retval EFI_UNSUPPORTED       Attributes is unsupported. The only legal attribute bits are
+                                MEMORY_WRITE_COMBINE and MEMORY_CACHED.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_OUT_OF_RESOURCES  The memory pages could not be allocated.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_ALLOCATE_BUFFER)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL              *This,
+  IN     EFI_ALLOCATE_TYPE                        Type,
+  IN     EFI_MEMORY_TYPE                          MemoryType,
+  IN     UINTN                                    Pages,
+  IN OUT VOID                                     **HostAddress,
+  IN     UINT64                                   Attributes
+  );
+
+/**
+  Frees memory that was allocated with AllocateBuffer().
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Pages                 The number of pages to free.
+  @param  HostAddress           The base system memory address of the allocated range.
+
+  @retval EFI_SUCCESS           The requested memory pages were freed.
+  @retval EFI_INVALID_PARAMETER The memory range specified by HostAddress and Pages
+                                was not allocated with AllocateBuffer().
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_FREE_BUFFER)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL           *This,
+  IN  UINTN                                    Pages,
+  IN  VOID                                     *HostAddress
+  );
+
+/**
+  Flushes all PCI posted write transactions from a PCI host bridge to system memory.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+
+  @retval EFI_SUCCESS           The PCI posted write transactions were flushed from the PCI host
+                                bridge to system memory.
+  @retval EFI_DEVICE_ERROR      The PCI posted write transactions were not flushed from the PCI
+                                host bridge due to a hardware error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_FLUSH)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL  *This
+  );
+
+/**
+  Gets the attributes that a PCI root bridge supports setting with SetAttributes(), and the
+  attributes that a PCI root bridge is currently using.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Supports              A pointer to the mask of attributes that this PCI root bridge supports
+                                setting with SetAttributes().
+  @param  Attributes            A pointer to the mask of attributes that this PCI root bridge is currently
+                                using.
+
+  @retval EFI_SUCCESS           If Supports is not NULL, then the attributes that the PCI root
+                                bridge supports is returned in Supports. If Attributes is
+                                not NULL, then the attributes that the PCI root bridge is currently
+                                using is returned in Attributes.
+  @retval EFI_INVALID_PARAMETER Both Supports and Attributes are NULL.
+
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_GET_ATTRIBUTES)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL           *This,
+  OUT UINT64                                   *Supports,
+  OUT UINT64                                   *Attributes
+  );
+
+/**
+  Sets attributes for a resource range on a PCI root bridge.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Attributes            The mask of attributes to set.
+  @param  ResourceBase          A pointer to the base address of the resource range to be modified by the
+                                attributes specified by Attributes.
+  @param  ResourceLength        A pointer to the length of the resource range to be modified by the
+                                attributes specified by Attributes.
+
+  @retval EFI_SUCCESS           The set of attributes specified by Attributes for the resource
+                                range specified by ResourceBase and ResourceLength
+                                were set on the PCI root bridge, and the actual resource range is
+                                returned in ResuourceBase and ResourceLength.
+  @retval EFI_UNSUPPORTED       A bit is set in Attributes that is not supported by the PCI Root
+                                Bridge.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources to set the attributes on the
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_SET_ATTRIBUTES)(
+  IN EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL              *This,
+  IN     UINT64                                   Attributes,
+  IN OUT UINT64                                   *ResourceBase,
+  IN OUT UINT64                                   *ResourceLength
+  );
+
+/**
+  Retrieves the current resource settings of this PCI root bridge in the form of a set of ACPI 2.0
+  resource descriptors.
+
+  @param  This                  A pointer to the EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL.
+  @param  Resources             A pointer to the ACPI 2.0 resource descriptors that describe the current
+                                configuration of this PCI root bridge.
+
+  @retval EFI_SUCCESS           The current configuration of this PCI root bridge was returned in
+                                Resources.
+  @retval EFI_UNSUPPORTED       The current configuration of this PCI root bridge could not be
+                                retrieved.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_CONFIGURATION)(
+  IN  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL          *This,
+  OUT VOID                                     **Resources
+  );
+
+///
+/// Provides the basic Memory, I/O, PCI configuration, and DMA interfaces that are
+/// used to abstract accesses to PCI controllers behind a PCI Root Bridge Controller.
+///
+struct _EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL {
+  ///
+  /// The EFI_HANDLE of the PCI Host Bridge of which this PCI Root Bridge is a member.
+  ///
+  EFI_HANDLE                                      ParentHandle;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_POLL_IO_MEM     PollMem;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_POLL_IO_MEM     PollIo;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_ACCESS          Mem;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_ACCESS          Io;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_ACCESS          Pci;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_COPY_MEM        CopyMem;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_MAP             Map;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_UNMAP           Unmap;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_ALLOCATE_BUFFER AllocateBuffer;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_FREE_BUFFER     FreeBuffer;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_FLUSH           Flush;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_GET_ATTRIBUTES  GetAttributes;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_SET_ATTRIBUTES  SetAttributes;
+  EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_CONFIGURATION   Configuration;
+
+  ///
+  /// The segment number that this PCI root bridge resides.
+  ///
+  UINT32                                          SegmentNumber;
+};
+
+extern EFI_GUID gEfiPciRootBridgeIoProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/SimpleNetwork.h b/src/include/ipxe/efi/Protocol/SimpleNetwork.h
new file mode 100644
index 0000000..d3d2afc
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/SimpleNetwork.h
@@ -0,0 +1,593 @@
+/** @file
+  Simple Network protocol as defined in the UEFI 2.0 specification.
+
+  Basic network device abstraction.
+
+  Rx    - Received
+  Tx    - Transmit
+  MCast - MultiCast
+  ...
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __SIMPLE_NETWORK_H__
+#define __SIMPLE_NETWORK_H__
+
+#define EFI_SIMPLE_NETWORK_PROTOCOL_GUID \
+  { \
+    0xA19832B9, 0xAC25, 0x11D3, {0x9A, 0x2D, 0x00, 0x90, 0x27, 0x3F, 0xC1, 0x4D } \
+  }
+
+typedef struct _EFI_SIMPLE_NETWORK_PROTOCOL  EFI_SIMPLE_NETWORK_PROTOCOL;
+
+
+///
+/// Protocol defined in EFI1.1.
+///
+typedef EFI_SIMPLE_NETWORK_PROTOCOL   EFI_SIMPLE_NETWORK;
+
+///
+/// Simple Network Protocol data structures
+///
+typedef struct {
+  ///
+  /// Total number of frames received.  Includes frames with errors and
+  /// dropped frames.
+  ///
+  UINT64  RxTotalFrames;
+
+  ///
+  /// Number of valid frames received and copied into receive buffers.
+  ///
+  UINT64  RxGoodFrames;
+
+  ///
+  /// Number of frames below the minimum length for the media.
+  /// This would be <64 for ethernet.
+  ///
+  UINT64  RxUndersizeFrames;
+
+  ///
+  /// Number of frames longer than the maxminum length for the
+  /// media.  This would be >1500 for ethernet.
+  ///
+  UINT64  RxOversizeFrames;
+
+  ///
+  /// Valid frames that were dropped because receive buffers were full.
+  ///
+  UINT64  RxDroppedFrames;
+
+  ///
+  /// Number of valid unicast frames received and not dropped.
+  ///
+  UINT64  RxUnicastFrames;
+
+  ///
+  /// Number of valid broadcast frames received and not dropped.
+  ///
+  UINT64  RxBroadcastFrames;
+
+  ///
+  /// Number of valid mutlicast frames received and not dropped.
+  ///
+  UINT64  RxMulticastFrames;
+
+  ///
+  /// Number of frames w/ CRC or alignment errors.
+  ///
+  UINT64  RxCrcErrorFrames;
+
+  ///
+  /// Total number of bytes received.  Includes frames with errors
+  /// and dropped frames.
+  //
+  UINT64  RxTotalBytes;
+
+  ///
+  /// Transmit statistics.
+  ///
+  UINT64  TxTotalFrames;
+  UINT64  TxGoodFrames;
+  UINT64  TxUndersizeFrames;
+  UINT64  TxOversizeFrames;
+  UINT64  TxDroppedFrames;
+  UINT64  TxUnicastFrames;
+  UINT64  TxBroadcastFrames;
+  UINT64  TxMulticastFrames;
+  UINT64  TxCrcErrorFrames;
+  UINT64  TxTotalBytes;
+
+  ///
+  /// Number of collisions detection on this subnet.
+  ///
+  UINT64  Collisions;
+
+  ///
+  /// Number of frames destined for unsupported protocol.
+  ///
+  UINT64  UnsupportedProtocol;
+
+} EFI_NETWORK_STATISTICS;
+
+typedef enum {
+  EfiSimpleNetworkStopped,
+  EfiSimpleNetworkStarted,
+  EfiSimpleNetworkInitialized,
+  EfiSimpleNetworkMaxState
+} EFI_SIMPLE_NETWORK_STATE;
+
+#define EFI_SIMPLE_NETWORK_RECEIVE_UNICAST                0x01
+#define EFI_SIMPLE_NETWORK_RECEIVE_MULTICAST              0x02
+#define EFI_SIMPLE_NETWORK_RECEIVE_BROADCAST              0x04
+#define EFI_SIMPLE_NETWORK_RECEIVE_PROMISCUOUS            0x08
+#define EFI_SIMPLE_NETWORK_RECEIVE_PROMISCUOUS_MULTICAST  0x10
+
+#define EFI_SIMPLE_NETWORK_RECEIVE_INTERRUPT              0x01
+#define EFI_SIMPLE_NETWORK_TRANSMIT_INTERRUPT             0x02
+#define EFI_SIMPLE_NETWORK_COMMAND_INTERRUPT              0x04
+#define EFI_SIMPLE_NETWORK_SOFTWARE_INTERRUPT             0x08
+
+#define MAX_MCAST_FILTER_CNT                              16
+typedef struct {
+  UINT32          State;
+  UINT32          HwAddressSize;
+  UINT32          MediaHeaderSize;
+  UINT32          MaxPacketSize;
+  UINT32          NvRamSize;
+  UINT32          NvRamAccessSize;
+  UINT32          ReceiveFilterMask;
+  UINT32          ReceiveFilterSetting;
+  UINT32          MaxMCastFilterCount;
+  UINT32          MCastFilterCount;
+  EFI_MAC_ADDRESS MCastFilter[MAX_MCAST_FILTER_CNT];
+  EFI_MAC_ADDRESS CurrentAddress;
+  EFI_MAC_ADDRESS BroadcastAddress;
+  EFI_MAC_ADDRESS PermanentAddress;
+  UINT8           IfType;
+  BOOLEAN         MacAddressChangeable;
+  BOOLEAN         MultipleTxSupported;
+  BOOLEAN         MediaPresentSupported;
+  BOOLEAN         MediaPresent;
+} EFI_SIMPLE_NETWORK_MODE;
+
+//
+// Protocol Member Functions
+//
+/**
+  Changes the state of a network interface from "stopped" to "started".
+
+  @param  This Protocol instance pointer.
+
+  @retval EFI_SUCCESS           The network interface was started.
+  @retval EFI_ALREADY_STARTED   The network interface is already in the started state.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_START)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL  *This
+  );
+
+/**
+  Changes the state of a network interface from "started" to "stopped".
+
+  @param  This Protocol instance pointer.
+
+  @retval EFI_SUCCESS           The network interface was stopped.
+  @retval EFI_ALREADY_STARTED   The network interface is already in the stopped state.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_STOP)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL  *This
+  );
+
+/**
+  Resets a network adapter and allocates the transmit and receive buffers
+  required by the network interface; optionally, also requests allocation
+  of additional transmit and receive buffers.
+
+  @param  This              Protocol instance pointer.
+  @param  ExtraRxBufferSize The size, in bytes, of the extra receive buffer space
+                            that the driver should allocate for the network interface.
+                            Some network interfaces will not be able to use the extra
+                            buffer, and the caller will not know if it is actually
+                            being used.
+  @param  ExtraTxBufferSize The size, in bytes, of the extra transmit buffer space
+                            that the driver should allocate for the network interface.
+                            Some network interfaces will not be able to use the extra
+                            buffer, and the caller will not know if it is actually
+                            being used.
+
+  @retval EFI_SUCCESS           The network interface was initialized.
+  @retval EFI_NOT_STARTED       The network interface has not been started
+  @retval EFI_OUT_OF_RESOURCES  There was not enough memory for the transmit and
+                                receive buffers.   .
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_INITIALIZE)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL                    *This,
+  IN UINTN                                          ExtraRxBufferSize  OPTIONAL,
+  IN UINTN                                          ExtraTxBufferSize  OPTIONAL
+  );
+
+/**
+  Resets a network adapter and re-initializes it with the parameters that were
+  provided in the previous call to Initialize().
+
+  @param  This                 Protocol instance pointer.
+  @param  ExtendedVerification Indicates that the driver may perform a more
+                               exhaustive verification operation of the device
+                               during reset.
+
+  @retval EFI_SUCCESS           The network interface was reset.
+  @retval EFI_NOT_STARTED       The network interface has not been started
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_RESET)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL   *This,
+  IN BOOLEAN                       ExtendedVerification
+  );
+
+/**
+  Resets a network adapter and leaves it in a state that is safe for
+  another driver to initialize.
+
+  @param  This Protocol instance pointer.
+
+  @retval EFI_SUCCESS           The network interface was shutdown.
+  @retval EFI_NOT_STARTED       The network interface has not been started
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_SHUTDOWN)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL  *This
+  );
+
+/**
+  Manages the multicast receive filters of a network interface.
+
+  @param  This             Protocol instance pointer.
+  @param  Enable           A bit mask of receive filters to enable on the network interface.
+  @param  Disable          A bit mask of receive filters to disable on the network interface.
+  @param  ResetMCastFilter Set to TRUE to reset the contents of the multicast receive
+                           filters on the network interface to their default values.
+  @param  McastFilterCnt   Number of multicast HW MAC addresses in the new
+                           MCastFilter list. This value must be less than or equal to
+                           the MCastFilterCnt field of EFI_SIMPLE_NETWORK_MODE. This
+                           field is optional if ResetMCastFilter is TRUE.
+  @param  MCastFilter      A pointer to a list of new multicast receive filter HW MAC
+                           addresses. This list will replace any existing multicast
+                           HW MAC address list. This field is optional if
+                           ResetMCastFilter is TRUE.
+
+  @retval EFI_SUCCESS           The multicast receive filter list was updated.
+  @retval EFI_NOT_STARTED       The network interface has not been started
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_RECEIVE_FILTERS)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL                             *This,
+  IN UINT32                                                  Enable,
+  IN UINT32                                                  Disable,
+  IN BOOLEAN                                                 ResetMCastFilter,
+  IN UINTN                                                   MCastFilterCnt     OPTIONAL,
+  IN EFI_MAC_ADDRESS                                         *MCastFilter OPTIONAL
+  );
+
+/**
+  Modifies or resets the current station address, if supported.
+
+  @param  This  Protocol instance pointer.
+  @param  Reset Flag used to reset the station address to the network interfaces
+                permanent address.
+  @param  New   New station address to be used for the network interface.
+
+  @retval EFI_SUCCESS           The network interfaces station address was updated.
+  @retval EFI_NOT_STARTED       The network interface has not been started
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_STATION_ADDRESS)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL            *This,
+  IN BOOLEAN                                Reset,
+  IN EFI_MAC_ADDRESS                        *New OPTIONAL
+  );
+
+/**
+  Resets or collects the statistics on a network interface.
+
+  @param  This            Protocol instance pointer.
+  @param  Reset           Set to TRUE to reset the statistics for the network interface.
+  @param  StatisticsSize  On input the size, in bytes, of StatisticsTable. On
+                          output the size, in bytes, of the resulting table of
+                          statistics.
+  @param  StatisticsTable A pointer to the EFI_NETWORK_STATISTICS structure that
+                          contains the statistics.
+
+  @retval EFI_SUCCESS           The statistics were collected from the network interface.
+  @retval EFI_NOT_STARTED       The network interface has not been started.
+  @retval EFI_BUFFER_TOO_SMALL  The Statistics buffer was too small. The current buffer
+                                size needed to hold the statistics is returned in
+                                StatisticsSize.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_STATISTICS)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL          *This,
+  IN BOOLEAN                              Reset,
+  IN OUT UINTN                            *StatisticsSize   OPTIONAL,
+  OUT EFI_NETWORK_STATISTICS              *StatisticsTable  OPTIONAL
+  );
+
+/**
+  Converts a multicast IP address to a multicast HW MAC address.
+
+  @param  This Protocol instance pointer.
+  @param  IPv6 Set to TRUE if the multicast IP address is IPv6 [RFC 2460]. Set
+               to FALSE if the multicast IP address is IPv4 [RFC 791].
+  @param  IP   The multicast IP address that is to be converted to a multicast
+               HW MAC address.
+  @param  MAC  The multicast HW MAC address that is to be generated from IP.
+
+  @retval EFI_SUCCESS           The multicast IP address was mapped to the multicast
+                                HW MAC address.
+  @retval EFI_NOT_STARTED       The network interface has not been started.
+  @retval EFI_BUFFER_TOO_SMALL  The Statistics buffer was too small. The current buffer
+                                size needed to hold the statistics is returned in
+                                StatisticsSize.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_MCAST_IP_TO_MAC)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL          *This,
+  IN BOOLEAN                              IPv6,
+  IN EFI_IP_ADDRESS                       *IP,
+  OUT EFI_MAC_ADDRESS                     *MAC
+  );
+
+/**
+  Performs read and write operations on the NVRAM device attached to a
+  network interface.
+
+  @param  This       Protocol instance pointer.
+  @param  ReadWrite  TRUE for read operations, FALSE for write operations.
+  @param  Offset     Byte offset in the NVRAM device at which to start the read or
+                     write operation. This must be a multiple of NvRamAccessSize and
+                     less than NvRamSize.
+  @param  BufferSize The number of bytes to read or write from the NVRAM device.
+                     This must also be a multiple of NvramAccessSize.
+  @param  Buffer     A pointer to the data buffer.
+
+  @retval EFI_SUCCESS           The NVRAM access was performed.
+  @retval EFI_NOT_STARTED       The network interface has not been started.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_NVDATA)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL          *This,
+  IN BOOLEAN                              ReadWrite,
+  IN UINTN                                Offset,
+  IN UINTN                                BufferSize,
+  IN OUT VOID                             *Buffer
+  );
+
+/**
+  Reads the current interrupt status and recycled transmit buffer status from
+  a network interface.
+
+  @param  This            Protocol instance pointer.
+  @param  InterruptStatus A pointer to the bit mask of the currently active interrupts
+                          If this is NULL, the interrupt status will not be read from
+                          the device. If this is not NULL, the interrupt status will
+                          be read from the device. When the  interrupt status is read,
+                          it will also be cleared. Clearing the transmit  interrupt
+                          does not empty the recycled transmit buffer array.
+  @param  TxBuf           Recycled transmit buffer address. The network interface will
+                          not transmit if its internal recycled transmit buffer array
+                          is full. Reading the transmit buffer does not clear the
+                          transmit interrupt. If this is NULL, then the transmit buffer
+                          status will not be read. If there are no transmit buffers to
+                          recycle and TxBuf is not NULL, * TxBuf will be set to NULL.
+
+  @retval EFI_SUCCESS           The status of the network interface was retrieved.
+  @retval EFI_NOT_STARTED       The network interface has not been started.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_GET_STATUS)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL          *This,
+  OUT UINT32                              *InterruptStatus OPTIONAL,
+  OUT VOID                                **TxBuf OPTIONAL
+  );
+
+/**
+  Places a packet in the transmit queue of a network interface.
+
+  @param  This       Protocol instance pointer.
+  @param  HeaderSize The size, in bytes, of the media header to be filled in by
+                     the Transmit() function. If HeaderSize is non-zero, then it
+                     must be equal to This->Mode->MediaHeaderSize and the DestAddr
+                     and Protocol parameters must not be NULL.
+  @param  BufferSize The size, in bytes, of the entire packet (media header and
+                     data) to be transmitted through the network interface.
+  @param  Buffer     A pointer to the packet (media header followed by data) to be
+                     transmitted. This parameter cannot be NULL. If HeaderSize is zero,
+                     then the media header in Buffer must already be filled in by the
+                     caller. If HeaderSize is non-zero, then the media header will be
+                     filled in by the Transmit() function.
+  @param  SrcAddr    The source HW MAC address. If HeaderSize is zero, then this parameter
+                     is ignored. If HeaderSize is non-zero and SrcAddr is NULL, then
+                     This->Mode->CurrentAddress is used for the source HW MAC address.
+  @param  DsetAddr   The destination HW MAC address. If HeaderSize is zero, then this
+                     parameter is ignored.
+  @param  Protocol   The type of header to build. If HeaderSize is zero, then this
+                     parameter is ignored. See RFC 1700, section "Ether Types", for
+                     examples.
+
+  @retval EFI_SUCCESS           The packet was placed on the transmit queue.
+  @retval EFI_NOT_STARTED       The network interface has not been started.
+  @retval EFI_NOT_READY         The network interface is too busy to accept this transmit request.
+  @retval EFI_BUFFER_TOO_SMALL  The BufferSize parameter is too small.
+  @retval EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_TRANSMIT)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL          *This,
+  IN UINTN                                HeaderSize,
+  IN UINTN                                BufferSize,
+  IN VOID                                 *Buffer,
+  IN EFI_MAC_ADDRESS                      *SrcAddr  OPTIONAL,
+  IN EFI_MAC_ADDRESS                      *DestAddr OPTIONAL,
+  IN UINT16                               *Protocol OPTIONAL
+  );
+
+/**
+  Receives a packet from a network interface.
+
+  @param  This       Protocol instance pointer.
+  @param  HeaderSize The size, in bytes, of the media header received on the network
+                     interface. If this parameter is NULL, then the media header size
+                     will not be returned.
+  @param  BufferSize On entry, the size, in bytes, of Buffer. On exit, the size, in
+                     bytes, of the packet that was received on the network interface.
+  @param  Buffer     A pointer to the data buffer to receive both the media header and
+                     the data.
+  @param  SrcAddr    The source HW MAC address. If this parameter is NULL, the
+                     HW MAC source address will not be extracted from the media
+                     header.
+  @param  DsetAddr   The destination HW MAC address. If this parameter is NULL,
+                     the HW MAC destination address will not be extracted from the
+                     media header.
+  @param  Protocol   The media header type. If this parameter is NULL, then the
+                     protocol will not be extracted from the media header. See
+                     RFC 1700 section "Ether Types" for examples.
+
+  @retval  EFI_SUCCESS           The received data was stored in Buffer, and BufferSize has
+                                 been updated to the number of bytes received.
+  @retval  EFI_NOT_STARTED       The network interface has not been started.
+  @retval  EFI_NOT_READY         The network interface is too busy to accept this transmit
+                                 request.
+  @retval  EFI_BUFFER_TOO_SMALL  The BufferSize parameter is too small.
+  @retval  EFI_INVALID_PARAMETER One or more of the parameters has an unsupported value.
+  @retval  EFI_DEVICE_ERROR      The command could not be sent to the network interface.
+  @retval  EFI_UNSUPPORTED       This function is not supported by the network interface.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIMPLE_NETWORK_RECEIVE)(
+  IN EFI_SIMPLE_NETWORK_PROTOCOL          *This,
+  OUT UINTN                               *HeaderSize OPTIONAL,
+  IN OUT UINTN                            *BufferSize,
+  OUT VOID                                *Buffer,
+  OUT EFI_MAC_ADDRESS                     *SrcAddr    OPTIONAL,
+  OUT EFI_MAC_ADDRESS                     *DestAddr   OPTIONAL,
+  OUT UINT16                              *Protocol   OPTIONAL
+  );
+
+#define EFI_SIMPLE_NETWORK_PROTOCOL_REVISION  0x00010000
+
+//
+// Revision defined in EFI1.1
+//
+#define EFI_SIMPLE_NETWORK_INTERFACE_REVISION   EFI_SIMPLE_NETWORK_PROTOCOL_REVISION
+
+///
+/// The EFI_SIMPLE_NETWORK_PROTOCOL protocol is used to initialize access
+/// to a network adapter. Once the network adapter initializes,
+/// the EFI_SIMPLE_NETWORK_PROTOCOL protocol provides services that
+/// allow packets to be transmitted and received.
+///
+struct _EFI_SIMPLE_NETWORK_PROTOCOL {
+  ///
+  /// Revision of the EFI_SIMPLE_NETWORK_PROTOCOL. All future revisions must
+  /// be backwards compatible. If a future version is not backwards compatible
+  /// it is not the same GUID.
+  ///
+  UINT64                              Revision;
+  EFI_SIMPLE_NETWORK_START            Start;
+  EFI_SIMPLE_NETWORK_STOP             Stop;
+  EFI_SIMPLE_NETWORK_INITIALIZE       Initialize;
+  EFI_SIMPLE_NETWORK_RESET            Reset;
+  EFI_SIMPLE_NETWORK_SHUTDOWN         Shutdown;
+  EFI_SIMPLE_NETWORK_RECEIVE_FILTERS  ReceiveFilters;
+  EFI_SIMPLE_NETWORK_STATION_ADDRESS  StationAddress;
+  EFI_SIMPLE_NETWORK_STATISTICS       Statistics;
+  EFI_SIMPLE_NETWORK_MCAST_IP_TO_MAC  MCastIpToMac;
+  EFI_SIMPLE_NETWORK_NVDATA           NvData;
+  EFI_SIMPLE_NETWORK_GET_STATUS       GetStatus;
+  EFI_SIMPLE_NETWORK_TRANSMIT         Transmit;
+  EFI_SIMPLE_NETWORK_RECEIVE          Receive;
+  ///
+  /// Event used with WaitForEvent() to wait for a packet to be received.
+  ///
+  EFI_EVENT                           WaitForPacket;
+  ///
+  /// Pointer to the EFI_SIMPLE_NETWORK_MODE data for the device.
+  ///
+  EFI_SIMPLE_NETWORK_MODE             *Mode;
+};
+
+extern EFI_GUID gEfiSimpleNetworkProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/SimpleTextIn.h b/src/include/ipxe/efi/Protocol/SimpleTextIn.h
new file mode 100644
index 0000000..787d8f1
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/SimpleTextIn.h
@@ -0,0 +1,136 @@
+/** @file
+  Simple Text In protocol from the UEFI 2.0 specification.
+
+  Abstraction of a very simple input device like a keyboard or serial
+  terminal.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __SIMPLE_TEXT_IN_PROTOCOL_H__
+#define __SIMPLE_TEXT_IN_PROTOCOL_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+
+#define EFI_SIMPLE_TEXT_INPUT_PROTOCOL_GUID \
+  { \
+    0x387477c1, 0x69c7, 0x11d2, {0x8e, 0x39, 0x0, 0xa0, 0xc9, 0x69, 0x72, 0x3b } \
+  }
+
+///
+/// Protocol GUID defined in EFI1.1.
+///
+#define SIMPLE_INPUT_PROTOCOL   EFI_SIMPLE_TEXT_INPUT_PROTOCOL_GUID
+
+typedef struct _EFI_SIMPLE_TEXT_INPUT_PROTOCOL  EFI_SIMPLE_TEXT_INPUT_PROTOCOL;
+
+///
+/// Backward-compatible with EFI1.1.
+///
+typedef struct _EFI_SIMPLE_TEXT_INPUT_PROTOCOL  SIMPLE_INPUT_INTERFACE;
+//
+// Data structures
+//
+typedef struct {
+  UINT16  ScanCode;
+  CHAR16  UnicodeChar;
+} EFI_INPUT_KEY;
+
+//
+// Required unicode control chars
+//
+#define CHAR_NULL             0x0000
+#define CHAR_BACKSPACE        0x0008
+#define CHAR_TAB              0x0009
+#define CHAR_LINEFEED         0x000A
+#define CHAR_CARRIAGE_RETURN  0x000D
+
+//
+// EFI Scan codes
+//
+#define SCAN_NULL       0x0000
+#define SCAN_UP         0x0001
+#define SCAN_DOWN       0x0002
+#define SCAN_RIGHT      0x0003
+#define SCAN_LEFT       0x0004
+#define SCAN_HOME       0x0005
+#define SCAN_END        0x0006
+#define SCAN_INSERT     0x0007
+#define SCAN_DELETE     0x0008
+#define SCAN_PAGE_UP    0x0009
+#define SCAN_PAGE_DOWN  0x000A
+#define SCAN_F1         0x000B
+#define SCAN_F2         0x000C
+#define SCAN_F3         0x000D
+#define SCAN_F4         0x000E
+#define SCAN_F5         0x000F
+#define SCAN_F6         0x0010
+#define SCAN_F7         0x0011
+#define SCAN_F8         0x0012
+#define SCAN_F9         0x0013
+#define SCAN_F10        0x0014
+#define SCAN_F11        0x0015
+#define SCAN_F12        0x0016
+#define SCAN_ESC        0x0017
+
+/**
+  Reset the input device and optionaly run diagnostics
+
+  @param  This                 Protocol instance pointer.
+  @param  ExtendedVerification Driver may perform diagnostics on reset.
+
+  @retval EFI_SUCCESS          The device was reset.
+  @retval EFI_DEVICE_ERROR     The device is not functioning properly and could not be reset.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_INPUT_RESET)(
+  IN EFI_SIMPLE_TEXT_INPUT_PROTOCOL       *This,
+  IN BOOLEAN                              ExtendedVerification
+  );
+
+/**
+  Reads the next keystroke from the input device. The WaitForKey Event can
+  be used to test for existance of a keystroke via WaitForEvent () call.
+
+  @param  This Protocol instance pointer.
+  @param  Key  Driver may perform diagnostics on reset.
+
+  @retval EFI_SUCCESS      The keystroke information was returned.
+  @retval EFI_NOT_READY    There was no keystroke data availiable.
+  @retval EFI_DEVICE_ERROR The keydtroke information was not returned due to
+                           hardware errors.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_INPUT_READ_KEY)(
+  IN EFI_SIMPLE_TEXT_INPUT_PROTOCOL       *This,
+  OUT EFI_INPUT_KEY                       *Key
+  );
+
+///
+/// The EFI_SIMPLE_TEXT_INPUT_PROTOCOL is used on the ConsoleIn device.
+/// It is the minimum required protocol for ConsoleIn.
+///
+struct _EFI_SIMPLE_TEXT_INPUT_PROTOCOL {
+  EFI_INPUT_RESET     Reset;
+  EFI_INPUT_READ_KEY  ReadKeyStroke;
+  ///
+  /// Event to use with WaitForEvent() to wait for a key to be available
+  ///
+  EFI_EVENT           WaitForKey;
+};
+
+extern EFI_GUID gEfiSimpleTextInProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Protocol/SimpleTextOut.h b/src/include/ipxe/efi/Protocol/SimpleTextOut.h
new file mode 100644
index 0000000..426ce81
--- /dev/null
+++ b/src/include/ipxe/efi/Protocol/SimpleTextOut.h
@@ -0,0 +1,404 @@
+/** @file
+  Simple Text Out protocol from the UEFI 2.0 specification.
+
+  Abstraction of a very simple text based output device like VGA text mode or
+  a serial terminal. The Simple Text Out protocol instance can represent
+  a single hardware device or a virtual device that is an agregation
+  of multiple physical devices.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __SIMPLE_TEXT_OUT_H__
+#define __SIMPLE_TEXT_OUT_H__
+
+#define EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL_GUID \
+  { \
+    0x387477c2, 0x69c7, 0x11d2, {0x8e, 0x39, 0x0, 0xa0, 0xc9, 0x69, 0x72, 0x3b } \
+  }
+
+///
+/// Protocol GUID defined in EFI1.1.
+///
+#define SIMPLE_TEXT_OUTPUT_PROTOCOL   EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL_GUID
+
+typedef struct _EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL;
+
+///
+/// Backward-compatible with EFI1.1.
+///
+typedef EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL   SIMPLE_TEXT_OUTPUT_INTERFACE;
+
+//
+// Define's for required EFI Unicode Box Draw characters
+//
+#define BOXDRAW_HORIZONTAL                  0x2500
+#define BOXDRAW_VERTICAL                    0x2502
+#define BOXDRAW_DOWN_RIGHT                  0x250c
+#define BOXDRAW_DOWN_LEFT                   0x2510
+#define BOXDRAW_UP_RIGHT                    0x2514
+#define BOXDRAW_UP_LEFT                     0x2518
+#define BOXDRAW_VERTICAL_RIGHT              0x251c
+#define BOXDRAW_VERTICAL_LEFT               0x2524
+#define BOXDRAW_DOWN_HORIZONTAL             0x252c
+#define BOXDRAW_UP_HORIZONTAL               0x2534
+#define BOXDRAW_VERTICAL_HORIZONTAL         0x253c
+#define BOXDRAW_DOUBLE_HORIZONTAL           0x2550
+#define BOXDRAW_DOUBLE_VERTICAL             0x2551
+#define BOXDRAW_DOWN_RIGHT_DOUBLE           0x2552
+#define BOXDRAW_DOWN_DOUBLE_RIGHT           0x2553
+#define BOXDRAW_DOUBLE_DOWN_RIGHT           0x2554
+#define BOXDRAW_DOWN_LEFT_DOUBLE            0x2555
+#define BOXDRAW_DOWN_DOUBLE_LEFT            0x2556
+#define BOXDRAW_DOUBLE_DOWN_LEFT            0x2557
+#define BOXDRAW_UP_RIGHT_DOUBLE             0x2558
+#define BOXDRAW_UP_DOUBLE_RIGHT             0x2559
+#define BOXDRAW_DOUBLE_UP_RIGHT             0x255a
+#define BOXDRAW_UP_LEFT_DOUBLE              0x255b
+#define BOXDRAW_UP_DOUBLE_LEFT              0x255c
+#define BOXDRAW_DOUBLE_UP_LEFT              0x255d
+#define BOXDRAW_VERTICAL_RIGHT_DOUBLE       0x255e
+#define BOXDRAW_VERTICAL_DOUBLE_RIGHT       0x255f
+#define BOXDRAW_DOUBLE_VERTICAL_RIGHT       0x2560
+#define BOXDRAW_VERTICAL_LEFT_DOUBLE        0x2561
+#define BOXDRAW_VERTICAL_DOUBLE_LEFT        0x2562
+#define BOXDRAW_DOUBLE_VERTICAL_LEFT        0x2563
+#define BOXDRAW_DOWN_HORIZONTAL_DOUBLE      0x2564
+#define BOXDRAW_DOWN_DOUBLE_HORIZONTAL      0x2565
+#define BOXDRAW_DOUBLE_DOWN_HORIZONTAL      0x2566
+#define BOXDRAW_UP_HORIZONTAL_DOUBLE        0x2567
+#define BOXDRAW_UP_DOUBLE_HORIZONTAL        0x2568
+#define BOXDRAW_DOUBLE_UP_HORIZONTAL        0x2569
+#define BOXDRAW_VERTICAL_HORIZONTAL_DOUBLE  0x256a
+#define BOXDRAW_VERTICAL_DOUBLE_HORIZONTAL  0x256b
+#define BOXDRAW_DOUBLE_VERTICAL_HORIZONTAL  0x256c
+
+//
+// EFI Required Block Elements Code Chart
+//
+#define BLOCKELEMENT_FULL_BLOCK   0x2588
+#define BLOCKELEMENT_LIGHT_SHADE  0x2591
+
+//
+// EFI Required Geometric Shapes Code Chart
+//
+#define GEOMETRICSHAPE_UP_TRIANGLE    0x25b2
+#define GEOMETRICSHAPE_RIGHT_TRIANGLE 0x25ba
+#define GEOMETRICSHAPE_DOWN_TRIANGLE  0x25bc
+#define GEOMETRICSHAPE_LEFT_TRIANGLE  0x25c4
+
+//
+// EFI Required Arrow shapes
+//
+#define ARROW_LEFT  0x2190
+#define ARROW_UP    0x2191
+#define ARROW_RIGHT 0x2192
+#define ARROW_DOWN  0x2193
+
+//
+// EFI Console Colours
+//
+#define EFI_BLACK                 0x00
+#define EFI_BLUE                  0x01
+#define EFI_GREEN                 0x02
+#define EFI_CYAN                  (EFI_BLUE | EFI_GREEN)
+#define EFI_RED                   0x04
+#define EFI_MAGENTA               (EFI_BLUE | EFI_RED)
+#define EFI_BROWN                 (EFI_GREEN | EFI_RED)
+#define EFI_LIGHTGRAY             (EFI_BLUE | EFI_GREEN | EFI_RED)
+#define EFI_BRIGHT                0x08
+#define EFI_DARKGRAY              (EFI_BRIGHT)
+#define EFI_LIGHTBLUE             (EFI_BLUE | EFI_BRIGHT)
+#define EFI_LIGHTGREEN            (EFI_GREEN | EFI_BRIGHT)
+#define EFI_LIGHTCYAN             (EFI_CYAN | EFI_BRIGHT)
+#define EFI_LIGHTRED              (EFI_RED | EFI_BRIGHT)
+#define EFI_LIGHTMAGENTA          (EFI_MAGENTA | EFI_BRIGHT)
+#define EFI_YELLOW                (EFI_BROWN | EFI_BRIGHT)
+#define EFI_WHITE                 (EFI_BLUE | EFI_GREEN | EFI_RED | EFI_BRIGHT)
+
+#define EFI_TEXT_ATTR(f, b)       ((f) | ((b) << 4))
+
+#define EFI_BACKGROUND_BLACK      0x00
+#define EFI_BACKGROUND_BLUE       0x10
+#define EFI_BACKGROUND_GREEN      0x20
+#define EFI_BACKGROUND_CYAN       (EFI_BACKGROUND_BLUE | EFI_BACKGROUND_GREEN)
+#define EFI_BACKGROUND_RED        0x40
+#define EFI_BACKGROUND_MAGENTA    (EFI_BACKGROUND_BLUE | EFI_BACKGROUND_RED)
+#define EFI_BACKGROUND_BROWN      (EFI_BACKGROUND_GREEN | EFI_BACKGROUND_RED)
+#define EFI_BACKGROUND_LIGHTGRAY  (EFI_BACKGROUND_BLUE | EFI_BACKGROUND_GREEN | EFI_BACKGROUND_RED)
+
+//
+// We currently define attributes from 0 - 7F for color manipulations
+// To internally handle the local display characteristics for a particular character, we are defining
+// Bit 7 to signify the local glyph representation for a character.  If turned on, glyphs will be
+// pulled from the wide glyph database and will display locally as a wide character (16 X 19 versus 8 X 19)
+// If bit 7 is off, the narrow glyph database will be used.  This does NOT affect information that is sent to
+// non-local displays (e.g. serial or LAN consoles).
+//
+#define EFI_WIDE_ATTRIBUTE  0x80
+
+/**
+  Reset the text output device hardware and optionaly run diagnostics
+
+  @param  This                 Protocol instance pointer.
+  @param  ExtendedVerification Driver may perform more exhaustive verfication
+                               operation of the device during reset.
+
+  @retval EFI_SUCCESS          The text output device was reset.
+  @retval EFI_DEVICE_ERROR     The text output device is not functioning correctly and
+                               could not be reset.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_RESET)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN BOOLEAN                                ExtendedVerification
+  );
+
+/**
+  Write a Unicode string to the output device.
+
+  @param  This   Protocol instance pointer.
+  @param  String The NULL-terminated Unicode string to be displayed on the output
+                 device(s). All output devices must also support the Unicode
+                 drawing defined in this file.
+
+  @retval EFI_SUCCESS             The string was output to the device.
+  @retval EFI_DEVICE_ERROR        The device reported an error while attempting to output
+                                  the text.
+  @retval EFI_UNSUPPORTED         The output device's mode is not currently in a
+                                  defined text mode.
+  @retval EFI_WARN_UNKNOWN_GLYPH  This warning code indicates that some of the
+                                  characters in the Unicode string could not be
+                                  rendered and were skipped.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_STRING)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN CHAR16                                 *String
+  );
+
+/**
+  Verifies that all characters in a Unicode string can be output to the
+  target device.
+
+  @param  This   Protocol instance pointer.
+  @param  String The NULL-terminated Unicode string to be examined for the output
+                 device(s).
+
+  @retval EFI_SUCCESS      The device(s) are capable of rendering the output string.
+  @retval EFI_UNSUPPORTED  Some of the characters in the Unicode string cannot be
+                           rendered by one or more of the output devices mapped
+                           by the EFI handle.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_TEST_STRING)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN CHAR16                                 *String
+  );
+
+/**
+  Returns information for an available text mode that the output device(s)
+  supports.
+
+  @param  This       Protocol instance pointer.
+  @param  ModeNumber The mode number to return information on.
+  @param  Columns    Returns the geometry of the text output device for the
+                     requested ModeNumber.
+  @param  Rows       Returns the geometry of the text output device for the
+                     requested ModeNumber.
+
+  @retval EFI_SUCCESS      The requested mode information was returned.
+  @retval EFI_DEVICE_ERROR The device had an error and could not complete the request.
+  @retval EFI_UNSUPPORTED  The mode number was not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_QUERY_MODE)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN UINTN                                  ModeNumber,
+  OUT UINTN                                 *Columns,
+  OUT UINTN                                 *Rows
+  );
+
+/**
+  Sets the output device(s) to a specified mode.
+
+  @param  This       Protocol instance pointer.
+  @param  ModeNumber The mode number to set.
+
+  @retval EFI_SUCCESS      The requested text mode was set.
+  @retval EFI_DEVICE_ERROR The device had an error and could not complete the request.
+  @retval EFI_UNSUPPORTED  The mode number was not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_SET_MODE)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN UINTN                                  ModeNumber
+  );
+
+/**
+  Sets the background and foreground colors for the OutputString () and
+  ClearScreen () functions.
+
+  @param  This      Protocol instance pointer.
+  @param  Attribute The attribute to set. Bits 0..3 are the foreground color, and
+                    bits 4..6 are the background color. All other bits are undefined
+                    and must be zero. The valid Attributes are defined in this file.
+
+  @retval EFI_SUCCESS     The attribute was set.
+  @retval EFI_DEVICE_     ERROR The device had an error and could not complete the request.
+  @retval EFI_UNSUPPORTED The attribute requested is not defined.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_SET_ATTRIBUTE)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN UINTN                                  Attribute
+  );
+
+/**
+  Clears the output device(s) display to the currently selected background
+  color.
+
+  @param  This              Protocol instance pointer.
+
+  @retval  EFI_SUCCESS      The operation completed successfully.
+  @retval  EFI_DEVICE_ERROR The device had an error and could not complete the request.
+  @retval  EFI_UNSUPPORTED  The output device is not in a valid text mode.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_CLEAR_SCREEN)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL   *This
+  );
+
+/**
+  Sets the current coordinates of the cursor position
+
+  @param  This        Protocol instance pointer.
+  @param  Column      The position to set the cursor to. Must be greater than or
+                      equal to zero and less than the number of columns and rows
+                      by QueryMode ().
+  @param  Row         The position to set the cursor to. Must be greater than or
+                      equal to zero and less than the number of columns and rows
+                      by QueryMode ().
+
+  @retval EFI_SUCCESS      The operation completed successfully.
+  @retval EFI_DEVICE_ERROR The device had an error and could not complete the request.
+  @retval EFI_UNSUPPORTED  The output device is not in a valid text mode, or the
+                           cursor position is invalid for the current mode.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_SET_CURSOR_POSITION)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN UINTN                                  Column,
+  IN UINTN                                  Row
+  );
+
+/**
+  Makes the cursor visible or invisible
+
+  @param  This    Protocol instance pointer.
+  @param  Visible If TRUE, the cursor is set to be visible. If FALSE, the cursor is
+                  set to be invisible.
+
+  @retval EFI_SUCCESS      The operation completed successfully.
+  @retval EFI_DEVICE_ERROR The device had an error and could not complete the
+                           request, or the device does not support changing
+                           the cursor mode.
+  @retval EFI_UNSUPPORTED  The output device is not in a valid text mode.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_TEXT_ENABLE_CURSOR)(
+  IN EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL        *This,
+  IN BOOLEAN                                Visible
+  );
+
+/**
+  @par Data Structure Description:
+  Mode Structure pointed to by Simple Text Out protocol.
+
+  @param MaxMode
+  The number of modes supported by QueryMode () and SetMode ().
+
+  @param Mode
+  The text mode of the output device(s).
+
+  @param Attribute
+  The current character output attribute
+
+  @param CursorColumn
+  The cursor's column.
+
+  @param CursorRow
+  The cursor's row.
+
+  @param CursorVisible
+  The cursor is currently visbile or not.
+
+**/
+typedef struct {
+  INT32   MaxMode;
+
+  //
+  // current settings
+  //
+  INT32   Mode;
+  INT32   Attribute;
+  INT32   CursorColumn;
+  INT32   CursorRow;
+  BOOLEAN CursorVisible;
+} EFI_SIMPLE_TEXT_OUTPUT_MODE;
+
+///
+/// The SIMPLE_TEXT_OUTPUT protocol is used to control text-based output devices.
+/// It is the minimum required protocol for any handle supplied as the ConsoleOut
+/// or StandardError device. In addition, the minimum supported text mode of such
+/// devices is at least 80 x 25 characters.
+///
+struct _EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL {
+  EFI_TEXT_RESET                Reset;
+
+  EFI_TEXT_STRING               OutputString;
+  EFI_TEXT_TEST_STRING          TestString;
+
+  EFI_TEXT_QUERY_MODE           QueryMode;
+  EFI_TEXT_SET_MODE             SetMode;
+  EFI_TEXT_SET_ATTRIBUTE        SetAttribute;
+
+  EFI_TEXT_CLEAR_SCREEN         ClearScreen;
+  EFI_TEXT_SET_CURSOR_POSITION  SetCursorPosition;
+  EFI_TEXT_ENABLE_CURSOR        EnableCursor;
+
+  ///
+  /// Pointer to SIMPLE_TEXT_OUTPUT_MODE data.
+  ///
+  EFI_SIMPLE_TEXT_OUTPUT_MODE   *Mode;
+};
+
+extern EFI_GUID gEfiSimpleTextOutProtocolGuid;
+
+#endif
diff --git a/src/include/ipxe/efi/Uefi.h b/src/include/ipxe/efi/Uefi.h
new file mode 100644
index 0000000..1e62d2a
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi.h
@@ -0,0 +1,27 @@
+/** @file
+
+  Root include file for Mde Package UEFI, UEFI_APPLICATION type modules.
+
+  This is the include file for any module of type UEFI and UEFI_APPLICATION. Uefi modules only use
+  types defined via this include file and can be ported easily to any
+  environment.
+
+Copyright (c) 2006 - 2007, Intel Corporation
+All rights reserved. This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PI_UEFI_H__
+#define __PI_UEFI_H__
+
+#include <ipxe/efi/Uefi/UefiBaseType.h>
+#include <ipxe/efi/Uefi/UefiSpec.h>
+
+#endif
+
diff --git a/src/include/ipxe/efi/Uefi/UefiBaseType.h b/src/include/ipxe/efi/Uefi/UefiBaseType.h
new file mode 100644
index 0000000..e7d964d
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi/UefiBaseType.h
@@ -0,0 +1,200 @@
+/** @file
+  Defines data types and constants introduced in UEFI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __UEFI_BASETYPE_H__
+#define __UEFI_BASETYPE_H__
+
+#include <ipxe/efi/Base.h>
+
+//
+// Basical data type definitions introduced in UEFI.
+//
+
+///
+/// 128-bit buffer containing a unique identifier value.
+///
+typedef GUID                      EFI_GUID;
+///
+/// Function return status for EFI API
+///
+typedef RETURN_STATUS             EFI_STATUS;
+///
+/// A collection of related interfaces.
+///
+typedef VOID                      *EFI_HANDLE;
+///
+/// Handle to an event structure.
+///
+typedef VOID                      *EFI_EVENT;
+///
+/// Task priority level.
+///
+typedef UINTN                     EFI_TPL;
+///
+/// Logical block address.
+///
+typedef UINT64                    EFI_LBA;
+typedef UINT64                    EFI_PHYSICAL_ADDRESS;
+typedef UINT64                    EFI_VIRTUAL_ADDRESS;
+
+///
+/// EFI Time Abstraction:
+///  Year:       1998 - 20XX
+///  Month:      1 - 12
+///  Day:        1 - 31
+///  Hour:       0 - 23
+///  Minute:     0 - 59
+///  Second:     0 - 59
+///  Nanosecond: 0 - 999,999,999
+///  TimeZone:   -1440 to 1440 or 2047
+///
+typedef struct {
+  UINT16  Year;
+  UINT8   Month;
+  UINT8   Day;
+  UINT8   Hour;
+  UINT8   Minute;
+  UINT8   Second;
+  UINT8   Pad1;
+  UINT32  Nanosecond;
+  INT16   TimeZone;
+  UINT8   Daylight;
+  UINT8   Pad2;
+} EFI_TIME;
+
+
+///
+/// 4-byte buffer. An IPv4 internet protocol address.
+///
+typedef struct {
+  UINT8 Addr[4];
+} EFI_IPv4_ADDRESS;
+
+///
+/// 16-byte buffer. An IPv6 internet protocol address
+///
+typedef struct {
+  UINT8 Addr[16];
+} EFI_IPv6_ADDRESS;
+
+///
+/// 32-byte buffer containing a network Media Access Control address.
+///
+typedef struct {
+  UINT8 Addr[32];
+} EFI_MAC_ADDRESS;
+
+///
+/// 16-byte buffer aligned on a 4-byte boundary.
+/// An IPv4 or IPv6 internet protocol address.
+///
+typedef union {
+  UINT32            Addr[4];
+  EFI_IPv4_ADDRESS  v4;
+  EFI_IPv6_ADDRESS  v6;
+} EFI_IP_ADDRESS;
+
+
+//
+// Enumeration of EFI_STATUS.
+//
+#define EFI_SUCCESS               RETURN_SUCCESS
+#define EFI_LOAD_ERROR            RETURN_LOAD_ERROR
+#define EFI_INVALID_PARAMETER     RETURN_INVALID_PARAMETER
+#define EFI_UNSUPPORTED           RETURN_UNSUPPORTED
+#define EFI_BAD_BUFFER_SIZE       RETURN_BAD_BUFFER_SIZE
+#define EFI_BUFFER_TOO_SMALL      RETURN_BUFFER_TOO_SMALL
+#define EFI_NOT_READY             RETURN_NOT_READY
+#define EFI_DEVICE_ERROR          RETURN_DEVICE_ERROR
+#define EFI_WRITE_PROTECTED       RETURN_WRITE_PROTECTED
+#define EFI_OUT_OF_RESOURCES      RETURN_OUT_OF_RESOURCES
+#define EFI_VOLUME_CORRUPTED      RETURN_VOLUME_CORRUPTED
+#define EFI_VOLUME_FULL           RETURN_VOLUME_FULL
+#define EFI_NO_MEDIA              RETURN_NO_MEDIA
+#define EFI_MEDIA_CHANGED         RETURN_MEDIA_CHANGED
+#define EFI_NOT_FOUND             RETURN_NOT_FOUND
+#define EFI_ACCESS_DENIED         RETURN_ACCESS_DENIED
+#define EFI_NO_RESPONSE           RETURN_NO_RESPONSE
+#define EFI_NO_MAPPING            RETURN_NO_MAPPING
+#define EFI_TIMEOUT               RETURN_TIMEOUT
+#define EFI_NOT_STARTED           RETURN_NOT_STARTED
+#define EFI_ALREADY_STARTED       RETURN_ALREADY_STARTED
+#define EFI_ABORTED               RETURN_ABORTED
+#define EFI_ICMP_ERROR            RETURN_ICMP_ERROR
+#define EFI_TFTP_ERROR            RETURN_TFTP_ERROR
+#define EFI_PROTOCOL_ERROR        RETURN_PROTOCOL_ERROR
+#define EFI_INCOMPATIBLE_VERSION  RETURN_INCOMPATIBLE_VERSION
+#define EFI_SECURITY_VIOLATION    RETURN_SECURITY_VIOLATION
+#define EFI_CRC_ERROR             RETURN_CRC_ERROR
+#define EFI_END_OF_MEDIA          RETURN_END_OF_MEDIA
+#define EFI_END_OF_FILE           RETURN_END_OF_FILE
+#define EFI_INVALID_LANGUAGE      RETURN_INVALID_LANGUAGE
+
+#define EFI_WARN_UNKNOWN_GLYPH    RETURN_WARN_UNKNOWN_GLYPH
+#define EFI_WARN_DELETE_FAILURE   RETURN_WARN_DELETE_FAILURE
+#define EFI_WARN_WRITE_FAILURE    RETURN_WARN_WRITE_FAILURE
+#define EFI_WARN_BUFFER_TOO_SMALL RETURN_WARN_BUFFER_TOO_SMALL
+
+
+//
+// Define macro to encode the status code.
+//
+#define EFIERR(_a)                ENCODE_ERROR(_a)
+
+#define EFI_ERROR(A)              RETURN_ERROR(A)
+
+//
+// Define macros to build data structure signatures from characters.
+//
+#define EFI_SIGNATURE_16(A, B)                    SIGNATURE_16 (A, B)
+#define EFI_SIGNATURE_32(A, B, C, D)              SIGNATURE_32 (A, B, C, D)
+#define EFI_SIGNATURE_64(A, B, C, D, E, F, G, H)  SIGNATURE_64 (A, B, C, D, E, F, G, H)
+
+
+///
+///  Returns the byte offset to a field within a structure
+///
+#define EFI_FIELD_OFFSET(TYPE,Field) ((UINTN)(&(((TYPE *) 0)->Field)))
+
+//
+// The EFI memory allocation functions work in units of EFI_PAGEs that are
+// 4K. This should in no way be confused with the page size of the processor.
+// An EFI_PAGE is just the quanta of memory in EFI.
+//
+#define EFI_PAGE_SIZE             0x1000
+#define EFI_PAGE_MASK             0xFFF
+#define EFI_PAGE_SHIFT            12
+
+#define EFI_SIZE_TO_PAGES(a)  (((a) >> EFI_PAGE_SHIFT) + (((a) & EFI_PAGE_MASK) ? 1 : 0))
+
+#define EFI_PAGES_TO_SIZE(a)   ( (a) << EFI_PAGE_SHIFT)
+
+
+#define EFI_MAX_BIT               MAX_BIT
+#define EFI_MAX_ADDRESS           MAX_ADDRESS
+
+
+///
+/// Limited buffer size for a language code recommended by RFC3066
+/// (42 characters plus a NULL terminator)
+///
+#define RFC_3066_ENTRY_SIZE             (42 + 1)
+
+///
+/// The size of a 3 character ISO639 language code.
+///
+#define ISO_639_2_ENTRY_SIZE            3
+
+
+#endif
diff --git a/src/include/ipxe/efi/Uefi/UefiGpt.h b/src/include/ipxe/efi/Uefi/UefiGpt.h
new file mode 100644
index 0000000..92c3035
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi/UefiGpt.h
@@ -0,0 +1,62 @@
+/** @file
+  EFI Guid Partition Table Format Definition.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __UEFI_GPT_H__
+#define __UEFI_GPT_H__
+
+///
+/// The primary GUID Partition Table Header must be
+/// located in LBA 1 (i.e., the second logical block).
+///
+#define PRIMARY_PART_HEADER_LBA 1
+
+///
+/// EFI Partition Table Signature: "EFI PART"
+///
+#define EFI_PTAB_HEADER_ID      0x5452415020494645ULL
+
+#pragma pack(1)
+
+///
+/// GPT Partition Table Header
+///
+typedef struct {
+  EFI_TABLE_HEADER  Header;
+  EFI_LBA           MyLBA;
+  EFI_LBA           AlternateLBA;
+  EFI_LBA           FirstUsableLBA;
+  EFI_LBA           LastUsableLBA;
+  EFI_GUID          DiskGUID;
+  EFI_LBA           PartitionEntryLBA;
+  UINT32            NumberOfPartitionEntries;
+  UINT32            SizeOfPartitionEntry;
+  UINT32            PartitionEntryArrayCRC32;
+} EFI_PARTITION_TABLE_HEADER;
+
+///
+/// GPT Partition Entry
+///
+typedef struct {
+  EFI_GUID  PartitionTypeGUID;
+  EFI_GUID  UniquePartitionGUID;
+  EFI_LBA   StartingLBA;
+  EFI_LBA   EndingLBA;
+  UINT64    Attributes;
+  CHAR16    PartitionName[36];
+} EFI_PARTITION_ENTRY;
+
+#pragma pack()
+#endif
+
+
diff --git a/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h b/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h
new file mode 100644
index 0000000..c675517
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h
@@ -0,0 +1,1590 @@
+/** @file
+  This file defines the encoding for the VFR (Visual Form Representation) language.
+  IFR is primarily consumed by the EFI presentation engine, and produced by EFI
+  internal application and drivers as well as all add-in card option-ROM drivers
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  These definitions are from UEFI2.1.
+
+**/
+
+#ifndef __UEFI_INTERNAL_FORMREPRESENTATION_H__
+#define __UEFI_INTERNAL_FORMREPRESENTATION_H__
+
+///
+/// The following types are currently defined:
+///
+typedef VOID*   EFI_HII_HANDLE;
+typedef CHAR16* EFI_STRING;
+typedef UINT16  EFI_IMAGE_ID;
+typedef UINT16  EFI_QUESTION_ID;
+typedef UINT16  EFI_STRING_ID;
+typedef UINT16  EFI_FORM_ID;
+typedef UINT16  EFI_VARSTORE_ID;
+
+typedef UINT16  EFI_DEFAULT_ID;
+
+typedef UINT32  EFI_HII_FONT_STYLE;
+
+
+
+#pragma pack(1)
+
+//
+// Definitions for Package Lists and Package Headers
+// Section 27.3.1
+//
+
+///
+/// The header found at the start of each package list.
+///
+typedef struct {
+  EFI_GUID               PackageListGuid;
+  UINT32                 PackageLength;
+} EFI_HII_PACKAGE_LIST_HEADER;
+
+///
+/// The header found at the start of each package.
+///
+typedef struct {
+  UINT32  Length:24;
+  UINT32  Type:8;
+  // UINT8  Data[...];
+} EFI_HII_PACKAGE_HEADER;
+
+//
+// Value of HII package type
+//
+#define EFI_HII_PACKAGE_TYPE_ALL             0x00
+#define EFI_HII_PACKAGE_TYPE_GUID            0x01
+#define EFI_HII_PACKAGE_FORMS                0x02
+#define EFI_HII_PACKAGE_STRINGS              0x04
+#define EFI_HII_PACKAGE_FONTS                0x05
+#define EFI_HII_PACKAGE_IMAGES               0x06
+#define EFI_HII_PACKAGE_SIMPLE_FONTS         0x07
+#define EFI_HII_PACKAGE_DEVICE_PATH          0x08
+#define EFI_HII_PACKAGE_KEYBOARD_LAYOUT      0x09
+#define EFI_HII_PACKAGE_END                  0xDF
+#define EFI_HII_PACKAGE_TYPE_SYSTEM_BEGIN    0xE0
+#define EFI_HII_PACKAGE_TYPE_SYSTEM_END      0xFF
+
+//
+// Definitions for Simplified Font Package
+// Section 27.3.2
+//
+
+//
+// Contents of EFI_NARROW_GLYPH.Attributes
+//
+#define EFI_GLYPH_NON_SPACING                0x01
+#define EFI_GLYPH_WIDE                       0x02
+#define EFI_GLYPH_HEIGHT                     19
+#define EFI_GLYPH_WIDTH                      8
+
+typedef struct {
+  CHAR16                 UnicodeWeight;
+  UINT8                  Attributes;
+  UINT8                  GlyphCol1[EFI_GLYPH_HEIGHT];
+} EFI_NARROW_GLYPH;
+
+typedef struct {
+  CHAR16                 UnicodeWeight;
+  UINT8                  Attributes;
+  UINT8                  GlyphCol1[EFI_GLYPH_HEIGHT];
+  UINT8                  GlyphCol2[EFI_GLYPH_HEIGHT];
+  UINT8                  Pad[3];
+} EFI_WIDE_GLYPH;
+
+///
+/// A simplified font package consists of a font header
+/// followed by a series of glyph structures.
+///
+typedef struct _EFI_HII_SIMPLE_FONT_PACKAGE_HDR {
+  EFI_HII_PACKAGE_HEADER Header;
+  UINT16                 NumberOfNarrowGlyphs;
+  UINT16                 NumberOfWideGlyphs;
+  // EFI_NARROW_GLYPH       NarrowGlyphs[];
+  // EFI_WIDE_GLYPH         WideGlyphs[];
+} EFI_HII_SIMPLE_FONT_PACKAGE_HDR;
+
+//
+// Definitions for Font Package
+// Section 27.3.3
+//
+
+//
+// Value for font style
+//
+#define EFI_HII_FONT_STYLE_NORMAL            0x00000000
+#define EFI_HII_FONT_STYLE_BOLD              0x00000001
+#define EFI_HII_FONT_STYLE_ITALIC            0x00000002
+#define EFI_HII_FONT_STYLE_EMBOSS            0x00010000
+#define EFI_HII_FONT_STYLE_OUTLINE           0x00020000
+#define EFI_HII_FONT_STYLE_SHADOW            0x00040000
+#define EFI_HII_FONT_STYLE_UNDERLINE         0x00080000
+#define EFI_HII_FONT_STYLE_DBL_UNDER         0x00100000
+
+typedef struct _EFI_HII_GLYPH_INFO {
+  UINT16                 Width;
+  UINT16                 Height;
+  INT16                  OffsetX;
+  INT16                  OffsetY;
+  INT16                  AdvanceX;
+} EFI_HII_GLYPH_INFO;
+
+///
+/// The fixed header consists of a standard record header and
+/// then the character values in this section, the flags
+/// (including the encoding method) and the offsets of the glyph
+/// information, the glyph bitmaps and the character map.
+///
+typedef struct _EFI_HII_FONT_PACKAGE_HDR {
+  EFI_HII_PACKAGE_HEADER Header;
+  UINT32                 HdrSize;
+  UINT32                 GlyphBlockOffset;
+  EFI_HII_GLYPH_INFO     Cell;
+  EFI_HII_FONT_STYLE     FontStyle;
+  CHAR16                 FontFamily[1];
+} EFI_HII_FONT_PACKAGE_HDR;
+
+//
+// Value of different glyph info block types
+//
+#define EFI_HII_GIBT_END                  0x00
+#define EFI_HII_GIBT_GLYPH                0x10
+#define EFI_HII_GIBT_GLYPHS               0x11
+#define EFI_HII_GIBT_GLYPH_DEFAULT        0x12
+#define EFI_HII_GIBT_GLYPHS_DEFAULT       0x13
+#define EFI_HII_GIBT_DUPLICATE            0x20
+#define EFI_HII_GIBT_SKIP2                0x21
+#define EFI_HII_GIBT_SKIP1                0x22
+#define EFI_HII_GIBT_DEFAULTS             0x23
+#define EFI_HII_GIBT_EXT1                 0x30
+#define EFI_HII_GIBT_EXT2                 0x31
+#define EFI_HII_GIBT_EXT4                 0x32
+
+typedef struct _EFI_HII_GLYPH_BLOCK {
+  UINT8                  BlockType;
+} EFI_HII_GLYPH_BLOCK;
+
+//
+// Definition of different glyph info block types
+//
+
+typedef struct _EFI_HII_GIBT_DEFAULTS_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  EFI_HII_GLYPH_INFO     Cell;
+} EFI_HII_GIBT_DEFAULTS_BLOCK;
+
+typedef struct _EFI_HII_GIBT_DUPLICATE_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  CHAR16                 CharValue;
+} EFI_HII_GIBT_DUPLICATE_BLOCK;
+
+typedef struct _EFI_GLYPH_GIBT_END_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+} EFI_GLYPH_GIBT_END_BLOCK;
+
+typedef struct _EFI_HII_GIBT_EXT1_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT8                  BlockType2;
+  UINT8                  Length;
+} EFI_HII_GIBT_EXT1_BLOCK;
+
+typedef struct _EFI_HII_GIBT_EXT2_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT8                  BlockType2;
+  UINT16                 Length;
+} EFI_HII_GIBT_EXT2_BLOCK;
+
+typedef struct _EFI_HII_GIBT_EXT4_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT8                  BlockType2;
+  UINT32                 Length;
+} EFI_HII_GIBT_EXT4_BLOCK;
+
+typedef struct _EFI_HII_GIBT_GLYPH_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  EFI_HII_GLYPH_INFO     Cell;
+  UINT8                  BitmapData[1];
+} EFI_HII_GIBT_GLYPH_BLOCK;
+
+typedef struct _EFI_HII_GIBT_GLYPHS_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  EFI_HII_GLYPH_INFO     Cell;
+  UINT16                 Count;
+  UINT8                  BitmapData[1];
+} EFI_HII_GIBT_GLYPHS_BLOCK;
+
+typedef struct _EFI_HII_GIBT_GLYPH_DEFAULT_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT8                  BitmapData[1];
+} EFI_HII_GIBT_GLYPH_DEFAULT_BLOCK;
+
+typedef struct _EFI_HII_GIBT_GLYPHS_DEFAULT_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT16                 Count;
+  UINT8                  BitmapData[1];
+} EFI_HII_GIBT_GLYPHS_DEFAULT_BLOCK;
+
+typedef struct _EFI_HII_GIBT_SKIP1_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT8                  SkipCount;
+} EFI_HII_GIBT_SKIP1_BLOCK;
+
+typedef struct _EFI_HII_GIBT_SKIP2_BLOCK {
+  EFI_HII_GLYPH_BLOCK    Header;
+  UINT16                 SkipCount;
+} EFI_HII_GIBT_SKIP2_BLOCK;
+
+//
+// Definitions for Device Path Package
+// Section 27.3.4
+//
+
+///
+/// The device path package is used to carry a device path
+/// associated with the package list.
+///
+typedef struct _EFI_HII_DEVICE_PATH_PACKAGE {
+  EFI_HII_PACKAGE_HEADER   Header;
+  // EFI_DEVICE_PATH_PROTOCOL DevicePath[];
+} EFI_HII_DEVICE_PATH_PACKAGE;
+
+//
+// Definitions for GUID Package
+// Section 27.3.5
+//
+
+///
+/// The GUID package is used to carry data where the format is defined by a GUID.
+///
+typedef struct _EFI_HII_GUID_PACKAGE_HDR {
+  EFI_HII_PACKAGE_HEADER  Header;
+  EFI_GUID                Guid;
+  // Data per GUID definition may follow
+} EFI_HII_GUID_PACKAGE_HDR;
+
+//
+// Definitions for String Package
+// Section 27.3.6
+//
+
+#define UEFI_CONFIG_LANG  L"x-UEFI"
+#define UEFI_CONFIG_LANG2 L"x-i-UEFI"
+
+///
+/// The fixed header consists of a standard record header and then the string identifiers
+/// contained in this section and the offsets of the string and language information.
+///
+typedef struct _EFI_HII_STRING_PACKAGE_HDR {
+  EFI_HII_PACKAGE_HEADER  Header;
+  UINT32                  HdrSize;
+  UINT32                  StringInfoOffset;
+  CHAR16                  LanguageWindow[16];
+  EFI_STRING_ID           LanguageName;
+  CHAR8                   Language[1];
+} EFI_HII_STRING_PACKAGE_HDR;
+
+typedef struct {
+  UINT8                   BlockType;
+} EFI_HII_STRING_BLOCK;
+
+//
+// Value of different string information block types
+//
+#define EFI_HII_SIBT_END                     0x00
+#define EFI_HII_SIBT_STRING_SCSU             0x10
+#define EFI_HII_SIBT_STRING_SCSU_FONT        0x11
+#define EFI_HII_SIBT_STRINGS_SCSU            0x12
+#define EFI_HII_SIBT_STRINGS_SCSU_FONT       0x13
+#define EFI_HII_SIBT_STRING_UCS2             0x14
+#define EFI_HII_SIBT_STRING_UCS2_FONT        0x15
+#define EFI_HII_SIBT_STRINGS_UCS2            0x16
+#define EFI_HII_SIBT_STRINGS_UCS2_FONT       0x17
+#define EFI_HII_SIBT_DUPLICATE               0x20
+#define EFI_HII_SIBT_SKIP2                   0x21
+#define EFI_HII_SIBT_SKIP1                   0x22
+#define EFI_HII_SIBT_EXT1                    0x30
+#define EFI_HII_SIBT_EXT2                    0x31
+#define EFI_HII_SIBT_EXT4                    0x32
+#define EFI_HII_SIBT_FONT                    0x40
+
+//
+// Definition of different string information block types
+//
+
+typedef struct _EFI_HII_SIBT_DUPLICATE_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  EFI_STRING_ID           StringId;
+} EFI_HII_SIBT_DUPLICATE_BLOCK;
+
+typedef struct _EFI_HII_SIBT_END_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+} EFI_HII_SIBT_END_BLOCK;
+
+typedef struct _EFI_HII_SIBT_EXT1_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   BlockType2;
+  UINT8                   Length;
+} EFI_HII_SIBT_EXT1_BLOCK;
+
+typedef struct _EFI_HII_SIBT_EXT2_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   BlockType2;
+  UINT16                  Length;
+} EFI_HII_SIBT_EXT2_BLOCK;
+
+typedef struct _EFI_HII_SIBT_EXT4_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   BlockType2;
+  UINT32                  Length;
+} EFI_HII_SIBT_EXT4_BLOCK;
+
+typedef struct _EFI_HII_SIBT_FONT_BLOCK {
+  EFI_HII_SIBT_EXT2_BLOCK Header;
+  UINT8                   FontId;
+  UINT16                  FontSize;
+  EFI_HII_FONT_STYLE      FontStyle;
+  CHAR16                  FontName[1];
+} EFI_HII_SIBT_FONT_BLOCK;
+
+typedef struct _EFI_HII_SIBT_SKIP1_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   SkipCount;
+} EFI_HII_SIBT_SKIP1_BLOCK;
+
+typedef struct _EFI_HII_SIBT_SKIP2_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT16                  SkipCount;
+} EFI_HII_SIBT_SKIP2_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRING_SCSU_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   StringText[1];
+} EFI_HII_SIBT_STRING_SCSU_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRING_SCSU_FONT_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   FontIdentifier;
+  UINT8                   StringText[1];
+} EFI_HII_SIBT_STRING_SCSU_FONT_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRINGS_SCSU_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT16                  StringCount;
+  UINT8                   StringText[1];
+} EFI_HII_SIBT_STRINGS_SCSU_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRINGS_SCSU_FONT_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   FontIdentifier;
+  UINT16                  StringCount;
+  UINT8                   StringText[1];
+} EFI_HII_SIBT_STRINGS_SCSU_FONT_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRING_UCS2_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  CHAR16                  StringText[1];
+} EFI_HII_SIBT_STRING_UCS2_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRING_UCS2_FONT_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   FontIdentifier;
+  CHAR16                  StringText[1];
+} EFI_HII_SIBT_STRING_UCS2_FONT_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRINGS_UCS2_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT16                  StringCount;
+  CHAR16                  StringText[1];
+} EFI_HII_SIBT_STRINGS_UCS2_BLOCK;
+
+typedef struct _EFI_HII_SIBT_STRINGS_UCS2_FONT_BLOCK {
+  EFI_HII_STRING_BLOCK    Header;
+  UINT8                   FontIdentifier;
+  UINT16                  StringCount;
+  CHAR16                  StringText[1];
+} EFI_HII_SIBT_STRINGS_UCS2_FONT_BLOCK;
+
+//
+// Definitions for Image Package
+// Section 27.3.7
+//
+
+typedef struct _EFI_HII_IMAGE_PACKAGE_HDR {
+  EFI_HII_PACKAGE_HEADER  Header;
+  UINT32                  ImageInfoOffset;
+  UINT32                  PaletteInfoOffset;
+} EFI_HII_IMAGE_PACKAGE_HDR;
+
+typedef struct _EFI_HII_IMAGE_BLOCK {
+  UINT8                   BlockType;
+} EFI_HII_IMAGE_BLOCK;
+
+//
+// Value of different image information block types
+//
+#define EFI_HII_IIBT_END               0x00
+#define EFI_HII_IIBT_IMAGE_1BIT        0x10
+#define EFI_HII_IIBT_IMAGE_1BIT_TRANS  0x11
+#define EFI_HII_IIBT_IMAGE_4BIT        0x12
+#define EFI_HII_IIBT_IMAGE_4BIT_TRANS  0x13
+#define EFI_HII_IIBT_IMAGE_8BIT        0x14
+#define EFI_HII_IIBT_IMAGE_8BIT_TRANS  0x15
+#define EFI_HII_IIBT_IMAGE_24BIT       0x16
+#define EFI_HII_IIBT_IMAGE_24BIT_TRANS 0x17
+#define EFI_HII_IIBT_IMAGE_JPEG        0x18
+#define EFI_HII_IIBT_DUPLICATE         0x20
+#define EFI_HII_IIBT_SKIP2             0x21
+#define EFI_HII_IIBT_SKIP1             0x22
+#define EFI_HII_IIBT_EXT1              0x30
+#define EFI_HII_IIBT_EXT2              0x31
+#define EFI_HII_IIBT_EXT4              0x32
+
+//
+// Definition of different image information block types
+//
+
+typedef struct _EFI_HII_IIBT_END_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+} EFI_HII_IIBT_END_BLOCK;
+
+typedef struct _EFI_HII_IIBT_EXT1_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        BlockType2;
+  UINT8                        Length;
+} EFI_HII_IIBT_EXT1_BLOCK;
+
+typedef struct _EFI_HII_IIBT_EXT2_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        BlockType2;
+  UINT16                       Length;
+} EFI_HII_IIBT_EXT2_BLOCK;
+
+typedef struct _EFI_HII_IIBT_EXT4_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        BlockType2;
+  UINT32                       Length;
+} EFI_HII_IIBT_EXT4_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_1BIT_BASE {
+  UINT16                       Width;
+  UINT16                       Height;
+  UINT8                        Data[1];
+} EFI_HII_IIBT_IMAGE_1BIT_BASE;
+
+typedef struct _EFI_HII_IIBT_IMAGE_1BIT_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        PaletteIndex;
+  EFI_HII_IIBT_IMAGE_1BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_1BIT_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_1BIT_TRANS_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        PaletteIndex;
+  EFI_HII_IIBT_IMAGE_1BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_1BIT_TRANS_BLOCK;
+
+typedef struct _EFI_HII_RGB_PIXEL {
+  UINT8                        b;
+  UINT8                        g;
+  UINT8                        r;
+} EFI_HII_RGB_PIXEL;
+
+typedef struct _EFI_HII_IIBT_IMAGE_24BIT_BASE {
+  UINT16                       Width;
+  UINT16                       Height;
+  EFI_HII_RGB_PIXEL            Bitmap[1];
+} EFI_HII_IIBT_IMAGE_24BIT_BASE;
+
+typedef struct _EFI_HII_IIBT_IMAGE_24BIT_BLOCK {
+  EFI_HII_IMAGE_BLOCK           Header;
+  EFI_HII_IIBT_IMAGE_24BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_24BIT_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_24BIT_TRANS_BLOCK {
+  EFI_HII_IMAGE_BLOCK           Header;
+  EFI_HII_IIBT_IMAGE_24BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_24BIT_TRANS_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_4BIT_BASE {
+  UINT16                       Width;
+  UINT16                       Height;
+  UINT8                        Data[1];
+} EFI_HII_IIBT_IMAGE_4BIT_BASE;
+
+typedef struct _EFI_HII_IIBT_IMAGE_4BIT_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        PaletteIndex;
+  EFI_HII_IIBT_IMAGE_4BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_4BIT_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_4BIT_TRANS_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        PaletteIndex;
+  EFI_HII_IIBT_IMAGE_4BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_4BIT_TRANS_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_8BIT_BASE {
+  UINT16                       Width;
+  UINT16                       Height;
+  UINT8                        Data[1];
+} EFI_HII_IIBT_IMAGE_8BIT_BASE;
+
+typedef struct _EFI_HII_IIBT_IMAGE_8BIT_PALETTE_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        PaletteIndex;
+  EFI_HII_IIBT_IMAGE_8BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_8BIT_BLOCK;
+
+typedef struct _EFI_HII_IIBT_IMAGE_8BIT_TRANS_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        PaletteIndex;
+  EFI_HII_IIBT_IMAGE_8BIT_BASE Bitmap;
+} EFI_HII_IIBT_IMAGE_8BIT_TRAN_BLOCK;
+
+typedef struct _EFI_HII_IIBT_DUPLICATE_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  EFI_IMAGE_ID                 ImageId;
+} EFI_HII_IIBT_DUPLICATE_BLOCK;
+
+typedef struct _EFI_HII_IIBT_JPEG_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT32                       Size;
+  UINT8                        Data[1];
+} EFI_HII_IIBT_JPEG_BLOCK;
+
+typedef struct _EFI_HII_IIBT_SKIP1_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT8                        SkipCount;
+} EFI_HII_IIBT_SKIP1_BLOCK;
+
+typedef struct _EFI_HII_IIBT_SKIP2_BLOCK {
+  EFI_HII_IMAGE_BLOCK          Header;
+  UINT16                       SkipCount;
+} EFI_HII_IIBT_SKIP2_BLOCK;
+
+//
+// Definitions for Palette Information
+//
+
+typedef struct _EFI_HII_IMAGE_PALETTE_INFO_HEADER {
+  UINT16                       PaletteCount;
+} EFI_HII_IMAGE_PALETTE_INFO_HEADER;
+
+typedef struct _EFI_HII_IMAGE_PALETTE_INFO {
+  UINT16                       PaletteSize;
+  EFI_HII_RGB_PIXEL            PaletteValue[1];
+} EFI_HII_IMAGE_PALETTE_INFO;
+
+//
+// Definitions for Forms Package
+// Section 27.3.8
+//
+
+///
+/// The Forms package is used to carry forms-based encoding data.
+///
+typedef struct _EFI_HII_FORM_PACKAGE {
+  EFI_HII_PACKAGE_HEADER       Header;
+  // EFI_IFR_OP_HEADER         OpCodeHeader;
+  // More op-codes follow
+} EFI_HII_FORM_PACKAGE;
+
+typedef struct {
+  UINT8 Hour;
+  UINT8 Minute;
+  UINT8 Second;
+} EFI_HII_TIME;
+
+typedef struct {
+  UINT16 Year;
+  UINT8  Month;
+  UINT8  Day;
+} EFI_HII_DATE;
+
+typedef union {
+  UINT8           u8;
+  UINT16          u16;
+  UINT32          u32;
+  UINT64          u64;
+  BOOLEAN         b;
+  EFI_HII_TIME    time;
+  EFI_HII_DATE    date;
+  EFI_STRING_ID   string;
+} EFI_IFR_TYPE_VALUE;
+
+//
+// IFR Opcodes
+//
+#define EFI_IFR_FORM_OP                0x01
+#define EFI_IFR_SUBTITLE_OP            0x02
+#define EFI_IFR_TEXT_OP                0x03
+#define EFI_IFR_IMAGE_OP               0x04
+#define EFI_IFR_ONE_OF_OP              0x05
+#define EFI_IFR_CHECKBOX_OP            0x06
+#define EFI_IFR_NUMERIC_OP             0x07
+#define EFI_IFR_PASSWORD_OP            0x08
+#define EFI_IFR_ONE_OF_OPTION_OP       0x09
+#define EFI_IFR_SUPPRESS_IF_OP         0x0A
+#define EFI_IFR_LOCKED_OP              0x0B
+#define EFI_IFR_ACTION_OP              0x0C
+#define EFI_IFR_RESET_BUTTON_OP        0x0D
+#define EFI_IFR_FORM_SET_OP            0x0E
+#define EFI_IFR_REF_OP                 0x0F
+#define EFI_IFR_NO_SUBMIT_IF_OP        0x10
+#define EFI_IFR_INCONSISTENT_IF_OP     0x11
+#define EFI_IFR_EQ_ID_VAL_OP           0x12
+#define EFI_IFR_EQ_ID_ID_OP            0x13
+#define EFI_IFR_EQ_ID_LIST_OP          0x14
+#define EFI_IFR_AND_OP                 0x15
+#define EFI_IFR_OR_OP                  0x16
+#define EFI_IFR_NOT_OP                 0x17
+#define EFI_IFR_RULE_OP                0x18
+#define EFI_IFR_GRAY_OUT_IF_OP         0x19
+#define EFI_IFR_DATE_OP                0x1A
+#define EFI_IFR_TIME_OP                0x1B
+#define EFI_IFR_STRING_OP              0x1C
+#define EFI_IFR_REFRESH_OP             0x1D
+#define EFI_IFR_DISABLE_IF_OP          0x1E
+#define EFI_IFR_TO_LOWER_OP            0x20
+#define EFI_IFR_TO_UPPER_OP            0x21
+#define EFI_IFR_ORDERED_LIST_OP        0x23
+#define EFI_IFR_VARSTORE_OP            0x24
+#define EFI_IFR_VARSTORE_NAME_VALUE_OP 0x25
+#define EFI_IFR_VARSTORE_EFI_OP        0x26
+#define EFI_IFR_VARSTORE_DEVICE_OP     0x27
+#define EFI_IFR_VERSION_OP             0x28
+#define EFI_IFR_END_OP                 0x29
+#define EFI_IFR_MATCH_OP               0x2A
+#define EFI_IFR_EQUAL_OP               0x2F
+#define EFI_IFR_NOT_EQUAL_OP           0x30
+#define EFI_IFR_GREATER_THAN_OP        0x31
+#define EFI_IFR_GREATER_EQUAL_OP       0x32
+#define EFI_IFR_LESS_THAN_OP           0x33
+#define EFI_IFR_LESS_EQUAL_OP          0x34
+#define EFI_IFR_BITWISE_AND_OP         0x35
+#define EFI_IFR_BITWISE_OR_OP          0x36
+#define EFI_IFR_BITWISE_NOT_OP         0x37
+#define EFI_IFR_SHIFT_LEFT_OP          0x38
+#define EFI_IFR_SHIFT_RIGHT_OP         0x39
+#define EFI_IFR_ADD_OP                 0x3A
+#define EFI_IFR_SUBTRACT_OP            0x3B
+#define EFI_IFR_MULTIPLY_OP            0x3C
+#define EFI_IFR_DIVIDE_OP              0x3D
+#define EFI_IFR_MODULO_OP              0x3E
+#define EFI_IFR_RULE_REF_OP            0x3F
+#define EFI_IFR_QUESTION_REF1_OP       0x40
+#define EFI_IFR_QUESTION_REF2_OP       0x41
+#define EFI_IFR_UINT8_OP               0x42
+#define EFI_IFR_UINT16_OP              0x43
+#define EFI_IFR_UINT32_OP              0x44
+#define EFI_IFR_UINT64_OP              0x45
+#define EFI_IFR_TRUE_OP                0x46
+#define EFI_IFR_FALSE_OP               0x47
+#define EFI_IFR_TO_UINT_OP             0x48
+#define EFI_IFR_TO_STRING_OP           0x49
+#define EFI_IFR_TO_BOOLEAN_OP          0x4A
+#define EFI_IFR_MID_OP                 0x4B
+#define EFI_IFR_FIND_OP                0x4C
+#define EFI_IFR_TOKEN_OP               0x4D
+#define EFI_IFR_STRING_REF1_OP         0x4E
+#define EFI_IFR_STRING_REF2_OP         0x4F
+#define EFI_IFR_CONDITIONAL_OP         0x50
+#define EFI_IFR_QUESTION_REF3_OP       0x51
+#define EFI_IFR_ZERO_OP                0x52
+#define EFI_IFR_ONE_OP                 0x53
+#define EFI_IFR_ONES_OP                0x54
+#define EFI_IFR_UNDEFINED_OP           0x55
+#define EFI_IFR_LENGTH_OP              0x56
+#define EFI_IFR_DUP_OP                 0x57
+#define EFI_IFR_THIS_OP                0x58
+#define EFI_IFR_SPAN_OP                0x59
+#define EFI_IFR_VALUE_OP               0x5A
+#define EFI_IFR_DEFAULT_OP             0x5B
+#define EFI_IFR_DEFAULTSTORE_OP        0x5C
+#define EFI_IFR_CATENATE_OP            0x5E
+#define EFI_IFR_GUID_OP                0x5F
+
+//
+// Definitions of IFR Standard Headers
+// Section 27.3.8.2
+//
+
+typedef struct _EFI_IFR_OP_HEADER {
+  UINT8                    OpCode;
+  UINT8                    Length:7;
+  UINT8                    Scope:1;
+} EFI_IFR_OP_HEADER;
+
+typedef struct _EFI_IFR_STATEMENT_HEADER {
+  EFI_STRING_ID            Prompt;
+  EFI_STRING_ID            Help;
+} EFI_IFR_STATEMENT_HEADER;
+
+typedef struct _EFI_IFR_QUESTION_HEADER {
+  EFI_IFR_STATEMENT_HEADER Header;
+  EFI_QUESTION_ID          QuestionId;
+  EFI_VARSTORE_ID          VarStoreId;
+  union {
+    EFI_STRING_ID          VarName;
+    UINT16                 VarOffset;
+  }                        VarStoreInfo;
+  UINT8                    Flags;
+} EFI_IFR_QUESTION_HEADER;
+
+//
+// Flag values of EFI_IFR_QUESTION_HEADER
+//
+#define EFI_IFR_FLAG_READ_ONLY         0x01
+#define EFI_IFR_FLAG_CALLBACK          0x04
+#define EFI_IFR_FLAG_RESET_REQUIRED    0x10
+#define EFI_IFR_FLAG_OPTIONS_ONLY      0x80
+
+//
+// Definition for Opcode Reference
+// Section 27.3.8.3
+//
+typedef struct _EFI_IFR_DEFAULTSTORE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            DefaultName;
+  UINT16                   DefaultId;
+} EFI_IFR_DEFAULTSTORE;
+
+//
+// Default Identifier of default store
+//
+#define EFI_HII_DEFAULT_CLASS_STANDARD       0x0000
+#define EFI_HII_DEFAULT_CLASS_MANUFACTURING  0x0001
+#define EFI_HII_DEFAULT_CLASS_SAFE           0x0002
+#define EFI_HII_DEFAULT_CLASS_PLATFORM_BEGIN 0x4000
+#define EFI_HII_DEFAULT_CLASS_PLATFORM_END   0x7fff
+#define EFI_HII_DEFAULT_CLASS_HARDWARE_BEGIN 0x8000
+#define EFI_HII_DEFAULT_CLASS_HARDWARE_END   0xbfff
+#define EFI_HII_DEFAULT_CLASS_FIRMWARE_BEGIN 0xc000
+#define EFI_HII_DEFAULT_CLASS_FIRMWARE_END   0xffff
+
+typedef struct _EFI_IFR_VARSTORE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_GUID                 Guid;
+  EFI_VARSTORE_ID          VarStoreId;
+  UINT16                   Size;
+  UINT8                    Name[1];
+} EFI_IFR_VARSTORE;
+
+typedef struct _EFI_IFR_VARSTORE_EFI {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_VARSTORE_ID          VarStoreId;
+  EFI_GUID                 Guid;
+  UINT32                   Attributes;
+} EFI_IFR_VARSTORE_EFI;
+
+typedef struct _EFI_IFR_VARSTORE_NAME_VALUE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_VARSTORE_ID          VarStoreId;
+  EFI_GUID                 Guid;
+} EFI_IFR_VARSTORE_NAME_VALUE;
+
+typedef struct _EFI_IFR_FORM_SET {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_GUID                 Guid;
+  EFI_STRING_ID            FormSetTitle;
+  EFI_STRING_ID            Help;
+} EFI_IFR_FORM_SET;
+
+typedef struct _EFI_IFR_END {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_END;
+
+typedef struct _EFI_IFR_FORM {
+  EFI_IFR_OP_HEADER        Header;
+  UINT16                   FormId;
+  EFI_STRING_ID            FormTitle;
+} EFI_IFR_FORM;
+
+typedef struct _EFI_IFR_IMAGE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IMAGE_ID             Id;
+} EFI_IFR_IMAGE;
+
+typedef struct _EFI_IFR_LOCKED {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_LOCKED;
+
+typedef struct _EFI_IFR_RULE {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8                    RuleId;
+} EFI_IFR_RULE;
+
+typedef struct _EFI_IFR_DEFAULT {
+  EFI_IFR_OP_HEADER        Header;
+  UINT16                   DefaultId;
+  UINT8                    Type;
+  EFI_IFR_TYPE_VALUE       Value;
+} EFI_IFR_DEFAULT;
+
+typedef struct _EFI_IFR_VALUE {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_VALUE;
+
+typedef struct _EFI_IFR_SUBTITLE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_STATEMENT_HEADER Statement;
+  UINT8                    Flags;
+} EFI_IFR_SUBTITLE;
+
+#define EFI_IFR_FLAGS_HORIZONTAL       0x01
+
+typedef struct _EFI_IFR_CHECKBOX {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    Flags;
+} EFI_IFR_CHECKBOX;
+
+#define EFI_IFR_CHECKBOX_DEFAULT       0x01
+#define EFI_IFR_CHECKBOX_DEFAULT_MFG   0x02
+
+typedef struct _EFI_IFR_TEXT {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_STATEMENT_HEADER Statement;
+  EFI_STRING_ID            TextTwo;
+} EFI_IFR_TEXT;
+
+typedef struct _EFI_IFR_REF {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  EFI_FORM_ID              FormId;
+} EFI_IFR_REF;
+
+typedef struct _EFI_IFR_REF2 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  EFI_FORM_ID              FormId;
+  EFI_QUESTION_ID          QuestionId;
+} EFI_IFR_REF2;
+
+typedef struct _EFI_IFR_REF3 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  EFI_FORM_ID              FormId;
+  EFI_QUESTION_ID          QuestionId;
+  EFI_GUID                 FormSetId;
+} EFI_IFR_REF3;
+
+typedef struct _EFI_IFR_REF4 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  EFI_FORM_ID              FormId;
+  EFI_QUESTION_ID          QuestionId;
+  EFI_GUID                 FormSetId;
+  EFI_STRING_ID            DevicePath;
+} EFI_IFR_REF4;
+
+typedef struct _EFI_IFR_RESET_BUTTON {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  EFI_DEFAULT_ID           DefaultId;
+} EFI_IFR_RESET_BUTTON;
+
+typedef struct _EFI_IFR_ACTION {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  EFI_STRING_ID            QuestionConfig;
+} EFI_IFR_ACTION;
+
+typedef struct _EFI_IFR_ACTION_1 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+} EFI_IFR_ACTION_1;
+
+typedef struct _EFI_IFR_DATE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    Flags;
+} EFI_IFR_DATE;
+
+//
+// Flags that describe the behavior of the question.
+//
+#define EFI_QF_DATE_YEAR_SUPPRESS      0x01
+#define EFI_QF_DATE_MONTH_SUPPRESS     0x02
+#define EFI_QF_DATE_DAY_SUPPRESS       0x04
+
+#define EFI_QF_DATE_STORAGE            0x30
+#define     QF_DATE_STORAGE_NORMAL     0x00
+#define     QF_DATE_STORAGE_TIME       0x10
+#define     QF_DATE_STORAGE_WAKEUP     0x20
+
+typedef union {
+  struct {
+    UINT8 MinValue;
+    UINT8 MaxValue;
+    UINT8 Step;
+  } u8;
+  struct {
+    UINT16 MinValue;
+    UINT16 MaxValue;
+    UINT16 Step;
+  } u16;
+  struct {
+    UINT32 MinValue;
+    UINT32 MaxValue;
+    UINT32 Step;
+  } u32;
+  struct {
+    UINT64 MinValue;
+    UINT64 MaxValue;
+    UINT64 Step;
+  } u64;
+} MINMAXSTEP_DATA;
+
+typedef struct _EFI_IFR_NUMERIC {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    Flags;
+  MINMAXSTEP_DATA          data;
+} EFI_IFR_NUMERIC;
+
+//
+// Flags related to the numeric question
+//
+#define EFI_IFR_NUMERIC_SIZE           0x03
+#define   EFI_IFR_NUMERIC_SIZE_1       0x00
+#define   EFI_IFR_NUMERIC_SIZE_2       0x01
+#define   EFI_IFR_NUMERIC_SIZE_4       0x02
+#define   EFI_IFR_NUMERIC_SIZE_8       0x03
+
+#define EFI_IFR_DISPLAY                0x30
+#define   EFI_IFR_DISPLAY_INT_DEC      0x00
+#define   EFI_IFR_DISPLAY_UINT_DEC     0x10
+#define   EFI_IFR_DISPLAY_UINT_HEX     0x20
+
+typedef struct _EFI_IFR_ONE_OF {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    Flags;
+  MINMAXSTEP_DATA          data;
+} EFI_IFR_ONE_OF;
+
+typedef struct _EFI_IFR_STRING {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    MinSize;
+  UINT8                    MaxSize;
+  UINT8                    Flags;
+} EFI_IFR_STRING;
+
+#define EFI_IFR_STRING_MULTI_LINE      0x01
+
+typedef struct _EFI_IFR_PASSWORD {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT16                   MinSize;
+  UINT16                   MaxSize;
+} EFI_IFR_PASSWORD;
+
+typedef struct _EFI_IFR_ORDERED_LIST {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    MaxContainers;
+  UINT8                    Flags;
+} EFI_IFR_ORDERED_LIST;
+
+#define EFI_IFR_UNIQUE_SET             0x01
+#define EFI_IFR_NO_EMPTY_SET           0x02
+
+typedef struct _EFI_IFR_TIME {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_IFR_QUESTION_HEADER  Question;
+  UINT8                    Flags;
+} EFI_IFR_TIME;
+
+//
+// A bit-mask that determines which unique settings are active for this opcode.
+//
+#define QF_TIME_HOUR_SUPPRESS          0x01
+#define QF_TIME_MINUTE_SUPPRESS        0x02
+#define QF_TIME_SECOND_SUPPRESS        0x04
+
+#define QF_TIME_STORAGE                0x30
+#define   QF_TIME_STORAGE_NORMAL       0x00
+#define   QF_TIME_STORAGE_TIME         0x10
+#define   QF_TIME_STORAGE_WAKEUP       0x20
+
+typedef struct _EFI_IFR_DISABLE_IF {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_DISABLE_IF;
+
+typedef struct _EFI_IFR_SUPPRESS_IF {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_SUPPRESS_IF;
+
+typedef struct _EFI_IFR_GRAY_OUT_IF {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_GRAY_OUT_IF;
+
+typedef struct _EFI_IFR_INCONSISTENT_IF {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            Error;
+} EFI_IFR_INCONSISTENT_IF;
+
+typedef struct _EFI_IFR_NO_SUBMIT_IF {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            Error;
+} EFI_IFR_NO_SUBMIT_IF;
+
+typedef struct _EFI_IFR_REFRESH {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8                    RefreshInterval;
+} EFI_IFR_REFRESH;
+
+typedef struct _EFI_IFR_VARSTORE_DEVICE {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            DevicePath;
+} EFI_IFR_VARSTORE_DEVICE;
+
+typedef struct _EFI_IFR_ONE_OF_OPTION {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            Option;
+  UINT8                    Flags;
+  UINT8                    Type;
+  EFI_IFR_TYPE_VALUE       Value;
+} EFI_IFR_ONE_OF_OPTION;
+
+//
+// Types of the option's value.
+//
+#define EFI_IFR_TYPE_NUM_SIZE_8        0x00
+#define EFI_IFR_TYPE_NUM_SIZE_16       0x01
+#define EFI_IFR_TYPE_NUM_SIZE_32       0x02
+#define EFI_IFR_TYPE_NUM_SIZE_64       0x03
+#define EFI_IFR_TYPE_BOOLEAN           0x04
+#define EFI_IFR_TYPE_TIME              0x05
+#define EFI_IFR_TYPE_DATE              0x06
+#define EFI_IFR_TYPE_STRING            0x07
+#define EFI_IFR_TYPE_OTHER             0x08
+
+#define EFI_IFR_OPTION_DEFAULT         0x10
+#define EFI_IFR_OPTION_DEFAULT_MFG     0x20
+
+typedef struct _EFI_IFR_GUID {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_GUID                 Guid;
+  //Optional Data Follows
+} EFI_IFR_GUID;
+
+typedef struct _EFI_IFR_DUP {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_DUP;
+
+typedef struct _EFI_IFR_EQ_ID_ID {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_QUESTION_ID          QuestionId1;
+  EFI_QUESTION_ID          QuestionId2;
+} EFI_IFR_EQ_ID_ID;
+
+typedef struct _EFI_IFR_EQ_ID_VAL {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_QUESTION_ID          QuestionId;
+  UINT16                   Value;
+} EFI_IFR_EQ_ID_VAL;
+
+typedef struct _EFI_IFR_EQ_ID_LIST {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_QUESTION_ID          QuestionId;
+  UINT16                   ListLength;
+  UINT16                   ValueList[1];
+} EFI_IFR_EQ_ID_LIST;
+
+typedef struct _EFI_IFR_UINT8 {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8 Value;
+} EFI_IFR_UINT8;
+
+typedef struct _EFI_IFR_UINT16 {
+  EFI_IFR_OP_HEADER        Header;
+  UINT16                   Value;
+} EFI_IFR_UINT16;
+
+typedef struct _EFI_IFR_UINT32 {
+  EFI_IFR_OP_HEADER        Header;
+  UINT32                   Value;
+} EFI_IFR_UINT32;
+
+typedef struct _EFI_IFR_UINT64 {
+  EFI_IFR_OP_HEADER        Header;
+  UINT64 Value;
+} EFI_IFR_UINT64;
+
+typedef struct _EFI_IFR_QUESTION_REF1 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_QUESTION_ID          QuestionId;
+} EFI_IFR_QUESTION_REF1;
+
+typedef struct _EFI_IFR_QUESTION_REF2 {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_QUESTION_REF2;
+
+typedef struct _EFI_IFR_QUESTION_REF3 {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_QUESTION_REF3;
+
+typedef struct _EFI_IFR_QUESTION_REF3_2 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            DevicePath;
+} EFI_IFR_QUESTION_REF3_2;
+
+typedef struct _EFI_IFR_QUESTION_REF3_3 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            DevicePath;
+  EFI_GUID                 Guid;
+} EFI_IFR_QUESTION_REF3_3;
+
+typedef struct _EFI_IFR_RULE_REF {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8                    RuleId;
+} EFI_IFR_RULE_REF;
+
+typedef struct _EFI_IFR_STRING_REF1 {
+  EFI_IFR_OP_HEADER        Header;
+  EFI_STRING_ID            StringId;
+} EFI_IFR_STRING_REF1;
+
+typedef struct _EFI_IFR_STRING_REF2 {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_STRING_REF2;
+
+typedef struct _EFI_IFR_THIS {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_THIS;
+
+typedef struct _EFI_IFR_TRUE {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_TRUE;
+
+typedef struct _EFI_IFR_FALSE {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_FALSE;
+
+typedef struct _EFI_IFR_ONE {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_ONE;
+
+typedef struct _EFI_IFR_ONES {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_ONES;
+
+typedef struct _EFI_IFR_ZERO {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_ZERO;
+
+typedef struct _EFI_IFR_UNDEFINED {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_UNDEFINED;
+
+typedef struct _EFI_IFR_VERSION {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_VERSION;
+
+typedef struct _EFI_IFR_LENGTH {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_LENGTH;
+
+typedef struct _EFI_IFR_NOT {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_NOT;
+
+typedef struct _EFI_IFR_BITWISE_NOT {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_BITWISE_NOT;
+
+typedef struct _EFI_IFR_TO_BOOLEAN {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_TO_BOOLEAN;
+
+//
+// For EFI_IFR_TO_STRING, when converting from
+// unsigned integers, these flags control the format:
+// 0 = unsigned decimal
+// 1 = signed decimal
+// 2 = hexadecimal (lower-case alpha)
+// 3 = hexadecimal (upper-case alpha)
+//
+#define EFI_IFR_STRING_UNSIGNED_DEC      0
+#define EFI_IFR_STRING_SIGNED_DEC        1
+#define EFI_IFR_STRING_LOWERCASE_HEX     2
+#define EFI_IFR_STRING_UPPERCASE_HEX     3
+//
+// When converting from a buffer, these flags control the format:
+// 0 = ASCII
+// 8 = Unicode
+//
+#define EFI_IFR_STRING_ASCII             0
+#define EFI_IFR_STRING_UNICODE           8
+
+typedef struct _EFI_IFR_TO_STRING {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8                    Format;
+} EFI_IFR_TO_STRING;
+
+typedef struct _EFI_IFR_TO_UINT {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_TO_UINT;
+
+typedef struct _EFI_IFR_TO_UPPER {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_TO_UPPER;
+
+typedef struct _EFI_IFR_TO_LOWER {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_TO_LOWER;
+
+typedef struct _EFI_IFR_ADD {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_ADD;
+
+typedef struct _EFI_IFR_AND {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_AND;
+
+typedef struct _EFI_IFR_BITWISE_AND {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_BITWISE_AND;
+
+typedef struct _EFI_IFR_BITWISE_OR {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_BITWISE_OR;
+
+typedef struct _EFI_IFR_CATENATE {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_CATENATE;
+
+typedef struct _EFI_IFR_DIVIDE {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_DIVIDE;
+
+typedef struct _EFI_IFR_EQUAL {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_EQUAL;
+
+typedef struct _EFI_IFR_GREATER_EQUAL {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_GREATER_EQUAL;
+
+typedef struct _EFI_IFR_GREATER_THAN {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_GREATER_THAN;
+
+typedef struct _EFI_IFR_LESS_EQUAL {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_LESS_EQUAL;
+
+typedef struct _EFI_IFR_LESS_THAN {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_LESS_THAN;
+
+typedef struct _EFI_IFR_MATCH {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_MATCH;
+
+typedef struct _EFI_IFR_MULTIPLY {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_MULTIPLY;
+
+typedef struct _EFI_IFR_MODULO {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_MODULO;
+
+typedef struct _EFI_IFR_NOT_EQUAL {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_NOT_EQUAL;
+
+typedef struct _EFI_IFR_OR {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_OR;
+
+typedef struct _EFI_IFR_SHIFT_LEFT {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_SHIFT_LEFT;
+
+typedef struct _EFI_IFR_SHIFT_RIGHT {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_SHIFT_RIGHT;
+
+typedef struct _EFI_IFR_SUBTRACT {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_SUBTRACT;
+
+typedef struct _EFI_IFR_CONDITIONAL {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_CONDITIONAL;
+
+//
+// Flags governing the matching criteria of EFI_IFR_FIND
+//
+#define EFI_IFR_FF_CASE_SENSITIVE    0x00
+#define EFI_IFR_FF_CASE_INSENSITIVE  0x01
+
+typedef struct _EFI_IFR_FIND {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8                    Format;
+} EFI_IFR_FIND;
+
+typedef struct _EFI_IFR_MID {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_MID;
+
+typedef struct _EFI_IFR_TOKEN {
+  EFI_IFR_OP_HEADER        Header;
+} EFI_IFR_TOKEN;
+
+//
+// Flags specifying whether to find the first matching string
+// or the first non-matching string.
+//
+#define EFI_IFR_FLAGS_FIRST_MATCHING     0x00
+#define EFI_IFR_FLAGS_FIRST_NON_MATCHING 0x01
+
+typedef struct _EFI_IFR_SPAN {
+  EFI_IFR_OP_HEADER        Header;
+  UINT8                    Flags;
+} EFI_IFR_SPAN;
+
+//
+// Definitions for Keyboard Package
+// Section 27.3.9
+// Releated definitions are in Section of EFI_HII_DATABASE_PROTOCOL
+//
+
+typedef enum {
+  EfiKeyLCtrl,
+  EfiKeyA0,
+  EfiKeyLAlt,
+  EfiKeySpaceBar,
+  EfiKeyA2,
+  EfiKeyA3,
+  EfiKeyA4,
+  EfiKeyRCtrl,
+  EfiKeyLeftArrow,
+  EfiKeyDownArrow,
+  EfiKeyRightArrow,
+  EfiKeyZero,
+  EfiKeyPeriod,
+  EfiKeyEnter,
+  EfiKeyLShift,
+  EfiKeyB0,
+  EfiKeyB1,
+  EfiKeyB2,
+  EfiKeyB3,
+  EfiKeyB4,
+  EfiKeyB5,
+  EfiKeyB6,
+  EfiKeyB7,
+  EfiKeyB8,
+  EfiKeyB9,
+  EfiKeyB10,
+  EfiKeyRShift,
+  EfiKeyUpArrow,
+  EfiKeyOne,
+  EfiKeyTwo,
+  EfiKeyThree,
+  EfiKeyCapsLock,
+  EfiKeyC1,
+  EfiKeyC2,
+  EfiKeyC3,
+  EfiKeyC4,
+  EfiKeyC5,
+  EfiKeyC6,
+  EfiKeyC7,
+  EfiKeyC8,
+  EfiKeyC9,
+  EfiKeyC10,
+  EfiKeyC11,
+  EfiKeyC12,
+  EfiKeyFour,
+  EfiKeyFive,
+  EfiKeySix,
+  EfiKeyPlus,
+  EfiKeyTab,
+  EfiKeyD1,
+  EfiKeyD2,
+  EfiKeyD3,
+  EfiKeyD4,
+  EfiKeyD5,
+  EfiKeyD6,
+  EfiKeyD7,
+  EfiKeyD8,
+  EfiKeyD9,
+  EfiKeyD10,
+  EfiKeyD11,
+  EfiKeyD12,
+  EfiKeyD13,
+  EfiKeyDel,
+  EfiKeyEnd,
+  EfiKeyPgDn,
+  EfiKeySeven,
+  EfiKeyEight,
+  EfiKeyNine,
+  EfiKeyE0,
+  EfiKeyE1,
+  EfiKeyE2,
+  EfiKeyE3,
+  EfiKeyE4,
+  EfiKeyE5,
+  EfiKeyE6,
+  EfiKeyE7,
+  EfiKeyE8,
+  EfiKeyE9,
+  EfiKeyE10,
+  EfiKeyE11,
+  EfiKeyE12,
+  EfiKeyBackSpace,
+  EfiKeyIns,
+  EfiKeyHome,
+  EfiKeyPgUp,
+  EfiKeyNLck,
+  EfiKeySlash,
+  EfiKeyAsterisk,
+  EfiKeyMinus,
+  EfiKeyEsc,
+  EfiKeyF1,
+  EfiKeyF2,
+  EfiKeyF3,
+  EfiKeyF4,
+  EfiKeyF5,
+  EfiKeyF6,
+  EfiKeyF7,
+  EfiKeyF8,
+  EfiKeyF9,
+  EfiKeyF10,
+  EfiKeyF11,
+  EfiKeyF12,
+  EfiKeyPrint,
+  EfiKeySLck,
+  EfiKeyPause
+} EFI_KEY;
+
+typedef struct {
+  EFI_KEY                 Key;
+  CHAR16                  Unicode;
+  CHAR16                  ShiftedUnicode;
+  CHAR16                  AltGrUnicode;
+  CHAR16                  ShiftedAltGrUnicode;
+  UINT16                  Modifier;
+  UINT16                  AffectedAttribute;
+} EFI_KEY_DESCRIPTOR;
+
+///
+/// A key which is affected by all the standard shift modifiers.
+/// Most keys would be expected to have this bit active.
+///
+#define EFI_AFFECTED_BY_STANDARD_SHIFT       0x0001
+
+///
+/// This key is affected by the caps lock so that if a keyboard driver
+/// would need to disambiguate between a key which had a "1" defined
+/// versus a "a" character.  Having this bit turned on would tell
+/// the keyboard driver to use the appropriate shifted state or not.
+///
+#define EFI_AFFECTED_BY_CAPS_LOCK            0x0002
+
+///
+/// Similar to the case of CAPS lock, if this bit is active, the key
+/// is affected by the num lock being turned on.
+///
+#define EFI_AFFECTED_BY_NUM_LOCK             0x0004
+
+typedef struct {
+  UINT16                  LayoutLength;
+  EFI_GUID                Guid;
+  UINT32                  LayoutDescriptorStringOffset;
+  UINT8                   DescriptorCount;
+  // EFI_KEY_DESCRIPTOR    Descriptors[];
+} EFI_HII_KEYBOARD_LAYOUT;
+
+typedef struct {
+  EFI_HII_PACKAGE_HEADER  Header;
+  UINT16                  LayoutCount;
+  // EFI_HII_KEYBOARD_LAYOUT Layout[];
+} EFI_HII_KEYBOARD_PACKAGE_HDR;
+
+//
+// Modifier values
+//
+#define EFI_NULL_MODIFIER                0x0000
+#define EFI_LEFT_CONTROL_MODIFIER        0x0001
+#define EFI_RIGHT_CONTROL_MODIFIER       0x0002
+#define EFI_LEFT_ALT_MODIFIER            0x0003
+#define EFI_RIGHT_ALT_MODIFIER           0x0004
+#define EFI_ALT_GR_MODIFIER              0x0005
+#define EFI_INSERT_MODIFIER              0x0006
+#define EFI_DELETE_MODIFIER              0x0007
+#define EFI_PAGE_DOWN_MODIFIER           0x0008
+#define EFI_PAGE_UP_MODIFIER             0x0009
+#define EFI_HOME_MODIFIER                0x000A
+#define EFI_END_MODIFIER                 0x000B
+#define EFI_LEFT_SHIFT_MODIFIER          0x000C
+#define EFI_RIGHT_SHIFT_MODIFIER         0x000D
+#define EFI_CAPS_LOCK_MODIFIER           0x000E
+#define EFI_NUM_LOCK_MODIFIER            0x000F
+#define EFI_LEFT_ARROW_MODIFIER          0x0010
+#define EFI_RIGHT_ARROW_MODIFIER         0x0011
+#define EFI_DOWN_ARROW_MODIFIER          0x0012
+#define EFI_UP_ARROW_MODIFIER            0x0013
+#define EFI_NS_KEY_MODIFIER              0x0014
+#define EFI_NS_KEY_DEPENDENCY_MODIFIER   0x0015
+#define EFI_FUNCTION_KEY_ONE_MODIFIER    0x0016
+#define EFI_FUNCTION_KEY_TWO_MODIFIER    0x0017
+#define EFI_FUNCTION_KEY_THREE_MODIFIER  0x0018
+#define EFI_FUNCTION_KEY_FOUR_MODIFIER   0x0019
+#define EFI_FUNCTION_KEY_FIVE_MODIFIER   0x001A
+#define EFI_FUNCTION_KEY_SIX_MODIFIER    0x001B
+#define EFI_FUNCTION_KEY_SEVEN_MODIFIER  0x001C
+#define EFI_FUNCTION_KEY_EIGHT_MODIFIER  0x001D
+#define EFI_FUNCTION_KEY_NINE_MODIFIER   0x001E
+#define EFI_FUNCTION_KEY_TEN_MODIFIER    0x001F
+#define EFI_FUNCTION_KEY_ELEVEN_MODIFIER 0x0020
+#define EFI_FUNCTION_KEY_TWELVE_MODIFIER 0x0021
+
+//
+// Keys that have multiple control functions based on modifier
+// settings are handled in the keyboard driver implementation.
+// For instance PRINT_KEY might have a modifier held down and
+// is still a nonprinting character, but might have an alternate
+// control function like SYSREQUEST
+//
+#define EFI_PRINT_MODIFIER               0x0022
+#define EFI_SYS_REQUEST_MODIFIER         0x0023
+#define EFI_SCROLL_LOCK_MODIFIER         0x0024
+#define EFI_PAUSE_MODIFIER               0x0025
+#define EFI_BREAK_MODIFIER               0x0026
+
+#define EFI_LEFT_LOGO_MODIFIER           0x0027
+#define EFI_RIGHT_LOGO_MODIFIER          0x0028
+#define EFI_MENU_MODIFIER                0x0029
+
+#pragma pack()
+
+
+
+///
+/// References to string tokens must use this macro to enable scanning for
+/// token usages.
+///
+///
+/// STRING_TOKEN is not defined in UEFI specification. But it is placed
+/// here for the easy access by C files and VFR source files.
+///
+#define STRING_TOKEN(t) t
+
+#endif
diff --git a/src/include/ipxe/efi/Uefi/UefiMultiPhase.h b/src/include/ipxe/efi/Uefi/UefiMultiPhase.h
new file mode 100644
index 0000000..24cf48e
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi/UefiMultiPhase.h
@@ -0,0 +1,210 @@
+/** @file
+  This includes some definitions introduced in UEFI that will be used in both PEI and DXE phases.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __UEFI_MULTIPHASE_H__
+#define __UEFI_MULTIPHASE_H__
+
+#include <ipxe/efi/ProcessorBind.h>
+
+///
+/// Enumeration of memory types introduced in UEFI.
+///
+typedef enum {
+  EfiReservedMemoryType,
+  EfiLoaderCode,
+  EfiLoaderData,
+  EfiBootServicesCode,
+  EfiBootServicesData,
+  EfiRuntimeServicesCode,
+  EfiRuntimeServicesData,
+  EfiConventionalMemory,
+  EfiUnusableMemory,
+  EfiACPIReclaimMemory,
+  EfiACPIMemoryNVS,
+  EfiMemoryMappedIO,
+  EfiMemoryMappedIOPortSpace,
+  EfiPalCode,
+  EfiMaxMemoryType
+} EFI_MEMORY_TYPE;
+
+
+///
+/// Data structure that precedes all of the standard EFI table types.
+///
+typedef struct {
+  UINT64  Signature;
+  UINT32  Revision;
+  UINT32  HeaderSize;
+  UINT32  CRC32;
+  UINT32  Reserved;
+} EFI_TABLE_HEADER;
+
+///
+/// Attributes of variable.
+///
+#define EFI_VARIABLE_NON_VOLATILE                 0x00000001
+#define EFI_VARIABLE_BOOTSERVICE_ACCESS           0x00000002
+#define EFI_VARIABLE_RUNTIME_ACCESS               0x00000004
+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD        0x00000008
+
+///
+/// This attribute is identified by the mnemonic 'HR'
+/// elsewhere in this specification.
+///
+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS   0x00000010
+
+//
+// _WIN_CERTIFICATE.wCertificateType
+//
+#define WIN_CERT_TYPE_EFI_PKCS115   0x0EF0
+#define WIN_CERT_TYPE_EFI_GUID      0x0EF1
+
+///
+/// The WIN_CERTIFICATE structure is part of the PE/COFF specification.
+///
+typedef struct _WIN_CERTIFICATE {
+  ///
+  /// The length of the entire certificate,
+  /// including the length of the header, in bytes.
+  ///
+  UINT32  dwLength;
+  ///
+  /// The revision level of the WIN_CERTIFICATE
+  /// structure. The current revision level is 0x0200.
+  ///
+  UINT16  wRevision;
+  ///
+  /// The certificate type. See WIN_CERT_TYPE_xxx for the UEFI
+  /// certificate types. The UEFI specification reserves the range of
+  /// certificate type values from 0x0EF0 to 0x0EFF.
+  ///
+  UINT16  wCertificateType;
+  ///
+  /// The following is the actual certificate. The format of
+  /// the certificate depends on wCertificateType.
+  ///
+  /// UINT8 bCertificate[ANYSIZE_ARRAY];
+  ///
+} WIN_CERTIFICATE;
+
+///
+/// WIN_CERTIFICATE_UEFI_GUID.CertType
+///
+#define EFI_CERT_TYPE_RSA2048_SHA256_GUID \
+  {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } }
+
+//
+// WIN_CERTIFICATE_UEFI_GUID.CertData
+//
+typedef struct _EFI_CERT_BLOCK_RSA_2048_SHA256 {
+  UINT32  HashType;
+  UINT8   PublicKey[256];
+  UINT8   Signature[256];
+} EFI_CERT_BLOCK_RSA_2048_SHA256;
+
+
+///
+/// Certificate which encapsulates a GUID-specific digital signature
+///
+typedef struct _WIN_CERTIFICATE_UEFI_GUID {
+  ///
+  /// This is the standard WIN_CERTIFICATE header, where
+  /// wCertificateType is set to WIN_CERT_TYPE_UEFI_GUID.
+  ///
+  WIN_CERTIFICATE   Hdr;
+  ///
+  /// This is the unique id which determines the
+  /// format of the CertData. In this case, the
+  /// value is EFI_CERT_TYPE_RSA2048_SHA256_GUID.
+  ///
+  EFI_GUID          CertType;
+  ///
+  /// The following is the certificate data. The format of
+  /// the data is determined by the CertType. In this case the value is
+  /// EFI_CERT_BLOCK_RSA_2048_SHA256.
+  ///
+  /// UINT8            CertData[ANYSIZE_ARRAY];
+  ///
+} WIN_CERTIFICATE_UEFI_GUID;
+
+
+///
+/// Certificate which encapsulates the RSASSA_PKCS1-v1_5 digital signature.
+///
+/// The WIN_CERTIFICATE_UEFI_PKCS1_15 structure is derived from
+/// WIN_CERTIFICATE and encapsulate the information needed to
+/// implement the RSASSA-PKCS1-v1_5 digital signature algorithm as
+/// specified in RFC2437.
+///
+typedef struct _WIN_CERTIFICATE_EFI_PKCS1_15 {
+  ///
+  /// This is the standard WIN_CERTIFICATE header, where
+  /// wCertificateType is set to WIN_CERT_TYPE_UEFI_PKCS1_15.
+  ///
+  WIN_CERTIFICATE Hdr;
+  ///
+  /// This is the hashing algorithm which was performed on the
+  /// UEFI executable when creating the digital signature.
+  ///
+  EFI_GUID        HashAlgorithm;
+  ///
+  /// The following is the actual digital signature. The
+  /// size of the signature is the same size as the key
+  /// (1024-bit key is 128 bytes) and can be determined by
+  /// subtracting the length of the other parts of this header
+  /// from the total length of the certificate as found in
+  /// Hdr.dwLength.
+  ///
+  /// UINT8 Signature[ANYSIZE_ARRAY];
+  ///
+} WIN_CERTIFICATE_EFI_PKCS1_15;
+
+
+
+///
+/// AuthInfo is a WIN_CERTIFICATE using the wCertificateType
+/// WIN_CERTIFICATE_UEFI_GUID and the CertType
+/// EFI_CERT_TYPE_RSA2048_SHA256. If the attribute specifies
+/// authenticated access, then the Data buffer should begin with an
+/// authentication descriptor prior to the data payload and DataSize
+/// should reflect the the data.and descriptor size. The caller
+/// shall digest the Monotonic Count value and the associated data
+/// for the variable update using the SHA-256 1-way hash algorithm.
+/// The ensuing the 32-byte digest will be signed using the private
+/// key associated w/ the public/private 2048-bit RSA key-pair. The
+/// WIN_CERTIFICATE shall be used to describe the signature of the
+/// Variable data *Data. In addition, the signature will also
+/// include the MonotonicCount value to guard against replay attacks
+///
+typedef struct {
+  ///
+  /// Included in the signature of
+  /// AuthInfo.Used to ensure freshness/no
+  /// replay. Incremented during each
+  /// "Write" access.
+  ///
+  UINT64                      MonotonicCount;
+  ///
+  /// Provides the authorization for the variable
+  /// access. It is a signature across the
+  /// variable data and the  Monotonic Count
+  /// value. Caller uses Private key that is
+  /// associated with a public key that has been
+  /// provisioned via the key exchange.
+  ///
+  WIN_CERTIFICATE_UEFI_GUID   AuthInfo;
+} EFI_VARIABLE_AUTHENTICATION;
+
+#endif
+
diff --git a/src/include/ipxe/efi/Uefi/UefiPxe.h b/src/include/ipxe/efi/Uefi/UefiPxe.h
new file mode 100644
index 0000000..bb8ab41
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi/UefiPxe.h
@@ -0,0 +1,1756 @@
+/** @file
+  This header file contains all of the PXE type definitions,
+  structure prototypes, global variables and constants that
+  are needed for porting PXE to EFI.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+  @par Revision Reference:
+  32/64-bit PXE specification:
+  alpha-4, 99-Dec-17
+
+**/
+
+#ifndef __EFI_PXE_H__
+#define __EFI_PXE_H__
+
+#pragma pack(1)
+
+#define PXE_BUSTYPE(a, b, c, d) \
+    ( \
+      (((PXE_UINT32) (d) & 0xFF) << 24) | (((PXE_UINT32) (c) & 0xFF) << 16) | (((PXE_UINT32) (b) & 0xFF) << 8) | \
+        ((PXE_UINT32) (a) & 0xFF) \
+    )
+
+///
+/// UNDI ROM ID and devive ID signature
+///
+#define PXE_BUSTYPE_PXE PXE_BUSTYPE ('!', 'P', 'X', 'E')
+
+///
+/// BUS ROM ID signatures
+///
+#define PXE_BUSTYPE_PCI     PXE_BUSTYPE ('P', 'C', 'I', 'R')
+#define PXE_BUSTYPE_PC_CARD PXE_BUSTYPE ('P', 'C', 'C', 'R')
+#define PXE_BUSTYPE_USB     PXE_BUSTYPE ('U', 'S', 'B', 'R')
+#define PXE_BUSTYPE_1394    PXE_BUSTYPE ('1', '3', '9', '4')
+
+#define PXE_SWAP_UINT16(n)  ((((PXE_UINT16) (n) & 0x00FF) << 8) | (((PXE_UINT16) (n) & 0xFF00) >> 8))
+
+#define PXE_SWAP_UINT32(n) \
+  ((((PXE_UINT32)(n) & 0x000000FF) << 24) | \
+   (((PXE_UINT32)(n) & 0x0000FF00) << 8)  | \
+   (((PXE_UINT32)(n) & 0x00FF0000) >> 8)  | \
+   (((PXE_UINT32)(n) & 0xFF000000) >> 24))
+
+#define PXE_SWAP_UINT64(n) \
+  ((((PXE_UINT64)(n) & 0x00000000000000FFULL) << 56) | \
+   (((PXE_UINT64)(n) & 0x000000000000FF00ULL) << 40) | \
+   (((PXE_UINT64)(n) & 0x0000000000FF0000ULL) << 24) | \
+   (((PXE_UINT64)(n) & 0x00000000FF000000ULL) << 8)  | \
+   (((PXE_UINT64)(n) & 0x000000FF00000000ULL) >> 8)  | \
+   (((PXE_UINT64)(n) & 0x0000FF0000000000ULL) >> 24) | \
+   (((PXE_UINT64)(n) & 0x00FF000000000000ULL) >> 40) | \
+   (((PXE_UINT64)(n) & 0xFF00000000000000ULL) >> 56))
+
+
+#define PXE_CPBSIZE_NOT_USED  0               ///< zero
+#define PXE_DBSIZE_NOT_USED   0               ///< zero
+#define PXE_CPBADDR_NOT_USED  (PXE_UINT64) 0  ///< zero
+#define PXE_DBADDR_NOT_USED   (PXE_UINT64) 0  ///< zero
+#define PXE_CONST             CONST
+
+#define PXE_VOLATILE          volatile
+
+typedef VOID           PXE_VOID;
+typedef UINT8          PXE_UINT8;
+typedef UINT16         PXE_UINT16;
+typedef UINT32         PXE_UINT32;
+typedef UINTN          PXE_UINTN;
+
+///
+/// typedef unsigned long PXE_UINT64;
+///
+typedef UINT64      PXE_UINT64;
+
+typedef PXE_UINT8 PXE_BOOL;
+#define PXE_FALSE 0            ///< zero
+#define PXE_TRUE  (!PXE_FALSE)
+
+typedef PXE_UINT16      PXE_OPCODE;
+
+///
+/// Return UNDI operational state.
+///
+#define PXE_OPCODE_GET_STATE  0x0000
+
+///
+/// Change UNDI operational state from Stopped to Started.
+///
+#define PXE_OPCODE_START  0x0001
+
+///
+/// Change UNDI operational state from Started to Stopped.
+///
+#define PXE_OPCODE_STOP 0x0002
+
+///
+/// Get UNDI initialization information.
+///
+#define PXE_OPCODE_GET_INIT_INFO  0x0003
+
+///
+/// Get NIC configuration information.
+///
+#define PXE_OPCODE_GET_CONFIG_INFO  0x0004
+
+///
+/// Changed UNDI operational state from Started to Initialized.
+///
+#define PXE_OPCODE_INITIALIZE 0x0005
+
+///
+/// Re-initialize the NIC H/W.
+///
+#define PXE_OPCODE_RESET  0x0006
+
+///
+/// Change the UNDI operational state from Initialized to Started.
+///
+#define PXE_OPCODE_SHUTDOWN 0x0007
+
+///
+/// Read & change state of external interrupt enables.
+///
+#define PXE_OPCODE_INTERRUPT_ENABLES  0x0008
+
+///
+/// Read & change state of packet receive filters.
+///
+#define PXE_OPCODE_RECEIVE_FILTERS  0x0009
+
+///
+/// Read & change station MAC address.
+///
+#define PXE_OPCODE_STATION_ADDRESS  0x000A
+
+///
+/// Read traffic statistics.
+///
+#define PXE_OPCODE_STATISTICS 0x000B
+
+///
+/// Convert multicast IP address to multicast MAC address.
+///
+#define PXE_OPCODE_MCAST_IP_TO_MAC  0x000C
+
+///
+/// Read or change non-volatile storage on the NIC.
+///
+#define PXE_OPCODE_NVDATA 0x000D
+
+///
+/// Get & clear interrupt status.
+///
+#define PXE_OPCODE_GET_STATUS 0x000E
+
+///
+/// Fill media header in packet for transmit.
+///
+#define PXE_OPCODE_FILL_HEADER  0x000F
+
+///
+/// Transmit packet(s).
+///
+#define PXE_OPCODE_TRANSMIT 0x0010
+
+///
+/// Receive packet.
+///
+#define PXE_OPCODE_RECEIVE  0x0011
+
+///
+/// Last valid PXE UNDI OpCode number.
+///
+#define PXE_OPCODE_LAST_VALID 0x0011
+
+typedef PXE_UINT16  PXE_OPFLAGS;
+
+#define PXE_OPFLAGS_NOT_USED  0x0000
+
+//
+// //////////////////////////////////////
+// UNDI Get State
+//
+// No OpFlags
+
+////////////////////////////////////////
+// UNDI Start
+//
+// No OpFlags
+
+////////////////////////////////////////
+// UNDI Stop
+//
+// No OpFlags
+
+////////////////////////////////////////
+// UNDI Get Init Info
+//
+// No Opflags
+
+////////////////////////////////////////
+// UNDI Get Config Info
+//
+// No Opflags
+
+///
+/// UNDI Initialize
+///
+#define PXE_OPFLAGS_INITIALIZE_CABLE_DETECT_MASK    0x0001
+#define PXE_OPFLAGS_INITIALIZE_DETECT_CABLE         0x0000
+#define PXE_OPFLAGS_INITIALIZE_DO_NOT_DETECT_CABLE  0x0001
+
+///
+///
+/// UNDI Reset
+///
+#define PXE_OPFLAGS_RESET_DISABLE_INTERRUPTS  0x0001
+#define PXE_OPFLAGS_RESET_DISABLE_FILTERS     0x0002
+
+///
+/// UNDI Shutdown
+///
+/// No OpFlags
+
+///
+/// UNDI Interrupt Enables
+///
+///
+/// Select whether to enable or disable external interrupt signals.
+/// Setting both enable and disable will return PXE_STATCODE_INVALID_OPFLAGS.
+///
+#define PXE_OPFLAGS_INTERRUPT_OPMASK  0xC000
+#define PXE_OPFLAGS_INTERRUPT_ENABLE  0x8000
+#define PXE_OPFLAGS_INTERRUPT_DISABLE 0x4000
+#define PXE_OPFLAGS_INTERRUPT_READ    0x0000
+
+///
+/// Enable receive interrupts.  An external interrupt will be generated
+/// after a complete non-error packet has been received.
+///
+#define PXE_OPFLAGS_INTERRUPT_RECEIVE 0x0001
+
+///
+/// Enable transmit interrupts.  An external interrupt will be generated
+/// after a complete non-error packet has been transmitted.
+///
+#define PXE_OPFLAGS_INTERRUPT_TRANSMIT  0x0002
+
+///
+/// Enable command interrupts.  An external interrupt will be generated
+/// when command execution stops.
+///
+#define PXE_OPFLAGS_INTERRUPT_COMMAND 0x0004
+
+///
+/// Generate software interrupt.  Setting this bit generates an external
+/// interrupt, if it is supported by the hardware.
+///
+#define PXE_OPFLAGS_INTERRUPT_SOFTWARE  0x0008
+
+///
+/// UNDI Receive Filters
+///
+///
+/// Select whether to enable or disable receive filters.
+/// Setting both enable and disable will return PXE_STATCODE_INVALID_OPCODE.
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_OPMASK   0xC000
+#define PXE_OPFLAGS_RECEIVE_FILTER_ENABLE   0x8000
+#define PXE_OPFLAGS_RECEIVE_FILTER_DISABLE  0x4000
+#define PXE_OPFLAGS_RECEIVE_FILTER_READ     0x0000
+
+///
+/// To reset the contents of the multicast MAC address filter list,
+/// set this OpFlag:
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_RESET_MCAST_LIST 0x2000
+
+///
+/// Enable unicast packet receiving.  Packets sent to the current station
+/// MAC address will be received.
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_UNICAST  0x0001
+
+///
+/// Enable broadcast packet receiving.  Packets sent to the broadcast
+/// MAC address will be received.
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_BROADCAST  0x0002
+
+///
+/// Enable filtered multicast packet receiving.  Packets sent to any
+/// of the multicast MAC addresses in the multicast MAC address filter
+/// list will be received.  If the filter list is empty, no multicast
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_FILTERED_MULTICAST 0x0004
+
+///
+/// Enable promiscuous packet receiving.  All packets will be received.
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_PROMISCUOUS  0x0008
+
+///
+/// Enable promiscuous multicast packet receiving.  All multicast
+/// packets will be received.
+///
+#define PXE_OPFLAGS_RECEIVE_FILTER_ALL_MULTICAST  0x0010
+
+///
+/// UNDI Station Address
+///
+#define PXE_OPFLAGS_STATION_ADDRESS_READ   0x0000
+#define PXE_OPFLAGS_STATION_ADDRESS_WRITE  0x0000
+#define PXE_OPFLAGS_STATION_ADDRESS_RESET  0x0001
+
+///
+/// UNDI Statistics
+///
+#define PXE_OPFLAGS_STATISTICS_READ   0x0000
+#define PXE_OPFLAGS_STATISTICS_RESET  0x0001
+
+///
+/// UNDI MCast IP to MAC
+///
+///
+/// Identify the type of IP address in the CPB.
+///
+#define PXE_OPFLAGS_MCAST_IP_TO_MAC_OPMASK  0x0003
+#define PXE_OPFLAGS_MCAST_IPV4_TO_MAC       0x0000
+#define PXE_OPFLAGS_MCAST_IPV6_TO_MAC       0x0001
+
+///
+/// UNDI NvData
+///
+///
+/// Select the type of non-volatile data operation.
+///
+#define PXE_OPFLAGS_NVDATA_OPMASK 0x0001
+#define PXE_OPFLAGS_NVDATA_READ   0x0000
+#define PXE_OPFLAGS_NVDATA_WRITE  0x0001
+
+///
+/// UNDI Get Status
+///
+///
+/// Return current interrupt status.  This will also clear any interrupts
+/// that are currently set.  This can be used in a polling routine.  The
+/// interrupt flags are still set and cleared even when the interrupts
+/// are disabled.
+///
+#define PXE_OPFLAGS_GET_INTERRUPT_STATUS  0x0001
+
+///
+/// Return list of transmitted buffers for recycling.  Transmit buffers
+/// must not be changed or unallocated until they have recycled.  After
+/// issuing a transmit command, wait for a transmit complete interrupt.
+/// When a transmit complete interrupt is received, read the transmitted
+/// buffers.  Do not plan on getting one buffer per interrupt.  Some
+/// NICs and UNDIs may transmit multiple buffers per interrupt.
+///
+#define PXE_OPFLAGS_GET_TRANSMITTED_BUFFERS 0x0002
+
+///
+/// UNDI Fill Header
+///
+#define PXE_OPFLAGS_FILL_HEADER_OPMASK      0x0001
+#define PXE_OPFLAGS_FILL_HEADER_FRAGMENTED  0x0001
+#define PXE_OPFLAGS_FILL_HEADER_WHOLE       0x0000
+
+///
+/// UNDI Transmit
+///
+///
+/// S/W UNDI only.  Return after the packet has been transmitted.  A
+/// transmit complete interrupt will still be generated and the transmit
+/// buffer will have to be recycled.
+///
+#define PXE_OPFLAGS_SWUNDI_TRANSMIT_OPMASK  0x0001
+#define PXE_OPFLAGS_TRANSMIT_BLOCK          0x0001
+#define PXE_OPFLAGS_TRANSMIT_DONT_BLOCK     0x0000
+
+#define PXE_OPFLAGS_TRANSMIT_OPMASK     0x0002
+#define PXE_OPFLAGS_TRANSMIT_FRAGMENTED 0x0002
+#define PXE_OPFLAGS_TRANSMIT_WHOLE      0x0000
+
+///
+/// UNDI Receive
+///
+/// No OpFlags
+///
+
+///
+/// PXE STATFLAGS
+///
+typedef PXE_UINT16  PXE_STATFLAGS;
+
+#define PXE_STATFLAGS_INITIALIZE  0x0000
+
+///
+/// Common StatFlags that can be returned by all commands.
+///
+///
+/// The COMMAND_COMPLETE and COMMAND_FAILED status flags must be
+/// implemented by all UNDIs.  COMMAND_QUEUED is only needed by UNDIs
+/// that support command queuing.
+///
+#define PXE_STATFLAGS_STATUS_MASK       0xC000
+#define PXE_STATFLAGS_COMMAND_COMPLETE  0xC000
+#define PXE_STATFLAGS_COMMAND_FAILED    0x8000
+#define PXE_STATFLAGS_COMMAND_QUEUED    0x4000
+
+///
+/// UNDI Get State
+///
+#define PXE_STATFLAGS_GET_STATE_MASK        0x0003
+#define PXE_STATFLAGS_GET_STATE_INITIALIZED 0x0002
+#define PXE_STATFLAGS_GET_STATE_STARTED     0x0001
+#define PXE_STATFLAGS_GET_STATE_STOPPED     0x0000
+
+///
+/// UNDI Start
+///
+/// No additional StatFlags
+///
+
+///
+/// UNDI Get Init Info
+///
+#define PXE_STATFLAGS_CABLE_DETECT_MASK           0x0001
+#define PXE_STATFLAGS_CABLE_DETECT_NOT_SUPPORTED  0x0000
+#define PXE_STATFLAGS_CABLE_DETECT_SUPPORTED      0x0001
+
+///
+/// UNDI Initialize
+///
+#define PXE_STATFLAGS_INITIALIZED_NO_MEDIA  0x0001
+
+///
+/// UNDI Reset
+///
+#define PXE_STATFLAGS_RESET_NO_MEDIA  0x0001
+
+///
+/// UNDI Shutdown
+///
+/// No additional StatFlags
+
+///
+/// UNDI Interrupt Enables
+///
+///
+/// If set, receive interrupts are enabled.
+///
+#define PXE_STATFLAGS_INTERRUPT_RECEIVE 0x0001
+
+///
+/// If set, transmit interrupts are enabled.
+///
+#define PXE_STATFLAGS_INTERRUPT_TRANSMIT  0x0002
+
+///
+/// If set, command interrupts are enabled.
+///
+#define PXE_STATFLAGS_INTERRUPT_COMMAND 0x0004
+
+///
+/// UNDI Receive Filters
+///
+
+///
+/// If set, unicast packets will be received.
+///
+#define PXE_STATFLAGS_RECEIVE_FILTER_UNICAST  0x0001
+
+///
+/// If set, broadcast packets will be received.
+///
+#define PXE_STATFLAGS_RECEIVE_FILTER_BROADCAST  0x0002
+
+///
+/// If set, multicast packets that match up with the multicast address
+/// filter list will be received.
+///
+#define PXE_STATFLAGS_RECEIVE_FILTER_FILTERED_MULTICAST 0x0004
+
+///
+/// If set, all packets will be received.
+///
+#define PXE_STATFLAGS_RECEIVE_FILTER_PROMISCUOUS  0x0008
+
+///
+/// If set, all multicast packets will be received.
+///
+#define PXE_STATFLAGS_RECEIVE_FILTER_ALL_MULTICAST  0x0010
+
+///
+/// UNDI Station Address
+///
+/// No additional StatFlags
+///
+
+///
+/// UNDI Statistics
+///
+/// No additional StatFlags
+///
+
+///
+//// UNDI MCast IP to MAC
+////
+//// No additional StatFlags
+
+///
+/// UNDI NvData
+///
+/// No additional StatFlags
+///
+
+///
+/// UNDI Get Status
+///
+
+///
+/// Use to determine if an interrupt has occurred.
+///
+#define PXE_STATFLAGS_GET_STATUS_INTERRUPT_MASK 0x000F
+#define PXE_STATFLAGS_GET_STATUS_NO_INTERRUPTS  0x0000
+
+///
+/// If set, at least one receive interrupt occurred.
+///
+#define PXE_STATFLAGS_GET_STATUS_RECEIVE  0x0001
+
+///
+/// If set, at least one transmit interrupt occurred.
+///
+#define PXE_STATFLAGS_GET_STATUS_TRANSMIT 0x0002
+
+///
+/// If set, at least one command interrupt occurred.
+///
+#define PXE_STATFLAGS_GET_STATUS_COMMAND  0x0004
+
+///
+/// If set, at least one software interrupt occurred.
+///
+#define PXE_STATFLAGS_GET_STATUS_SOFTWARE 0x0008
+
+///
+/// This flag is set if the transmitted buffer queue is empty.  This flag
+/// will be set if all transmitted buffer addresses get written into the DB.
+///
+#define PXE_STATFLAGS_GET_STATUS_TXBUF_QUEUE_EMPTY  0x0010
+
+///
+/// This flag is set if no transmitted buffer addresses were written
+/// into the DB.  (This could be because DBsize was too small.)
+///
+#define PXE_STATFLAGS_GET_STATUS_NO_TXBUFS_WRITTEN  0x0020
+
+///
+/// UNDI Fill Header
+///
+/// No additional StatFlags
+///
+
+///
+/// UNDI Transmit
+///
+/// No additional StatFlags.
+
+///
+/// UNDI Receive
+///
+
+///
+/// No additional StatFlags.
+///
+typedef PXE_UINT16  PXE_STATCODE;
+
+#define PXE_STATCODE_INITIALIZE 0x0000
+
+///
+/// Common StatCodes returned by all UNDI commands, UNDI protocol functions
+/// and BC protocol functions.
+///
+#define PXE_STATCODE_SUCCESS              0x0000
+
+#define PXE_STATCODE_INVALID_CDB          0x0001
+#define PXE_STATCODE_INVALID_CPB          0x0002
+#define PXE_STATCODE_BUSY                 0x0003
+#define PXE_STATCODE_QUEUE_FULL           0x0004
+#define PXE_STATCODE_ALREADY_STARTED      0x0005
+#define PXE_STATCODE_NOT_STARTED          0x0006
+#define PXE_STATCODE_NOT_SHUTDOWN         0x0007
+#define PXE_STATCODE_ALREADY_INITIALIZED  0x0008
+#define PXE_STATCODE_NOT_INITIALIZED      0x0009
+#define PXE_STATCODE_DEVICE_FAILURE       0x000A
+#define PXE_STATCODE_NVDATA_FAILURE       0x000B
+#define PXE_STATCODE_UNSUPPORTED          0x000C
+#define PXE_STATCODE_BUFFER_FULL          0x000D
+#define PXE_STATCODE_INVALID_PARAMETER    0x000E
+#define PXE_STATCODE_INVALID_UNDI         0x000F
+#define PXE_STATCODE_IPV4_NOT_SUPPORTED   0x0010
+#define PXE_STATCODE_IPV6_NOT_SUPPORTED   0x0011
+#define PXE_STATCODE_NOT_ENOUGH_MEMORY    0x0012
+#define PXE_STATCODE_NO_DATA              0x0013
+
+typedef PXE_UINT16  PXE_IFNUM;
+
+///
+/// This interface number must be passed to the S/W UNDI Start command.
+///
+#define PXE_IFNUM_START 0x0000
+
+///
+/// This interface number is returned by the S/W UNDI Get State and
+/// Start commands if information in the CDB, CPB or DB is invalid.
+///
+#define PXE_IFNUM_INVALID 0x0000
+
+typedef PXE_UINT16  PXE_CONTROL;
+
+///
+/// Setting this flag directs the UNDI to queue this command for later
+/// execution if the UNDI is busy and it supports command queuing.
+/// If queuing is not supported, a PXE_STATCODE_INVALID_CONTROL error
+/// is returned.  If the queue is full, a PXE_STATCODE_CDB_QUEUE_FULL
+/// error is returned.
+///
+#define PXE_CONTROL_QUEUE_IF_BUSY 0x0002
+
+///
+/// These two bit values are used to determine if there are more UNDI
+/// CDB structures following this one.  If the link bit is set, there
+/// must be a CDB structure following this one.  Execution will start
+/// on the next CDB structure as soon as this one completes successfully.
+/// If an error is generated by this command, execution will stop.
+///
+#define PXE_CONTROL_LINK              0x0001
+#define PXE_CONTROL_LAST_CDB_IN_LIST  0x0000
+
+typedef PXE_UINT8   PXE_FRAME_TYPE;
+
+#define PXE_FRAME_TYPE_NONE                     0x00
+#define PXE_FRAME_TYPE_UNICAST                  0x01
+#define PXE_FRAME_TYPE_BROADCAST                0x02
+#define PXE_FRAME_TYPE_FILTERED_MULTICAST       0x03
+#define PXE_FRAME_TYPE_PROMISCUOUS              0x04
+#define PXE_FRAME_TYPE_PROMISCUOUS_MULTICAST    0x05
+
+#define PXE_FRAME_TYPE_MULTICAST                PXE_FRAME_TYPE_FILTERED_MULTICAST
+
+typedef PXE_UINT32  PXE_IPV4;
+
+typedef PXE_UINT32  PXE_IPV6[4];
+#define PXE_MAC_LENGTH  32
+
+typedef PXE_UINT8   PXE_MAC_ADDR[PXE_MAC_LENGTH];
+
+typedef PXE_UINT8   PXE_IFTYPE;
+typedef UINT16      PXE_MEDIA_PROTOCOL;
+
+///
+/// This information is from the ARP section of RFC 1700.
+///
+///     1 Ethernet (10Mb)                                    [JBP]
+///     2 Experimental Ethernet (3Mb)                        [JBP]
+///     3 Amateur Radio AX.25                                [PXK]
+///     4 Proteon ProNET Token Ring                          [JBP]
+///     5 Chaos                                              [GXP]
+///     6 IEEE 802 Networks                                  [JBP]
+///     7 ARCNET                                             [JBP]
+///     8 Hyperchannel                                       [JBP]
+///     9 Lanstar                                             [TU]
+///    10 Autonet Short Address                             [MXB1]
+///    11 LocalTalk                                         [JKR1]
+///    12 LocalNet (IBM* PCNet or SYTEK* LocalNET)           [JXM]
+///    13 Ultra link                                        [RXD2]
+///    14 SMDS                                              [GXC1]
+///    15 Frame Relay                                        [AGM]
+///    16 Asynchronous Transmission Mode (ATM)              [JXB2]
+///    17 HDLC                                               [JBP]
+///    18 Fibre Channel                            [Yakov Rekhter]
+///    19 Asynchronous Transmission Mode (ATM)      [Mark Laubach]
+///    20 Serial Line                                        [JBP]
+///    21 Asynchronous Transmission Mode (ATM)              [MXB1]
+///
+/// * Other names and brands may be claimed as the property of others.
+///
+#define PXE_IFTYPE_ETHERNET       0x01
+#define PXE_IFTYPE_TOKENRING      0x04
+#define PXE_IFTYPE_FIBRE_CHANNEL  0x12
+
+typedef struct s_pxe_hw_undi {
+  PXE_UINT32  Signature;      ///< PXE_ROMID_SIGNATURE
+  PXE_UINT8   Len;            ///< sizeof(PXE_HW_UNDI)
+  PXE_UINT8   Fudge;          ///< makes 8-bit cksum equal zero
+  PXE_UINT8   Rev;            ///< PXE_ROMID_REV
+  PXE_UINT8   IFcnt;          ///< physical connector count
+  PXE_UINT8   MajorVer;       ///< PXE_ROMID_MAJORVER
+  PXE_UINT8   MinorVer;       ///< PXE_ROMID_MINORVER
+  PXE_UINT16  reserved;       ///< zero, not used
+  PXE_UINT32  Implementation; ///< implementation flags
+  ///< reserved             ///< vendor use
+  ///< UINT32 Status;       ///< status port
+  ///< UINT32 Command;      ///< command port
+  ///< UINT64 CDBaddr;      ///< CDB address port
+  ///<
+} PXE_HW_UNDI;
+
+///
+/// Status port bit definitions
+///
+
+///
+/// UNDI operation state
+///
+#define PXE_HWSTAT_STATE_MASK   0xC0000000
+#define PXE_HWSTAT_BUSY         0xC0000000
+#define PXE_HWSTAT_INITIALIZED  0x80000000
+#define PXE_HWSTAT_STARTED      0x40000000
+#define PXE_HWSTAT_STOPPED      0x00000000
+
+///
+/// If set, last command failed
+///
+#define PXE_HWSTAT_COMMAND_FAILED 0x20000000
+
+///
+/// If set, identifies enabled receive filters
+///
+#define PXE_HWSTAT_PROMISCUOUS_MULTICAST_RX_ENABLED 0x00001000
+#define PXE_HWSTAT_PROMISCUOUS_RX_ENABLED           0x00000800
+#define PXE_HWSTAT_BROADCAST_RX_ENABLED             0x00000400
+#define PXE_HWSTAT_MULTICAST_RX_ENABLED             0x00000200
+#define PXE_HWSTAT_UNICAST_RX_ENABLED               0x00000100
+
+///
+/// If set, identifies enabled external interrupts
+///
+#define PXE_HWSTAT_SOFTWARE_INT_ENABLED     0x00000080
+#define PXE_HWSTAT_TX_COMPLETE_INT_ENABLED  0x00000040
+#define PXE_HWSTAT_PACKET_RX_INT_ENABLED    0x00000020
+#define PXE_HWSTAT_CMD_COMPLETE_INT_ENABLED 0x00000010
+
+///
+/// If set, identifies pending interrupts
+///
+#define PXE_HWSTAT_SOFTWARE_INT_PENDING     0x00000008
+#define PXE_HWSTAT_TX_COMPLETE_INT_PENDING  0x00000004
+#define PXE_HWSTAT_PACKET_RX_INT_PENDING    0x00000002
+#define PXE_HWSTAT_CMD_COMPLETE_INT_PENDING 0x00000001
+
+///
+/// Command port definitions
+///
+
+///
+/// If set, CDB identified in CDBaddr port is given to UNDI.
+/// If not set, other bits in this word will be processed.
+///
+#define PXE_HWCMD_ISSUE_COMMAND   0x80000000
+#define PXE_HWCMD_INTS_AND_FILTS  0x00000000
+
+///
+/// Use these to enable/disable receive filters.
+///
+#define PXE_HWCMD_PROMISCUOUS_MULTICAST_RX_ENABLE 0x00001000
+#define PXE_HWCMD_PROMISCUOUS_RX_ENABLE           0x00000800
+#define PXE_HWCMD_BROADCAST_RX_ENABLE             0x00000400
+#define PXE_HWCMD_MULTICAST_RX_ENABLE             0x00000200
+#define PXE_HWCMD_UNICAST_RX_ENABLE               0x00000100
+
+///
+/// Use these to enable/disable external interrupts
+///
+#define PXE_HWCMD_SOFTWARE_INT_ENABLE     0x00000080
+#define PXE_HWCMD_TX_COMPLETE_INT_ENABLE  0x00000040
+#define PXE_HWCMD_PACKET_RX_INT_ENABLE    0x00000020
+#define PXE_HWCMD_CMD_COMPLETE_INT_ENABLE 0x00000010
+
+///
+/// Use these to clear pending external interrupts
+///
+#define PXE_HWCMD_CLEAR_SOFTWARE_INT      0x00000008
+#define PXE_HWCMD_CLEAR_TX_COMPLETE_INT   0x00000004
+#define PXE_HWCMD_CLEAR_PACKET_RX_INT     0x00000002
+#define PXE_HWCMD_CLEAR_CMD_COMPLETE_INT  0x00000001
+
+typedef struct s_pxe_sw_undi {
+  PXE_UINT32  Signature;      ///< PXE_ROMID_SIGNATURE
+  PXE_UINT8   Len;            ///< sizeof(PXE_SW_UNDI)
+  PXE_UINT8   Fudge;          ///< makes 8-bit cksum zero
+  PXE_UINT8   Rev;            ///< PXE_ROMID_REV
+  PXE_UINT8   IFcnt;          ///< physical connector count
+  PXE_UINT8   MajorVer;       ///< PXE_ROMID_MAJORVER
+  PXE_UINT8   MinorVer;       ///< PXE_ROMID_MINORVER
+  PXE_UINT16  reserved1;      ///< zero, not used
+  PXE_UINT32  Implementation; ///< Implementation flags
+  PXE_UINT64  EntryPoint;     ///< API entry point
+  PXE_UINT8   reserved2[3];   ///< zero, not used
+  PXE_UINT8   BusCnt;         ///< number of bustypes supported
+  PXE_UINT32  BusType[1];     ///< list of supported bustypes
+} PXE_SW_UNDI;
+
+typedef union u_pxe_undi {
+  PXE_HW_UNDI hw;
+  PXE_SW_UNDI sw;
+} PXE_UNDI;
+
+///
+/// Signature of !PXE structure
+///
+#define PXE_ROMID_SIGNATURE PXE_BUSTYPE ('!', 'P', 'X', 'E')
+
+///
+/// !PXE structure format revision
+///
+#define PXE_ROMID_REV 0x02
+
+///
+/// UNDI command interface revision.  These are the values that get sent
+/// in option 94 (Client Network Interface Identifier) in the DHCP Discover
+/// and PXE Boot Server Request packets.
+///
+#define PXE_ROMID_MAJORVER    0x03
+#define PXE_ROMID_MINORVER    0x01
+
+///
+/// Implementation flags
+///
+#define PXE_ROMID_IMP_HW_UNDI                             0x80000000
+#define PXE_ROMID_IMP_SW_VIRT_ADDR                        0x40000000
+#define PXE_ROMID_IMP_64BIT_DEVICE                        0x00010000
+#define PXE_ROMID_IMP_FRAG_SUPPORTED                      0x00008000
+#define PXE_ROMID_IMP_CMD_LINK_SUPPORTED                  0x00004000
+#define PXE_ROMID_IMP_CMD_QUEUE_SUPPORTED                 0x00002000
+#define PXE_ROMID_IMP_MULTI_FRAME_SUPPORTED               0x00001000
+#define PXE_ROMID_IMP_NVDATA_SUPPORT_MASK                 0x00000C00
+#define PXE_ROMID_IMP_NVDATA_BULK_WRITABLE                0x00000C00
+#define PXE_ROMID_IMP_NVDATA_SPARSE_WRITABLE              0x00000800
+#define PXE_ROMID_IMP_NVDATA_READ_ONLY                    0x00000400
+#define PXE_ROMID_IMP_NVDATA_NOT_AVAILABLE                0x00000000
+#define PXE_ROMID_IMP_STATISTICS_SUPPORTED                0x00000200
+#define PXE_ROMID_IMP_STATION_ADDR_SETTABLE               0x00000100
+#define PXE_ROMID_IMP_PROMISCUOUS_MULTICAST_RX_SUPPORTED  0x00000080
+#define PXE_ROMID_IMP_PROMISCUOUS_RX_SUPPORTED            0x00000040
+#define PXE_ROMID_IMP_BROADCAST_RX_SUPPORTED              0x00000020
+#define PXE_ROMID_IMP_FILTERED_MULTICAST_RX_SUPPORTED     0x00000010
+#define PXE_ROMID_IMP_SOFTWARE_INT_SUPPORTED              0x00000008
+#define PXE_ROMID_IMP_TX_COMPLETE_INT_SUPPORTED           0x00000004
+#define PXE_ROMID_IMP_PACKET_RX_INT_SUPPORTED             0x00000002
+#define PXE_ROMID_IMP_CMD_COMPLETE_INT_SUPPORTED          0x00000001
+
+typedef struct s_pxe_cdb {
+  PXE_OPCODE    OpCode;
+  PXE_OPFLAGS   OpFlags;
+  PXE_UINT16    CPBsize;
+  PXE_UINT16    DBsize;
+  PXE_UINT64    CPBaddr;
+  PXE_UINT64    DBaddr;
+  PXE_STATCODE  StatCode;
+  PXE_STATFLAGS StatFlags;
+  PXE_UINT16    IFnum;
+  PXE_CONTROL   Control;
+} PXE_CDB;
+
+typedef union u_pxe_ip_addr {
+  PXE_IPV6  IPv6;
+  PXE_IPV4  IPv4;
+} PXE_IP_ADDR;
+
+typedef union pxe_device {
+  ///
+  /// PCI and PC Card NICs are both identified using bus, device
+  /// and function numbers.  For PC Card, this may require PC
+  /// Card services to be loaded in the BIOS or preboot
+  /// environment.
+  ///
+  struct {
+    ///
+    /// See S/W UNDI ROMID structure definition for PCI and
+    /// PCC BusType definitions.
+    ///
+    PXE_UINT32  BusType;
+
+    ///
+    /// Bus, device & function numbers that locate this device.
+    ///
+    PXE_UINT16  Bus;
+    PXE_UINT8   Device;
+    PXE_UINT8   Function;
+  }
+  PCI, PCC;
+
+} PXE_DEVICE;
+
+///
+/// cpb and db definitions
+///
+#define MAX_PCI_CONFIG_LEN    64  ///< # of dwords
+#define MAX_EEPROM_LEN        128 ///< # of dwords
+#define MAX_XMIT_BUFFERS      32  ///< recycling Q length for xmit_done
+#define MAX_MCAST_ADDRESS_CNT 8
+
+typedef struct s_pxe_cpb_start_30 {
+  ///
+  /// PXE_VOID Delay(UINTN microseconds);
+  ///
+  /// UNDI will never request a delay smaller than 10 microseconds
+  /// and will always request delays in increments of 10 microseconds.
+  /// The Delay() CallBack routine must delay between n and n + 10
+  /// microseconds before returning control to the UNDI.
+  ///
+  /// This field cannot be set to zero.
+  ///
+  UINT64  Delay;
+
+  ///
+  /// PXE_VOID Block(UINT32 enable);
+  ///
+  /// UNDI may need to block multi-threaded/multi-processor access to
+  /// critical code sections when programming or accessing the network
+  /// device.  To this end, a blocking service is needed by the UNDI.
+  /// When UNDI needs a block, it will call Block() passing a non-zero
+  /// value.  When UNDI no longer needs a block, it will call Block()
+  /// with a zero value.  When called, if the Block() is already enabled,
+  /// do not return control to the UNDI until the previous Block() is
+  /// disabled.
+  ///
+  /// This field cannot be set to zero.
+  ///
+  UINT64  Block;
+
+  ///
+  /// PXE_VOID Virt2Phys(UINT64 virtual, UINT64 physical_ptr);
+  ///
+  /// UNDI will pass the virtual address of a buffer and the virtual
+  /// address of a 64-bit physical buffer.  Convert the virtual address
+  /// to a physical address and write the result to the physical address
+  /// buffer.  If virtual and physical addresses are the same, just
+  /// copy the virtual address to the physical address buffer.
+  ///
+  /// This field can be set to zero if virtual and physical addresses
+  /// are equal.
+  ///
+  UINT64  Virt2Phys;
+  ///
+  /// PXE_VOID Mem_IO(UINT8 read_write, UINT8 len, UINT64 port,
+  ///              UINT64 buf_addr);
+  ///
+  /// UNDI will read or write the device io space using this call back
+  /// function. It passes the number of bytes as the len parameter and it
+  /// will be either 1,2,4 or 8.
+  ///
+  /// This field can not be set to zero.
+  ///
+  UINT64  Mem_IO;
+} PXE_CPB_START_30;
+
+typedef struct s_pxe_cpb_start_31 {
+  ///
+  /// PXE_VOID Delay(UINT64 UnqId, UINTN microseconds);
+  ///
+  /// UNDI will never request a delay smaller than 10 microseconds
+  /// and will always request delays in increments of 10 microseconds.
+  /// The Delay() CallBack routine must delay between n and n + 10
+  /// microseconds before returning control to the UNDI.
+  ///
+  /// This field cannot be set to zero.
+  ///
+  UINT64  Delay;
+
+  ///
+  /// PXE_VOID Block(UINT64 unq_id, UINT32 enable);
+  ///
+  /// UNDI may need to block multi-threaded/multi-processor access to
+  /// critical code sections when programming or accessing the network
+  /// device.  To this end, a blocking service is needed by the UNDI.
+  /// When UNDI needs a block, it will call Block() passing a non-zero
+  /// value.  When UNDI no longer needs a block, it will call Block()
+  /// with a zero value.  When called, if the Block() is already enabled,
+  /// do not return control to the UNDI until the previous Block() is
+  /// disabled.
+  ///
+  /// This field cannot be set to zero.
+  ///
+  UINT64  Block;
+
+  ///
+  /// PXE_VOID Virt2Phys(UINT64 UnqId, UINT64 virtual, UINT64 physical_ptr);
+  ///
+  /// UNDI will pass the virtual address of a buffer and the virtual
+  /// address of a 64-bit physical buffer.  Convert the virtual address
+  /// to a physical address and write the result to the physical address
+  /// buffer.  If virtual and physical addresses are the same, just
+  /// copy the virtual address to the physical address buffer.
+  ///
+  /// This field can be set to zero if virtual and physical addresses
+  /// are equal.
+  ///
+  UINT64  Virt2Phys;
+  ///
+  /// PXE_VOID Mem_IO(UINT64 UnqId, UINT8 read_write, UINT8 len, UINT64 port,
+  ///              UINT64 buf_addr);
+  ///
+  /// UNDI will read or write the device io space using this call back
+  /// function. It passes the number of bytes as the len parameter and it
+  /// will be either 1,2,4 or 8.
+  ///
+  /// This field can not be set to zero.
+  ///
+  UINT64  Mem_IO;
+  ///
+  /// PXE_VOID Map_Mem(UINT64 unq_id, UINT64 virtual_addr, UINT32 size,
+  ///                 UINT32 Direction, UINT64 mapped_addr);
+  ///
+  /// UNDI will pass the virtual address of a buffer, direction of the data
+  /// flow from/to the mapped buffer (the constants are defined below)
+  /// and a place holder (pointer) for the mapped address.
+  /// This call will Map the given address to a physical DMA address and write
+  /// the result to the mapped_addr pointer.  If there is no need to
+  /// map the given address to a lower address (i.e. the given address is
+  /// associated with a physical address that is already compatible to be
+  /// used with the DMA, it converts the given virtual address to it's
+  /// physical address and write that in the mapped address pointer.
+  ///
+  /// This field can be set to zero if there is no mapping service available
+  ///
+  UINT64  Map_Mem;
+
+  ///
+  /// PXE_VOID UnMap_Mem(UINT64 unq_id, UINT64 virtual_addr, UINT32 size,
+  ///            UINT32 Direction, UINT64 mapped_addr);
+  ///
+  /// UNDI will pass the virtual and mapped addresses of a buffer
+  /// This call will un map the given address
+  ///
+  /// This field can be set to zero if there is no unmapping service available
+  ///
+  UINT64  UnMap_Mem;
+
+  ///
+  /// PXE_VOID Sync_Mem(UINT64 unq_id, UINT64 virtual,
+  ///            UINT32 size, UINT32 Direction, UINT64 mapped_addr);
+  ///
+  /// UNDI will pass the virtual and mapped addresses of a buffer
+  /// This call will synchronize the contents of both the virtual and mapped
+  /// buffers for the given Direction.
+  ///
+  /// This field can be set to zero if there is no service available
+  ///
+  UINT64  Sync_Mem;
+
+  ///
+  /// protocol driver can provide anything for this Unique_ID, UNDI remembers
+  /// that as just a 64bit value assocaited to the interface specified by
+  /// the ifnum and gives it back as a parameter to all the call-back routines
+  /// when calling for that interface!
+  ///
+  UINT64  Unique_ID;
+} PXE_CPB_START_31;
+
+#define TO_AND_FROM_DEVICE    0
+#define FROM_DEVICE           1
+#define TO_DEVICE             2
+
+#define PXE_DELAY_MILLISECOND 1000
+#define PXE_DELAY_SECOND      1000000
+#define PXE_IO_READ           0
+#define PXE_IO_WRITE          1
+#define PXE_MEM_READ          2
+#define PXE_MEM_WRITE         4
+
+typedef struct s_pxe_db_get_init_info {
+  ///
+  /// Minimum length of locked memory buffer that must be given to
+  /// the Initialize command. Giving UNDI more memory will generally
+  /// give better performance.
+  ///
+  /// If MemoryRequired is zero, the UNDI does not need and will not
+  /// use system memory to receive and transmit packets.
+  ///
+  PXE_UINT32  MemoryRequired;
+
+  ///
+  /// Maximum frame data length for Tx/Rx excluding the media header.
+  ///
+  PXE_UINT32  FrameDataLen;
+
+  ///
+  /// Supported link speeds are in units of mega bits.  Common ethernet
+  /// values are 10, 100 and 1000.  Unused LinkSpeeds[] entries are zero
+  /// filled.
+  ///
+  PXE_UINT32  LinkSpeeds[4];
+
+  ///
+  /// Number of non-volatile storage items.
+  ///
+  PXE_UINT32  NvCount;
+
+  ///
+  /// Width of non-volatile storage item in bytes.  0, 1, 2 or 4
+  ///
+  PXE_UINT16  NvWidth;
+
+  ///
+  /// Media header length.  This is the typical media header length for
+  /// this UNDI.  This information is needed when allocating receive
+  /// and transmit buffers.
+  ///
+  PXE_UINT16  MediaHeaderLen;
+
+  ///
+  /// Number of bytes in the NIC hardware (MAC) address.
+  ///
+  PXE_UINT16  HWaddrLen;
+
+  ///
+  /// Maximum number of multicast MAC addresses in the multicast
+  /// MAC address filter list.
+  ///
+  PXE_UINT16  MCastFilterCnt;
+
+  ///
+  /// Default number and size of transmit and receive buffers that will
+  /// be allocated by the UNDI.  If MemoryRequired is non-zero, this
+  /// allocation will come out of the memory buffer given to the Initialize
+  /// command.  If MemoryRequired is zero, this allocation will come out of
+  /// memory on the NIC.
+  ///
+  PXE_UINT16  TxBufCnt;
+  PXE_UINT16  TxBufSize;
+  PXE_UINT16  RxBufCnt;
+  PXE_UINT16  RxBufSize;
+
+  ///
+  /// Hardware interface types defined in the Assigned Numbers RFC
+  /// and used in DHCP and ARP packets.
+  /// See the PXE_IFTYPE typedef and PXE_IFTYPE_xxx macros.
+  ///
+  PXE_UINT8   IFtype;
+
+  ///
+  /// Supported duplex.  See PXE_DUPLEX_xxxxx #defines below.
+  ///
+  PXE_UINT8   SupportedDuplexModes;
+
+  ///
+  /// Supported loopback options.  See PXE_LOOPBACK_xxxxx #defines below.
+  ///
+  PXE_UINT8   SupportedLoopBackModes;
+} PXE_DB_GET_INIT_INFO;
+
+#define PXE_MAX_TXRX_UNIT_ETHER           1500
+
+#define PXE_HWADDR_LEN_ETHER              0x0006
+#define PXE_MAC_HEADER_LEN_ETHER          0x000E
+
+#define PXE_DUPLEX_ENABLE_FULL_SUPPORTED  1
+#define PXE_DUPLEX_FORCE_FULL_SUPPORTED   2
+
+#define PXE_LOOPBACK_INTERNAL_SUPPORTED   1
+#define PXE_LOOPBACK_EXTERNAL_SUPPORTED   2
+
+typedef struct s_pxe_pci_config_info {
+  ///
+  /// This is the flag field for the PXE_DB_GET_CONFIG_INFO union.
+  /// For PCI bus devices, this field is set to PXE_BUSTYPE_PCI.
+  ///
+  UINT32  BusType;
+
+  ///
+  /// This identifies the PCI network device that this UNDI interface
+  /// is bound to.
+  ///
+  UINT16  Bus;
+  UINT8   Device;
+  UINT8   Function;
+
+  ///
+  /// This is a copy of the PCI configuration space for this
+  /// network device.
+  ///
+  union {
+    UINT8   Byte[256];
+    UINT16  Word[128];
+    UINT32  Dword[64];
+  } Config;
+} PXE_PCI_CONFIG_INFO;
+
+typedef struct s_pxe_pcc_config_info {
+  ///
+  /// This is the flag field for the PXE_DB_GET_CONFIG_INFO union.
+  /// For PCC bus devices, this field is set to PXE_BUSTYPE_PCC.
+  ///
+  PXE_UINT32  BusType;
+
+  ///
+  /// This identifies the PCC network device that this UNDI interface
+  /// is bound to.
+  ///
+  PXE_UINT16  Bus;
+  PXE_UINT8   Device;
+  PXE_UINT8   Function;
+
+  ///
+  /// This is a copy of the PCC configuration space for this
+  /// network device.
+  ///
+  union {
+    PXE_UINT8   Byte[256];
+    PXE_UINT16  Word[128];
+    PXE_UINT32  Dword[64];
+  } Config;
+} PXE_PCC_CONFIG_INFO;
+
+typedef union u_pxe_db_get_config_info {
+  PXE_PCI_CONFIG_INFO   pci;
+  PXE_PCC_CONFIG_INFO   pcc;
+} PXE_DB_GET_CONFIG_INFO;
+
+typedef struct s_pxe_cpb_initialize {
+  ///
+  /// Address of first (lowest) byte of the memory buffer.  This buffer must
+  /// be in contiguous physical memory and cannot be swapped out.  The UNDI
+  /// will be using this for transmit and receive buffering.
+  ///
+  PXE_UINT64  MemoryAddr;
+
+  ///
+  /// MemoryLength must be greater than or equal to MemoryRequired
+  /// returned by the Get Init Info command.
+  ///
+  PXE_UINT32  MemoryLength;
+
+  ///
+  /// Desired link speed in Mbit/sec.  Common ethernet values are 10, 100
+  /// and 1000.  Setting a value of zero will auto-detect and/or use the
+  /// default link speed (operation depends on UNDI/NIC functionality).
+  ///
+  PXE_UINT32  LinkSpeed;
+
+  ///
+  /// Suggested number and size of receive and transmit buffers to
+  /// allocate.  If MemoryAddr and MemoryLength are non-zero, this
+  /// allocation comes out of the supplied memory buffer.  If MemoryAddr
+  /// and MemoryLength are zero, this allocation comes out of memory
+  /// on the NIC.
+  ///
+  /// If these fields are set to zero, the UNDI will allocate buffer
+  /// counts and sizes as it sees fit.
+  ///
+  PXE_UINT16  TxBufCnt;
+  PXE_UINT16  TxBufSize;
+  PXE_UINT16  RxBufCnt;
+  PXE_UINT16  RxBufSize;
+
+  ///
+  /// The following configuration parameters are optional and must be zero
+  /// to use the default values.
+  ///
+  PXE_UINT8   DuplexMode;
+
+  PXE_UINT8   LoopBackMode;
+} PXE_CPB_INITIALIZE;
+
+#define PXE_DUPLEX_DEFAULT      0x00
+#define PXE_FORCE_FULL_DUPLEX   0x01
+#define PXE_ENABLE_FULL_DUPLEX  0x02
+#define PXE_FORCE_HALF_DUPLEX   0x04
+#define PXE_DISABLE_FULL_DUPLEX 0x08
+
+#define LOOPBACK_NORMAL         0
+#define LOOPBACK_INTERNAL       1
+#define LOOPBACK_EXTERNAL       2
+
+typedef struct s_pxe_db_initialize {
+  ///
+  /// Actual amount of memory used from the supplied memory buffer.  This
+  /// may be less that the amount of memory suppllied and may be zero if
+  /// the UNDI and network device do not use external memory buffers.
+  ///
+  /// Memory used by the UNDI and network device is allocated from the
+  /// lowest memory buffer address.
+  ///
+  PXE_UINT32  MemoryUsed;
+
+  ///
+  /// Actual number and size of receive and transmit buffers that were
+  /// allocated.
+  ///
+  PXE_UINT16  TxBufCnt;
+  PXE_UINT16  TxBufSize;
+  PXE_UINT16  RxBufCnt;
+  PXE_UINT16  RxBufSize;
+} PXE_DB_INITIALIZE;
+
+typedef struct s_pxe_cpb_receive_filters {
+  ///
+  /// List of multicast MAC addresses.  This list, if present, will
+  /// replace the existing multicast MAC address filter list.
+  ///
+  PXE_MAC_ADDR  MCastList[MAX_MCAST_ADDRESS_CNT];
+} PXE_CPB_RECEIVE_FILTERS;
+
+typedef struct s_pxe_db_receive_filters {
+  ///
+  /// Filtered multicast MAC address list.
+  ///
+  PXE_MAC_ADDR  MCastList[MAX_MCAST_ADDRESS_CNT];
+} PXE_DB_RECEIVE_FILTERS;
+
+typedef struct s_pxe_cpb_station_address {
+  ///
+  /// If supplied and supported, the current station MAC address
+  /// will be changed.
+  ///
+  PXE_MAC_ADDR  StationAddr;
+} PXE_CPB_STATION_ADDRESS;
+
+typedef struct s_pxe_dpb_station_address {
+  ///
+  /// Current station MAC address.
+  ///
+  PXE_MAC_ADDR  StationAddr;
+
+  ///
+  /// Station broadcast MAC address.
+  ///
+  PXE_MAC_ADDR  BroadcastAddr;
+
+  ///
+  /// Permanent station MAC address.
+  ///
+  PXE_MAC_ADDR  PermanentAddr;
+} PXE_DB_STATION_ADDRESS;
+
+typedef struct s_pxe_db_statistics {
+  ///
+  /// Bit field identifying what statistic data is collected by the
+  /// UNDI/NIC.
+  /// If bit 0x00 is set, Data[0x00] is collected.
+  /// If bit 0x01 is set, Data[0x01] is collected.
+  /// If bit 0x20 is set, Data[0x20] is collected.
+  /// If bit 0x21 is set, Data[0x21] is collected.
+  /// Etc.
+  ///
+  PXE_UINT64  Supported;
+
+  ///
+  /// Statistic data.
+  ///
+  PXE_UINT64  Data[64];
+} PXE_DB_STATISTICS;
+
+///
+/// Total number of frames received.  Includes frames with errors and
+/// dropped frames.
+///
+#define PXE_STATISTICS_RX_TOTAL_FRAMES  0x00
+
+///
+/// Number of valid frames received and copied into receive buffers.
+///
+#define PXE_STATISTICS_RX_GOOD_FRAMES 0x01
+
+///
+/// Number of frames below the minimum length for the media.
+/// This would be <64 for ethernet.
+///
+#define PXE_STATISTICS_RX_UNDERSIZE_FRAMES  0x02
+
+///
+/// Number of frames longer than the maxminum length for the
+/// media.  This would be >1500 for ethernet.
+///
+#define PXE_STATISTICS_RX_OVERSIZE_FRAMES 0x03
+
+///
+/// Valid frames that were dropped because receive buffers were full.
+///
+#define PXE_STATISTICS_RX_DROPPED_FRAMES  0x04
+
+///
+/// Number of valid unicast frames received and not dropped.
+///
+#define PXE_STATISTICS_RX_UNICAST_FRAMES  0x05
+
+///
+/// Number of valid broadcast frames received and not dropped.
+///
+#define PXE_STATISTICS_RX_BROADCAST_FRAMES  0x06
+
+///
+/// Number of valid mutlicast frames received and not dropped.
+///
+#define PXE_STATISTICS_RX_MULTICAST_FRAMES  0x07
+
+///
+/// Number of frames w/ CRC or alignment errors.
+///
+#define PXE_STATISTICS_RX_CRC_ERROR_FRAMES  0x08
+
+///
+/// Total number of bytes received.  Includes frames with errors
+/// and dropped frames.
+///
+#define PXE_STATISTICS_RX_TOTAL_BYTES 0x09
+
+///
+/// Transmit statistics.
+///
+#define PXE_STATISTICS_TX_TOTAL_FRAMES      0x0A
+#define PXE_STATISTICS_TX_GOOD_FRAMES       0x0B
+#define PXE_STATISTICS_TX_UNDERSIZE_FRAMES  0x0C
+#define PXE_STATISTICS_TX_OVERSIZE_FRAMES   0x0D
+#define PXE_STATISTICS_TX_DROPPED_FRAMES    0x0E
+#define PXE_STATISTICS_TX_UNICAST_FRAMES    0x0F
+#define PXE_STATISTICS_TX_BROADCAST_FRAMES  0x10
+#define PXE_STATISTICS_TX_MULTICAST_FRAMES  0x11
+#define PXE_STATISTICS_TX_CRC_ERROR_FRAMES  0x12
+#define PXE_STATISTICS_TX_TOTAL_BYTES       0x13
+
+///
+/// Number of collisions detection on this subnet.
+///
+#define PXE_STATISTICS_COLLISIONS 0x14
+
+///
+/// Number of frames destined for unsupported protocol.
+///
+#define PXE_STATISTICS_UNSUPPORTED_PROTOCOL 0x15
+
+typedef struct s_pxe_cpb_mcast_ip_to_mac {
+  ///
+  /// Multicast IP address to be converted to multicast MAC address.
+  ///
+  PXE_IP_ADDR IP;
+} PXE_CPB_MCAST_IP_TO_MAC;
+
+typedef struct s_pxe_db_mcast_ip_to_mac {
+  ///
+  /// Multicast MAC address.
+  ///
+  PXE_MAC_ADDR  MAC;
+} PXE_DB_MCAST_IP_TO_MAC;
+
+typedef struct s_pxe_cpb_nvdata_sparse {
+  ///
+  /// NvData item list.  Only items in this list will be updated.
+  ///
+  struct {
+    ///
+    ///  Non-volatile storage address to be changed.
+    ///
+    PXE_UINT32  Addr;
+
+    ///
+    /// Data item to write into above storage address.
+    ///
+    union {
+      PXE_UINT8   Byte;
+      PXE_UINT16  Word;
+      PXE_UINT32  Dword;
+    } Data;
+  } Item[MAX_EEPROM_LEN];
+} PXE_CPB_NVDATA_SPARSE;
+
+///
+/// When using bulk update, the size of the CPB structure must be
+/// the same size as the non-volatile NIC storage.
+///
+typedef union u_pxe_cpb_nvdata_bulk {
+  ///
+  /// Array of byte-wide data items.
+  ///
+  PXE_UINT8   Byte[MAX_EEPROM_LEN << 2];
+
+  ///
+  /// Array of word-wide data items.
+  ///
+  PXE_UINT16  Word[MAX_EEPROM_LEN << 1];
+
+  ///
+  /// Array of dword-wide data items.
+  ///
+  PXE_UINT32  Dword[MAX_EEPROM_LEN];
+} PXE_CPB_NVDATA_BULK;
+
+typedef struct s_pxe_db_nvdata {
+  ///
+  /// Arrays of data items from non-volatile storage.
+  ///
+  union {
+    ///
+    /// Array of byte-wide data items.
+    ///
+    PXE_UINT8   Byte[MAX_EEPROM_LEN << 2];
+
+    ///
+    /// Array of word-wide data items.
+    ///
+    PXE_UINT16  Word[MAX_EEPROM_LEN << 1];
+
+    ///
+    /// Array of dword-wide data items.
+    ///
+    PXE_UINT32  Dword[MAX_EEPROM_LEN];
+  } Data;
+} PXE_DB_NVDATA;
+
+typedef struct s_pxe_db_get_status {
+  ///
+  /// Length of next receive frame (header + data).  If this is zero,
+  /// there is no next receive frame available.
+  ///
+  PXE_UINT32  RxFrameLen;
+
+  ///
+  /// Reserved, set to zero.
+  ///
+  PXE_UINT32  reserved;
+
+  ///
+  ///  Addresses of transmitted buffers that need to be recycled.
+  ///
+  PXE_UINT64  TxBuffer[MAX_XMIT_BUFFERS];
+} PXE_DB_GET_STATUS;
+
+typedef struct s_pxe_cpb_fill_header {
+  ///
+  /// Source and destination MAC addresses.  These will be copied into
+  /// the media header without doing byte swapping.
+  ///
+  PXE_MAC_ADDR  SrcAddr;
+  PXE_MAC_ADDR  DestAddr;
+
+  ///
+  /// Address of first byte of media header.  The first byte of packet data
+  /// follows the last byte of the media header.
+  ///
+  PXE_UINT64        MediaHeader;
+
+  ///
+  /// Length of packet data in bytes (not including the media header).
+  ///
+  PXE_UINT32        PacketLen;
+
+  ///
+  /// Protocol type.  This will be copied into the media header without
+  /// doing byte swapping.  Protocol type numbers can be obtained from
+  /// the Assigned Numbers RFC 1700.
+  ///
+  PXE_UINT16        Protocol;
+
+  ///
+  /// Length of the media header in bytes.
+  ///
+  PXE_UINT16        MediaHeaderLen;
+} PXE_CPB_FILL_HEADER;
+
+#define PXE_PROTOCOL_ETHERNET_IP  0x0800
+#define PXE_PROTOCOL_ETHERNET_ARP 0x0806
+#define MAX_XMIT_FRAGMENTS        16
+
+typedef struct s_pxe_cpb_fill_header_fragmented {
+  ///
+  /// Source and destination MAC addresses.  These will be copied into
+  /// the media header without doing byte swapping.
+  ///
+  PXE_MAC_ADDR        SrcAddr;
+  PXE_MAC_ADDR        DestAddr;
+
+  ///
+  /// Length of packet data in bytes (not including the media header).
+  ///
+  PXE_UINT32          PacketLen;
+
+  ///
+  /// Protocol type.  This will be copied into the media header without
+  /// doing byte swapping.  Protocol type numbers can be obtained from
+  /// the Assigned Numbers RFC 1700.
+  ///
+  PXE_MEDIA_PROTOCOL  Protocol;
+
+  ///
+  /// Length of the media header in bytes.
+  ///
+  PXE_UINT16          MediaHeaderLen;
+
+  ///
+  /// Number of packet fragment descriptors.
+  ///
+  PXE_UINT16          FragCnt;
+
+  ///
+  /// Reserved, must be set to zero.
+  ///
+  PXE_UINT16          reserved;
+
+  ///
+  /// Array of packet fragment descriptors.  The first byte of the media
+  /// header is the first byte of the first fragment.
+  ///
+  struct {
+    ///
+    /// Address of this packet fragment.
+    ///
+    PXE_UINT64  FragAddr;
+
+    ///
+    /// Length of this packet fragment.
+    ///
+    PXE_UINT32  FragLen;
+
+    ///
+    /// Reserved, must be set to zero.
+    ///
+    PXE_UINT32  reserved;
+  } FragDesc[MAX_XMIT_FRAGMENTS];
+}
+PXE_CPB_FILL_HEADER_FRAGMENTED;
+
+typedef struct s_pxe_cpb_transmit {
+  ///
+  /// Address of first byte of frame buffer.  This is also the first byte
+  /// of the media header.
+  ///
+  PXE_UINT64  FrameAddr;
+
+  ///
+  /// Length of the data portion of the frame buffer in bytes.  Do not
+  /// include the length of the media header.
+  ///
+  PXE_UINT32  DataLen;
+
+  ///
+  /// Length of the media header in bytes.
+  ///
+  PXE_UINT16  MediaheaderLen;
+
+  ///
+  /// Reserved, must be zero.
+  ///
+  PXE_UINT16  reserved;
+} PXE_CPB_TRANSMIT;
+
+typedef struct s_pxe_cpb_transmit_fragments {
+  ///
+  /// Length of packet data in bytes (not including the media header).
+  ///
+  PXE_UINT32  FrameLen;
+
+  ///
+  /// Length of the media header in bytes.
+  ///
+  PXE_UINT16  MediaheaderLen;
+
+  ///
+  /// Number of packet fragment descriptors.
+  ///
+  PXE_UINT16  FragCnt;
+
+  ///
+  /// Array of frame fragment descriptors.  The first byte of the first
+  /// fragment is also the first byte of the media header.
+  ///
+  struct {
+    ///
+    /// Address of this frame fragment.
+    ///
+    PXE_UINT64  FragAddr;
+
+    ///
+    /// Length of this frame fragment.
+    ///
+    PXE_UINT32  FragLen;
+
+    ///
+    /// Reserved, must be set to zero.
+    ///
+    PXE_UINT32  reserved;
+  } FragDesc[MAX_XMIT_FRAGMENTS];
+}
+PXE_CPB_TRANSMIT_FRAGMENTS;
+
+typedef struct s_pxe_cpb_receive {
+  ///
+  /// Address of first byte of receive buffer.  This is also the first byte
+  /// of the frame header.
+  ///
+  PXE_UINT64  BufferAddr;
+
+  ///
+  /// Length of receive buffer.  This must be large enough to hold the
+  /// received frame (media header + data).  If the length of smaller than
+  /// the received frame, data will be lost.
+  ///
+  PXE_UINT32  BufferLen;
+
+  ///
+  /// Reserved, must be set to zero.
+  ///
+  PXE_UINT32  reserved;
+} PXE_CPB_RECEIVE;
+
+typedef struct s_pxe_db_receive {
+  ///
+  /// Source and destination MAC addresses from media header.
+  ///
+  PXE_MAC_ADDR        SrcAddr;
+  PXE_MAC_ADDR        DestAddr;
+
+  ///
+  /// Length of received frame.  May be larger than receive buffer size.
+  /// The receive buffer will not be overwritten.  This is how to tell
+  /// if data was lost because the receive buffer was too small.
+  ///
+  PXE_UINT32          FrameLen;
+
+  ///
+  /// Protocol type from media header.
+  ///
+  PXE_MEDIA_PROTOCOL  Protocol;
+
+  ///
+  /// Length of media header in received frame.
+  ///
+  PXE_UINT16          MediaHeaderLen;
+
+  ///
+  /// Type of receive frame.
+  ///
+  PXE_FRAME_TYPE      Type;
+
+  ///
+  /// Reserved, must be zero.
+  ///
+  PXE_UINT8           reserved[7];
+
+} PXE_DB_RECEIVE;
+
+#pragma pack()
+
+#endif
diff --git a/src/include/ipxe/efi/Uefi/UefiSpec.h b/src/include/ipxe/efi/Uefi/UefiSpec.h
new file mode 100644
index 0000000..4d34b19
--- /dev/null
+++ b/src/include/ipxe/efi/Uefi/UefiSpec.h
@@ -0,0 +1,1916 @@
+/** @file
+  Include file that supports UEFI.
+
+  This include file must only contain things defined in the UEFI 2.1 specification.
+  If a code construct is defined in the UEFI 2.1 specification it must be included
+  by this include file.
+
+  Copyright (c) 2006 - 2008, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __UEFI_SPEC_H__
+#define __UEFI_SPEC_H__
+
+#include <ipxe/efi/Uefi/UefiMultiPhase.h>
+
+#include <ipxe/efi/Protocol/DevicePath.h>
+#include <ipxe/efi/Protocol/SimpleTextIn.h>
+#include <ipxe/efi/Protocol/SimpleTextOut.h>
+
+///
+/// Enumeration of memory allocation.
+///
+typedef enum {
+  AllocateAnyPages,
+  AllocateMaxAddress,
+  AllocateAddress,
+  MaxAllocateType
+} EFI_ALLOCATE_TYPE;
+
+//
+// Bit definitions for EFI_TIME.Daylight
+//
+#define EFI_TIME_ADJUST_DAYLIGHT  0x01
+#define EFI_TIME_IN_DAYLIGHT      0x02
+
+///
+/// Value definition for EFI_TIME.TimeZone
+///
+#define EFI_UNSPECIFIED_TIMEZONE  0x07FF
+
+//
+// Memory cacheability attributes
+//
+#define EFI_MEMORY_UC   0x0000000000000001ULL
+#define EFI_MEMORY_WC   0x0000000000000002ULL
+#define EFI_MEMORY_WT   0x0000000000000004ULL
+#define EFI_MEMORY_WB   0x0000000000000008ULL
+#define EFI_MEMORY_UCE  0x0000000000000010ULL
+//
+// Physical memory protection attributes
+//
+#define EFI_MEMORY_WP   0x0000000000001000ULL
+#define EFI_MEMORY_RP   0x0000000000002000ULL
+#define EFI_MEMORY_XP   0x0000000000004000ULL
+//
+// Runtime memory attribute
+//
+#define EFI_MEMORY_RUNTIME  0x8000000000000000ULL
+
+///
+/// Memory descriptor version number
+///
+#define EFI_MEMORY_DESCRIPTOR_VERSION 1
+
+///
+/// Definition of memory descriptor
+///
+typedef struct {
+  UINT32                Type;
+  EFI_PHYSICAL_ADDRESS  PhysicalStart;
+  EFI_VIRTUAL_ADDRESS   VirtualStart;
+  UINT64                NumberOfPages;
+  UINT64                Attribute;
+} EFI_MEMORY_DESCRIPTOR;
+
+///
+/// Build macros to find next EFI_MEMORY_DESCRIPTOR.
+///
+#define NEXT_MEMORY_DESCRIPTOR(_Ptr, _Size)   ((EFI_MEMORY_DESCRIPTOR *) (((UINT8 *) (_Ptr)) + (_Size)))
+
+///
+/// Declare forward referenced data structures
+///
+typedef struct _EFI_SYSTEM_TABLE   EFI_SYSTEM_TABLE;
+
+/**
+  Allocates memory pages from the system.
+
+  @param  Type        The type of allocation to perform.
+  @param  MemoryType  The type of memory to allocate.
+  @param  Pages       The number of contiguous 4 KB pages to allocate.
+  @param  Memory      Pointer to a physical address. On input, the way in which the address is
+                      used depends on the value of Type.
+
+  @retval EFI_SUCCESS           The requested pages were allocated.
+  @retval EFI_INVALID_PARAMETER 1) Type is not AllocateAnyPages or
+                                AllocateMaxAddress or AllocateAddress.
+                                2) MemoryType is in the range
+                                EfiMaxMemoryType..0x7FFFFFFF.
+  @retval EFI_OUT_OF_RESOURCES  The pages could not be allocated.
+  @retval EFI_NOT_FOUND         The requested pages could not be found.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_ALLOCATE_PAGES)(
+  IN     EFI_ALLOCATE_TYPE            Type,
+  IN     EFI_MEMORY_TYPE              MemoryType,
+  IN     UINTN                        Pages,
+  IN OUT EFI_PHYSICAL_ADDRESS         *Memory
+  );
+
+/**
+  Frees memory pages.
+
+  @param  Memory      The base physical address of the pages to be freed.
+  @param  Pages       The number of contiguous 4 KB pages to free.
+
+  @retval EFI_SUCCESS           The requested pages were freed.
+  @retval EFI_INVALID_PARAMETER Memory is not a page-aligned address or Pages is invalid.
+  @retval EFI_NOT_FOUND         The requested memory pages were not allocated with
+                                AllocatePages().
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_FREE_PAGES)(
+  IN  EFI_PHYSICAL_ADDRESS         Memory,
+  IN  UINTN                        Pages
+  );
+
+/**
+  Returns the current memory map.
+
+  @param  MemoryMapSize         A pointer to the size, in bytes, of the MemoryMap buffer.
+                                On input, this is the size of the buffer allocated by the caller.
+                                On output, it is the size of the buffer returned by the firmware if
+                                the buffer was large enough, or the size of the buffer needed to contain
+                                the map if the buffer was too small.
+  @param  MemoryMap             A pointer to the buffer in which firmware places the current memory
+                                map.
+  @param  MapKey                A pointer to the location in which firmware returns the key for the
+                                current memory map.
+  @param  DescriptorSize        A pointer to the location in which firmware returns the size, in bytes, of
+                                an individual EFI_MEMORY_DESCRIPTOR.
+  @param  DescriptorVersion     A pointer to the location in which firmware returns the version number
+                                associated with the EFI_MEMORY_DESCRIPTOR.
+
+  @retval EFI_SUCCESS           The memory map was returned in the MemoryMap buffer.
+  @retval EFI_BUFFER_TOO_SMALL  The MemoryMap buffer was too small. The current buffer size
+                                needed to hold the memory map is returned in MemoryMapSize.
+  @retval EFI_INVALID_PARAMETER 1) MemoryMapSize is NULL.
+                                2) The MemoryMap buffer is not too small and MemoryMap is
+                                   NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_MEMORY_MAP)(
+  IN OUT UINTN                       *MemoryMapSize,
+  IN OUT EFI_MEMORY_DESCRIPTOR       *MemoryMap,
+  OUT    UINTN                       *MapKey,
+  OUT    UINTN                       *DescriptorSize,
+  OUT    UINT32                      *DescriptorVersion
+  );
+
+/**
+  Allocates pool memory.
+
+  @param  PoolType              The type of pool to allocate.
+  @param  Size                  The number of bytes to allocate from the pool.
+  @param  Buffer                A pointer to a pointer to the allocated buffer if the call succeeds;
+                                undefined otherwise.
+
+  @retval EFI_SUCCESS           The requested number of bytes was allocated.
+  @retval EFI_OUT_OF_RESOURCES  The pool requested could not be allocated.
+  @retval EFI_INVALID_PARAMETER PoolType was invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_ALLOCATE_POOL)(
+  IN  EFI_MEMORY_TYPE              PoolType,
+  IN  UINTN                        Size,
+  OUT VOID                         **Buffer
+  );
+
+/**
+  Returns pool memory to the system.
+
+  @param  Buffer                Pointer to the buffer to free.
+
+  @retval EFI_SUCCESS           The memory was returned to the system.
+  @retval EFI_INVALID_PARAMETER Buffer was invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_FREE_POOL)(
+  IN  VOID                         *Buffer
+  );
+
+/**
+  Changes the runtime addressing mode of EFI firmware from physical to virtual.
+
+  @param  MemoryMapSize         The size in bytes of VirtualMap.
+  @param  DescriptorSize        The size in bytes of an entry in the VirtualMap.
+  @param  DescriptorVersion     The version of the structure entries in VirtualMap.
+  @param  VirtualMap            An array of memory descriptors which contain new virtual
+                                address mapping information for all runtime ranges.
+
+  @retval EFI_SUCCESS           The virtual address map has been applied.
+  @retval EFI_UNSUPPORTED       EFI firmware is not at runtime, or the EFI firmware is already in
+                                virtual address mapped mode.
+  @retval EFI_INVALID_PARAMETER DescriptorSize or DescriptorVersion is invalid.
+  @retval EFI_NO_MAPPING        A virtual address was not supplied for a range in the memory
+                                map that requires a mapping.
+  @retval EFI_NOT_FOUND         A virtual address was supplied for an address that is not found
+                                in the memory map.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_VIRTUAL_ADDRESS_MAP)(
+  IN  UINTN                        MemoryMapSize,
+  IN  UINTN                        DescriptorSize,
+  IN  UINT32                       DescriptorVersion,
+  IN  EFI_MEMORY_DESCRIPTOR        *VirtualMap
+  );
+
+/**
+  Connects one or more drivers to a controller.
+
+  @param  ControllerHandle      The handle of the controller to which driver(s) are to be connected.
+  @param  DriverImageHandle     A pointer to an ordered list handles that support the
+                                EFI_DRIVER_BINDING_PROTOCOL.
+  @param  RemainingDevicePath   A pointer to the device path that specifies a child of the
+                                controller specified by ControllerHandle.
+  @param  Recursive             If TRUE, then ConnectController() is called recursively
+                                until the entire tree of controllers below the controller specified
+                                by ControllerHandle have been created. If FALSE, then
+                                the tree of controllers is only expanded one level.
+
+  @retval EFI_SUCCESS           1) One or more drivers were connected to ControllerHandle.
+                                2) No drivers were connected to ControllerHandle, but
+                                RemainingDevicePath is not NULL, and it is an End Device
+                                Path Node.
+  @retval EFI_INVALID_PARAMETER ControllerHandle is not a valid EFI_HANDLE.
+  @retval EFI_NOT_FOUND         1) There are no EFI_DRIVER_BINDING_PROTOCOL instances
+                                present in the system.
+                                2) No drivers were connected to ControllerHandle.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CONNECT_CONTROLLER)(
+  IN  EFI_HANDLE                    ControllerHandle,
+  IN  EFI_HANDLE                    *DriverImageHandle,   OPTIONAL
+  IN  EFI_DEVICE_PATH_PROTOCOL      *RemainingDevicePath, OPTIONAL
+  IN  BOOLEAN                       Recursive
+  );
+
+/**
+  Disconnects one or more drivers from a controller.
+
+  @param  ControllerHandle      The handle of the controller from which driver(s) are to be disconnected.
+  @param  DriverImageHandle     The driver to disconnect from ControllerHandle.
+                                If DriverImageHandle is NULL, then all the drivers currently managing
+                                ControllerHandle are disconnected from ControllerHandle.
+  @param  ChildHandle           The handle of the child to destroy.
+                                If ChildHandle is NULL, then all the children of ControllerHandle are
+                                destroyed before the drivers are disconnected from ControllerHandle.
+
+  @retval EFI_SUCCESS           1) One or more drivers were disconnected from the controller.
+                                2) On entry, no drivers are managing ControllerHandle.
+                                3) DriverImageHandle is not NULL, and on entry
+                                   DriverImageHandle is not managing ControllerHandle.
+  @retval EFI_INVALID_PARAMETER 1) ControllerHandle is not a valid EFI_HANDLE.
+                                2) DriverImageHandle is not NULL, and it is not a valid EFI_HANDLE.
+                                3) ChildHandle is not NULL, and it is not a valid EFI_HANDLE.
+                                4) DriverImageHandle does not support the EFI_DRIVER_BINDING_PROTOCOL.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources available to disconnect any drivers from
+                                ControllerHandle.
+  @retval EFI_DEVICE_ERROR      The controller could not be disconnected because of a device error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_DISCONNECT_CONTROLLER)(
+  IN  EFI_HANDLE                     ControllerHandle,
+  IN  EFI_HANDLE                     DriverImageHandle, OPTIONAL
+  IN  EFI_HANDLE                     ChildHandle        OPTIONAL
+  );
+
+
+
+//
+// ConvertPointer DebugDisposition type.
+//
+#define EFI_OPTIONAL_PTR     0x00000001
+#define EFI_OPTIONAL_POINTER EFI_OPTIONAL_PTR
+
+/**
+  Determines the new virtual address that is to be used on subsequent memory accesses.
+
+  @param  DebugDisposition      Supplies type information for the pointer being converted.
+  @param  Address               A pointer to a pointer that is to be fixed to be the value needed
+                                for the new virtual address mappings being applied.
+
+  @retval EFI_SUCCESS           The pointer pointed to by Address was modified.
+  @retval EFI_INVALID_PARAMETER 1) Address is NULL.
+                                2) *Address is NULL and DebugDisposition does
+                                not have the EFI_OPTIONAL_PTR bit set.
+  @retval EFI_NOT_FOUND         The pointer pointed to by Address was not found to be part
+                                of the current memory map. This is normally fatal.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CONVERT_POINTER)(
+  IN     UINTN                      DebugDisposition,
+  IN OUT VOID                       **Address
+  );
+
+
+//
+// These types can be ORed together as needed - for example,
+// EVT_TIMER might be Ored with EVT_NOTIFY_WAIT or
+// EVT_NOTIFY_SIGNAL.
+//
+#define EVT_TIMER                         0x80000000
+#define EVT_RUNTIME                       0x40000000
+#define EVT_NOTIFY_WAIT                   0x00000100
+#define EVT_NOTIFY_SIGNAL                 0x00000200
+
+#define EVT_SIGNAL_EXIT_BOOT_SERVICES     0x00000201
+#define EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE 0x60000202
+
+//
+// The event's NotifyContext pointer points to a runtime memory
+// address.
+// The event is deprecated in UEFI2.0 and later specifications.
+//
+#define EVT_RUNTIME_CONTEXT               0x20000000
+
+
+/**
+  Invoke a notification event
+
+  @param  Event                 Event whose notification function is being invoked.
+  @param  Context               Pointer to the notification function's context,
+                                which is implementation-dependent.
+
+**/
+typedef
+VOID
+(EFIAPI *EFI_EVENT_NOTIFY)(
+  IN  EFI_EVENT                Event,
+  IN  VOID                     *Context
+  );
+
+/**
+  Creates an event.
+
+  @param  Type                  The type of event to create and its mode and attributes.
+  @param  NotifyTpl             The task priority level of event notifications, if needed.
+  @param  NotifyFunction        Pointer to the event's notification function, if any.
+  @param  NotifyContext         Pointer to the notification function's context; corresponds to parameter
+                                Context in the notification function.
+  @param  Event                 Pointer to the newly created event if the call succeeds; undefined
+                                otherwise.
+
+  @retval EFI_SUCCESS           The event structure was created.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_OUT_OF_RESOURCES  The event could not be allocated.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CREATE_EVENT)(
+  IN  UINT32                       Type,
+  IN  EFI_TPL                      NotifyTpl,
+  IN  EFI_EVENT_NOTIFY             NotifyFunction,
+  IN  VOID                         *NotifyContext,
+  OUT EFI_EVENT                    *Event
+  );
+
+/**
+  Creates an event in a group.
+
+  @param  Type                  The type of event to create and its mode and attributes.
+  @param  NotifyTpl             The task priority level of event notifications,if needed.
+  @param  NotifyFunction        Pointer to the event's notification function, if any.
+  @param  NotifyContext         Pointer to the notification function's context; corresponds to parameter
+                                Context in the notification function.
+  @param  EventGroup            Pointer to the unique identifier of the group to which this event belongs.
+                                If this is NULL, then the function behaves as if the parameters were passed
+                                to CreateEvent.
+  @param  Event                 Pointer to the newly created event if the call succeeds; undefined
+                                otherwise.
+
+  @retval EFI_SUCCESS           The event structure was created.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_OUT_OF_RESOURCES  The event could not be allocated.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CREATE_EVENT_EX)(
+  IN       UINT32                 Type,
+  IN       EFI_TPL                NotifyTpl,
+  IN       EFI_EVENT_NOTIFY       NotifyFunction OPTIONAL,
+  IN CONST VOID                   *NotifyContext OPTIONAL,
+  IN CONST EFI_GUID               *EventGroup    OPTIONAL,
+  OUT      EFI_EVENT              *Event
+  );
+
+///
+/// Timer delay types
+///
+typedef enum {
+  TimerCancel,
+  TimerPeriodic,
+  TimerRelative
+} EFI_TIMER_DELAY;
+
+/**
+  Sets the type of timer and the trigger time for a timer event.
+
+  @param  Event                 The timer event that is to be signaled at the specified time.
+  @param  Type                  The type of time that is specified in TriggerTime.
+  @param  TriggerTime           The number of 100ns units until the timer expires.
+                                A TriggerTime of 0 is legal.
+                                If Type is TimerRelative and TriggerTime is 0, then the timer
+                                event will be signaled on the next timer tick.
+                                If Type is TimerPeriodic and TriggerTime is 0, then the timer
+                                event will be signaled on every timer tick.
+
+  @retval EFI_SUCCESS           The event has been set to be signaled at the requested time.
+  @retval EFI_INVALID_PARAMETER Event or Type is not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_TIMER)(
+  IN  EFI_EVENT                Event,
+  IN  EFI_TIMER_DELAY          Type,
+  IN  UINT64                   TriggerTime
+  );
+
+/**
+  Signals an event.
+
+  @param  Event                 The event to signal.
+
+  @retval EFI_SUCCESS           The event has been signaled.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SIGNAL_EVENT)(
+  IN  EFI_EVENT                Event
+  );
+
+/**
+  Stops execution until an event is signaled.
+
+  @param  NumberOfEvents        The number of events in the Event array.
+  @param  Event                 An array of EFI_EVENT.
+  @param  Index                 Pointer to the index of the event which satisfied the wait condition.
+
+  @retval EFI_SUCCESS           The event indicated by Index was signaled.
+  @retval EFI_INVALID_PARAMETER 1) NumberOfEvents is 0.
+                                2) The event indicated by Index is of type
+                                   EVT_NOTIFY_SIGNAL.
+  @retval EFI_UNSUPPORTED       The current TPL is not TPL_APPLICATION.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_WAIT_FOR_EVENT)(
+  IN  UINTN                    NumberOfEvents,
+  IN  EFI_EVENT                *Event,
+  OUT UINTN                    *Index
+  );
+
+/**
+  Closes an event.
+
+  @param  Event                 The event to close.
+
+  @retval EFI_SUCCESS           The event has been closed.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CLOSE_EVENT)(
+  IN EFI_EVENT                Event
+  );
+
+/**
+  Checks whether an event is in the signaled state.
+
+  @param  Event                 The event to check.
+
+  @retval EFI_SUCCESS           The event is in the signaled state.
+  @retval EFI_NOT_READY         The event is not in the signaled state.
+  @retval EFI_INVALID_PARAMETER Event is of type EVT_NOTIFY_SIGNAL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CHECK_EVENT)(
+  IN EFI_EVENT                Event
+  );
+
+
+//
+// Task priority level
+//
+#define TPL_APPLICATION       4
+#define TPL_CALLBACK          8
+#define TPL_NOTIFY            16
+#define TPL_HIGH_LEVEL        31
+
+
+/**
+  Raises a task's priority level and returns its previous level.
+
+  @param  NewTpl                The new task priority level.
+
+  @return Previous task priority level
+
+**/
+typedef
+EFI_TPL
+(EFIAPI *EFI_RAISE_TPL)(
+  IN EFI_TPL      NewTpl
+  );
+
+/**
+  Restores a task's priority level to its previous value.
+
+  @param  OldTpl                The previous task priority level to restore.
+
+**/
+typedef
+VOID
+(EFIAPI *EFI_RESTORE_TPL)(
+  IN EFI_TPL      OldTpl
+  );
+
+/**
+  Returns the value of a variable.
+
+  @param  VariableName          A Null-terminated Unicode string that is the name of the
+                                vendor's variable.
+  @param  VendorGuid            A unique identifier for the vendor.
+  @param  Attributes            If not NULL, a pointer to the memory location to return the
+                                attributes bitmask for the variable.
+  @param  DataSize              On input, the size in bytes of the return Data buffer.
+                                On output the size of data returned in Data.
+  @param  Data                  The buffer to return the contents of the variable.
+
+  @retval EFI_SUCCESS            The function completed successfully.
+  @retval EFI_NOT_FOUND          The variable was not found.
+  @retval EFI_BUFFER_TOO_SMALL   The DataSize is too small for the result.
+  @retval EFI_INVALID_PARAMETER  VariableName is NULL.
+  @retval EFI_INVALID_PARAMETER  VendorGuid is NULL.
+  @retval EFI_INVALID_PARAMETER  DataSize is NULL.
+  @retval EFI_INVALID_PARAMETER  The DataSize is not too small and Data is NULL.
+  @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.
+  @retval EFI_SECURITY_VIOLATION The variable could not be retrieved due to an authentication failure.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_VARIABLE)(
+  IN     CHAR16                      *VariableName,
+  IN     EFI_GUID                    *VendorGuid,
+  OUT    UINT32                      *Attributes,    OPTIONAL
+  IN OUT UINTN                       *DataSize,
+  OUT    VOID                        *Data
+  );
+
+/**
+  Enumerates the current variable names.
+
+  @param  VariableNameSize      The size of the VariableName buffer.
+  @param  VariableName          On input, supplies the last VariableName that was returned
+                                by GetNextVariableName(). On output, returns the Nullterminated
+                                Unicode string of the current variable.
+  @param  VendorGuid            On input, supplies the last VendorGuid that was returned by
+                                GetNextVariableName(). On output, returns the
+                                VendorGuid of the current variable.
+
+  @retval EFI_SUCCESS           The function completed successfully.
+  @retval EFI_NOT_FOUND         The next variable was not found.
+  @retval EFI_BUFFER_TOO_SMALL  The VariableNameSize is too small for the result.
+  @retval EFI_INVALID_PARAMETER VariableNameSize is NULL.
+  @retval EFI_INVALID_PARAMETER VariableName is NULL.
+  @retval EFI_INVALID_PARAMETER VendorGuid is NULL.
+  @retval EFI_DEVICE_ERROR      The variable could not be retrieved due to a hardware error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_NEXT_VARIABLE_NAME)(
+  IN OUT UINTN                    *VariableNameSize,
+  IN OUT CHAR16                   *VariableName,
+  IN OUT EFI_GUID                 *VendorGuid
+  );
+
+/**
+  Sets the value of a variable.
+
+  @param  VariableName          A Null-terminated Unicode string that is the name of the
+                                vendor's variable.
+  @param  VendorGuid            A unique identifier for the vendor.
+  @param  Attributes            Attributes bitmask to set for the variable.
+  @param  DataSize              The size in bytes of the Data buffer.
+  @param  Data                  The contents for the variable.
+
+  @retval EFI_SUCCESS            The firmware has successfully stored the variable and its data as
+                                 defined by the Attributes.
+  @retval EFI_INVALID_PARAMETER  An invalid combination of attribute bits was supplied, or the
+                                 DataSize exceeds the maximum allowed.
+  @retval EFI_INVALID_PARAMETER  VariableName is an empty Unicode string.
+  @retval EFI_OUT_OF_RESOURCES   Not enough storage is available to hold the variable and its data.
+  @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.
+  @retval EFI_WRITE_PROTECTED    The variable in question is read-only.
+  @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.
+  @retval EFI_SECURITY_VIOLATION The variable could not be retrieved due to an authentication failure.
+  @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_VARIABLE)(
+  IN  CHAR16                       *VariableName,
+  IN  EFI_GUID                     *VendorGuid,
+  IN  UINT32                       Attributes,
+  IN  UINTN                        DataSize,
+  IN  VOID                         *Data
+  );
+
+
+///
+/// This provides the capabilities of the
+/// real time clock device as exposed through the EFI interfaces.
+///
+typedef struct {
+  UINT32    Resolution;
+  UINT32    Accuracy;
+  BOOLEAN   SetsToZero;
+} EFI_TIME_CAPABILITIES;
+
+/**
+  Returns the current time and date information, and the time-keeping capabilities
+  of the hardware platform.
+
+  @param  Time                  A pointer to storage to receive a snapshot of the current time.
+  @param  Capabilities          An optional pointer to a buffer to receive the real time clock
+                                device's capabilities.
+
+  @retval EFI_SUCCESS           The operation completed successfully.
+  @retval EFI_INVALID_PARAMETER Time is NULL.
+  @retval EFI_DEVICE_ERROR      The time could not be retrieved due to hardware error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_TIME)(
+  OUT  EFI_TIME                    *Time,
+  OUT  EFI_TIME_CAPABILITIES       *Capabilities OPTIONAL
+  );
+
+/**
+  Sets the current local time and date information.
+
+  @param  Time                  A pointer to the current time.
+
+  @retval EFI_SUCCESS           The operation completed successfully.
+  @retval EFI_INVALID_PARAMETER A time field is out of range.
+  @retval EFI_DEVICE_ERROR      The time could not be set due due to hardware error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_TIME)(
+  IN  EFI_TIME                     *Time
+  );
+
+/**
+  Returns the current wakeup alarm clock setting.
+
+  @param  Enabled               Indicates if the alarm is currently enabled or disabled.
+  @param  Pending               Indicates if the alarm signal is pending and requires acknowledgement.
+  @param  Time                  The current alarm setting.
+
+  @retval EFI_SUCCESS           The alarm settings were returned.
+  @retval EFI_INVALID_PARAMETER Enabled is NULL.
+  @retval EFI_INVALID_PARAMETER Pending is NULL.
+  @retval EFI_INVALID_PARAMETER Time is NULL.
+  @retval EFI_DEVICE_ERROR      The wakeup time could not be retrieved due to a hardware error.
+  @retval EFI_UNSUPPORTED       A wakeup timer is not supported on this platform.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_WAKEUP_TIME)(
+  OUT BOOLEAN                     *Enabled,
+  OUT BOOLEAN                     *Pending,
+  OUT EFI_TIME                    *Time
+  );
+
+/**
+  Sets the system wakeup alarm clock time.
+
+  @param  Enabled               Enable or disable the wakeup alarm.
+  @param  Time                  If Enable is TRUE, the time to set the wakeup alarm for.
+                                If Enable is FALSE, then this parameter is optional, and may be NULL.
+
+  @retval EFI_SUCCESS           If Enable is TRUE, then the wakeup alarm was enabled. If
+                                Enable is FALSE, then the wakeup alarm was disabled.
+  @retval EFI_INVALID_PARAMETER A time field is out of range.
+  @retval EFI_DEVICE_ERROR      The wakeup time could not be set due to a hardware error.
+  @retval EFI_UNSUPPORTED       A wakeup timer is not supported on this platform.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_WAKEUP_TIME)(
+  IN  BOOLEAN                      Enable,
+  IN  EFI_TIME                     *Time   OPTIONAL
+  );
+
+/**
+  This is the declaration of an EFI image entry point. This entry point is
+  the same for UEFI Applications, UEFI OS Loaders, and UEFI Drivers including
+  both device drivers and bus drivers.
+
+  @param  ImageHandle           The firmware allocated handle for the UEFI image.
+  @param  SystemTable           A pointer to the EFI System Table.
+
+  @retval EFI_SUCCESS           The operation completed successfully.
+  @retval EFI_OUT_OF_RESOURCES  The request could not be completed due to a lack of resources.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_IMAGE_ENTRY_POINT)(
+  IN  EFI_HANDLE                   ImageHandle,
+  IN  EFI_SYSTEM_TABLE             *SystemTable
+  );
+
+/**
+  Loads an EFI image into memory.
+
+  @param  BootPolicy            If TRUE, indicates that the request originates from the boot
+                                manager, and that the boot manager is attempting to load
+                                FilePath as a boot selection. Ignored if SourceBuffer is
+                                not NULL.
+  @param  ParentImageHandle     The caller's image handle.
+  @param  DevicePath            The DeviceHandle specific file path from which the image is
+                                loaded.
+  @param  SourceBuffer          If not NULL, a pointer to the memory location containing a copy
+                                of the image to be loaded.
+  @param  SourceSize            The size in bytes of SourceBuffer. Ignored if SourceBuffer is NULL.
+  @param  ImageHandle           Pointer to the returned image handle that is created when the
+                                image is successfully loaded.
+
+  @retval EFI_SUCCESS           Image was loaded into memory correctly.
+  @retval EFI_NOT_FOUND         Both SourceBuffer and DevicePath are NULL.
+  @retval EFI_INVALID_PARAMETER One or more parametes are invalid.
+  @retval EFI_UNSUPPORTED       The image type is not supported.
+  @retval EFI_OUT_OF_RESOURCES  Image was not loaded due to insufficient resources.
+  @retval EFI_LOAD_ERROR        Image was not loaded because the image format was corrupt or not
+                                understood.
+  @retval EFI_DEVICE_ERROR      Image was not loaded because the device returned a read error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_IMAGE_LOAD)(
+  IN  BOOLEAN                      BootPolicy,
+  IN  EFI_HANDLE                   ParentImageHandle,
+  IN  EFI_DEVICE_PATH_PROTOCOL     *DevicePath,
+  IN  VOID                         *SourceBuffer OPTIONAL,
+  IN  UINTN                        SourceSize,
+  OUT EFI_HANDLE                   *ImageHandle
+  );
+
+/**
+  Transfers control to a loaded image's entry point.
+
+  @param  ImageHandle           Handle of image to be started.
+  @param  ExitDataSize          Pointer to the size, in bytes, of ExitData.
+  @param  ExitData              Pointer to a pointer to a data buffer that includes a Null-terminated
+                                Unicode string, optionally followed by additional binary data.
+
+  @retval EFI_INVALID_PARAMETER ImageHandle is either an invalid image handle or the image
+                                has already been initialized with StartImage
+  @return Exit code from image
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_IMAGE_START)(
+  IN  EFI_HANDLE                  ImageHandle,
+  OUT UINTN                       *ExitDataSize,
+  OUT CHAR16                      **ExitData    OPTIONAL
+  );
+
+/**
+  Terminates a loaded EFI image and returns control to boot services.
+
+  @param  ImageHandle           Handle that identifies the image.
+  @param  ExitStatus            The image's exit code.
+  @param  ExitDataSize          The size, in bytes, of ExitData.
+  @param  ExitData              Pointer to a data buffer that includes a Null-terminated Unicode string,
+                                optionally followed by additional binary data.
+
+  @retval EFI_SUCCESS           The image specified by ImageHandle was unloaded.
+  @retval EFI_INVALID_PARAMETER The image specified by ImageHandle has been loaded and
+                                started with LoadImage() and StartImage(), but the
+                                image is not the currently executing image.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_EXIT)(
+  IN  EFI_HANDLE                   ImageHandle,
+  IN  EFI_STATUS                   ExitStatus,
+  IN  UINTN                        ExitDataSize,
+  IN  CHAR16                       *ExitData     OPTIONAL
+  );
+
+/**
+  Unloads an image.
+
+  @param  ImageHandle           Handle that identifies the image to be unloaded.
+
+  @retval EFI_SUCCESS           The image has been unloaded.
+  @retval EFI_INVALID_PARAMETER ImageHandle is not a valid image handle.
+  @retval EFI_UNSUPPORTED       The image has been started, and does not support unload.
+  @return Exit code from the image's unload handler
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_IMAGE_UNLOAD)(
+  IN  EFI_HANDLE                   ImageHandle
+  );
+
+/**
+  Terminates all boot services.
+
+  @param  ImageHandle           Handle that identifies the exiting image.
+  @param  MapKey                Key to the latest memory map.
+
+  @retval EFI_SUCCESS           Boot services have been terminated.
+  @retval EFI_INVALID_PARAMETER MapKey is incorrect.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_EXIT_BOOT_SERVICES)(
+  IN  EFI_HANDLE                   ImageHandle,
+  IN  UINTN                        MapKey
+  );
+
+/**
+  Induces a fine-grained stall.
+
+  @param  Microseconds          The number of microseconds to stall execution.
+
+  @retval EFI_SUCCESS           Execution was stalled at least the requested number of
+                                Microseconds.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_STALL)(
+  IN  UINTN                    Microseconds
+  );
+
+/**
+  Sets the system's watchdog timer.
+
+  @param  Timeout               The number of seconds to set the watchdog timer to.
+  @param  WatchdogCode          The numeric code to log on a watchdog timer timeout event.
+  @param  DataSize              The size, in bytes, of WatchdogData.
+  @param  WatchdogData          A data buffer that includes a Null-terminated Unicode string, optionally
+                                followed by additional binary data.
+
+  @retval EFI_SUCCESS           The timeout has been set.
+  @retval EFI_INVALID_PARAMETER The supplied WatchdogCode is invalid.
+  @retval EFI_UNSUPPORTED       The system does not have a watchdog timer.
+  @retval EFI_DEVICE_ERROR      The watch dog timer could not be programmed due to a hardware
+                                error.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_SET_WATCHDOG_TIMER)(
+  IN UINTN                    Timeout,
+  IN UINT64                   WatchdogCode,
+  IN UINTN                    DataSize,
+  IN CHAR16                   *WatchdogData OPTIONAL
+  );
+
+///
+/// Enumeration of reset types.
+///
+typedef enum {
+  EfiResetCold,
+  EfiResetWarm,
+  EfiResetShutdown,
+  EfiResetUpdate
+} EFI_RESET_TYPE;
+
+/**
+  Resets the entire platform.
+
+  @param  ResetType             The type of reset to perform.
+  @param  ResetStatus           The status code for the reset.
+  @param  DataSize              The size, in bytes, of WatchdogData.
+  @param  ResetData             For a ResetType of EfiResetCold, EfiResetWarm, or
+                                EfiResetShutdown the data buffer starts with a Null-terminated
+                                Unicode string, optionally followed by additional binary data.
+
+**/
+typedef
+VOID
+(EFIAPI *EFI_RESET_SYSTEM)(
+  IN EFI_RESET_TYPE           ResetType,
+  IN EFI_STATUS               ResetStatus,
+  IN UINTN                    DataSize,
+  IN CHAR16                   *ResetData OPTIONAL
+  );
+
+/**
+  Returns a monotonically increasing count for the platform.
+
+  @param  Count                 Pointer to returned value.
+
+  @retval EFI_SUCCESS           The next monotonic count was returned.
+  @retval EFI_INVALID_PARAMETER Count is NULL.
+  @retval EFI_DEVICE_ERROR      The device is not functioning properly.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_NEXT_MONOTONIC_COUNT)(
+  OUT UINT64                  *Count
+  );
+
+/**
+  Returns the next high 32 bits of the platform's monotonic counter.
+
+  @param  HighCount             Pointer to returned value.
+
+  @retval EFI_SUCCESS           The next high monotonic count was returned.
+  @retval EFI_INVALID_PARAMETER HighCount is NULL.
+  @retval EFI_DEVICE_ERROR      The device is not functioning properly.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_GET_NEXT_HIGH_MONO_COUNT)(
+  OUT UINT32                  *HighCount
+  );
+
+/**
+  Computes and returns a 32-bit CRC for a data buffer.
+
+  @param  Data                  A pointer to the buffer on which the 32-bit CRC is to be computed.
+  @param  DataSize              The number of bytes in the buffer Data.
+  @param  Crc32                 The 32-bit CRC that was computed for the data buffer specified by Data
+                                and DataSize.
+
+  @retval EFI_SUCCESS           The 32-bit CRC was computed for the data buffer and returned in
+                                Crc32.
+  @retval EFI_INVALID_PARAMETER Data is NULL.
+  @retval EFI_INVALID_PARAMETER Crc32 is NULL.
+  @retval EFI_INVALID_PARAMETER DataSize is 0.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CALCULATE_CRC32)(
+  IN  VOID                              *Data,
+  IN  UINTN                             DataSize,
+  OUT UINT32                            *Crc32
+  );
+
+/**
+  Copies the contents of one buffer to another buffer.
+
+  @param  Destination           Pointer to the destination buffer of the memory copy.
+  @param  Source                Pointer to the source buffer of the memory copy.
+  @param  Length                Number of bytes to copy from Source to Destination.
+
+**/
+typedef
+VOID
+(EFIAPI *EFI_COPY_MEM)(
+  IN VOID     *Destination,
+  IN VOID     *Source,
+  IN UINTN    Length
+  );
+
+/**
+  The SetMem() function fills a buffer with a specified value.
+
+  @param  Buffer                Pointer to the buffer to fill.
+  @param  Size                  Number of bytes in Buffer to fill.
+  @param  Value                 Value to fill Buffer with.
+
+**/
+typedef
+VOID
+(EFIAPI *EFI_SET_MEM)(
+  IN VOID     *Buffer,
+  IN UINTN    Size,
+  IN UINT8    Value
+  );
+
+
+//
+// Protocol handler functions
+//
+typedef enum {
+  EFI_NATIVE_INTERFACE
+} EFI_INTERFACE_TYPE;
+
+/**
+  Installs a protocol interface on a device handle. If the handle does not exist, it is created and added
+  to the list of handles in the system. InstallMultipleProtocolInterfaces() performs
+  more error checking than InstallProtocolInterface(), so it is recommended that
+  InstallMultipleProtocolInterfaces() be used in place of
+  InstallProtocolInterface()
+
+  @param  Handle                A pointer to the EFI_HANDLE on which the interface is to be installed.
+  @param  Protocol              The numeric ID of the protocol interface.
+  @param  InterfaceType         Indicates whether Interface is supplied in native form.
+  @param  Interface             A pointer to the protocol interface.
+
+  @retval EFI_SUCCESS           The protocol interface was installed.
+  @retval EFI_OUT_OF_RESOURCES  Space for a new handle could not be allocated.
+  @retval EFI_INVALID_PARAMETER Handle is NULL.
+  @retval EFI_INVALID_PARAMETER Protocol is NULL.
+  @retval EFI_INVALID_PARAMETER InterfaceType is not EFI_NATIVE_INTERFACE.
+  @retval EFI_INVALID_PARAMETER Protocol is already installed on the handle specified by Handle.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_INSTALL_PROTOCOL_INTERFACE)(
+  IN OUT EFI_HANDLE               *Handle,
+  IN     EFI_GUID                 *Protocol,
+  IN     EFI_INTERFACE_TYPE       InterfaceType,
+  IN     VOID                     *Interface
+  );
+
+/**
+  Installs one or more protocol interfaces into the boot services environment.
+
+  @param  Handle                The handle to install the new protocol interfaces on, or NULL if a new
+                                handle is to be allocated.
+  @param  ...                   A variable argument list containing pairs of protocol GUIDs and protocol
+                                interfaces.
+
+  @retval EFI_SUCCESS           All the protocol interface was installed.
+  @retval EFI_OUT_OF_RESOURCES  There was not enough memory in pool to install all the protocols.
+  @retval EFI_ALREADY_STARTED   A Device Path Protocol instance was passed in that is already present in
+                                the handle database.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_INSTALL_MULTIPLE_PROTOCOL_INTERFACES)(
+  IN OUT EFI_HANDLE           *Handle,
+  ...
+  );
+
+/**
+  Reinstalls a protocol interface on a device handle.
+
+  @param  Handle                Handle on which the interface is to be reinstalled.
+  @param  Protocol              The numeric ID of the interface.
+  @param  OldInterface          A pointer to the old interface. NULL can be used if a structure is not
+                                associated with Protocol.
+  @param  NewInterface          A pointer to the new interface.
+
+  @retval EFI_SUCCESS           The protocol interface was reinstalled.
+  @retval EFI_NOT_FOUND         The OldInterface on the handle was not found.
+  @retval EFI_ACCESS_DENIED     The protocol interface could not be reinstalled,
+                                because OldInterface is still being used by a
+                                driver that will not release it.
+  @retval EFI_INVALID_PARAMETER Handle is not a valid EFI_HANDLE.
+  @retval EFI_INVALID_PARAMETER Protocol is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_REINSTALL_PROTOCOL_INTERFACE)(
+  IN EFI_HANDLE               Handle,
+  IN EFI_GUID                 *Protocol,
+  IN VOID                     *OldInterface,
+  IN VOID                     *NewInterface
+  );
+
+/**
+  Removes a protocol interface from a device handle. It is recommended that
+  UninstallMultipleProtocolInterfaces() be used in place of
+  UninstallProtocolInterface().
+
+  @param  Handle                The handle on which the interface was installed.
+  @param  Protocol              The numeric ID of the interface.
+  @param  Interface             A pointer to the interface.
+
+  @retval EFI_SUCCESS           The interface was removed.
+  @retval EFI_NOT_FOUND         The interface was not found.
+  @retval EFI_ACCESS_DENIED     The interface was not removed because the interface
+                                is still being used by a driver.
+  @retval EFI_INVALID_PARAMETER Handle is not a valid EFI_HANDLE.
+  @retval EFI_INVALID_PARAMETER Protocol is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_UNINSTALL_PROTOCOL_INTERFACE)(
+  IN EFI_HANDLE               Handle,
+  IN EFI_GUID                 *Protocol,
+  IN VOID                     *Interface
+  );
+
+/**
+  Removes one or more protocol interfaces into the boot services environment.
+
+  @param  Handle                The handle to remove the protocol interfaces from.
+  @param  ...                   A variable argument list containing pairs of protocol GUIDs and
+                                protocol interfaces.
+
+  @retval EFI_SUCCESS           All the protocol interfaces were removed.
+  @retval EFI_INVALID_PARAMETER One of the protocol interfaces was not previously installed on Handle.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_UNINSTALL_MULTIPLE_PROTOCOL_INTERFACES)(
+  IN EFI_HANDLE           Handle,
+  ...
+  );
+
+/**
+  Queries a handle to determine if it supports a specified protocol.
+
+  @param  Handle                The handle being queried.
+  @param  Protocol              The published unique identifier of the protocol.
+  @param  Interface             Supplies the address where a pointer to the corresponding Protocol
+                                Interface is returned.
+
+  @retval EFI_SUCCESS           The interface information for the specified protocol was returned.
+  @retval EFI_UNSUPPORTED       The device does not support the specified protocol.
+  @retval EFI_INVALID_PARAMETER Handle is not a valid EFI_HANDLE.
+  @retval EFI_INVALID_PARAMETER Protocol is NULL.
+  @retval EFI_INVALID_PARAMETER Interface is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_HANDLE_PROTOCOL)(
+  IN  EFI_HANDLE               Handle,
+  IN  EFI_GUID                 *Protocol,
+  OUT VOID                     **Interface
+  );
+
+#define EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL  0x00000001
+#define EFI_OPEN_PROTOCOL_GET_PROTOCOL        0x00000002
+#define EFI_OPEN_PROTOCOL_TEST_PROTOCOL       0x00000004
+#define EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER 0x00000008
+#define EFI_OPEN_PROTOCOL_BY_DRIVER           0x00000010
+#define EFI_OPEN_PROTOCOL_EXCLUSIVE           0x00000020
+
+/**
+  Queries a handle to determine if it supports a specified protocol. If the protocol is supported by the
+  handle, it opens the protocol on behalf of the calling agent.
+
+  @param  Handle                The handle for the protocol interface that is being opened.
+  @param  Protocol              The published unique identifier of the protocol.
+  @param  Interface             Supplies the address where a pointer to the corresponding Protocol
+                                Interface is returned.
+  @param  AgentHandle           The handle of the agent that is opening the protocol interface
+                                specified by Protocol and Interface.
+  @param  ControllerHandle      If the agent that is opening a protocol is a driver that follows the
+                                UEFI Driver Model, then this parameter is the controller handle
+                                that requires the protocol interface. If the agent does not follow
+                                the UEFI Driver Model, then this parameter is optional and may
+                                be NULL.
+  @param  Attributes            The open mode of the protocol interface specified by Handle
+                                and Protocol.
+
+  @retval EFI_SUCCESS           An item was added to the open list for the protocol interface, and the
+                                protocol interface was returned in Interface.
+  @retval EFI_UNSUPPORTED       Handle does not support Protocol.
+  @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+  @retval EFI_ACCESS_DENIED     Required attributes can't be supported in current environment.
+  @retval EFI_ALREADY_STARTED   Item on the open list already has requierd attributes whose agent
+                                handle is the same as AgentHandle.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_OPEN_PROTOCOL)(
+  IN  EFI_HANDLE                Handle,
+  IN  EFI_GUID                  *Protocol,
+  OUT VOID                      **Interface, OPTIONAL
+  IN  EFI_HANDLE                AgentHandle,
+  IN  EFI_HANDLE                ControllerHandle,
+  IN  UINT32                    Attributes
+  );
+
+
+/**
+  Closes a protocol on a handle that was opened using OpenProtocol().
+
+  @param  Handle                The handle for the protocol interface that was previously opened
+                                with OpenProtocol(), and is now being closed.
+  @param  Protocol              The published unique identifier of the protocol.
+  @param  AgentHandle           The handle of the agent that is closing the protocol interface.
+  @param  ControllerHandle      If the agent that opened a protocol is a driver that follows the
+                                UEFI Driver Model, then this parameter is the controller handle
+                                that required the protocol interface.
+
+  @retval EFI_SUCCESS           The protocol instance was closed.
+  @retval EFI_INVALID_PARAMETER 1) Handle is not a valid EFI_HANDLE.
+                                2) AgentHandle is not a valid EFI_HANDLE.
+                                3) ControllerHandle is not NULL and ControllerHandle is not a valid EFI_HANDLE.
+                                4) Protocol is NULL.
+  @retval EFI_NOT_FOUND         1) Handle does not support the protocol specified by Protocol.
+                                2) The protocol interface specified by Handle and Protocol is not
+                                   currently open by AgentHandle and ControllerHandle.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CLOSE_PROTOCOL)(
+  IN EFI_HANDLE               Handle,
+  IN EFI_GUID                 *Protocol,
+  IN EFI_HANDLE               AgentHandle,
+  IN EFI_HANDLE               ControllerHandle
+  );
+
+
+typedef struct {
+  EFI_HANDLE  AgentHandle;
+  EFI_HANDLE  ControllerHandle;
+  UINT32      Attributes;
+  UINT32      OpenCount;
+} EFI_OPEN_PROTOCOL_INFORMATION_ENTRY;
+
+/**
+  Retrieves the list of agents that currently have a protocol interface opened.
+
+  @param  Handle                The handle for the protocol interface that is being queried.
+  @param  Protocol              The published unique identifier of the protocol.
+  @param  EntryBuffer           A pointer to a buffer of open protocol information in the form of
+                                EFI_OPEN_PROTOCOL_INFORMATION_ENTRY structures.
+  @param  EntryCount            A pointer to the number of entries in EntryBuffer.
+
+  @retval EFI_SUCCESS           The open protocol information was returned in EntryBuffer, and the
+                                number of entries was returned EntryCount.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough resources available to allocate EntryBuffer.
+  @retval EFI_NOT_FOUND         Handle does not support the protocol specified by Protocol.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_OPEN_PROTOCOL_INFORMATION)(
+  IN  EFI_HANDLE                          Handle,
+  IN  EFI_GUID                            *Protocol,
+  OUT EFI_OPEN_PROTOCOL_INFORMATION_ENTRY **EntryBuffer,
+  OUT UINTN                               *EntryCount
+  );
+
+/**
+  Retrieves the list of protocol interface GUIDs that are installed on a handle in a buffer allocated
+  from pool.
+
+  @param  Handle                The handle from which to retrieve the list of protocol interface
+                                GUIDs.
+  @param  ProtocolBuffer        A pointer to the list of protocol interface GUID pointers that are
+                                installed on Handle.
+  @param  ProtocolBufferCount   A pointer to the number of GUID pointers present in
+                                ProtocolBuffer.
+
+  @retval EFI_SUCCESS           The list of protocol interface GUIDs installed on Handle was returned in
+                                ProtocolBuffer. The number of protocol interface GUIDs was
+                                returned in ProtocolBufferCount.
+  @retval EFI_OUT_OF_RESOURCES  There is not enough pool memory to store the results.
+  @retval EFI_INVALID_PARAMETER Handle is NULL.
+  @retval EFI_INVALID_PARAMETER Handle is not a valid EFI_HANDLE.
+  @retval EFI_INVALID_PARAMETER ProtocolBuffer is NULL.
+  @retval EFI_INVALID_PARAMETER ProtocolBufferCount is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_PROTOCOLS_PER_HANDLE)(
+  IN  EFI_HANDLE      Handle,
+  OUT EFI_GUID        ***ProtocolBuffer,
+  OUT UINTN           *ProtocolBufferCount
+  );
+
+/**
+  Creates an event that is to be signaled whenever an interface is installed for a specified protocol.
+
+  @param  Protocol              The numeric ID of the protocol for which the event is to be registered.
+  @param  Event                 Event that is to be signaled whenever a protocol interface is registered
+                                for Protocol.
+  @param  Registration          A pointer to a memory location to receive the registration value.
+
+  @retval EFI_SUCCESS           The notification event has been registered.
+  @retval EFI_OUT_OF_RESOURCES  Space for the notification event could not be allocated.
+  @retval EFI_INVALID_PARAMETER Protocol is NULL.
+  @retval EFI_INVALID_PARAMETER Event is NULL.
+  @retval EFI_INVALID_PARAMETER Registration is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_REGISTER_PROTOCOL_NOTIFY)(
+  IN  EFI_GUID                 *Protocol,
+  IN  EFI_EVENT                Event,
+  OUT VOID                     **Registration
+  );
+
+
+typedef enum {
+  AllHandles,
+  ByRegisterNotify,
+  ByProtocol
+} EFI_LOCATE_SEARCH_TYPE;
+
+/**
+  Returns an array of handles that support a specified protocol.
+
+  @param  SearchType            Specifies which handle(s) are to be returned.
+  @param  Protocol              Specifies the protocol to search by.
+  @param  SearchKey             Specifies the search key.
+  @param  BufferSize            On input, the size in bytes of Buffer. On output, the size in bytes of
+                                the array returned in Buffer (if the buffer was large enough) or the
+                                size, in bytes, of the buffer needed to obtain the array (if the buffer was
+                                not large enough).
+  @param  Buffer                The buffer in which the array is returned.
+
+  @retval EFI_SUCCESS           The array of handles was returned.
+  @retval EFI_NOT_FOUND         No handles match the search.
+  @retval EFI_BUFFER_TOO_SMALL  The BufferSize is too small for the result.
+  @retval EFI_INVALID_PARAMETER SearchType is not a member of EFI_LOCATE_SEARCH_TYPE.
+  @retval EFI_INVALID_PARAMETER SearchType is ByRegisterNotify and SearchKey is NULL.
+  @retval EFI_INVALID_PARAMETER SearchType is ByProtocol and Protocol is NULL.
+  @retval EFI_INVALID_PARAMETER One or more matches are found and BufferSize is NULL.
+  @retval EFI_INVALID_PARAMETER BufferSize is large enough for the result and Buffer is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LOCATE_HANDLE)(
+  IN     EFI_LOCATE_SEARCH_TYPE   SearchType,
+  IN     EFI_GUID                 *Protocol,    OPTIONAL
+  IN     VOID                     *SearchKey,   OPTIONAL
+  IN OUT UINTN                    *BufferSize,
+  OUT    EFI_HANDLE               *Buffer
+  );
+
+/**
+  Locates the handle to a device on the device path that supports the specified protocol.
+
+  @param  Protocol              Specifies the protocol to search for.
+  @param  DevicePath            On input, a pointer to a pointer to the device path. On output, the device
+                                path pointer is modified to point to the remaining part of the device
+                                path.
+  @param  Device                A pointer to the returned device handle.
+
+  @retval EFI_SUCCESS           The resulting handle was returned.
+  @retval EFI_NOT_FOUND         No handles match the search.
+  @retval EFI_INVALID_PARAMETER Protocol is NULL.
+  @retval EFI_INVALID_PARAMETER DevicePath is NULL.
+  @retval EFI_INVALID_PARAMETER A handle matched the search and Device is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LOCATE_DEVICE_PATH)(
+  IN     EFI_GUID                         *Protocol,
+  IN OUT EFI_DEVICE_PATH_PROTOCOL         **DevicePath,
+  OUT    EFI_HANDLE                       *Device
+  );
+
+/**
+  Adds, updates, or removes a configuration table entry from the EFI System Table.
+
+  @param  Guid                  A pointer to the GUID for the entry to add, update, or remove.
+  @param  Table                 A pointer to the configuration table for the entry to add, update, or
+                                remove. May be NULL.
+
+  @retval EFI_SUCCESS           The (Guid, Table) pair was added, updated, or removed.
+  @retval EFI_NOT_FOUND         An attempt was made to delete a nonexistent entry.
+  @retval EFI_INVALID_PARAMETER Guid is not valid.
+  @retval EFI_OUT_OF_RESOURCES  There is not enough memory available to complete the operation.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_INSTALL_CONFIGURATION_TABLE)(
+  IN EFI_GUID                 *Guid,
+  IN VOID                     *Table
+  );
+
+
+/**
+  Returns an array of handles that support the requested protocol in a buffer allocated from pool.
+
+  @param  SearchType            Specifies which handle(s) are to be returned.
+  @param  Protocol              Provides the protocol to search by.
+                                This parameter is only valid for a SearchType of ByProtocol.
+  @param  SearchKey             Supplies the search key depending on the SearchType.
+  @param  NoHandles             The number of handles returned in Buffer.
+  @param  Buffer                A pointer to the buffer to return the requested array of handles that
+                                support Protocol.
+
+  @retval EFI_SUCCESS           The array of handles was returned in Buffer, and the number of
+                                handles in Buffer was returned in NoHandles.
+  @retval EFI_NOT_FOUND         No handles match the search.
+  @retval EFI_OUT_OF_RESOURCES  There is not enough pool memory to store the matching results.
+  @retval EFI_INVALID_PARAMETER NoHandles is NULL.
+  @retval EFI_INVALID_PARAMETER Buffer is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LOCATE_HANDLE_BUFFER)(
+  IN     EFI_LOCATE_SEARCH_TYPE       SearchType,
+  IN     EFI_GUID                     *Protocol,      OPTIONAL
+  IN     VOID                         *SearchKey,     OPTIONAL
+  IN OUT UINTN                        *NoHandles,
+  OUT    EFI_HANDLE                   **Buffer
+  );
+
+/**
+  Returns the first protocol instance that matches the given protocol.
+
+  @param  Protocol              Provides the protocol to search for.
+  @param  Registration          Optional registration key returned from
+                                RegisterProtocolNotify().
+  @param  Interface             On return, a pointer to the first interface that matches Protocol and
+                                Registration.
+
+  @retval EFI_SUCCESS           A protocol instance matching Protocol was found and returned in
+                                Interface.
+  @retval EFI_NOT_FOUND         No protocol instances were found that match Protocol and
+                                Registration.
+  @retval EFI_INVALID_PARAMETER Interface is NULL.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LOCATE_PROTOCOL)(
+  IN  EFI_GUID  *Protocol,
+  IN  VOID      *Registration, OPTIONAL
+  OUT VOID      **Interface
+  );
+
+typedef struct {
+  UINT64                            Length;
+  union {
+    EFI_PHYSICAL_ADDRESS  DataBlock;
+    EFI_PHYSICAL_ADDRESS  ContinuationPointer;
+  } Union;
+} EFI_CAPSULE_BLOCK_DESCRIPTOR;
+
+typedef struct {
+  EFI_GUID          CapsuleGuid;
+  UINT32            HeaderSize;
+  UINT32            Flags;
+  UINT32            CapsuleImageSize;
+} EFI_CAPSULE_HEADER;
+
+//
+// The EFI System Table entry must point to an array of capsules
+// that contain the same CapsuleGuid value. The array must be
+// prefixed by a UINT32 that represents the size of the array of capsules.
+//
+typedef struct {
+  UINT32   CapsuleArrayNumber;
+  VOID*    CapsulePtr[1];
+} EFI_CAPSULE_TABLE;
+
+#define CAPSULE_FLAGS_PERSIST_ACROSS_RESET          0x00010000
+#define CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE         0x00020000
+
+/**
+  Passes capsules to the firmware with both virtual and physical mapping. Depending on the intended
+  consumption, the firmware may process the capsule immediately. If the payload should persist
+  across a system reset, the reset value returned from EFI_QueryCapsuleCapabilities must
+  be passed into ResetSystem() and will cause the capsule to be processed by the firmware as
+  part of the reset process.
+
+  @param  CapsuleHeaderArray    Virtual pointer to an array of virtual pointers to the capsules
+                                being passed into update capsule.
+  @param  CapsuleCount          Number of pointers to EFI_CAPSULE_HEADER in
+                                CaspuleHeaderArray.
+  @param  ScatterGatherList     Physical pointer to a set of
+                                EFI_CAPSULE_BLOCK_DESCRIPTOR that describes the
+                                location in physical memory of a set of capsules.
+
+  @retval EFI_SUCCESS           Valid capsule was passed. If
+                                CAPSULE_FLAGS_PERSIT_ACROSS_RESET is not set, the
+                                capsule has been successfully processed by the firmware.
+  @retval EFI_DEVICE_ERROR      The capsule update was started, but failed due to a device error.
+  @retval EFI_INVALID_PARAMETER CapsuleSize is NULL.
+  @retval EFI_UNSUPPORTED       The capsule type is not supported on this platform.
+  @retval EFI_OUT_OF_RESOURCES  There were insufficient resources to process the capsule.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_UPDATE_CAPSULE)(
+  IN EFI_CAPSULE_HEADER     **CapsuleHeaderArray,
+  IN UINTN                  CapsuleCount,
+  IN EFI_PHYSICAL_ADDRESS   ScatterGatherList   OPTIONAL
+  );
+
+/**
+  Returns if the capsule can be supported via UpdateCapsule().
+
+  @param  CapsuleHeaderArray    Virtual pointer to an array of virtual pointers to the capsules
+                                being passed into update capsule.
+  @param  CapsuleCount          Number of pointers to EFI_CAPSULE_HEADER in
+                                CaspuleHeaderArray.
+  @param  MaxiumCapsuleSize     On output the maximum size that UpdateCapsule() can
+                                support as an argument to UpdateCapsule() via
+                                CapsuleHeaderArray and ScatterGatherList.
+  @param  ResetType             Returns the type of reset required for the capsule update.
+
+  @retval EFI_SUCCESS           Valid answer returned.
+  @retval EFI_UNSUPPORTED       The capsule type is not supported on this platform, and
+                                MaximumCapsuleSize and ResetType are undefined.
+  @retval EFI_INVALID_PARAMETER MaximumCapsuleSize is NULL.
+  @retval EFI_OUT_OF_RESOURCES  There were insufficient resources to process the query request.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_QUERY_CAPSULE_CAPABILITIES)(
+  IN  EFI_CAPSULE_HEADER     **CapsuleHeaderArray,
+  IN  UINTN                  CapsuleCount,
+  OUT UINT64                 *MaximumCapsuleSize,
+  OUT EFI_RESET_TYPE         *ResetType
+  );
+
+/**
+  Returns information about the EFI variables.
+
+  @param  Attributes                   Attributes bitmask to specify the type of variables on
+                                       which to return information.
+  @param  MaximumVariableStorageSize   On output the maximum size of the storage space
+                                       available for the EFI variables associated with the
+                                       attributes specified.
+  @param  RemainingVariableStorageSize Returns the remaining size of the storage space
+                                       available for the EFI variables associated with the
+                                       attributes specified.
+  @param  MaximumVariableSize          Returns the maximum size of the individual EFI
+                                       variables associated with the attributes specified.
+
+  @retval EFI_SUCCESS                  Valid answer returned.
+  @retval EFI_INVALID_PARAMETER        An invalid combination of attribute bits was supplied
+  @retval EFI_UNSUPPORTED              The attribute is not supported on this platform, and the
+                                       MaximumVariableStorageSize,
+                                       RemainingVariableStorageSize, MaximumVariableSize
+                                       are undefined.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_QUERY_VARIABLE_INFO)(
+  IN  UINT32            Attributes,
+  OUT UINT64            *MaximumVariableStorageSize,
+  OUT UINT64            *RemainingVariableStorageSize,
+  OUT UINT64            *MaximumVariableSize
+  );
+
+
+//
+// EFI Runtime Services Table
+//
+#define EFI_SYSTEM_TABLE_SIGNATURE      0x5453595320494249ULL
+#define EFI_SYSTEM_TABLE_REVISION       ((2<<16) | (10))
+#define EFI_2_10_SYSTEM_TABLE_REVISION  ((2<<16) | (10))
+#define EFI_2_00_SYSTEM_TABLE_REVISION  ((2<<16) | (00))
+#define EFI_1_10_SYSTEM_TABLE_REVISION  ((1<<16) | (10))
+#define EFI_1_02_SYSTEM_TABLE_REVISION  ((1<<16) | (02))
+
+#define EFI_RUNTIME_SERVICES_SIGNATURE  0x56524553544e5552ULL
+#define EFI_RUNTIME_SERVICES_REVISION   EFI_2_10_SYSTEM_TABLE_REVISION
+
+///
+/// EFI Runtime Services Table
+///
+typedef struct {
+  ///
+  /// The table header for the EFI Runtime Services Table.
+  ///
+  EFI_TABLE_HEADER                Hdr;
+
+  //
+  // Time Services
+  //
+  EFI_GET_TIME                    GetTime;
+  EFI_SET_TIME                    SetTime;
+  EFI_GET_WAKEUP_TIME             GetWakeupTime;
+  EFI_SET_WAKEUP_TIME             SetWakeupTime;
+
+  //
+  // Virtual Memory Services
+  //
+  EFI_SET_VIRTUAL_ADDRESS_MAP     SetVirtualAddressMap;
+  EFI_CONVERT_POINTER             ConvertPointer;
+
+  //
+  // Variable Services
+  //
+  EFI_GET_VARIABLE                GetVariable;
+  EFI_GET_NEXT_VARIABLE_NAME      GetNextVariableName;
+  EFI_SET_VARIABLE                SetVariable;
+
+  //
+  // Miscellaneous Services
+  //
+  EFI_GET_NEXT_HIGH_MONO_COUNT    GetNextHighMonotonicCount;
+  EFI_RESET_SYSTEM                ResetSystem;
+
+  //
+  // UEFI 2.0 Capsule Services
+  //
+  EFI_UPDATE_CAPSULE              UpdateCapsule;
+  EFI_QUERY_CAPSULE_CAPABILITIES  QueryCapsuleCapabilities;
+
+  //
+  // Miscellaneous UEFI 2.0 Service
+  //
+  EFI_QUERY_VARIABLE_INFO         QueryVariableInfo;
+} EFI_RUNTIME_SERVICES;
+
+
+#define EFI_BOOT_SERVICES_SIGNATURE   0x56524553544f4f42ULL
+#define EFI_BOOT_SERVICES_REVISION    EFI_2_10_SYSTEM_TABLE_REVISION
+
+///
+/// EFI Boot Services Table
+///
+typedef struct {
+  ///
+  /// The table header for the EFI Boot Services Table.
+  ///
+  EFI_TABLE_HEADER                Hdr;
+
+  //
+  // Task Priority Services
+  //
+  EFI_RAISE_TPL                   RaiseTPL;
+  EFI_RESTORE_TPL                 RestoreTPL;
+
+  //
+  // Memory Services
+  //
+  EFI_ALLOCATE_PAGES              AllocatePages;
+  EFI_FREE_PAGES                  FreePages;
+  EFI_GET_MEMORY_MAP              GetMemoryMap;
+  EFI_ALLOCATE_POOL               AllocatePool;
+  EFI_FREE_POOL                   FreePool;
+
+  //
+  // Event & Timer Services
+  //
+  EFI_CREATE_EVENT                  CreateEvent;
+  EFI_SET_TIMER                     SetTimer;
+  EFI_WAIT_FOR_EVENT                WaitForEvent;
+  EFI_SIGNAL_EVENT                  SignalEvent;
+  EFI_CLOSE_EVENT                   CloseEvent;
+  EFI_CHECK_EVENT                   CheckEvent;
+
+  //
+  // Protocol Handler Services
+  //
+  EFI_INSTALL_PROTOCOL_INTERFACE    InstallProtocolInterface;
+  EFI_REINSTALL_PROTOCOL_INTERFACE  ReinstallProtocolInterface;
+  EFI_UNINSTALL_PROTOCOL_INTERFACE  UninstallProtocolInterface;
+  EFI_HANDLE_PROTOCOL               HandleProtocol;
+  VOID                              *Reserved;
+  EFI_REGISTER_PROTOCOL_NOTIFY      RegisterProtocolNotify;
+  EFI_LOCATE_HANDLE                 LocateHandle;
+  EFI_LOCATE_DEVICE_PATH            LocateDevicePath;
+  EFI_INSTALL_CONFIGURATION_TABLE   InstallConfigurationTable;
+
+  //
+  // Image Services
+  //
+  EFI_IMAGE_LOAD                    LoadImage;
+  EFI_IMAGE_START                   StartImage;
+  EFI_EXIT                          Exit;
+  EFI_IMAGE_UNLOAD                  UnloadImage;
+  EFI_EXIT_BOOT_SERVICES            ExitBootServices;
+
+  //
+  // Miscellaneous Services
+  //
+  EFI_GET_NEXT_MONOTONIC_COUNT      GetNextMonotonicCount;
+  EFI_STALL                         Stall;
+  EFI_SET_WATCHDOG_TIMER            SetWatchdogTimer;
+
+  //
+  // DriverSupport Services
+  //
+  EFI_CONNECT_CONTROLLER            ConnectController;
+  EFI_DISCONNECT_CONTROLLER         DisconnectController;
+
+  //
+  // Open and Close Protocol Services
+  //
+  EFI_OPEN_PROTOCOL                 OpenProtocol;
+  EFI_CLOSE_PROTOCOL                CloseProtocol;
+  EFI_OPEN_PROTOCOL_INFORMATION     OpenProtocolInformation;
+
+  //
+  // Library Services
+  //
+  EFI_PROTOCOLS_PER_HANDLE          ProtocolsPerHandle;
+  EFI_LOCATE_HANDLE_BUFFER          LocateHandleBuffer;
+  EFI_LOCATE_PROTOCOL               LocateProtocol;
+  EFI_INSTALL_MULTIPLE_PROTOCOL_INTERFACES    InstallMultipleProtocolInterfaces;
+  EFI_UNINSTALL_MULTIPLE_PROTOCOL_INTERFACES  UninstallMultipleProtocolInterfaces;
+
+  //
+  // 32-bit CRC Services
+  //
+  EFI_CALCULATE_CRC32               CalculateCrc32;
+
+  //
+  // Miscellaneous Services
+  //
+  EFI_COPY_MEM                      CopyMem;
+  EFI_SET_MEM                       SetMem;
+  EFI_CREATE_EVENT_EX               CreateEventEx;
+} EFI_BOOT_SERVICES;
+
+///
+/// Contains a set of GUID/pointer pairs comprised of the ConfigurationTable field in the
+/// EFI System Table.
+///
+typedef struct{
+  ///
+  /// The 128-bit GUID value that uniquely identifies the system configuration table.
+  ///
+  EFI_GUID                          VendorGuid;
+  ///
+  /// A pointer to the table associated with VendorGuid.
+  ///
+  VOID                              *VendorTable;
+} EFI_CONFIGURATION_TABLE;
+
+///
+/// EFI System Table
+///
+struct _EFI_SYSTEM_TABLE {
+  ///
+  /// The table header for the EFI System Table.
+  ///
+  EFI_TABLE_HEADER                  Hdr;
+  ///
+  /// A pointer to a null terminated Unicode string that identifies
+  /// the vendor that produces the system firmware for the platform.
+  ///
+  CHAR16                            *FirmwareVendor;
+  ///
+  /// A firmware vendor specific value that identifies the revision
+  /// of the system firmware for the platform.
+  ///
+  UINT32                            FirmwareRevision;
+  ///
+  /// The handle for the active console input device.
+  ///
+  EFI_HANDLE                        ConsoleInHandle;
+  ///
+  /// A pointer to the SIMPLE_INPUT_PROTOCOL interface that is
+  /// associated with ConsoleInHandle.
+  ///
+  EFI_SIMPLE_TEXT_INPUT_PROTOCOL    *ConIn;
+  ///
+  /// The handle for the active console output device.
+  ///
+  EFI_HANDLE                        ConsoleOutHandle;
+  ///
+  /// A pointer to the SIMPLE_TEXT_OUTPUT_PROTOCOL interface
+  /// that is associated with ConsoleOutHandle.
+  ///
+  EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL   *ConOut;
+  ///
+  /// The handle for the active standard error console device.
+  ///
+  EFI_HANDLE                        StandardErrorHandle;
+  ///
+  /// A pointer to the SIMPLE_TEXT_OUTPUT_PROTOCOL interface
+  /// that is associated with StandardErrorHandle.
+  ///
+  EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL   *StdErr;
+  ///
+  /// A pointer to the EFI Runtime Services Table.
+  ///
+  EFI_RUNTIME_SERVICES              *RuntimeServices;
+  ///
+  /// A pointer to the EFI Boot Services Table.
+  ///
+  EFI_BOOT_SERVICES                 *BootServices;
+  ///
+  /// The number of system configuration tables in the buffer ConfigurationTable.
+  ///
+  UINTN                             NumberOfTableEntries;
+  ///
+  /// A pointer to the system configuration tables.
+  /// The number of entries in the table is NumberOfTableEntries.
+  ///
+  EFI_CONFIGURATION_TABLE           *ConfigurationTable;
+};
+
+//
+// EFI Load Options Attributes
+//
+#define LOAD_OPTION_ACTIVE            0x00000001
+#define LOAD_OPTION_FORCE_RECONNECT   0x00000002
+#define LOAD_OPTION_HIDDEN            0x00000008
+#define LOAD_OPTION_CATEGORY          0x00001F00
+
+#define LOAD_OPTION_CATEGORY_BOOT     0x00000000
+#define LOAD_OPTION_CATEGORY_APP      0x00000100
+
+#define EFI_BOOT_OPTION_SUPPORT_KEY   0x00000001
+#define EFI_BOOT_OPTION_SUPPORT_APP   0x00000002
+#define EFI_BOOT_OPTION_SUPPORT_COUNT 0x00000300
+
+typedef union {
+  struct {
+    UINT32  Revision        : 8;
+    UINT32  ShiftPressed    : 1;
+    UINT32  ControlPressed  : 1;
+    UINT32  AltPressed      : 1;
+    UINT32  LogoPressed     : 1;
+    UINT32  MenuPressed     : 1;
+    UINT32  SysReqPessed    : 1;
+    UINT32  Reserved        : 16;
+    UINT32  InputKeyCount   : 2;
+  } Options;
+  UINT32  PackedValue;
+} HOT_KEY_EFI_KEY_DATA;
+
+typedef struct {
+  HOT_KEY_EFI_KEY_DATA  KeyOptions;
+  UINT32                BootOptionCrc;
+  UINT16                BootOption;
+//EFI_INPUT_KEY         Keys[];
+} EFI_KEY_OPTION;
+
+#define EFI_KEY_OPTION_SHIFT     0x00000001
+#define EFI_KEY_OPTION_CONTROL   0x00000002
+#define EFI_KEY_OPTION_ALT       0x00000004
+#define EFI_KEY_OPTION_LOGO      0x00000008
+#define EFI_KEY_OPTION_MENU      0x00000010
+#define EFI_KEY_OPTION_SYSREQ    0x00000020
+#define EFI_KEY_CODE_COUNT       0x00000300
+
+
+//
+// EFI File location to boot from on removable media devices
+//
+#define EFI_REMOVABLE_MEDIA_FILE_NAME_IA32    L"\\EFI\\BOOT\\BOOTIA32.EFI"
+#define EFI_REMOVABLE_MEDIA_FILE_NAME_IA64    L"\\EFI\\BOOT\\BOOTIA64.EFI"
+#define EFI_REMOVABLE_MEDIA_FILE_NAME_X64     L"\\EFI\\BOOT\\BOOTX64.EFI"
+
+#if   defined (MDE_CPU_IA32)
+  #define EFI_REMOVABLE_MEDIA_FILE_NAME   EFI_REMOVABLE_MEDIA_FILE_NAME_IA32
+#elif defined (MDE_CPU_IPF)
+  #define EFI_REMOVABLE_MEDIA_FILE_NAME   EFI_REMOVABLE_MEDIA_FILE_NAME_IA64
+#elif defined (MDE_CPU_X64)
+  #define EFI_REMOVABLE_MEDIA_FILE_NAME   EFI_REMOVABLE_MEDIA_FILE_NAME_X64
+#elif defined (MDE_CPU_EBC)
+#else
+  #error Unknown Processor Type
+#endif
+
+#include <ipxe/efi/Uefi/UefiPxe.h>
+#include <ipxe/efi/Uefi/UefiGpt.h>
+#include <ipxe/efi/Uefi/UefiInternalFormRepresentation.h>
+
+#endif
diff --git a/src/include/ipxe/efi/X64/ProcessorBind.h b/src/include/ipxe/efi/X64/ProcessorBind.h
new file mode 100644
index 0000000..fe6c413
--- /dev/null
+++ b/src/include/ipxe/efi/X64/ProcessorBind.h
@@ -0,0 +1,247 @@
+/** @file
+  Processor or Compiler specific defines and types x64 (Intel(r) EM64T, AMD64).
+
+  Copyright (c) 2006, Intel Corporation
+  All rights reserved. This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __PROCESSOR_BIND_H__
+#define __PROCESSOR_BIND_H__
+
+///
+/// Define the processor type so other code can make processor based choices
+///
+#define MDE_CPU_X64
+
+
+//
+// Make sure we are useing the correct packing rules per EFI specification
+//
+#ifndef __GNUC__
+#pragma pack()
+#endif
+
+
+#if __INTEL_COMPILER
+//
+// Disable ICC's remark #869: "Parameter" was never referenced warning.
+// This is legal ANSI C code so we disable the remark that is turned on with -Wall
+//
+#pragma warning ( disable : 869 )
+
+//
+// Disable ICC's remark #1418: external function definition with no prior declaration.
+// This is legal ANSI C code so we disable the remark that is turned on with /W4
+//
+#pragma warning ( disable : 1418 )
+
+//
+// Disable ICC's remark #1419: external declaration in primary source file
+// This is legal ANSI C code so we disable the remark that is turned on with /W4
+//
+#pragma warning ( disable : 1419 )
+
+#endif
+
+
+#if _MSC_EXTENSIONS
+
+//
+// Disable warning that make it impossible to compile at /W4
+// This only works for Microsoft* tools
+//
+
+//
+// Disabling bitfield type checking warnings.
+//
+#pragma warning ( disable : 4214 )
+
+//
+// Disabling the unreferenced formal parameter warnings.
+//
+#pragma warning ( disable : 4100 )
+
+//
+// Disable slightly different base types warning as CHAR8 * can not be set
+// to a constant string.
+//
+#pragma warning ( disable : 4057 )
+
+//
+// ASSERT(FALSE) or while (TRUE) are legal constructes so supress this warning
+//
+#pragma warning ( disable : 4127 )
+
+//
+// This warning is caused by functions defined but not used. For precompiled header only.
+//
+#pragma warning ( disable : 4505 )
+
+//
+// This warning is caused by empty (after preprocessing) souce file. For precompiled header only.
+//
+#pragma warning ( disable : 4206 )
+
+#endif
+
+
+#if !defined(__GNUC__) && (__STDC_VERSION__ < 199901L)
+  //
+  // No ANSI C 2000 stdint.h integer width declarations, so define equivalents
+  //
+
+  #if _MSC_EXTENSIONS
+
+
+    //
+    // use Microsoft C complier dependent interger width types
+    //
+    typedef unsigned __int64    UINT64;
+    typedef __int64             INT64;
+    typedef unsigned __int32    UINT32;
+    typedef __int32             INT32;
+    typedef unsigned short      UINT16;
+    typedef unsigned short      CHAR16;
+    typedef short               INT16;
+    typedef unsigned char       BOOLEAN;
+    typedef unsigned char       UINT8;
+    typedef char                CHAR8;
+    typedef char                INT8;
+  #else
+    #ifdef _EFI_P64
+      //
+      // P64 - is Intel Itanium(TM) speak for pointers being 64-bit and longs and ints
+      //  are 32-bits
+      //
+      typedef unsigned long long  UINT64;
+      typedef long long           INT64;
+      typedef unsigned int        UINT32;
+      typedef int                 INT32;
+      typedef unsigned short      CHAR16;
+      typedef unsigned short      UINT16;
+      typedef short               INT16;
+      typedef unsigned char       BOOLEAN;
+      typedef unsigned char       UINT8;
+      typedef char                CHAR8;
+      typedef char                INT8;
+    #else
+      //
+      // Assume LP64 - longs and pointers are 64-bit. Ints are 32-bit.
+      //
+      typedef unsigned long   UINT64;
+      typedef long            INT64;
+      typedef unsigned int    UINT32;
+      typedef int             INT32;
+      typedef unsigned short  UINT16;
+      typedef unsigned short  CHAR16;
+      typedef short           INT16;
+      typedef unsigned char   BOOLEAN;
+      typedef unsigned char   UINT8;
+      typedef char            CHAR8;
+      typedef char            INT8;
+    #endif
+  #endif
+
+  #define UINT8_MAX 0xff
+
+#else
+  //
+  // Use ANSI C 2000 stdint.h integer width declarations
+  //
+  #include <stdint.h>
+  typedef uint8_t   BOOLEAN;
+  typedef int8_t    INT8;
+  typedef uint8_t   UINT8;
+  typedef int16_t   INT16;
+  typedef uint16_t  UINT16;
+  typedef int32_t   INT32;
+  typedef uint32_t  UINT32;
+  typedef int64_t   INT64;
+  typedef uint64_t  UINT64;
+  typedef char      CHAR8;
+  typedef uint16_t  CHAR16;
+
+#endif
+
+typedef UINT64  UINTN;
+typedef INT64   INTN;
+
+
+//
+// Processor specific defines
+//
+#define MAX_BIT     0x8000000000000000ULL
+#define MAX_2_BITS  0xC000000000000000ULL
+
+//
+// Maximum legal X64 address
+//
+#define MAX_ADDRESS   0xFFFFFFFFFFFFFFFFULL
+
+//
+// The stack alignment required for X64
+//
+#define CPU_STACK_ALIGNMENT   16
+
+//
+// Modifier to ensure that all protocol member functions and EFI intrinsics
+// use the correct C calling convention. All protocol member functions and
+// EFI intrinsics are required to modify thier member functions with EFIAPI.
+//
+#if _MSC_EXTENSIONS
+  ///
+  /// Define the standard calling convention reguardless of optimization level.
+  /// __cdecl is Microsoft* specific C extension.
+  ///
+  #define EFIAPI __cdecl
+#elif __GNUC__
+  ///
+  /// Define the standard calling convention reguardless of optimization level.
+  /// The GCC support assumes a GCC compiler that supports the EFI ABI. The EFI
+  /// ABI is much closer to the x64 Microsoft* ABI than standard x64 (x86-64)
+  /// GCC ABI. Thus a standard x64 (x86-64) GCC compiler can not be used for
+  /// x64. Warning the assembly code in the MDE x64 does not follow the correct
+  /// ABI for the standard x64 (x86-64) GCC.
+  ///
+  #define EFIAPI __attribute__((ms_abi))
+#else
+  ///
+  /// The default for a non Microsoft* or GCC compiler is to assume the EFI ABI
+  /// is the standard.
+  ///
+  #define EFIAPI
+#endif
+
+//
+// The Microsoft* C compiler can removed references to unreferenced data items
+//  if the /OPT:REF linker option is used. We defined a macro as this is a
+//  a non standard extension
+//
+#if _MSC_EXTENSIONS
+  #define GLOBAL_REMOVE_IF_UNREFERENCED __declspec(selectany)
+#else
+  #define GLOBAL_REMOVE_IF_UNREFERENCED
+#endif
+
+//
+// For symbol name in GNU assembly code, an extra "_" is necessary
+//
+#if __GNUC__
+  #if defined(linux)
+    #define ASM_PFX(name) name
+  #else
+    #define ASM_PFX(name) _##name
+  #endif
+#endif
+
+#define FUNCTION_ENTRY_POINT(p) (p)
+
+#endif
+
diff --git a/src/include/ipxe/efi/efi.h b/src/include/ipxe/efi/efi.h
new file mode 100644
index 0000000..4acbc24
--- /dev/null
+++ b/src/include/ipxe/efi/efi.h
@@ -0,0 +1,142 @@
+#ifndef _EFI_H
+#define _EFI_H
+
+/** @file
+ *
+ * EFI API
+ *
+ * The intention is to include near-verbatim copies of the EFI headers
+ * required by iPXE.  This is achieved using the import.pl script in
+ * this directory.  Run the import script to update the local copies
+ * of the headers:
+ *
+ *     ./import.pl /path/to/edk2/edk2
+ *
+ * where /path/to/edk2/edk2 is the path to your local checkout of the
+ * EFI Development Kit.
+ *
+ * Note that import.pl will modify any #include lines in each imported
+ * header to reflect its new location within the iPXE tree.  It will
+ * also tidy up the file by removing carriage return characters and
+ * trailing whitespace.
+ *
+ *
+ * At the time of writing, there are a few other modifications to
+ * these headers that are present in my personal edk2 tree, that are
+ * not yet committed back to the main edk2 repository.  These
+ * modifications are fixes for compilation on case-dependent
+ * filesystems, compilation under -mrtd and -mregparm=3, etc.
+ */
+
+/* EFI headers rudely redefine NULL */
+#undef NULL
+
+/* EFI headers expect ICC to define __GNUC__ */
+#if defined ( __ICC ) && ! defined ( __GNUC__ )
+#define __GNUC__ 1
+#endif
+
+/* Include the top-level EFI header files */
+#include <ipxe/efi/Uefi.h>
+#include <ipxe/efi/PiDxe.h>
+
+/* Reset any trailing #pragma pack directives */
+#pragma pack(1)
+#pragma pack()
+
+#include <ipxe/tables.h>
+#include <ipxe/uuid.h>
+
+/** An EFI protocol used by iPXE */
+struct efi_protocol {
+	/** GUID */
+	union {
+		/** EFI protocol GUID */
+		EFI_GUID guid;
+		/** UUID structure understood by iPXE */
+		union uuid uuid;
+	} u;
+	/** Variable containing pointer to protocol structure */
+	void **protocol;
+};
+
+/** EFI protocol table */
+#define EFI_PROTOCOLS __table ( struct efi_protocol, "efi_protocols" )
+
+/** Declare an EFI protocol used by iPXE */
+#define __efi_protocol __table_entry ( EFI_PROTOCOLS, 01 )
+
+/** Declare an EFI protocol to be required by iPXE
+ *
+ * @v _protocol		EFI protocol name
+ * @v _ptr		Pointer to protocol instance
+ */
+#define EFI_REQUIRE_PROTOCOL( _protocol, _ptr )				     \
+	struct efi_protocol __ ## _protocol __efi_protocol = {		     \
+		.u.guid = _protocol ## _GUID,				     \
+		.protocol = ( ( void ** ) ( void * )			     \
+			      ( ( (_ptr) == ( ( _protocol ** ) (_ptr) ) ) ?  \
+				(_ptr) : (_ptr) ) ),			     \
+	}
+
+/** An EFI configuration table used by iPXE */
+struct efi_config_table {
+	/** GUID */
+	union {
+		/** EFI configuration table GUID */
+		EFI_GUID guid;
+		/** UUID structure understood by iPXE */
+		union uuid uuid;
+	} u;
+	/** Variable containing pointer to configuration table */
+	void **table;
+	/** Table is required for operation */
+	int required;
+};
+
+/** EFI configuration table table */
+#define EFI_CONFIG_TABLES \
+	__table ( struct efi_config_table, "efi_config_tables" )
+
+/** Declare an EFI configuration table used by iPXE */
+#define __efi_config_table __table_entry ( EFI_CONFIG_TABLES, 01 )
+
+/** Declare an EFI configuration table to be used by iPXE
+ *
+ * @v _table		EFI configuration table name
+ * @v _ptr		Pointer to configuration table
+ * @v _required		Table is required for operation
+ */
+#define EFI_USE_TABLE( _table, _ptr, _required )			     \
+	struct efi_config_table __ ## _table __efi_config_table = {	     \
+		.u.guid = _table ## _GUID,				     \
+		.table = ( ( void ** ) ( void * ) (_ptr) ),		     \
+		.required = (_required),				     \
+	}
+
+/** Convert a iPXE status code to an EFI status code
+ *
+ * FIXME: actually perform some kind of conversion.  iPXE error codes
+ * will be detected as EFI error codes; both have the top bit set, and
+ * the success return code is zero for both.  Anything that just
+ * reports a numerical error will be OK, anything attempting to
+ * interpret the value or to display a text equivalent will be
+ * screwed.
+ */
+#define RC_TO_EFIRC( rc ) (rc)
+
+/** Convert an EFI status code to a iPXE status code
+ *
+ * FIXME: as above
+ */
+#define EFIRC_TO_RC( efirc ) (efirc)
+
+extern EFI_HANDLE efi_image_handle;
+extern EFI_SYSTEM_TABLE *efi_systab;
+
+extern const char * efi_strerror ( EFI_STATUS efirc );
+extern EFI_STATUS efi_init ( EFI_HANDLE image_handle,
+			     EFI_SYSTEM_TABLE *systab );
+extern int efi_snp_install ( void );
+
+#endif /* _EFI_H */
diff --git a/src/include/ipxe/efi/efi_io.h b/src/include/ipxe/efi/efi_io.h
new file mode 100644
index 0000000..2ed96e1
--- /dev/null
+++ b/src/include/ipxe/efi/efi_io.h
@@ -0,0 +1,180 @@
+#ifndef _IPXE_EFI_IO_H
+#define _IPXE_EFI_IO_H
+
+/** @file
+ *
+ * iPXE I/O API for EFI
+ *
+ * EFI runs with flat physical addressing, so the various mappings
+ * between virtual addresses, I/O addresses and bus addresses are all
+ * no-ops.  I/O is handled using the EFI_CPU_IO_PROTOCOL.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef IOAPI_EFI
+#define IOAPI_PREFIX_efi
+#else
+#define IOAPI_PREFIX_efi __efi_
+#endif
+
+extern unsigned long long efi_ioread ( volatile void *io_addr,
+				       size_t size );
+extern void efi_iowrite ( unsigned long long data, volatile void *io_addr,
+			  size_t size );
+extern void efi_ioreads ( volatile void *io_addr, void *data,
+			  size_t size, unsigned int count );
+extern void efi_iowrites ( volatile void *io_addr, const void *data,
+			  size_t size, unsigned int count );
+
+/*
+ * Physical<->Bus and Bus<->I/O address mappings
+ *
+ * EFI runs with flat physical addressing, so these are all no-ops.
+ *
+ */
+
+static inline __always_inline unsigned long
+IOAPI_INLINE ( efi, phys_to_bus ) ( unsigned long phys_addr ) {
+	return phys_addr;
+}
+
+static inline __always_inline unsigned long
+IOAPI_INLINE ( efi, bus_to_phys ) ( unsigned long bus_addr ) {
+	return bus_addr;
+}
+
+static inline __always_inline void *
+IOAPI_INLINE ( efi, ioremap ) ( unsigned long bus_addr, size_t len __unused ) {
+	return ( ( void * ) bus_addr );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, iounmap ) ( volatile const void *io_addr __unused ) {
+	/* Nothing to do */
+}
+
+static inline __always_inline unsigned long
+IOAPI_INLINE ( efi, io_to_bus ) ( volatile const void *io_addr ) {
+	return ( ( unsigned long ) io_addr );
+}
+
+/*
+ * I/O functions
+ *
+ */
+
+static inline __always_inline uint8_t
+IOAPI_INLINE ( efi, readb ) ( volatile uint8_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline uint16_t
+IOAPI_INLINE ( efi, readw ) ( volatile uint16_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline uint32_t
+IOAPI_INLINE ( efi, readl ) ( volatile uint32_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline uint64_t
+IOAPI_INLINE ( efi, readq ) ( volatile uint64_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, writeb ) ( uint8_t data, volatile uint8_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, writew ) ( uint16_t data, volatile uint16_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, writel ) ( uint32_t data, volatile uint32_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, writeq ) ( uint64_t data, volatile uint64_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline uint8_t
+IOAPI_INLINE ( efi, inb ) ( volatile uint8_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline uint16_t
+IOAPI_INLINE ( efi, inw ) ( volatile uint16_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline uint32_t
+IOAPI_INLINE ( efi, inl ) ( volatile uint32_t *io_addr ) {
+	return efi_ioread ( io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, outb ) ( uint8_t data, volatile uint8_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, outw ) ( uint16_t data, volatile uint16_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, outl ) ( uint32_t data, volatile uint32_t *io_addr ) {
+	efi_iowrite ( data, io_addr, sizeof ( *io_addr ) );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, insb ) ( volatile uint8_t *io_addr, uint8_t *data,
+			     unsigned int count ) {
+	efi_ioreads ( io_addr, data, sizeof ( *io_addr ), count );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, insw ) ( volatile uint16_t *io_addr, uint16_t *data,
+			     unsigned int count ) {
+	efi_ioreads ( io_addr, data, sizeof ( *io_addr ), count );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, insl ) ( volatile uint32_t *io_addr, uint32_t *data,
+			     unsigned int count ) {
+	efi_ioreads ( io_addr, data, sizeof ( *io_addr ), count );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, outsb ) ( volatile uint8_t *io_addr, const uint8_t *data,
+			      unsigned int count ) {
+	efi_iowrites ( io_addr, data, sizeof ( *io_addr ), count );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, outsw ) ( volatile uint16_t *io_addr, const uint16_t *data,
+			      unsigned int count ) {
+	efi_iowrites ( io_addr, data, sizeof ( *io_addr ), count );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, outsl ) ( volatile uint32_t *io_addr, const uint32_t *data,
+			      unsigned int count ) {
+	efi_iowrites ( io_addr, data, sizeof ( *io_addr ), count );
+}
+
+static inline __always_inline void
+IOAPI_INLINE ( efi, mb ) ( void ) {
+	/* Do nothing; EFI readl()/writel() calls already act as
+	 * memory barriers.
+	 */
+}
+
+#endif /* _IPXE_EFI_IO_H */
diff --git a/src/include/ipxe/efi/efi_pci.h b/src/include/ipxe/efi/efi_pci.h
new file mode 100644
index 0000000..b280d80
--- /dev/null
+++ b/src/include/ipxe/efi/efi_pci.h
@@ -0,0 +1,148 @@
+#ifndef _IPXE_EFI_PCI_H
+#define _IPXE_EFI_PCI_H
+
+/** @file
+ *
+ * iPXE PCI I/O API for EFI
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef PCIAPI_EFI
+#define PCIAPI_PREFIX_efi
+#else
+#define PCIAPI_PREFIX_efi __efi_
+#endif
+
+/* EFI PCI width codes defined by EFI spec */
+#define EFIPCI_WIDTH_BYTE 0
+#define EFIPCI_WIDTH_WORD 1
+#define EFIPCI_WIDTH_DWORD 2
+
+#define EFIPCI_LOCATION( _offset, _width ) \
+	( (_offset) | ( (_width) << 16 ) )
+#define EFIPCI_OFFSET( _location ) ( (_location) & 0xffff )
+#define EFIPCI_WIDTH( _location ) ( (_location) >> 16 )
+
+struct pci_device;
+
+extern int efipci_read ( struct pci_device *pci, unsigned long location,
+			 void *value );
+extern int efipci_write ( struct pci_device *pci, unsigned long location,
+			  unsigned long value );
+
+/**
+ * Determine maximum PCI bus number within system
+ *
+ * @ret max_bus		Maximum bus number
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_max_bus ) ( void ) {
+	/* No way to work this out via EFI */
+	return 0xff;
+}
+
+/**
+ * Read byte from PCI configuration space via EFI
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value read
+ * @ret rc	Return status code
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_read_config_byte ) ( struct pci_device *pci,
+					      unsigned int where,
+					      uint8_t *value ) {
+	return efipci_read ( pci,
+			     EFIPCI_LOCATION ( where, EFIPCI_WIDTH_BYTE ),
+			     value );
+}
+
+/**
+ * Read word from PCI configuration space via EFI
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value read
+ * @ret rc	Return status code
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_read_config_word ) ( struct pci_device *pci,
+					      unsigned int where,
+					      uint16_t *value ) {
+	return efipci_read ( pci,
+			     EFIPCI_LOCATION ( where, EFIPCI_WIDTH_WORD ),
+			     value );
+}
+
+/**
+ * Read dword from PCI configuration space via EFI
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value read
+ * @ret rc	Return status code
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_read_config_dword ) ( struct pci_device *pci,
+					       unsigned int where,
+					       uint32_t *value ) {
+	return efipci_read ( pci,
+			     EFIPCI_LOCATION ( where, EFIPCI_WIDTH_DWORD ),
+			     value );
+}
+
+/**
+ * Write byte to PCI configuration space via EFI
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value to be written
+ * @ret rc	Return status code
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_write_config_byte ) ( struct pci_device *pci,
+					       unsigned int where,
+					       uint8_t value ) {
+	return efipci_write ( pci,
+			      EFIPCI_LOCATION ( where, EFIPCI_WIDTH_BYTE ),
+			      value );
+}
+
+/**
+ * Write word to PCI configuration space via EFI
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value to be written
+ * @ret rc	Return status code
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_write_config_word ) ( struct pci_device *pci,
+					       unsigned int where,
+					       uint16_t value ) {
+	return efipci_write ( pci,
+			      EFIPCI_LOCATION ( where, EFIPCI_WIDTH_WORD ),
+			      value );
+}
+
+/**
+ * Write dword to PCI configuration space via EFI
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value to be written
+ * @ret rc	Return status code
+ */
+static inline __always_inline int
+PCIAPI_INLINE ( efi, pci_write_config_dword ) ( struct pci_device *pci,
+						unsigned int where,
+						uint32_t value ) {
+	return efipci_write ( pci,
+			      EFIPCI_LOCATION ( where, EFIPCI_WIDTH_DWORD ),
+			      value );
+}
+
+#endif /* _IPXE_EFI_PCI_H */
diff --git a/src/include/ipxe/efi/efi_smbios.h b/src/include/ipxe/efi/efi_smbios.h
new file mode 100644
index 0000000..7642e5b
--- /dev/null
+++ b/src/include/ipxe/efi/efi_smbios.h
@@ -0,0 +1,18 @@
+#ifndef _IPXE_EFI_SMBIOS_H
+#define _IPXE_EFI_SMBIOS_H
+
+/** @file
+ *
+ * iPXE SMBIOS API for EFI
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef SMBIOS_EFI
+#define SMBIOS_PREFIX_efi
+#else
+#define SMBIOS_PREFIX_efi __efi_
+#endif
+
+#endif /* _IPXE_EFI_SMBIOS_H */
diff --git a/src/include/ipxe/efi/efi_timer.h b/src/include/ipxe/efi/efi_timer.h
new file mode 100644
index 0000000..b10543d
--- /dev/null
+++ b/src/include/ipxe/efi/efi_timer.h
@@ -0,0 +1,18 @@
+#ifndef _IPXE_EFI_TIMER_H
+#define _IPXE_EFI_TIMER_H
+
+/** @file
+ *
+ * iPXE timer API for EFI
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef TIMER_EFI
+#define TIMER_PREFIX_efi
+#else
+#define TIMER_PREFIX_efi __efi_
+#endif
+
+#endif /* _IPXE_EFI_TIMER_H */
diff --git a/src/include/ipxe/efi/efi_uaccess.h b/src/include/ipxe/efi/efi_uaccess.h
new file mode 100644
index 0000000..dc226a3
--- /dev/null
+++ b/src/include/ipxe/efi/efi_uaccess.h
@@ -0,0 +1,90 @@
+#ifndef _IPXE_EFI_UACCESS_H
+#define _IPXE_EFI_UACCESS_H
+
+/** @file
+ *
+ * iPXE user access API for EFI
+ *
+ * EFI runs with flat physical addressing, so the various mappings
+ * between virtual addresses, I/O addresses and bus addresses are all
+ * no-ops.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef UACCESS_EFI
+#define UACCESS_PREFIX_efi
+#else
+#define UACCESS_PREFIX_efi __efi_
+#endif
+
+/**
+ * Convert physical address to user pointer
+ *
+ * @v phys_addr		Physical address
+ * @ret userptr		User pointer
+ */
+static inline __always_inline userptr_t
+UACCESS_INLINE ( efi, phys_to_user ) ( unsigned long phys_addr ) {
+	return phys_addr;
+}
+
+/**
+ * Convert user buffer to physical address
+ *
+ * @v userptr		User pointer
+ * @v offset		Offset from user pointer
+ * @ret phys_addr	Physical address
+ */
+static inline __always_inline unsigned long
+UACCESS_INLINE ( efi, user_to_phys ) ( userptr_t userptr, off_t offset ) {
+	return ( userptr + offset );
+}
+
+static inline __always_inline userptr_t
+UACCESS_INLINE ( efi, virt_to_user ) ( volatile const void *addr ) {
+	return trivial_virt_to_user ( addr );
+}
+
+static inline __always_inline void *
+UACCESS_INLINE ( efi, user_to_virt ) ( userptr_t userptr, off_t offset ) {
+	return trivial_user_to_virt ( userptr, offset );
+}
+
+static inline __always_inline userptr_t
+UACCESS_INLINE ( efi, userptr_add ) ( userptr_t userptr, off_t offset ) {
+	return trivial_userptr_add ( userptr, offset );
+}
+
+static inline __always_inline void
+UACCESS_INLINE ( efi, memcpy_user ) ( userptr_t dest, off_t dest_off,
+					userptr_t src, off_t src_off,
+					size_t len ) {
+	trivial_memcpy_user ( dest, dest_off, src, src_off, len );
+}
+
+static inline __always_inline void
+UACCESS_INLINE ( efi, memmove_user ) ( userptr_t dest, off_t dest_off,
+					 userptr_t src, off_t src_off,
+					 size_t len ) {
+	trivial_memmove_user ( dest, dest_off, src, src_off, len );
+}
+
+static inline __always_inline void
+UACCESS_INLINE ( efi, memset_user ) ( userptr_t buffer, off_t offset,
+					int c, size_t len ) {
+	trivial_memset_user ( buffer, offset, c, len );
+}
+
+static inline __always_inline size_t
+UACCESS_INLINE ( efi, strlen_user ) ( userptr_t buffer, off_t offset ) {
+	return trivial_strlen_user ( buffer, offset );
+}
+
+static inline __always_inline off_t
+UACCESS_INLINE ( efi, memchr_user ) ( userptr_t buffer, off_t offset,
+					int c, size_t len ) {
+	return trivial_memchr_user ( buffer, offset, c, len );
+}
+
+#endif /* _IPXE_EFI_UACCESS_H */
diff --git a/src/include/ipxe/efi/efi_umalloc.h b/src/include/ipxe/efi/efi_umalloc.h
new file mode 100644
index 0000000..911e69a
--- /dev/null
+++ b/src/include/ipxe/efi/efi_umalloc.h
@@ -0,0 +1,18 @@
+#ifndef _IPXE_EFI_UMALLOC_H
+#define _IPXE_EFI_UMALLOC_H
+
+/** @file
+ *
+ * iPXE user memory allocation API for EFI
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef UMALLOC_EFI
+#define UMALLOC_PREFIX_efi
+#else
+#define UMALLOC_PREFIX_efi __efi_
+#endif
+
+#endif /* _IPXE_EFI_UMALLOC_H */
diff --git a/src/include/ipxe/efi/import.pl b/src/include/ipxe/efi/import.pl
new file mode 100755
index 0000000..4ea5175
--- /dev/null
+++ b/src/include/ipxe/efi/import.pl
@@ -0,0 +1,75 @@
+#!/usr/bin/perl -w
+
+use File::Spec::Functions qw ( :ALL );
+use File::Find;
+use File::Path;
+use FindBin;
+use strict;
+use warnings;
+
+sub try_import_file {
+  my $ipxedir = shift;
+  my $edkdirs = shift;
+  my $filename = shift;
+
+  # Skip everything except headers
+  return unless $filename =~ /\.h$/;
+  print "$filename...";
+
+  my $outfile = catfile ( $ipxedir, $filename );
+  foreach my $edkdir ( @$edkdirs ) {
+    my $infile = catfile ( $edkdir, $filename );
+    if ( -e $infile ) {
+      # We have found a matching source file - import it
+      print "$infile\n";
+      open my $infh, "<$infile" or die "Could not open $infile: $!\n";
+      ( undef, my $outdir, undef ) = splitpath ( $outfile );
+      mkpath ( $outdir );
+      open my $outfh, ">$outfile" or die "Could not open $outfile: $!\n";
+      my @dependencies = ();
+      while ( <$infh> ) {
+	# Strip CR and trailing whitespace
+	s/\r//g;
+	s/\s*$//g;
+	chomp;
+	# Update include lines, and record included files
+	if ( s/^\#include\s+[<\"](\S+)[>\"]/\#include <ipxe\/efi\/$1>/ ) {
+	  push @dependencies, $1;
+	}
+	print $outfh "$_\n";
+      }
+      close $outfh;
+      close $infh;
+      # Recurse to handle any included files that we don't already have
+      foreach my $dependency ( @dependencies ) {
+	if ( ! -e catfile ( $ipxedir, $dependency ) ) {
+	  print "...following dependency on $dependency\n";
+	  try_import_file ( $ipxedir, $edkdirs, $dependency );
+	}
+      }
+      return;
+    }
+  }
+  print "no equivalent found\n";
+}
+
+# Identify edk import directories
+die "Syntax $0 /path/to/edk2/edk2\n" unless @ARGV == 1;
+my $edktop = shift;
+die "Directory \"$edktop\" does not appear to contain the EFI EDK2\n"
+    unless -e catfile ( $edktop, "MdePkg" );
+my $edkdirs = [ catfile ( $edktop, "MdePkg/Include" ),
+		catfile ( $edktop, "IntelFrameworkPkg/Include" ) ];
+
+# Identify iPXE EFI includes directory
+my $ipxedir = $FindBin::Bin;
+die "Directory \"$ipxedir\" does not appear to contain the iPXE EFI includes\n"
+    unless -e catfile ( $ipxedir, "../../../include/ipxe/efi" );
+
+print "Importing EFI headers into $ipxedir\nfrom ";
+print join ( "\n and ", @$edkdirs )."\n";
+
+# Import headers
+find ( { wanted => sub {
+  try_import_file ( $ipxedir, $edkdirs, abs2rel ( $_, $ipxedir ) );
+}, no_chdir => 1 }, $ipxedir );
diff --git a/src/include/ipxe/eisa.h b/src/include/ipxe/eisa.h
new file mode 100644
index 0000000..1588f81
--- /dev/null
+++ b/src/include/ipxe/eisa.h
@@ -0,0 +1,130 @@
+#ifndef EISA_H
+#define EISA_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/isa_ids.h>
+#include <ipxe/device.h>
+#include <ipxe/tables.h>
+
+/*
+ * EISA constants
+ *
+ */
+
+#define EISA_MIN_SLOT (0x1)
+#define EISA_MAX_SLOT (0xf)	/* Must be 2^n - 1 */
+#define EISA_SLOT_BASE( n ) ( 0x1000 * (n) )
+
+#define EISA_VENDOR_ID ( 0xc80 )
+#define EISA_PROD_ID ( 0xc82 )
+#define EISA_GLOBAL_CONFIG ( 0xc84 )
+
+#define EISA_CMD_RESET ( 1 << 2 )
+#define EISA_CMD_ENABLE ( 1 << 0 )
+
+/** An EISA device ID list entry */
+struct eisa_device_id {
+	/** Name */
+        const char *name;
+	/** Manufacturer ID */
+	uint16_t vendor_id;
+	/** Product ID */
+	uint16_t prod_id;
+};
+
+/** An EISA device */
+struct eisa_device {
+	/** Generic device */
+	struct device dev;
+	/** Slot number */
+	unsigned int slot;
+	/** I/O address */
+	uint16_t ioaddr;
+	/** Manufacturer ID */
+	uint16_t vendor_id;
+	/** Product ID */
+	uint16_t prod_id;
+	/** Driver for this device */
+	struct eisa_driver *driver;
+	/** Driver-private data
+	 *
+	 * Use eisa_set_drvdata() and eisa_get_drvdata() to access
+	 * this field.
+	 */
+	void *priv;
+	/** Driver name */
+	const char *driver_name;
+};
+
+/** An EISA driver */
+struct eisa_driver {
+	/** EISA ID table */
+	struct eisa_device_id *ids;
+	/** Number of entries in EISA ID table */
+	unsigned int id_count;
+	/**
+	 * Probe device
+	 *
+	 * @v eisa	EISA device
+	 * @v id	Matching entry in ID table
+	 * @ret rc	Return status code
+	 */
+	int ( * probe ) ( struct eisa_device *eisa,
+			  const struct eisa_device_id *id );
+	/**
+	 * Remove device
+	 *
+	 * @v eisa	EISA device
+	 */
+	void ( * remove ) ( struct eisa_device *eisa );
+};
+
+/** EISA driver table */
+#define EISA_DRIVERS __table ( struct eisa_driver, "eisa_drivers" )
+
+/** Declare an EISA driver */
+#define __eisa_driver __table_entry ( EISA_DRIVERS, 01 )
+
+extern void eisa_device_enabled ( struct eisa_device *eisa, int enabled );
+
+/**
+ * Enable EISA device
+ *
+ * @v eisa		EISA device
+ */
+static inline void enable_eisa_device ( struct eisa_device *eisa ) {
+	eisa_device_enabled ( eisa, 1 );
+}
+
+/**
+ * Disable EISA device
+ *
+ * @v eisa		EISA device
+ */
+static inline void disable_eisa_device ( struct eisa_device *eisa ) {
+	eisa_device_enabled ( eisa, 0 );
+}
+
+/**
+ * Set EISA driver-private data
+ *
+ * @v eisa		EISA device
+ * @v priv		Private data
+ */
+static inline void eisa_set_drvdata ( struct eisa_device *eisa, void *priv ) {
+	eisa->priv = priv;
+}
+
+/**
+ * Get EISA driver-private data
+ *
+ * @v eisa		EISA device
+ * @ret priv		Private data
+ */
+static inline void * eisa_get_drvdata ( struct eisa_device *eisa ) {
+	return eisa->priv;
+}
+
+#endif /* EISA_H */
diff --git a/src/include/ipxe/elf.h b/src/include/ipxe/elf.h
new file mode 100644
index 0000000..23160a9
--- /dev/null
+++ b/src/include/ipxe/elf.h
@@ -0,0 +1,17 @@
+#ifndef _IPXE_ELF_H
+#define _IPXE_ELF_H
+
+/**
+ * @file
+ *
+ * ELF image format
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <elf.h>
+
+extern int elf_load ( struct image *image );
+
+#endif /* _IPXE_ELF_H */
diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h
new file mode 100644
index 0000000..736ce46
--- /dev/null
+++ b/src/include/ipxe/errfile.h
@@ -0,0 +1,211 @@
+#ifndef _IPXE_ERRFILE_H
+#define _IPXE_ERRFILE_H
+
+/** @file
+ *
+ * Error file identifiers
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <bits/errfile.h>
+
+/**
+ * @defgroup errfilecat Error file identifier categories
+ *
+ * @{
+ */
+
+#define ERRFILE_CORE		0x00002000	/**< Core code */
+#define ERRFILE_DRIVER		0x00004000	/**< Driver code */
+#define ERRFILE_NET		0x00006000	/**< Networking code */
+#define ERRFILE_IMAGE		0x00008000	/**< Image code */
+#define ERRFILE_OTHER		0x0000e000	/**< Any other code */
+
+/** @} */
+
+/** Flag for architecture-dependent error files */
+#define ERRFILE_ARCH		0x00800000
+
+/**
+ * @defgroup errfile Error file identifiers
+ *
+ * These values are automatically incorporated into the definitions
+ * for error numbers such as EINVAL.
+ *
+ * @{
+ */
+
+#define ERRFILE_asprintf	       ( ERRFILE_CORE | 0x00000000 )
+#define ERRFILE_downloader	       ( ERRFILE_CORE | 0x00010000 )
+#define ERRFILE_exec		       ( ERRFILE_CORE | 0x00020000 )
+#define ERRFILE_hw		       ( ERRFILE_CORE | 0x00030000 )
+#define ERRFILE_iobuf		       ( ERRFILE_CORE | 0x00040000 )
+#define ERRFILE_job		       ( ERRFILE_CORE | 0x00050000 )
+#define ERRFILE_linebuf		       ( ERRFILE_CORE | 0x00060000 )
+#define ERRFILE_monojob		       ( ERRFILE_CORE | 0x00070000 )
+#define ERRFILE_nvo		       ( ERRFILE_CORE | 0x00080000 )
+#define ERRFILE_open		       ( ERRFILE_CORE | 0x00090000 )
+#define ERRFILE_posix_io	       ( ERRFILE_CORE | 0x000a0000 )
+#define ERRFILE_resolv		       ( ERRFILE_CORE | 0x000b0000 )
+#define ERRFILE_settings	       ( ERRFILE_CORE | 0x000c0000 )
+#define ERRFILE_vsprintf	       ( ERRFILE_CORE | 0x000d0000 )
+#define ERRFILE_xfer		       ( ERRFILE_CORE | 0x000e0000 )
+#define ERRFILE_bitmap		       ( ERRFILE_CORE | 0x000f0000 )
+
+#define ERRFILE_eisa		     ( ERRFILE_DRIVER | 0x00000000 )
+#define ERRFILE_isa		     ( ERRFILE_DRIVER | 0x00010000 )
+#define ERRFILE_isapnp		     ( ERRFILE_DRIVER | 0x00020000 )
+#define ERRFILE_mca		     ( ERRFILE_DRIVER | 0x00030000 )
+#define ERRFILE_pci		     ( ERRFILE_DRIVER | 0x00040000 )
+
+#define ERRFILE_nvs		     ( ERRFILE_DRIVER | 0x00100000 )
+#define ERRFILE_spi		     ( ERRFILE_DRIVER | 0x00110000 )
+#define ERRFILE_i2c_bit		     ( ERRFILE_DRIVER | 0x00120000 )
+#define ERRFILE_spi_bit		     ( ERRFILE_DRIVER | 0x00130000 )
+
+#define ERRFILE_3c509		     ( ERRFILE_DRIVER | 0x00200000 )
+#define ERRFILE_bnx2		     ( ERRFILE_DRIVER | 0x00210000 )
+#define ERRFILE_cs89x0		     ( ERRFILE_DRIVER | 0x00220000 )
+#define ERRFILE_eepro		     ( ERRFILE_DRIVER | 0x00230000 )
+#define ERRFILE_etherfabric	     ( ERRFILE_DRIVER | 0x00240000 )
+#define ERRFILE_legacy		     ( ERRFILE_DRIVER | 0x00250000 )
+#define ERRFILE_natsemi		     ( ERRFILE_DRIVER | 0x00260000 )
+#define ERRFILE_pnic		     ( ERRFILE_DRIVER | 0x00270000 )
+#define ERRFILE_prism2_pci	     ( ERRFILE_DRIVER | 0x00280000 )
+#define ERRFILE_prism2_plx	     ( ERRFILE_DRIVER | 0x00290000 )
+#define ERRFILE_rtl8139		     ( ERRFILE_DRIVER | 0x002a0000 )
+#define ERRFILE_smc9000		     ( ERRFILE_DRIVER | 0x002b0000 )
+#define ERRFILE_tg3		     ( ERRFILE_DRIVER | 0x002c0000 )
+#define ERRFILE_3c509_eisa	     ( ERRFILE_DRIVER | 0x002d0000 )
+#define ERRFILE_3c515		     ( ERRFILE_DRIVER | 0x002e0000 )
+#define ERRFILE_3c529		     ( ERRFILE_DRIVER | 0x002f0000 )
+#define ERRFILE_3c595		     ( ERRFILE_DRIVER | 0x00300000 )
+#define ERRFILE_3c5x9		     ( ERRFILE_DRIVER | 0x00310000 )
+#define ERRFILE_3c90x		     ( ERRFILE_DRIVER | 0x00320000 )
+#define ERRFILE_amd8111e	     ( ERRFILE_DRIVER | 0x00330000 )
+#define ERRFILE_davicom		     ( ERRFILE_DRIVER | 0x00340000 )
+#define ERRFILE_depca		     ( ERRFILE_DRIVER | 0x00350000 )
+#define ERRFILE_dmfe		     ( ERRFILE_DRIVER | 0x00360000 )
+#define ERRFILE_eepro100	     ( ERRFILE_DRIVER | 0x00380000 )
+#define ERRFILE_epic100		     ( ERRFILE_DRIVER | 0x00390000 )
+#define ERRFILE_forcedeth	     ( ERRFILE_DRIVER | 0x003a0000 )
+#define ERRFILE_mtd80x		     ( ERRFILE_DRIVER | 0x003b0000 )
+#define ERRFILE_ns83820		     ( ERRFILE_DRIVER | 0x003c0000 )
+#define ERRFILE_ns8390		     ( ERRFILE_DRIVER | 0x003d0000 )
+#define ERRFILE_pcnet32		     ( ERRFILE_DRIVER | 0x003e0000 )
+#define ERRFILE_r8169		     ( ERRFILE_DRIVER | 0x003f0000 )
+#define ERRFILE_sis900		     ( ERRFILE_DRIVER | 0x00400000 )
+#define ERRFILE_sundance	     ( ERRFILE_DRIVER | 0x00410000 )
+#define ERRFILE_tlan		     ( ERRFILE_DRIVER | 0x00420000 )
+#define ERRFILE_tulip		     ( ERRFILE_DRIVER | 0x00430000 )
+#define ERRFILE_via_rhine	     ( ERRFILE_DRIVER | 0x00440000 )
+#define ERRFILE_via_velocity	     ( ERRFILE_DRIVER | 0x00450000 )
+#define ERRFILE_w89c840		     ( ERRFILE_DRIVER | 0x00460000 )
+#define ERRFILE_ipoib		     ( ERRFILE_DRIVER | 0x00470000 )
+#define ERRFILE_e1000_main	     ( ERRFILE_DRIVER | 0x00480000 )
+#define ERRFILE_e1000e_main	     ( ERRFILE_DRIVER | 0x00490000 )
+#define ERRFILE_mtnic		     ( ERRFILE_DRIVER | 0x004a0000 )
+#define ERRFILE_phantom		     ( ERRFILE_DRIVER | 0x004b0000 )
+#define ERRFILE_ne2k_isa	     ( ERRFILE_DRIVER | 0x004c0000 )
+#define ERRFILE_b44		     ( ERRFILE_DRIVER | 0x004d0000 )
+#define ERRFILE_rtl818x		     ( ERRFILE_DRIVER | 0x004e0000 )
+#define ERRFILE_sky2                 ( ERRFILE_DRIVER | 0x004f0000 )
+#define ERRFILE_ath5k		     ( ERRFILE_DRIVER | 0x00500000 )
+#define ERRFILE_atl1e		     ( ERRFILE_DRIVER | 0x00510000 )
+#define ERRFILE_sis190		     ( ERRFILE_DRIVER | 0x00520000 )
+#define ERRFILE_myri10ge	     ( ERRFILE_DRIVER | 0x00530000 )
+#define ERRFILE_skge		     ( ERRFILE_DRIVER | 0x00540000 )
+#define ERRFILE_vxge_main	     ( ERRFILE_DRIVER | 0x00550000 )
+#define ERRFILE_vxge_config	     ( ERRFILE_DRIVER | 0x00560000 )
+#define ERRFILE_vxge_traffic	     ( ERRFILE_DRIVER | 0x00570000 )
+#define ERRFILE_igb_main	     ( ERRFILE_DRIVER | 0x00580000 )
+
+#define ERRFILE_scsi		     ( ERRFILE_DRIVER | 0x00700000 )
+#define ERRFILE_arbel		     ( ERRFILE_DRIVER | 0x00710000 )
+#define ERRFILE_hermon		     ( ERRFILE_DRIVER | 0x00720000 )
+#define ERRFILE_linda		     ( ERRFILE_DRIVER | 0x00730000 )
+#define ERRFILE_ata		     ( ERRFILE_DRIVER | 0x00740000 )
+#define ERRFILE_srp		     ( ERRFILE_DRIVER | 0x00750000 )
+
+#define ERRFILE_aoe			( ERRFILE_NET | 0x00000000 )
+#define ERRFILE_arp			( ERRFILE_NET | 0x00010000 )
+#define ERRFILE_dhcpopts		( ERRFILE_NET | 0x00020000 )
+#define ERRFILE_ethernet		( ERRFILE_NET | 0x00030000 )
+#define ERRFILE_icmpv6			( ERRFILE_NET | 0x00040000 )
+#define ERRFILE_ipv4			( ERRFILE_NET | 0x00050000 )
+#define ERRFILE_ipv6			( ERRFILE_NET | 0x00060000 )
+#define ERRFILE_ndp			( ERRFILE_NET | 0x00070000 )
+#define ERRFILE_netdevice		( ERRFILE_NET | 0x00080000 )
+#define ERRFILE_nullnet			( ERRFILE_NET | 0x00090000 )
+#define ERRFILE_tcp			( ERRFILE_NET | 0x000a0000 )
+#define ERRFILE_ftp			( ERRFILE_NET | 0x000b0000 )
+#define ERRFILE_http			( ERRFILE_NET | 0x000c0000 )
+#define ERRFILE_iscsi			( ERRFILE_NET | 0x000d0000 )
+#define ERRFILE_tcpip			( ERRFILE_NET | 0x000e0000 )
+#define ERRFILE_udp			( ERRFILE_NET | 0x000f0000 )
+#define ERRFILE_dhcp			( ERRFILE_NET | 0x00100000 )
+#define ERRFILE_dns			( ERRFILE_NET | 0x00110000 )
+#define ERRFILE_tftp			( ERRFILE_NET | 0x00120000 )
+#define ERRFILE_infiniband		( ERRFILE_NET | 0x00130000 )
+#define ERRFILE_netdev_settings		( ERRFILE_NET | 0x00140000 )
+#define ERRFILE_dhcppkt			( ERRFILE_NET | 0x00150000 )
+#define ERRFILE_slam			( ERRFILE_NET | 0x00160000 )
+#define ERRFILE_ib_sma			( ERRFILE_NET | 0x00170000 )
+#define ERRFILE_ib_packet		( ERRFILE_NET | 0x00180000 )
+#define ERRFILE_icmp			( ERRFILE_NET | 0x00190000 )
+#define ERRFILE_ib_qset			( ERRFILE_NET | 0x001a0000 )
+#define ERRFILE_ib_gma			( ERRFILE_NET | 0x001b0000 )
+#define ERRFILE_ib_pathrec		( ERRFILE_NET | 0x001c0000 )
+#define ERRFILE_ib_mcast		( ERRFILE_NET | 0x001d0000 )
+#define ERRFILE_ib_cm			( ERRFILE_NET | 0x001e0000 )
+#define ERRFILE_net80211		( ERRFILE_NET | 0x001f0000 )
+#define ERRFILE_ib_mi			( ERRFILE_NET | 0x00200000 )
+#define ERRFILE_ib_cmrc			( ERRFILE_NET | 0x00210000 )
+#define ERRFILE_ib_srp			( ERRFILE_NET | 0x00220000 )
+#define ERRFILE_sec80211		( ERRFILE_NET | 0x00230000 )
+#define ERRFILE_wep			( ERRFILE_NET | 0x00240000 )
+#define ERRFILE_eapol			( ERRFILE_NET | 0x00250000 )
+#define ERRFILE_wpa			( ERRFILE_NET | 0x00260000 )
+#define ERRFILE_wpa_psk			( ERRFILE_NET | 0x00270000 )
+#define ERRFILE_wpa_tkip		( ERRFILE_NET | 0x00280000 )
+#define ERRFILE_wpa_ccmp		( ERRFILE_NET | 0x00290000 )
+
+#define ERRFILE_image		      ( ERRFILE_IMAGE | 0x00000000 )
+#define ERRFILE_elf		      ( ERRFILE_IMAGE | 0x00010000 )
+#define ERRFILE_script		      ( ERRFILE_IMAGE | 0x00020000 )
+#define ERRFILE_segment		      ( ERRFILE_IMAGE | 0x00030000 )
+#define ERRFILE_efi_image	      ( ERRFILE_IMAGE | 0x00040000 )
+#define ERRFILE_embedded	      ( ERRFILE_IMAGE | 0x00050000 )
+
+#define ERRFILE_asn1		      ( ERRFILE_OTHER | 0x00000000 )
+#define ERRFILE_chap		      ( ERRFILE_OTHER | 0x00010000 )
+#define ERRFILE_aoeboot		      ( ERRFILE_OTHER | 0x00020000 )
+#define ERRFILE_autoboot	      ( ERRFILE_OTHER | 0x00030000 )
+#define ERRFILE_dhcpmgmt	      ( ERRFILE_OTHER | 0x00040000 )
+#define ERRFILE_imgmgmt		      ( ERRFILE_OTHER | 0x00050000 )
+#define ERRFILE_pxe_tftp	      ( ERRFILE_OTHER | 0x00060000 )
+#define ERRFILE_pxe_udp		      ( ERRFILE_OTHER | 0x00070000 )
+#define ERRFILE_axtls_aes	      ( ERRFILE_OTHER | 0x00080000 )
+#define ERRFILE_cipher		      ( ERRFILE_OTHER | 0x00090000 )
+#define ERRFILE_image_cmd	      ( ERRFILE_OTHER | 0x000a0000 )
+#define ERRFILE_uri_test	      ( ERRFILE_OTHER | 0x000b0000 )
+#define ERRFILE_ibft		      ( ERRFILE_OTHER | 0x000c0000 )
+#define ERRFILE_tls		      ( ERRFILE_OTHER | 0x000d0000 )
+#define ERRFILE_ifmgmt		      ( ERRFILE_OTHER | 0x000e0000 )
+#define ERRFILE_iscsiboot	      ( ERRFILE_OTHER | 0x000f0000 )
+#define ERRFILE_efi_pci		      ( ERRFILE_OTHER | 0x00100000 )
+#define ERRFILE_efi_snp		      ( ERRFILE_OTHER | 0x00110000 )
+#define ERRFILE_smbios		      ( ERRFILE_OTHER | 0x00120000 )
+#define ERRFILE_smbios_settings	      ( ERRFILE_OTHER | 0x00130000 )
+#define ERRFILE_efi_smbios	      ( ERRFILE_OTHER | 0x00140000 )
+#define ERRFILE_pxemenu		      ( ERRFILE_OTHER | 0x00150000 )
+#define ERRFILE_x509		      ( ERRFILE_OTHER | 0x00160000 )
+#define ERRFILE_login_ui	      ( ERRFILE_OTHER | 0x00170000 )
+#define ERRFILE_ib_srpboot	      ( ERRFILE_OTHER | 0x00180000 )
+#define ERRFILE_iwmgmt		      ( ERRFILE_OTHER | 0x00190000 )
+
+/** @} */
+
+#endif /* _IPXE_ERRFILE_H */
diff --git a/src/include/ipxe/errortab.h b/src/include/ipxe/errortab.h
new file mode 100644
index 0000000..945cde3
--- /dev/null
+++ b/src/include/ipxe/errortab.h
@@ -0,0 +1,23 @@
+#ifndef _IPXE_ERRORTAB_H
+#define _IPXE_ERRORTAB_H
+
+/** @file
+ *
+ * Error message tables
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tables.h>
+
+struct errortab {
+	int errno;
+	const char *text;
+};
+
+#define ERRORTAB __table ( struct errortab, "errortab" )
+
+#define __errortab __table_entry ( ERRORTAB, 01 )
+
+#endif /* _IPXE_ERRORTAB_H */
diff --git a/src/include/ipxe/ethernet.h b/src/include/ipxe/ethernet.h
new file mode 100644
index 0000000..5799092
--- /dev/null
+++ b/src/include/ipxe/ethernet.h
@@ -0,0 +1,21 @@
+#ifndef _IPXE_ETHERNET_H
+#define _IPXE_ETHERNET_H
+
+/** @file
+ *
+ * Ethernet protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+extern void eth_init_addr ( const void *hw_addr, void *ll_addr );
+extern const char * eth_ntoa ( const void *ll_addr );
+extern int eth_mc_hash ( unsigned int af, const void *net_addr,
+			 void *ll_addr );
+extern int eth_eth_addr ( const void *ll_addr, void *eth_addr );
+extern struct net_device * alloc_etherdev ( size_t priv_size );
+
+#endif /* _IPXE_ETHERNET_H */
diff --git a/src/include/ipxe/fakedhcp.h b/src/include/ipxe/fakedhcp.h
new file mode 100644
index 0000000..ea06b06
--- /dev/null
+++ b/src/include/ipxe/fakedhcp.h
@@ -0,0 +1,23 @@
+#ifndef _IPXE_FAKEDHCP_H
+#define _IPXE_FAKEDHCP_H
+
+/** @file
+ *
+ * Fake DHCP packets
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+struct net_device;
+
+extern int create_fakedhcpdiscover ( struct net_device *netdev,
+				     void *data, size_t max_len );
+extern int create_fakedhcpack ( struct net_device *netdev,
+				void *data, size_t max_len );
+extern int create_fakepxebsack ( struct net_device *netdev,
+				 void *data, size_t max_len );
+
+#endif /* _IPXE_FAKEDHCP_H */
diff --git a/src/include/ipxe/features.h b/src/include/ipxe/features.h
new file mode 100644
index 0000000..b5033a6
--- /dev/null
+++ b/src/include/ipxe/features.h
@@ -0,0 +1,103 @@
+#ifndef _IPXE_FEATURES_H
+#define _IPXE_FEATURES_H
+
+#include <stdint.h>
+#include <ipxe/tables.h>
+#include <ipxe/dhcp.h>
+
+/** @file
+ *
+ * Feature list
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/**
+ * @defgroup featurecat Feature categories
+ * @{
+ */
+
+#define FEATURE_PROTOCOL		01 /**< Network protocols */
+#define FEATURE_IMAGE			02 /**< Image formats */
+#define FEATURE_MISC			03 /**< Miscellaneous */
+
+/** @} */
+
+/**
+ * @defgroup dhcpfeatures DHCP feature option tags
+ *
+ * DHCP feature option tags are Etherboot encapsulated options in the
+ * range 0x10-0x7f.
+ *
+ * @{
+ */
+
+#define DHCP_EB_FEATURE_PXE_EXT		0x10 /**< PXE API extensions */
+#define DHCP_EB_FEATURE_ISCSI		0x11 /**< iSCSI protocol */
+#define DHCP_EB_FEATURE_AOE		0x12 /**< AoE protocol */
+#define DHCP_EB_FEATURE_HTTP		0x13 /**< HTTP protocol */
+#define DHCP_EB_FEATURE_HTTPS		0x14 /**< HTTPS protocol */
+#define DHCP_EB_FEATURE_TFTP		0x15 /**< TFTP protocol */
+#define DHCP_EB_FEATURE_FTP		0x16 /**< FTP protocol */
+#define DHCP_EB_FEATURE_DNS		0x17 /**< DNS protocol */
+#define DHCP_EB_FEATURE_BZIMAGE		0x18 /**< bzImage format */
+#define DHCP_EB_FEATURE_MULTIBOOT	0x19 /**< Multiboot format */
+#define DHCP_EB_FEATURE_SLAM		0x1a /**< SLAM protocol */
+#define DHCP_EB_FEATURE_SRP		0x1b /**< SRP protocol */
+#define DHCP_EB_FEATURE_NBI		0x20 /**< NBI format */
+#define DHCP_EB_FEATURE_PXE		0x21 /**< PXE format */
+#define DHCP_EB_FEATURE_ELF		0x22 /**< ELF format */
+#define DHCP_EB_FEATURE_COMBOOT		0x23 /**< COMBOOT format */
+#define DHCP_EB_FEATURE_EFI		0x24 /**< EFI format */
+
+/** @} */
+
+/** DHCP feature table */
+#define DHCP_FEATURES __table ( uint8_t, "dhcp_features" )
+
+/** Declare a feature code for DHCP */
+#define __dhcp_feature __table_entry ( DHCP_FEATURES, 01 )
+
+/** Construct a DHCP feature table entry */
+#define DHCP_FEATURE( feature_opt, ... )				    \
+	_DHCP_FEATURE ( OBJECT, feature_opt, __VA_ARGS__ )
+#define _DHCP_FEATURE( _name, feature_opt, ... )			    \
+	__DHCP_FEATURE ( _name, feature_opt, __VA_ARGS__ )
+#define __DHCP_FEATURE( _name, feature_opt, ... )			    \
+	uint8_t __dhcp_feature_ ## _name [] __dhcp_feature = {		    \
+		feature_opt, DHCP_OPTION ( __VA_ARGS__ )		    \
+	};
+
+/** A named feature */
+struct feature {
+	/** Feature name */
+	char *name;
+};
+
+/** Named feature table */
+#define FEATURES __table ( struct feature, "features" )
+
+/** Declare a named feature */
+#define __feature_name( category ) __table_entry ( FEATURES, category )
+
+/** Construct a named feature */
+#define FEATURE_NAME( category, text )					    \
+	_FEATURE_NAME ( category, OBJECT, text )
+#define _FEATURE_NAME( category, _name, text )				    \
+	__FEATURE_NAME ( category, _name, text )
+#define __FEATURE_NAME( category, _name, text )				    \
+	struct feature __feature_ ## _name __feature_name ( category ) = {  \
+		.name = text,						    \
+	};
+
+/** Declare a feature */
+#define FEATURE( category, text, feature_opt, version )			    \
+	FEATURE_NAME ( category, text );				    \
+	DHCP_FEATURE ( feature_opt, version );
+
+/** Declare the version number feature */
+#define FEATURE_VERSION( ... )						    \
+	DHCP_FEATURE ( DHCP_ENCAPSULATED ( DHCP_EB_VERSION ), __VA_ARGS__ )
+
+#endif /* _IPXE_FEATURES_H */
diff --git a/src/include/ipxe/filter.h b/src/include/ipxe/filter.h
new file mode 100644
index 0000000..b23a98d
--- /dev/null
+++ b/src/include/ipxe/filter.h
@@ -0,0 +1,75 @@
+#ifndef _IPXE_FILTER_H
+#define _IPXE_FILTER_H
+
+/** @file
+ *
+ * Data transfer filters
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stddef.h>
+#include <ipxe/xfer.h>
+
+/**
+ * Half of a data transfer filter
+ *
+ * Embed two of these structures within a structure implementing a
+ * data transfer filter, and intialise with filter_init().  You can
+ * then use the filter_xxx() methods as the data transfer interface
+ * methods as required.
+ */
+struct xfer_filter_half {
+	/** Data transfer interface */
+	struct xfer_interface xfer;
+	/** Other half of the data transfer filter */
+	struct xfer_filter_half *other;
+};
+
+/**
+ * Get data transfer interface for the other half of a data transfer filter
+ *
+ * @v xfer		Data transfer interface
+ * @ret other		Other half's data transfer interface
+ */
+static inline __attribute__ (( always_inline )) struct xfer_interface *
+filter_other_half ( struct xfer_interface *xfer ) {
+	struct xfer_filter_half *half = 
+		container_of ( xfer, struct xfer_filter_half, xfer );
+	return &half->other->xfer;
+}
+
+extern void filter_close ( struct xfer_interface *xfer, int rc );
+extern int filter_vredirect ( struct xfer_interface *xfer, int type,
+			      va_list args );
+extern size_t filter_window ( struct xfer_interface *xfer );
+extern struct io_buffer * filter_alloc_iob ( struct xfer_interface *xfer,
+					     size_t len );
+extern int filter_deliver_iob ( struct xfer_interface *xfer,
+				struct io_buffer *iobuf,
+				struct xfer_metadata *meta );
+extern int filter_deliver_raw ( struct xfer_interface *xfer, const void *data,
+				size_t len );
+
+/**
+ * Initialise a data transfer filter
+ *
+ * @v left		"Left" half of the filter
+ * @v left_op		Data transfer interface operations for "left" half
+ * @v right		"Right" half of the filter
+ * @v right_op		Data transfer interface operations for "right" half
+ * @v refcnt		Containing object reference counter, or NULL
+ */
+static inline void filter_init ( struct xfer_filter_half *left,
+				 struct xfer_interface_operations *left_op,
+				 struct xfer_filter_half *right,
+				 struct xfer_interface_operations *right_op,
+				 struct refcnt *refcnt ) {
+	xfer_init ( &left->xfer, left_op, refcnt );
+	xfer_init ( &right->xfer, right_op, refcnt );
+	left->other = right;
+	right->other = left;
+}
+
+#endif /* _IPXE_FILTER_H */
diff --git a/src/include/ipxe/ftp.h b/src/include/ipxe/ftp.h
new file mode 100644
index 0000000..cbab12d
--- /dev/null
+++ b/src/include/ipxe/ftp.h
@@ -0,0 +1,15 @@
+#ifndef _IPXE_FTP_H
+#define _IPXE_FTP_H
+
+/** @file
+ *
+ * File transfer protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** FTP default port */
+#define FTP_PORT 21
+
+#endif /* _IPXE_FTP_H */
diff --git a/src/include/ipxe/gdbserial.h b/src/include/ipxe/gdbserial.h
new file mode 100644
index 0000000..a3b5617
--- /dev/null
+++ b/src/include/ipxe/gdbserial.h
@@ -0,0 +1,21 @@
+#ifndef _IPXE_GDBSERIAL_H
+#define _IPXE_GDBSERIAL_H
+
+/** @file
+ *
+ * GDB remote debugging over serial
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct gdb_transport;
+
+/**
+ * Set up the serial transport
+ *
+ * @ret transport suitable for starting the GDB stub or NULL on error
+ */
+struct gdb_transport *gdbserial_configure ( void );
+
+#endif /* _IPXE_GDBSERIAL_H */
diff --git a/src/include/ipxe/gdbstub.h b/src/include/ipxe/gdbstub.h
new file mode 100644
index 0000000..3196067
--- /dev/null
+++ b/src/include/ipxe/gdbstub.h
@@ -0,0 +1,77 @@
+#ifndef _IPXE_GDBSTUB_H
+#define _IPXE_GDBSTUB_H
+
+/** @file
+ *
+ * GDB remote debugging
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/tables.h>
+#include <gdbmach.h>
+
+/**
+ * A transport mechanism for the GDB protocol
+ *
+ */
+struct gdb_transport {
+	/** Transport name */
+	const char *name;
+	/**
+	 * Set up the transport given a list of arguments
+	 *
+	 * @v argc Number of arguments
+	 * @v argv Argument list
+	 * @ret Return status code
+	 *
+	 * Note that arguments start at argv[0].
+	 */
+	int ( * init ) ( int argc, char **argv );
+	/**
+	 * Perform a blocking read
+	 *
+	 * @v buf Buffer
+	 * @v len Size of buffer
+	 * @ret Number of bytes read into buffer
+	 */
+	size_t ( * recv ) ( char *buf, size_t len );
+	/**
+	 * Write, may block
+	 *
+	 * @v buf Buffer
+	 * @v len Size of buffer
+	 */
+	void ( * send ) ( const char *buf, size_t len );
+};
+
+#define GDB_TRANSPORTS __table ( struct gdb_transport, "gdb_transports" )
+
+#define __gdb_transport __table_entry ( GDB_TRANSPORTS, 01 )
+
+/**
+ * Look up GDB transport by name
+ *
+ * @v name Name of transport
+ * @ret GDB transport or NULL
+ */
+extern struct gdb_transport *find_gdb_transport ( const char *name );
+
+/**
+ * Break into the debugger using the given transport
+ *
+ * @v trans GDB transport
+ */
+extern void gdbstub_start ( struct gdb_transport *trans );
+
+/**
+ * Interrupt handler
+ *
+ * @signo POSIX signal number
+ * @regs CPU register snapshot
+ **/
+extern void gdbstub_handler ( int signo, gdbreg_t *regs );
+
+#endif /* _IPXE_GDBSTUB_H */
diff --git a/src/include/ipxe/gdbudp.h b/src/include/ipxe/gdbudp.h
new file mode 100644
index 0000000..db7a451
--- /dev/null
+++ b/src/include/ipxe/gdbudp.h
@@ -0,0 +1,24 @@
+#ifndef _IPXE_GDBUDP_H
+#define _IPXE_GDBUDP_H
+
+/** @file
+ *
+ * GDB remote debugging over UDP
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct sockaddr_in;
+struct gdb_transport;
+
+/**
+ * Set up the UDP transport with network address
+ *
+ * @name network device name
+ * @addr IP address and UDP listen port, may be NULL and fields may be zero
+ * @ret transport suitable for starting the GDB stub or NULL on error
+ */
+struct gdb_transport *gdbudp_configure ( const char *name, struct sockaddr_in *addr );
+
+#endif /* _IPXE_GDBUDP_H */
diff --git a/src/include/ipxe/hidemem.h b/src/include/ipxe/hidemem.h
new file mode 100644
index 0000000..ddc9cd8
--- /dev/null
+++ b/src/include/ipxe/hidemem.h
@@ -0,0 +1,17 @@
+#ifndef _IPXE_HIDEMEM_H
+#define _IPXE_HIDEMEM_H
+
+/**
+ * @file
+ *
+ * Hidden memory regions
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+extern void hide_umalloc ( physaddr_t start, physaddr_t end );
+
+#endif /* _IPXE_HIDEMEM_H */
diff --git a/src/include/ipxe/hmac.h b/src/include/ipxe/hmac.h
new file mode 100644
index 0000000..d5ec086
--- /dev/null
+++ b/src/include/ipxe/hmac.h
@@ -0,0 +1,32 @@
+#ifndef _IPXE_HMAC_H
+#define _IPXE_HMAC_H
+
+/** @file
+ *
+ * Keyed-Hashing for Message Authentication
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/crypto.h>
+
+/**
+ * Update HMAC
+ *
+ * @v digest		Digest algorithm to use
+ * @v digest_ctx	Digest context
+ * @v data		Data
+ * @v len		Length of data
+ */
+static inline void hmac_update ( struct digest_algorithm *digest,
+				 void *digest_ctx, const void *data,
+				 size_t len ) {
+	digest_update ( digest, digest_ctx, data, len );
+}
+
+extern void hmac_init ( struct digest_algorithm *digest, void *digest_ctx,
+			void *key, size_t *key_len );
+extern void hmac_final ( struct digest_algorithm *digest, void *digest_ctx,
+			 void *key, size_t *key_len, void *hmac );
+
+#endif /* _IPXE_HMAC_H */
diff --git a/src/include/ipxe/http.h b/src/include/ipxe/http.h
new file mode 100644
index 0000000..97014d1
--- /dev/null
+++ b/src/include/ipxe/http.h
@@ -0,0 +1,23 @@
+#ifndef _IPXE_HTTP_H
+#define _IPXE_HTTP_H
+
+/** @file
+ *
+ * Hyper Text Transport Protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** HTTP default port */
+#define HTTP_PORT 80
+
+/** HTTPS default port */
+#define HTTPS_PORT 443
+
+extern int http_open_filter ( struct xfer_interface *xfer, struct uri *uri,
+			      unsigned int default_port,
+			      int ( * filter ) ( struct xfer_interface *,
+						 struct xfer_interface ** ) );
+
+#endif /* _IPXE_HTTP_H */
diff --git a/src/include/ipxe/i2c.h b/src/include/ipxe/i2c.h
new file mode 100644
index 0000000..c1f5a9b
--- /dev/null
+++ b/src/include/ipxe/i2c.h
@@ -0,0 +1,171 @@
+#ifndef _IPXE_I2C_H
+#define _IPXE_I2C_H
+
+/** @file
+ *
+ * I2C interface
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/bitbash.h>
+
+/** An I2C device
+ *
+ * An I2C device represents a specific slave device on an I2C bus.  It
+ * is accessed via an I2C interface.
+ */
+struct i2c_device {
+	/** Address of this device
+	 *
+	 * The actual address sent on the bus will look like
+	 *
+	 *    <start> <device address> <word address overflow> <r/w>
+	 *
+	 * The "word address overflow" is any excess bits from the
+	 * word address, i.e. any portion that does not fit within the
+	 * defined word address length.
+	 */
+	unsigned int dev_addr;
+	/** Device address length, in bytes
+	 *
+	 * This is the number of bytes that comprise the device
+	 * address, defined to be the portion that terminates with the
+	 * read/write bit.
+	 */
+	unsigned int dev_addr_len;
+	/** Word adddress length, in bytes
+	 *
+	 * This is the number of bytes that comprise the word address,
+	 * defined to be the portion that starts after the read/write
+	 * bit and ends before the first data byte.
+	 *
+	 * For some devices, this length will be zero (i.e. the word
+	 * address is contained entirely within the "word address
+	 * overflow").
+	 */
+	unsigned int word_addr_len;
+};
+
+/** An I2C interface
+ *
+ * An I2C interface provides access to an I2C bus, via which I2C
+ * devices may be reached.
+ */
+struct i2c_interface {
+	/**
+	 * Read data from I2C device
+	 *
+	 * @v i2c		I2C interface
+	 * @v i2cdev		I2C device
+	 * @v offset		Starting offset within the device
+	 * @v data		Data buffer
+	 * @v len		Length of data buffer
+	 * @ret rc		Return status code
+	 */
+	int ( * read ) ( struct i2c_interface *i2c, struct i2c_device *i2cdev,
+			 unsigned int offset, uint8_t *data,
+			 unsigned int len );
+	/**
+	 * Write data to I2C device
+	 *
+	 * @v i2c		I2C interface
+	 * @v i2cdev		I2C device
+	 * @v offset		Starting offset within the device
+	 * @v data		Data buffer
+	 * @v len		Length of data buffer
+	 * @ret rc		Return status code
+	 */
+	int ( * write ) ( struct i2c_interface *i2c, struct i2c_device *i2cdev,
+			  unsigned int offset, const uint8_t *data,
+			  unsigned int len );
+};
+
+/** A bit-bashing I2C interface
+ *
+ * This provides a standardised way to construct I2C buses via a
+ * bit-bashing interface.
+ */
+struct i2c_bit_basher {
+	/** I2C interface */
+	struct i2c_interface i2c;
+	/** Bit-bashing interface */
+	struct bit_basher basher;
+};
+
+/** Ten-bit address marker
+ *
+ * This value is ORed with the I2C device address to indicate a
+ * ten-bit address format on the bus.
+ */
+#define I2C_TENBIT_ADDRESS 0x7800
+
+/** An I2C write command */
+#define I2C_WRITE 0
+
+/** An I2C read command */
+#define I2C_READ 1
+
+/** Bit indices used for I2C bit-bashing interface */
+enum {
+	/** Serial clock */
+	I2C_BIT_SCL = 0,
+	/** Serial data */
+	I2C_BIT_SDA,
+};
+
+/** Delay required for bit-bashing operation */
+#define I2C_UDELAY 5
+
+/** Maximum number of cycles to use when attempting a bus reset */
+#define I2C_RESET_MAX_CYCLES 32
+
+/**
+ * Check presence of I2C device
+ *
+ * @v i2c		I2C interface
+ * @v i2cdev		I2C device
+ * @ret rc		Return status code
+ *
+ * Checks for the presence of the device on the I2C bus by attempting
+ * a zero-length write.
+ */
+static inline int i2c_check_presence ( struct i2c_interface *i2c,
+				       struct i2c_device *i2cdev ) {
+	return i2c->write ( i2c, i2cdev, 0, NULL, 0 );
+}
+
+extern int init_i2c_bit_basher ( struct i2c_bit_basher *i2cbit,
+				 struct bit_basher_operations *bash_op );
+
+/**
+ * Initialise generic I2C EEPROM device
+ *
+ * @v i2cdev		I2C device
+ */
+static inline __always_inline void
+init_i2c_eeprom ( struct i2c_device *i2cdev, unsigned int dev_addr ) {
+	i2cdev->dev_addr = dev_addr;
+	i2cdev->dev_addr_len = 1;
+	i2cdev->word_addr_len = 1;
+}
+
+/**
+ * Initialise Atmel AT24C11
+ *
+ * @v i2cdev		I2C device
+ */
+static inline __always_inline void
+init_at24c11 ( struct i2c_device *i2cdev ) {
+	/* This chip has no device address; it must be the only chip
+	 * on the bus.  The word address is contained entirely within
+	 * the device address field.
+	 */
+	i2cdev->dev_addr = 0;
+	i2cdev->dev_addr_len = 1;
+	i2cdev->word_addr_len = 0;
+}
+
+#endif /* _IPXE_I2C_H */
diff --git a/src/include/ipxe/ib_cm.h b/src/include/ipxe/ib_cm.h
new file mode 100644
index 0000000..136e494
--- /dev/null
+++ b/src/include/ipxe/ib_cm.h
@@ -0,0 +1,72 @@
+#ifndef _IPXE_IB_CM_H
+#define _IPXE_IB_CM_H
+
+/** @file
+ *
+ * Infiniband communication management
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/infiniband.h>
+#include <ipxe/retry.h>
+
+struct ib_mad_transaction;
+struct ib_connection;
+
+/** Infiniband connection operations */
+struct ib_connection_operations {
+	/** Handle change of connection status
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v conn		Connection
+	 * @v rc		Connection status code
+	 * @v private_data	Private data, if available
+	 * @v private_data_len	Length of private data
+	 */
+	void ( * changed ) ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			     struct ib_connection *conn, int rc,
+			     void *private_data, size_t private_data_len );
+};
+
+/** An Infiniband connection */
+struct ib_connection {
+	/** Infiniband device */
+	struct ib_device *ibdev;
+	/** Queue pair */
+	struct ib_queue_pair *qp;
+	/** Local communication ID */
+	uint32_t local_id;
+	/** Remote communication ID */
+	uint32_t remote_id;
+	/** Target service ID */
+	struct ib_gid_half service_id;
+	/** Connection operations */
+	struct ib_connection_operations *op;
+
+	/** List of connections */
+	struct list_head list;
+
+	/** Path to target */
+	struct ib_path *path;
+	/** Connection request management transaction */
+	struct ib_mad_transaction *madx;
+
+	/** Length of connection request private data */
+	size_t private_data_len;
+	/** Connection request private data */
+	uint8_t private_data[0];
+};
+
+extern struct ib_connection *
+ib_create_conn ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+		 struct ib_gid *dgid, struct ib_gid_half *service_id,
+		 void *req_private_data, size_t req_private_data_len,
+		 struct ib_connection_operations *op );
+extern void ib_destroy_conn ( struct ib_device *ibdev,
+			      struct ib_queue_pair *qp,
+			      struct ib_connection *conn );
+
+#endif /* _IPXE_IB_CM_H */
diff --git a/src/include/ipxe/ib_cmrc.h b/src/include/ipxe/ib_cmrc.h
new file mode 100644
index 0000000..c02b15d
--- /dev/null
+++ b/src/include/ipxe/ib_cmrc.h
@@ -0,0 +1,20 @@
+#ifndef _IPXE_IB_CMRC_H
+#define _IPXE_IB_CMRC_H
+
+/** @file
+ *
+ * Infiniband Communication-managed Reliable Connections
+ *
+ */
+
+FILE_LICENCE ( BSD2 );
+
+#include <ipxe/infiniband.h>
+#include <ipxe/xfer.h>
+
+extern int ib_cmrc_open ( struct xfer_interface *xfer,
+			  struct ib_device *ibdev,
+			  struct ib_gid *dgid,
+			  struct ib_gid_half *service_id );
+
+#endif /* _IPXE_IB_CMRC_H */
diff --git a/src/include/ipxe/ib_mad.h b/src/include/ipxe/ib_mad.h
new file mode 100644
index 0000000..94f171a
--- /dev/null
+++ b/src/include/ipxe/ib_mad.h
@@ -0,0 +1,561 @@
+#ifndef _IPXE_IB_MAD_H
+#define _IPXE_IB_MAD_H
+
+/** @file
+ *
+ * Infiniband management datagrams
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/ib_packet.h>
+
+/*****************************************************************************
+ *
+ * Subnet management MADs
+ *
+ *****************************************************************************
+ */
+
+/** A subnet management header
+ *
+ * Defined in sections 14.2.1.1 and 14.2.1.2 of the IBA.
+ */
+struct ib_smp_hdr {
+	uint64_t mkey;
+	uint16_t slid;
+	uint16_t dlid;
+	uint8_t reserved[28];
+} __attribute__ (( packed ));
+
+/** Subnet management class version */
+#define IB_SMP_CLASS_VERSION			1
+
+/** Subnet management direction bit
+ *
+ * This bit resides in the "status" field in the MAD header.
+ */
+#define IB_SMP_STATUS_D_INBOUND			0x8000
+
+/* Subnet management attributes */
+#define IB_SMP_ATTR_NOTICE			0x0002
+#define IB_SMP_ATTR_NODE_DESC			0x0010
+#define IB_SMP_ATTR_NODE_INFO			0x0011
+#define IB_SMP_ATTR_SWITCH_INFO			0x0012
+#define IB_SMP_ATTR_GUID_INFO			0x0014
+#define IB_SMP_ATTR_PORT_INFO			0x0015
+#define IB_SMP_ATTR_PKEY_TABLE			0x0016
+#define IB_SMP_ATTR_SL_TO_VL_TABLE		0x0017
+#define IB_SMP_ATTR_VL_ARB_TABLE		0x0018
+#define IB_SMP_ATTR_LINEAR_FORWARD_TABLE	0x0019
+#define IB_SMP_ATTR_RANDOM_FORWARD_TABLE	0x001A
+#define IB_SMP_ATTR_MCAST_FORWARD_TABLE		0x001B
+#define IB_SMP_ATTR_SM_INFO			0x0020
+#define IB_SMP_ATTR_VENDOR_DIAG			0x0030
+#define IB_SMP_ATTR_LED_INFO			0x0031
+#define IB_SMP_ATTR_VENDOR_MASK			0xFF00
+
+/**
+ * A Node Description attribute
+ *
+ * Defined in section 14.2.5.2 of the IBA
+ */
+struct ib_node_desc {
+	char node_string[64];
+} __attribute__ (( packed ));
+
+/** A Node Information attribute
+ *
+ * Defined in section 14.2.5.3 of the IBA.
+ */
+struct ib_node_info {
+	uint8_t base_version;
+	uint8_t class_version;
+	uint8_t node_type;
+	uint8_t num_ports;
+	struct ib_gid_half sys_guid;
+	struct ib_gid_half node_guid;
+	struct ib_gid_half port_guid;
+	uint16_t partition_cap;
+	uint16_t device_id;
+	uint32_t revision;
+	uint8_t local_port_num;
+	uint8_t vendor_id[3];
+} __attribute__ ((packed));
+
+#define IB_NODE_TYPE_HCA		0x01
+#define IB_NODE_TYPE_SWITCH		0x02
+#define IB_NODE_TYPE_ROUTER		0x03
+
+/** A GUID Information attribute
+ *
+ * Defined in section 14.2.5.5 of the IBA.
+ */
+struct ib_guid_info {
+	uint8_t guid[8][8];
+} __attribute__ (( packed ));
+
+/** A Port Information attribute
+ *
+ * Defined in section 14.2.5.6 of the IBA.
+ */
+struct ib_port_info {
+	uint64_t mkey;
+	uint8_t gid_prefix[8];
+	uint16_t lid;
+	uint16_t mastersm_lid;
+	uint32_t cap_mask;
+	uint16_t diag_code;
+	uint16_t mkey_lease_period;
+	uint8_t local_port_num;
+	uint8_t link_width_enabled;
+	uint8_t link_width_supported;
+	uint8_t link_width_active;
+	uint8_t link_speed_supported__port_state;
+	uint8_t port_phys_state__link_down_def_state;
+	uint8_t mkey_prot_bits__lmc;
+	uint8_t link_speed_active__link_speed_enabled;
+	uint8_t neighbour_mtu__mastersm_sl;
+	uint8_t vl_cap__init_type;
+	uint8_t vl_high_limit;
+	uint8_t vl_arbitration_high_cap;
+	uint8_t vl_arbitration_low_cap;
+	uint8_t init_type_reply__mtu_cap;
+	uint8_t vl_stall_count__hoq_life;
+	uint8_t operational_vls__enforcement;
+	uint16_t mkey_violations;
+	uint16_t pkey_violations;
+	uint16_t qkey_violations;
+	uint8_t guid_cap;
+	uint8_t client_reregister__subnet_timeout;
+	uint8_t resp_time_value;
+	uint8_t local_phy_errors__overrun_errors;
+	uint16_t max_credit_hint;
+	uint32_t link_round_trip_latency;
+} __attribute__ (( packed ));
+
+#define IB_LINK_WIDTH_1X		0x01
+#define IB_LINK_WIDTH_4X		0x02
+#define IB_LINK_WIDTH_8X		0x04
+#define IB_LINK_WIDTH_12X		0x08
+
+#define IB_LINK_SPEED_SDR		0x01
+#define IB_LINK_SPEED_DDR		0x02
+#define IB_LINK_SPEED_QDR		0x04
+
+#define IB_PORT_STATE_DOWN		0x01
+#define IB_PORT_STATE_INIT		0x02
+#define IB_PORT_STATE_ARMED		0x03
+#define IB_PORT_STATE_ACTIVE		0x04
+
+#define IB_PORT_PHYS_STATE_SLEEP	0x01
+#define IB_PORT_PHYS_STATE_POLLING	0x02
+
+#define IB_MTU_256			0x01
+#define IB_MTU_512			0x02
+#define IB_MTU_1024			0x03
+#define IB_MTU_2048			0x04
+#define IB_MTU_4096			0x05
+
+#define IB_VL_0				0x01
+#define IB_VL_0_1			0x02
+#define IB_VL_0_3			0x03
+#define IB_VL_0_7			0x04
+#define IB_VL_0_14			0x05
+
+/** A Partition Key Table attribute
+ *
+ * Defined in section 14.2.5.7 of the IBA.
+ */
+struct ib_pkey_table {
+	uint16_t pkey[32];
+} __attribute__ (( packed ));
+
+/** A subnet management attribute */
+union ib_smp_data {
+	struct ib_node_desc node_desc;
+	struct ib_node_info node_info;
+	struct ib_guid_info guid_info;
+	struct ib_port_info port_info;
+	struct ib_pkey_table pkey_table;
+	uint8_t bytes[64];
+} __attribute__ (( packed ));
+
+/** A subnet management directed route path */
+struct ib_smp_dr_path {
+	uint8_t hops[64];
+} __attribute__ (( packed ));
+
+/** Subnet management MAD class-specific data */
+struct ib_smp_class_specific {
+	uint8_t hop_pointer;
+	uint8_t hop_count;
+} __attribute__ (( packed ));
+
+/*****************************************************************************
+ *
+ * Subnet administration MADs
+ *
+ *****************************************************************************
+ */
+
+#define IB_SA_CLASS_VERSION			2
+
+#define IB_SA_METHOD_DELETE_RESP		0x95
+
+struct ib_rmpp_hdr {
+	uint32_t raw[3];
+} __attribute__ (( packed ));
+
+struct ib_sa_hdr {
+	uint32_t sm_key[2];
+	uint16_t reserved;
+	uint16_t attrib_offset;
+	uint32_t comp_mask[2];
+} __attribute__ (( packed ));
+
+#define IB_SA_ATTR_MC_MEMBER_REC		0x38
+#define IB_SA_ATTR_PATH_REC			0x35
+
+struct ib_path_record {
+	uint32_t reserved0[2];
+	struct ib_gid dgid;
+	struct ib_gid sgid;
+	uint16_t dlid;
+	uint16_t slid;
+	uint32_t hop_limit__flow_label__raw_traffic;
+	uint32_t pkey__numb_path__reversible__tclass;
+	uint8_t reserved1;
+	uint8_t reserved__sl;
+	uint8_t mtu_selector__mtu;
+	uint8_t rate_selector__rate;
+	uint32_t preference__packet_lifetime__packet_lifetime_selector;
+	uint32_t reserved2[35];
+} __attribute__ (( packed ));
+
+#define IB_SA_PATH_REC_DGID			(1<<2)
+#define IB_SA_PATH_REC_SGID			(1<<3)
+
+struct ib_mc_member_record {
+	struct ib_gid mgid;
+	struct ib_gid port_gid;
+	uint32_t qkey;
+	uint16_t mlid;
+	uint8_t mtu_selector__mtu;
+	uint8_t tclass;
+	uint16_t pkey;
+	uint8_t rate_selector__rate;
+	uint8_t packet_lifetime_selector__packet_lifetime;
+	uint32_t sl__flow_label__hop_limit;
+	uint8_t scope__join_state;
+	uint8_t proxy_join__reserved;
+	uint16_t reserved0;
+	uint32_t reserved1[37];
+} __attribute__ (( packed ));
+
+#define IB_SA_MCMEMBER_REC_MGID			(1<<0)
+#define IB_SA_MCMEMBER_REC_PORT_GID		(1<<1)
+#define IB_SA_MCMEMBER_REC_QKEY			(1<<2)
+#define IB_SA_MCMEMBER_REC_MLID			(1<<3)
+#define IB_SA_MCMEMBER_REC_MTU_SELECTOR		(1<<4)
+#define IB_SA_MCMEMBER_REC_MTU			(1<<5)
+#define IB_SA_MCMEMBER_REC_TRAFFIC_CLASS	(1<<6)
+#define IB_SA_MCMEMBER_REC_PKEY			(1<<7)
+#define IB_SA_MCMEMBER_REC_RATE_SELECTOR	(1<<8)
+#define IB_SA_MCMEMBER_REC_RATE			(1<<9)
+#define IB_SA_MCMEMBER_REC_PACKET_LIFE_TIME_SELECTOR	(1<<10)
+#define IB_SA_MCMEMBER_REC_PACKET_LIFE_TIME	(1<<11)
+#define IB_SA_MCMEMBER_REC_SL			(1<<12)
+#define IB_SA_MCMEMBER_REC_FLOW_LABEL		(1<<13)
+#define IB_SA_MCMEMBER_REC_HOP_LIMIT		(1<<14)
+#define IB_SA_MCMEMBER_REC_SCOPE		(1<<15)
+#define IB_SA_MCMEMBER_REC_JOIN_STATE		(1<<16)
+#define IB_SA_MCMEMBER_REC_PROXY_JOIN		(1<<17)
+
+union ib_sa_data {
+	struct ib_path_record path_record;
+	struct ib_mc_member_record mc_member_record;
+} __attribute__ (( packed ));
+
+/*****************************************************************************
+ *
+ * Communication management MADs
+ *
+ *****************************************************************************
+ */
+
+/** Communication management class version */
+#define IB_CM_CLASS_VERSION			2
+
+/* Communication management attributes */
+#define IB_CM_ATTR_CLASS_PORT_INFO		0x0001
+#define IB_CM_ATTR_CONNECT_REQUEST		0x0010
+#define IB_CM_ATTR_MSG_RCPT_ACK			0x0011
+#define IB_CM_ATTR_CONNECT_REJECT		0x0012
+#define IB_CM_ATTR_CONNECT_REPLY		0x0013
+#define IB_CM_ATTR_READY_TO_USE			0x0014
+#define IB_CM_ATTR_DISCONNECT_REQUEST		0x0015
+#define IB_CM_ATTR_DISCONNECT_REPLY		0x0016
+#define IB_CM_ATTR_SERVICE_ID_RES_REQ		0x0016
+#define IB_CM_ATTR_SERVICE_ID_RES_REQ_RESP	0x0018
+#define IB_CM_ATTR_LOAD_ALTERNATE_PATH		0x0019
+#define IB_CM_ATTR_ALTERNATE_PATH_RESPONSE	0x001a
+
+/** Communication management common fields */
+struct ib_cm_common {
+	/** Local communication ID */
+	uint32_t local_id;
+	/** Remote communication ID */
+	uint32_t remote_id;
+	/** Reserved */
+	uint8_t reserved[224];
+} __attribute__ (( packed ));
+
+/** A communication management path */
+struct ib_cm_path {
+	/** Local port LID */
+	uint16_t local_lid;
+	/** Remote port LID */
+	uint16_t remote_lid;
+	/** Local port GID */
+	struct ib_gid local_gid;
+	/** Remote port GID */
+	struct ib_gid remote_gid;
+	/** Flow label and rate */
+	uint32_t flow_label__rate;
+	/** Traffic class */
+	uint8_t tc;
+	/** Hop limit */
+	uint8_t hop_limit;
+	/** SL and subnet local*/
+	uint8_t sl__subnet_local;
+	/** Local ACK timeout */
+	uint8_t local_ack_timeout;
+} __attribute__ (( packed ));
+
+/** A communication management connection request
+ *
+ * Defined in section 12.6.5 of the IBA.
+ */
+struct ib_cm_connect_request {
+	/** Local communication ID */
+	uint32_t local_id;
+	/** Reserved */
+	uint32_t reserved0[1];
+	/** Service ID */
+	struct ib_gid_half service_id;
+	/** Local CA GUID */
+	struct ib_gid_half local_ca;
+	/** Reserved */
+	uint32_t reserved1[1];
+	/** Local queue key */
+	uint32_t local_qkey;
+	/** Local QPN and responder resources*/
+	uint32_t local_qpn__responder_resources;
+	/** Local EECN and initiator depth */
+	uint32_t local_eecn__initiator_depth;
+	/** Remote EECN, remote CM response timeout, transport service
+	 * type, EE flow control
+	 */
+	uint32_t remote_eecn__remote_timeout__service_type__ee_flow_ctrl;
+	/** Starting PSN, local CM response timeout and retry count */
+	uint32_t starting_psn__local_timeout__retry_count;
+	/** Partition key */
+	uint16_t pkey;
+	/** Path packet payload MTU, RDC exists, RNR retry count */
+	uint8_t payload_mtu__rdc_exists__rnr_retry;
+	/** Max CM retries and SRQ */
+	uint8_t max_cm_retries__srq;
+	/** Primary path */
+	struct ib_cm_path primary;
+	/** Alternate path */
+	struct ib_cm_path alternate;
+	/** Private data */
+	uint8_t private_data[92];
+} __attribute__ (( packed ));
+
+/** CM transport types */
+#define IB_CM_TRANSPORT_RC		0
+#define IB_CM_TRANSPORT_UC		1
+#define IB_CM_TRANSPORT_RD		2
+
+/** A communication management connection rejection
+ *
+ * Defined in section 12.6.7 of the IBA.
+ */
+struct ib_cm_connect_reject {
+	/** Local communication ID */
+	uint32_t local_id;
+	/** Remote communication ID */
+	uint32_t remote_id;
+	/** Message rejected */
+	uint8_t message;
+	/** Reject information length */
+	uint8_t info_len;
+	/** Rejection reason */
+	uint16_t reason;
+	/** Additional rejection information */
+	uint8_t info[72];
+	/** Private data */
+	uint8_t private_data[148];
+} __attribute__ (( packed ));
+
+/** CM rejection reasons */
+#define IB_CM_REJECT_BAD_SERVICE_ID	8
+#define IB_CM_REJECT_STALE_CONN		10
+#define IB_CM_REJECT_CONSUMER		28
+
+/** A communication management connection reply
+ *
+ * Defined in section 12.6.8 of the IBA.
+ */
+struct ib_cm_connect_reply {
+	/** Local communication ID */
+	uint32_t local_id;
+	/** Remote communication ID */
+	uint32_t remote_id;
+	/** Local queue key */
+	uint32_t local_qkey;
+	/** Local QPN */
+	uint32_t local_qpn;
+	/** Local EECN */
+	uint32_t local_eecn;
+	/** Starting PSN */
+	uint32_t starting_psn;
+	/** Responder resources */
+	uint8_t responder_resources;
+	/** Initiator depth */
+	uint8_t initiator_depth;
+	/** Target ACK delay, failover accepted, and end-to-end flow control */
+	uint8_t target_ack_delay__failover_accepted__ee_flow_ctrl;
+	/** RNR retry count, SRQ */
+	uint8_t rnr_retry__srq;
+	/** Local CA GUID */
+	struct ib_gid_half local_ca;
+	/** Private data */
+	uint8_t private_data[196];
+} __attribute__ (( packed ));
+
+/** A communication management ready to use reply
+ *
+ * Defined in section 12.6.9 of the IBA.
+ */
+struct ib_cm_ready_to_use {
+	/** Local communication ID */
+	uint32_t local_id;
+	/** Remote communication ID */
+	uint32_t remote_id;
+	/** Private data */
+	uint8_t private_data[224];
+} __attribute__ (( packed ));
+
+/** A communication management attribute */
+union ib_cm_data {
+	struct ib_cm_common common;
+	struct ib_cm_connect_request connect_request;
+	struct ib_cm_connect_reject connect_reject;
+	struct ib_cm_connect_reply connect_reply;
+	struct ib_cm_ready_to_use ready_to_use;
+	uint8_t bytes[232];
+} __attribute__ (( packed ));
+
+/*****************************************************************************
+ *
+ * MADs
+ *
+ *****************************************************************************
+ */
+
+/** Management datagram class_specific data */
+union ib_mad_class_specific {
+	uint16_t raw;
+	struct ib_smp_class_specific smp;
+} __attribute__ (( packed ));
+
+/** A management datagram common header
+ *
+ * Defined in section 13.4.2 of the IBA.
+ */
+struct ib_mad_hdr {
+	uint8_t base_version;
+	uint8_t mgmt_class;
+	uint8_t class_version;
+	uint8_t method;
+	uint16_t status;
+	union ib_mad_class_specific class_specific;
+	uint32_t tid[2];
+	uint16_t attr_id;
+	uint8_t reserved[2];
+	uint32_t attr_mod;
+} __attribute__ (( packed ));
+
+/* Management base version */
+#define IB_MGMT_BASE_VERSION			1
+
+/* Management classes */
+#define IB_MGMT_CLASS_SUBN_LID_ROUTED		0x01
+#define IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE	0x81
+#define IB_MGMT_CLASS_SUBN_ADM			0x03
+#define IB_MGMT_CLASS_PERF_MGMT			0x04
+#define IB_MGMT_CLASS_BM			0x05
+#define IB_MGMT_CLASS_DEVICE_MGMT		0x06
+#define IB_MGMT_CLASS_CM			0x07
+#define IB_MGMT_CLASS_SNMP			0x08
+#define IB_MGMT_CLASS_VENDOR_RANGE2_START	0x30
+#define IB_MGMT_CLASS_VENDOR_RANGE2_END		0x4f
+
+#define IB_MGMT_CLASS_MASK			0x7f
+
+/* Management methods */
+#define IB_MGMT_METHOD_GET			0x01
+#define IB_MGMT_METHOD_SET			0x02
+#define IB_MGMT_METHOD_GET_RESP			0x81
+#define IB_MGMT_METHOD_SEND			0x03
+#define IB_MGMT_METHOD_TRAP			0x05
+#define IB_MGMT_METHOD_REPORT			0x06
+#define IB_MGMT_METHOD_REPORT_RESP		0x86
+#define IB_MGMT_METHOD_TRAP_REPRESS		0x07
+#define IB_MGMT_METHOD_DELETE			0x15
+
+/* Status codes */
+#define IB_MGMT_STATUS_OK			0x0000
+#define IB_MGMT_STATUS_BAD_VERSION		0x0001
+#define IB_MGMT_STATUS_UNSUPPORTED_METHOD	0x0002
+#define IB_MGMT_STATUS_UNSUPPORTED_METHOD_ATTR	0x0003
+#define IB_MGMT_STATUS_INVALID_VALUE		0x0004
+
+/** A subnet management MAD */
+struct ib_mad_smp {
+	struct ib_mad_hdr mad_hdr;
+	struct ib_smp_hdr smp_hdr;
+	union ib_smp_data smp_data;
+	struct ib_smp_dr_path initial_path;
+	struct ib_smp_dr_path return_path;
+} __attribute__ (( packed ));
+
+/** A subnet administration MAD */
+struct ib_mad_sa {
+	struct ib_mad_hdr mad_hdr;
+	struct ib_rmpp_hdr rmpp_hdr;
+	struct ib_sa_hdr sa_hdr;
+	union ib_sa_data sa_data;
+} __attribute__ (( packed ));
+
+/** A communication management MAD */
+struct ib_mad_cm {
+	struct ib_mad_hdr mad_hdr;
+	union ib_cm_data cm_data;
+} __attribute__ (( packed ));
+
+/** A management datagram */
+union ib_mad {
+	struct ib_mad_hdr hdr;
+	struct ib_mad_smp smp;
+	struct ib_mad_sa sa;
+	struct ib_mad_cm cm;
+	uint8_t bytes[256];
+} __attribute__ (( packed ));
+
+#endif /* _IPXE_IB_MAD_H */
diff --git a/src/include/ipxe/ib_mcast.h b/src/include/ipxe/ib_mcast.h
new file mode 100644
index 0000000..86d5709
--- /dev/null
+++ b/src/include/ipxe/ib_mcast.h
@@ -0,0 +1,48 @@
+#ifndef _IPXE_IB_MCAST_H
+#define _IPXE_IB_MCAST_H
+
+/** @file
+ *
+ * Infiniband multicast groups
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/infiniband.h>
+
+struct ib_mad_transaction;
+
+/** An Infiniband multicast group membership */
+struct ib_mc_membership {
+	/** Queue pair */
+	struct ib_queue_pair *qp;
+	/** Multicast GID */
+	struct ib_gid gid;
+	/** Multicast group join transaction */
+	struct ib_mad_transaction *madx;
+	/** Handle join success/failure
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v membership	Multicast group membership
+	 * @v rc		Status code
+	 * @v mad		Response MAD (or NULL on error)
+	 */
+	void ( * complete ) ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			      struct ib_mc_membership *membership, int rc,
+			      union ib_mad *mad );
+};
+
+extern int ib_mcast_join ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			   struct ib_mc_membership *membership,
+			   struct ib_gid *gid,
+			   void ( * joined ) ( struct ib_device *ibdev,
+					       struct ib_queue_pair *qp,
+					       struct ib_mc_membership *memb,
+					       int rc, union ib_mad *mad ) );
+
+extern void ib_mcast_leave ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			     struct ib_mc_membership *membership );
+
+#endif /* _IPXE_IB_MCAST_H */
diff --git a/src/include/ipxe/ib_mi.h b/src/include/ipxe/ib_mi.h
new file mode 100644
index 0000000..5c5415b
--- /dev/null
+++ b/src/include/ipxe/ib_mi.h
@@ -0,0 +1,135 @@
+#ifndef _IPXE_IB_MI_H
+#define _IPXE_IB_MI_H
+
+/** @file
+ *
+ * Infiniband management interfaces
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/list.h>
+#include <ipxe/retry.h>
+#include <ipxe/tables.h>
+#include <ipxe/infiniband.h>
+
+struct ib_mad_interface;
+struct ib_mad_transaction;
+
+/** An Infiniband management agent */
+struct ib_mad_agent {
+	/** Management class */
+	uint8_t mgmt_class;
+	/** Class version */
+	uint8_t class_version;
+	/** Attribute (in network byte order) */
+	uint16_t attr_id;
+	/** Handle MAD
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v mi		Management interface
+	 * @v mad		Received MAD
+	 * @v av		Source address vector
+	 * @ret rc		Return status code
+	 */
+	void ( * handle ) ( struct ib_device *ibdev,
+			    struct ib_mad_interface *mi,
+			    union ib_mad *mad,
+			    struct ib_address_vector *av );
+};
+
+/** Infiniband management agents */
+#define IB_MAD_AGENTS __table ( struct ib_mad_agent, "ib_mad_agents" )
+
+/** Declare an Infiniband management agent */
+#define __ib_mad_agent __table_entry ( IB_MAD_AGENTS, 01 )
+
+/** Infiniband management transaction operations */
+struct ib_mad_transaction_operations {
+	/** Handle transaction completion
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v mi		Management interface
+	 * @v madx		Management transaction
+	 * @v rc		Status code
+	 * @v mad		Received MAD (or NULL on error)
+	 * @v av		Source address vector (or NULL on error)
+	 *
+	 * The completion handler should in most cases call
+	 * ib_destroy_madx() to free up the completed transaction.
+	 */
+	void ( * complete ) ( struct ib_device *ibdev,
+			      struct ib_mad_interface *mi,
+			      struct ib_mad_transaction *madx,
+			      int rc, union ib_mad *mad,
+			      struct ib_address_vector *av );
+};
+
+/** An Infiniband management transaction */
+struct ib_mad_transaction {
+	/** Associated management interface */
+	struct ib_mad_interface *mi;
+	/** List of transactions */
+	struct list_head list;
+	/** Retry timer */
+	struct retry_timer timer;
+	/** Destination address vector */
+	struct ib_address_vector av;
+	/** MAD being sent */
+	union ib_mad mad;
+	/** Transaction operations */
+	struct ib_mad_transaction_operations *op;
+	/** Owner private data */
+	void *owner_priv;
+};
+
+/** An Infiniband management interface */
+struct ib_mad_interface {
+	/** Infiniband device */
+	struct ib_device *ibdev;
+	/** Completion queue */
+	struct ib_completion_queue *cq;
+	/** Queue pair */
+	struct ib_queue_pair *qp;
+	/** List of management transactions */
+	struct list_head madx;
+};
+
+/**
+ * Set Infiniband management transaction owner-private data
+ *
+ * @v madx		Management transaction
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_madx_set_ownerdata ( struct ib_mad_transaction *madx, void *priv ) {
+	madx->owner_priv = priv;
+}
+
+/**
+ * Get Infiniband management transaction owner-private data
+ *
+ * @v madx		Management transaction
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_madx_get_ownerdata ( struct ib_mad_transaction *madx ) {
+	return madx->owner_priv;
+}
+
+extern int ib_mi_send ( struct ib_device *ibdev, struct ib_mad_interface *mi,
+			union ib_mad *mad, struct ib_address_vector *av );
+extern struct ib_mad_transaction *
+ib_create_madx ( struct ib_device *ibdev, struct ib_mad_interface *mi,
+		 union ib_mad *mad, struct ib_address_vector *av,
+		 struct ib_mad_transaction_operations *op );
+extern void ib_destroy_madx ( struct ib_device *ibdev,
+			      struct ib_mad_interface *mi,
+			      struct ib_mad_transaction *madx );
+extern struct ib_mad_interface * ib_create_mi ( struct ib_device *ibdev,
+						enum ib_queue_pair_type type );
+extern void ib_destroy_mi ( struct ib_device *ibdev,
+			    struct ib_mad_interface *mi );
+
+#endif /* _IPXE_IB_MI_H */
diff --git a/src/include/ipxe/ib_packet.h b/src/include/ipxe/ib_packet.h
new file mode 100644
index 0000000..0904295
--- /dev/null
+++ b/src/include/ipxe/ib_packet.h
@@ -0,0 +1,147 @@
+#ifndef _IPXE_IB_PACKET_H
+#define _IPXE_IB_PACKET_H
+
+/** @file
+ *
+ * Infiniband packet format
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct ib_device;
+struct ib_queue_pair;
+struct ib_address_vector;
+struct io_buffer;
+
+/** Half of an Infiniband Global Identifier */
+struct ib_gid_half {
+	union {
+		uint8_t bytes[8];
+		uint16_t words[4];
+		uint32_t dwords[2];
+	} u;
+};
+
+/** An Infiniband Global Identifier */
+struct ib_gid {
+	union {
+		uint8_t bytes[16];
+		uint16_t words[8];
+		uint32_t dwords[4];
+		struct ib_gid_half half[2];
+	} u;
+};
+
+/** An Infiniband Local Route Header */
+struct ib_local_route_header {
+	/** Virtual lane and link version */
+	uint8_t vl__lver;
+	/** Service level and next link header */
+	uint8_t sl__lnh;
+	/** Destination LID */
+	uint16_t dlid;
+	/** Packet length */
+	uint16_t length;
+	/** Source LID */
+	uint16_t slid;
+} __attribute__ (( packed ));
+
+/** Infiniband virtual lanes */
+enum ib_vl {
+	IB_VL_DEFAULT = 0,
+	IB_VL_SMP = 15,
+};
+
+/** An Infiniband Link Next Header value */
+enum ib_lnh {
+	IB_LNH_RAW = 0,
+	IB_LNH_IPv6 = 1,
+	IB_LNH_BTH = 2,
+	IB_LNH_GRH = 3
+};
+
+/** Default Infiniband LID */
+#define IB_LID_NONE 0xffff
+
+/** Test for multicast LID */
+#define IB_LID_MULTICAST( lid ) ( ( (lid) >= 0xc000 ) && ( (lid) <= 0xfffe ) )
+
+/** An Infiniband Global Route Header */
+struct ib_global_route_header {
+	/** IP version, traffic class, and flow label
+	 *
+	 *  4 bits : Version of the GRH
+	 *  8 bits : Traffic class
+	 * 20 bits : Flow label
+	 */
+	uint32_t ipver__tclass__flowlabel;
+	/** Payload length */
+	uint16_t paylen;
+	/** Next header */
+	uint8_t nxthdr;
+	/** Hop limit */
+	uint8_t hoplmt;
+	/** Source GID */
+	struct ib_gid sgid;
+	/** Destiniation GID */
+	struct ib_gid dgid;
+} __attribute__ (( packed ));
+
+#define IB_GRH_IPVER_IPv6 0x06
+#define IB_GRH_NXTHDR_IBA 0x1b
+
+/** An Infiniband Base Transport Header */
+struct ib_base_transport_header {
+	/** Opcode */
+	uint8_t opcode;
+	/** Transport header version, pad count, migration and solicitation */
+	uint8_t se__m__padcnt__tver;
+	/** Partition key */
+	uint16_t pkey;
+	/** Destination queue pair */
+	uint32_t dest_qp;
+	/** Packet sequence number and acknowledge request */
+	uint32_t ack__psn;
+} __attribute__ (( packed ));
+
+/** An Infiniband BTH opcode */
+enum ib_bth_opcode {
+	BTH_OPCODE_UD_SEND = 0x64,
+};
+
+/** An Infiniband Datagram Extended Transport Header */
+struct ib_datagram_extended_transport_header {
+	/** Queue key */
+	uint32_t qkey;
+	/** Source queue pair */
+	uint32_t src_qp;
+} __attribute__ (( packed ));
+
+/** All known IB header formats */
+union ib_headers {
+	struct ib_local_route_header lrh;
+	struct {
+		struct ib_local_route_header lrh;
+		struct ib_global_route_header grh;
+		struct ib_base_transport_header bth;
+		struct ib_datagram_extended_transport_header deth;
+	} __attribute__ (( packed )) lrh__grh__bth__deth;
+	struct {
+		struct ib_local_route_header lrh;
+		struct ib_base_transport_header bth;
+		struct ib_datagram_extended_transport_header deth;
+	} __attribute__ (( packed )) lrh__bth__deth;
+} __attribute__ (( packed ));
+
+/** Maximum size required for IB headers */
+#define IB_MAX_HEADER_SIZE sizeof ( union ib_headers )
+
+extern int ib_push ( struct ib_device *ibdev, struct io_buffer *iobuf,
+		     struct ib_queue_pair *qp, size_t payload_len,
+		     const struct ib_address_vector *av );
+extern int ib_pull ( struct ib_device *ibdev, struct io_buffer *iobuf,
+		     struct ib_queue_pair **qp, size_t *payload_len,
+		     struct ib_address_vector *av );
+
+#endif /* _IPXE_IB_PACKET_H */
diff --git a/src/include/ipxe/ib_pathrec.h b/src/include/ipxe/ib_pathrec.h
new file mode 100644
index 0000000..1fe67f8
--- /dev/null
+++ b/src/include/ipxe/ib_pathrec.h
@@ -0,0 +1,76 @@
+#ifndef _IPXE_IB_PATHREC_H
+#define _IPXE_IB_PATHREC_H
+
+/** @file
+ *
+ * Infiniband path records
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/infiniband.h>
+
+struct ib_mad_transaction;
+struct ib_path;
+
+/** Infiniband path operations */
+struct ib_path_operations {
+	/** Handle path transaction completion
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v path		Path
+	 * @v rc		Status code
+	 * @v av		Address vector, or NULL on error
+	 */
+	void ( * complete ) ( struct ib_device *ibdev,
+			      struct ib_path *path, int rc,
+			      struct ib_address_vector *av );
+};
+
+/** An Infiniband path */
+struct ib_path {
+	/** Infiniband device */
+	struct ib_device *ibdev;
+	/** Address vector */
+	struct ib_address_vector av;
+	/** Management transaction */
+	struct ib_mad_transaction *madx;
+	/** Path operations */
+	struct ib_path_operations *op;
+	/** Owner private data */
+	void *owner_priv;
+};
+
+/**
+ * Set Infiniband path owner-private data
+ *
+ * @v path		Path
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_path_set_ownerdata ( struct ib_path *path, void *priv ) {
+	path->owner_priv = priv;
+}
+
+/**
+ * Get Infiniband path owner-private data
+ *
+ * @v path		Path
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_path_get_ownerdata ( struct ib_path *path ) {
+	return path->owner_priv;
+}
+
+extern struct ib_path *
+ib_create_path ( struct ib_device *ibdev, struct ib_address_vector *av,
+		 struct ib_path_operations *op );
+extern void ib_destroy_path ( struct ib_device *ibdev,
+			      struct ib_path *path );
+
+extern int ib_resolve_path ( struct ib_device *ibdev,
+			     struct ib_address_vector *av );
+
+#endif /* _IPXE_IB_PATHREC_H */
diff --git a/src/include/ipxe/ib_sma.h b/src/include/ipxe/ib_sma.h
new file mode 100644
index 0000000..fa355c6
--- /dev/null
+++ b/src/include/ipxe/ib_sma.h
@@ -0,0 +1,20 @@
+#ifndef _IPXE_IB_SMA_H
+#define _IPXE_IB_SMA_H
+
+/** @file
+ *
+ * Infiniband subnet management agent
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct ib_device;
+struct ib_mad_interface;
+
+extern int ib_create_sma ( struct ib_device *ibdev,
+			   struct ib_mad_interface *mi );
+extern void ib_destroy_sma ( struct ib_device *ibdev,
+			     struct ib_mad_interface *mi );
+
+#endif /* _IPXE_IB_SMA_H */
diff --git a/src/include/ipxe/ib_smc.h b/src/include/ipxe/ib_smc.h
new file mode 100644
index 0000000..d16a37f
--- /dev/null
+++ b/src/include/ipxe/ib_smc.h
@@ -0,0 +1,20 @@
+#ifndef _IPXE_IB_SMC_H
+#define _IPXE_IB_SMC_H
+
+/** @file
+ *
+ * Infiniband Subnet Management Client
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/infiniband.h>
+
+typedef int ( * ib_local_mad_t ) ( struct ib_device *ibdev,
+				   union ib_mad *mad );
+
+extern int ib_smc_update ( struct ib_device *ibdev,
+			   ib_local_mad_t local_mad );
+
+#endif /* _IPXE_IB_SMC_H */
diff --git a/src/include/ipxe/ib_srp.h b/src/include/ipxe/ib_srp.h
new file mode 100644
index 0000000..b773f96
--- /dev/null
+++ b/src/include/ipxe/ib_srp.h
@@ -0,0 +1,79 @@
+#ifndef _IPXE_IB_SRP_H
+#define _IPXE_IB_SRP_H
+
+/** @file
+ *
+ * SCSI RDMA Protocol over Infiniband
+ *
+ */
+
+FILE_LICENCE ( BSD2 );
+
+#include <stdint.h>
+#include <ipxe/infiniband.h>
+#include <ipxe/srp.h>
+
+/** SRP initiator port identifier for Infiniband */
+struct ib_srp_initiator_port_id {
+	/** Identifier extension */
+	struct ib_gid_half id_ext;
+	/** IB channel adapter GUID */
+	struct ib_gid_half hca_guid;
+} __attribute__ (( packed ));
+
+/** SRP target port identifier for Infiniband */
+struct ib_srp_target_port_id {
+	/** Identifier extension */
+	struct ib_gid_half id_ext;
+	/** I/O controller GUID */
+	struct ib_gid_half ioc_guid;
+} __attribute__ (( packed ));
+
+/**
+ * Get Infiniband-specific initiator port ID
+ *
+ * @v port_ids		SRP port IDs
+ * @ret initiator_port_id  Infiniband-specific initiator port ID
+ */
+static inline __always_inline struct ib_srp_initiator_port_id *
+ib_srp_initiator_port_id ( struct srp_port_ids *port_ids ) {
+	return ( ( struct ib_srp_initiator_port_id * ) &port_ids->initiator );
+}
+
+/**
+ * Get Infiniband-specific target port ID
+ *
+ * @v port_ids		SRP port IDs
+ * @ret target_port_id	Infiniband-specific target port ID
+ */
+static inline __always_inline struct ib_srp_target_port_id *
+ib_srp_target_port_id ( struct srp_port_ids *port_ids ) {
+	return ( ( struct ib_srp_target_port_id * ) &port_ids->target );
+}
+
+/** Infiniband-specific SRP parameters */
+struct ib_srp_parameters {
+	/** Source GID */
+	struct ib_gid sgid;
+	/** Destination GID */
+	struct ib_gid dgid;
+	/** Service ID */
+	struct ib_gid_half service_id;
+	/** Partition key */
+	uint16_t pkey;
+};
+
+/**
+ * Get Infiniband-specific transport parameters
+ *
+ * @v srp		SRP device
+ * @ret ib_params	Infiniband-specific transport parameters
+ */
+static inline __always_inline struct ib_srp_parameters *
+ib_srp_params ( struct srp_device *srp ) {
+	return srp_transport_priv ( srp );
+}
+
+extern struct srp_transport_type ib_srp_transport;
+
+#endif /* _IPXE_IB_SRP_H */
diff --git a/src/include/ipxe/icmp.h b/src/include/ipxe/icmp.h
new file mode 100644
index 0000000..e402ce4
--- /dev/null
+++ b/src/include/ipxe/icmp.h
@@ -0,0 +1,25 @@
+#ifndef _IPXE_ICMP_H
+#define _IPXE_ICMP_H
+
+/** @file
+ *
+ * ICMP protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** An ICMP header */
+struct icmp_header {
+	/** Type */
+	uint8_t type;
+	/** Code */
+	uint8_t code;
+	/** Checksum */
+	uint16_t chksum;
+} __attribute__ (( packed ));
+
+#define ICMP_ECHO_RESPONSE 0
+#define ICMP_ECHO_REQUEST 8
+
+#endif /* _IPXE_ICMP_H */
diff --git a/src/include/ipxe/icmp6.h b/src/include/ipxe/icmp6.h
new file mode 100644
index 0000000..d2ab3bc
--- /dev/null
+++ b/src/include/ipxe/icmp6.h
@@ -0,0 +1,59 @@
+#ifndef _IPXE_ICMP6_H
+#define _IPXE_ICMP6_H
+
+/** @file
+ *
+ * ICMP6 protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/ip6.h>
+#include <ipxe/ndp.h>
+
+#define ICMP6_NSOLICIT 135
+#define ICMP6_NADVERT 136
+
+extern struct tcpip_protocol icmp6_protocol;
+
+struct icmp6_header {
+	uint8_t type;
+	uint8_t code;
+	uint16_t csum;
+	/* Message body */
+};
+
+struct neighbour_solicit {
+	uint8_t type;
+	uint8_t code;
+	uint16_t csum;
+	uint32_t reserved;
+	struct in6_addr target;
+	/* "Compulsory" options */
+	uint8_t opt_type;
+	uint8_t opt_len;
+  /* FIXME:  hack alert */
+	uint8_t opt_ll_addr[6];
+};
+
+struct neighbour_advert {
+	uint8_t type;
+	uint8_t code;
+	uint16_t csum;
+	uint8_t flags;
+	uint8_t reserved;
+	struct in6_addr target;
+	uint8_t opt_type;
+	uint8_t opt_len;
+  /* FIXME:  hack alert */
+	uint8_t opt_ll_addr[6];
+};
+
+#define ICMP6_FLAGS_ROUTER 0x80
+#define ICMP6_FLAGS_SOLICITED 0x40
+#define ICMP6_FLAGS_OVERRIDE 0x20
+
+int icmp6_send_solicit ( struct net_device *netdev, struct in6_addr *src, struct in6_addr *dest );
+
+#endif /* _IPXE_ICMP6_H */
diff --git a/src/include/ipxe/ieee80211.h b/src/include/ipxe/ieee80211.h
new file mode 100644
index 0000000..8f4aa96
--- /dev/null
+++ b/src/include/ipxe/ieee80211.h
@@ -0,0 +1,1160 @@
+#ifndef _IPXE_IEEE80211_H
+#define _IPXE_IEEE80211_H
+
+#include <ipxe/if_ether.h>	/* for ETH_ALEN */
+#include <endian.h>
+
+/** @file
+ * Constants and data structures defined in IEEE 802.11, subsetted
+ * according to what iPXE knows how to use.
+ */
+
+FILE_LICENCE(GPL2_OR_LATER);
+
+/* ---------- Maximum lengths of things ---------- */
+
+/**
+ * @defgroup ieee80211_maxlen Maximum lengths in the 802.11 protocol
+ * @{
+ */
+
+/** Maximum length of frame payload
+ *
+ * This does not include cryptographic overhead, which can be up to 20
+ * bytes, but it DOES include the 802.2 LLC/SNAP headers that are used
+ * on data frames (but not management frames).
+ */
+#define IEEE80211_MAX_DATA_LEN          2304
+
+/** Length of LLC/SNAP headers on data frames */
+#define IEEE80211_LLC_HEADER_LEN	8
+
+/** Maximum cryptographic overhead before encrypted data */
+#define IEEE80211_MAX_CRYPTO_HEADER	8
+
+/** Maximum cryptographic overhead after encrypted data
+ *
+ * This does not count the MIC in TKIP frames, since that is
+ * considered to be part of the MSDU and thus contributes to the size
+ * of the data field.
+ *
+ * It @e does count the MIC in CCMP frames, which is considered part
+ * of the MPDU (outside the data field).
+ */
+#define IEEE80211_MAX_CRYPTO_TRAILER    8
+
+/** Total maximum cryptographic overhead */
+#define IEEE80211_MAX_CRYPTO_OVERHEAD	16
+
+/** Bytes of network-layer data that can go into a regular data frame */
+#define IEEE80211_MAX_FRAME_DATA	2296
+
+/** Frame header length for frames we might work with
+ *
+ * QoS adds a two-byte field on top of this, and APs communicating
+ * with each other in Wireless Distribution System (WDS) mode add an
+ * extra 6-byte MAC address field, but we do not work with such
+ * frames.
+ */
+#define IEEE80211_TYP_FRAME_HEADER_LEN	24
+
+/** Theoretical maximum frame header length
+ *
+ * This includes the QoS and WDS Addr4 fields that we should never
+ * see.
+ */
+#define IEEE80211_MAX_FRAME_HEADER_LEN	32
+
+/** Maximum combined frame length
+ *
+ * The biggest frame will include 32 frame header bytes, 16 bytes of
+ * crypto overhead, and 2304 data bytes.
+ */
+#define IEEE80211_MAX_FRAME_LEN         2352
+
+/** Maximum length of an ESSID */
+#define IEEE80211_MAX_SSID_LEN          32
+
+/** @} */
+
+
+/* ---------- Frame Control defines ---------- */
+
+/**
+ * @defgroup ieee80211_fc 802.11 Frame Control field bits
+ * @{
+ */
+
+/** 802.11 Frame Control field, Version bitmask */
+#define IEEE80211_FC_VERSION	0x0003
+
+/** Expected value of Version bits in Frame Control */
+#define  IEEE80211_THIS_VERSION  0x0000
+
+
+/** 802.11 Frame Control field, Frame Type bitmask */
+#define IEEE80211_FC_TYPE	0x000C
+
+/** Type value for management (layer-2) frames */
+#define  IEEE80211_TYPE_MGMT     0x0000
+
+/** Type value for control (layer-1, hardware-managed) frames */
+#define  IEEE80211_TYPE_CTRL     0x0004
+
+/** Type value for data frames */
+#define  IEEE80211_TYPE_DATA     0x0008
+
+
+/** 802.11 Frame Control field, Frame Subtype bitmask */
+#define IEEE80211_FC_SUBTYPE	0x00F0
+
+/** Subtype value for association-request management frames
+ *
+ * Association request frames are sent after authentication from the
+ * client to the Access Point to establish the client as part of the
+ * Access Point's network.
+ */
+#define  IEEE80211_STYPE_ASSOC_REQ    0x0000
+
+/** Subtype value for association-response management frames
+ *
+ * Association response frames are sent by the Access Point to confirm
+ * or deny the association requested in an association request frame.
+ */
+#define  IEEE80211_STYPE_ASSOC_RESP   0x0010
+
+/** Subtype value for reassociation-request management frames
+ *
+ * Reassociation request frames are sent by clients wishing to change
+ * from one Access Point to another while roaming within the same
+ * extended network (same ESSID).
+ */
+#define  IEEE80211_STYPE_REASSOC_REQ  0x0020
+
+/** Subtype value for reassociation-response management frames
+ *
+ * Reassociation response frames are sent by the Access Point to
+ * confirm or deny the swap requested in a reassociation request
+ * frame.
+ */
+#define  IEEE80211_STYPE_REASSOC_RESP 0x0030
+
+/** Subtype value for probe-request management frames
+ *
+ * Probe request frames are sent by clients to request that all Access
+ * Points on the sending channel, or all belonging to a particular
+ * ESSID, identify themselves by BSSID, supported transfer rates, RF
+ * configuration, and other capabilities.
+ */
+#define  IEEE80211_STYPE_PROBE_REQ    0x0040
+
+/** Subtype value for probe-response management frames
+ *
+ * Probe response frames are sent by Access Points in response to
+ * probe request frames, providing the requested information.
+ */
+#define  IEEE80211_STYPE_PROBE_RESP   0x0050
+
+/** Subtype value for beacon management frames
+ *
+ * Beacon frames are sent by Access Points at regular intervals,
+ * usually ten per second, on the channel on which they communicate.
+ * They can be used to probe passively for access points on a channel
+ * where local regulatory restrictions prohibit active scanning, or
+ * due to their regularity as a mechanism to determine the fraction of
+ * packets that are being dropped.
+ */
+#define  IEEE80211_STYPE_BEACON       0x0080
+
+/** Subtype value for disassociation management frames
+ *
+ * Disassociation frames are sent by either a client or an Access
+ * Point to unequivocally terminate the association between the two.
+ * They may be sent by clients upon leaving the network, or by an
+ * Access Point upon reconfiguration, among other reasons; they are
+ * usually more "polite" than deauthentication frames.
+ */
+#define  IEEE80211_STYPE_DISASSOC     0x00A0
+
+/** Subtype value for authentication management frames
+ *
+ * Authentication frames are exchanged between a client and an Access
+ * Point before association may be performed. Confusingly, in the most
+ * common authentication method (Open System) no security tokens are
+ * exchanged at all. Modern 802.11 security handshaking takes place
+ * after association.
+ */
+#define  IEEE80211_STYPE_AUTH         0x00B0
+
+/** Subtype value for deauthentication management frames
+ *
+ * Deauthentication frames are sent by either a client or an Access
+ * Point to terminate the authentication (and therefore also the
+ * association) between the two. They are generally more forceful than
+ * disassociation frames, sent for such reasons as a failure to
+ * set up security properly after associating.
+ */
+#define  IEEE80211_STYPE_DEAUTH       0x00C0
+
+/** Subtype value for action management frames
+ *
+ * Action frames are used to implement spectrum management and QoS
+ * features that iPXE currently does not support.
+ */
+#define  IEEE80211_STYPE_ACTION	      0x00D0
+
+
+/** Subtype value for RTS (request to send) control frames */
+#define  IEEE80211_STYPE_RTS          0x00B0
+
+/** Subtype value for CTS (clear to send) control frames */
+#define  IEEE80211_STYPE_CTS          0x00C0
+
+/** Subtype value for ACK (acknowledgement) control frames */
+#define  IEEE80211_STYPE_ACK          0x00D0
+
+
+/** Subtype value for ordinary data frames, with no QoS or CF add-ons */
+#define  IEEE80211_STYPE_DATA         0x0000
+
+/** Subtype value for data frames containing no data */
+#define  IEEE80211_STYPE_NODATA       0x0040
+
+
+/** 802.11 Frame Control field: To Data System flag
+ *
+ * This is set on data frames sent to an Access Point.
+ */
+#define IEEE80211_FC_TODS       0x0100
+
+/** 802.11 Frame Control field: From Data System flag
+ *
+ * This is set on data frames sent from an Access Point. If both TODS
+ * and FROMDS are set, the frame header is a 4-address format used for
+ * inter-Access Point communication.
+ */
+#define IEEE80211_FC_FROMDS     0x0200
+
+/** 802.11 Frame Control field: More Fragments flag */
+#define IEEE80211_FC_MORE_FRAG  0x0400
+
+/** 802.11 Frame Control field: Retransmission flag */
+#define IEEE80211_FC_RETRY      0x0800
+
+/** 802.11 Frame Control field: Power Managed flag
+ *
+ * This is set on any frame sent by a low-power station that will go
+ * into a power-saving mode immediately after this frame. Access
+ * Points are not allowed to act as low-power stations.
+ */
+#define IEEE80211_FC_PWR_MGMT   0x1000
+
+/** 802.11 Frame Control field: More Data flag
+ *
+ * This is set on any frame sent by a station that has more data
+ * queued to be sent than is in the frame.
+ */
+#define IEEE80211_FC_MORE_DATA  0x2000
+
+/** 802.11 Frame Control field: Protected flag
+ *
+ * This is set on frames in which data is encrypted (by any method).
+ */
+#define IEEE80211_FC_PROTECTED  0x4000
+
+/** 802.11 Frame Control field: Ordered flag [?] */
+#define IEEE80211_FC_ORDER      0x8000
+
+/** @} */
+
+
+/* ---------- Sequence Control defines ---------- */
+
+/**
+ * @defgroup ieee80211_seq 802.11 Sequence Control field handling
+ * @{
+ */
+
+/** Extract sequence number from 802.11 Sequence Control field */
+#define IEEE80211_SEQNR( seq )		( ( seq ) >> 4 )
+
+/** Extract fragment number from 802.11 Sequence Control field */
+#define IEEE80211_FRAG( seq )		( ( seq ) & 0x000F )
+
+/** Make 802.11 Sequence Control field from sequence and fragment numbers */
+#define IEEE80211_MAKESEQ( seqnr, frag )	\
+	( ( ( ( seqnr ) & 0xFFF ) << 4 ) | ( ( frag ) & 0xF ) )
+
+/** @} */
+
+
+/* ---------- Frame header formats ---------- */
+
+/**
+ * @defgroup ieee80211_hdr 802.11 frame header formats
+ * @{
+ */
+
+/** An 802.11 data or management frame without QoS or WDS header fields */
+struct ieee80211_frame
+{
+	u16 fc;			/**< 802.11 Frame Control field */
+	u16 duration;		/**< Microseconds to reserve link */
+	u8 addr1[ETH_ALEN];	/**< Address 1 (immediate receiver) */
+	u8 addr2[ETH_ALEN];	/**< Address 2 (immediate sender) */
+	u8 addr3[ETH_ALEN];	/**< Address 3 (often "forward to") */
+	u16 seq;		/**< 802.11 Sequence Control field */
+	u8 data[0];		/**< Beginning of frame data */
+} __attribute__((packed));
+
+/** The 802.2 LLC/SNAP header sent before actual data in a data frame
+ *
+ * This header is not acknowledged in the 802.11 standard at all; it
+ * is treated just like data for MAC-layer purposes, including
+ * fragmentation and encryption. It is actually two headers
+ * concatenated: a three-byte 802.2 LLC header indicating Subnetwork
+ * Accesss Protocol (SNAP) in both source and destination Service
+ * Access Point (SAP) fields, and a five-byte SNAP header indicating a
+ * zero OUI and two-byte Ethernet protocol type field.
+ *
+ * Thus, an eight-byte header in which six of the bytes are redundant.
+ * Lovely, isn't it?
+ */
+struct ieee80211_llc_snap_header
+{
+	/* LLC part: */
+	u8 dsap;		/**< Destination SAP ID */
+	u8 ssap;		/**< Source SAP ID */
+	u8 ctrl;		/**< Control information */
+
+	/* SNAP part: */
+	u8 oui[3];		/**< Organization code, usually 0 */
+	u16 ethertype;		/**< Ethernet Type field */
+} __attribute__((packed));
+
+/** Value for DSAP field in 802.2 LLC header for 802.11 frames: SNAP */
+#define IEEE80211_LLC_DSAP	0xAA
+
+/** Value for SSAP field in 802.2 LLC header for 802.11 frames: SNAP */
+#define IEEE80211_LLC_SSAP	0xAA
+
+/** Value for control field in 802.2 LLC header for 802.11 frames
+ *
+ * "Unnumbered Information".
+ */
+#define IEEE80211_LLC_CTRL	0x03
+
+
+/** 16-byte RTS frame format, with abbreviated header */
+struct ieee80211_rts
+{
+	u16 fc;			/**< 802.11 Frame Control field */
+	u16 duration;		/**< Microseconds to reserve link */
+	u8 addr1[ETH_ALEN];	/**< Address 1 (immediate receiver) */
+	u8 addr2[ETH_ALEN];	/**< Address 2 (immediate sender) */
+} __attribute__((packed));
+
+/** Length of 802.11 RTS control frame */
+#define IEEE80211_RTS_LEN	16
+
+/** 10-byte CTS or ACK frame format, with abbreviated header */
+struct ieee80211_cts_or_ack
+{
+	u16 fc;			/**< 802.11 Frame Control field */
+	u16 duration;		/**< Microseconds to reserve link */
+	u8 addr1[ETH_ALEN];	/**< Address 1 (immediate receiver) */
+} __attribute__((packed));
+
+#define ieee80211_cts ieee80211_cts_or_ack
+#define ieee80211_ack ieee80211_cts_or_ack
+
+/** Length of 802.11 CTS control frame */
+#define IEEE80211_CTS_LEN	10
+
+/** Length of 802.11 ACK control frame */
+#define IEEE80211_ACK_LEN	10
+
+/** @} */
+
+
+/* ---------- Capability bits, status and reason codes ---------- */
+
+/**
+ * @defgroup ieee80211_capab 802.11 management frame capability field bits
+ * @{
+ */
+
+/** Set if using an Access Point (managed mode) */
+#define IEEE80211_CAPAB_MANAGED       0x0001
+
+/** Set if operating in IBSS (no-AP, "Ad-Hoc") mode */
+#define IEEE80211_CAPAB_ADHOC         0x0002
+
+/** Set if we support Contention-Free Period operation */
+#define IEEE80211_CAPAB_CFPOLL        0x0004
+
+/** Set if we wish to be polled for Contention-Free operation */
+#define IEEE80211_CAPAB_CFPR          0x0008
+
+/** Set if the network is encrypted (by any method) */
+#define IEEE80211_CAPAB_PRIVACY       0x0010
+
+/** Set if PHY supports short preambles on 802.11b */
+#define IEEE80211_CAPAB_SHORT_PMBL    0x0020
+
+/** Set if PHY supports PBCC modulation */
+#define IEEE80211_CAPAB_PBCC          0x0040
+
+/** Set if we support Channel Agility */
+#define IEEE80211_CAPAB_CHAN_AGILITY  0x0080
+
+/** Set if we support spectrum management (DFS and TPC) on the 5GHz band */
+#define IEEE80211_CAPAB_SPECTRUM_MGMT 0x0100
+
+/** Set if we support Quality of Service enhancements */
+#define IEEE80211_CAPAB_QOS           0x0200
+
+/** Set if PHY supports short slot time on 802.11g */
+#define IEEE80211_CAPAB_SHORT_SLOT    0x0400
+
+/** Set if PHY supports APSD option */
+#define IEEE80211_CAPAB_APSD          0x0800
+
+/** Set if PHY supports DSSS/OFDM modulation (one way of 802.11 b/g mixing) */
+#define IEEE80211_CAPAB_DSSS_OFDM     0x2000
+
+/** Set if we support delayed block ACK */
+#define IEEE80211_CAPAB_DELAYED_BACK  0x4000
+
+/** Set if we support immediate block ACK */
+#define IEEE80211_CAPAB_IMMED_BACK    0x8000
+
+/** @} */
+
+
+/**
+ * @defgroup ieee80211_status 802.11 status codes
+ *
+ * These are returned to indicate an immediate denial of
+ * authentication or association. In iPXE, the lower 5 bits of the
+ * status code are encoded into the file-unique portion of an error
+ * code, the ERRFILE portion is always @c ERRFILE_net80211, and the
+ * POSIX error code is @c ECONNREFUSED for status 0-31 or @c
+ * EHOSTUNREACH for status 32-63.
+ *
+ * For a complete table with non-abbreviated error messages, see IEEE
+ * Std 802.11-2007, Table 7-23, p.94.
+ *
+ * @{
+ */
+
+#define IEEE80211_STATUS_SUCCESS		0
+#define IEEE80211_STATUS_FAILURE		1
+#define IEEE80211_STATUS_CAPAB_UNSUPP		10
+#define IEEE80211_STATUS_REASSOC_INVALID	11
+#define IEEE80211_STATUS_ASSOC_DENIED		12
+#define IEEE80211_STATUS_AUTH_ALGO_UNSUPP	13
+#define IEEE80211_STATUS_AUTH_SEQ_INVALID	14
+#define IEEE80211_STATUS_AUTH_CHALL_INVALID	15
+#define IEEE80211_STATUS_AUTH_TIMEOUT		16
+#define IEEE80211_STATUS_ASSOC_NO_ROOM		17
+#define IEEE80211_STATUS_ASSOC_NEED_RATE	18
+#define IEEE80211_STATUS_ASSOC_NEED_SHORT_PMBL	19
+#define IEEE80211_STATUS_ASSOC_NEED_PBCC	20
+#define IEEE80211_STATUS_ASSOC_NEED_CHAN_AGILITY 21
+#define IEEE80211_STATUS_ASSOC_NEED_SPECTRUM_MGMT 22
+#define IEEE80211_STATUS_ASSOC_BAD_POWER	23
+#define IEEE80211_STATUS_ASSOC_BAD_CHANNELS	24
+#define IEEE80211_STATUS_ASSOC_NEED_SHORT_SLOT	25
+#define IEEE80211_STATUS_ASSOC_NEED_DSSS_OFDM	26
+#define IEEE80211_STATUS_QOS_FAILURE		32
+#define IEEE80211_STATUS_QOS_NO_ROOM		33
+#define IEEE80211_STATUS_LINK_IS_HORRIBLE	34
+#define IEEE80211_STATUS_ASSOC_NEED_QOS		35
+#define IEEE80211_STATUS_REQUEST_DECLINED	37
+#define IEEE80211_STATUS_REQUEST_INVALID	38
+#define IEEE80211_STATUS_TS_NOT_CREATED_AGAIN	39
+#define IEEE80211_STATUS_INVALID_IE		40
+#define IEEE80211_STATUS_GROUP_CIPHER_INVALID	41
+#define IEEE80211_STATUS_PAIR_CIPHER_INVALID	42
+#define IEEE80211_STATUS_AKMP_INVALID		43
+#define IEEE80211_STATUS_RSN_VERSION_UNSUPP	44
+#define IEEE80211_STATUS_RSN_CAPAB_INVALID	45
+#define IEEE80211_STATUS_CIPHER_REJECTED	46
+#define IEEE80211_STATUS_TS_NOT_CREATED_WAIT	47
+#define IEEE80211_STATUS_DIRECT_LINK_FORBIDDEN	48
+#define IEEE80211_STATUS_DEST_NOT_PRESENT	49
+#define IEEE80211_STATUS_DEST_NOT_QOS		50
+#define IEEE80211_STATUS_ASSOC_LISTEN_TOO_HIGH	51
+
+/** @} */
+
+
+
+/**
+ * @defgroup ieee80211_reason 802.11 reason codes
+ *
+ * These are returned to indicate the reason for a deauthentication or
+ * disassociation sent (usually) after authentication or association
+ * had succeeded.  In iPXE, the lower 5 bits of the reason code are
+ * encoded into the file-unique portion of an error code, the ERRFILE
+ * portion is always @c ERRFILE_net80211, and the POSIX error code is
+ * @c ECONNRESET for reason 0-31 or @c ENETRESET for reason 32-63.
+ *
+ * For a complete table with non-abbreviated error messages, see IEEE
+ * Std 802.11-2007, Table 7-22, p.92.
+ *
+ * @{
+ */
+
+#define IEEE80211_REASON_NONE			0
+#define IEEE80211_REASON_UNSPECIFIED		1
+#define IEEE80211_REASON_AUTH_NO_LONGER_VALID	2
+#define IEEE80211_REASON_LEAVING		3
+#define IEEE80211_REASON_INACTIVITY		4
+#define IEEE80211_REASON_OUT_OF_RESOURCES	5
+#define IEEE80211_REASON_NEED_AUTH		6
+#define IEEE80211_REASON_NEED_ASSOC		7
+#define IEEE80211_REASON_LEAVING_TO_ROAM	8
+#define IEEE80211_REASON_REASSOC_INVALID	9
+#define IEEE80211_REASON_BAD_POWER		10
+#define IEEE80211_REASON_BAD_CHANNELS		11
+#define IEEE80211_REASON_INVALID_IE		13
+#define IEEE80211_REASON_MIC_FAILURE		14
+#define IEEE80211_REASON_4WAY_TIMEOUT		15
+#define IEEE80211_REASON_GROUPKEY_TIMEOUT	16
+#define IEEE80211_REASON_4WAY_INVALID		17
+#define IEEE80211_REASON_GROUP_CIPHER_INVALID	18
+#define IEEE80211_REASON_PAIR_CIPHER_INVALID	19
+#define IEEE80211_REASON_AKMP_INVALID		20
+#define IEEE80211_REASON_RSN_VERSION_INVALID	21
+#define IEEE80211_REASON_RSN_CAPAB_INVALID	22
+#define IEEE80211_REASON_8021X_FAILURE		23
+#define IEEE80211_REASON_CIPHER_REJECTED	24
+#define IEEE80211_REASON_QOS_UNSPECIFIED	32
+#define IEEE80211_REASON_QOS_OUT_OF_RESOURCES	33
+#define IEEE80211_REASON_LINK_IS_HORRIBLE	34
+#define IEEE80211_REASON_INVALID_TXOP		35
+#define IEEE80211_REASON_REQUESTED_LEAVING	36
+#define IEEE80211_REASON_REQUESTED_NO_USE	37
+#define IEEE80211_REASON_REQUESTED_NEED_SETUP	38
+#define IEEE80211_REASON_REQUESTED_TIMEOUT	39
+#define IEEE80211_REASON_CIPHER_UNSUPPORTED	45
+
+/** @} */
+
+/* ---------- Information element declarations ---------- */
+
+/**
+ * @defgroup ieee80211_ie 802.11 information elements
+ *
+ * Many management frames include a section that amounts to a
+ * concatenation of these information elements, so that the sender can
+ * choose which information to send and the receiver can ignore the
+ * parts it doesn't understand. Each IE contains a two-byte header,
+ * one byte ID and one byte length, followed by IE-specific data. The
+ * length does not include the two-byte header. Information elements
+ * are required to be sorted by ID, but iPXE does not require that in
+ * those it receives.
+ *
+ * This group also includes a few inline functions to simplify common
+ * tasks in IE processing.
+ *
+ * @{
+ */
+
+/** Generic 802.11 information element header */
+struct ieee80211_ie_header {
+	u8 id;			/**< Information element ID */
+	u8 len;			/**< Information element length */
+} __attribute__ ((packed));
+
+
+/** 802.11 SSID information element */
+struct ieee80211_ie_ssid {
+	u8 id;			/**< SSID ID: 0 */
+	u8 len;			/**< SSID length */
+	char ssid[0];		/**< SSID data, not NUL-terminated */
+} __attribute__ ((packed));
+
+/** Information element ID for SSID information element */
+#define IEEE80211_IE_SSID	0
+
+
+/** 802.11 rates information element
+ *
+ * The first 8 rates go in an IE of type RATES (1), and any more rates
+ * go in one of type EXT_RATES (50). Each rate is a byte with the low
+ * 7 bits equal to the rate in units of 500 kbps, and the high bit set
+ * if and only if the rate is "basic" (must be supported by all
+ * connected stations).
+ */
+struct ieee80211_ie_rates {
+	u8 id;			/**< Rates ID: 1 or 50 */
+	u8 len;			/**< Number of rates */
+	u8 rates[0];		/**< Rates data, one rate per byte */
+} __attribute__ ((packed));
+
+/** Information element ID for rates information element */
+#define IEEE80211_IE_RATES	1
+
+/** Information element ID for extended rates information element */
+#define IEEE80211_IE_EXT_RATES	50
+
+
+/** 802.11 Direct Spectrum parameter information element
+ *
+ * This just contains the channel number. It has the fancy name
+ * because IEEE 802.11 also defines a frequency-hopping PHY that
+ * changes channels at regular intervals following a predetermined
+ * pattern; in practice nobody uses the FH PHY.
+ */
+struct ieee80211_ie_ds_param {
+	u8 id;			/**< DS parameter ID: 3 */
+	u8 len;			/**< DS parameter length: 1 */
+	u8 current_channel;	/**< Current channel number, 1-14 */
+} __attribute__ ((packed));
+
+/** Information element ID for Direct Spectrum parameter information element */
+#define IEEE80211_IE_DS_PARAM	3
+
+
+/** 802.11 Country information element regulatory extension triplet */
+struct ieee80211_ie_country_ext_triplet {
+	u8 reg_ext_id;		/**< Regulatory extension ID */
+	u8 reg_class_id;	/**< Regulatory class ID */
+	u8 coverage_class;	/**< Coverage class */
+} __attribute__ ((packed));
+
+/** 802.11 Country information element regulatory band triplet */
+struct ieee80211_ie_country_band_triplet {
+	u8 first_channel;	/**< Channel number for first channel in band */
+	u8 nr_channels;		/**< Number of contiguous channels in band */
+	u8 max_txpower;		/**< Maximum TX power in dBm */
+} __attribute__ ((packed));
+
+/** 802.11 Country information element regulatory triplet
+ *
+ * It is a band triplet if the first byte is 200 or less, and a
+ * regulatory extension triplet otherwise.
+ */
+union ieee80211_ie_country_triplet {
+	/** Differentiator between band and ext triplets */
+	u8 first;
+
+	/** Information about a band of channels */
+	struct ieee80211_ie_country_band_triplet band;
+
+	/** Regulatory extension information */
+	struct ieee80211_ie_country_ext_triplet ext;
+};
+
+/** 802.11 Country information element
+ *
+ * This contains some data about RF regulations.
+ */
+struct ieee80211_ie_country {
+	u8 id;			/**< Country information ID: 7 */
+	u8 len;			/**< Country information length: varies */
+	char name[2];		/**< ISO Alpha2 country code */
+	char in_out;		/**< 'I' for indoor, 'O' for outdoor */
+
+	/** List of regulatory triplets */
+	union ieee80211_ie_country_triplet triplet[0];
+} __attribute__ ((packed));
+
+/** Information element ID for Country information element */
+#define IEEE80211_IE_COUNTRY	7
+
+
+/** 802.11 Request information element
+ *
+ * This contains a list of information element types we would like to
+ * be included in probe response frames.
+ */
+struct ieee80211_ie_request {
+	u8 id;			/**< Request ID: 10 */
+	u8 len;			/**< Number of IEs requested */
+	u8 request[0];		/**< List of IEs requested */
+} __attribute__ ((packed));
+
+/** Information element ID for Request information element */
+#define IEEE80211_IE_REQUEST	10
+
+
+/** 802.11 Challenge Text information element
+ *
+ * This is used in authentication frames under Shared Key
+ * authentication.
+ */
+struct ieee80211_ie_challenge_text {
+	u8 id;			/**< Challenge Text ID: 16 */
+	u8 len;			/**< Challenge Text length: usually 128 */
+	u8 challenge_text[0];	/**< Challenge Text data */
+} __attribute__ ((packed));
+
+/** Information element ID for Challenge Text information element */
+#define IEEE80211_IE_CHALLENGE_TEXT	16
+
+
+/** 802.11 Power Constraint information element
+ *
+ * This is used to specify an additional power limitation on top of
+ * the Country requirements.
+ */
+struct ieee80211_ie_power_constraint {
+	u8 id;			/**< Power Constraint ID: 52 */
+	u8 len;			/**< Power Constraint length: 1 */
+	u8 power_constraint;	/**< Decrease in allowed TX power, dBm */
+} __attribute__ ((packed));
+
+/** Information element ID for Power Constraint information element */
+#define IEEE80211_IE_POWER_CONSTRAINT	52
+
+
+/** 802.11 Power Capability information element
+ *
+ * This is used in association request frames to indicate the extremes
+ * of our TX power abilities. It is required only if we indicate
+ * support for spectrum management.
+ */
+struct ieee80211_ie_power_capab {
+	u8 id;			/**< Power Capability ID: 33 */
+	u8 len;			/**< Power Capability length: 2 */
+	u8 min_txpower;		/**< Minimum possible TX power, dBm */
+	u8 max_txpower;		/**< Maximum possible TX power, dBm */
+} __attribute__ ((packed));
+
+/** Information element ID for Power Capability information element */
+#define IEEE80211_IE_POWER_CAPAB	33
+
+
+/** 802.11 Channels information element channel band tuple */
+struct ieee80211_ie_channels_channel_band {
+	u8 first_channel;	/**< Channel number of first channel in band */
+	u8 nr_channels;		/**< Number of channels in band */
+} __attribute__ ((packed));
+
+/** 802.11 Channels information element
+ *
+ * This is used in association frames to indicate the channels we can
+ * use. It is required only if we indicate support for spectrum
+ * management.
+ */
+struct ieee80211_ie_channels {
+	u8 id;			/**< Channels ID: 36 */
+	u8 len;			/**< Channels length: 2 */
+
+	/** List of (start, length) channel bands we can use */
+	struct ieee80211_ie_channels_channel_band channels[0];
+} __attribute__ ((packed));
+
+/** Information element ID for Channels information element */
+#define IEEE80211_IE_CHANNELS	36
+
+
+/** 802.11 ERP Information information element
+ *
+ * This is used to communicate some PHY-level flags.
+ */
+struct ieee80211_ie_erp_info {
+	u8 id;			/**< ERP Information ID: 42 */
+	u8 len;			/**< ERP Information length: 1 */
+	u8 erp_info;		/**< ERP flags */
+} __attribute__ ((packed));
+
+/** Information element ID for ERP Information information element */
+#define IEEE80211_IE_ERP_INFO	42
+
+/** ERP information element: Flag set if 802.11b stations are present */
+#define  IEEE80211_ERP_NONERP_PRESENT	0x01
+
+/** ERP information element: Flag set if CTS protection must be used */
+#define  IEEE80211_ERP_USE_PROTECTION	0x02
+
+/** ERP information element: Flag set if long preambles must be used */
+#define  IEEE80211_ERP_BARKER_LONG	0x04
+
+
+/** 802.11 Robust Security Network ("WPA") information element
+ *
+ * Showing once again a striking clarity of design, the IEEE folks put
+ * dynamically-sized data in the middle of this structure. As such,
+ * the below structure definition only works for IEs we create
+ * ourselves, which always have one pairwise cipher and one AKM;
+ * received IEs should be parsed piecemeal.
+ *
+ * Also inspired was IEEE's choice of 16-bit fields to count the
+ * number of 4-byte elements in a structure with a maximum length of
+ * 255 bytes.
+ *
+ * Many fields reference a cipher or authentication-type ID; this is a
+ * three-byte OUI followed by one byte identifying the cipher with
+ * respect to that OUI. For all standard ciphers the OUI is 00:0F:AC,
+ * except in old-style WPA IEs encapsulated in vendor-specific IEs,
+ * where it's 00:50:F2.
+ */
+struct ieee80211_ie_rsn {
+	/** Information element ID */
+	u8 id;
+
+	/** Information element length */
+	u8 len;
+
+	/** RSN information element version */
+	u16 version;
+
+	/** Cipher ID for the cipher used in multicast/broadcast frames */
+	u32 group_cipher;
+
+	/** Number of unicast ciphers supported */
+	u16 pairwise_count;
+
+	/** List of cipher IDs for supported unicast frame ciphers */
+	u32 pairwise_cipher[1];
+
+	/** Number of authentication types supported */
+	u16 akm_count;
+
+	/** List of authentication type IDs for supported types */
+	u32 akm_list[1];
+
+	/** Security capabilities field (RSN only) */
+	u16 rsn_capab;
+
+	/** Number of PMKIDs included (present only in association frames) */
+	u16 pmkid_count;
+
+	/** List of PMKIDs included, each a 16-byte SHA1 hash */
+	u8 pmkid_list[0];
+} __attribute__((packed));
+
+/** Information element ID for Robust Security Network information element */
+#define IEEE80211_IE_RSN	48
+
+/** Calculate necessary size of RSN information element
+ *
+ * @v npair	Number of pairwise ciphers supported
+ * @v nauth	Number of authentication types supported
+ * @v npmkid	Number of PMKIDs to include
+ * @v is_rsn	If TRUE, calculate RSN IE size; if FALSE, calculate WPA IE size
+ * @ret size	Necessary size of IE, including header bytes
+ */
+static inline size_t ieee80211_rsn_size ( int npair, int nauth, int npmkid,
+					  int rsn_ie ) {
+	return 16 + 4 * ( npair + nauth ) + 16 * npmkid - 4 * ! rsn_ie;
+}
+
+/** Make OUI plus type byte into 32-bit integer for easy comparison */
+#if __BYTE_ORDER == __BIG_ENDIAN
+#define _MKOUI( a, b, c, t )	\
+		( ( ( a ) << 24 ) | ( ( b ) << 16 ) | ( ( c ) << 8 ) | ( d ) )
+#define  OUI_ORG_MASK		0xFFFFFF00
+#define  OUI_TYPE_MASK		0x000000FF
+#else
+#define _MKOUI( a, b, c, t )	\
+		( ( ( t ) << 24 ) | ( ( c ) << 16 ) | ( ( b ) << 8 ) | ( a ) )
+#define  OUI_ORG_MASK		0x00FFFFFF
+#define  OUI_TYPE_MASK		0xFF000000
+#endif
+
+/** Organization part for OUIs in standard RSN IE */
+#define  IEEE80211_RSN_OUI	_MKOUI ( 0x00, 0x0F, 0xAC, 0 )
+
+/** Organization part for OUIs in old WPA IE */
+#define  IEEE80211_WPA_OUI	_MKOUI ( 0x00, 0x50, 0xF2, 0 )
+
+/** Old vendor-type WPA IE OUI type + subtype */
+#define  IEEE80211_WPA_OUI_VEN	_MKOUI ( 0x00, 0x50, 0xF2, 0x01 )
+
+
+/** 802.11 RSN IE: expected version number */
+#define  IEEE80211_RSN_VERSION		1
+
+/** 802.11 RSN IE: cipher type for 40-bit WEP */
+#define  IEEE80211_RSN_CTYPE_WEP40	_MKOUI ( 0, 0, 0, 0x01 )
+
+/** 802.11 RSN IE: cipher type for 104-bit WEP */
+#define  IEEE80211_RSN_CTYPE_WEP104	_MKOUI ( 0, 0, 0, 0x05 )
+
+/** 802.11 RSN IE: cipher type for TKIP ("WPA") */
+#define  IEEE80211_RSN_CTYPE_TKIP	_MKOUI ( 0, 0, 0, 0x02 )
+
+/** 802.11 RSN IE: cipher type for CCMP ("WPA2") */
+#define  IEEE80211_RSN_CTYPE_CCMP	_MKOUI ( 0, 0, 0, 0x04 )
+
+/** 802.11 RSN IE: cipher type for "use group"
+ *
+ * This can only appear as a pairwise cipher, and means unicast frames
+ * should be encrypted in the same way as broadcast/multicast frames.
+ */
+#define  IEEE80211_RSN_CTYPE_USEGROUP	_MKOUI ( 0, 0, 0, 0x00 )
+
+/** 802.11 RSN IE: auth method type for using an 802.1X server */
+#define  IEEE80211_RSN_ATYPE_8021X	_MKOUI ( 0, 0, 0, 0x01 )
+
+/** 802.11 RSN IE: auth method type for using a pre-shared key */
+#define  IEEE80211_RSN_ATYPE_PSK	_MKOUI ( 0, 0, 0, 0x02 )
+
+/** 802.11 RSN IE capabilities: AP supports pre-authentication */
+#define  IEEE80211_RSN_CAPAB_PREAUTH	0x001
+
+/** 802.11 RSN IE capabilities: Node has conflict between TKIP and WEP
+ *
+ * This is a legacy issue; APs always set it to 0, and iPXE sets it to
+ * 0.
+ */
+#define  IEEE80211_RSN_CAPAB_NO_PAIRWISE 0x002
+
+/** 802.11 RSN IE capabilities: Number of PTKSA replay counters
+ *
+ * A value of 0 means one replay counter, 1 means two, 2 means four,
+ * and 3 means sixteen.
+ */
+#define  IEEE80211_RSN_CAPAB_PTKSA_REPLAY 0x00C
+
+/** 802.11 RSN IE capabilities: Number of GTKSA replay counters
+ *
+ * A value of 0 means one replay counter, 1 means two, 2 means four,
+ * and 3 means sixteen.
+ */
+#define  IEEE80211_RSN_CAPAB_GTKSA_REPLAY 0x030
+
+/** 802.11 RSN IE capabilities: PeerKey Handshaking is suported */
+#define  IEEE80211_RSN_CAPAB_PEERKEY	0x200
+
+
+/** 802.11 RSN IE capabilities: One replay counter
+ *
+ * This should be AND'ed with @c IEEE80211_RSN_CAPAB_PTKSA_REPLAY or
+ * @c IEEE80211_RSN_CAPAB_GTKSA_REPLAY (or both) to produce a value
+ * which can be OR'ed into the capabilities field.
+ */
+#define IEEE80211_RSN_1_CTR		0x000
+
+/** 802.11 RSN IE capabilities: Two replay counters */
+#define IEEE80211_RSN_2_CTR		0x014
+
+/** 802.11 RSN IE capabilities: Four replay counters */
+#define IEEE80211_RSN_4_CTR		0x028
+
+/** 802.11 RSN IE capabilities: 16 replay counters */
+#define IEEE80211_RSN_16_CTR		0x03C
+
+
+/** 802.11 Vendor Specific information element
+ *
+ * One often sees the RSN IE masquerading as vendor-specific on
+ * devices that were produced prior to 802.11i (the WPA amendment)
+ * being finalized.
+ */
+struct ieee80211_ie_vendor {
+	u8 id;			/**< Vendor-specific ID: 221 */
+	u8 len;			/**< Vendor-specific length: variable */
+	u32 oui;		/**< OUI and vendor-specific type byte */
+	u8 data[0];		/**< Vendor-specific data */
+} __attribute__ ((packed));
+
+/** Information element ID for Vendor Specific information element */
+#define IEEE80211_IE_VENDOR	221
+
+
+
+
+/** Any 802.11 information element
+ *
+ * This is formatted for ease of use, so IEs with complex structures
+ * get referenced in full, while those with only one byte of data or a
+ * simple array are pulled in to avoid a layer of indirection like
+ * ie->channels.channels[0].
+ */
+union ieee80211_ie
+{
+	/** Generic and simple information element info */
+	struct {
+		u8 id;		/**< Information element ID */
+		u8 len;		/**< Information element data length */
+		union {
+			char ssid[0];	/**< SSID text */
+			u8 rates[0];	/**< Rates data */
+			u8 request[0];	/**< Request list */
+			u8 challenge_text[0]; /**< Challenge text data */
+			u8 power_constraint; /**< Power constraint, dBm */
+			u8 erp_info;	/**< ERP information flags */
+			/** List of channels */
+			struct ieee80211_ie_channels_channel_band channels[0];
+		};
+	};
+
+	/** DS parameter set */
+	struct ieee80211_ie_ds_param ds_param;
+
+	/** Country information */
+	struct ieee80211_ie_country country;
+
+	/** Power capability */
+	struct ieee80211_ie_power_capab power_capab;
+
+	/** Security information */
+	struct ieee80211_ie_rsn rsn;
+
+	/** Vendor-specific */
+	struct ieee80211_ie_vendor vendor;
+};
+
+/** Check that 802.11 information element is bounded by buffer
+ *
+ * @v ie	Information element
+ * @v end	End of buffer in which information element is stored
+ * @ret ok	TRUE if the IE is completely contained within the buffer
+ */
+static inline int ieee80211_ie_bound ( union ieee80211_ie *ie, void *end )
+{
+	void *iep = ie;
+	return ( iep + 2 <= end && iep + 2 + ie->len <= end );
+}
+
+/** Advance to next 802.11 information element
+ *
+ * @v ie	Current information element pointer
+ * @v end	Pointer to first byte not in information element space
+ * @ret next	Pointer to next information element, or NULL if no more
+ *
+ * When processing received IEs, @a end should be set to the I/O
+ * buffer tail pointer; when marshalling IEs for sending, @a end
+ * should be NULL.
+ */
+static inline union ieee80211_ie * ieee80211_next_ie ( union ieee80211_ie *ie,
+						       void *end )
+{
+	void *next_ie_byte = ( void * ) ie + ie->len + 2;
+	union ieee80211_ie *next_ie = next_ie_byte;
+
+	if ( ! end )
+		return next_ie;
+
+	if ( ieee80211_ie_bound ( next_ie, end ) )
+		return next_ie;
+
+	return NULL;
+}
+
+/** @} */
+
+
+/* ---------- Management frame data formats ---------- */
+
+/**
+ * @defgroup ieee80211_mgmt_data Management frame data payloads
+ * @{
+ */
+
+/** Beacon or probe response frame data */
+struct ieee80211_beacon_or_probe_resp
+{
+	/** 802.11 TSFT value at frame send */
+	u64 timestamp;
+
+	/** Interval at which beacons are sent, in units of 1024 us */
+	u16 beacon_interval;
+
+	/** Capability flags */
+	u16 capability;
+
+	/** List of information elements */
+	union ieee80211_ie info_element[0];
+} __attribute__((packed));
+
+#define ieee80211_beacon	ieee80211_beacon_or_probe_resp
+#define ieee80211_probe_resp	ieee80211_beacon_or_probe_resp
+
+/** Disassociation or deauthentication frame data */
+struct ieee80211_disassoc_or_deauth
+{
+	/** Reason code */
+	u16 reason;
+} __attribute__((packed));
+
+#define ieee80211_disassoc	ieee80211_disassoc_or_deauth
+#define ieee80211_deauth	ieee80211_disassoc_or_deauth
+
+/** Association request frame data */
+struct ieee80211_assoc_req
+{
+	/** Capability flags */
+	u16 capability;
+
+	/** Interval at which we wake up, in units of the beacon interval */
+	u16 listen_interval;
+
+	/** List of information elements */
+	union ieee80211_ie info_element[0];
+} __attribute__((packed));
+
+/** Association or reassociation response frame data */
+struct ieee80211_assoc_or_reassoc_resp
+{
+	/** Capability flags */
+	u16 capability;
+
+	/** Status code */
+	u16 status;
+
+	/** Association ID */
+	u16 aid;
+
+	/** List of information elements */
+	union ieee80211_ie info_element[0];
+} __attribute__((packed));
+
+#define ieee80211_assoc_resp	ieee80211_assoc_or_reassoc_resp
+#define ieee80211_reassoc_resp	ieee80211_assoc_or_reassoc_resp
+
+/** Reassociation request frame data */
+struct ieee80211_reassoc_req
+{
+	/** Capability flags */
+	u16 capability;
+
+	/** Interval at which we wake up, in units of the beacon interval */
+	u16 listen_interval;
+
+	/** MAC address of current Access Point */
+	u8 current_addr[ETH_ALEN];
+
+	/** List of information elements */
+	union ieee80211_ie info_element[0];
+} __attribute__((packed));
+
+/** Probe request frame data */
+struct ieee80211_probe_req
+{
+	/** List of information elements */
+	union ieee80211_ie info_element[0];
+} __attribute__((packed));
+
+/** Authentication frame data */
+struct ieee80211_auth
+{
+	/** Authentication algorithm (Open System or Shared Key) */
+	u16 algorithm;
+
+	/** Sequence number of this frame; first from client to AP is 1 */
+	u16 tx_seq;
+
+	/** Status code */
+	u16 status;
+
+	/** List of information elements */
+	union ieee80211_ie info_element[0];
+} __attribute__((packed));
+
+/** Open System authentication algorithm */
+#define IEEE80211_AUTH_OPEN_SYSTEM  0
+
+/** Shared Key authentication algorithm */
+#define IEEE80211_AUTH_SHARED_KEY   1
+
+/** @} */
+
+#endif
diff --git a/src/include/ipxe/if_arp.h b/src/include/ipxe/if_arp.h
new file mode 100644
index 0000000..fd36e9c
--- /dev/null
+++ b/src/include/ipxe/if_arp.h
@@ -0,0 +1,102 @@
+#ifndef	_IPXE_IF_ARP_H
+#define	_IPXE_IF_ARP_H
+
+/** @file
+ *
+ * Address Resolution Protocol constants and types
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/* ARP protocol HARDWARE identifiers. */
+#define ARPHRD_NETROM	0		/**< from KA9Q: NET/ROM pseudo	*/
+#define ARPHRD_ETHER 	1		/**< Ethernet 10Mbps		*/
+#define	ARPHRD_EETHER	2		/**< Experimental Ethernet	*/
+#define	ARPHRD_AX25	3		/**< AX.25 Level 2		*/
+#define	ARPHRD_PRONET	4		/**< PROnet token ring		*/
+#define	ARPHRD_CHAOS	5		/**< Chaosnet			*/
+#define	ARPHRD_IEEE802	6		/**< IEEE 802.2 Ethernet/TR/TB	*/
+#define	ARPHRD_ARCNET	7		/**< ARCnet			*/
+#define	ARPHRD_APPLETLK	8		/**< APPLEtalk			*/
+#define ARPHRD_DLCI	15		/**< Frame Relay DLCI		*/
+#define ARPHRD_ATM	19		/**< ATM 			*/
+#define ARPHRD_METRICOM	23		/**< Metricom STRIP (new IANA id) */
+#define	ARPHRD_IEEE1394	24		/**< IEEE 1394 IPv4 - RFC 2734	*/
+#define ARPHRD_EUI64	27		/**< EUI-64			*/
+#define ARPHRD_INFINIBAND 32		/**< InfiniBand			*/
+
+/* ARP protocol opcodes. */
+#define	ARPOP_REQUEST	1		/**< ARP request		*/
+#define	ARPOP_REPLY	2		/**< ARP reply			*/
+#define	ARPOP_RREQUEST	3		/**< RARP request		*/
+#define	ARPOP_RREPLY	4		/**< RARP reply			*/
+#define	ARPOP_InREQUEST	8		/**< InARP request		*/
+#define	ARPOP_InREPLY	9		/**< InARP reply		*/
+#define	ARPOP_NAK	10		/**< (ATM)ARP NAK		*/
+
+/**
+ * An ARP header
+ *
+ * This contains only the fixed-size portions of an ARP header; for
+ * other fields use the arp_{sender,target}_{ha,pa} family of
+ * functions.
+ */
+struct arphdr {
+	/** Link-layer protocol
+	 *
+	 * This is an ARPHRD_XXX constant
+	 */
+	uint16_t ar_hrd;
+	/** Network-layer protocol
+	 *
+	 * This is, for Ethernet, an ETH_P_XXX constant.
+	 */
+	uint16_t ar_pro;
+	/** Link-layer address length */
+	uint8_t ar_hln;
+	/** Network-layer address length */
+	uint8_t ar_pln;
+	/** ARP opcode */
+	uint16_t ar_op;
+} __attribute__ (( packed ));
+
+/** ARP packet sender hardware address
+ *
+ * @v arphdr	ARP header
+ * @ret ar_sha	Sender hardware address
+ */
+static inline void * arp_sender_ha ( struct arphdr *arphdr ) {
+	return ( ( ( void * ) arphdr ) + sizeof ( *arphdr ) );
+}
+
+/** ARP packet sender protocol address
+ *
+ * @v arphdr	ARP header
+ * @ret ar_spa	Sender protocol address
+ */
+static inline void * arp_sender_pa ( struct arphdr *arphdr ) {
+	return ( arp_sender_ha ( arphdr ) + arphdr->ar_hln );
+}
+
+/** ARP packet target hardware address
+ *
+ * @v arphdr	ARP header
+ * @ret ar_tha	Target hardware address
+ */
+static inline void * arp_target_ha ( struct arphdr *arphdr ) {
+	return ( arp_sender_pa ( arphdr ) + arphdr->ar_pln );
+}
+
+/** ARP packet target protocol address
+ *
+ * @v arphdr	ARP header
+ * @ret ar_tpa	Target protocol address
+ */
+static inline void * arp_target_pa ( struct arphdr *arphdr ) {
+	return ( arp_target_ha ( arphdr ) + arphdr->ar_hln );
+}
+
+#endif	/* _IPXE_IF_ARP_H */
diff --git a/src/include/ipxe/if_ether.h b/src/include/ipxe/if_ether.h
new file mode 100644
index 0000000..a526241
--- /dev/null
+++ b/src/include/ipxe/if_ether.h
@@ -0,0 +1,36 @@
+#ifndef	_IPXE_IF_ETHER_H
+#define	_IPXE_IF_ETHER_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+#define ETH_ALEN		6	/* Size of Ethernet address */
+#define ETH_HLEN		14	/* Size of ethernet header */
+#define	ETH_ZLEN		60	/* Minimum packet */
+#define	ETH_FRAME_LEN		1514	/* Maximum packet */
+#define ETH_DATA_ALIGN		2	/* Amount needed to align the data after an ethernet header */
+#ifndef	ETH_MAX_MTU
+#define	ETH_MAX_MTU		(ETH_FRAME_LEN-ETH_HLEN)
+#endif
+
+#define ETH_P_RAW	0x0000	/* Raw packet */
+#define ETH_P_IP	0x0800	/* Internet Protocl Packet */
+#define ETH_P_ARP	0x0806	/* Address Resolution Protocol */
+#define ETH_P_RARP	0x8035	/* Reverse Address resolution Protocol */
+#define ETH_P_IPV6	0x86DD	/* IPv6 over blueblook */
+#define ETH_P_SLOW	0x8809	/* Ethernet slow protocols */
+#define ETH_P_EAPOL	0x888E	/* 802.1X EAP over LANs */
+#define ETH_P_AOE	0x88A2	/* ATA over Ethernet */
+
+/** An Ethernet link-layer header */
+struct ethhdr {
+	/** Destination MAC address */
+        uint8_t h_dest[ETH_ALEN];
+	/** Source MAC address */
+        uint8_t h_source[ETH_ALEN];
+	/** Protocol ID */
+        uint16_t h_protocol;
+} __attribute__ ((packed));
+
+#endif	/* _IPXE_IF_ETHER_H */
diff --git a/src/include/ipxe/image.h b/src/include/ipxe/image.h
new file mode 100644
index 0000000..abe4a61
--- /dev/null
+++ b/src/include/ipxe/image.h
@@ -0,0 +1,194 @@
+#ifndef _IPXE_IMAGE_H
+#define _IPXE_IMAGE_H
+
+/**
+ * @file
+ *
+ * Executable/loadable images
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tables.h>
+#include <ipxe/list.h>
+#include <ipxe/uaccess.h>
+#include <ipxe/refcnt.h>
+
+struct uri;
+struct image_type;
+
+/** An executable or loadable image */
+struct image {
+	/** Reference count */
+	struct refcnt refcnt;
+
+	/** List of registered images */
+	struct list_head list;
+
+	/** URI of image */
+	struct uri *uri;
+	/** Name */
+	char name[16];
+	/** Flags */
+	unsigned int flags;
+
+	/** Command line to pass to image */
+	char *cmdline;
+	/** Raw file image */
+	userptr_t data;
+	/** Length of raw file image */
+	size_t len;
+
+	/** Image type, if known */
+	struct image_type *type;
+	/** Image type private data */
+	union {
+		physaddr_t phys;
+		userptr_t user;
+		unsigned long ul;
+	} priv;
+
+	/** Replacement image
+	 *
+	 * An image wishing to replace itself with another image (in a
+	 * style similar to a Unix exec() call) should return from its
+	 * exec() method with the replacement image set to point to
+	 * the new image.  The new image must already be in a suitable
+	 * state for execution (i.e. loaded).
+	 *
+	 * If an image unregisters itself as a result of being
+	 * executed, it must make sure that its replacement image (if
+	 * any) is registered, otherwise the replacement is likely to
+	 * be freed before it can be executed.
+	 */
+	struct image *replacement;
+};
+
+/** Image is loaded */
+#define IMAGE_LOADED 0x0001
+
+/** An executable or loadable image type */
+struct image_type {
+	/** Name of this image type */
+	char *name;
+	/**
+	 * Load image into memory
+	 *
+	 * @v image		Executable/loadable image
+	 * @ret rc		Return status code
+	 *
+	 * Load the image into memory at the correct location as
+	 * determined by the file format.
+	 *
+	 * If the file image is in the correct format, the method must
+	 * update @c image->type to point to its own type (unless @c
+	 * image->type is already set).  This allows the autoloading
+	 * code to disambiguate between "this is not my image format"
+	 * and "there is something wrong with this image".  In
+	 * particular, setting @c image->type and then returning an
+	 * error will cause image_autoload() to abort and return an
+	 * error, rather than continuing to the next image type.
+	 */
+	int ( * load ) ( struct image *image );
+	/**
+	 * Execute loaded image
+	 *
+	 * @v image		Loaded image
+	 * @ret rc		Return status code
+	 *
+	 * Note that the image may be invalidated by the act of
+	 * execution, i.e. an image is allowed to choose to unregister
+	 * (and so potentially free) itself.
+	 */
+	int ( * exec ) ( struct image *image );
+};
+
+/**
+ * Multiboot image probe priority
+ *
+ * Multiboot images are also valid executables in another format
+ * (e.g. ELF), so we must perform the multiboot probe first.
+ */
+#define PROBE_MULTIBOOT	01
+
+/**
+ * Normal image probe priority
+ */
+#define PROBE_NORMAL 02
+
+/**
+ * PXE image probe priority
+ *
+ * PXE images have no signature checks, so will claim all image files.
+ * They must therefore be tried last in the probe order list.
+ */
+#define PROBE_PXE 03
+
+/** Executable or loadable image type table */
+#define IMAGE_TYPES __table ( struct image_type, "image_types" )
+
+/** An executable or loadable image type */
+#define __image_type( probe_order ) __table_entry ( IMAGE_TYPES, probe_order )
+
+extern struct list_head images;
+
+/** Iterate over all registered images */
+#define for_each_image( image ) \
+	list_for_each_entry ( (image), &images, list )
+
+/**
+ * Test for existence of images
+ *
+ * @ret existence	Some images exist
+ */
+static inline int have_images ( void ) {
+	return ( ! list_empty ( &images ) );
+}
+
+extern struct image * alloc_image ( void );
+extern int image_set_uri ( struct image *image, struct uri *uri );
+extern int image_set_cmdline ( struct image *image, const char *cmdline );
+extern int register_image ( struct image *image );
+extern void unregister_image ( struct image *image );
+extern void promote_image ( struct image *image );
+struct image * find_image ( const char *name );
+extern int image_load ( struct image *image );
+extern int image_autoload ( struct image *image );
+extern int image_exec ( struct image *image );
+extern int register_and_autoload_image ( struct image *image );
+extern int register_and_autoexec_image ( struct image *image );
+
+/**
+ * Increment reference count on an image
+ *
+ * @v image		Image
+ * @ret image		Image
+ */
+static inline struct image * image_get ( struct image *image ) {
+	ref_get ( &image->refcnt );
+	return image;
+}
+
+/**
+ * Decrement reference count on an image
+ *
+ * @v image		Image
+ */
+static inline void image_put ( struct image *image ) {
+	ref_put ( &image->refcnt );
+}
+
+/**
+ * Set image name
+ *
+ * @v image		Image
+ * @v name		New image name
+ * @ret rc		Return status code
+ */
+static inline int image_set_name ( struct image *image, const char *name ) {
+	strncpy ( image->name, name, ( sizeof ( image->name ) - 1 ) );
+	return 0;
+}
+
+#endif /* _IPXE_IMAGE_H */
diff --git a/src/include/ipxe/in.h b/src/include/ipxe/in.h
new file mode 100644
index 0000000..20f1ce2
--- /dev/null
+++ b/src/include/ipxe/in.h
@@ -0,0 +1,104 @@
+#ifndef	_IPXE_IN_H
+#define	_IPXE_IN_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/socket.h>
+
+/* Protocol numbers */
+
+#define IP_ICMP		1
+#define IP_TCP		6
+#define IP_UDP		17
+#define IP_ICMP6	58
+
+/* IP address constants */
+
+#define INADDR_NONE 0xffffffff
+
+#define INADDR_BROADCAST 0xffffffff
+
+#define	IN_CLASSA(addr)		( ( (addr) & 0x80000000 ) == 0x00000000 )
+#define	IN_CLASSA_NET		0xff000000
+#define	IN_CLASSB(addr)		( ( (addr) & 0xc0000000 ) == 0x80000000 )
+#define	IN_CLASSB_NET		0xffff0000
+#define	IN_CLASSC(addr)		( ( (addr) & 0xe0000000 ) == 0xc0000000 )
+#define	IN_CLASSC_NET		0xffffff00
+#define IN_MULTICAST(addr)	( ( (addr) & 0xf0000000 ) == 0xe0000000 )
+
+/**
+ * IP address structure
+ */
+struct in_addr {
+	uint32_t	s_addr;
+};
+
+typedef struct in_addr in_addr;
+
+/**
+ * IP6 address structure
+ */
+struct in6_addr {
+        union {
+                uint8_t u6_addr8[16];
+                uint16_t u6_addr16[8];
+                uint32_t u6_addr32[4];
+        } in6_u;
+#define s6_addr         in6_u.u6_addr8
+#define s6_addr16       in6_u.u6_addr16
+#define s6_addr32       in6_u.u6_addr32
+};
+
+/**
+ * IPv4 socket address
+ */
+struct sockaddr_in {
+	/** Socket address family (part of struct @c sockaddr)
+	 *
+	 * Always set to @c AF_INET for IPv4 addresses
+	 */
+	sa_family_t sin_family;
+	/** TCP/IP port (part of struct @c sockaddr_tcpip) */
+	uint16_t sin_port;
+	/** IPv4 address */
+	struct in_addr sin_addr;
+	/** Padding
+	 *
+	 * This ensures that a struct @c sockaddr_tcpip is large
+	 * enough to hold a socket address for any TCP/IP address
+	 * family.
+	 */
+	char pad[ sizeof ( struct sockaddr ) - sizeof ( sa_family_t )
+					     - sizeof ( uint16_t )
+					     - sizeof ( struct in_addr ) ];
+} __attribute__ (( may_alias ));
+
+/**
+ * IPv6 socket address
+ */
+struct sockaddr_in6 {
+	/** Socket address family (part of struct @c sockaddr)
+	 *
+	 * Always set to @c AF_INET6 for IPv6 addresses
+	 */
+	sa_family_t sin_family;
+	/** TCP/IP port (part of struct @c sockaddr_tcpip) */
+	uint16_t 	sin_port;
+        uint32_t        sin6_flowinfo;  /* Flow number */
+        struct in6_addr sin6_addr;      /* 128-bit destination address */
+        uint32_t        sin6_scope_id;  /* Scope ID */
+} __attribute__ (( may_alias ));
+
+extern int inet_aton ( const char *cp, struct in_addr *inp );
+extern char * inet_ntoa ( struct in_addr in );
+
+/* Adding the following for IP6 support
+ *
+
+extern int inet6_aton ( const char *cp, struct in6_addr *inp );
+extern char * inet6_ntoa ( struct in_addr in );
+
+ */
+
+#endif	/* _IPXE_IN_H */
diff --git a/src/include/ipxe/infiniband.h b/src/include/ipxe/infiniband.h
new file mode 100644
index 0000000..f2eb57c
--- /dev/null
+++ b/src/include/ipxe/infiniband.h
@@ -0,0 +1,659 @@
+#ifndef _IPXE_INFINIBAND_H
+#define _IPXE_INFINIBAND_H
+
+/** @file
+ *
+ * Infiniband protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/refcnt.h>
+#include <ipxe/device.h>
+#include <ipxe/ib_packet.h>
+#include <ipxe/ib_mad.h>
+
+/** Subnet management interface QPN */
+#define IB_QPN_SMI 0
+
+/** Subnet management interface queue key */
+#define IB_QKEY_SMI 0
+
+/** General service interface QPN */
+#define IB_QPN_GSI 1
+
+/** General service interface queue key */
+#define IB_QKEY_GSI 0x80010000UL
+
+/** Broadcast QPN */
+#define IB_QPN_BROADCAST 0xffffffUL
+
+/** QPN mask */
+#define IB_QPN_MASK 0xffffffUL
+
+/** Default Infiniband partition key */
+#define IB_PKEY_DEFAULT 0xffff
+
+/** Infiniband partition key full membership flag */
+#define IB_PKEY_FULL 0x8000
+
+/**
+ * Maximum payload size
+ *
+ * This is currently hard-coded in various places (drivers, subnet
+ * management agent, etc.) to 2048.
+ */
+#define IB_MAX_PAYLOAD_SIZE 2048
+
+struct ib_device;
+struct ib_queue_pair;
+struct ib_address_vector;
+struct ib_completion_queue;
+struct ib_mad_interface;
+
+/** Infiniband transmission rates */
+enum ib_rate {
+	IB_RATE_2_5 = 2,
+	IB_RATE_10 = 3,
+	IB_RATE_30 = 4,
+	IB_RATE_5 = 5,
+	IB_RATE_20 = 6,
+	IB_RATE_40 = 7,
+	IB_RATE_60 = 8,
+	IB_RATE_80 = 9,
+	IB_RATE_120 = 10,
+};
+
+/** An Infiniband Address Vector */
+struct ib_address_vector {
+	/** Queue Pair Number */
+	unsigned long qpn;
+	/** Queue key
+	 *
+	 * Not specified for received packets.
+	 */
+	unsigned long qkey;
+	/** Local ID */
+	unsigned int lid;
+	/** Rate
+	 *
+	 * Not specified for received packets.
+	 */
+	enum ib_rate rate;
+	/** Service level */
+	unsigned int sl;
+	/** GID is present */
+	unsigned int gid_present;
+	/** GID, if present */
+	struct ib_gid gid;
+};
+
+/** An Infiniband Work Queue */
+struct ib_work_queue {
+	/** Containing queue pair */
+	struct ib_queue_pair *qp;
+	/** "Is a send queue" flag */
+	int is_send;
+	/** Associated completion queue */
+	struct ib_completion_queue *cq;
+	/** List of work queues on this completion queue */
+	struct list_head list;
+	/** Packet sequence number */
+	uint32_t psn;
+	/** Number of work queue entries */
+	unsigned int num_wqes;
+	/** Number of occupied work queue entries */
+	unsigned int fill;
+	/** Next work queue entry index
+	 *
+	 * This is the index of the next entry to be filled (i.e. the
+	 * first empty entry).  This value is not bounded by num_wqes;
+	 * users must logical-AND with (num_wqes-1) to generate an
+	 * array index.
+	 */
+	unsigned long next_idx;
+	/** I/O buffers assigned to work queue */
+	struct io_buffer **iobufs;
+	/** Driver private data */
+	void *drv_priv;
+};
+
+/** An Infiniband multicast GID */
+struct ib_multicast_gid {
+	/** List of multicast GIDs on this QP */
+	struct list_head list;
+	/** Multicast GID */
+	struct ib_gid gid;
+};
+
+/** An Infiniband queue pair type */
+enum ib_queue_pair_type {
+	IB_QPT_SMI,
+	IB_QPT_GSI,
+	IB_QPT_UD,
+	IB_QPT_RC,
+};
+
+/** An Infiniband Queue Pair */
+struct ib_queue_pair {
+	/** Containing Infiniband device */
+	struct ib_device *ibdev;
+	/** List of queue pairs on this Infiniband device */
+	struct list_head list;
+	/** Queue pair number */
+	unsigned long qpn;
+	/** Externally-visible queue pair number
+	 *
+	 * This may differ from the real queue pair number (e.g. when
+	 * the HCA cannot use the management QPNs 0 and 1 as hardware
+	 * QPNs and needs to remap them).
+	 */
+	unsigned long ext_qpn;
+	/** Queue pair type */
+	enum ib_queue_pair_type type;
+	/** Queue key */
+	unsigned long qkey;
+	/** Send queue */
+	struct ib_work_queue send;
+	/** Receive queue */
+	struct ib_work_queue recv;
+	/** List of multicast GIDs */
+	struct list_head mgids;
+	/** Address vector */
+	struct ib_address_vector av;
+	/** Driver private data */
+	void *drv_priv;
+	/** Queue owner private data */
+	void *owner_priv;
+};
+
+/** Infiniband completion queue operations */
+struct ib_completion_queue_operations {
+	/**
+	 * Complete Send WQE
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v iobuf		I/O buffer
+	 * @v rc		Completion status code
+	 */
+	void ( * complete_send ) ( struct ib_device *ibdev,
+				   struct ib_queue_pair *qp,
+				   struct io_buffer *iobuf, int rc );
+	/**
+	 * Complete Receive WQE
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v av		Address vector, or NULL
+	 * @v iobuf		I/O buffer
+	 * @v rc		Completion status code
+	 */
+	void ( * complete_recv ) ( struct ib_device *ibdev,
+				   struct ib_queue_pair *qp,
+				   struct ib_address_vector *av,
+				   struct io_buffer *iobuf, int rc );
+};
+
+/** An Infiniband Completion Queue */
+struct ib_completion_queue {
+	/** Containing Infiniband device */
+	struct ib_device *ibdev;
+	/** List of completion queues on this Infiniband device */
+	struct list_head list;
+	/** Completion queue number */
+	unsigned long cqn;
+	/** Number of completion queue entries */
+	unsigned int num_cqes;
+	/** Next completion queue entry index
+	 *
+	 * This is the index of the next entry to be filled (i.e. the
+	 * first empty entry).  This value is not bounded by num_wqes;
+	 * users must logical-AND with (num_wqes-1) to generate an
+	 * array index.
+	 */
+	unsigned long next_idx;
+	/** List of work queues completing to this queue */
+	struct list_head work_queues;
+	/** Completion queue operations */
+	struct ib_completion_queue_operations *op;
+	/** Driver private data */
+	void *drv_priv;
+};
+
+/**
+ * Infiniband device operations
+ *
+ * These represent a subset of the Infiniband Verbs.
+ */
+struct ib_device_operations {
+	/** Create completion queue
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v cq		Completion queue
+	 * @ret rc		Return status code
+	 */
+	int ( * create_cq ) ( struct ib_device *ibdev,
+			      struct ib_completion_queue *cq );
+	/** Destroy completion queue
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v cq		Completion queue
+	 */
+	void ( * destroy_cq ) ( struct ib_device *ibdev,
+				struct ib_completion_queue *cq );
+	/** Create queue pair
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @ret rc		Return status code
+	 */
+	int ( * create_qp ) ( struct ib_device *ibdev,
+			      struct ib_queue_pair *qp );
+	/** Modify queue pair
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @ret rc		Return status code
+	 */
+	int ( * modify_qp ) ( struct ib_device *ibdev,
+			      struct ib_queue_pair *qp );
+	/** Destroy queue pair
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 */
+	void ( * destroy_qp ) ( struct ib_device *ibdev,
+				struct ib_queue_pair *qp );
+	/** Post send work queue entry
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v av		Address vector
+	 * @v iobuf		I/O buffer
+	 * @ret rc		Return status code
+	 *
+	 * If this method returns success, the I/O buffer remains
+	 * owned by the queue pair.  If this method returns failure,
+	 * the I/O buffer is immediately released; the failure is
+	 * interpreted as "failure to enqueue buffer".
+	 */
+	int ( * post_send ) ( struct ib_device *ibdev,
+			      struct ib_queue_pair *qp,
+			      struct ib_address_vector *av,
+			      struct io_buffer *iobuf );
+	/** Post receive work queue entry
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v iobuf		I/O buffer
+	 * @ret rc		Return status code
+	 *
+	 * If this method returns success, the I/O buffer remains
+	 * owned by the queue pair.  If this method returns failure,
+	 * the I/O buffer is immediately released; the failure is
+	 * interpreted as "failure to enqueue buffer".
+	 */
+	int ( * post_recv ) ( struct ib_device *ibdev,
+			      struct ib_queue_pair *qp,
+			      struct io_buffer *iobuf );
+	/** Poll completion queue
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v cq		Completion queue
+	 *
+	 * The relevant completion handler (specified at completion
+	 * queue creation time) takes ownership of the I/O buffer.
+	 */
+	void ( * poll_cq ) ( struct ib_device *ibdev,
+			     struct ib_completion_queue *cq );
+	/**
+	 * Poll event queue
+	 *
+	 * @v ibdev		Infiniband device
+	 */
+	void ( * poll_eq ) ( struct ib_device *ibdev );
+	/**
+	 * Open port
+	 *
+	 * @v ibdev		Infiniband device
+	 * @ret rc		Return status code
+	 */
+	int ( * open ) ( struct ib_device *ibdev );
+	/**
+	 * Close port
+	 *
+	 * @v ibdev		Infiniband device
+	 */
+	void ( * close ) ( struct ib_device *ibdev );
+	/** Attach to multicast group
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v gid		Multicast GID
+	 * @ret rc		Return status code
+	 */
+	int ( * mcast_attach ) ( struct ib_device *ibdev,
+				 struct ib_queue_pair *qp,
+				 struct ib_gid *gid );
+	/** Detach from multicast group
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v qp		Queue pair
+	 * @v gid		Multicast GID
+	 */
+	void ( * mcast_detach ) ( struct ib_device *ibdev,
+				  struct ib_queue_pair *qp,
+				  struct ib_gid *gid );
+	/** Set port information
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v mad		Set port information MAD
+	 *
+	 * This method is required only by adapters that do not have
+	 * an embedded SMA.
+	 */
+	int ( * set_port_info ) ( struct ib_device *ibdev, union ib_mad *mad );
+	/** Set partition key table
+	 *
+	 * @v ibdev		Infiniband device
+	 * @v mad		Set partition key table MAD
+	 *
+	 * This method is required only by adapters that do not have
+	 * an embedded SMA.
+	 */
+	int ( * set_pkey_table ) ( struct ib_device *ibdev,
+				   union ib_mad *mad );
+};
+
+/** An Infiniband device */
+struct ib_device {
+	/** Reference counter */
+	struct refcnt refcnt;
+	/** List of Infiniband devices */
+	struct list_head list;
+	/** List of open Infiniband devices */
+	struct list_head open_list;
+	/** Underlying device */
+	struct device *dev;
+	/** List of completion queues */
+	struct list_head cqs;
+	/** List of queue pairs */
+	struct list_head qps;
+	/** Infiniband operations */
+	struct ib_device_operations *op;
+	/** Port number */
+	unsigned int port;
+	/** Port open request counter */
+	unsigned int open_count;
+
+	/** Port state */
+	uint8_t port_state;
+	/** Link width supported */
+	uint8_t link_width_supported;
+	/** Link width enabled */
+	uint8_t link_width_enabled;
+	/** Link width active */
+	uint8_t link_width_active;
+	/** Link speed supported */
+	uint8_t link_speed_supported;
+	/** Link speed enabled */
+	uint8_t link_speed_enabled;
+	/** Link speed active */
+	uint8_t link_speed_active;
+	/** Port GID */
+	struct ib_gid gid;
+	/** Port LID */
+	uint16_t lid;
+	/** Subnet manager LID */
+	uint16_t sm_lid;
+	/** Subnet manager SL */
+	uint8_t sm_sl;
+	/** Partition key */
+	uint16_t pkey;
+
+	/** RDMA key
+	 *
+	 * This is a single key allowing unrestricted access to
+	 * memory.
+	 */
+	uint32_t rdma_key;
+
+	/** Subnet management interface */
+	struct ib_mad_interface *smi;
+	/** General services interface */
+	struct ib_mad_interface *gsi;
+
+	/** Driver private data */
+	void *drv_priv;
+	/** Owner private data */
+	void *owner_priv;
+};
+
+extern struct ib_completion_queue *
+ib_create_cq ( struct ib_device *ibdev, unsigned int num_cqes,
+	       struct ib_completion_queue_operations *op );
+extern void ib_destroy_cq ( struct ib_device *ibdev,
+			    struct ib_completion_queue *cq );
+extern void ib_poll_cq ( struct ib_device *ibdev,
+			 struct ib_completion_queue *cq );
+extern struct ib_queue_pair *
+ib_create_qp ( struct ib_device *ibdev, enum ib_queue_pair_type type,
+	       unsigned int num_send_wqes, struct ib_completion_queue *send_cq,
+	       unsigned int num_recv_wqes,
+	       struct ib_completion_queue *recv_cq );
+extern int ib_modify_qp ( struct ib_device *ibdev, struct ib_queue_pair *qp );
+extern void ib_destroy_qp ( struct ib_device *ibdev,
+			    struct ib_queue_pair *qp );
+extern struct ib_queue_pair * ib_find_qp_qpn ( struct ib_device *ibdev,
+					       unsigned long qpn );
+extern struct ib_queue_pair * ib_find_qp_mgid ( struct ib_device *ibdev,
+						struct ib_gid *gid );
+extern struct ib_work_queue * ib_find_wq ( struct ib_completion_queue *cq,
+					   unsigned long qpn, int is_send );
+extern int ib_post_send ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			  struct ib_address_vector *av,
+			  struct io_buffer *iobuf );
+extern int ib_post_recv ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			  struct io_buffer *iobuf );
+extern void ib_complete_send ( struct ib_device *ibdev,
+			       struct ib_queue_pair *qp,
+			       struct io_buffer *iobuf, int rc );
+extern void ib_complete_recv ( struct ib_device *ibdev,
+			       struct ib_queue_pair *qp,
+			       struct ib_address_vector *av,
+			       struct io_buffer *iobuf, int rc );
+extern void ib_refill_recv ( struct ib_device *ibdev,
+			     struct ib_queue_pair *qp );
+extern int ib_open ( struct ib_device *ibdev );
+extern void ib_close ( struct ib_device *ibdev );
+extern int ib_link_rc ( struct ib_device *ibdev );
+extern int ib_mcast_attach ( struct ib_device *ibdev, struct ib_queue_pair *qp,
+			     struct ib_gid *gid );
+extern void ib_mcast_detach ( struct ib_device *ibdev,
+			      struct ib_queue_pair *qp, struct ib_gid *gid );
+extern int ib_get_hca_info ( struct ib_device *ibdev,
+			     struct ib_gid_half *hca_guid );
+extern int ib_set_port_info ( struct ib_device *ibdev, union ib_mad *mad );
+extern int ib_set_pkey_table ( struct ib_device *ibdev, union ib_mad *mad );
+extern struct ib_device * alloc_ibdev ( size_t priv_size );
+extern int register_ibdev ( struct ib_device *ibdev );
+extern void unregister_ibdev ( struct ib_device *ibdev );
+extern struct ib_device * find_ibdev ( struct ib_gid *gid );
+extern struct ib_device * last_opened_ibdev ( void );
+extern void ib_link_state_changed ( struct ib_device *ibdev );
+extern void ib_poll_eq ( struct ib_device *ibdev );
+extern struct list_head ib_devices;
+
+/** Iterate over all network devices */
+#define for_each_ibdev( ibdev ) \
+	list_for_each_entry ( (ibdev), &ib_devices, list )
+
+/**
+ * Check link state
+ *
+ * @v ibdev		Infiniband device
+ * @ret link_up		Link is up
+ */
+static inline __always_inline int
+ib_link_ok ( struct ib_device *ibdev ) {
+	return ( ibdev->port_state == IB_PORT_STATE_ACTIVE );
+}
+
+/**
+ * Get reference to Infiniband device
+ *
+ * @v ibdev		Infiniband device
+ * @ret ibdev		Infiniband device
+ */
+static inline __always_inline struct ib_device *
+ibdev_get ( struct ib_device *ibdev ) {
+	ref_get ( &ibdev->refcnt );
+	return ibdev;
+}
+
+/**
+ * Drop reference to Infiniband device
+ *
+ * @v ibdev		Infiniband device
+ */
+static inline __always_inline void
+ibdev_put ( struct ib_device *ibdev ) {
+	ref_put ( &ibdev->refcnt );
+}
+
+/**
+ * Set Infiniband work queue driver-private data
+ *
+ * @v wq		Work queue
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_wq_set_drvdata ( struct ib_work_queue *wq, void *priv ) {
+	wq->drv_priv = priv;
+}
+
+/**
+ * Get Infiniband work queue driver-private data
+ *
+ * @v wq		Work queue
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_wq_get_drvdata ( struct ib_work_queue *wq ) {
+	return wq->drv_priv;
+}
+
+/**
+ * Set Infiniband queue pair driver-private data
+ *
+ * @v qp		Queue pair
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_qp_set_drvdata ( struct ib_queue_pair *qp, void *priv ) {
+	qp->drv_priv = priv;
+}
+
+/**
+ * Get Infiniband queue pair driver-private data
+ *
+ * @v qp		Queue pair
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_qp_get_drvdata ( struct ib_queue_pair *qp ) {
+	return qp->drv_priv;
+}
+
+/**
+ * Set Infiniband queue pair owner-private data
+ *
+ * @v qp		Queue pair
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_qp_set_ownerdata ( struct ib_queue_pair *qp, void *priv ) {
+	qp->owner_priv = priv;
+}
+
+/**
+ * Get Infiniband queue pair owner-private data
+ *
+ * @v qp		Queue pair
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_qp_get_ownerdata ( struct ib_queue_pair *qp ) {
+	return qp->owner_priv;
+}
+
+/**
+ * Set Infiniband completion queue driver-private data
+ *
+ * @v cq		Completion queue
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_cq_set_drvdata ( struct ib_completion_queue *cq, void *priv ) {
+	cq->drv_priv = priv;
+}
+
+/**
+ * Get Infiniband completion queue driver-private data
+ *
+ * @v cq		Completion queue
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_cq_get_drvdata ( struct ib_completion_queue *cq ) {
+	return cq->drv_priv;
+}
+
+/**
+ * Set Infiniband device driver-private data
+ *
+ * @v ibdev		Infiniband device
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_set_drvdata ( struct ib_device *ibdev, void *priv ) {
+	ibdev->drv_priv = priv;
+}
+
+/**
+ * Get Infiniband device driver-private data
+ *
+ * @v ibdev		Infiniband device
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_get_drvdata ( struct ib_device *ibdev ) {
+	return ibdev->drv_priv;
+}
+
+/**
+ * Set Infiniband device owner-private data
+ *
+ * @v ibdev		Infiniband device
+ * @v priv		Private data
+ */
+static inline __always_inline void
+ib_set_ownerdata ( struct ib_device *ibdev, void *priv ) {
+	ibdev->owner_priv = priv;
+}
+
+/**
+ * Get Infiniband device owner-private data
+ *
+ * @v ibdev		Infiniband device
+ * @ret priv		Private data
+ */
+static inline __always_inline void *
+ib_get_ownerdata ( struct ib_device *ibdev ) {
+	return ibdev->owner_priv;
+}
+
+#endif /* _IPXE_INFINIBAND_H */
diff --git a/src/include/ipxe/init.h b/src/include/ipxe/init.h
new file mode 100644
index 0000000..10ff869
--- /dev/null
+++ b/src/include/ipxe/init.h
@@ -0,0 +1,81 @@
+#ifndef _IPXE_INIT_H
+#define _IPXE_INIT_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tables.h>
+
+/**
+ * An initialisation function
+ *
+ * Initialisation functions are called exactly once, as part of the
+ * call to initialise().
+ */
+struct init_fn {
+	void ( * initialise ) ( void );
+};
+
+/** Initialisation function table */
+#define INIT_FNS __table ( struct init_fn, "init_fns" )
+
+/** Declare an initialisation functon */
+#define __init_fn( init_order ) __table_entry ( INIT_FNS, init_order )
+
+/** @defgroup initfn_order Initialisation function ordering
+ * @{
+ */
+
+#define INIT_EARLY	01	/**< Early initialisation */
+#define INIT_SERIAL	02	/**< Serial driver initialisation */
+#define	INIT_CONSOLE	03	/**< Console initialisation */
+#define INIT_NORMAL	04	/**< Normal initialisation */
+
+/** @} */
+
+/** Shutdown flags */
+enum shutdown_flags {
+	/** Shutdown is in order to exit (return to iPXE's caller) */
+	SHUTDOWN_EXIT = 0x0001,
+	/** Shutdown is in order to boot an OS */
+	SHUTDOWN_BOOT = 0x0002,
+	/** Do not remove devices */
+	SHUTDOWN_KEEP_DEVICES = 0x0004,
+};
+
+/**
+ * A startup/shutdown function
+ *
+ * Startup and shutdown functions may be called multiple times, as
+ * part of the calls to startup() and shutdown().
+ */
+struct startup_fn {
+	void ( * startup ) ( void );
+	void ( * shutdown ) ( int flags );
+};
+
+/** Startup/shutdown function table */
+#define STARTUP_FNS __table ( struct startup_fn, "startup_fns" )
+
+/** Declare a startup/shutdown function */
+#define __startup_fn( startup_order ) \
+	__table_entry ( STARTUP_FNS, startup_order )
+
+/** @defgroup startfn_order Startup/shutdown function ordering
+ *
+ * Shutdown functions are called in the reverse order to startup
+ * functions.
+ *
+ * @{
+ */
+
+#define STARTUP_EARLY	01	/**< Early startup */
+#define STARTUP_NORMAL	02	/**< Normal startup */
+#define STARTUP_LATE	03	/**< Late startup */
+
+/** @} */
+
+extern void initialise ( void );
+extern void startup ( void );
+extern void shutdown ( int flags );
+
+#endif /* _IPXE_INIT_H */
diff --git a/src/include/ipxe/interface.h b/src/include/ipxe/interface.h
new file mode 100644
index 0000000..4104105
--- /dev/null
+++ b/src/include/ipxe/interface.h
@@ -0,0 +1,58 @@
+#ifndef _IPXE_INTERFACE_H
+#define _IPXE_INTERFACE_H
+
+/** @file
+ *
+ * Object communication interfaces
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/refcnt.h>
+
+/** An object communication interface */
+struct interface {
+	/** Destination interface
+	 *
+	 * When messages are sent via this interface, they will be
+	 * delivered to the destination interface.
+	 *
+	 * This pointer may never be NULL.  When the interface is
+	 * unplugged, it should point to a null interface.
+	 */
+	struct interface *dest;
+	/** Reference counter
+	 *
+	 * If this interface is not part of a reference-counted
+	 * object, this field may be NULL.
+	 */
+	struct refcnt *refcnt;
+};
+
+/**
+ * Increment reference count on an interface
+ *
+ * @v intf		Interface
+ * @ret intf		Interface
+ */
+static inline __attribute__ (( always_inline )) struct interface *
+intf_get ( struct interface *intf ) {
+	ref_get ( intf->refcnt );
+	return intf;
+}
+
+/**
+ * Decrement reference count on an interface
+ *
+ * @v intf		Interface
+ */
+static inline __attribute__ (( always_inline )) void
+intf_put ( struct interface *intf ) {
+	ref_put ( intf->refcnt );
+}
+
+extern void plug ( struct interface *intf, struct interface *dest );
+extern void plug_plug ( struct interface *a, struct interface *b );
+
+#endif /* _IPXE_INTERFACE_H */
diff --git a/src/include/ipxe/io.h b/src/include/ipxe/io.h
new file mode 100644
index 0000000..5bfd899
--- /dev/null
+++ b/src/include/ipxe/io.h
@@ -0,0 +1,506 @@
+#ifndef _IPXE_IO_H
+#define _IPXE_IO_H
+
+/** @file
+ *
+ * iPXE I/O API
+ *
+ * The I/O API provides methods for reading from and writing to
+ * memory-mapped and I/O-mapped devices.
+ *
+ * The standard methods (readl()/writel() etc.) do not strictly check
+ * the type of the address parameter; this is because traditional
+ * usage does not necessarily provide the correct pointer type.  For
+ * example, code written for ISA devices at fixed I/O addresses (such
+ * as the keyboard controller) tend to use plain integer constants for
+ * the address parameter.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/api.h>
+#include <config/ioapi.h>
+#include <ipxe/uaccess.h>
+
+/**
+ * Calculate static inline I/O API function name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ */
+#define IOAPI_INLINE( _subsys, _api_func ) \
+	SINGLE_API_INLINE ( IOAPI_PREFIX_ ## _subsys, _api_func )
+
+/**
+ * Provide an I/O API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_IOAPI( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( IOAPI_PREFIX_ ## _subsys, _api_func, _func )
+
+/**
+ * Provide a static inline I/O API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ */
+#define PROVIDE_IOAPI_INLINE( _subsys, _api_func ) \
+	PROVIDE_SINGLE_API_INLINE ( IOAPI_PREFIX_ ## _subsys, _api_func )
+
+/* Include all architecture-independent I/O API headers */
+#include <ipxe/efi/efi_io.h>
+
+/* Include all architecture-dependent I/O API headers */
+#include <bits/io.h>
+
+/**
+ * Wrap an I/O read
+ *
+ * @v _func		I/O API function
+ * @v _type		Data type
+ * @v io_addr		I/O address
+ * @v _prefix		Prefix for address in debug message
+ * @v _ndigits		Number of hex digits for this data type
+ */
+#define IOAPI_READ( _func, _type, io_addr, _prefix, _ndigits ) ( {	      \
+	volatile _type *_io_addr =					      \
+		( ( volatile _type * ) ( intptr_t ) (io_addr) );	      \
+	_type _data = _func ( _io_addr );				      \
+	DBGIO ( "[" _prefix " %08lx] => %0" #_ndigits "llx\n",		      \
+		io_to_bus ( _io_addr ), ( unsigned long long ) _data );	      \
+	_data; } )
+
+/**
+ * Wrap an I/O write
+ *
+ * @v _func		I/O API function
+ * @v _type		Data type
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ * @v _prefix		Prefix for address in debug message
+ * @v _ndigits		Number of hex digits for this data type
+ */
+#define IOAPI_WRITE( _func, _type, data, io_addr, _prefix, _ndigits ) do {    \
+	volatile _type *_io_addr =					      \
+		( ( volatile _type * ) ( intptr_t ) (io_addr) );	      \
+	_type _data = (data);						      \
+	DBGIO ( "[" _prefix " %08lx] <= %0" #_ndigits "llx\n",		      \
+		io_to_bus ( _io_addr ), ( unsigned long long ) _data );	      \
+	_func ( _data, _io_addr );					      \
+	} while ( 0 )
+
+/**
+ * Wrap an I/O string read
+ *
+ * @v _func		I/O API function
+ * @v _type		Data type
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of elements to read
+ * @v _prefix		Prefix for address in debug message
+ * @v _ndigits		Number of hex digits for this data type
+ */
+#define IOAPI_READS( _func, _type, io_addr, data, count, _prefix, _ndigits )  \
+	do {								      \
+	volatile _type *_io_addr =					      \
+		( ( volatile _type * ) ( intptr_t ) (io_addr) );	      \
+	void *_data_void = (data); /* Check data is a pointer */	      \
+	_type * _data = ( ( _type * ) _data_void );			      \
+	const _type * _dbg_data = _data;				      \
+	unsigned int _count = (count);					      \
+	unsigned int _dbg_count = _count;				      \
+	_func ( _io_addr, _data, _count );				      \
+	DBGIO ( "[" _prefix " %08lx] =>", io_to_bus ( _io_addr ) );	      \
+	while ( _dbg_count-- ) {					      \
+		DBGIO ( " %0" #_ndigits "llx",				      \
+			( ( unsigned long long ) *(_dbg_data++) ) );	      \
+	}								      \
+	DBGIO ( "\n" );							      \
+	} while ( 0 )
+
+/**
+ * Wrap an I/O string write
+ *
+ * @v _func		I/O API function
+ * @v _type		Data type
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of elements to write
+ * @v _prefix		Prefix for address in debug message
+ * @v _ndigits		Number of hex digits for this data type
+ */
+#define IOAPI_WRITES( _func, _type, io_addr, data, count, _prefix, _ndigits ) \
+	do {								      \
+	volatile _type *_io_addr =					      \
+		( ( volatile _type * ) ( intptr_t ) (io_addr) );	      \
+	const void *_data_void = (data); /* Check data is a pointer */	      \
+	const _type * _data = ( ( const _type * ) _data_void );		      \
+	const _type * _dbg_data = _data;				      \
+	unsigned int _count = (count);					      \
+	unsigned int _dbg_count = _count;				      \
+	DBGIO ( "[" _prefix " %08lx] <=", io_to_bus ( _io_addr ) );	      \
+	while ( _dbg_count-- ) {					      \
+		DBGIO ( " %0" #_ndigits "llx",				      \
+			( ( unsigned long long ) *(_dbg_data++) ) );	      \
+	}								      \
+	DBGIO ( "\n" );							      \
+	_func ( _io_addr, _data, _count );				      \
+	} while ( 0 )
+
+/**
+ * Convert physical address to a bus address
+ *
+ * @v phys_addr		Physical address
+ * @ret bus_addr	Bus address
+ */
+unsigned long phys_to_bus ( unsigned long phys_addr );
+
+/**
+ * Convert bus address to a physical address
+ *
+ * @v bus_addr		Bus address
+ * @ret phys_addr	Physical address
+ */
+unsigned long bus_to_phys ( unsigned long bus_addr );
+
+/**
+ * Convert virtual address to a bus address
+ *
+ * @v addr		Virtual address
+ * @ret bus_addr	Bus address
+ */
+static inline __always_inline unsigned long
+virt_to_bus ( volatile const void *addr ) {
+	return phys_to_bus ( virt_to_phys ( addr ) );
+}
+
+/**
+ * Convert bus address to a virtual address
+ *
+ * @v bus_addr		Bus address
+ * @ret addr		Virtual address
+ *
+ * This operation is not available under all memory models.
+ */
+static inline __always_inline void * bus_to_virt ( unsigned long bus_addr ) {
+	return phys_to_virt ( bus_to_phys ( bus_addr ) );
+}
+
+/**
+ * Map bus address as an I/O address
+ *
+ * @v bus_addr		Bus address
+ * @v len		Length of region
+ * @ret io_addr		I/O address
+ */
+void * ioremap ( unsigned long bus_addr, size_t len );
+
+/**
+ * Unmap I/O address
+ *
+ * @v io_addr		I/O address
+ */
+void iounmap ( volatile const void *io_addr );
+
+/**
+ * Convert I/O address to bus address (for debug only)
+ *
+ * @v io_addr		I/O address
+ * @ret bus_addr	Bus address
+ */
+unsigned long io_to_bus ( volatile const void *io_addr );
+
+/**
+ * Read byte from memory-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint8_t readb ( volatile uint8_t *io_addr );
+#define readb( io_addr ) IOAPI_READ ( readb, uint8_t, io_addr, "MEM", 2 )
+
+/**
+ * Read 16-bit word from memory-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint16_t readw ( volatile uint16_t *io_addr );
+#define readw( io_addr ) IOAPI_READ ( readw, uint16_t, io_addr, "MEM", 4 )
+
+/**
+ * Read 32-bit dword from memory-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint32_t readl ( volatile uint32_t *io_addr );
+#define readl( io_addr ) IOAPI_READ ( readl, uint32_t, io_addr, "MEM", 8 )
+
+/**
+ * Read 64-bit qword from memory-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint64_t readq ( volatile uint64_t *io_addr );
+#define readq( io_addr ) IOAPI_READ ( readq, uint64_t, io_addr, "MEM", 16 )
+
+/**
+ * Write byte to memory-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void writeb ( uint8_t data, volatile uint8_t *io_addr );
+#define writeb( data, io_addr ) \
+	IOAPI_WRITE ( writeb, uint8_t, data, io_addr, "MEM", 2 )
+
+/**
+ * Write 16-bit word to memory-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void writew ( uint16_t data, volatile uint16_t *io_addr );
+#define writew( data, io_addr ) \
+	IOAPI_WRITE ( writew, uint16_t, data, io_addr, "MEM", 4 )
+
+/**
+ * Write 32-bit dword to memory-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void writel ( uint32_t data, volatile uint32_t *io_addr );
+#define writel( data, io_addr ) \
+	IOAPI_WRITE ( writel, uint32_t, data, io_addr, "MEM", 8 )
+
+/**
+ * Write 64-bit qword to memory-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void writeq ( uint64_t data, volatile uint64_t *io_addr );
+#define writeq( data, io_addr ) \
+	IOAPI_WRITE ( writeq, uint64_t, data, io_addr, "MEM", 16 )
+
+/**
+ * Read byte from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint8_t inb ( volatile uint8_t *io_addr );
+#define inb( io_addr ) IOAPI_READ ( inb, uint8_t, io_addr, "IO", 2 )
+
+/**
+ * Read 16-bit word from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint16_t inw ( volatile uint16_t *io_addr );
+#define inw( io_addr ) IOAPI_READ ( inw, uint16_t, io_addr, "IO", 4 )
+
+/**
+ * Read 32-bit dword from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+uint32_t inl ( volatile uint32_t *io_addr );
+#define inl( io_addr ) IOAPI_READ ( inl, uint32_t, io_addr, "IO", 8 )
+
+/**
+ * Write byte to I/O-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void outb ( uint8_t data, volatile uint8_t *io_addr );
+#define outb( data, io_addr ) \
+	IOAPI_WRITE ( outb, uint8_t, data, io_addr, "IO", 2 )
+
+/**
+ * Write 16-bit word to I/O-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void outw ( uint16_t data, volatile uint16_t *io_addr );
+#define outw( data, io_addr ) \
+	IOAPI_WRITE ( outw, uint16_t, data, io_addr, "IO", 4 )
+
+/**
+ * Write 32-bit dword to I/O-mapped device
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+void outl ( uint32_t data, volatile uint32_t *io_addr );
+#define outl( data, io_addr ) \
+	IOAPI_WRITE ( outl, uint32_t, data, io_addr, "IO", 8 )
+
+/**
+ * Read bytes from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of bytes to read
+ */
+void insb ( volatile uint8_t *io_addr, uint8_t *data, unsigned int count );
+#define insb( io_addr, data, count ) \
+	IOAPI_READS ( insb, uint8_t, io_addr, data, count, "IO", 2 )
+
+/**
+ * Read 16-bit words from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of words to read
+ */
+void insw ( volatile uint16_t *io_addr, uint16_t *data, unsigned int count );
+#define insw( io_addr, data, count ) \
+	IOAPI_READS ( insw, uint16_t, io_addr, data, count, "IO", 4 )
+
+/**
+ * Read 32-bit words from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of words to read
+ */
+void insl ( volatile uint32_t *io_addr, uint32_t *data, unsigned int count );
+#define insl( io_addr, data, count ) \
+	IOAPI_READS ( insl, uint32_t, io_addr, data, count, "IO", 8 )
+
+/**
+ * Write bytes to I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of bytes to write
+ */
+void outsb ( volatile uint8_t *io_addr, const uint8_t *data,
+	     unsigned int count );
+#define outsb( io_addr, data, count ) \
+	IOAPI_WRITES ( outsb, uint8_t, io_addr, data, count, "IO", 2 )
+
+/**
+ * Write 16-bit words to I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of words to write
+ */
+void outsw ( volatile uint16_t *io_addr, const uint16_t *data,
+	     unsigned int count );
+#define outsw( io_addr, data, count ) \
+	IOAPI_WRITES ( outsw, uint16_t, io_addr, data, count, "IO", 4 )
+
+/**
+ * Write 32-bit words to I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @v data		Data buffer
+ * @v count		Number of words to write
+ */
+void outsl ( volatile uint32_t *io_addr, const uint32_t *data,
+	     unsigned int count );
+#define outsl( io_addr, data, count ) \
+	IOAPI_WRITES ( outsl, uint32_t, io_addr, data, count, "IO", 8 )
+
+/**
+ * Slow down I/O
+ *
+ */
+void iodelay ( void );
+
+/**
+ * Read value from I/O-mapped device, slowly
+ *
+ * @v _func		Function to use to read value
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+#define INX_P( _func, _type, io_addr ) ( {				      \
+	_type _data = _func ( (io_addr) );				      \
+	iodelay();							      \
+	_data; } )
+
+/**
+ * Read byte from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+#define inb_p( io_addr ) INX_P ( inb, uint8_t, io_addr )
+
+/**
+ * Read 16-bit word from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+#define inw_p( io_addr ) INX_P ( inw, uint16_t, io_addr )
+
+/**
+ * Read 32-bit dword from I/O-mapped device
+ *
+ * @v io_addr		I/O address
+ * @ret data		Value read
+ */
+#define inl_p( io_addr ) INX_P ( inl, uint32_t, io_addr )
+
+/**
+ * Write value to I/O-mapped device, slowly
+ *
+ * @v _func		Function to use to write value
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+#define OUTX_P( _func, data, io_addr ) do {				      \
+	_func ( (data), (io_addr) );					      \
+	iodelay();							      \
+	} while ( 0 )
+
+/**
+ * Write byte to I/O-mapped device, slowly
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+#define outb_p( data, io_addr ) OUTX_P ( outb, data, io_addr )
+
+/**
+ * Write 16-bit word to I/O-mapped device, slowly
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+#define outw_p( data, io_addr ) OUTX_P ( outw, data, io_addr )
+
+/**
+ * Write 32-bit dword to I/O-mapped device, slowly
+ *
+ * @v data		Value to write
+ * @v io_addr		I/O address
+ */
+#define outl_p( data, io_addr ) OUTX_P ( outl, data, io_addr )
+
+/**
+ * Memory barrier
+ *
+ */
+void mb ( void );
+#define rmb()	mb()
+#define wmb()	mb()
+
+#endif /* _IPXE_IO_H */
diff --git a/src/include/ipxe/iobuf.h b/src/include/ipxe/iobuf.h
new file mode 100644
index 0000000..82c8b88
--- /dev/null
+++ b/src/include/ipxe/iobuf.h
@@ -0,0 +1,229 @@
+#ifndef _IPXE_IOBUF_H
+#define _IPXE_IOBUF_H
+
+/** @file
+ *
+ * I/O buffers
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <assert.h>
+#include <ipxe/list.h>
+
+/**
+ * I/O buffer alignment
+ *
+ * I/O buffers allocated via alloc_iob() are guaranteed to be
+ * physically aligned to this boundary.  Some cards cannot DMA across
+ * a 4kB boundary.  With a standard Ethernet MTU, aligning to a 2kB
+ * boundary is sufficient to guarantee no 4kB boundary crossings.  For
+ * a jumbo Ethernet MTU, a packet may be larger than 4kB anyway.
+ */
+#define IOB_ALIGN 2048
+
+/**
+ * Minimum I/O buffer length
+ *
+ * alloc_iob() will round up the allocated length to this size if
+ * necessary.  This is used on behalf of hardware that is not capable
+ * of auto-padding.
+ */
+#define IOB_ZLEN 64
+
+/**
+ * A persistent I/O buffer
+ *
+ * This data structure encapsulates a long-lived I/O buffer.  The
+ * buffer may be passed between multiple owners, queued for possible
+ * retransmission, etc.
+ */
+struct io_buffer {
+	/** List of which this buffer is a member
+	 *
+	 * The list must belong to the current owner of the buffer.
+	 * Different owners may maintain different lists (e.g. a
+	 * retransmission list for TCP).
+	 */
+	struct list_head list;
+
+	/** Start of the buffer */
+	void *head;
+	/** Start of data */
+	void *data;
+	/** End of data */
+	void *tail;
+	/** End of the buffer */
+        void *end;
+};
+
+/**
+ * Reserve space at start of I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @v len	Length to reserve
+ * @ret data	Pointer to new start of buffer
+ */
+static inline void * iob_reserve ( struct io_buffer *iobuf, size_t len ) {
+	iobuf->data += len;
+	iobuf->tail += len;
+	return iobuf->data;
+}
+#define iob_reserve( iobuf, len ) ( {			\
+	void *__result;					\
+	__result = iob_reserve ( (iobuf), (len) );	\
+	assert ( (iobuf)->tail <= (iobuf)->end );	\
+	__result; } )
+
+/**
+ * Add data to start of I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @v len	Length to add
+ * @ret data	Pointer to new start of buffer
+ */
+static inline void * iob_push ( struct io_buffer *iobuf, size_t len ) {
+	iobuf->data -= len;
+	return iobuf->data;
+}
+#define iob_push( iobuf, len ) ( {			\
+	void *__result;					\
+	__result = iob_push ( (iobuf), (len) );		\
+	assert ( (iobuf)->data >= (iobuf)->head );	\
+	__result; } )
+
+/**
+ * Remove data from start of I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @v len	Length to remove
+ * @ret data	Pointer to new start of buffer
+ */
+static inline void * iob_pull ( struct io_buffer *iobuf, size_t len ) {
+	iobuf->data += len;
+	assert ( iobuf->data <= iobuf->tail );
+	return iobuf->data;
+}
+#define iob_pull( iobuf, len ) ( {			\
+	void *__result;					\
+	__result = iob_pull ( (iobuf), (len) );		\
+	assert ( (iobuf)->data <= (iobuf)->tail );	\
+	__result; } )
+
+/**
+ * Add data to end of I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @v len	Length to add
+ * @ret data	Pointer to newly added space
+ */
+static inline void * iob_put ( struct io_buffer *iobuf, size_t len ) {
+	void *old_tail = iobuf->tail;
+	iobuf->tail += len;
+	return old_tail;
+}
+#define iob_put( iobuf, len ) ( {			\
+	void *__result;					\
+	__result = iob_put ( (iobuf), (len) );		\
+	assert ( (iobuf)->tail <= (iobuf)->end );	\
+	__result; } )
+
+/**
+ * Remove data from end of I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @v len	Length to remove
+ */
+static inline void iob_unput ( struct io_buffer *iobuf, size_t len ) {
+	iobuf->tail -= len;
+}
+#define iob_unput( iobuf, len ) do {			\
+	iob_unput ( (iobuf), (len) );			\
+	assert ( (iobuf)->tail >= (iobuf)->data );	\
+	} while ( 0 )
+
+/**
+ * Empty an I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ */
+static inline void iob_empty ( struct io_buffer *iobuf ) {
+	iobuf->tail = iobuf->data;
+}
+
+/**
+ * Calculate length of data in an I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @ret len	Length of data in buffer
+ */
+static inline size_t iob_len ( struct io_buffer *iobuf ) {
+	return ( iobuf->tail - iobuf->data );
+}
+
+/**
+ * Calculate available space at start of an I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @ret len	Length of data available at start of buffer
+ */
+static inline size_t iob_headroom ( struct io_buffer *iobuf ) {
+	return ( iobuf->data - iobuf->head );
+}
+
+/**
+ * Calculate available space at end of an I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @ret len	Length of data available at end of buffer
+ */
+static inline size_t iob_tailroom ( struct io_buffer *iobuf ) {
+	return ( iobuf->end - iobuf->tail );
+}
+
+/**
+ * Create a temporary I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ * @v data	Data buffer
+ * @v len	Length of data
+ * @v max_len	Length of buffer
+ *
+ * It is sometimes useful to use the iob_xxx() methods on temporary
+ * data buffers.
+ */
+static inline void iob_populate ( struct io_buffer *iobuf,
+				  void *data, size_t len, size_t max_len ) {
+	iobuf->head = iobuf->data = data;
+	iobuf->tail = ( data + len );
+	iobuf->end = ( data + max_len );
+}
+
+/**
+ * Disown an I/O buffer
+ *
+ * @v iobuf	I/O buffer
+ *
+ * There are many functions that take ownership of the I/O buffer they
+ * are passed as a parameter.  The caller should not retain a pointer
+ * to the I/O buffer.  Use iob_disown() to automatically nullify the
+ * caller's pointer, e.g.:
+ *
+ *     xfer_deliver_iob ( xfer, iob_disown ( iobuf ) );
+ *
+ * This will ensure that iobuf is set to NULL for any code after the
+ * call to xfer_deliver_iob().
+ */
+#define iob_disown( iobuf ) ( {				\
+	struct io_buffer *__iobuf = (iobuf);		\
+	(iobuf) = NULL;					\
+	__iobuf; } )
+
+extern struct io_buffer * __malloc alloc_iob ( size_t len );
+extern void free_iob ( struct io_buffer *iobuf );
+extern void iob_pad ( struct io_buffer *iobuf, size_t min_len );
+extern int iob_ensure_headroom ( struct io_buffer *iobuf, size_t len );
+
+#endif /* _IPXE_IOBUF_H */
diff --git a/src/include/ipxe/ip.h b/src/include/ipxe/ip.h
new file mode 100644
index 0000000..e3445aa
--- /dev/null
+++ b/src/include/ipxe/ip.h
@@ -0,0 +1,97 @@
+#ifndef _IPXE_IP_H
+#define _IPXE_IP_H
+
+/** @file
+ *
+ * IP protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/in.h>
+#include <ipxe/list.h>
+#include <ipxe/retry.h>
+
+struct io_buffer;
+struct net_device;
+struct net_protocol;
+
+/* IP constants */
+
+#define IP_VER			0x40U
+#define IP_MASK_VER		0xf0U
+#define IP_MASK_HLEN 		0x0fU
+#define IP_MASK_OFFSET		0x1fffU
+#define IP_MASK_DONOTFRAG	0x4000U
+#define IP_MASK_MOREFRAGS	0x2000U
+#define IP_PSHLEN 	12
+
+/* IP header defaults */
+#define IP_TOS		0
+#define IP_TTL		64
+
+#define IP_FRAG_IOB_SIZE	1500
+#define IP_FRAG_TIMEOUT		50
+
+/** An IPv4 packet header */
+struct iphdr {
+	uint8_t  verhdrlen;
+	uint8_t  service;
+	uint16_t len;
+	uint16_t ident;
+	uint16_t frags;
+	uint8_t  ttl;
+	uint8_t  protocol;
+	uint16_t chksum;
+	struct in_addr src;
+	struct in_addr dest;
+} __attribute__ (( packed ));
+
+/** An IPv4 pseudo header */
+struct ipv4_pseudo_header {
+	struct in_addr src;
+	struct in_addr dest;
+	uint8_t zero_padding;
+	uint8_t protocol;
+	uint16_t len;
+};
+
+/** An IPv4 address/routing table entry */
+struct ipv4_miniroute {
+	/** List of miniroutes */
+	struct list_head list;
+
+	/** Network device */
+	struct net_device *netdev;
+
+	/** IPv4 address */
+	struct in_addr address;
+	/** Subnet mask */
+	struct in_addr netmask;
+	/** Gateway address */
+	struct in_addr gateway;
+};
+
+/* Fragment reassembly buffer */
+struct frag_buffer {
+	/* Identification number */
+	uint16_t ident;
+	/* Source network address */
+	struct in_addr src;
+	/* Destination network address */
+	struct in_addr dest;
+	/* Reassembled I/O buffer */
+	struct io_buffer *frag_iob;
+	/* Reassembly timer */
+	struct retry_timer frag_timer;
+	/* List of fragment reassembly buffers */
+	struct list_head list;
+};
+
+extern struct list_head ipv4_miniroutes;
+
+extern struct net_protocol ipv4_protocol;
+
+#endif /* _IPXE_IP_H */
diff --git a/src/include/ipxe/ip6.h b/src/include/ipxe/ip6.h
new file mode 100644
index 0000000..70c2fad
--- /dev/null
+++ b/src/include/ipxe/ip6.h
@@ -0,0 +1,80 @@
+#ifndef _IPXE_IP6_H
+#define _IPXE_IP6_H
+
+/** @file
+ *
+ * IP6 protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/in.h>
+
+/* IP6 constants */
+
+#define IP6_VERSION	0x6
+#define IP6_HOP_LIMIT	255
+
+/**
+ * I/O buffer contents
+ * This is duplicated in tcp.h and here. Ideally it should go into iobuf.h
+ */
+#define MAX_HDR_LEN	100
+#define MAX_IOB_LEN	1500
+#define MIN_IOB_LEN	MAX_HDR_LEN + 100 /* To account for padding by LL */
+
+#define IP6_EQUAL( in6_addr1, in6_addr2 ) \
+        ( memcmp ( ( char* ) &( in6_addr1 ), ( char* ) &( in6_addr2 ),\
+	sizeof ( struct in6_addr ) ) == 0 )
+
+#define IS_UNSPECIFIED( addr ) \
+	( ( (addr).in6_u.u6_addr32[0] == 0x00000000 ) && \
+	( (addr).in6_u.u6_addr32[1] == 0x00000000 ) && \
+	( (addr).in6_u.u6_addr32[2] == 0x00000000 ) && \
+	( (addr).in6_u.u6_addr32[3] == 0x00000000 ) )
+/* IP6 header */
+struct ip6_header {
+	uint32_t 	ver_traffic_class_flow_label;
+	uint16_t 	payload_len;
+	uint8_t 	nxt_hdr;
+	uint8_t 	hop_limit;
+	struct in6_addr src;
+	struct in6_addr dest;
+};
+
+/* IP6 pseudo header */
+struct ipv6_pseudo_header {
+	struct in6_addr src;
+	struct in6_addr dest;
+	uint8_t zero_padding;
+	uint8_t nxt_hdr;
+	uint16_t len;
+};
+
+/* Next header numbers */
+#define IP6_HOPBYHOP 		0x00
+#define IP6_ROUTING 		0x43
+#define IP6_FRAGMENT		0x44
+#define IP6_AUTHENTICATION	0x51
+#define IP6_DEST_OPTS		0x60
+#define IP6_ESP			0x50
+#define IP6_ICMP6		0x58
+#define IP6_NO_HEADER		0x59
+
+struct io_buffer;
+struct net_device;
+struct net_protocol;
+
+extern struct net_protocol ipv6_protocol;
+extern struct tcpip_net_protocol ipv6_tcpip_protocol;
+extern char * inet6_ntoa ( struct in6_addr in6 );
+
+extern int add_ipv6_address ( struct net_device *netdev,
+			      struct in6_addr prefix, int prefix_len,
+			      struct in6_addr address,
+			      struct in6_addr gateway );
+extern void del_ipv6_address ( struct net_device *netdev );
+
+#endif /* _IPXE_IP6_H */
diff --git a/src/include/ipxe/ipoib.h b/src/include/ipxe/ipoib.h
new file mode 100644
index 0000000..31b0c1b
--- /dev/null
+++ b/src/include/ipxe/ipoib.h
@@ -0,0 +1,61 @@
+#ifndef _IPXE_IPOIB_H
+#define _IPXE_IPOIB_H
+
+/** @file
+ *
+ * IP over Infiniband
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/infiniband.h>
+
+/** IPoIB MAC address length */
+#define IPOIB_ALEN 20
+
+/** An IPoIB MAC address */
+struct ipoib_mac {
+	/** Queue pair number
+	 *
+	 * MSB indicates support for IPoIB "connected mode".  Lower 24
+	 * bits are the QPN.
+	 */
+	uint32_t flags__qpn;
+	/** Port GID */
+	struct ib_gid gid;
+} __attribute__ (( packed ));
+
+/** IPoIB link-layer header length */
+#define IPOIB_HLEN 4
+
+/** IPoIB link-layer header */
+struct ipoib_hdr {
+	/** Network-layer protocol */
+	uint16_t proto;
+	/** Reserved, must be zero */
+	union {
+		/** Reserved, must be zero */
+		uint16_t reserved;
+		/** Peer addresses
+		 *
+		 * We use these fields internally to represent the
+		 * peer addresses using a lookup key.  There simply
+		 * isn't enough room in the IPoIB header to store
+		 * literal source or destination MAC addresses.
+		 */
+		struct {
+			/** Destination address key */
+			uint8_t dest;
+			/** Source address key */
+			uint8_t src;
+		} __attribute__ (( packed )) peer;
+	} __attribute__ (( packed )) u;
+} __attribute__ (( packed ));
+
+extern const char * ipoib_ntoa ( const void *ll_addr );
+extern void ipoib_link_state_changed ( struct ib_device *ibdev );
+extern int ipoib_probe ( struct ib_device *ibdev );
+extern void ipoib_remove ( struct ib_device *ibdev );
+extern struct net_device * alloc_ipoibdev ( size_t priv_size );
+
+#endif /* _IPXE_IPOIB_H */
diff --git a/src/include/ipxe/isa.h b/src/include/ipxe/isa.h
new file mode 100644
index 0000000..6d8f761
--- /dev/null
+++ b/src/include/ipxe/isa.h
@@ -0,0 +1,97 @@
+#ifndef	ISA_H
+#define ISA_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/isa_ids.h>
+#include <ipxe/device.h>
+#include <ipxe/tables.h>
+
+/** An ISA device */
+struct isa_device {
+	/** Generic device */
+	struct device dev;
+	/** I/O address */
+	uint16_t ioaddr;
+	/** Driver for this device */
+	struct isa_driver *driver;
+	/** Driver-private data
+	 *
+	 * Use isa_set_drvdata() and isa_get_drvdata() to access
+	 * this field.
+	 */
+	void *priv;
+	/** Driver name */
+	const char *driver_name;
+};
+
+/*
+ * An individual ISA device, identified by probe address
+ *
+ */
+typedef uint16_t isa_probe_addr_t;
+
+/** An ISA driver */
+struct isa_driver {
+	/** Name */
+	const char *name;
+	/** Probe address list */
+	isa_probe_addr_t *probe_addrs;
+	/** Number of entries in probe address list */
+	unsigned int addr_count;
+	/** Manufacturer ID to be assumed for this device */
+	uint16_t vendor_id;
+	/** Product ID to be assumed for this device */
+	uint16_t prod_id;
+	/**
+	 * Probe device
+	 *
+	 * @v isa	ISA device
+	 * @v id	Matching entry in ID table
+	 * @ret rc	Return status code
+	 */
+	int ( * probe ) ( struct isa_device *isa );
+	/**
+	 * Remove device
+	 *
+	 * @v isa	ISA device
+	 */
+	void ( * remove ) ( struct isa_device *isa );
+};
+
+/** ISA driver table */
+#define ISA_DRIVERS __table ( struct isa_driver, "isa_drivers" )
+
+/** Declare an ISA driver */
+#define __isa_driver __table_entry ( ISA_DRIVERS, 01 )
+
+/**
+ * Set ISA driver-private data
+ *
+ * @v isa		ISA device
+ * @v priv		Private data
+ */
+static inline void isa_set_drvdata ( struct isa_device *isa, void *priv ) {
+	isa->priv = priv;
+}
+
+/**
+ * Get ISA driver-private data
+ *
+ * @v isa		ISA device
+ * @ret priv		Private data
+ */
+static inline void * isa_get_drvdata ( struct isa_device *isa ) {
+	return isa->priv;
+}
+
+/*
+ * ISA_ROM is parsed by parserom.pl to generate Makefile rules and
+ * files for rom-o-matic.
+ *
+ */
+#define ISA_ROM( IMAGE, DESCRIPTION )
+
+#endif /* ISA_H */
+
diff --git a/src/include/ipxe/isa_ids.h b/src/include/ipxe/isa_ids.h
new file mode 100644
index 0000000..1faf114
--- /dev/null
+++ b/src/include/ipxe/isa_ids.h
@@ -0,0 +1,51 @@
+#ifndef ISA_IDS_H
+#define ISA_IDS_H
+
+/* 
+ * This file defines IDs as used by ISAPnP and EISA devices.  These
+ * IDs have the format:
+ *
+ * vendor  byte 0 bit  7    must be zero
+ *		  bits 6-2  first vendor char in compressed ASCII
+ *		  bits 1-0  second vendor char in compressed ASCII (bits 4-3)
+ *	   byte 1 bits 7-5  second vendor char in compressed ASCII (bits 2-0)
+ *                bits 4-0  third vendor char in compressed ASCII
+ * product byte 0 bits 7-4  first hex digit of product number
+ *		  bits 3-0  second hex digit of product number
+ *	   byte 1 bits 7-4  third hex digit of product number
+ *		  bits 3-0  hex digit of revision level
+ *
+ * ISA IDs are always expressed in little-endian order, even though
+ * the underlying "meaning" is big-endian.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <byteswap.h>
+
+/*
+ * Construct a vendor ID from three ASCII characters
+ *
+ */
+#define ISA_VENDOR( a, b, c )					\
+	bswap_16 ( ( ( ( (a) - 'A' + 1 ) & 0x1f ) << 10 ) |	\
+		   ( ( ( (b) - 'A' + 1 ) & 0x1f ) << 5 ) |	\
+		   ( ( ( (c) - 'A' + 1 ) & 0x1f ) << 0 ) )
+
+#define ISAPNP_VENDOR( a, b, c )	ISA_VENDOR ( a, b, c )
+#define EISA_VENDOR( a, b, c )		ISA_VENDOR ( a, b, c )
+
+#define	GENERIC_ISAPNP_VENDOR		ISAPNP_VENDOR ( 'P','N','P' )
+
+/*
+ * Extract product ID and revision from combined product field
+ *
+ */
+#define ISA_PROD_ID_MASK	( 0xf0ff )
+#define ISA_PROD_ID(product)	( (product) & ISA_PROD_ID_MASK )
+#define ISA_PROD_REV(product)	( ( (product) & ~ISA_PROD_ID_MASK ) >> 8 )
+
+/* Functions in isa_ids.c */
+extern char * isa_id_string ( unsigned int vendor, unsigned int product );
+
+#endif /* ISA_IDS_H */
diff --git a/src/include/ipxe/isapnp.h b/src/include/ipxe/isapnp.h
new file mode 100644
index 0000000..f2b0b34
--- /dev/null
+++ b/src/include/ipxe/isapnp.h
@@ -0,0 +1,278 @@
+/**************************************************************************
+*
+*    isapnp.h -- Etherboot isapnp support for the 3Com 3c515
+*    Written 2002-2003 by Timothy Legge <tlegge@rogers.com>
+*
+*    This program is free software; you can redistribute it and/or modify
+*    it under the terms of the GNU General Public License as published by
+*    the Free Software Foundation; either version 2 of the License, or
+*    (at your option) any later version.
+*
+*    This program is distributed in the hope that it will be useful,
+*    but WITHOUT ANY WARRANTY; without even the implied warranty of
+*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+*    GNU General Public License for more details.
+*
+*    You should have received a copy of the GNU General Public License
+*    along with this program; if not, write to the Free Software
+*    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*
+*    Portions of this code:
+*		Copyright (C) 2001  P.J.H.Fox (fox@roestock.demon.co.uk)
+*
+*
+*
+*    REVISION HISTORY:
+*    ================
+*        Version 0.1 April 26, 2002 	TJL
+*	 Version 0.2 01/08/2003			TJL Renamed from 3c515_isapnp.h
+*
+*
+*    Generalised into an ISAPnP bus that can be used by more than just
+*    the 3c515 by Michael Brown <mbrown@fensystems.co.uk>
+*
+***************************************************************************/
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifndef ISAPNP_H
+#define ISAPNP_H
+
+#include <stdint.h>
+#include <ipxe/isa_ids.h>
+#include <ipxe/device.h>
+#include <ipxe/tables.h>
+
+/*
+ * ISAPnP constants
+ *
+ */
+
+/* Port addresses */
+#define ISAPNP_ADDRESS		0x279
+#define ISAPNP_WRITE_DATA	0xa79
+#define ISAPNP_READ_PORT_MIN	0x203
+#define ISAPNP_READ_PORT_START	0x213	/* ISAPnP spec says 0x203, but
+					 * Linux ISAPnP starts at
+					 * 0x213 with no explanatory
+					 * comment.  0x203 probably
+					 * clashes with something. */
+#define ISAPNP_READ_PORT_MAX	0x3ff
+#define ISAPNP_READ_PORT_STEP	0x10	/* Can be any multiple of 4
+					 * according to the spec, but
+					 * since ISA I/O addresses are
+					 * allocated in blocks of 16,
+					 * it makes no sense to use
+					 * any value less than 16.
+					 */
+
+/* Card select numbers */
+#define ISAPNP_CSN_MIN		0x01
+#define ISAPNP_CSN_MAX		0x0f
+
+/* Registers */
+#define ISAPNP_READPORT			0x00
+#define ISAPNP_SERIALISOLATION 		0x01
+#define ISAPNP_CONFIGCONTROL		0x02
+#define ISAPNP_WAKE			0x03
+#define ISAPNP_RESOURCEDATA		0x04
+#define ISAPNP_STATUS          		0x05
+#define ISAPNP_CARDSELECTNUMBER		0x06
+#define ISAPNP_LOGICALDEVICENUMBER	0x07
+#define ISAPNP_ACTIVATE			0x30
+#define ISAPNP_IORANGECHECK		0x31
+#define ISAPNP_IOBASE(n)		( 0x60 + ( (n) * 2 ) )
+#define ISAPNP_IRQNO(n)			( 0x70 + ( (n) * 2 ) )
+#define ISAPNP_IRQTYPE(n)		( 0x71 + ( (n) * 2 ) )
+
+/* Bits in the CONFIGCONTROL register */
+#define ISAPNP_CONFIG_RESET		( 1 << 0 )
+#define ISAPNP_CONFIG_WAIT_FOR_KEY	( 1 << 1 )
+#define ISAPNP_CONFIG_RESET_CSN		( 1 << 2 )
+#define ISAPNP_CONFIG_RESET_DRV		( ISAPNP_CONFIG_RESET | 	\
+					  ISAPNP_CONFIG_WAIT_FOR_KEY |	\
+					  ISAPNP_CONFIG_RESET_CSN )
+
+/* The LFSR used for the initiation key and for checksumming */
+#define ISAPNP_LFSR_SEED		0x6a
+
+/* Small tags */
+#define ISAPNP_IS_SMALL_TAG(tag)	( ! ( (tag) & 0x80 ) )
+#define ISAPNP_SMALL_TAG_NAME(tag)	( ( (tag) >> 3 ) & 0xf )
+#define ISAPNP_SMALL_TAG_LEN(tag)	( ( (tag) & 0x7 ) )
+#define ISAPNP_TAG_PNPVERNO		0x01
+#define ISAPNP_TAG_LOGDEVID		0x02
+#define ISAPNP_TAG_COMPATDEVID		0x03
+#define ISAPNP_TAG_IRQ			0x04
+#define ISAPNP_TAG_DMA			0x05
+#define ISAPNP_TAG_STARTDEP		0x06
+#define ISAPNP_TAG_ENDDEP		0x07
+#define ISAPNP_TAG_IOPORT		0x08
+#define ISAPNP_TAG_FIXEDIO		0x09
+#define ISAPNP_TAG_RSVDSHORTA		0x0A
+#define ISAPNP_TAG_RSVDSHORTB		0x0B
+#define ISAPNP_TAG_RSVDSHORTC		0x0C
+#define ISAPNP_TAG_RSVDSHORTD		0x0D
+#define ISAPNP_TAG_VENDORSHORT		0x0E
+#define ISAPNP_TAG_END			0x0F
+/* Large tags */
+#define ISAPNP_IS_LARGE_TAG(tag)	( ( (tag) & 0x80 ) )
+#define ISAPNP_LARGE_TAG_NAME(tag)	(tag)
+#define ISAPNP_TAG_MEMRANGE		0x81
+#define ISAPNP_TAG_ANSISTR		0x82
+#define ISAPNP_TAG_UNICODESTR		0x83
+#define ISAPNP_TAG_VENDORLONG		0x84
+#define ISAPNP_TAG_MEM32RANGE		0x85
+#define ISAPNP_TAG_FIXEDMEM32RANGE	0x86
+#define ISAPNP_TAG_RSVDLONG0		0xF0
+#define ISAPNP_TAG_RSVDLONG1		0xF1
+#define ISAPNP_TAG_RSVDLONG2		0xF2
+#define ISAPNP_TAG_RSVDLONG3		0xF3
+#define ISAPNP_TAG_RSVDLONG4		0xF4
+#define ISAPNP_TAG_RSVDLONG5		0xF5
+#define ISAPNP_TAG_RSVDLONG6		0xF6
+#define ISAPNP_TAG_RSVDLONG7		0xF7
+#define ISAPNP_TAG_RSVDLONG8		0xF8
+#define ISAPNP_TAG_RSVDLONG9		0xF9
+#define ISAPNP_TAG_RSVDLONGA		0xFA
+#define ISAPNP_TAG_RSVDLONGB		0xFB
+#define ISAPNP_TAG_RSVDLONGC		0xFC
+#define ISAPNP_TAG_RSVDLONGD		0xFD
+#define ISAPNP_TAG_RSVDLONGE		0xFE
+#define ISAPNP_TAG_RSVDLONGF		0xFF
+#define ISAPNP_TAG_PSEUDO_NEWBOARD	0x100
+
+/** An ISAPnP serial identifier */
+struct isapnp_identifier {
+	/** Vendor ID */
+	uint16_t vendor_id;
+	/** Product ID */
+	uint16_t prod_id;
+	/** Serial number */
+	uint32_t serial;
+	/** Checksum */
+	uint8_t checksum;
+} __attribute__ (( packed ));
+
+/** An ISAPnP logical device ID structure */
+struct isapnp_logdevid {
+	/** Vendor ID */
+	uint16_t vendor_id;
+	/** Product ID */
+	uint16_t prod_id;
+	/** Flags */
+	uint16_t flags;
+} __attribute__ (( packed ));
+
+/** An ISAPnP device ID list entry */
+struct isapnp_device_id {
+	/** Name */
+        const char *name;
+	/** Vendor ID */
+	uint16_t vendor_id;
+	/** Product ID */
+	uint16_t prod_id;
+};
+
+/** An ISAPnP device */
+struct isapnp_device {
+	/** Generic device */
+	struct device dev;
+	/** Vendor ID */
+	uint16_t vendor_id;
+	/** Product ID */
+	uint16_t prod_id;
+	/** I/O address */
+	uint16_t ioaddr;
+	/** Interrupt number */
+	uint8_t irqno;
+	/** Card Select Number */
+	uint8_t csn;
+	/** Logical Device ID */
+	uint8_t logdev;
+	/** Driver for this device */
+	struct isapnp_driver *driver;
+	/** Driver-private data
+	 *
+	 * Use isapnp_set_drvdata() and isapnp_get_drvdata() to access
+	 * this field.
+	 */
+	void *priv;
+	/** Driver name */
+	const char *driver_name;
+};
+
+/** An ISAPnP driver */
+struct isapnp_driver {
+	/** ISAPnP ID table */
+	struct isapnp_device_id *ids;
+	/** Number of entries in ISAPnP ID table */
+	unsigned int id_count;
+	/**
+	 * Probe device
+	 *
+	 * @v isapnp	ISAPnP device
+	 * @v id	Matching entry in ID table
+	 * @ret rc	Return status code
+	 */
+	int ( * probe ) ( struct isapnp_device *isapnp,
+			  const struct isapnp_device_id *id );
+	/**
+	 * Remove device
+	 *
+	 * @v isapnp	ISAPnP device
+	 */
+	void ( * remove ) ( struct isapnp_device *isapnp );
+};
+
+/** ISAPnP driver table */
+#define ISAPNP_DRIVERS __table ( struct isapnp_driver, "isapnp_drivers" )
+
+/** Declare an ISAPnP driver */
+#define __isapnp_driver __table_entry ( ISAPNP_DRIVERS, 01 )
+
+extern uint16_t isapnp_read_port;
+
+extern void isapnp_device_activation ( struct isapnp_device *isapnp,
+				       int activation );
+
+/**
+ * Activate ISAPnP device
+ *
+ * @v isapnp		ISAPnP device
+ */
+static inline void activate_isapnp_device ( struct isapnp_device *isapnp ) {
+	isapnp_device_activation ( isapnp, 1 );
+}
+
+/**
+ * Deactivate ISAPnP device
+ *
+ * @v isapnp		ISAPnP device
+ */
+static inline void deactivate_isapnp_device ( struct isapnp_device *isapnp ) {
+	isapnp_device_activation ( isapnp, 0 );
+}
+
+/**
+ * Set ISAPnP driver-private data
+ *
+ * @v isapnp		ISAPnP device
+ * @v priv		Private data
+ */
+static inline void isapnp_set_drvdata ( struct isapnp_device *isapnp,
+					void *priv ) {
+	isapnp->priv = priv;
+}
+
+/**
+ * Get ISAPnP driver-private data
+ *
+ * @v isapnp		ISAPnP device
+ * @ret priv		Private data
+ */
+static inline void * isapnp_get_drvdata ( struct isapnp_device *isapnp ) {
+	return isapnp->priv;
+}
+
+#endif /* ISAPNP_H */
diff --git a/src/include/ipxe/iscsi.h b/src/include/ipxe/iscsi.h
new file mode 100644
index 0000000..c5e7251
--- /dev/null
+++ b/src/include/ipxe/iscsi.h
@@ -0,0 +1,678 @@
+#ifndef _IPXE_ISCSI_H
+#define _IPXE_ISCSI_H
+
+/** @file
+ *
+ * iSCSI protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/socket.h>
+#include <ipxe/scsi.h>
+#include <ipxe/chap.h>
+#include <ipxe/refcnt.h>
+#include <ipxe/xfer.h>
+#include <ipxe/process.h>
+
+/** Default iSCSI port */
+#define ISCSI_PORT 3260
+
+/**
+ * iSCSI segment lengths
+ *
+ * iSCSI uses an icky structure with one one-byte field (a dword
+ * count) and one three-byte field (a byte count).  This structure,
+ * and the accompanying macros, relieve some of the pain.
+ */
+union iscsi_segment_lengths {
+	struct {
+		/** The AHS length (measured in dwords) */
+		uint8_t ahs_len;
+		/** The data length (measured in bytes), in network
+		 * byte order
+		 */
+		uint8_t data_len[3];
+	} bytes;
+	/** Ths data length (measured in bytes), in network byte
+	 * order, with ahs_len as the first byte.
+	 */
+	uint32_t ahs_and_data_len;
+};
+
+/** The length of the additional header segment, in dwords */
+#define ISCSI_AHS_LEN( segment_lengths ) \
+	( (segment_lengths).bytes.ahs_len )
+
+/** The length of the data segment, in bytes, excluding any padding */
+#define ISCSI_DATA_LEN( segment_lengths ) \
+	( ntohl ( (segment_lengths).ahs_and_data_len ) & 0xffffff )
+
+/** The padding of the data segment, in bytes */
+#define ISCSI_DATA_PAD_LEN( segment_lengths ) \
+	( ( 0 - (segment_lengths).bytes.data_len[2] ) & 0x03 )
+
+/** Set additional header and data segment lengths */
+#define ISCSI_SET_LENGTHS( segment_lengths, ahs_len, data_len ) do {	\
+	(segment_lengths).ahs_and_data_len =				\
+		htonl ( data_len | ( ahs_len << 24 ) );			\
+	} while ( 0 )
+
+/**
+ * iSCSI basic header segment common fields
+ *
+ */
+struct iscsi_bhs_common {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Fields specific to the PDU type */
+	uint8_t other_a[2];
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Fields specific to the PDU type */
+	uint8_t other_b[8];
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Fields specific to the PDU type */
+	uint8_t other_c[28];
+};
+
+/** Opcode mask */
+#define ISCSI_OPCODE_MASK 0x3f
+
+/** Immediate delivery */
+#define ISCSI_FLAG_IMMEDIATE 0x40
+
+/** Final PDU of a sequence */
+#define ISCSI_FLAG_FINAL 0x80
+
+/**
+ * iSCSI basic header segment common request fields
+ *
+ */
+struct iscsi_bhs_common_response {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Fields specific to the PDU type */
+	uint8_t other_a[2];
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Fields specific to the PDU type */
+	uint8_t other_b[8];
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Fields specific to the PDU type */
+	uint8_t other_c[4];
+	/** Status sequence number */
+	uint32_t statsn;
+	/** Expected command sequence number */
+	uint32_t expcmdsn;
+	/** Fields specific to the PDU type */
+	uint8_t other_d[16];
+};
+
+/**
+ * iSCSI login request basic header segment
+ *
+ */
+struct iscsi_bhs_login_request {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Maximum supported version number */
+	uint8_t version_max;
+	/** Minimum supported version number */
+	uint8_t version_min;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Initiator session ID (IANA format) enterprise number and flags */
+	uint32_t isid_iana_en;
+	/** Initiator session ID (IANA format) qualifier */
+	uint16_t isid_iana_qual;
+	/** Target session identifying handle */
+	uint16_t tsih;
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Connection ID */
+	uint16_t cid;
+	/** Reserved */
+	uint16_t reserved_a;
+	/** Command sequence number */
+	uint32_t cmdsn;
+	/** Expected status sequence number */
+	uint32_t expstatsn;
+	/** Reserved */
+	uint8_t reserved_b[16];
+};
+
+/** Login request opcode */
+#define ISCSI_OPCODE_LOGIN_REQUEST 0x03
+
+/** Willingness to transition to next stage */
+#define ISCSI_LOGIN_FLAG_TRANSITION 0x80
+
+/** Key=value pairs continued in subsequent request */
+#define ISCSI_LOGIN_FLAG_CONTINUE 0x40
+
+/* Current stage values and mask */
+#define ISCSI_LOGIN_CSG_MASK 0x0c
+#define ISCSI_LOGIN_CSG_SECURITY_NEGOTIATION 0x00
+#define ISCSI_LOGIN_CSG_OPERATIONAL_NEGOTIATION 0x04
+#define ISCSI_LOGIN_CSG_FULL_FEATURE_PHASE 0x0c
+
+/* Next stage values and mask */
+#define ISCSI_LOGIN_NSG_MASK 0x03
+#define ISCSI_LOGIN_NSG_SECURITY_NEGOTIATION 0x00
+#define ISCSI_LOGIN_NSG_OPERATIONAL_NEGOTIATION 0x01
+#define ISCSI_LOGIN_NSG_FULL_FEATURE_PHASE 0x03
+
+/** ISID IANA format marker */
+#define ISCSI_ISID_IANA 0x40000000
+
+/** Fen Systems Ltd. IANA enterprise number
+ *
+ * Permission is hereby granted to use Fen Systems Ltd.'s IANA
+ * enterprise number with this iSCSI implementation.
+ */
+#define IANA_EN_FEN_SYSTEMS 10019
+
+/**
+ * iSCSI login response basic header segment
+ *
+ */
+struct iscsi_bhs_login_response {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Maximum supported version number */
+	uint8_t version_max;
+	/** Minimum supported version number */
+	uint8_t version_min;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Initiator session ID (IANA format) enterprise number and flags */
+	uint32_t isid_iana_en;
+	/** Initiator session ID (IANA format) qualifier */
+	uint16_t isid_iana_qual;
+	/** Target session identifying handle */
+	uint16_t tsih;
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Reserved */
+	uint32_t reserved_a;
+	/** Status sequence number */
+	uint32_t statsn;
+	/** Expected command sequence number */
+	uint32_t expcmdsn;
+	/** Maximum command sequence number */
+	uint32_t maxcmdsn;
+	/** Status class */
+	uint8_t status_class;
+	/** Status detail */
+	uint8_t status_detail;
+	/** Reserved */
+	uint8_t reserved_b[10];
+};
+
+/** Login response opcode */
+#define ISCSI_OPCODE_LOGIN_RESPONSE 0x23
+
+/* Login response status codes */
+#define ISCSI_STATUS_SUCCESS			0x00
+#define ISCSI_STATUS_REDIRECT			0x01
+#define ISCSI_STATUS_INITIATOR_ERROR		0x02
+#define ISCSI_STATUS_INITIATOR_ERROR_AUTHENTICATION	0x01
+#define ISCSI_STATUS_INITIATOR_ERROR_AUTHORISATION	0x02
+#define ISCSI_STATUS_INITIATOR_ERROR_NOT_FOUND		0x03
+#define ISCSI_STATUS_INITIATOR_ERROR_REMOVED		0x04
+#define ISCSI_STATUS_TARGET_ERROR		0x03
+
+/**
+ * iSCSI SCSI command basic header segment
+ *
+ */
+struct iscsi_bhs_scsi_command {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint16_t reserved_a;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** SCSI Logical Unit Number */
+	struct scsi_lun lun;
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Expected data transfer length */
+	uint32_t exp_len;
+	/** Command sequence number */
+	uint32_t cmdsn;
+	/** Expected status sequence number */
+	uint32_t expstatsn;
+	/** SCSI Command Descriptor Block (CDB) */
+	union scsi_cdb cdb;
+};
+
+/** SCSI command opcode */
+#define ISCSI_OPCODE_SCSI_COMMAND 0x01
+
+/** Command will read data */
+#define ISCSI_COMMAND_FLAG_READ 0x40
+
+/** Command will write data */
+#define ISCSI_COMMAND_FLAG_WRITE 0x20
+
+/* Task attributes */
+#define ISCSI_COMMAND_ATTR_UNTAGGED 0x00
+#define ISCSI_COMMAND_ATTR_SIMPLE 0x01
+#define ISCSI_COMMAND_ATTR_ORDERED 0x02
+#define ISCSI_COMMAND_ATTR_HEAD_OF_QUEUE 0x03
+#define ISCSI_COMMAND_ATTR_ACA 0x04
+
+/**
+ * iSCSI SCSI response basic header segment
+ *
+ */
+struct iscsi_bhs_scsi_response {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Response code */
+	uint8_t response;
+	/** SCSI status code */
+	uint8_t status;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Reserved */
+	uint8_t reserved_a[8];
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** SNACK tag */
+	uint32_t snack;
+	/** Status sequence number */
+	uint32_t statsn;
+	/** Expected command sequence number */
+	uint32_t expcmdsn;
+	/** Maximum command sequence number */
+	uint32_t maxcmdsn;
+	/** Expected data sequence number */
+	uint32_t expdatasn;
+	/** Reserved */
+	uint8_t reserved_b[8];
+};
+
+/** SCSI response opcode */
+#define ISCSI_OPCODE_SCSI_RESPONSE 0x21
+
+/** SCSI command completed at target */
+#define ISCSI_RESPONSE_COMMAND_COMPLETE 0x00
+
+/** SCSI target failure */
+#define ISCSI_RESPONSE_TARGET_FAILURE 0x01
+
+/** SCSI sense response code offset
+ *
+ * The SCSI response may contain unsolicited sense data in the data
+ * segment.  If it does, this is the offset to the sense response code
+ * byte, which is the only byte we care about.
+ */
+#define ISCSI_SENSE_RESPONSE_CODE_OFFSET 2
+
+/**
+ * iSCSI data-in basic header segment
+ *
+ */
+struct iscsi_bhs_data_in {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved_a;
+	/** SCSI status code */
+	uint8_t status;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Logical Unit Number */
+	struct scsi_lun lun;
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Target Transfer Tag */
+	uint32_t ttt;
+	/** Status sequence number */
+	uint32_t statsn;
+	/** Expected command sequence number */
+	uint32_t expcmdsn;
+	/** Maximum command sequence number */
+	uint32_t maxcmdsn;
+	/** Data sequence number */
+	uint32_t datasn;
+	/** Buffer offset */
+	uint32_t offset;
+	/** Residual count */
+	uint32_t residual_count;
+};
+
+/** Data-in opcode */
+#define ISCSI_OPCODE_DATA_IN 0x25
+
+/** Data requires acknowledgement */
+#define ISCSI_DATA_FLAG_ACKNOWLEDGE 0x40
+
+/** Data overflow occurred */
+#define ISCSI_DATA_FLAG_OVERFLOW 0x04
+
+/** Data underflow occurred */
+#define ISCSI_DATA_FLAG_UNDERFLOW 0x02
+
+/** SCSI status code and overflow/underflow flags are valid */
+#define ISCSI_DATA_FLAG_STATUS 0x01
+
+/**
+ * iSCSI data-out basic header segment
+ *
+ */
+struct iscsi_bhs_data_out {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint16_t reserved_a;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Logical Unit Number */
+	struct scsi_lun lun;
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Target Transfer Tag */
+	uint32_t ttt;
+	/** Reserved */
+	uint32_t reserved_b;
+	/** Expected status sequence number */
+	uint32_t expstatsn;
+	/** Reserved */
+	uint32_t reserved_c;
+	/** Data sequence number */
+	uint32_t datasn;
+	/** Buffer offset */
+	uint32_t offset;
+	/** Reserved */
+	uint32_t reserved_d;
+};
+
+/** Data-out opcode */
+#define ISCSI_OPCODE_DATA_OUT 0x05
+
+/**
+ * iSCSI request to transfer basic header segment
+ *
+ */
+struct iscsi_bhs_r2t {
+	/** Opcode */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Reserved */
+	uint16_t reserved_a;
+	/** Segment lengths */
+	union iscsi_segment_lengths lengths;
+	/** Logical Unit Number */
+	struct scsi_lun lun;
+	/** Initiator Task Tag */
+	uint32_t itt;
+	/** Target Transfer Tag */
+	uint32_t ttt;
+	/** Status sequence number */
+	uint32_t statsn;
+	/** Expected command sequence number */
+	uint32_t expcmdsn;
+	/** Maximum command sequence number */
+	uint32_t maxcmdsn;
+	/** R2T sequence number */
+	uint32_t r2tsn;
+	/** Buffer offset */
+	uint32_t offset;
+	/** Desired data transfer length */
+	uint32_t len;
+};
+
+/** R2T opcode */
+#define ISCSI_OPCODE_R2T 0x31
+
+/**
+ * An iSCSI basic header segment
+ */
+union iscsi_bhs {
+	struct iscsi_bhs_common common;
+	struct iscsi_bhs_common_response common_response;
+	struct iscsi_bhs_login_request login_request;
+	struct iscsi_bhs_login_response login_response;
+	struct iscsi_bhs_scsi_command scsi_command;
+	struct iscsi_bhs_scsi_response scsi_response;
+	struct iscsi_bhs_data_in data_in;
+	struct iscsi_bhs_data_out data_out;
+	struct iscsi_bhs_r2t r2t;
+	unsigned char bytes[ sizeof ( struct iscsi_bhs_common ) ];
+};
+
+/** State of an iSCSI TX engine */
+enum iscsi_tx_state {
+	/** Nothing to send */
+	ISCSI_TX_IDLE = 0,
+	/** Sending the basic header segment */
+	ISCSI_TX_BHS,
+	/** Sending the additional header segment */
+	ISCSI_TX_AHS,
+	/** Sending the data segment */
+	ISCSI_TX_DATA,
+	/** Sending the data segment padding */
+	ISCSI_TX_DATA_PADDING,
+};
+
+/** State of an iSCSI RX engine */
+enum iscsi_rx_state {
+	/** Receiving the basic header segment */
+	ISCSI_RX_BHS = 0,
+	/** Receiving the additional header segment */
+	ISCSI_RX_AHS,
+	/** Receiving the data segment */
+	ISCSI_RX_DATA,
+	/** Receiving the data segment padding */
+	ISCSI_RX_DATA_PADDING,
+};
+
+/** An iSCSI session */
+struct iscsi_session {
+	/** Reference counter */
+	struct refcnt refcnt;
+
+	/** Transport-layer socket */
+	struct xfer_interface socket;
+
+	/** Target address */
+	char *target_address;
+	/** Target port */
+	unsigned int target_port;
+	/** Target IQN */
+	char *target_iqn;
+	/** Logical Unit Number (LUN) */
+	struct scsi_lun lun;
+	/** Target socket address (recorded only for iBFT) */
+	struct sockaddr target_sockaddr;
+
+	/** Session status
+	 *
+	 * This is the bitwise-OR of zero or more ISCSI_STATUS_XXX
+	 * constants.
+	 */
+	int status;
+	/** Retry count
+	 *
+	 * Number of times that the connection has been retried.
+	 * Reset upon a successful connection.
+	 */
+	int retry_count;
+
+	/** Initiator username (if any) */
+	char *initiator_username;
+	/** Initiator password (if any) */
+	char *initiator_password;
+	/** Target username (if any) */
+	char *target_username;
+	/** Target password (if any) */
+	char *target_password;
+	/** CHAP challenge (for target auth only)
+	 *
+	 * This is a block of random data; the first byte is used as
+	 * the CHAP identifier (CHAP_I) and the remainder as the CHAP
+	 * challenge (CHAP_C).
+	 */
+	unsigned char chap_challenge[17];
+	/** CHAP response (used for both initiator and target auth) */
+	struct chap_response chap;
+
+	/** Target session identifying handle
+	 *
+	 * This is assigned by the target when we first log in, and
+	 * must be reused on subsequent login attempts.
+	 */
+	uint16_t tsih;
+	/** Initiator task tag
+	 *
+	 * This is the tag of the current command.  It is incremented
+	 * whenever a new command is started.
+	 */
+	uint32_t itt;
+	/** Target transfer tag
+	 *
+	 * This is the tag attached to a sequence of data-out PDUs in
+	 * response to an R2T.
+	 */
+	uint32_t ttt;
+	/**
+	 * Transfer offset
+	 *
+	 * This is the offset for an in-progress sequence of data-out
+	 * PDUs in response to an R2T.
+	 */
+	uint32_t transfer_offset;
+	/**
+	 * Transfer length
+	 *
+	 * This is the length for an in-progress sequence of data-out
+	 * PDUs in response to an R2T.
+	 */
+	uint32_t transfer_len;
+	/** Command sequence number
+	 *
+	 * This is the sequence number of the current command, used to
+	 * fill out the CmdSN field in iSCSI request PDUs.  It is
+	 * updated with the value of the ExpCmdSN field whenever we
+	 * receive an iSCSI response PDU containing such a field.
+	 */
+	uint32_t cmdsn;
+	/** Status sequence number
+	 *
+	 * This is the most recent status sequence number present in
+	 * the StatSN field of an iSCSI response PDU containing such a
+	 * field.  Whenever we send an iSCSI request PDU, we fill out
+	 * the ExpStatSN field with this value plus one.
+	 */
+	uint32_t statsn;
+	
+	/** Basic header segment for current TX PDU */
+	union iscsi_bhs tx_bhs;
+	/** State of the TX engine */
+	enum iscsi_tx_state tx_state;
+	/** TX process */
+	struct process process;
+
+	/** Basic header segment for current RX PDU */
+	union iscsi_bhs rx_bhs;
+	/** State of the RX engine */
+	enum iscsi_rx_state rx_state;
+	/** Byte offset within the current RX state */
+	size_t rx_offset;
+	/** Length of the current RX state */
+	size_t rx_len;
+	/** Buffer for received data (not always used) */
+	void *rx_buffer;
+
+	/** Current SCSI command
+	 *
+	 * Set to NULL when command is complete.
+	 */
+	struct scsi_command *command;
+	/** Instant return code
+	 *
+	 * Set to a non-zero value if all requests should return
+	 * immediately.  This can be used to e.g. avoid retrying
+	 * logins that are doomed to fail authentication.
+	 */
+	int instant_rc;
+};
+
+/** iSCSI session is currently in the security negotiation phase */
+#define ISCSI_STATUS_SECURITY_NEGOTIATION_PHASE		\
+	( ISCSI_LOGIN_CSG_SECURITY_NEGOTIATION |	\
+	  ISCSI_LOGIN_NSG_OPERATIONAL_NEGOTIATION )
+
+/** iSCSI session is currently in the operational parameter
+ * negotiation phase
+ */
+#define ISCSI_STATUS_OPERATIONAL_NEGOTIATION_PHASE	\
+	( ISCSI_LOGIN_CSG_OPERATIONAL_NEGOTIATION |	\
+	  ISCSI_LOGIN_NSG_FULL_FEATURE_PHASE )
+
+/** iSCSI session is currently in the full feature phase */
+#define ISCSI_STATUS_FULL_FEATURE_PHASE	ISCSI_LOGIN_CSG_FULL_FEATURE_PHASE
+
+/** Mask for all iSCSI session phases */
+#define ISCSI_STATUS_PHASE_MASK ( ISCSI_LOGIN_CSG_MASK | ISCSI_LOGIN_NSG_MASK )
+
+/** iSCSI session needs to send the initial security negotiation strings */
+#define ISCSI_STATUS_STRINGS_SECURITY 0x0100
+
+/** iSCSI session needs to send the CHAP_A string */
+#define ISCSI_STATUS_STRINGS_CHAP_ALGORITHM 0x0200
+
+/** iSCSI session needs to send the CHAP response */
+#define ISCSI_STATUS_STRINGS_CHAP_RESPONSE 0x0400
+
+/** iSCSI session needs to send the mutual CHAP challenge */
+#define ISCSI_STATUS_STRINGS_CHAP_CHALLENGE 0x0800
+
+/** iSCSI session needs to send the operational negotiation strings */
+#define ISCSI_STATUS_STRINGS_OPERATIONAL 0x1000
+
+/** Mask for all iSCSI "needs to send" flags */
+#define ISCSI_STATUS_STRINGS_MASK 0xff00
+
+/** Target has requested forward (initiator) authentication */
+#define ISCSI_STATUS_AUTH_FORWARD_REQUIRED 0x00010000
+
+/** Initiator requires target (reverse) authentication */
+#define ISCSI_STATUS_AUTH_REVERSE_REQUIRED 0x00020000
+
+/** Target authenticated itself correctly */
+#define ISCSI_STATUS_AUTH_REVERSE_OK 0x00040000
+
+/** Maximum number of retries at connecting */
+#define ISCSI_MAX_RETRIES 2
+
+extern int iscsi_attach ( struct scsi_device *scsi, const char *root_path );
+extern void iscsi_detach ( struct scsi_device *scsi );
+extern const char * iscsi_initiator_iqn ( void );
+
+#endif /* _IPXE_ISCSI_H */
diff --git a/src/include/ipxe/job.h b/src/include/ipxe/job.h
new file mode 100644
index 0000000..893a790
--- /dev/null
+++ b/src/include/ipxe/job.h
@@ -0,0 +1,169 @@
+#ifndef _IPXE_JOB_H
+#define _IPXE_JOB_H
+
+/** @file
+ *
+ * Job control interfaces
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stddef.h>
+#include <ipxe/interface.h>
+
+/** Job progress */
+struct job_progress {
+	/** Amount of operation completed so far
+	 *
+	 * The units for this quantity are arbitrary.  @c completed
+	 * divded by @total should give something which approximately
+	 * represents the progress through the operation.  For a
+	 * download operation, using byte counts would make sense.
+	 */
+	unsigned long completed;
+	/** Total operation size
+	 *
+	 * See @c completed.  A zero value means "total size unknown"
+	 * and is explcitly permitted; users should take this into
+	 * account before calculating @c completed/total.
+	 */
+	unsigned long total;
+};
+
+struct job_interface;
+
+/** Job control interface operations */
+struct job_interface_operations {
+	/** Job completed
+	 *
+	 * @v job		Job control interface
+	 * @v rc		Overall job status code
+	 */
+	void ( * done ) ( struct job_interface *job, int rc );
+	/** Abort job
+	 *
+	 * @v job		Job control interface
+	 */
+	void ( * kill ) ( struct job_interface *job );
+	/** Get job progress
+	 *
+	 * @v job		Job control interface
+	 * @v progress		Progress data to fill in
+	 */
+	void ( * progress ) ( struct job_interface *job,
+			      struct job_progress *progress );
+};
+
+/** A job control interface */
+struct job_interface {
+	/** Generic object communication interface */
+	struct interface intf;
+	/** Operations for received messages */
+	struct job_interface_operations *op;
+};
+
+extern struct job_interface null_job;
+extern struct job_interface_operations null_job_ops;
+
+extern void job_done ( struct job_interface *job, int rc );
+extern void job_kill ( struct job_interface *job );
+extern void job_progress ( struct job_interface *job,
+			   struct job_progress *progress );
+
+extern void ignore_job_done ( struct job_interface *job, int rc );
+extern void ignore_job_kill ( struct job_interface *job );
+extern void ignore_job_progress ( struct job_interface *job,
+				  struct job_progress *progress );
+
+/**
+ * Initialise a job control interface
+ *
+ * @v job		Job control interface
+ * @v op		Job control interface operations
+ * @v refcnt		Containing object reference counter, or NULL
+ */
+static inline void job_init ( struct job_interface *job,
+			      struct job_interface_operations *op,
+			      struct refcnt *refcnt ) {
+	job->intf.dest = &null_job.intf;
+	job->intf.refcnt = refcnt;
+	job->op = op;
+}
+
+/**
+ * Get job control interface from generic object communication interface
+ *
+ * @v intf		Generic object communication interface
+ * @ret job		Job control interface
+ */
+static inline __attribute__ (( always_inline )) struct job_interface *
+intf_to_job ( struct interface *intf ) {
+	return container_of ( intf, struct job_interface, intf );
+}
+
+/**
+ * Get reference to destination job control interface
+ *
+ * @v job		Job control interface
+ * @ret dest		Destination interface
+ */
+static inline __attribute__ (( always_inline )) struct job_interface *
+job_get_dest ( struct job_interface *job ) {
+	return intf_to_job ( intf_get ( job->intf.dest ) );
+}
+
+/**
+ * Drop reference to job control interface
+ *
+ * @v job		Job control interface
+ */
+static inline __attribute__ (( always_inline )) void
+job_put ( struct job_interface *job ) {
+	intf_put ( &job->intf );
+}
+
+/**
+ * Plug a job control interface into a new destination interface
+ *
+ * @v job		Job control interface
+ * @v dest		New destination interface
+ */
+static inline void job_plug ( struct job_interface *job,
+			       struct job_interface *dest ) {
+	plug ( &job->intf, &dest->intf );
+}
+
+/**
+ * Plug two job control interfaces together
+ *
+ * @v a			Job control interface A
+ * @v b			Job control interface B
+ */
+static inline void job_plug_plug ( struct job_interface *a,
+				    struct job_interface *b ) {
+	plug_plug ( &a->intf, &b->intf );
+}
+
+/**
+ * Unplug a job control interface
+ *
+ * @v job		Job control interface
+ */
+static inline void job_unplug ( struct job_interface *job ) {
+	plug ( &job->intf, &null_job.intf );
+}
+
+/**
+ * Stop using a job control interface
+ *
+ * @v job		Job control interface
+ *
+ * After calling this method, no further messages will be received via
+ * the interface.
+ */
+static inline void job_nullify ( struct job_interface *job ) {
+	job->op = &null_job_ops;
+};
+
+#endif /* _IPXE_JOB_H */
diff --git a/src/include/ipxe/keys.h b/src/include/ipxe/keys.h
new file mode 100644
index 0000000..dba65ec
--- /dev/null
+++ b/src/include/ipxe/keys.h
@@ -0,0 +1,81 @@
+#ifndef _IPXE_KEYS_H
+#define _IPXE_KEYS_H
+
+/** @file
+ *
+ * Key definitions
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/*
+ * Symbolic names for some standard ASCII characters
+ *
+ */
+
+#define NUL		0x00
+#define CTRL_A		0x01
+#define CTRL_B		0x02
+#define CTRL_C		0x03
+#define CTRL_D		0x04
+#define CTRL_E		0x05
+#define CTRL_F		0x06
+#define CTRL_G		0x07
+#define CTRL_H		0x08
+#define CTRL_I		0x09
+#define CTRL_J		0x0a
+#define CTRL_K		0x0b
+#define CTRL_L		0x0c
+#define CTRL_M		0x0d
+#define CTRL_N		0x0e
+#define CTRL_O		0x0f
+#define CTRL_P		0x10
+#define CTRL_Q		0x11
+#define CTRL_R		0x12
+#define CTRL_S		0x13
+#define CTRL_T		0x14
+#define CTRL_U		0x15
+#define CTRL_V		0x16
+#define CTRL_W		0x17
+#define CTRL_X		0x18
+#define CTRL_Y		0x19
+#define CTRL_Z		0x1a
+
+#define BACKSPACE	CTRL_H
+#define TAB		CTRL_I
+#define LF		CTRL_J
+#define CR		CTRL_M
+#define ESC		0x1b
+
+/*
+ * Special keys outside the normal ASCII range 
+ *
+ *
+ * The names are chosen to match those used by curses.  The values are
+ * chosen to facilitate easy conversion from a received ANSI escape
+ * sequence to a KEY_XXX constant.
+ */
+
+#define KEY_ANSI( n, terminator ) ( 0x100 * ( (n) + 1 ) + (terminator) )
+
+#define KEY_MIN		0x101
+#define KEY_UP		KEY_ANSI ( 0, 'A' )	/**< Up arrow */
+#define KEY_DOWN	KEY_ANSI ( 0, 'B' )	/**< Down arrow */
+#define KEY_RIGHT	KEY_ANSI ( 0, 'C' )	/**< Right arrow */
+#define KEY_LEFT	KEY_ANSI ( 0, 'D' )	/**< Left arrow */
+#define KEY_END		KEY_ANSI ( 0, 'F' )	/**< End */
+#define KEY_HOME	KEY_ANSI ( 0, 'H' )	/**< Home */
+#define KEY_IC		KEY_ANSI ( 2, '~' )	/**< Insert */
+#define KEY_DC		KEY_ANSI ( 3, '~' )	/**< Delete */
+#define KEY_PPAGE	KEY_ANSI ( 5, '~' )	/**< Page up */
+#define KEY_NPAGE	KEY_ANSI ( 6, '~' )	/**< Page down */
+#define KEY_F8		KEY_ANSI ( 19, '~' )	/**< F8 (for PXE) */
+
+/* Not in the [KEY_MIN,KEY_MAX] range; terminals seem to send these as
+ * normal ASCII values.
+ */
+#define KEY_BACKSPACE	BACKSPACE
+#define KEY_ENTER	LF
+
+#endif /* _IPXE_KEYS_H */
diff --git a/src/include/ipxe/linebuf.h b/src/include/ipxe/linebuf.h
new file mode 100644
index 0000000..706ef25
--- /dev/null
+++ b/src/include/ipxe/linebuf.h
@@ -0,0 +1,30 @@
+#ifndef _IPXE_LINEBUF_H
+#define _IPXE_LINEBUF_H
+
+/** @file
+ *
+ * Line buffering
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <stddef.h>
+
+/** A line buffer */
+struct line_buffer {
+	/** Current string in the buffer */
+	char *data;
+	/** Length of current string, excluding the terminating NUL */
+	size_t len;
+	/** String is ready to read */
+	int ready;
+};
+
+extern char * buffered_line ( struct line_buffer *linebuf );
+extern ssize_t line_buffer ( struct line_buffer *linebuf,
+			     const char *data, size_t len );
+extern void empty_line_buffer ( struct line_buffer *linebuf );
+
+#endif /* _IPXE_LINEBUF_H */
diff --git a/src/include/ipxe/linux_compat.h b/src/include/ipxe/linux_compat.h
new file mode 100644
index 0000000..6f6ed97
--- /dev/null
+++ b/src/include/ipxe/linux_compat.h
@@ -0,0 +1,27 @@
+#ifndef _IPXE_LINUX_COMPAT_H
+#define _IPXE_LINUX_COMPAT_H
+
+/** @file
+ *
+ * Linux code compatibility
+ *
+ * This file exists to ease the building of Linux source code within
+ * iPXE.  This is intended to facilitate quick testing; it is not
+ * intended to be a substitute for proper porting.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <byteswap.h>
+#include <ipxe/bitops.h>
+
+#define __init
+#define __exit
+#define __initdata
+#define __exitdata
+#define printk printf
+
+#endif /* _IPXE_LINUX_COMPAT_H */
diff --git a/src/include/ipxe/list.h b/src/include/ipxe/list.h
new file mode 100644
index 0000000..743a3e2
--- /dev/null
+++ b/src/include/ipxe/list.h
@@ -0,0 +1,180 @@
+#ifndef _IPXE_LIST_H
+#define _IPXE_LIST_H
+
+/** @file
+ *
+ * Linked lists
+ *
+ * This linked list handling code is based on the Linux kernel's
+ * list.h.
+ */
+
+FILE_LICENCE ( GPL2_ONLY );
+
+#include <stddef.h>
+#include <assert.h>
+
+/*
+ * Simple doubly linked list implementation.
+ *
+ * Some of the internal functions ("__xxx") are useful when
+ * manipulating whole lists rather than single entries, as
+ * sometimes we already know the next/prev entries and we can
+ * generate better code by using them directly rather than
+ * using the generic single-entry routines.
+ */
+
+struct list_head {
+	struct list_head *next;
+	struct list_head *prev;
+};
+
+#define LIST_HEAD_INIT( name ) { &(name), &(name) }
+
+#define LIST_HEAD( name ) \
+	struct list_head name = LIST_HEAD_INIT ( name )
+
+#define INIT_LIST_HEAD( ptr ) do { \
+	(ptr)->next = (ptr); (ptr)->prev = (ptr); \
+} while ( 0 )
+
+/*
+ * Insert a new entry between two known consecutive entries.
+ *
+ * This is only for internal list manipulation where we know
+ * the prev/next entries already!
+ */
+static inline void __list_add ( struct list_head *new,
+				struct list_head *prev,
+				struct list_head *next ) {
+	next->prev = new;
+	new->next = next;
+	new->prev = prev;
+	prev->next = new;
+}
+
+/**
+ * Add a new entry to the head of a list
+ *
+ * @v new	New entry to be added
+ * @v head	List head to add it after
+ *
+ * Insert a new entry after the specified head.  This is good for
+ * implementing stacks.
+ */
+static inline void list_add ( struct list_head *new, struct list_head *head ) {
+	__list_add ( new, head, head->next );
+}
+#define list_add( new, head ) do {			\
+	assert ( (head)->next->prev == (head) );	\
+	assert ( (head)->prev->next == (head) );	\
+	list_add ( (new), (head) );			\
+	} while ( 0 )
+
+/**
+ * Add a new entry to the tail of a list
+ *
+ * @v new	New entry to be added
+ * @v head	List head to add it before
+ *
+ * Insert a new entry before the specified head.  This is useful for
+ * implementing queues.
+ */
+static inline void list_add_tail ( struct list_head *new,
+				   struct list_head *head ) {
+	__list_add ( new, head->prev, head );
+}
+#define list_add_tail( new, head ) do {			\
+	assert ( (head)->next->prev == (head) );	\
+	assert ( (head)->prev->next == (head) );	\
+	list_add_tail ( (new), (head) );		\
+	} while ( 0 )
+
+/*
+ * Delete a list entry by making the prev/next entries
+ * point to each other.
+ *
+ * This is only for internal list manipulation where we know
+ * the prev/next entries already!
+ */
+static inline void __list_del ( struct list_head * prev,
+				struct list_head * next ) {
+	next->prev = prev;
+	prev->next = next;
+}
+
+/**
+ * Delete an entry from a list
+ *
+ * @v entry	Element to delete from the list
+ *
+ * Note that list_empty() on entry does not return true after this;
+ * the entry is in an undefined state.
+ */
+static inline void list_del ( struct list_head *entry ) {
+	__list_del ( entry->prev, entry->next );
+}
+#define list_del( entry ) do {				\
+	assert ( (entry)->prev != NULL );		\
+	assert ( (entry)->next != NULL );		\
+	assert ( (entry)->next->prev == (entry) );	\
+	assert ( (entry)->prev->next == (entry) );	\
+	list_del ( (entry) );				\
+	} while ( 0 )
+
+/**
+ * Test whether a list is empty
+ *
+ * @v head	List to test.
+ */
+static inline int list_empty ( const struct list_head *head ) {
+	return head->next == head;
+}
+
+/**
+ * Get the containing struct for this entry
+ *
+ * @v ptr	The struct list_head pointer
+ * @v type	The type of the struct this is embedded in
+ * @v member	The name of the list_struct within the struct
+ */
+#define list_entry( ptr, type, member ) \
+	container_of ( ptr, type, member )
+
+/**
+ * Iterate over a list
+ *
+ * @v pos	The &struct list_head to use as a loop counter
+ * @v head	The head for your list
+ */
+#define list_for_each( pos, head ) \
+	for ( pos = (head)->next; pos != (head); pos = pos->next )
+
+/**
+ * Iterate over entries in a list
+ *
+ * @v pos	The type * to use as a loop counter
+ * @v head	The head for your list
+ * @v member	The name of the list_struct within the struct
+ */
+#define list_for_each_entry( pos, head, member )			      \
+	for ( pos = list_entry ( (head)->next, typeof ( *pos ), member );     \
+	      &pos->member != (head);					      \
+	      pos = list_entry ( pos->member.next, typeof ( *pos ), member ) )
+
+/**
+ * Iterate over entries in a list, safe against deletion of entries
+ *
+ * @v pos	The type * to use as a loop counter
+ * @v tmp	Another type * to use for temporary storage
+ * @v head	The head for your list
+ * @v member	The name of the list_struct within the struct
+ */
+#define list_for_each_entry_safe( pos, tmp, head, member )		      \
+	for ( pos = list_entry ( (head)->next, typeof ( *pos ), member ),     \
+	      tmp = list_entry ( pos->member.next, typeof ( *tmp ), member ); \
+	      &pos->member != (head);					      \
+	      pos = tmp,						      \
+	      tmp = list_entry ( tmp->member.next, typeof ( *tmp ), member ) )
+
+#endif /* _IPXE_LIST_H */
diff --git a/src/include/ipxe/login_ui.h b/src/include/ipxe/login_ui.h
new file mode 100644
index 0000000..01e5479
--- /dev/null
+++ b/src/include/ipxe/login_ui.h
@@ -0,0 +1,14 @@
+#ifndef _IPXE_LOGIN_UI_H
+#define _IPXE_LOGIN_UI_H
+
+/** @file
+ *
+ * Login UI
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+extern int login_ui ( void );
+
+#endif /* _IPXE_LOGIN_UI_H */
diff --git a/src/include/ipxe/malloc.h b/src/include/ipxe/malloc.h
new file mode 100644
index 0000000..a1b656c
--- /dev/null
+++ b/src/include/ipxe/malloc.h
@@ -0,0 +1,59 @@
+#ifndef _IPXE_MALLOC_H
+#define _IPXE_MALLOC_H
+
+#include <stdint.h>
+
+/** @file
+ *
+ * Dynamic memory allocation
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/*
+ * Prototypes for the standard functions (malloc() et al) are in
+ * stdlib.h.  Include <ipxe/malloc.h> only if you need the
+ * non-standard functions, such as malloc_dma().
+ *
+ */
+#include <stdlib.h>
+
+extern size_t freemem;
+
+extern void * __malloc alloc_memblock ( size_t size, size_t align );
+extern void free_memblock ( void *ptr, size_t size );
+extern void mpopulate ( void *start, size_t len );
+extern void mdumpfree ( void );
+
+/**
+ * Allocate memory for DMA
+ *
+ * @v size		Requested size
+ * @v align		Physical alignment
+ * @ret ptr		Memory, or NULL
+ *
+ * Allocates physically-aligned memory for DMA.
+ *
+ * @c align must be a power of two.  @c size may not be zero.
+ */
+static inline void * __malloc malloc_dma ( size_t size, size_t phys_align ) {
+	return alloc_memblock ( size, phys_align );
+}
+
+/**
+ * Free memory allocated with malloc_dma()
+ *
+ * @v ptr		Memory allocated by malloc_dma(), or NULL
+ * @v size		Size of memory, as passed to malloc_dma()
+ *
+ * Memory allocated with malloc_dma() can only be freed with
+ * free_dma(); it cannot be freed with the standard free().
+ *
+ * If @c ptr is NULL, no action is taken.
+ */
+static inline void free_dma ( void *ptr, size_t size ) {
+	free_memblock ( ptr, size );
+}
+
+#endif /* _IPXE_MALLOC_H */
diff --git a/src/include/ipxe/mca.h b/src/include/ipxe/mca.h
new file mode 100644
index 0000000..79543c1
--- /dev/null
+++ b/src/include/ipxe/mca.h
@@ -0,0 +1,108 @@
+/*
+ * MCA bus driver code
+ *
+ * Abstracted from 3c509.c.
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifndef MCA_H
+#define MCA_H
+
+#include <ipxe/isa_ids.h>
+#include <ipxe/device.h>
+#include <ipxe/tables.h>
+
+/*
+ * MCA constants
+ *
+ */
+#define MCA_MOTHERBOARD_SETUP_REG	0x94
+#define MCA_ADAPTER_SETUP_REG		0x96
+#define MCA_MAX_SLOT_NR			0x07	/* Must be 2^n - 1 */
+#define MCA_POS_REG(n)			(0x100+(n))
+
+/* Is there a standard that would define this? */
+#define GENERIC_MCA_VENDOR ISA_VENDOR ( 'M', 'C', 'A' )
+
+/** An MCA device ID list entry */
+struct mca_device_id {
+	/** Name */
+        const char *name;
+	/** Device ID */
+	uint16_t id;
+};
+
+/** An MCA device */
+struct mca_device {
+	/** Generic device */
+	struct device dev;
+	/** Slot number */
+	unsigned int slot;
+	/** POS register values */
+	unsigned char pos[8];
+	/** Driver for this device */
+	struct mca_driver *driver;
+	/** Driver-private data
+	 *
+	 * Use mca_set_drvdata() and mca_get_drvdata() to access
+	 * this field.
+	 */
+	void *priv;
+	/** Driver name */
+	const char *driver_name;
+};
+
+#define MCA_ID(mca) ( ( (mca)->pos[1] << 8 ) + (mca)->pos[0] )
+
+/** An MCA driver */
+struct mca_driver {
+	/** MCA ID table */
+	struct mca_device_id *ids;
+	/** Number of entries in MCA ID table */
+	unsigned int id_count;
+	/**
+	 * Probe device
+	 *
+	 * @v mca	MCA device
+	 * @v id	Matching entry in ID table
+	 * @ret rc	Return status code
+	 */
+	int ( * probe ) ( struct mca_device *mca,
+			  const struct mca_device_id *id );
+	/**
+	 * Remove device
+	 *
+	 * @v mca	MCA device
+	 */
+	void ( * remove ) ( struct mca_device *mca );
+};
+
+/** MCA driver table */
+#define MCA_DRIVERS __table ( struct mca_driver, "mca_drivers" )
+
+/** Declare an MCA driver */
+#define __mca_driver __table_entry ( MCA_DRIVERS, 01 )
+
+/**
+ * Set MCA driver-private data
+ *
+ * @v mca		MCA device
+ * @v priv		Private data
+ */
+static inline void mca_set_drvdata ( struct mca_device *mca, void *priv ) {
+	mca->priv = priv;
+}
+
+/**
+ * Get MCA driver-private data
+ *
+ * @v mca		MCA device
+ * @ret priv		Private data
+ */
+static inline void * mca_get_drvdata ( struct mca_device *mca ) {
+	return mca->priv;
+}
+
+#endif
diff --git a/src/include/ipxe/md5.h b/src/include/ipxe/md5.h
new file mode 100644
index 0000000..c3dfeb7
--- /dev/null
+++ b/src/include/ipxe/md5.h
@@ -0,0 +1,24 @@
+#ifndef _IPXE_MD5_H
+#define _IPXE_MD5_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct digest_algorithm;
+
+#include <stdint.h>
+
+#define MD5_DIGEST_SIZE		16
+#define MD5_BLOCK_WORDS		16
+#define MD5_HASH_WORDS		4
+
+struct md5_ctx {
+	u32 hash[MD5_HASH_WORDS];
+	u32 block[MD5_BLOCK_WORDS];
+	u64 byte_count;
+};
+
+#define MD5_CTX_SIZE sizeof ( struct md5_ctx )
+
+extern struct digest_algorithm md5_algorithm;
+
+#endif /* _IPXE_MD5_H */
diff --git a/src/include/ipxe/memmap.h b/src/include/ipxe/memmap.h
new file mode 100644
index 0000000..cfd3fe9
--- /dev/null
+++ b/src/include/ipxe/memmap.h
@@ -0,0 +1,36 @@
+#ifndef _IPXE_MEMMAP_H
+#define _IPXE_MEMMAP_H
+
+#include <stdint.h>
+
+/**
+ * @file
+ *
+ * Memory mapping
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** A usable memory region */
+struct memory_region {
+	/** Physical start address */
+	uint64_t start;
+	/** Physical end address */
+	uint64_t end;
+};
+
+/** Maximum number of memory regions we expect to encounter */
+#define MAX_MEMORY_REGIONS 8
+
+/** A memory map */
+struct memory_map {
+	/** Memory regions */
+	struct memory_region regions[MAX_MEMORY_REGIONS];
+	/** Number of used regions */
+	unsigned int count;
+};
+
+extern void get_memmap ( struct memory_map *memmap );
+
+#endif /* _IPXE_MEMMAP_H */
diff --git a/src/include/ipxe/monojob.h b/src/include/ipxe/monojob.h
new file mode 100644
index 0000000..b2f3dfd
--- /dev/null
+++ b/src/include/ipxe/monojob.h
@@ -0,0 +1,17 @@
+#ifndef _IPXE_MONOJOB_H
+#define _IPXE_MONOJOB_H
+
+/** @file
+ *
+ * Single foreground job
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct job_interface;
+
+extern struct job_interface monojob;
+extern int monojob_wait ( const char *string );
+
+#endif /* _IPXE_MONOJOB_H */
diff --git a/src/include/ipxe/nap.h b/src/include/ipxe/nap.h
new file mode 100644
index 0000000..90bd958
--- /dev/null
+++ b/src/include/ipxe/nap.h
@@ -0,0 +1,56 @@
+#ifndef _IPXE_NAP_H
+#define _IPXE_NAP_H
+
+/** @file
+ *
+ * CPU sleeping
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/api.h>
+#include <config/nap.h>
+
+/**
+ * Calculate static inline CPU sleeping API function name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ */
+#define NAP_INLINE( _subsys, _api_func ) \
+	SINGLE_API_INLINE ( NAP_PREFIX_ ## _subsys, _api_func )
+
+/**
+ * Provide an CPU sleeping API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_NAP( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( NAP_PREFIX_ ## _subsys, _api_func, _func )
+
+/**
+ * Provide a static inline CPU sleeping API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ */
+#define PROVIDE_NAP_INLINE( _subsys, _api_func ) \
+	PROVIDE_SINGLE_API_INLINE ( NAP_PREFIX_ ## _subsys, _api_func )
+
+/* Include all architecture-independent I/O API headers */
+#include <ipxe/null_nap.h>
+
+/* Include all architecture-dependent I/O API headers */
+#include <bits/nap.h>
+
+/**
+ * Sleep until next CPU interrupt
+ *
+ */
+void cpu_nap ( void );
+
+#endif /* _IPXE_NAP_H */
diff --git a/src/include/ipxe/ndp.h b/src/include/ipxe/ndp.h
new file mode 100644
index 0000000..42bb2fe
--- /dev/null
+++ b/src/include/ipxe/ndp.h
@@ -0,0 +1,21 @@
+#include <stdint.h>
+#include <byteswap.h>
+#include <string.h>
+#include <ipxe/icmp6.h>
+#include <ipxe/ip6.h>
+#include <ipxe/in.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/tcpip.h>
+
+#define NDP_STATE_INVALID 0
+#define NDP_STATE_INCOMPLETE 1
+#define NDP_STATE_REACHABLE 2
+#define NDP_STATE_DELAY 3
+#define NDP_STATE_PROBE 4
+#define NDP_STATE_STALE 5
+
+int ndp_resolve ( struct net_device *netdev, struct in6_addr *src,
+		  struct in6_addr *dest, void *dest_ll_addr );
+int ndp_process_advert ( struct io_buffer *iobuf, struct sockaddr_tcpip *st_src,
+			 struct sockaddr_tcpip *st_dest );
diff --git a/src/include/ipxe/net80211.h b/src/include/ipxe/net80211.h
new file mode 100644
index 0000000..d70eb7c
--- /dev/null
+++ b/src/include/ipxe/net80211.h
@@ -0,0 +1,1186 @@
+#ifndef _IPXE_NET80211_H
+#define _IPXE_NET80211_H
+
+#include <ipxe/process.h>
+#include <ipxe/ieee80211.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/netdevice.h>
+#include <ipxe/rc80211.h>
+
+/** @file
+ *
+ * The iPXE 802.11 MAC layer.
+ */
+
+/*
+ * Major things NOT YET supported:
+ * - any type of security
+ * - 802.11n
+ *
+ * Major things that probably will NEVER be supported, barring a
+ * compelling use case and/or corporate sponsorship:
+ * - QoS
+ * - 802.1X authentication ("WPA Enterprise")
+ * - Contention-free periods
+ * - "ad-hoc" networks (IBSS), monitor mode, host AP mode
+ * - hidden networks on the 5GHz band due to regulatory issues
+ * - spectrum management on the 5GHz band (TPC and DFS), as required
+ *   in some non-US regulatory domains
+ * - Clause 14 PHYs (Frequency-Hopping Spread Spectrum on 2.4GHz)
+ *   and Clause 16 PHYs (infrared) - I'm not aware of any real-world
+ *   use of these.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/* All 802.11 devices are handled using a generic "802.11 device"
+   net_device, with a link in its `priv' field to a net80211_device
+   which we use to handle 802.11-specific details. */
+
+
+/** @defgroup net80211_band RF bands on which an 802.11 device can transmit */
+/** @{ */
+
+/** The 2.4 GHz ISM band, unlicensed in most countries */
+#define NET80211_BAND_2GHZ	0
+/** The band from 4.9 GHz to 5.7 GHz, which tends to be more restricted */
+#define NET80211_BAND_5GHZ	1
+/** Number of RF bands */
+#define NET80211_NR_BANDS	2
+
+/** Bitmask for the 2GHz band */
+#define NET80211_BAND_BIT_2GHZ	(1 << 0)
+/** Bitmask for the 5GHz band */
+#define NET80211_BAND_BIT_5GHZ	(1 << 1)
+
+/** @} */
+
+
+/** @defgroup net80211_mode 802.11 operation modes supported by hardware */
+/** @{ */
+
+/** 802.11a: 54 Mbps operation using OFDM signaling on the 5GHz band */
+#define NET80211_MODE_A		(1 << 0)
+
+/** 802.11b: 1-11 Mbps operation using DSSS/CCK signaling on the 2.4GHz band */
+#define NET80211_MODE_B		(1 << 1)
+
+/** 802.11g: 54 Mbps operation using ERP/OFDM signaling on the 2.4GHz band */
+#define NET80211_MODE_G		(1 << 2)
+
+/** 802.11n: High-rate operation using MIMO technology on 2.4GHz or 5GHz */
+#define NET80211_MODE_N		(1 << 3)
+
+/** @} */
+
+
+/** @defgroup net80211_cfg Constants for the net80211 config callback */
+/** @{ */
+
+/** Channel choice (@c dev->channel) or regulatory parameters have changed */
+#define NET80211_CFG_CHANNEL	(1 << 0)
+
+/** Requested transmission rate (@c dev->rate) has changed */
+#define NET80211_CFG_RATE	(1 << 1)
+
+/** Association has been established with a new BSS (@c dev->bssid) */
+#define NET80211_CFG_ASSOC	(1 << 2)
+
+/** Low-level link parameters (short preamble, protection, etc) have changed */
+#define NET80211_CFG_PHY_PARAMS	(1 << 3)
+
+/** @} */
+
+
+/** An 802.11 security handshaking protocol */
+enum net80211_security_proto {
+	/** No security handshaking
+	 *
+	 * This might be used with an open network or with WEP, as
+	 * WEP does not have a cryptographic handshaking phase.
+	 */
+	NET80211_SECPROT_NONE = 0,
+
+	/** Pre-shared key handshaking
+	 *
+	 * This implements the "WPA Personal" handshake. 802.1X
+	 * authentication is not performed -- the user supplies a
+	 * pre-shared key directly -- but there is a 4-way handshake
+	 * between client and AP to verify that both have the same key
+	 * without revealing the contents of that key.
+	 */
+	NET80211_SECPROT_PSK = 1,
+
+	/** Full EAP 802.1X handshaking
+	 *
+	 * This implements the "WPA Enterprise" handshake, connecting
+	 * to an 802.1X authentication server to provide credentials
+	 * and receive a pairwise master key (PMK), which is then used
+	 * in the same 4-way handshake as the PSK method.
+	 */
+	NET80211_SECPROT_EAP = 2,
+
+	/** Dummy value used when the handshaking type can't be detected */
+	NET80211_SECPROT_UNKNOWN = 3,
+};
+
+
+/** An 802.11 data encryption algorithm */
+enum net80211_crypto_alg {
+	/** No security, an "Open" network */
+	NET80211_CRYPT_NONE = 0,
+
+	/** Network protected with WEP (awful RC4-based system)
+	 *
+	 * WEP uses a naive application of RC4, with a monotonically
+	 * increasing initialization vector that is prepended to the
+	 * key to initialize the RC4 keystream. It is highly insecure
+	 * and can be completely cracked or subverted using automated,
+	 * robust, freely available tools (aircrack-ng) in minutes.
+	 *
+	 * 40-bit and 104-bit WEP are differentiated only by the size
+	 * of the key. They may be advertised as 64-bit and 128-bit,
+	 * counting the non-random IV as part of the key bits.
+	 */
+	NET80211_CRYPT_WEP = 1,
+
+	/** Network protected with TKIP (better RC4-based system)
+	 *
+	 * Usually known by its trade name of WPA (Wi-Fi Protected
+	 * Access), TKIP implements a message integrity code (MIC)
+	 * called Michael, a timestamp counter for replay prevention,
+	 * and a key mixing function that together remove almost all
+	 * the security problems with WEP. Countermeasures are
+	 * implemented to prevent high data-rate attacks.
+	 *
+	 * There exists one known attack on TKIP, that allows one to
+	 * send between 7 and 15 arbitrary short data packets on a
+	 * QoS-enabled network given about an hour of data
+	 * gathering. Since iPXE does not support QoS for 802.11
+	 * networks, this is not a threat to us. The only other method
+	 * is a brute-force passphrase attack.
+	 */
+	NET80211_CRYPT_TKIP = 2,
+
+	/** Network protected with CCMP (AES-based system)
+	 *
+	 * Often called WPA2 in commerce, or RSNA (Robust Security
+	 * Network Architecture) in the 802.11 standard, CCMP is
+	 * highly secure and does not have any known attack vectors.
+	 * Since it is based on a block cipher, the statistical
+	 * correlation and "chopchop" attacks used with great success
+	 * against WEP and minor success against TKIP fail.
+	 */
+	NET80211_CRYPT_CCMP = 3,
+
+	/** Dummy value used when the cryptosystem can't be detected */
+	NET80211_CRYPT_UNKNOWN = 4,
+};
+
+
+/** @defgroup net80211_state Bits for the 802.11 association state field */
+/** @{ */
+
+/** An error code indicating the failure mode, or 0 if successful */
+#define NET80211_STATUS_MASK    0x7F
+
+/** Whether the error code provided is a "reason" code, not a "status" code */
+#define NET80211_IS_REASON	0x80
+
+/** Whether we have found the network we will be associating with */
+#define NET80211_PROBED		(1 << 8)
+
+/** Whether we have successfully authenticated with the network
+ *
+ * This usually has nothing to do with actual security; it is a
+ * holdover from older 802.11 implementation ideas.
+ */
+#define NET80211_AUTHENTICATED  (1 << 9)
+
+/** Whether we have successfully associated with the network */
+#define NET80211_ASSOCIATED     (1 << 10)
+
+/** Whether we have completed security handshaking with the network
+ *
+ * Once this is set, we can send data packets. For that reason this
+ * bit is set even in cases where no security handshaking is
+ * required.
+ */
+#define NET80211_CRYPTO_SYNCED  (1 << 11)
+
+/** Whether the auto-association task is running */
+#define NET80211_WORKING        (1 << 12)
+
+/** Whether the auto-association task is waiting for a reply from the AP */
+#define NET80211_WAITING        (1 << 13)
+
+/** Whether the auto-association task should be suppressed
+ *
+ * This is set by the `iwlist' command so that it can open the device
+ * without starting another probe process that will interfere with its
+ * own.
+ */
+#define NET80211_NO_ASSOC	(1 << 14)
+
+/** Whether this association was performed using a broadcast SSID
+ *
+ * If the user opened this device without netX/ssid set, the device's
+ * SSID will be set to that of the network it chooses to associate
+ * with, but the netX/ssid setting will remain blank. If we don't
+ * remember that we started from no specified SSID, it will appear
+ * every time settings are updated (e.g. after DHCP) that we need to
+ * reassociate due to the difference between the set SSID and our own.
+ */
+#define NET80211_AUTO_SSID	(1 << 15)
+
+
+/** @} */
+
+
+/** @defgroup net80211_phy 802.11 physical layer flags */
+/** @{ */
+
+/** Whether to use RTS/CTS or CTS-to-self protection for transmissions
+ *
+ * Since the RTS or CTS is transmitted using 802.11b signaling, and
+ * includes a field indicating the amount of time that will be used by
+ * transmission of the following packet, this serves as an effective
+ * protection mechanism to avoid 802.11b clients interfering with
+ * 802.11g clients on mixed networks.
+ */
+#define NET80211_PHY_USE_PROTECTION      (1 << 1)
+
+/** Whether to use 802.11b short preamble operation
+ *
+ * Short-preamble operation can moderately increase throughput on
+ * 802.11b networks operating between 2Mbps and 11Mbps. It is
+ * irrelevant for 802.11g data rates, since they use a different
+ * modulation scheme.
+ */
+#define NET80211_PHY_USE_SHORT_PREAMBLE  (1 << 2)
+
+/** Whether to use 802.11g short slot operation
+ *
+ * This affects a low-level timing parameter of 802.11g transmissions.
+ */
+#define NET80211_PHY_USE_SHORT_SLOT      (1 << 3)
+
+/** @} */
+
+
+/** The maximum number of TX rates we allow to be configured simultaneously */
+#define NET80211_MAX_RATES	16
+
+/** The maximum number of channels we allow to be configured simultaneously */
+#define NET80211_MAX_CHANNELS	32
+
+/** Seconds we'll wait to get all fragments of a packet */
+#define NET80211_FRAG_TIMEOUT	2
+
+/** The number of fragments we can receive at once
+ *
+ * The 802.11 standard requires that this be at least 3.
+ */
+#define NET80211_NR_CONCURRENT_FRAGS 3
+
+/** Maximum TX power to allow (dBm), if we don't get a regulatory hint */
+#define NET80211_REG_TXPOWER	20
+
+
+struct net80211_device;
+
+/** Operations that must be implemented by an 802.11 driver */
+struct net80211_device_operations {
+	/** Open 802.11 device
+	 *
+	 * @v dev	802.11 device
+	 * @ret rc	Return status code
+	 *
+	 * This method should allocate RX I/O buffers and enable the
+	 * hardware to start transmitting and receiving packets on the
+	 * channels its net80211_register() call indicated it could
+	 * handle. It does not need to tune the antenna to receive
+	 * packets on any particular channel.
+	 */
+	int ( * open ) ( struct net80211_device *dev );
+
+	/** Close 802.11 network device
+	 *
+	 * @v dev	802.11 device
+	 *
+	 * This method should stop the flow of packets, and call
+	 * net80211_tx_complete() for any packets remaining in the
+	 * device's TX queue.
+	 */
+	void ( * close ) ( struct net80211_device *dev );
+
+	/** Transmit packet on 802.11 network device
+	 *
+	 * @v dev	802.11 device
+	 * @v iobuf	I/O buffer
+	 * @ret rc	Return status code
+	 *
+	 * This method should cause the hardware to initiate
+	 * transmission of the I/O buffer, using the channel and rate
+	 * most recently indicated by an appropriate call to the
+	 * @c config callback. The 802.11 layer guarantees that said
+	 * channel and rate will be the same as those currently
+	 * reflected in the fields of @a dev.
+	 *
+	 * If this method returns success, the I/O buffer remains
+	 * owned by the network layer's TX queue, and the driver must
+	 * eventually call net80211_tx_complete() to free the buffer
+	 * whether transmission succeeded or not. If this method
+	 * returns failure, it will be interpreted as "failure to
+	 * enqueue buffer" and the I/O buffer will be immediately
+	 * released.
+	 *
+	 * This method is guaranteed to be called only when the device
+	 * is open.
+	 */
+	int ( * transmit ) ( struct net80211_device *dev,
+			     struct io_buffer *iobuf );
+
+	/** Poll for completed and received packets
+	 *
+	 * @v dev	802.11 device
+	 *
+	 * This method should cause the hardware to check for
+	 * completed transmissions and received packets. Any received
+	 * packets should be delivered via net80211_rx(), and
+	 * completed transmissions should be indicated using
+	 * net80211_tx_complete().
+	 *
+	 * This method is guaranteed to be called only when the device
+	 * is open.
+	 */
+	void ( * poll ) ( struct net80211_device *dev );
+
+	/** Enable or disable interrupts
+	 *
+	 * @v dev	802.11 device
+	 * @v enable	If TRUE, interrupts should be enabled
+	 */
+	void ( * irq ) ( struct net80211_device *dev, int enable );
+
+	/** Update hardware state to match 802.11 layer state
+	 *
+	 * @v dev	802.11 device
+	 * @v changed	Set of flags indicating what may have changed
+	 * @ret rc	Return status code
+	 *
+	 * This method should cause the hardware state to be
+	 * reinitialized from the state indicated in fields of
+	 * net80211_device, in the areas indicated by bits set in
+	 * @a changed. If the hardware is unable to do so, this method
+	 * may return an appropriate error indication.
+	 *
+	 * This method is guaranteed to be called only when the device
+	 * is open.
+	 */
+	int ( * config ) ( struct net80211_device *dev, int changed );
+};
+
+/** An 802.11 RF channel. */
+struct net80211_channel
+{
+	/** The band with which this channel is associated */
+	u8 band;
+
+	/** A channel number interpreted according to the band
+	 *
+	 * The 2.4GHz band uses channel numbers from 1-13 at 5MHz
+	 * intervals such that channel 1 is 2407 MHz; channel 14,
+	 * legal for use only in Japan, is defined separately as 2484
+	 * MHz. Adjacent channels will overlap, since 802.11
+	 * transmissions use a 20 MHz (4-channel) bandwidth. Most
+	 * commonly, channels 1, 6, and 11 are used.
+	 *
+	 * The 5GHz band uses channel numbers derived directly from
+	 * the frequency; channel 0 is 5000 MHz, and channels are
+	 * always spaced 5 MHz apart. Channel numbers over 180 are
+	 * relative to 4GHz instead of 5GHz, but these are rarely
+	 * seen. Most channels are not legal for use.
+	 */
+	u8 channel_nr;
+
+	/** The center frequency for this channel
+	 *
+	 * Currently a bandwidth of 20 MHz is assumed.
+	 */
+	u16 center_freq;
+
+	/** Hardware channel value */
+	u16 hw_value;
+
+	/** Maximum allowable transmit power, in dBm
+	 *
+	 * This should be interpreted as EIRP, the power supplied to
+	 * an ideal isotropic antenna in order to achieve the same
+	 * average signal intensity as the real hardware at a
+	 * particular distance.
+	 *
+	 * Currently no provision is made for directional antennas.
+	 */
+	u8 maxpower;
+};
+
+/** Information on the capabilities of an 802.11 hardware device
+ *
+ * In its probe callback, an 802.11 driver must read hardware
+ * registers to determine the appropriate contents of this structure,
+ * fill it, and pass it to net80211_register() so that the 802.11
+ * layer knows how to treat the hardware and what to advertise as
+ * supported to access points.
+ */
+struct net80211_hw_info
+{
+	/** Default hardware MAC address.
+	 *
+	 * The user may change this by setting the @c netX/mac setting
+	 * before the driver's open function is called; in that case
+	 * the driver must set the hardware MAC address to the address
+	 * contained in the wrapping net_device's ll_addr field, or if
+	 * that is impossible, set that ll_addr field back to the
+	 * unchangeable hardware MAC address.
+	 */
+	u8 hwaddr[ETH_ALEN];
+
+	/** A bitwise OR of the 802.11x modes supported by this device */
+	int modes;
+
+	/** A bitwise OR of the bands on which this device can communicate */
+	int bands;
+
+	/** A set of flags indicating peculiarities of this device. */
+	enum {
+		/** Received frames include a frame check sequence. */
+		NET80211_HW_RX_HAS_FCS = (1 << 1),
+
+		/** Hardware doesn't support 2.4GHz short preambles
+		 *
+		 * This is only relevant for 802.11b operation above
+		 * 2Mbps. All 802.11g devices support short preambles.
+		 */
+		NET80211_HW_NO_SHORT_PREAMBLE = (1 << 2),
+
+		/** Hardware doesn't support 802.11g short slot operation */
+		NET80211_HW_NO_SHORT_SLOT = (1 << 3),
+	} flags;
+
+	/** Signal strength information that can be provided by the device
+	 *
+	 * Signal strength is passed to net80211_rx(), primarily to
+	 * allow determination of the closest access point for a
+	 * multi-AP network. The units are provided for completeness
+	 * of status displays.
+	 */
+	enum {
+		/** No signal strength information supported */
+		NET80211_SIGNAL_NONE = 0,
+		/** Signal strength in arbitrary units */
+		NET80211_SIGNAL_ARBITRARY,
+		/** Signal strength in decibels relative to arbitrary base */
+		NET80211_SIGNAL_DB,
+		/** Signal strength in decibels relative to 1mW */
+		NET80211_SIGNAL_DBM,
+	} signal_type;
+
+	/** Maximum signal in arbitrary cases
+	 *
+	 * If signal_type is NET80211_SIGNAL_ARBITRARY or
+	 * NET80211_SIGNAL_DB, the driver should report it on a scale
+	 * from 0 to signal_max.
+	 */
+	unsigned signal_max;
+
+	/** List of RF channels supported by the card */
+	struct net80211_channel channels[NET80211_MAX_CHANNELS];
+
+	/** Number of supported channels */
+	int nr_channels;
+
+	/** List of transmission rates supported by the card, indexed by band
+	 *
+	 * Rates should be in 100kbps increments (e.g. 11 Mbps would
+	 * be represented as the number 110).
+	 */
+	u16 rates[NET80211_NR_BANDS][NET80211_MAX_RATES];
+
+	/** Number of supported rates, indexed by band */
+	int nr_rates[NET80211_NR_BANDS];
+
+	/** Estimate of the time required to change channels, in microseconds
+	 *
+	 * If this is not known, a guess on the order of a few
+	 * milliseconds (value of 1000-5000) is reasonable.
+	 */
+	unsigned channel_change_time;
+};
+
+/** Structure tracking received fragments for a packet
+ *
+ * We set up a fragment cache entry when we receive a packet marked as
+ * fragment 0 with the "more fragments" bit set in its frame control
+ * header. We are required by the 802.11 standard to track 3
+ * fragmented packets arriving simultaneously; if we receive more we
+ * may drop some. Upon receipt of a new fragment-0 packet, if no entry
+ * is available or expired, we take over the most @e recent entry for
+ * the new packet, since we don't want to starve old entries from ever
+ * finishing at all. If we get a fragment after the zeroth with no
+ * cache entry for its packet, we drop it.
+ */
+struct net80211_frag_cache
+{
+	/** Whether this cache entry is in use */
+	u8 in_use;
+
+	/** Sequence number of this MSDU (packet) */
+	u16 seqnr;
+
+	/** Timestamp from point at which first fragment was collected */
+	u32 start_ticks;
+
+	/** Buffers for each fragment */
+	struct io_buffer *iob[16];
+};
+
+
+/** Interface to an 802.11 security handshaking protocol
+ *
+ * Security handshaking protocols handle parsing a user-specified key
+ * into a suitable input to the encryption algorithm, and for WPA and
+ * better systems, manage performing whatever authentication with the
+ * network is necessary.
+ *
+ * At all times when any method in this structure is called with a
+ * net80211_device argument @a dev, a dynamically allocated copy of
+ * the handshaker structure itself with space for the requested amount
+ * of private data may be accessed as @c dev->handshaker. The
+ * structure will not be modified, and will only be freed during
+ * reassociation and device closing after the @a stop method has been
+ * called.
+ */
+struct net80211_handshaker
+{
+	/** The security handshaking protocol implemented */
+	enum net80211_security_proto protocol;
+
+	/** Initialize security handshaking protocol
+	 *
+	 * @v dev	802.11 device
+	 * @ret rc	Return status code
+	 *
+	 * This method is expected to access @c netX/key or other
+	 * applicable settings to determine the parameters for
+	 * handshaking. If no handshaking is required, it should call
+	 * sec80211_install() with the cryptosystem and key that are
+	 * to be used, and @c start and @c step should be set to @c
+	 * NULL.
+	 *
+	 * This is always called just before association is performed,
+	 * but after its parameters have been set; in particular, you
+	 * may rely on the contents of the @a essid field in @a dev.
+	 */
+	int ( * init ) ( struct net80211_device *dev );
+
+	/** Start handshaking
+	 *
+	 * @v dev	802.11 device
+	 * @ret rc	Return status code
+	 *
+	 * This method is expected to set up internal state so that
+	 * packets sent immediately after association, before @a step
+	 * can be called, will be handled appropriately.
+	 *
+	 * This is always called just before association is attempted.
+	 */
+	int ( * start ) ( struct net80211_device *dev );
+
+	/** Process handshaking state
+	 *
+	 * @v dev	802.11 device
+	 * @ret rc	Return status code, or positive if done
+	 *
+	 * This method is expected to perform as much progress on the
+	 * protocol it implements as is possible without blocking. It
+	 * should return 0 if it wishes to be called again, a negative
+	 * return status code on error, or a positive value if
+	 * handshaking is complete. In the case of a positive return,
+	 * net80211_crypto_install() must have been called.
+	 *
+	 * If handshaking may require further action (e.g. an AP that
+	 * might decide to rekey), handlers must be installed by this
+	 * function that will act without further calls to @a step.
+	 */
+	int ( * step ) ( struct net80211_device *dev );
+
+	/** Change cryptographic key based on setting
+	 *
+	 * @v dev	802.11 device
+	 * @ret rc	Return status code
+	 *
+	 * This method is called whenever the @c netX/key setting
+	 * @e may have been changed. It is expected to determine
+	 * whether it did in fact change, and if so, to install the
+	 * new key using net80211_crypto_install(). If it is not
+	 * possible to do this immediately, this method should return
+	 * an error; in that case the 802.11 stack will reassociate,
+	 * following the usual init/start/step sequence.
+	 *
+	 * This method is only relevant when it is possible to
+	 * associate successfully with an incorrect key. When it is
+	 * not, a failed association will be retried until the user
+	 * changes the key setting, and a successful association will
+	 * not be dropped due to such a change. When association with
+	 * an incorrect key is impossible, this function should return
+	 * 0 after performing no action.
+	 */
+	int ( * change_key ) ( struct net80211_device *dev );
+
+	/** Stop security handshaking handlers
+	 *
+	 * @v dev	802.11 device
+	 *
+	 * This method is called just before freeing a security
+	 * handshaker; it could, for example, delete a process that @a
+	 * start had created to manage the security of the connection.
+	 * If not needed it may be set to NULL.
+	 */
+	void ( * stop ) ( struct net80211_device *dev );
+
+	/** Amount of private data requested
+	 *
+	 * Before @c init is called for the first time, this structure's
+	 * @c priv pointer will point to this many bytes of allocated
+	 * data, where the allocation will be performed separately for
+	 * each net80211_device.
+	 */
+	int priv_len;
+
+	/** Whether @a start has been called
+	 *
+	 * Reset to 0 after @a stop is called.
+	 */
+	int started;
+
+	/** Pointer to private data
+	 *
+	 * In initializing this structure statically for a linker
+	 * table, set this to NULL.
+	 */
+	void *priv;
+};
+
+#define NET80211_HANDSHAKERS __table ( struct net80211_handshaker, \
+				       "net80211_handshakers" )
+#define __net80211_handshaker __table_entry ( NET80211_HANDSHAKERS, 01 )
+
+
+/** Interface to an 802.11 cryptosystem
+ *
+ * Cryptosystems define a net80211_crypto structure statically, using
+ * a iPXE linker table to make it available to the 802.11 layer. When
+ * the cryptosystem needs to be used, the 802.11 code will allocate a
+ * copy of the static definition plus whatever space the algorithm has
+ * requested for private state, and point net80211_device::crypto or
+ * net80211_device::gcrypto at it.
+ */
+struct net80211_crypto
+{
+	/** The cryptographic algorithm implemented */
+	enum net80211_crypto_alg algorithm;
+
+	/** Initialize cryptosystem using a given key
+	 *
+	 * @v crypto	802.11 cryptosystem
+	 * @v key	Pointer to key bytes
+	 * @v keylen	Number of key bytes
+	 * @v rsc	Initial receive sequence counter, if applicable
+	 * @ret rc	Return status code
+	 *
+	 * This method is passed the communication key provided by the
+	 * security handshake handler, which will already be in the
+	 * low-level form required. It may not store a pointer to the
+	 * key after returning; it must copy it to its private storage.
+	 */
+	int ( * init ) ( struct net80211_crypto *crypto, const void *key,
+			 int keylen, const void *rsc );
+
+	/** Encrypt a frame using the cryptosystem
+	 *
+	 * @v crypto	802.11 cryptosystem
+	 * @v iob	I/O buffer
+	 * @ret eiob	Newly allocated I/O buffer with encrypted packet
+	 *
+	 * This method is called to encrypt a single frame. It is
+	 * guaranteed that initialize() will have completed
+	 * successfully before this method is called.
+	 *
+	 * The frame passed already has an 802.11 header prepended,
+	 * but the PROTECTED bit in the frame control field will not
+	 * be set; this method is responsible for setting it. The
+	 * returned I/O buffer should contain a complete copy of @a
+	 * iob, including the 802.11 header, but with the PROTECTED
+	 * bit set, the data encrypted, and whatever encryption
+	 * headers/trailers are necessary added.
+	 *
+	 * This method should never free the passed I/O buffer.
+	 *
+	 * Return NULL if the packet could not be encrypted, due to
+	 * memory limitations or otherwise.
+	 */
+	struct io_buffer * ( * encrypt ) ( struct net80211_crypto *crypto,
+					   struct io_buffer *iob );
+
+	/** Decrypt a frame using the cryptosystem
+	 *
+	 * @v crypto	802.11 cryptosystem
+	 * @v eiob	Encrypted I/O buffer
+	 * @ret iob	Newly allocated I/O buffer with decrypted packet
+	 *
+	 * This method is called to decrypt a single frame. It is
+	 * guaranteed that initialize() will have completed
+	 * successfully before this method is called.
+	 *
+	 * Decryption follows the reverse of the pattern used for
+	 * encryption: this method must copy the 802.11 header into
+	 * the returned packet, decrypt the data stream, remove any
+	 * encryption header or trailer, and clear the PROTECTED bit
+	 * in the frame control header.
+	 *
+	 * This method should never free the passed I/O buffer.
+	 *
+	 * Return NULL if memory was not available for decryption, if
+	 * a consistency or integrity check on the decrypted frame
+	 * failed, or if the decrypted frame should not be processed
+	 * by the network stack for any other reason.
+	 */
+	struct io_buffer * ( * decrypt ) ( struct net80211_crypto *crypto,
+					   struct io_buffer *iob );
+
+	/** Length of private data requested to be allocated */
+	int priv_len;
+
+	/** Private data for the algorithm to store key and state info */
+	void *priv;
+};
+
+#define NET80211_CRYPTOS __table ( struct net80211_crypto, "net80211_cryptos" )
+#define __net80211_crypto __table_entry ( NET80211_CRYPTOS, 01 )
+
+
+struct net80211_probe_ctx;
+struct net80211_assoc_ctx;
+
+
+/** Structure encapsulating the complete state of an 802.11 device
+ *
+ * An 802.11 device is always wrapped by a network device, and this
+ * network device is always pointed to by the @a netdev field. In
+ * general, operations should never be performed by 802.11 code using
+ * netdev functions directly. It is usually the case that the 802.11
+ * layer might need to do some processing or bookkeeping on top of
+ * what the netdevice code will do.
+ */
+struct net80211_device
+{
+	/** The net_device that wraps us. */
+	struct net_device *netdev;
+
+	/** List of 802.11 devices. */
+	struct list_head list;
+
+	/** 802.11 device operations */
+	struct net80211_device_operations *op;
+
+	/** Driver private data */
+	void *priv;
+
+	/** Information about the hardware, provided to net80211_register() */
+	struct net80211_hw_info *hw;
+
+	/* ---------- Channel and rate fields ---------- */
+
+	/** A list of all possible channels we might use */
+	struct net80211_channel channels[NET80211_MAX_CHANNELS];
+
+	/** The number of channels in the channels array */
+	u8 nr_channels;
+
+	/** The channel currently in use, as an index into the channels array */
+	u8 channel;
+
+	/** A list of all possible TX rates we might use
+	 *
+	 * Rates are in units of 100 kbps.
+	 */
+	u16 rates[NET80211_MAX_RATES];
+
+	/** The number of transmission rates in the rates array */
+	u8 nr_rates;
+
+	/** The rate currently in use, as an index into the rates array */
+	u8 rate;
+
+	/** The rate to use for RTS/CTS transmissions
+	 *
+	 * This is always the fastest basic rate that is not faster
+	 * than the data rate in use. Also an index into the rates array.
+	 */
+	u8 rtscts_rate;
+
+	/** Bitmask of basic rates
+	 *
+	 * If bit N is set in this value, with the LSB considered to
+	 * be bit 0, then rate N in the rates array is a "basic" rate.
+	 *
+	 * We don't decide which rates are "basic"; our AP does, and
+	 * we respect its wishes. We need to be able to identify basic
+	 * rates in order to calculate the duration of a CTS packet
+	 * used for 802.11 g/b interoperability.
+	 */
+	u32 basic_rates;
+
+	/* ---------- Association fields ---------- */
+
+	/** The asynchronous association process.
+	 *
+	 * When an 802.11 netdev is opened, or when the user changes
+	 * the SSID setting on an open 802.11 device, an
+	 * autoassociation task is started by net80211_autoassocate()
+	 * to associate with the new best network. The association is
+	 * asynchronous, but no packets can be transmitted until it is
+	 * complete. If it is successful, the wrapping net_device is
+	 * set as "link up". If it fails, @c assoc_rc will be set with
+	 * an error indication.
+	 */
+	struct process proc_assoc;
+
+	/** Network with which we are associating
+	 *
+	 * This will be NULL when we are not actively in the process
+	 * of associating with a network we have already successfully
+	 * probed for.
+	 */
+	struct net80211_wlan *associating;
+
+	/** Context for the association process
+	 *
+	 * This is a probe_ctx if the @c PROBED flag is not set in @c
+	 * state, and an assoc_ctx otherwise.
+	 */
+	union {
+		struct net80211_probe_ctx *probe;
+		struct net80211_assoc_ctx *assoc;
+	} ctx;
+
+	/** Security handshaker being used */
+	struct net80211_handshaker *handshaker;
+
+	/** State of our association to the network
+	 *
+	 * Since the association process happens asynchronously, it's
+	 * necessary to have some channel of communication so the
+	 * driver can say "I got an association reply and we're OK" or
+	 * similar. This variable provides that link. It is a bitmask
+	 * of any of NET80211_PROBED, NET80211_AUTHENTICATED,
+	 * NET80211_ASSOCIATED, NET80211_CRYPTO_SYNCED to indicate how
+	 * far along in associating we are; NET80211_WORKING if the
+	 * association task is running; and NET80211_WAITING if a
+	 * packet has been sent that we're waiting for a reply to. We
+	 * can only be crypto-synced if we're associated, we can
+	 * only be associated if we're authenticated, we can only be
+	 * authenticated if we've probed.
+	 *
+	 * If an association process fails (that is, we receive a
+	 * packet with an error indication), the error code is copied
+	 * into bits 6-0 of this variable and bit 7 is set to specify
+	 * what type of error code it is. An AP can provide either a
+	 * "status code" (0-51 are defined) explaining why it refused
+	 * an association immediately, or a "reason code" (0-45 are
+	 * defined) explaining why it canceled an association after it
+	 * had originally OK'ed it. Status and reason codes serve
+	 * similar functions, but they use separate error message
+	 * tables. A iPXE-formatted return status code (negative) is
+	 * placed in @c assoc_rc.
+	 *
+	 * If the failure to associate is indicated by a status code,
+	 * the NET80211_IS_REASON bit will be clear; if it is
+	 * indicated by a reason code, the bit will be set. If we were
+	 * successful, both zero status and zero reason mean success,
+	 * so there is no ambiguity.
+	 *
+	 * To prevent association when opening the device, user code
+	 * can set the NET80211_NO_ASSOC bit. The final bit in this
+	 * variable, NET80211_AUTO_SSID, is used to remember whether
+	 * we picked our SSID through automated probing as opposed to
+	 * user specification; the distinction becomes relevant in the
+	 * settings applicator.
+	 */
+	u16 state;
+
+	/** Return status code associated with @c state */
+	int assoc_rc;
+
+	/** RSN or WPA information element to include with association
+	 *
+	 * If set to @c NULL, none will be included. It is expected
+	 * that this will be set by the @a init function of a security
+	 * handshaker if it is needed.
+	 */
+	union ieee80211_ie *rsn_ie;
+
+	/* ---------- Parameters of currently associated network ---------- */
+
+	/** 802.11 cryptosystem for our current network
+	 *
+	 * For an open network, this will be set to NULL.
+	 */
+	struct net80211_crypto *crypto;
+
+	/** 802.11 cryptosystem for multicast and broadcast frames
+	 *
+	 * If this is NULL, the cryptosystem used for receiving
+	 * unicast frames will also be used for receiving multicast
+	 * and broadcast frames. Transmitted multicast and broadcast
+	 * frames are always sent unicast to the AP, who multicasts
+	 * them on our behalf; thus they always use the unicast
+	 * cryptosystem.
+	 */
+	struct net80211_crypto *gcrypto;
+
+	/** MAC address of the access point most recently associated */
+	u8 bssid[ETH_ALEN];
+
+	/** SSID of the access point we are or will be associated with
+	 *
+	 * Although the SSID field in 802.11 packets is generally not
+	 * NUL-terminated, here and in net80211_wlan we add a NUL for
+	 * convenience.
+	 */
+	char essid[IEEE80211_MAX_SSID_LEN+1];
+
+	/** Association ID given to us by the AP */
+	u16 aid;
+
+	/** TSFT value for last beacon received, microseconds */
+	u64 last_beacon_timestamp;
+
+	/** Time between AP sending beacons, microseconds */
+	u32 tx_beacon_interval;
+
+	/** Smoothed average time between beacons, microseconds */
+	u32 rx_beacon_interval;
+
+	/* ---------- Physical layer information ---------- */
+
+	/** Physical layer options
+	 *
+	 * These control the use of CTS protection, short preambles,
+	 * and short-slot operation.
+	 */
+	int phy_flags;
+
+	/** Signal strength of last received packet */
+	int last_signal;
+
+	/** Rate control state */
+	struct rc80211_ctx *rctl;
+
+	/* ---------- Packet handling state ---------- */
+
+	/** Fragment reassembly state */
+	struct net80211_frag_cache frags[NET80211_NR_CONCURRENT_FRAGS];
+
+	/** The sequence number of the last packet we sent */
+	u16 last_tx_seqnr;
+
+	/** Packet duplication elimination state
+	 *
+	 * We are only required to handle immediate duplicates for
+	 * each direct sender, and since we can only have one direct
+	 * sender (the AP), we need only keep the sequence control
+	 * field from the most recent packet we've received. Thus,
+	 * this field stores the last sequence control field we've
+	 * received for a packet from the AP.
+	 */
+	u16 last_rx_seq;
+
+	/** RX management packet queue
+	 *
+	 * Sometimes we want to keep probe, beacon, and action packets
+	 * that we receive, such as when we're scanning for networks.
+	 * Ordinarily we drop them because they are sent at a large
+	 * volume (ten beacons per second per AP, broadcast) and we
+	 * have no need of them except when we're scanning.
+	 *
+	 * When keep_mgmt is TRUE, received probe, beacon, and action
+	 * management packets will be stored in this queue.
+	 */
+	struct list_head mgmt_queue;
+
+	/** RX management packet info queue
+	 *
+	 * We need to keep track of the signal strength for management
+	 * packets we're keeping, because that provides the only way
+	 * to distinguish between multiple APs for the same network.
+	 * Since we can't extend io_buffer to store signal, this field
+	 * heads a linked list of "RX packet info" structures that
+	 * contain that signal strength field. Its entries always
+	 * parallel the entries in mgmt_queue, because the two queues
+	 * are always added to or removed from in parallel.
+	 */
+	struct list_head mgmt_info_queue;
+
+	/** Whether to store management packets
+	 *
+	 * Received beacon, probe, and action packets will be added to
+	 * mgmt_queue (and their signal strengths added to
+	 * mgmt_info_queue) only when this variable is TRUE. It should
+	 * be set by net80211_keep_mgmt() (which returns the old
+	 * value) only when calling code is prepared to poll the
+	 * management queue frequently, because packets will otherwise
+	 * pile up and exhaust memory.
+	 */
+	int keep_mgmt;
+};
+
+/** Structure representing a probed network.
+ *
+ * This is returned from the net80211_probe_finish functions and
+ * passed to the low-level association functions. At least essid,
+ * bssid, channel, beacon, and security must be filled in if you want
+ * to build this structure manually.
+ */
+struct net80211_wlan
+{
+	/** The human-readable ESSID (network name)
+	 *
+	 * Although the 802.11 SSID field is generally not
+	 * NUL-terminated, the iPXE code adds an extra NUL (and
+	 * expects one in this structure) for convenience.
+	 */
+	char essid[IEEE80211_MAX_SSID_LEN+1];
+
+	/** MAC address of the strongest-signal access point for this ESSID */
+	u8 bssid[ETH_ALEN];
+
+	/** Signal strength of beacon frame from that access point */
+	int signal;
+
+	/** The channel on which that access point communicates
+	 *
+	 * This is a raw channel number (net80211_channel::channel_nr),
+	 * so that it will not be affected by reconfiguration of the
+	 * device channels array.
+	 */
+	int channel;
+
+	/** The complete beacon or probe-response frame received */
+	struct io_buffer *beacon;
+
+	/** Security handshaking method used on the network */
+	enum net80211_security_proto handshaking;
+
+	/** Cryptographic algorithm used on the network */
+	enum net80211_crypto_alg crypto;
+
+	/** Link to allow chaining multiple structures into a list to
+	    be returned from net80211_probe_finish_all(). */
+	struct list_head list;
+};
+
+
+/** 802.11 encryption key setting */
+extern struct setting net80211_key_setting __setting;
+
+
+/**
+ * @defgroup net80211_probe 802.11 network location API
+ * @{
+ */
+int net80211_prepare_probe ( struct net80211_device *dev, int band,
+			     int active );
+struct net80211_probe_ctx * net80211_probe_start ( struct net80211_device *dev,
+						   const char *essid,
+						   int active );
+int net80211_probe_step ( struct net80211_probe_ctx *ctx );
+struct net80211_wlan *
+net80211_probe_finish_best ( struct net80211_probe_ctx *ctx );
+struct list_head *net80211_probe_finish_all ( struct net80211_probe_ctx *ctx );
+
+void net80211_free_wlan ( struct net80211_wlan *wlan );
+void net80211_free_wlanlist ( struct list_head *list );
+/** @} */
+
+
+/**
+ * @defgroup net80211_mgmt 802.11 network management API
+ * @{
+ */
+struct net80211_device * net80211_get ( struct net_device *netdev );
+void net80211_autoassociate ( struct net80211_device *dev );
+
+int net80211_change_channel ( struct net80211_device *dev, int channel );
+void net80211_set_rate_idx ( struct net80211_device *dev, int rate );
+
+int net80211_keep_mgmt ( struct net80211_device *dev, int enable );
+struct io_buffer * net80211_mgmt_dequeue ( struct net80211_device *dev,
+					   int *signal );
+int net80211_tx_mgmt ( struct net80211_device *dev, u16 fc,
+		       u8 bssid[ETH_ALEN], struct io_buffer *iob );
+/** @} */
+
+
+/**
+ * @defgroup net80211_assoc 802.11 network association API
+ * @{
+ */
+int net80211_prepare_assoc ( struct net80211_device *dev,
+			     struct net80211_wlan *wlan );
+int net80211_send_auth ( struct net80211_device *dev,
+			 struct net80211_wlan *wlan, int method );
+int net80211_send_assoc ( struct net80211_device *dev,
+			  struct net80211_wlan *wlan );
+void net80211_deauthenticate ( struct net80211_device *dev, int rc );
+/** @} */
+
+
+/**
+ * @defgroup net80211_driver 802.11 driver interface API
+ * @{
+ */
+struct net80211_device *net80211_alloc ( size_t priv_size );
+int net80211_register ( struct net80211_device *dev,
+			struct net80211_device_operations *ops,
+			struct net80211_hw_info *hw );
+u16 net80211_duration ( struct net80211_device *dev, int bytes, u16 rate );
+void net80211_rx ( struct net80211_device *dev, struct io_buffer *iob,
+		   int signal, u16 rate );
+void net80211_rx_err ( struct net80211_device *dev,
+		       struct io_buffer *iob, int rc );
+void net80211_tx_complete ( struct net80211_device *dev,
+			    struct io_buffer *iob, int retries, int rc );
+void net80211_unregister ( struct net80211_device *dev );
+void net80211_free ( struct net80211_device *dev );
+/** @} */
+
+/**
+ * Calculate duration field for a CTS control frame
+ *
+ * @v dev	802.11 device
+ * @v size	Size of the packet being cleared to send
+ *
+ * A CTS control frame's duration field captures the frame being
+ * protected and its 10-byte ACK.
+ */
+static inline u16 net80211_cts_duration ( struct net80211_device *dev,
+					  int size )
+{
+	return ( net80211_duration ( dev, 10,
+				     dev->rates[dev->rtscts_rate] ) +
+		 net80211_duration ( dev, size, dev->rates[dev->rate] ) );
+}
+
+#endif
diff --git a/src/include/ipxe/netdevice.h b/src/include/ipxe/netdevice.h
new file mode 100644
index 0000000..f829327
--- /dev/null
+++ b/src/include/ipxe/netdevice.h
@@ -0,0 +1,557 @@
+#ifndef _IPXE_NETDEVICE_H
+#define _IPXE_NETDEVICE_H
+
+/** @file
+ *
+ * Network device management
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/list.h>
+#include <ipxe/tables.h>
+#include <ipxe/refcnt.h>
+#include <ipxe/settings.h>
+
+struct io_buffer;
+struct net_device;
+struct net_protocol;
+struct ll_protocol;
+struct device;
+
+/** Maximum length of a hardware address
+ *
+ * The longest currently-supported link-layer address is for IPoIB.
+ */
+#define MAX_HW_ADDR_LEN 8
+
+/** Maximum length of a link-layer address
+ *
+ * The longest currently-supported link-layer address is for IPoIB.
+ */
+#define MAX_LL_ADDR_LEN 20
+
+/** Maximum length of a link-layer header
+ *
+ * The longest currently-supported link-layer header is for 802.11: a
+ * 24-byte frame header plus an 8-byte 802.3 LLC/SNAP header.  (The
+ * IPoIB link-layer pseudo-header doesn't actually include link-layer
+ * addresses; see ipoib.c for details).
+ */
+#define MAX_LL_HEADER_LEN 32
+
+/** Maximum length of a network-layer address */
+#define MAX_NET_ADDR_LEN 4
+
+/**
+ * A network-layer protocol
+ *
+ */
+struct net_protocol {
+	/** Protocol name */
+	const char *name;
+	/**
+	 * Process received packet
+	 *
+	 * @v iobuf	I/O buffer
+	 * @v netdev	Network device
+	 * @v ll_source	Link-layer source address
+	 *
+	 * This method takes ownership of the I/O buffer.
+	 */
+	int ( * rx ) ( struct io_buffer *iobuf, struct net_device *netdev,
+		       const void *ll_source );
+	/**
+	 * Transcribe network-layer address
+	 *
+	 * @v net_addr	Network-layer address
+	 * @ret string	Human-readable transcription of address
+	 *
+	 * This method should convert the network-layer address into a
+	 * human-readable format (e.g. dotted quad notation for IPv4).
+	 *
+	 * The buffer used to hold the transcription is statically
+	 * allocated.
+	 */
+	const char * ( *ntoa ) ( const void * net_addr );
+	/** Network-layer protocol
+	 *
+	 * This is an ETH_P_XXX constant, in network-byte order
+	 */
+	uint16_t net_proto;
+	/** Network-layer address length */
+	uint8_t net_addr_len;
+};
+
+/**
+ * A link-layer protocol
+ *
+ */
+struct ll_protocol {
+	/** Protocol name */
+	const char *name;
+	/**
+	 * Add link-layer header
+	 *
+	 * @v netdev		Network device
+	 * @v iobuf		I/O buffer
+	 * @v ll_dest		Link-layer destination address
+	 * @v ll_source		Source link-layer address
+	 * @v net_proto		Network-layer protocol, in network-byte order
+	 * @ret rc		Return status code
+	 */
+	int ( * push ) ( struct net_device *netdev, struct io_buffer *iobuf,
+			 const void *ll_dest, const void *ll_source,
+			 uint16_t net_proto );
+	/**
+	 * Remove link-layer header
+	 *
+	 * @v netdev		Network device
+	 * @v iobuf		I/O buffer
+	 * @ret ll_dest		Link-layer destination address
+	 * @ret ll_source	Source link-layer address
+	 * @ret net_proto	Network-layer protocol, in network-byte order
+	 * @ret rc		Return status code
+	 */
+	int ( * pull ) ( struct net_device *netdev, struct io_buffer *iobuf,
+			 const void **ll_dest, const void **ll_source,
+			 uint16_t *net_proto );
+	/**
+	 * Initialise link-layer address
+	 *
+	 * @v hw_addr		Hardware address
+	 * @v ll_addr		Link-layer address to fill in
+	 */
+	void ( * init_addr ) ( const void *hw_addr, void *ll_addr );
+	/**
+	 * Transcribe link-layer address
+	 *
+	 * @v ll_addr		Link-layer address
+	 * @ret string		Human-readable transcription of address
+	 *
+	 * This method should convert the link-layer address into a
+	 * human-readable format.
+	 *
+	 * The buffer used to hold the transcription is statically
+	 * allocated.
+	 */
+	const char * ( * ntoa ) ( const void *ll_addr );
+	/**
+	 * Hash multicast address
+	 *
+	 * @v af		Address family
+	 * @v net_addr		Network-layer address
+	 * @v ll_addr		Link-layer address to fill in
+	 * @ret rc		Return status code
+	 */
+	int ( * mc_hash ) ( unsigned int af, const void *net_addr,
+			    void *ll_addr );
+	/**
+	 * Generate Ethernet-compatible compressed link-layer address
+	 *
+	 * @v ll_addr		Link-layer address
+	 * @v eth_addr		Ethernet-compatible address to fill in
+	 */
+	int ( * eth_addr ) ( const void *ll_addr, void *eth_addr );
+	/** Link-layer protocol
+	 *
+	 * This is an ARPHRD_XXX constant, in network byte order.
+	 */
+	uint16_t ll_proto;
+	/** Hardware address length */
+	uint8_t hw_addr_len;
+	/** Link-layer address length */
+	uint8_t ll_addr_len;
+	/** Link-layer header length */
+	uint8_t ll_header_len;
+};
+
+/** Network device operations */
+struct net_device_operations {
+	/** Open network device
+	 *
+	 * @v netdev	Network device
+	 * @ret rc	Return status code
+	 *
+	 * This method should allocate RX I/O buffers and enable
+	 * the hardware to start transmitting and receiving packets.
+	 */
+	int ( * open ) ( struct net_device *netdev );
+	/** Close network device
+	 *
+	 * @v netdev	Network device
+	 *
+	 * This method should stop the flow of packets, and free up
+	 * any packets that are currently in the device's TX queue.
+	 */
+	void ( * close ) ( struct net_device *netdev );
+	/** Transmit packet
+	 *
+	 * @v netdev	Network device
+	 * @v iobuf	I/O buffer
+	 * @ret rc	Return status code
+	 *
+	 * This method should cause the hardware to initiate
+	 * transmission of the I/O buffer.
+	 *
+	 * If this method returns success, the I/O buffer remains
+	 * owned by the net device's TX queue, and the net device must
+	 * eventually call netdev_tx_complete() to free the buffer.
+	 * If this method returns failure, the I/O buffer is
+	 * immediately released; the failure is interpreted as
+	 * "failure to enqueue buffer".
+	 *
+	 * This method is guaranteed to be called only when the device
+	 * is open.
+	 */
+	int ( * transmit ) ( struct net_device *netdev,
+			     struct io_buffer *iobuf );
+	/** Poll for completed and received packets
+	 *
+	 * @v netdev	Network device
+	 *
+	 * This method should cause the hardware to check for
+	 * completed transmissions and received packets.  Any received
+	 * packets should be delivered via netdev_rx().
+	 *
+	 * This method is guaranteed to be called only when the device
+	 * is open.
+	 */
+	void ( * poll ) ( struct net_device *netdev );
+	/** Enable or disable interrupts
+	 *
+	 * @v netdev	Network device
+	 * @v enable	Interrupts should be enabled
+	 */
+	void ( * irq ) ( struct net_device *netdev, int enable );
+};
+
+/** Network device error */
+struct net_device_error {
+	/** Error status code */
+	int rc;
+	/** Error count */
+	unsigned int count;
+};
+
+/** Maximum number of unique errors that we will keep track of */
+#define NETDEV_MAX_UNIQUE_ERRORS 4
+
+/** Network device statistics */
+struct net_device_stats {
+	/** Count of successful completions */
+	unsigned int good;
+	/** Count of error completions */
+	unsigned int bad;
+	/** Error breakdowns */
+	struct net_device_error errors[NETDEV_MAX_UNIQUE_ERRORS];
+};
+
+/**
+ * A network device
+ *
+ * This structure represents a piece of networking hardware.  It has
+ * properties such as a link-layer address and methods for
+ * transmitting and receiving raw packets.
+ *
+ * Note that this structure must represent a generic network device,
+ * not just an Ethernet device.
+ */
+struct net_device {
+	/** Reference counter */
+	struct refcnt refcnt;
+	/** List of network devices */
+	struct list_head list;
+	/** List of open network devices */
+	struct list_head open_list;
+	/** Name of this network device */
+	char name[8];
+	/** Underlying hardware device */
+	struct device *dev;
+
+	/** Network device operations */
+	struct net_device_operations *op;
+
+	/** Link-layer protocol */
+	struct ll_protocol *ll_protocol;
+	/** Hardware address
+	 *
+	 * This is an address which is an intrinsic property of the
+	 * hardware, e.g. an address held in EEPROM.
+	 *
+	 * Note that the hardware address may not be the same length
+	 * as the link-layer address.
+	 */
+	uint8_t hw_addr[MAX_HW_ADDR_LEN];
+	/** Link-layer address
+	 *
+	 * This is the current link-layer address assigned to the
+	 * device.  It can be changed at runtime.
+	 */
+	uint8_t ll_addr[MAX_LL_ADDR_LEN];
+	/** Link-layer broadcast address */
+	const uint8_t *ll_broadcast;
+
+	/** Current device state
+	 *
+	 * This is the bitwise-OR of zero or more NETDEV_XXX constants.
+	 */
+	unsigned int state;
+	/** Link status code
+	 *
+	 * Zero indicates that the link is up; any other value
+	 * indicates the error preventing link-up.
+	 */
+	int link_rc;
+	/** Maximum packet length
+	 *
+	 * This length includes any link-layer headers.
+	 */
+	size_t max_pkt_len;
+	/** TX packet queue */
+	struct list_head tx_queue;
+	/** RX packet queue */
+	struct list_head rx_queue;
+	/** TX statistics */
+	struct net_device_stats tx_stats;
+	/** RX statistics */
+	struct net_device_stats rx_stats;
+
+	/** Configuration settings applicable to this device */
+	struct generic_settings settings;
+
+	/** Driver private data */
+	void *priv;
+};
+
+/** Network device is open */
+#define NETDEV_OPEN 0x0001
+
+/** Network device interrupts are enabled */
+#define NETDEV_IRQ_ENABLED 0x0002
+
+/** Link-layer protocol table */
+#define LL_PROTOCOLS __table ( struct ll_protocol, "ll_protocols" )
+
+/** Declare a link-layer protocol */
+#define __ll_protocol  __table_entry ( LL_PROTOCOLS, 01 )
+
+/** Network-layer protocol table */
+#define NET_PROTOCOLS __table ( struct net_protocol, "net_protocols" )
+
+/** Declare a network-layer protocol */
+#define __net_protocol __table_entry ( NET_PROTOCOLS, 01 )
+
+extern struct list_head net_devices;
+extern struct net_device_operations null_netdev_operations;
+extern struct settings_operations netdev_settings_operations;
+
+/**
+ * Initialise a network device
+ *
+ * @v netdev		Network device
+ * @v op		Network device operations
+ */
+static inline void netdev_init ( struct net_device *netdev,
+				 struct net_device_operations *op ) {
+	netdev->op = op;
+}
+
+/**
+ * Stop using a network device
+ *
+ * @v netdev		Network device
+ *
+ * Drivers should call this method immediately before the final call
+ * to netdev_put().
+ */
+static inline void netdev_nullify ( struct net_device *netdev ) {
+	netdev->op = &null_netdev_operations;
+}
+
+/**
+ * Get printable network device link-layer address
+ *
+ * @v netdev		Network device
+ * @ret name		Link-layer address
+ */
+static inline const char * netdev_addr ( struct net_device *netdev ) {
+	return netdev->ll_protocol->ntoa ( netdev->ll_addr );
+}
+
+/** Iterate over all network devices */
+#define for_each_netdev( netdev ) \
+	list_for_each_entry ( (netdev), &net_devices, list )
+
+/** There exist some network devices
+ *
+ * @ret existence	Existence of network devices
+ */
+static inline int have_netdevs ( void ) {
+	return ( ! list_empty ( &net_devices ) );
+}
+
+/**
+ * Get reference to network device
+ *
+ * @v netdev		Network device
+ * @ret netdev		Network device
+ */
+static inline __attribute__ (( always_inline )) struct net_device *
+netdev_get ( struct net_device *netdev ) {
+	ref_get ( &netdev->refcnt );
+	return netdev;
+}
+
+/**
+ * Drop reference to network device
+ *
+ * @v netdev		Network device
+ */
+static inline __attribute__ (( always_inline )) void
+netdev_put ( struct net_device *netdev ) {
+	ref_put ( &netdev->refcnt );
+}
+
+/**
+ * Get driver private area for this network device
+ *
+ * @v netdev		Network device
+ * @ret priv		Driver private area for this network device
+ */
+static inline __attribute__ (( always_inline )) void *
+netdev_priv ( struct net_device *netdev ) {
+        return netdev->priv;
+}
+
+/**
+ * Get per-netdevice configuration settings block
+ *
+ * @v netdev		Network device
+ * @ret settings	Settings block
+ */
+static inline __attribute__ (( always_inline )) struct settings *
+netdev_settings ( struct net_device *netdev ) {
+	return &netdev->settings.settings;
+}
+
+/**
+ * Initialise a per-netdevice configuration settings block
+ *
+ * @v generics		Generic settings block
+ * @v refcnt		Containing object reference counter, or NULL
+ * @v name		Settings block name
+ */
+static inline __attribute__ (( always_inline )) void
+netdev_settings_init ( struct net_device *netdev ) {
+	generic_settings_init ( &netdev->settings,
+				&netdev->refcnt, netdev->name );
+	netdev->settings.settings.op = &netdev_settings_operations;
+}
+
+/**
+ * Mark network device as having link up
+ *
+ * @v netdev		Network device
+ */
+static inline __attribute__ (( always_inline )) void
+netdev_link_up ( struct net_device *netdev ) {
+	netdev->link_rc = 0;
+}
+
+/**
+ * Mark network device as having link down due to a specific error
+ *
+ * @v netdev		Network device
+ * @v rc		Link status code
+ */
+static inline __attribute__ (( always_inline )) void
+netdev_link_err ( struct net_device *netdev, int rc ) {
+	netdev->link_rc = rc;
+}
+
+/**
+ * Check link state of network device
+ *
+ * @v netdev		Network device
+ * @ret link_up		Link is up
+ */
+static inline __attribute__ (( always_inline )) int
+netdev_link_ok ( struct net_device *netdev ) {
+	return ( netdev->link_rc == 0 );
+}
+
+/**
+ * Check whether or not network device is open
+ *
+ * @v netdev		Network device
+ * @v is_open		Network device is open
+ */
+static inline __attribute__ (( always_inline )) int
+netdev_is_open ( struct net_device *netdev ) {
+	return ( netdev->state & NETDEV_OPEN );
+}
+
+/**
+ * Check whether or not network device interrupts are currently enabled
+ *
+ * @v netdev		Network device
+ * @v irq_enabled	Network device interrupts are enabled
+ */
+static inline __attribute__ (( always_inline )) int
+netdev_irq_enabled ( struct net_device *netdev ) {
+	return ( netdev->state & NETDEV_IRQ_ENABLED );
+}
+
+extern void netdev_link_down ( struct net_device *netdev );
+extern int netdev_tx ( struct net_device *netdev, struct io_buffer *iobuf );
+extern void netdev_tx_complete_err ( struct net_device *netdev,
+				 struct io_buffer *iobuf, int rc );
+extern void netdev_tx_complete_next_err ( struct net_device *netdev, int rc );
+extern void netdev_rx ( struct net_device *netdev, struct io_buffer *iobuf );
+extern void netdev_rx_err ( struct net_device *netdev,
+			    struct io_buffer *iobuf, int rc );
+extern void netdev_poll ( struct net_device *netdev );
+extern struct io_buffer * netdev_rx_dequeue ( struct net_device *netdev );
+extern struct net_device * alloc_netdev ( size_t priv_size );
+extern int register_netdev ( struct net_device *netdev );
+extern int netdev_open ( struct net_device *netdev );
+extern void netdev_close ( struct net_device *netdev );
+extern void unregister_netdev ( struct net_device *netdev );
+extern void netdev_irq ( struct net_device *netdev, int enable );
+extern struct net_device * find_netdev ( const char *name );
+extern struct net_device * find_netdev_by_location ( unsigned int bus_type,
+						     unsigned int location );
+extern struct net_device * last_opened_netdev ( void );
+extern int net_tx ( struct io_buffer *iobuf, struct net_device *netdev,
+		    struct net_protocol *net_protocol, const void *ll_dest );
+extern int net_rx ( struct io_buffer *iobuf, struct net_device *netdev,
+		    uint16_t net_proto, const void *ll_source );
+
+/**
+ * Complete network transmission
+ *
+ * @v netdev		Network device
+ * @v iobuf		I/O buffer
+ *
+ * The packet must currently be in the network device's TX queue.
+ */
+static inline void netdev_tx_complete ( struct net_device *netdev,
+					struct io_buffer *iobuf ) {
+	netdev_tx_complete_err ( netdev, iobuf, 0 );
+}
+
+/**
+ * Complete network transmission
+ *
+ * @v netdev		Network device
+ *
+ * Completes the oldest outstanding packet in the TX queue.
+ */
+static inline void netdev_tx_complete_next ( struct net_device *netdev ) {
+	netdev_tx_complete_next_err ( netdev, 0 );
+}
+
+#endif /* _IPXE_NETDEVICE_H */
diff --git a/src/include/ipxe/null_nap.h b/src/include/ipxe/null_nap.h
new file mode 100644
index 0000000..0c0704b
--- /dev/null
+++ b/src/include/ipxe/null_nap.h
@@ -0,0 +1,23 @@
+#ifndef _IPXE_NULL_NAP_H
+#define _IPXE_NULL_NAP_H
+
+/** @file
+ *
+ * Null CPU sleeping
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#ifdef NAP_NULL
+#define NAP_PREFIX_null
+#else
+#define NAP_PREFIX_null __null_
+#endif
+
+static inline __always_inline void
+NAP_INLINE ( null, cpu_nap ) ( void ) {
+	/* Do nothing */
+}
+
+#endif /* _IPXE_NULL_NAP_H */
diff --git a/src/include/ipxe/nvo.h b/src/include/ipxe/nvo.h
new file mode 100644
index 0000000..0a0222b
--- /dev/null
+++ b/src/include/ipxe/nvo.h
@@ -0,0 +1,55 @@
+#ifndef _IPXE_NVO_H
+#define _IPXE_NVO_H
+
+/** @file
+ *
+ * Non-volatile stored options
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/dhcpopts.h>
+#include <ipxe/settings.h>
+
+struct nvs_device;
+struct refcnt;
+
+/**
+ * A fragment of a non-volatile storage device used for stored options
+ */
+struct nvo_fragment {
+	/** Starting address of fragment within NVS device */
+	unsigned int address;
+	/** Length of fragment */
+	size_t len;
+};
+
+/**
+ * A block of non-volatile stored options
+ */
+struct nvo_block {
+	/** Settings block */
+	struct settings settings;
+	/** Underlying non-volatile storage device */
+	struct nvs_device *nvs;
+	/** List of option-containing fragments
+	 *
+	 * The list is terminated by a fragment with a length of zero.
+	 */
+	struct nvo_fragment *fragments;
+	/** Total length of option-containing fragments */
+	size_t total_len;
+	/** Option-containing data */
+	void *data;
+	/** DHCP options block */
+	struct dhcp_options dhcpopts;
+};
+
+extern void nvo_init ( struct nvo_block *nvo, struct nvs_device *nvs,
+		       struct nvo_fragment *fragments, struct refcnt *refcnt );
+extern int register_nvo ( struct nvo_block *nvo, struct settings *parent );
+extern void unregister_nvo ( struct nvo_block *nvo );
+
+#endif /* _IPXE_NVO_H */
diff --git a/src/include/ipxe/nvs.h b/src/include/ipxe/nvs.h
new file mode 100644
index 0000000..4733123
--- /dev/null
+++ b/src/include/ipxe/nvs.h
@@ -0,0 +1,68 @@
+#ifndef _IPXE_NVS_H
+#define _IPXE_NVS_H
+
+/** @file
+ *
+ * Non-volatile storage
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/** A non-volatile storage device */
+struct nvs_device {
+	/** Word length
+	 *
+	 * This is expressed as the base-2 logarithm of the word
+	 * length in bytes.  A value of 0 therefore translates as
+	 * 8-bit words, and a value of 1 translates as 16-bit words.
+	 */
+	unsigned int word_len_log2;
+	/** Device size (in words) */
+	unsigned int size;
+	/** Data block size (in words)
+	 *
+	 * This is the block size used by the device.  It must be a
+	 * power of two.  Data reads and writes must not cross a block
+	 * boundary.
+	 *
+	 * Many devices allow reads to cross a block boundary, and
+	 * restrict only writes.  For the sake of simplicity, we
+	 * assume that the same restriction applies to both reads and
+	 * writes.
+	 */
+	unsigned int block_size;
+	/** Read data from device
+	 *
+	 * @v nvs		NVS device
+	 * @v address		Address from which to read
+	 * @v data		Data buffer
+	 * @v len		Length of data buffer
+	 * @ret rc		Return status code
+	 *
+	 * Reads may not cross a block boundary.
+	 */
+	int ( * read ) ( struct nvs_device *nvs, unsigned int address,
+			 void *data, size_t len );
+	/** Write data to device
+	 *
+	 * @v nvs		NVS device
+	 * @v address		Address to which to write
+	 * @v data		Data buffer
+	 * @v len		Length of data buffer
+	 * @ret rc		Return status code
+	 *
+	 * Writes may not cross a block boundary.
+	 */
+	int ( * write ) ( struct nvs_device *nvs, unsigned int address,
+			  const void *data, size_t len );
+};
+
+extern int nvs_read ( struct nvs_device *nvs, unsigned int address,
+		      void *data, size_t len );
+extern int nvs_write ( struct nvs_device *nvs, unsigned int address,
+		       const void *data, size_t len );
+
+#endif /* _IPXE_NVS_H */
diff --git a/src/include/ipxe/open.h b/src/include/ipxe/open.h
new file mode 100644
index 0000000..04e37e0
--- /dev/null
+++ b/src/include/ipxe/open.h
@@ -0,0 +1,105 @@
+#ifndef _IPXE_OPEN_H
+#define _IPXE_OPEN_H
+
+/** @file
+ *
+ * Data transfer interface opening
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdarg.h>
+#include <ipxe/tables.h>
+#include <ipxe/socket.h>
+
+struct xfer_interface;
+struct uri;
+
+/** Location types */
+enum {
+	/** Location is a URI
+	 *
+	 * Parameter list for open() is:
+	 *
+	 * struct uri *uri;
+	 */
+	LOCATION_URI = 1,
+	/** Location is a URI string
+	 *
+	 * Parameter list for open() is:
+	 *
+	 * const char *uri_string;
+	 */
+	LOCATION_URI_STRING,
+	/** Location is a socket
+	 *
+	 * Parameter list for open() is:
+	 *
+	 * int semantics;
+	 * struct sockaddr *peer;
+	 * struct sockaddr *local;
+	 */
+	LOCATION_SOCKET,
+};
+
+/** A URI opener */
+struct uri_opener {
+	/** URI protocol name
+	 *
+	 * This is the "scheme" portion of the URI, e.g. "http" or
+	 * "file".
+	 */
+	const char *scheme;
+	/** Open URI
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v uri		URI
+	 * @ret rc		Return status code
+	 */
+	int ( * open ) ( struct xfer_interface *xfer, struct uri *uri );
+};
+
+/** URI opener table */
+#define URI_OPENERS __table ( struct uri_opener, "uri_openers" )
+
+/** Register a URI opener */
+#define __uri_opener __table_entry ( URI_OPENERS, 01 )
+
+/** A socket opener */
+struct socket_opener {
+	/** Communication semantics (e.g. SOCK_STREAM) */
+	int semantics;
+	/** Address family (e.g. AF_INET) */
+	int family;
+	/** Open socket
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v peer		Peer socket address
+	 * @v local		Local socket address, or NULL
+	 * @ret rc		Return status code
+	 */
+	int ( * open ) ( struct xfer_interface *xfer, struct sockaddr *peer,
+			 struct sockaddr *local );
+};
+
+/** Socket opener table */
+#define SOCKET_OPENERS __table ( struct socket_opener, "socket_openers" )
+
+/** Register a socket opener */
+#define __socket_opener __table_entry ( SOCKET_OPENERS, 01 )
+
+extern int xfer_open_uri ( struct xfer_interface *xfer, struct uri *uri );
+extern int xfer_open_uri_string ( struct xfer_interface *xfer,
+				  const char *uri_string );
+extern int xfer_open_named_socket ( struct xfer_interface *xfer,
+				    int semantics, struct sockaddr *peer,
+				    const char *name, struct sockaddr *local );
+extern int xfer_open_socket ( struct xfer_interface *xfer, int semantics,
+			      struct sockaddr *peer, struct sockaddr *local );
+extern int xfer_vopen ( struct xfer_interface *xfer, int type, va_list args );
+extern int xfer_open ( struct xfer_interface *xfer, int type, ... );
+extern int xfer_vreopen ( struct xfer_interface *xfer, int type,
+			  va_list args );
+
+#endif /* _IPXE_OPEN_H */
diff --git a/src/include/ipxe/pci.h b/src/include/ipxe/pci.h
new file mode 100644
index 0000000..60ac8bf
--- /dev/null
+++ b/src/include/ipxe/pci.h
@@ -0,0 +1,402 @@
+#ifndef	_IPXE_PCI_H
+#define _IPXE_PCI_H
+
+/*
+ * Support for NE2000 PCI clones added David Monro June 1997
+ * Generalised for other PCI NICs by Ken Yap July 1997
+ * PCI support rewritten by Michael Brown 2006
+ *
+ * Most of this is taken from /usr/src/linux/include/linux/pci.h.
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2, or (at
+ * your option) any later version.
+ */
+
+FILE_LICENCE ( GPL2_ONLY );
+
+#include <stdint.h>
+#include <ipxe/device.h>
+#include <ipxe/tables.h>
+#include <ipxe/pci_io.h>
+#include "pci_ids.h"
+
+/*
+ * PCI constants
+ *
+ */
+
+#define PCI_COMMAND_IO			0x1	/* Enable response in I/O space */
+#define PCI_COMMAND_MEM			0x2	/* Enable response in mem space */
+#define PCI_COMMAND_MASTER		0x4	/* Enable bus mastering */
+
+#define PCI_CACHE_LINE_SIZE		0x0c	/* 8 bits */
+#define PCI_LATENCY_TIMER		0x0d	/* 8 bits */
+
+#define PCI_COMMAND_SPECIAL		0x8	/* Enable response to special cycles */
+#define PCI_COMMAND_INVALIDATE		0x10	/* Use memory write and invalidate */
+#define  PCI_COMMAND_VGA_PALETTE 0x20	/* Enable palette snooping */
+#define  PCI_COMMAND_PARITY	0x40	/* Enable parity checking */
+#define  PCI_COMMAND_WAIT 	0x80	/* Enable address/data stepping */
+#define  PCI_COMMAND_SERR	0x100	/* Enable SERR */
+#define  PCI_COMMAND_FAST_BACK	0x200	/* Enable back-to-back writes */
+#define  PCI_COMMAND_INTX_DISABLE 0x400 /* INTx Emulation Disable */
+
+
+#define PCI_VENDOR_ID           0x00    /* 16 bits */
+#define PCI_DEVICE_ID           0x02    /* 16 bits */
+#define PCI_COMMAND             0x04    /* 16 bits */
+
+#define PCI_STATUS		0x06	/* 16 bits */
+#define  PCI_STATUS_CAP_LIST	0x10	/* Support Capability List */
+#define  PCI_STATUS_66MHZ	0x20	/* Support 66 Mhz PCI 2.1 bus */
+#define  PCI_STATUS_UDF		0x40	/* Support User Definable Features [obsolete] */
+#define  PCI_STATUS_FAST_BACK	0x80	/* Accept fast-back to back */
+#define  PCI_STATUS_PARITY	0x100	/* Detected parity error */
+#define  PCI_STATUS_DEVSEL_MASK	0x600	/* DEVSEL timing */
+#define  PCI_STATUS_DEVSEL_FAST	0x000	
+#define  PCI_STATUS_DEVSEL_MEDIUM 0x200
+#define  PCI_STATUS_DEVSEL_SLOW 0x400
+#define  PCI_STATUS_SIG_TARGET_ABORT 0x800 /* Set on target abort */
+#define  PCI_STATUS_REC_TARGET_ABORT 0x1000 /* Master ack of " */
+#define  PCI_STATUS_REC_MASTER_ABORT 0x2000 /* Set on master abort */
+#define  PCI_STATUS_SIG_SYSTEM_ERROR 0x4000 /* Set when we drive SERR */
+#define  PCI_STATUS_DETECTED_PARITY 0x8000 /* Set on parity error */
+
+#define PCI_REVISION            0x08    /* 8 bits  */
+#define PCI_REVISION_ID         0x08    /* 8 bits  */
+#define PCI_CLASS_REVISION      0x08    /* 32 bits  */
+#define PCI_CLASS_CODE          0x0b    /* 8 bits */
+#define PCI_SUBCLASS_CODE       0x0a    /* 8 bits */
+#define PCI_HEADER_TYPE         0x0e    /* 8 bits */
+#define  PCI_HEADER_TYPE_NORMAL	0
+#define  PCI_HEADER_TYPE_BRIDGE 1
+#define  PCI_HEADER_TYPE_CARDBUS 2
+
+
+/* Header type 0 (normal devices) */
+#define PCI_CARDBUS_CIS		0x28
+#define PCI_SUBSYSTEM_VENDOR_ID	0x2c
+#define PCI_SUBSYSTEM_ID	0x2e  
+
+#define PCI_BASE_ADDRESS_0      0x10    /* 32 bits */
+#define PCI_BASE_ADDRESS_1      0x14    /* 32 bits */
+#define PCI_BASE_ADDRESS_2      0x18    /* 32 bits */
+#define PCI_BASE_ADDRESS_3      0x1c    /* 32 bits */
+#define PCI_BASE_ADDRESS_4      0x20    /* 32 bits */
+#define PCI_BASE_ADDRESS_5      0x24    /* 32 bits */
+
+#define PCI_BASE_ADDRESS_SPACE		0x01    /* 0 = memory, 1 = I/O */
+#define PCI_BASE_ADDRESS_SPACE_IO	0x01
+#define PCI_BASE_ADDRESS_SPACE_MEMORY	0x00
+
+#define PCI_BASE_ADDRESS_MEM_TYPE_MASK	0x06
+#define PCI_BASE_ADDRESS_MEM_TYPE_32	0x00	/* 32 bit address */
+#define PCI_BASE_ADDRESS_MEM_TYPE_1M	0x02	/* Below 1M [obsolete] */
+#define PCI_BASE_ADDRESS_MEM_TYPE_64	0x04	/* 64 bit address */
+#define	PCI_BASE_ADDRESS_MEM_MASK	(~0x0f)
+#define	PCI_BASE_ADDRESS_IO_MASK	(~0x03)
+#define	PCI_ROM_ADDRESS		0x30	/* 32 bits */
+#define	PCI_ROM_ADDRESS_ENABLE	0x01	/* Write 1 to enable ROM,
+					   bits 31..11 are address,
+					   10..2 are reserved */
+
+#define PCI_CAPABILITY_LIST	0x34	/* Offset of first capability list entry */
+
+#define PCI_INTERRUPT_LINE	0x3c	/* IRQ number (0-15) */
+#define PCI_INTERRUPT_PIN	0x3d	/* IRQ pin on PCI bus (A-D) */
+
+/* Header type 1 (PCI-to-PCI bridges) */
+#define PCI_PRIMARY_BUS		0x18	/* Primary bus number */
+#define PCI_SECONDARY_BUS	0x19	/* Secondary bus number */
+#define PCI_SUBORDINATE_BUS	0x1a	/* Highest bus number behind the bridge */
+#define PCI_SEC_LATENCY_TIMER	0x1b	/* Latency timer for secondary interface */
+#define PCI_IO_BASE		0x1c	/* I/O range behind the bridge */
+#define PCI_IO_LIMIT		0x1d
+#define  PCI_IO_RANGE_TYPE_MASK	0x0f	/* I/O bridging type */
+#define  PCI_IO_RANGE_TYPE_16	0x00
+#define  PCI_IO_RANGE_TYPE_32	0x01
+#define  PCI_IO_RANGE_MASK	~0x0f
+#define PCI_SEC_STATUS		0x1e	/* Secondary status register, only bit 14 used */
+#define PCI_MEMORY_BASE		0x20	/* Memory range behind */
+#define PCI_MEMORY_LIMIT	0x22
+#define  PCI_MEMORY_RANGE_TYPE_MASK 0x0f
+#define  PCI_MEMORY_RANGE_MASK	~0x0f
+#define PCI_PREF_MEMORY_BASE	0x24	/* Prefetchable memory range behind */
+#define PCI_PREF_MEMORY_LIMIT	0x26
+#define  PCI_PREF_RANGE_TYPE_MASK 0x0f
+#define  PCI_PREF_RANGE_TYPE_32	0x00
+#define  PCI_PREF_RANGE_TYPE_64	0x01
+#define  PCI_PREF_RANGE_MASK	~0x0f
+#define PCI_PREF_BASE_UPPER32	0x28	/* Upper half of prefetchable memory range */
+#define PCI_PREF_LIMIT_UPPER32	0x2c
+#define PCI_IO_BASE_UPPER16	0x30	/* Upper half of I/O addresses */
+#define PCI_IO_LIMIT_UPPER16	0x32
+/* 0x34 same as for htype 0 */
+/* 0x35-0x3b is reserved */
+#define PCI_ROM_ADDRESS1	0x38	/* Same as PCI_ROM_ADDRESS, but for htype 1 */
+/* 0x3c-0x3d are same as for htype 0 */
+#define PCI_BRIDGE_CONTROL	0x3e
+#define  PCI_BRIDGE_CTL_PARITY	0x01	/* Enable parity detection on secondary interface */
+#define  PCI_BRIDGE_CTL_SERR	0x02	/* The same for SERR forwarding */
+#define  PCI_BRIDGE_CTL_NO_ISA	0x04	/* Disable bridging of ISA ports */
+#define  PCI_BRIDGE_CTL_VGA	0x08	/* Forward VGA addresses */
+#define  PCI_BRIDGE_CTL_MASTER_ABORT 0x20  /* Report master aborts */
+#define  PCI_BRIDGE_CTL_BUS_RESET 0x40	/* Secondary bus reset */
+#define  PCI_BRIDGE_CTL_FAST_BACK 0x80	/* Fast Back2Back enabled on secondary interface */
+
+#define PCI_CB_CAPABILITY_LIST	0x14
+
+/* Capability lists */
+
+#define PCI_CAP_LIST_ID		0	/* Capability ID */
+#define  PCI_CAP_ID_PM		0x01	/* Power Management */
+#define  PCI_CAP_ID_AGP		0x02	/* Accelerated Graphics Port */
+#define  PCI_CAP_ID_VPD		0x03	/* Vital Product Data */
+#define  PCI_CAP_ID_SLOTID	0x04	/* Slot Identification */
+#define  PCI_CAP_ID_MSI		0x05	/* Message Signalled Interrupts */
+#define  PCI_CAP_ID_CHSWP	0x06	/* CompactPCI HotSwap */
+#define  PCI_CAP_ID_EXP		0x10	/* PCI Express */
+#define PCI_CAP_LIST_NEXT	1	/* Next capability in the list */
+#define PCI_CAP_FLAGS		2	/* Capability defined flags (16 bits) */
+#define PCI_CAP_SIZEOF		4
+
+/* Power Management Registers */
+
+#define PCI_PM_PMC              2       /* PM Capabilities Register */
+#define  PCI_PM_CAP_VER_MASK	0x0007	/* Version */
+#define  PCI_PM_CAP_PME_CLOCK	0x0008	/* PME clock required */
+#define  PCI_PM_CAP_RESERVED    0x0010  /* Reserved field */
+#define  PCI_PM_CAP_DSI		0x0020	/* Device specific initialization */
+#define  PCI_PM_CAP_AUX_POWER	0x01C0	/* Auxilliary power support mask */
+#define  PCI_PM_CAP_D1		0x0200	/* D1 power state support */
+#define  PCI_PM_CAP_D2		0x0400	/* D2 power state support */
+#define  PCI_PM_CAP_PME		0x0800	/* PME pin supported */
+#define  PCI_PM_CAP_PME_MASK    0xF800  /* PME Mask of all supported states */
+#define  PCI_PM_CAP_PME_D0      0x0800  /* PME# from D0 */
+#define  PCI_PM_CAP_PME_D1      0x1000  /* PME# from D1 */
+#define  PCI_PM_CAP_PME_D2      0x2000  /* PME# from D2 */
+#define  PCI_PM_CAP_PME_D3      0x4000  /* PME# from D3 (hot) */
+#define  PCI_PM_CAP_PME_D3cold  0x8000  /* PME# from D3 (cold) */
+#define PCI_PM_CTRL		4	/* PM control and status register */
+#define  PCI_PM_CTRL_STATE_MASK	0x0003	/* Current power state (D0 to D3) */
+#define  PCI_PM_CTRL_PME_ENABLE	0x0100	/* PME pin enable */
+#define  PCI_PM_CTRL_DATA_SEL_MASK	0x1e00	/* Data select (??) */
+#define  PCI_PM_CTRL_DATA_SCALE_MASK	0x6000	/* Data scale (??) */
+#define  PCI_PM_CTRL_PME_STATUS	0x8000	/* PME pin status */
+#define PCI_PM_PPB_EXTENSIONS	6	/* PPB support extensions (??) */
+#define  PCI_PM_PPB_B2_B3	0x40	/* Stop clock when in D3hot (??) */
+#define  PCI_PM_BPCC_ENABLE	0x80	/* Bus power/clock control enable (??) */
+#define PCI_PM_DATA_REGISTER	7	/* (??) */
+#define PCI_PM_SIZEOF		8
+
+/* AGP registers */
+
+#define PCI_AGP_VERSION		2	/* BCD version number */
+#define PCI_AGP_RFU		3	/* Rest of capability flags */
+#define PCI_AGP_STATUS		4	/* Status register */
+#define  PCI_AGP_STATUS_RQ_MASK	0xff000000	/* Maximum number of requests - 1 */
+#define  PCI_AGP_STATUS_SBA	0x0200	/* Sideband addressing supported */
+#define  PCI_AGP_STATUS_64BIT	0x0020	/* 64-bit addressing supported */
+#define  PCI_AGP_STATUS_FW	0x0010	/* FW transfers supported */
+#define  PCI_AGP_STATUS_RATE4	0x0004	/* 4x transfer rate supported */
+#define  PCI_AGP_STATUS_RATE2	0x0002	/* 2x transfer rate supported */
+#define  PCI_AGP_STATUS_RATE1	0x0001	/* 1x transfer rate supported */
+#define PCI_AGP_COMMAND		8	/* Control register */
+#define  PCI_AGP_COMMAND_RQ_MASK 0xff000000  /* Master: Maximum number of requests */
+#define  PCI_AGP_COMMAND_SBA	0x0200	/* Sideband addressing enabled */
+#define  PCI_AGP_COMMAND_AGP	0x0100	/* Allow processing of AGP transactions */
+#define  PCI_AGP_COMMAND_64BIT	0x0020 	/* Allow processing of 64-bit addresses */
+#define  PCI_AGP_COMMAND_FW	0x0010 	/* Force FW transfers */
+#define  PCI_AGP_COMMAND_RATE4	0x0004	/* Use 4x rate */
+#define  PCI_AGP_COMMAND_RATE2	0x0002	/* Use 2x rate */
+#define  PCI_AGP_COMMAND_RATE1	0x0001	/* Use 1x rate */
+#define PCI_AGP_SIZEOF		12
+
+/* Slot Identification */
+
+#define PCI_SID_ESR		2	/* Expansion Slot Register */
+#define  PCI_SID_ESR_NSLOTS	0x1f	/* Number of expansion slots available */
+#define  PCI_SID_ESR_FIC	0x20	/* First In Chassis Flag */
+#define PCI_SID_CHASSIS_NR	3	/* Chassis Number */
+
+/* Message Signalled Interrupts registers */
+
+#define PCI_MSI_FLAGS		2	/* Various flags */
+#define  PCI_MSI_FLAGS_64BIT	0x80	/* 64-bit addresses allowed */
+#define  PCI_MSI_FLAGS_QSIZE	0x70	/* Message queue size configured */
+#define  PCI_MSI_FLAGS_QMASK	0x0e	/* Maximum queue size available */
+#define  PCI_MSI_FLAGS_ENABLE	0x01	/* MSI feature enabled */
+#define PCI_MSI_RFU		3	/* Rest of capability flags */
+#define PCI_MSI_ADDRESS_LO	4	/* Lower 32 bits */
+#define PCI_MSI_ADDRESS_HI	8	/* Upper 32 bits (if PCI_MSI_FLAGS_64BIT set) */
+#define PCI_MSI_DATA_32		8	/* 16 bits of data for 32-bit devices */
+#define PCI_MSI_DATA_64		12	/* 16 bits of data for 64-bit devices */
+
+/* Advanced Error Reporting */
+
+#define PCI_ERR_UNCOR_STATUS	4	/* Uncorrectable Error Status */
+#define  PCI_ERR_UNC_TRAIN	0x00000001	/* Training */
+#define  PCI_ERR_UNC_DLP	0x00000010	/* Data Link Protocol */
+#define  PCI_ERR_UNC_POISON_TLP	0x00001000	/* Poisoned TLP */
+#define  PCI_ERR_UNC_FCP	0x00002000	/* Flow Control Protocol */
+#define  PCI_ERR_UNC_COMP_TIME	0x00004000	/* Completion Timeout */
+#define  PCI_ERR_UNC_COMP_ABORT	0x00008000	/* Completer Abort */
+#define  PCI_ERR_UNC_UNX_COMP	0x00010000	/* Unexpected Completion */
+#define  PCI_ERR_UNC_RX_OVER	0x00020000	/* Receiver Overflow */
+#define  PCI_ERR_UNC_MALF_TLP	0x00040000	/* Malformed TLP */
+#define  PCI_ERR_UNC_ECRC	0x00080000	/* ECRC Error Status */
+#define  PCI_ERR_UNC_UNSUP	0x00100000	/* Unsupported Request */
+#define PCI_ERR_UNCOR_MASK	8	/* Uncorrectable Error Mask */
+	/* Same bits as above */
+#define PCI_ERR_UNCOR_SEVER	12	/* Uncorrectable Error Severity */
+	/* Same bits as above */
+#define PCI_ERR_COR_STATUS	16	/* Correctable Error Status */
+#define  PCI_ERR_COR_RCVR	0x00000001	/* Receiver Error Status */
+#define  PCI_ERR_COR_BAD_TLP	0x00000040	/* Bad TLP Status */
+#define  PCI_ERR_COR_BAD_DLLP	0x00000080	/* Bad DLLP Status */
+#define  PCI_ERR_COR_REP_ROLL	0x00000100	/* REPLAY_NUM Rollover */
+#define  PCI_ERR_COR_REP_TIMER	0x00001000	/* Replay Timer Timeout */
+#define PCI_ERR_COR_MASK	20	/* Correctable Error Mask */
+	/* Same bits as above */
+
+/** A PCI device ID list entry */
+struct pci_device_id {
+	/** Name */
+	const char *name;
+	/** PCI vendor ID */
+	uint16_t vendor;
+	/** PCI device ID */
+	uint16_t device;
+	/** Arbitrary driver data */
+	unsigned long driver_data;
+};
+
+/** Match-anything ID */
+#define PCI_ANY_ID 0xffff
+
+/** A PCI device */
+struct pci_device {
+	/** Generic device */
+	struct device dev;
+	/** Memory base
+	 *
+	 * This is the physical address of the first valid memory BAR.
+	 */
+	unsigned long membase;
+	/**
+	 * I/O address
+	 *
+	 * This is the physical address of the first valid I/O BAR.
+	 */
+	unsigned long ioaddr;
+	/** Vendor ID */
+	uint16_t vendor;
+	/** Device ID */
+	uint16_t device;
+	/** Device class */
+	uint32_t class;
+	/** Interrupt number */
+	uint8_t irq;
+	/** Bus number */
+	uint8_t bus;
+	/** Device and function number */
+	uint8_t devfn;
+	/** Driver for this device */
+	struct pci_driver *driver;
+	/** Driver-private data
+	 *
+	 * Use pci_set_drvdata() and pci_get_drvdata() to access this
+	 * field.
+	 */
+	void *priv;
+	/** Driver name */
+	const char *driver_name;
+};
+
+/** A PCI driver */
+struct pci_driver {
+	/** PCI ID table */
+	struct pci_device_id *ids;
+	/** Number of entries in PCI ID table */
+	unsigned int id_count;
+	/**
+	 * Probe device
+	 *
+	 * @v pci	PCI device
+	 * @v id	Matching entry in ID table
+	 * @ret rc	Return status code
+	 */
+	int ( * probe ) ( struct pci_device *pci,
+			  const struct pci_device_id *id );
+	/**
+	 * Remove device
+	 *
+	 * @v pci	PCI device
+	 */
+	void ( * remove ) ( struct pci_device *pci );
+};
+
+/** PCI driver table */
+#define PCI_DRIVERS __table ( struct pci_driver, "pci_drivers" )
+
+/** Declare a PCI driver */
+#define __pci_driver __table_entry ( PCI_DRIVERS, 01 )
+
+#define PCI_DEVFN( slot, func )		( ( (slot) << 3 ) | (func) )
+#define PCI_SLOT( devfn )		( ( (devfn) >> 3 ) & 0x1f )
+#define PCI_FUNC( devfn )		( (devfn) & 0x07 )
+#define PCI_BUS( busdevfn )		( (busdevfn) >> 8 )
+#define PCI_BUSDEVFN( bus, devfn )	( ( (bus) << 8 ) | (devfn) )
+
+#define PCI_BASE_CLASS( class )		( (class) >> 16 )
+#define PCI_SUB_CLASS( class )		( ( (class) >> 8 ) & 0xff )
+#define PCI_PROG_INTF( class )		( (class) & 0xff )
+
+/*
+ * PCI_ROM is used to build up entries in a struct pci_id array.  It
+ * is also parsed by parserom.pl to generate Makefile rules and files
+ * for rom-o-matic.
+ *
+ * PCI_ID can be used to generate entries without creating a
+ * corresponding ROM in the build process.
+ */
+#define PCI_ID( _vendor, _device, _name, _description, _data ) {	\
+	.vendor = _vendor,						\
+	.device = _device,						\
+	.name = _name,							\
+	.driver_data = _data						\
+}
+#define PCI_ROM( _vendor, _device, _name, _description, _data ) \
+	PCI_ID( _vendor, _device, _name, _description, _data )
+
+extern void adjust_pci_device ( struct pci_device *pci );
+extern unsigned long pci_bar_start ( struct pci_device *pci,
+				     unsigned int reg );
+extern int pci_find_capability ( struct pci_device *pci, int capability );
+extern unsigned long pci_bar_size ( struct pci_device *pci, unsigned int reg );
+
+/**
+ * Set PCI driver-private data
+ *
+ * @v pci		PCI device
+ * @v priv		Private data
+ */
+static inline void pci_set_drvdata ( struct pci_device *pci, void *priv ) {
+	pci->priv = priv;
+}
+
+/**
+ * Get PCI driver-private data
+ *
+ * @v pci		PCI device
+ * @ret priv		Private data
+ */
+static inline void * pci_get_drvdata ( struct pci_device *pci ) {
+	return pci->priv;
+}
+
+#endif	/* _IPXE_PCI_H */
diff --git a/src/include/ipxe/pci_ids.h b/src/include/ipxe/pci_ids.h
new file mode 100644
index 0000000..25c7782
--- /dev/null
+++ b/src/include/ipxe/pci_ids.h
@@ -0,0 +1,351 @@
+#ifndef _IPXE_PCI_IDS_H
+#define _IPXE_PCI_IDS_H
+
+/*
+ *	PCI Class, Vendor and Device IDs
+ *
+ *	Please keep sorted.
+ */
+
+FILE_LICENCE ( GPL2_ONLY );
+
+/* Device classes and subclasses */
+
+#define PCI_CLASS_NOT_DEFINED		0x0000
+#define PCI_CLASS_NOT_DEFINED_VGA	0x0001
+
+#define PCI_BASE_CLASS_STORAGE		0x01
+#define PCI_CLASS_STORAGE_SCSI		0x0100
+#define PCI_CLASS_STORAGE_IDE		0x0101
+#define PCI_CLASS_STORAGE_FLOPPY	0x0102
+#define PCI_CLASS_STORAGE_IPI		0x0103
+#define PCI_CLASS_STORAGE_RAID		0x0104
+#define PCI_CLASS_STORAGE_OTHER		0x0180
+
+#define PCI_BASE_CLASS_NETWORK		0x02
+#define PCI_CLASS_NETWORK_ETHERNET	0x0200
+#define PCI_CLASS_NETWORK_TOKEN_RING	0x0201
+#define PCI_CLASS_NETWORK_FDDI		0x0202
+#define PCI_CLASS_NETWORK_ATM		0x0203
+#define PCI_CLASS_NETWORK_OTHER		0x0280
+
+#define PCI_BASE_CLASS_DISPLAY		0x03
+#define PCI_CLASS_DISPLAY_VGA		0x0300
+#define PCI_CLASS_DISPLAY_XGA		0x0301
+#define PCI_CLASS_DISPLAY_3D		0x0302
+#define PCI_CLASS_DISPLAY_OTHER		0x0380
+
+#define PCI_BASE_CLASS_MULTIMEDIA	0x04
+#define PCI_CLASS_MULTIMEDIA_VIDEO	0x0400
+#define PCI_CLASS_MULTIMEDIA_AUDIO	0x0401
+#define PCI_CLASS_MULTIMEDIA_PHONE	0x0402
+#define PCI_CLASS_MULTIMEDIA_OTHER	0x0480
+
+#define PCI_BASE_CLASS_MEMORY		0x05
+#define PCI_CLASS_MEMORY_RAM		0x0500
+#define PCI_CLASS_MEMORY_FLASH		0x0501
+#define PCI_CLASS_MEMORY_OTHER		0x0580
+
+#define PCI_BASE_CLASS_BRIDGE		0x06
+#define PCI_CLASS_BRIDGE_HOST		0x0600
+#define PCI_CLASS_BRIDGE_ISA		0x0601
+#define PCI_CLASS_BRIDGE_EISA		0x0602
+#define PCI_CLASS_BRIDGE_MC		0x0603
+#define PCI_CLASS_BRIDGE_PCI		0x0604
+#define PCI_CLASS_BRIDGE_PCMCIA		0x0605
+#define PCI_CLASS_BRIDGE_NUBUS		0x0606
+#define PCI_CLASS_BRIDGE_CARDBUS	0x0607
+#define PCI_CLASS_BRIDGE_RACEWAY	0x0608
+#define PCI_CLASS_BRIDGE_OTHER		0x0680
+
+#define PCI_BASE_CLASS_COMMUNICATION	0x07
+#define PCI_CLASS_COMMUNICATION_SERIAL	0x0700
+#define PCI_CLASS_COMMUNICATION_PARALLEL 0x0701
+#define PCI_CLASS_COMMUNICATION_MULTISERIAL 0x0702
+#define PCI_CLASS_COMMUNICATION_MODEM	0x0703
+#define PCI_CLASS_COMMUNICATION_OTHER	0x0780
+
+#define PCI_BASE_CLASS_SYSTEM		0x08
+#define PCI_CLASS_SYSTEM_PIC		0x0800
+#define PCI_CLASS_SYSTEM_DMA		0x0801
+#define PCI_CLASS_SYSTEM_TIMER		0x0802
+#define PCI_CLASS_SYSTEM_RTC		0x0803
+#define PCI_CLASS_SYSTEM_PCI_HOTPLUG	0x0804
+#define PCI_CLASS_SYSTEM_OTHER		0x0880
+
+#define PCI_BASE_CLASS_INPUT		0x09
+#define PCI_CLASS_INPUT_KEYBOARD	0x0900
+#define PCI_CLASS_INPUT_PEN		0x0901
+#define PCI_CLASS_INPUT_MOUSE		0x0902
+#define PCI_CLASS_INPUT_SCANNER		0x0903
+#define PCI_CLASS_INPUT_GAMEPORT	0x0904
+#define PCI_CLASS_INPUT_OTHER		0x0980
+
+#define PCI_BASE_CLASS_DOCKING		0x0a
+#define PCI_CLASS_DOCKING_GENERIC	0x0a00
+#define PCI_CLASS_DOCKING_OTHER		0x0a80
+
+#define PCI_BASE_CLASS_PROCESSOR	0x0b
+#define PCI_CLASS_PROCESSOR_386		0x0b00
+#define PCI_CLASS_PROCESSOR_486		0x0b01
+#define PCI_CLASS_PROCESSOR_PENTIUM	0x0b02
+#define PCI_CLASS_PROCESSOR_ALPHA	0x0b10
+#define PCI_CLASS_PROCESSOR_POWERPC	0x0b20
+#define PCI_CLASS_PROCESSOR_MIPS	0x0b30
+#define PCI_CLASS_PROCESSOR_CO		0x0b40
+
+#define PCI_BASE_CLASS_SERIAL		0x0c
+#define PCI_CLASS_SERIAL_FIREWIRE	0x0c00
+#define PCI_CLASS_SERIAL_ACCESS		0x0c01
+#define PCI_CLASS_SERIAL_SSA		0x0c02
+#define PCI_CLASS_SERIAL_USB		0x0c03
+#define PCI_CLASS_SERIAL_FIBER		0x0c04
+#define PCI_CLASS_SERIAL_SMBUS		0x0c05
+
+#define PCI_BASE_CLASS_INTELLIGENT	0x0e
+#define PCI_CLASS_INTELLIGENT_I2O	0x0e00
+
+#define PCI_BASE_CLASS_SATELLITE	0x0f
+#define PCI_CLASS_SATELLITE_TV		0x0f00
+#define PCI_CLASS_SATELLITE_AUDIO	0x0f01
+#define PCI_CLASS_SATELLITE_VOICE	0x0f03
+#define PCI_CLASS_SATELLITE_DATA	0x0f04
+
+#define PCI_BASE_CLASS_CRYPT		0x10
+#define PCI_CLASS_CRYPT_NETWORK		0x1000
+#define PCI_CLASS_CRYPT_ENTERTAINMENT	0x1001
+#define PCI_CLASS_CRYPT_OTHER		0x1080
+
+#define PCI_BASE_CLASS_SIGNAL_PROCESSING 0x11
+#define PCI_CLASS_SP_DPIO		0x1100
+#define PCI_CLASS_SP_OTHER		0x1180
+
+#define PCI_CLASS_OTHERS		0xff
+
+/* Vendors */
+
+#define PCI_VENDOR_ID_DYNALINK		0x0675
+#define PCI_VENDOR_ID_BERKOM			0x0871
+#define PCI_VENDOR_ID_COMPAQ		0x0e11
+#define PCI_VENDOR_ID_NCR		0x1000
+#define PCI_VENDOR_ID_LSI_LOGIC		0x1000
+#define PCI_VENDOR_ID_ATI		0x1002
+#define PCI_VENDOR_ID_VLSI		0x1004
+#define PCI_VENDOR_ID_ADL		0x1005
+#define PCI_VENDOR_ID_NS		0x100b
+#define PCI_VENDOR_ID_TSENG		0x100c
+#define PCI_VENDOR_ID_WEITEK		0x100e
+#define PCI_VENDOR_ID_DEC		0x1011
+#define PCI_VENDOR_ID_CIRRUS		0x1013
+#define PCI_VENDOR_ID_IBM		0x1014
+#define PCI_VENDOR_ID_COMPEX2		0x101a
+/* pci.ids says "AT&T GIS (NCR)" */
+#define PCI_VENDOR_ID_WD		0x101c
+#define PCI_VENDOR_ID_AMI		0x101e
+#define PCI_VENDOR_ID_AMD		0x1022
+#define PCI_VENDOR_ID_TRIDENT		0x1023
+#define PCI_VENDOR_ID_AI		0x1025
+#define PCI_VENDOR_ID_DELL              0x1028
+#define PCI_VENDOR_ID_MATROX		0x102B
+#define PCI_VENDOR_ID_CT		0x102c
+#define PCI_VENDOR_ID_MIRO		0x1031
+#define PCI_VENDOR_ID_NEC		0x1033
+#define PCI_VENDOR_ID_FD		0x1036
+#define PCI_VENDOR_ID_SIS         	0x1039
+#define PCI_VENDOR_ID_SI		0x1039
+#define PCI_VENDOR_ID_HP		0x103c
+#define PCI_VENDOR_ID_PCTECH		0x1042
+#define PCI_VENDOR_ID_ASUSTEK		0x1043
+#define PCI_VENDOR_ID_DPT		0x1044
+#define PCI_VENDOR_ID_OPTI		0x1045
+#define PCI_VENDOR_ID_ELSA		0x1048
+#define PCI_VENDOR_ID_ELSA		0x1048
+#define PCI_VENDOR_ID_SGS		0x104a
+#define PCI_VENDOR_ID_BUSLOGIC		      0x104B
+#define PCI_VENDOR_ID_TI		0x104c
+#define PCI_VENDOR_ID_SONY		0x104d
+#define PCI_VENDOR_ID_OAK		0x104e
+/* Winbond have two vendor IDs! See 0x10ad as well */
+#define PCI_VENDOR_ID_WINBOND2		0x1050
+#define PCI_VENDOR_ID_ANIGMA		0x1051
+#define PCI_VENDOR_ID_EFAR		0x1055
+#define PCI_VENDOR_ID_MOTOROLA		0x1057
+#define PCI_VENDOR_ID_MOTOROLA_OOPS	0x1507
+#define PCI_VENDOR_ID_PROMISE		0x105a
+#define PCI_VENDOR_ID_N9		0x105d
+#define PCI_VENDOR_ID_UMC		0x1060
+#define PCI_VENDOR_ID_X			0x1061
+#define PCI_VENDOR_ID_MYLEX		0x1069
+#define PCI_VENDOR_ID_PICOP		0x1066
+#define PCI_VENDOR_ID_APPLE		0x106b
+#define PCI_VENDOR_ID_YAMAHA		0x1073
+#define PCI_VENDOR_ID_NEXGEN		0x1074
+#define PCI_VENDOR_ID_QLOGIC		0x1077
+#define PCI_VENDOR_ID_CYRIX		0x1078
+#define PCI_VENDOR_ID_LEADTEK		0x107d
+#define PCI_VENDOR_ID_INTERPHASE	0x107e
+#define PCI_VENDOR_ID_CONTAQ		0x1080
+#define PCI_VENDOR_ID_FOREX		0x1083
+#define PCI_VENDOR_ID_OLICOM		0x108d
+#define PCI_VENDOR_ID_SUN		0x108e
+#define PCI_VENDOR_ID_CMD		0x1095
+#define PCI_VENDOR_ID_VISION		0x1098
+#define PCI_VENDOR_ID_BROOKTREE		0x109e
+#define PCI_VENDOR_ID_SIERRA		0x10a8
+#define PCI_VENDOR_ID_SGI		0x10a9
+#define PCI_VENDOR_ID_ACC		0x10aa
+#define PCI_VENDOR_ID_WINBOND		0x10ad
+#define PCI_VENDOR_ID_DATABOOK		0x10b3
+#define PCI_VENDOR_ID_PLX		0x10b5
+#define PCI_VENDOR_ID_MADGE		0x10b6
+#define PCI_VENDOR_ID_3COM		0x10b7
+#define PCI_VENDOR_ID_SMC		0x10b8
+#define PCI_VENDOR_ID_SUNDANCE		0x13F0
+#define PCI_VENDOR_ID_AL		0x10b9
+#define PCI_VENDOR_ID_MITSUBISHI	0x10ba
+#define PCI_VENDOR_ID_SURECOM		0x10bd
+#define PCI_VENDOR_ID_NEOMAGIC		0x10c8
+#define PCI_VENDOR_ID_ASP		0x10cd
+#define PCI_VENDOR_ID_MACRONIX		0x10d9
+#define PCI_VENDOR_ID_TCONRAD		0x10da
+#define PCI_VENDOR_ID_CERN		0x10dc
+#define PCI_VENDOR_ID_NVIDIA			0x10de
+#define PCI_VENDOR_ID_IMS		0x10e0
+#define PCI_VENDOR_ID_TEKRAM2		0x10e1
+#define PCI_VENDOR_ID_TUNDRA		0x10e3
+#define PCI_VENDOR_ID_AMCC		0x10e8
+#define PCI_VENDOR_ID_INTERG		0x10ea
+#define PCI_VENDOR_ID_REALTEK		0x10ec
+#define PCI_VENDOR_ID_XILINX		0x10ee
+#define PCI_VENDOR_ID_TRUEVISION	0x10fa
+#define PCI_VENDOR_ID_INIT		0x1101
+#define PCI_VENDOR_ID_CREATIVE		0x1102
+/* duplicate: ECTIVA */
+#define PCI_VENDOR_ID_ECTIVA		0x1102
+/* duplicate: CREATIVE */
+#define PCI_VENDOR_ID_TTI		0x1103
+#define PCI_VENDOR_ID_VIA		0x1106
+#define PCI_VENDOR_ID_VIATEC		0x1106
+#define PCI_VENDOR_ID_SIEMENS           0x110A
+#define PCI_VENDOR_ID_SMC2		0x1113
+#define PCI_VENDOR_ID_VORTEX		0x1119
+#define PCI_VENDOR_ID_EF		0x111a
+#define PCI_VENDOR_ID_IDT		0x111d
+#define PCI_VENDOR_ID_FORE		0x1127
+#define PCI_VENDOR_ID_IMAGINGTECH	0x112f
+#define PCI_VENDOR_ID_PHILIPS		0x1131
+#define PCI_VENDOR_ID_EICON		0x1133
+#define PCI_VENDOR_ID_CYCLONE		0x113c
+#define PCI_VENDOR_ID_ALLIANCE		0x1142
+#define PCI_VENDOR_ID_SYSKONNECT	0x1148
+#define PCI_VENDOR_ID_VMIC		0x114a
+#define PCI_VENDOR_ID_DIGI		0x114f
+#define PCI_VENDOR_ID_MUTECH		0x1159
+#define PCI_VENDOR_ID_XIRCOM		0x115d
+#define PCI_VENDOR_ID_RENDITION		0x1163
+#define PCI_VENDOR_ID_SERVERWORKS	  0x1166
+#define PCI_VENDOR_ID_SBE		0x1176
+#define PCI_VENDOR_ID_TOSHIBA		0x1179
+#define PCI_VENDOR_ID_RICOH		0x1180
+#define	PCI_VENDOR_ID_DLINK		0x1186
+#define PCI_VENDOR_ID_ARTOP		0x1191
+#define PCI_VENDOR_ID_ZEITNET		0x1193
+#define PCI_VENDOR_ID_OMEGA		0x119b
+#define PCI_VENDOR_ID_FUJITSU_ME	0x119e
+#define PCI_SUBVENDOR_ID_KEYSPAN	0x11a9
+#define PCI_VENDOR_ID_GALILEO		0x11ab
+#define PCI_VENDOR_ID_LINKSYS		0x11ad
+#define PCI_VENDOR_ID_LITEON		0x11ad
+#define PCI_VENDOR_ID_V3		0x11b0
+#define PCI_VENDOR_ID_NP		0x11bc
+#define PCI_VENDOR_ID_ATT		0x11c1
+#define PCI_VENDOR_ID_SPECIALIX		0x11cb
+#define PCI_VENDOR_ID_AURAVISION	0x11d1
+#define PCI_VENDOR_ID_ANALOG_DEVICES	0x11d4
+#define PCI_VENDOR_ID_IKON		0x11d5
+#define PCI_VENDOR_ID_ZORAN		0x11de
+#define PCI_VENDOR_ID_KINETIC		0x11f4
+#define PCI_VENDOR_ID_COMPEX		0x11f6
+#define PCI_VENDOR_ID_RP		0x11fe
+#define PCI_VENDOR_ID_CYCLADES		0x120e
+#define PCI_VENDOR_ID_ESSENTIAL		0x120f
+#define PCI_VENDOR_ID_O2		0x1217
+#define PCI_VENDOR_ID_3DFX		0x121a
+#define PCI_VENDOR_ID_SIGMADES		0x1236
+#define PCI_VENDOR_ID_CCUBE		0x123f
+#define PCI_VENDOR_ID_AVM		0x1244
+#define PCI_VENDOR_ID_DIPIX		0x1246
+#define PCI_VENDOR_ID_STALLION		0x124d
+#define PCI_VENDOR_ID_OPTIBASE		0x1255
+#define PCI_VENDOR_ID_ESS		0x125d
+#define PCI_VENDOR_ID_HARRIS        	0x1260
+#define PCI_VENDOR_ID_SATSAGEM		0x1267
+#define PCI_VENDOR_ID_HUGHES		0x1273
+#define PCI_VENDOR_ID_ENSONIQ		0x1274
+#define PCI_VENDOR_ID_ROCKWELL		0x127A
+#define PCI_VENDOR_ID_DAVICOM		0x1282
+#define PCI_VENDOR_ID_ITE		0x1283
+/* formerly Platform Tech */
+#define PCI_VENDOR_ID_ESS_OLD		0x1285
+#define PCI_VENDOR_ID_ALTEON		0x12ae
+#define PCI_VENDOR_ID_USR		0x12B9
+#define	PCI_VENDOR_ID_HOLTEK		0x12c3
+#define PCI_SUBVENDOR_ID_CONNECT_TECH			0x12c4
+#define PCI_VENDOR_ID_PICTUREL		0x12c5
+#define PCI_VENDOR_ID_NVIDIA_SGS	0x12d2
+#define PCI_SUBVENDOR_ID_CHASE_PCIFAST		0x12E0
+#define PCI_SUBVENDOR_ID_CHASE_PCIRAS		0x124D
+#define PCI_VENDOR_ID_AUREAL		0x12eb
+#define PCI_VENDOR_ID_CBOARDS		0x1307
+#define PCI_VENDOR_ID_SIIG		0x131f
+#define PCI_VENDOR_ID_ADMTEK            0x1317
+#define PCI_VENDOR_ID_DOMEX		0x134a
+#define PCI_VENDOR_ID_QUATECH		0x135C
+#define PCI_VENDOR_ID_SEALEVEL		0x135e
+#define PCI_VENDOR_ID_HYPERCOPE		0x1365
+#define PCI_VENDOR_ID_KAWASAKI		0x136b
+#define PCI_VENDOR_ID_LMC		0x1376
+#define PCI_VENDOR_ID_NETGEAR		0x1385
+#define PCI_VENDOR_ID_APPLICOM		0x1389
+#define PCI_VENDOR_ID_MOXA		0x1393
+#define PCI_VENDOR_ID_CCD		0x1397
+#define PCI_VENDOR_ID_MICROGATE		0x13c0
+#define PCI_VENDOR_ID_3WARE		0x13C1
+#define PCI_VENDOR_ID_ABOCOM		0x13D1
+#define PCI_VENDOR_ID_CMEDIA		0x13f6
+#define PCI_VENDOR_ID_LAVA		0x1407
+#define PCI_VENDOR_ID_TIMEDIA		0x1409
+#define PCI_VENDOR_ID_OXSEMI		0x1415
+#define PCI_VENDOR_ID_AIRONET		0x14b9
+#define PCI_VENDOR_ID_MYRICOM		0x14c1
+#define PCI_VENDOR_ID_TITAN		0x14D2
+#define PCI_VENDOR_ID_PANACOM		0x14d4
+#define PCI_VENDOR_ID_BROADCOM		0x14e4
+#define PCI_VENDOR_ID_SYBA		0x1592
+#define PCI_VENDOR_ID_MORETON		0x15aa
+#define PCI_VENDOR_ID_ZOLTRIX		0x15b0
+#define PCI_VENDOR_ID_PDC		0x15e9
+#define PCI_VENDOR_ID_FSC		0x1734
+#define PCI_VENDOR_ID_SYMPHONY		0x1c1c
+#define PCI_VENDOR_ID_TEKRAM		0x1de1
+#define PCI_VENDOR_ID_3DLABS		0x3d3d
+#define PCI_VENDOR_ID_AVANCE		0x4005
+#define PCI_VENDOR_ID_AKS		0x416c
+#define PCI_VENDOR_ID_NETVIN		0x4a14
+#define PCI_VENDOR_ID_S3		0x5333
+#define PCI_VENDOR_ID_DCI		0x6666
+#define PCI_VENDOR_ID_GENROCO		0x5555
+#define PCI_VENDOR_ID_INTEL		0x8086
+#define PCI_VENDOR_ID_COMPUTONE		0x8e0e
+#define PCI_SUBVENDOR_ID_COMPUTONE	0x8e0e
+#define PCI_VENDOR_ID_KTI		0x8e2e
+#define PCI_VENDOR_ID_ADAPTEC		0x9004
+#define PCI_VENDOR_ID_ADAPTEC2		0x9005
+#define PCI_VENDOR_ID_ATRONICS		0x907f
+#define PCI_VENDOR_ID_HOLTEK2		0x9412
+#define PCI_VENDOR_ID_NETMOS		0x9710
+#define PCI_SUBVENDOR_ID_EXSYS		0xd84d
+#define PCI_VENDOR_ID_TIGERJET		0xe159
+#define PCI_VENDOR_ID_ARK		0xedd8
+
+#endif /* _IPXE_PCI_IDS_H */
diff --git a/src/include/ipxe/pci_io.h b/src/include/ipxe/pci_io.h
new file mode 100644
index 0000000..1188090
--- /dev/null
+++ b/src/include/ipxe/pci_io.h
@@ -0,0 +1,124 @@
+#ifndef _IPXE_PCI_IO_H
+#define _IPXE_PCI_IO_H
+
+/** @file
+ *
+ * PCI I/O API
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/api.h>
+#include <config/ioapi.h>
+
+/**
+ * Calculate static inline PCI I/O API function name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ */
+#define PCIAPI_INLINE( _subsys, _api_func ) \
+	SINGLE_API_INLINE ( PCIAPI_PREFIX_ ## _subsys, _api_func )
+
+/**
+ * Provide a PCI I/O API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_PCIAPI( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( PCIAPI_PREFIX_ ## _subsys, _api_func, _func )
+
+/**
+ * Provide a static inline PCI I/O API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ */
+#define PROVIDE_PCIAPI_INLINE( _subsys, _api_func ) \
+	PROVIDE_SINGLE_API_INLINE ( PCIAPI_PREFIX_ ## _subsys, _api_func )
+
+/* Include all architecture-independent I/O API headers */
+#include <ipxe/efi/efi_pci.h>
+
+/* Include all architecture-dependent I/O API headers */
+#include <bits/pci_io.h>
+
+/**
+ * Determine maximum PCI bus number within system
+ *
+ * @ret max_bus		Maximum bus number
+ */
+int pci_max_bus ( void );
+
+/**
+ * Read byte from PCI configuration space
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value read
+ * @ret rc	Return status code
+ */
+int pci_read_config_byte ( struct pci_device *pci, unsigned int where,
+			   uint8_t *value );
+
+/**
+ * Read 16-bit word from PCI configuration space
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value read
+ * @ret rc	Return status code
+ */
+int pci_read_config_word ( struct pci_device *pci, unsigned int where,
+			   uint16_t *value );
+
+/**
+ * Read 32-bit dword from PCI configuration space
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value read
+ * @ret rc	Return status code
+ */
+int pci_read_config_dword ( struct pci_device *pci, unsigned int where,
+			    uint32_t *value );
+
+/**
+ * Write byte to PCI configuration space
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value to be written
+ * @ret rc	Return status code
+ */
+int pci_write_config_byte ( struct pci_device *pci, unsigned int where,
+			    uint8_t value );
+
+/**
+ * Write 16-bit word to PCI configuration space
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value to be written
+ * @ret rc	Return status code
+ */
+int pci_write_config_word ( struct pci_device *pci, unsigned int where,
+			    uint16_t value );
+
+/**
+ * Write 32-bit dword to PCI configuration space
+ *
+ * @v pci	PCI device
+ * @v where	Location within PCI configuration space
+ * @v value	Value to be written
+ * @ret rc	Return status code
+ */
+int pci_write_config_dword ( struct pci_device *pci, unsigned int where,
+			     uint32_t value );
+
+#endif /* _IPXE_PCI_IO_H */
diff --git a/src/include/ipxe/pcibackup.h b/src/include/ipxe/pcibackup.h
new file mode 100644
index 0000000..b9f55cf
--- /dev/null
+++ b/src/include/ipxe/pcibackup.h
@@ -0,0 +1,33 @@
+#ifndef _IPXE_PCIBACKUP_H
+#define _IPXE_PCIBACKUP_H
+
+/** @file
+ *
+ * PCI configuration space backup and restoration
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/** A PCI configuration space backup */
+struct pci_config_backup {
+	uint32_t dwords[64];
+};
+
+/** PCI configuration space backup exclusion list end marker */
+#define PCI_CONFIG_BACKUP_EXCLUDE_END 0xff
+
+/** Define a PCI configuration space backup exclusion list */
+#define PCI_CONFIG_BACKUP_EXCLUDE(...) \
+	{ __VA_ARGS__, PCI_CONFIG_BACKUP_EXCLUDE_END }
+
+extern void pci_backup ( struct pci_device *pci,
+			 struct pci_config_backup *backup,
+			 const uint8_t *exclude );
+extern void pci_restore ( struct pci_device *pci,
+			  struct pci_config_backup *backup,
+			  const uint8_t *exclude );
+
+#endif /* _IPXE_PCIBACKUP_H */
diff --git a/src/include/ipxe/posix_io.h b/src/include/ipxe/posix_io.h
new file mode 100644
index 0000000..11f3bb5
--- /dev/null
+++ b/src/include/ipxe/posix_io.h
@@ -0,0 +1,87 @@
+#ifndef _IPXE_POSIX_IO_H
+#define _IPXE_POSIX_IO_H
+
+/** @file
+ *
+ * POSIX-like I/O
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/uaccess.h>
+
+/** Minimum file descriptor that will ever be allocated */
+#define POSIX_FD_MIN ( 1 )
+
+/** Maximum file descriptor that will ever be allocated */
+#define POSIX_FD_MAX ( 31 )
+
+/** File descriptor set as used for select() */
+typedef uint32_t fd_set;
+
+extern int open ( const char *uri_string );
+extern ssize_t read_user ( int fd, userptr_t buffer,
+			   off_t offset, size_t len );
+extern int select ( fd_set *readfds, int wait );
+extern ssize_t fsize ( int fd );
+extern int close ( int fd );
+
+/**
+ * Zero a file descriptor set
+ *
+ * @v set		File descriptor set
+ */
+static inline __attribute__ (( always_inline )) void
+FD_ZERO ( fd_set *set ) {
+	*set = 0;
+}
+
+/**
+ * Set a bit within a file descriptor set
+ *
+ * @v fd		File descriptor
+ * @v set		File descriptor set
+ */
+static inline __attribute__ (( always_inline )) void
+FD_SET ( int fd, fd_set *set ) {
+	*set |= ( 1 << fd );
+}
+
+/**
+ * Clear a bit within a file descriptor set
+ *
+ * @v fd		File descriptor
+ * @v set		File descriptor set
+ */
+static inline __attribute__ (( always_inline )) void
+FD_CLR ( int fd, fd_set *set ) {
+	*set &= ~( 1 << fd );
+}
+
+/**
+ * Test a bit within a file descriptor set
+ *
+ * @v fd		File descriptor
+ * @v set		File descriptor set
+ * @ret is_set		Corresponding bit is set
+ */
+static inline __attribute__ (( always_inline )) int
+FD_ISSET ( int fd, fd_set *set ) {
+	return ( *set & ( 1 << fd ) );
+}
+
+/**
+ * Read data from file
+ *
+ * @v fd		File descriptor
+ * @v buf		Data buffer
+ * @v len		Maximum length to read
+ * @ret len		Actual length read, or negative error number
+ */
+static inline ssize_t read ( int fd, void *buf, size_t len ) {
+	return read_user ( fd, virt_to_user ( buf ), 0, len );
+}
+
+#endif /* _IPXE_POSIX_IO_H */
diff --git a/src/include/ipxe/process.h b/src/include/ipxe/process.h
new file mode 100644
index 0000000..7cd5b91
--- /dev/null
+++ b/src/include/ipxe/process.h
@@ -0,0 +1,80 @@
+#ifndef _IPXE_PROCESS_H
+#define _IPXE_PROCESS_H
+
+/** @file
+ *
+ * Processes
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/list.h>
+#include <ipxe/refcnt.h>
+#include <ipxe/tables.h>
+
+/** A process */
+struct process {
+	/** List of processes */
+	struct list_head list;
+	/**
+	 * Single-step the process
+	 *
+	 * This method should execute a single step of the process.
+	 * Returning from this method is isomorphic to yielding the
+	 * CPU to another process.
+	 */
+	void ( * step ) ( struct process *process );
+	/** Reference counter
+	 *
+	 * If this interface is not part of a reference-counted
+	 * object, this field may be NULL.
+	 */
+	struct refcnt *refcnt;
+};
+
+extern void process_add ( struct process *process );
+extern void process_del ( struct process *process );
+extern void step ( void );
+
+/**
+ * Initialise process without adding to process list
+ *
+ * @v process		Process
+ * @v step		Process' step() method
+ */
+static inline __attribute__ (( always_inline )) void
+process_init_stopped ( struct process *process,
+		       void ( * step ) ( struct process *process ),
+		       struct refcnt *refcnt ) {
+	INIT_LIST_HEAD ( &process->list );
+	process->step = step;
+	process->refcnt = refcnt;
+}
+
+/**
+ * Initialise process and add to process list
+ *
+ * @v process		Process
+ * @v step		Process' step() method
+ */
+static inline __attribute__ (( always_inline )) void
+process_init ( struct process *process,
+	       void ( * step ) ( struct process *process ),
+	       struct refcnt *refcnt ) {
+	process_init_stopped ( process, step, refcnt );
+	process_add ( process );
+}
+
+/** Permanent process table */
+#define PERMANENT_PROCESSES __table ( struct process, "processes" )
+
+/**
+ * Declare a permanent process
+ *
+ * Permanent processes will be automatically added to the process list
+ * at initialisation time.
+ */
+#define __permanent_process __table_entry ( PERMANENT_PROCESSES, 01 )
+
+#endif /* _IPXE_PROCESS_H */
diff --git a/src/include/ipxe/profile.h b/src/include/ipxe/profile.h
new file mode 100644
index 0000000..60dd53a
--- /dev/null
+++ b/src/include/ipxe/profile.h
@@ -0,0 +1,80 @@
+#ifndef _IPXE_PROFILE_H
+#define _IPXE_PROFILE_H
+
+/** @file
+ *
+ * Profiling
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/**
+ * A data structure for storing profiling information
+ */
+union profiler {
+	/** Timestamp (in CPU-specific "ticks") */
+	uint64_t timestamp;
+	/** Registers returned by rdtsc.
+	 *
+	 * This part should really be architecture-specific code.
+	 */
+	struct {
+		uint32_t eax;
+		uint32_t edx;
+	} rdtsc;
+};
+
+/**
+ * Static per-object profiler, for use with simple_profile()
+ */
+static union profiler simple_profiler;
+
+/**
+ * Perform profiling
+ *
+ * @v profiler		Profiler data structure
+ * @ret delta		Elapsed ticks since last call to profile().
+ *
+ * Call profile() both before and after the code you wish to measure.
+ * The "after" call will return the measurement.  For example:
+ *
+ * @code
+ *
+ *     profile ( &profiler );
+ *     ... do something here ...
+ *     printf ( "It took %ld ticks to execute\n", profile ( &profiler ) );
+ *
+ * @endcode
+ */
+static inline __attribute__ (( always_inline )) unsigned long
+profile ( union profiler *profiler ) {
+	uint64_t last_timestamp = profiler->timestamp;
+
+	__asm__ __volatile__ ( "rdtsc" :
+			       "=a" ( profiler->rdtsc.eax ),
+			       "=d" ( profiler->rdtsc.edx ) );
+	return ( profiler->timestamp - last_timestamp );
+}
+
+/**
+ * Perform profiling
+ *
+ * @ret delta		Elapsed ticks since last call to profile().
+ *
+ * When you only need one profiler, you can avoid the hassle of
+ * creating your own @c profiler data structure by using
+ * simple_profile() instead.
+ *
+ * simple_profile() is equivalent to profile(&simple_profiler), where
+ * @c simple_profiler is a @c profiler data structure that is static
+ * to each object which includes @c profile.h.
+ */
+static inline __attribute__ (( always_inline )) unsigned long
+simple_profile ( void ) {
+	return profile ( &simple_profiler );
+}
+
+#endif /* _IPXE_PROFILE_H */
diff --git a/src/include/ipxe/ramdisk.h b/src/include/ipxe/ramdisk.h
new file mode 100644
index 0000000..012ac73
--- /dev/null
+++ b/src/include/ipxe/ramdisk.h
@@ -0,0 +1,24 @@
+#ifndef _IPXE_RAMDISK_H
+#define _IPXE_RAMDISK_H
+
+/**
+ * @file
+ *
+ * RAM disks
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/uaccess.h>
+#include <ipxe/blockdev.h>
+
+struct ramdisk {
+	struct block_device blockdev;
+	userptr_t data;
+};
+
+extern int init_ramdisk ( struct ramdisk *ramdisk, userptr_t data, size_t len,
+			  unsigned int blksize );
+
+#endif /* _IPXE_RAMDISK_H */
diff --git a/src/include/ipxe/rarp.h b/src/include/ipxe/rarp.h
new file mode 100644
index 0000000..7edbe21
--- /dev/null
+++ b/src/include/ipxe/rarp.h
@@ -0,0 +1,16 @@
+#ifndef _IPXE_RARP_H
+#define _IPXE_RARP_H
+
+/** @file
+ *
+ * Reverse Address Resolution Protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct net_protocol;
+
+extern struct net_protocol rarp_protocol;
+
+#endif /* _IPXE_RARP_H */
diff --git a/src/include/ipxe/rc80211.h b/src/include/ipxe/rc80211.h
new file mode 100644
index 0000000..eac6bc9
--- /dev/null
+++ b/src/include/ipxe/rc80211.h
@@ -0,0 +1,19 @@
+#ifndef _IPXE_RC80211_H
+#define _IPXE_RC80211_H
+
+/** @file
+ *
+ * Rate-control algorithm prototype for 802.11.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct net80211_device;
+struct rc80211_ctx;
+
+struct rc80211_ctx * rc80211_init ( struct net80211_device *dev );
+void rc80211_update_tx ( struct net80211_device *dev, int retries, int rc );
+void rc80211_update_rx ( struct net80211_device *dev, int retry, u16 rate );
+void rc80211_free ( struct rc80211_ctx *ctx );
+
+#endif /* _IPXE_RC80211_H */
diff --git a/src/include/ipxe/refcnt.h b/src/include/ipxe/refcnt.h
new file mode 100644
index 0000000..4b02322
--- /dev/null
+++ b/src/include/ipxe/refcnt.h
@@ -0,0 +1,46 @@
+#ifndef _IPXE_REFCNT_H
+#define _IPXE_REFCNT_H
+
+/** @file
+ *
+ * Reference counting
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/**
+ * A reference counter
+ *
+ * This data structure is designed to be embedded within a
+ * reference-counted object.
+ *
+ * Reference-counted objects are freed when their reference count
+ * drops below zero.  This means that a freshly allocated-and-zeroed
+ * reference-counted object will be freed on the first call to
+ * ref_put().
+ */
+struct refcnt {
+	/** Current reference count
+	 *
+	 * When this count is decremented below zero, the free()
+	 * method will be called.
+	 */
+	int refcnt;
+	/** Free containing object
+	 *
+	 * This method is called when the reference count is
+	 * decremented below zero.
+	 *
+	 * If this method is left NULL, the standard library free()
+	 * function will be called.  The upshot of this is that you
+	 * may omit the free() method if the @c refcnt object is the
+	 * first element of your reference-counted struct.
+	 */
+	void ( * free ) ( struct refcnt *refcnt );
+};
+
+extern struct refcnt * ref_get ( struct refcnt *refcnt );
+extern void ref_put ( struct refcnt *refcnt );
+
+#endif /* _IPXE_REFCNT_H */
diff --git a/src/include/ipxe/resolv.h b/src/include/ipxe/resolv.h
new file mode 100644
index 0000000..c7d6199
--- /dev/null
+++ b/src/include/ipxe/resolv.h
@@ -0,0 +1,170 @@
+#ifndef _IPXE_RESOLV_H
+#define _IPXE_RESOLV_H
+
+/** @file
+ *
+ * Name resolution
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/refcnt.h>
+#include <ipxe/interface.h>
+#include <ipxe/tables.h>
+#include <ipxe/socket.h>
+
+struct resolv_interface;
+
+/** Name resolution interface operations */
+struct resolv_interface_operations {
+	/** Name resolution completed
+	 *
+	 * @v resolv		Name resolution interface
+	 * @v sa		Completed socket address (if successful)
+	 * @v rc		Final status code
+	 */
+	void ( * done ) ( struct resolv_interface *resolv,
+			  struct sockaddr *sa, int rc );
+};
+
+/** A name resolution interface */
+struct resolv_interface {
+	/** Generic object communication interface */
+	struct interface intf;
+	/** Operations for received messages */
+	struct resolv_interface_operations *op;
+};
+
+extern struct resolv_interface null_resolv;
+extern struct resolv_interface_operations null_resolv_ops;
+
+/**
+ * Initialise a name resolution interface
+ *
+ * @v resolv		Name resolution interface
+ * @v op		Name resolution interface operations
+ * @v refcnt		Containing object reference counter, or NULL
+ */
+static inline void resolv_init ( struct resolv_interface *resolv,
+				 struct resolv_interface_operations *op,
+				 struct refcnt *refcnt ) {
+	resolv->intf.dest = &null_resolv.intf;
+	resolv->intf.refcnt = refcnt;
+	resolv->op = op;
+}
+
+/**
+ * Get name resolution interface from generic object communication interface
+ *
+ * @v intf		Generic object communication interface
+ * @ret resolv		Name resolution interface
+ */
+static inline __attribute__ (( always_inline )) struct resolv_interface *
+intf_to_resolv ( struct interface *intf ) {
+	return container_of ( intf, struct resolv_interface, intf );
+}
+
+/**
+ * Get reference to destination name resolution interface
+ *
+ * @v resolv		Name resolution interface
+ * @ret dest		Destination interface
+ */
+static inline __attribute__ (( always_inline )) struct resolv_interface *
+resolv_get_dest ( struct resolv_interface *resolv ) {
+	return intf_to_resolv ( intf_get ( resolv->intf.dest ) );
+}
+
+/**
+ * Drop reference to name resolution interface
+ *
+ * @v resolv		name resolution interface
+ */
+static inline __attribute__ (( always_inline )) void
+resolv_put ( struct resolv_interface *resolv ) {
+	intf_put ( &resolv->intf );
+}
+
+/**
+ * Plug a name resolution interface into a new destination interface
+ *
+ * @v resolv		Name resolution interface
+ * @v dest		New destination interface
+ */
+static inline __attribute__ (( always_inline )) void
+resolv_plug ( struct resolv_interface *resolv, struct resolv_interface *dest ) {
+	plug ( &resolv->intf, &dest->intf );
+}
+
+/**
+ * Plug two name resolution interfaces together
+ *
+ * @v a			Name resolution interface A
+ * @v b			Name resolution interface B
+ */
+static inline __attribute__ (( always_inline )) void
+resolv_plug_plug ( struct resolv_interface *a, struct resolv_interface *b ) {
+	plug_plug ( &a->intf, &b->intf );
+}
+
+/**
+ * Unplug a name resolution interface
+ *
+ * @v resolv		Name resolution interface
+ */
+static inline __attribute__ (( always_inline )) void
+resolv_unplug ( struct resolv_interface *resolv ) {
+	plug ( &resolv->intf, &null_resolv.intf );
+}
+
+/**
+ * Stop using a name resolution interface
+ *
+ * @v resolv		Name resolution interface
+ *
+ * After calling this method, no further messages will be received via
+ * the interface.
+ */
+static inline void resolv_nullify ( struct resolv_interface *resolv ) {
+	resolv->op = &null_resolv_ops;
+};
+
+/** A name resolver */
+struct resolver {
+	/** Name of this resolver (e.g. "DNS") */
+	const char *name;
+	/** Start name resolution
+	 *
+	 * @v resolv		Name resolution interface
+	 * @v name		Name to resolve
+	 * @v sa		Socket address to complete
+	 * @ret rc		Return status code
+	 */
+	int ( * resolv ) ( struct resolv_interface *resolv, const char *name,
+			   struct sockaddr *sa );
+};
+
+/** Numeric resolver priority */
+#define RESOLV_NUMERIC 01
+
+/** Normal resolver priority */
+#define RESOLV_NORMAL 02
+
+/** Resolvers table */
+#define RESOLVERS __table ( struct resolver, "resolvers" )
+
+/** Register as a name resolver */
+#define __resolver( resolv_order ) __table_entry ( RESOLVERS, resolv_order )
+
+extern void resolv_done ( struct resolv_interface *resolv,
+			  struct sockaddr *sa, int rc );
+extern void ignore_resolv_done ( struct resolv_interface *resolv,
+			  struct sockaddr *sa, int rc );
+extern struct resolv_interface_operations null_resolv_ops;
+extern struct resolv_interface null_resolv;
+
+extern int resolv ( struct resolv_interface *resolv, const char *name,
+		    struct sockaddr *sa );
+
+#endif /* _IPXE_RESOLV_H */
diff --git a/src/include/ipxe/retry.h b/src/include/ipxe/retry.h
new file mode 100644
index 0000000..370a599
--- /dev/null
+++ b/src/include/ipxe/retry.h
@@ -0,0 +1,81 @@
+#ifndef _IPXE_RETRY_H
+#define _IPXE_RETRY_H
+
+/** @file
+ *
+ * Retry timers
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/list.h>
+
+/** Default timeout value */
+#define DEFAULT_MIN_TIMEOUT ( TICKS_PER_SEC / 4 )
+
+/** Limit after which the timeout will be deemed permanent */
+#define DEFAULT_MAX_TIMEOUT ( 10 * TICKS_PER_SEC )
+
+/** A retry timer */
+struct retry_timer {
+	/** List of active timers */
+	struct list_head list;
+	/** Timer is currently running */
+	unsigned int running;
+	/** Timeout value (in ticks) */
+	unsigned long timeout;
+	/** Minimum timeout value (in ticks)
+	 *
+	 * A value of zero means "use default timeout."
+	 */
+	unsigned long min_timeout;
+	/** Maximum timeout value before failure (in ticks)
+	 *
+	 * A value of zero means "use default timeout."
+	 */
+	unsigned long max_timeout;
+	/** Start time (in ticks) */
+	unsigned long start;
+	/** Retry count */
+	unsigned int count;
+	/** Timer expired callback
+	 *
+	 * @v timer	Retry timer
+	 * @v fail	Failure indicator
+	 *
+	 * The timer will already be stopped when this method is
+	 * called.  The failure indicator will be True if the retry
+	 * timeout has already exceeded @c MAX_TIMEOUT.
+	 */
+	void ( * expired ) ( struct retry_timer *timer, int over );
+};
+
+extern void start_timer ( struct retry_timer *timer );
+extern void start_timer_fixed ( struct retry_timer *timer,
+				unsigned long timeout );
+extern void stop_timer ( struct retry_timer *timer );
+
+/**
+ * Start timer with no delay
+ *
+ * @v timer		Retry timer
+ *
+ * This starts the timer running with a zero timeout value.
+ */
+static inline void start_timer_nodelay ( struct retry_timer *timer ) {
+	start_timer_fixed ( timer, 0 );
+}
+
+/**
+ * Test to see if timer is currently running
+ *
+ * @v timer		Retry timer
+ * @ret running		Non-zero if timer is running
+ */
+static inline __attribute__ (( always_inline )) unsigned long
+timer_running ( struct retry_timer *timer ) {
+	return ( timer->running );
+}
+
+#endif /* _IPXE_RETRY_H */
diff --git a/src/include/ipxe/rotate.h b/src/include/ipxe/rotate.h
new file mode 100644
index 0000000..745d84e
--- /dev/null
+++ b/src/include/ipxe/rotate.h
@@ -0,0 +1,29 @@
+#ifndef _IPXE_ROTATE_H
+#define _IPXE_ROTATE_H
+
+/** @file
+ *
+ * Bit operations
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+static inline uint32_t rol32 ( uint32_t data, unsigned int rotation ) {
+        return ( ( data << rotation ) | ( data >> ( 32 - rotation ) ) );
+}
+
+static inline uint32_t ror32 ( uint32_t data, unsigned int rotation ) {
+        return ( ( data >> rotation ) | ( data << ( 32 - rotation ) ) );
+}
+
+static inline uint64_t rol64 ( uint64_t data, unsigned int rotation ) {
+        return ( ( data << rotation ) | ( data >> ( 64 - rotation ) ) );
+}
+
+static inline uint64_t ror64 ( uint64_t data, unsigned int rotation ) {
+        return ( ( data >> rotation ) | ( data << ( 64 - rotation ) ) );
+}
+
+#endif /* _IPXE_ROTATE_H */
diff --git a/src/include/ipxe/rsa.h b/src/include/ipxe/rsa.h
new file mode 100644
index 0000000..a080f9f
--- /dev/null
+++ b/src/include/ipxe/rsa.h
@@ -0,0 +1,12 @@
+#ifndef _IPXE_RSA_H
+#define _IPXE_RSA_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct pubkey_algorithm;
+
+extern struct pubkey_algorithm rsa_algorithm;
+
+#include "crypto/axtls/crypto.h"
+
+#endif /* _IPXE_RSA_H */
diff --git a/src/include/ipxe/sanboot.h b/src/include/ipxe/sanboot.h
new file mode 100644
index 0000000..d27452c
--- /dev/null
+++ b/src/include/ipxe/sanboot.h
@@ -0,0 +1,20 @@
+#ifndef _IPXE_SANBOOT_H
+#define _IPXE_SANBOOT_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tables.h>
+
+struct sanboot_protocol {
+	const char *prefix;
+	int ( * boot ) ( const char *root_path );
+};
+
+#define SANBOOT_PROTOCOLS \
+	__table ( struct sanboot_protocol, "sanboot_protocols" )
+
+#define __sanboot_protocol __table_entry ( SANBOOT_PROTOCOLS, 01 )
+
+extern int keep_san ( void );
+
+#endif /* _IPXE_SANBOOT_H */
diff --git a/src/include/ipxe/scsi.h b/src/include/ipxe/scsi.h
new file mode 100644
index 0000000..b56ab75
--- /dev/null
+++ b/src/include/ipxe/scsi.h
@@ -0,0 +1,281 @@
+#ifndef _IPXE_SCSI_H
+#define _IPXE_SCSI_H
+
+#include <stdint.h>
+#include <ipxe/blockdev.h>
+#include <ipxe/uaccess.h>
+#include <ipxe/refcnt.h>
+
+/** @file
+ *
+ * SCSI devices
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/**
+ * @defgroup scsiops SCSI operation codes
+ * @{
+ */
+
+#define SCSI_OPCODE_READ_10		0x28	/**< READ (10) */
+#define SCSI_OPCODE_READ_16		0x88	/**< READ (16) */
+#define SCSI_OPCODE_WRITE_10		0x2a	/**< WRITE (10) */
+#define SCSI_OPCODE_WRITE_16		0x8a	/**< WRITE (16) */
+#define SCSI_OPCODE_READ_CAPACITY_10	0x25	/**< READ CAPACITY (10) */
+#define SCSI_OPCODE_SERVICE_ACTION_IN	0x9e	/**< SERVICE ACTION IN */
+#define SCSI_SERVICE_ACTION_READ_CAPACITY_16 0x10 /**< READ CAPACITY (16) */
+
+/** @} */
+
+/**
+ * @defgroup scsiflags SCSI flags
+ * @{
+ */
+
+#define SCSI_FL_FUA_NV		0x02	/**< Force unit access to NVS */
+#define SCSI_FL_FUA		0x08	/**< Force unit access */
+#define SCSI_FL_DPO		0x10	/**< Disable cache page out */
+
+/** @} */
+
+/**
+ * @defgroup scsicdbs SCSI command data blocks
+ * @{
+ */
+
+/** A SCSI "READ (10)" CDB */
+struct scsi_cdb_read_10 {
+	/** Opcode (0x28) */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Start address
+	 *
+	 * This is a logical block number, in big-endian order.
+	 */
+	uint32_t lba;
+	/** Group number */
+	uint8_t group;
+	/** Transfer length
+	 *
+	 * This is a logical block count, in big-endian order.
+	 */
+	uint16_t len;
+	/** Control byte */
+	uint8_t control;
+} __attribute__ (( packed ));
+
+/** A SCSI "READ (16)" CDB */
+struct scsi_cdb_read_16 {
+	/** Opcode (0x88) */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Start address
+	 *
+	 * This is a logical block number, in big-endian order.
+	 */
+	uint64_t lba;
+	/** Transfer length
+	 *
+	 * This is a logical block count, in big-endian order.
+	 */
+	uint32_t len;
+	/** Group number */
+	uint8_t group;
+	/** Control byte */
+	uint8_t control;
+} __attribute__ (( packed ));
+
+/** A SCSI "WRITE (10)" CDB */
+struct scsi_cdb_write_10 {
+	/** Opcode (0x2a) */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Start address
+	 *
+	 * This is a logical block number, in big-endian order.
+	 */
+	uint32_t lba;
+	/** Group number */
+	uint8_t group;
+	/** Transfer length
+	 *
+	 * This is a logical block count, in big-endian order.
+	 */
+	uint16_t len;
+	/** Control byte */
+	uint8_t control;
+} __attribute__ (( packed ));
+
+/** A SCSI "WRITE (16)" CDB */
+struct scsi_cdb_write_16 {
+	/** Opcode (0x8a) */
+	uint8_t opcode;
+	/** Flags */
+	uint8_t flags;
+	/** Start address
+	 *
+	 * This is a logical block number, in big-endian order.
+	 */
+	uint64_t lba;
+	/** Transfer length
+	 *
+	 * This is a logical block count, in big-endian order.
+	 */
+	uint32_t len;
+	/** Group number */
+	uint8_t group;
+	/** Control byte */
+	uint8_t control;
+} __attribute__ (( packed ));
+
+/** A SCSI "READ CAPACITY (10)" CDB */
+struct scsi_cdb_read_capacity_10 {
+	/** Opcode (0x25) */
+	uint8_t opcode;
+	/** Reserved */
+	uint8_t reserved_a;
+	/** Logical block address
+	 *
+	 * Applicable only if the PMI bit is set.
+	 */
+	uint32_t lba;
+	/** Reserved */
+	uint8_t reserved_b[3];
+	/** Control byte */
+	uint8_t control;	
+} __attribute__ (( packed ));
+
+/** SCSI "READ CAPACITY (10)" parameter data */
+struct scsi_capacity_10 {
+	/** Maximum logical block number */
+	uint32_t lba;
+	/** Block length in bytes */
+	uint32_t blksize;
+} __attribute__ (( packed ));
+
+/** A SCSI "READ CAPACITY (16)" CDB */
+struct scsi_cdb_read_capacity_16 {
+	/** Opcode (0x9e) */
+	uint8_t opcode;
+	/** Service action */
+	uint8_t service_action;
+	/** Logical block address
+	 *
+	 * Applicable only if the PMI bit is set.
+	 */
+	uint64_t lba;
+	/** Transfer length
+	 *
+	 * This is the size of the data-in buffer, in bytes.
+	 */
+	uint32_t len;
+	/** Reserved */
+	uint8_t reserved;
+	/** Control byte */
+	uint8_t control;
+} __attribute__ (( packed ));
+
+/** SCSI "READ CAPACITY (16)" parameter data */
+struct scsi_capacity_16 {
+	/** Maximum logical block number */
+	uint64_t lba;
+	/** Block length in bytes */
+	uint32_t blksize;
+	/** Reserved */
+	uint8_t reserved[20];
+} __attribute__ (( packed ));
+
+/** A SCSI Command Data Block */
+union scsi_cdb {
+	struct scsi_cdb_read_10 read10;
+	struct scsi_cdb_read_16 read16;
+	struct scsi_cdb_write_10 write10;
+	struct scsi_cdb_write_16 write16;
+	struct scsi_cdb_read_capacity_10 readcap10;
+	struct scsi_cdb_read_capacity_16 readcap16;
+	unsigned char bytes[16];
+};
+
+/** printf() format for dumping a scsi_cdb */
+#define SCSI_CDB_FORMAT "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:" \
+			"%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x"
+
+/** printf() parameters for dumping a scsi_cdb */
+#define SCSI_CDB_DATA(cdb)						  \
+	(cdb).bytes[0], (cdb).bytes[1], (cdb).bytes[2], (cdb).bytes[3],	  \
+	(cdb).bytes[4], (cdb).bytes[5], (cdb).bytes[6], (cdb).bytes[7],	  \
+	(cdb).bytes[8], (cdb).bytes[9], (cdb).bytes[10], (cdb).bytes[11], \
+	(cdb).bytes[12], (cdb).bytes[13], (cdb).bytes[14], (cdb).bytes[15]
+
+/** @} */
+
+/** A SCSI command */
+struct scsi_command {
+	/** CDB for this command */
+	union scsi_cdb cdb;
+	/** Data-out buffer (may be NULL) */
+	userptr_t data_out;
+	/** Data-out buffer length
+	 *
+	 * Must be zero if @c data_out is NULL
+	 */
+	size_t data_out_len;
+	/** Data-in buffer (may be NULL) */
+	userptr_t data_in;
+	/** Data-in buffer length
+	 *
+	 * Must be zero if @c data_in is NULL
+	 */
+	size_t data_in_len;
+	/** SCSI status code */
+	uint8_t status;
+	/** SCSI sense response code */
+	uint8_t sense_response;
+	/** Command status code */
+	int rc;
+};
+
+/** A SCSI LUN
+ *
+ * This is a four-level LUN as specified by SAM-2, in big-endian
+ * order.
+ */
+struct scsi_lun {
+	uint16_t u16[4];
+}  __attribute__ (( packed ));
+
+/** A SCSI device */
+struct scsi_device {
+	/** Block device interface */
+	struct block_device blockdev;
+	/**
+	 * Issue SCSI command
+	 *
+	 * @v scsi		SCSI device
+	 * @v command		SCSI command
+	 * @ret rc		Return status code
+	 *
+	 * Note that a successful return status code indicates only
+	 * that the SCSI command was issued.  The caller must check
+	 * the status field in the command structure to see when the
+	 * command completes and whether, for example, the device
+	 * returned CHECK CONDITION or some other non-success status
+	 * code.
+	 */
+	int ( * command ) ( struct scsi_device *scsi,
+			    struct scsi_command *command );
+	/** Backing device */
+	struct refcnt *backend;
+};
+
+extern int scsi_detached_command ( struct scsi_device *scsi,
+				   struct scsi_command *command );
+extern int init_scsidev ( struct scsi_device *scsi );
+extern int scsi_parse_lun ( const char *lun_string, struct scsi_lun *lun );
+
+#endif /* _IPXE_SCSI_H */
diff --git a/src/include/ipxe/sec80211.h b/src/include/ipxe/sec80211.h
new file mode 100644
index 0000000..5ac96de
--- /dev/null
+++ b/src/include/ipxe/sec80211.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _IPXE_SEC80211_H
+#define _IPXE_SEC80211_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/net80211.h>
+#include <errno.h>
+
+/** @file
+ *
+ * Definitions for general secured-network routines.
+ *
+ * Any function in this file which may be referenced by code which is
+ * not exclusive to encryption-enabled builds (e.g. sec80211_detect(),
+ * which is called by net80211_probe_step() to fill the net80211_wlan
+ * structure's security fields) must be declared as a weak symbol,
+ * using an inline interface similar to that used for
+ * sec80211_detect() below. This prevents secure network support from
+ * bloating general builds by any more than a few tiny hooks to call
+ * crypto functions when crypto structures are non-NULL.
+ */
+
+int _sec80211_detect ( struct io_buffer *iob,
+		       enum net80211_security_proto *secprot,
+		       enum net80211_crypto_alg *crypt )
+	__attribute__ (( weak ));
+
+
+/**
+ * Inline safety wrapper for _sec80211_detect()
+ *
+ * @v iob	I/O buffer containing beacon frame
+ * @ret secprot	Security handshaking protocol used by network
+ * @ret crypt	Cryptosystem used by network
+ * @ret rc	Return status code
+ *
+ * This function transparently calls _sec80211_detect() if the file
+ * containing it was compiled in, or returns an error indication of
+ * @c -ENOTSUP if not.
+ */
+static inline int sec80211_detect ( struct io_buffer *iob,
+				    enum net80211_security_proto *secprot,
+				    enum net80211_crypto_alg *crypt ) {
+	if ( _sec80211_detect )
+		return _sec80211_detect ( iob, secprot, crypt );
+	return -ENOTSUP;
+}
+
+int sec80211_detect_ie ( int is_rsn, u8 *start, u8 *end,
+			 enum net80211_security_proto *secprot,
+			 enum net80211_crypto_alg *crypt );
+u8 * sec80211_find_rsn ( union ieee80211_ie *ie, void *ie_end,
+			 int *is_rsn, u8 **end );
+
+int sec80211_install ( struct net80211_crypto **which,
+		       enum net80211_crypto_alg crypt,
+		       const void *key, int len, const void *rsc );
+
+u32 sec80211_rsn_get_crypto_desc ( enum net80211_crypto_alg crypt, int rsnie );
+u32 sec80211_rsn_get_akm_desc ( enum net80211_security_proto secprot,
+				int rsnie );
+enum net80211_crypto_alg sec80211_rsn_get_net80211_crypt ( u32 desc );
+
+#endif /* _IPXE_SEC80211_H */
+
diff --git a/src/include/ipxe/segment.h b/src/include/ipxe/segment.h
new file mode 100644
index 0000000..37bed0e
--- /dev/null
+++ b/src/include/ipxe/segment.h
@@ -0,0 +1,17 @@
+#ifndef _IPXE_SEGMENT_H
+#define _IPXE_SEGMENT_H
+
+/**
+ * @file
+ *
+ * Executable image segments
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/uaccess.h>
+
+extern int prep_segment ( userptr_t segment, size_t filesz, size_t memsz );
+
+#endif /* _IPXE_SEGMENT_H */
diff --git a/src/include/ipxe/serial.h b/src/include/ipxe/serial.h
new file mode 100644
index 0000000..c16e56a
--- /dev/null
+++ b/src/include/ipxe/serial.h
@@ -0,0 +1,16 @@
+#ifndef _IPXE_SERIAL_H
+#define _IPXE_SERIAL_H
+
+/** @file
+ *
+ * Serial driver functions
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+extern void serial_putc ( int ch );
+extern int serial_getc ( void );
+extern int serial_ischar ( void );
+
+#endif /* _IPXE_SERIAL_H */
diff --git a/src/include/ipxe/settings.h b/src/include/ipxe/settings.h
new file mode 100644
index 0000000..1be1cf2
--- /dev/null
+++ b/src/include/ipxe/settings.h
@@ -0,0 +1,335 @@
+#ifndef _IPXE_SETTINGS_H
+#define _IPXE_SETTINGS_H
+
+/** @file
+ *
+ * Configuration settings
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/tables.h>
+#include <ipxe/list.h>
+#include <ipxe/refcnt.h>
+
+struct settings;
+struct in_addr;
+union uuid;
+
+/** A setting */
+struct setting {
+	/** Name
+	 *
+	 * This is the human-readable name for the setting.
+	 */
+	const char *name;
+	/** Description */
+	const char *description;
+	/** Setting type
+	 *
+	 * This identifies the type of setting (e.g. string, IPv4
+	 * address, etc.).
+	 */
+	struct setting_type *type;
+	/** DHCP option number, if applicable */
+	unsigned int tag;
+};
+
+/** Configuration setting table */
+#define SETTINGS __table ( struct setting, "settings" )
+
+/** Declare a configuration setting */
+#define __setting __table_entry ( SETTINGS, 01 )
+
+/** Settings block operations */
+struct settings_operations {
+	/** Store value of setting
+	 *
+	 * @v settings		Settings block
+	 * @v setting		Setting to store
+	 * @v data		Setting data, or NULL to clear setting
+	 * @v len		Length of setting data
+	 * @ret rc		Return status code
+	 */
+	int ( * store ) ( struct settings *settings, struct setting *setting,
+			  const void *data, size_t len );
+	/** Fetch value of setting
+	 *
+	 * @v settings		Settings block
+	 * @v setting		Setting to fetch
+	 * @v data		Buffer to fill with setting data
+	 * @v len		Length of buffer
+	 * @ret len		Length of setting data, or negative error
+	 *
+	 * The actual length of the setting will be returned even if
+	 * the buffer was too small.
+	 */
+	int ( * fetch ) ( struct settings *settings, struct setting *setting,
+			  void *data, size_t len );
+	/** Clear settings block
+	 *
+	 * @v settings		Settings block
+	 */
+	void ( * clear ) ( struct settings *settings );
+};
+
+/** A settings block */
+struct settings {
+	/** Reference counter */
+	struct refcnt *refcnt;
+	/** Name */
+	const char *name;
+	/** Tag magic
+	 *
+	 * This value will be ORed in to any numerical tags
+	 * constructed by parse_setting_name(), and can be used to
+	 * avoid e.g. attempting to retrieve the subnet mask from
+	 * SMBIOS, or the system UUID from DHCP.
+	 */
+	unsigned int tag_magic;
+	/** Parent settings block */
+	struct settings *parent;
+	/** Sibling settings blocks */
+	struct list_head siblings;
+	/** Child settings blocks */
+	struct list_head children;
+	/** Settings block operations */
+	struct settings_operations *op;
+};
+
+/**
+ * A setting type
+ *
+ * This represents a type of setting (e.g. string, IPv4 address,
+ * etc.).
+ */
+struct setting_type {
+	/** Name
+	 *
+	 * This is the name exposed to the user (e.g. "string").
+	 */
+	const char *name;
+	/** Parse and set value of setting
+	 *
+	 * @v settings		Settings block
+	 * @v setting		Setting to store
+	 * @v value		Formatted setting data
+	 * @ret rc		Return status code
+	 */
+	int ( * storef ) ( struct settings *settings, struct setting *setting,
+			   const char *value );
+	/** Fetch and format value of setting
+	 *
+	 * @v settings		Settings block
+	 * @v setting		Setting to fetch
+	 * @v buf		Buffer to contain formatted value
+	 * @v len		Length of buffer
+	 * @ret len		Length of formatted value, or negative error
+	 */
+	int ( * fetchf ) ( struct settings *settings, struct setting *setting,
+			   char *buf, size_t len );
+};
+
+/** Configuration setting type table */
+#define SETTING_TYPES __table ( struct setting_type, "setting_types" )
+
+/** Declare a configuration setting type */
+#define __setting_type __table_entry ( SETTING_TYPES, 01 )
+
+/**
+ * A settings applicator
+ *
+ */
+struct settings_applicator {
+	/** Apply updated settings
+	 *
+	 * @ret rc		Return status code
+	 */
+	int ( * apply ) ( void );
+};
+
+/** Settings applicator table */
+#define SETTINGS_APPLICATORS \
+	__table ( struct settings_applicator, "settings_applicators" )
+
+/** Declare a settings applicator */
+#define __settings_applicator __table_entry ( SETTINGS_APPLICATORS, 01 )
+
+/**
+ * A generic settings block
+ *
+ */
+struct generic_settings {
+	/** Settings block */
+	struct settings settings;
+	/** List of generic settings */
+	struct list_head list;
+};
+
+extern struct settings_operations generic_settings_operations;
+extern int generic_settings_store ( struct settings *settings,
+				    struct setting *setting,
+				    const void *data, size_t len );
+extern int generic_settings_fetch ( struct settings *settings,
+				    struct setting *setting,
+				    void *data, size_t len );
+extern void generic_settings_clear ( struct settings *settings );
+
+extern int register_settings ( struct settings *settings,
+			       struct settings *parent );
+extern void unregister_settings ( struct settings *settings );
+
+extern int store_setting ( struct settings *settings, struct setting *setting,
+			   const void *data, size_t len );
+extern int fetch_setting ( struct settings *settings, struct setting *setting,
+			   void *data, size_t len );
+extern int fetch_setting_len ( struct settings *settings,
+			       struct setting *setting );
+extern int fetch_string_setting ( struct settings *settings,
+				  struct setting *setting,
+				  char *data, size_t len );
+extern int fetch_string_setting_copy ( struct settings *settings,
+				       struct setting *setting,
+				       char **data );
+extern int fetch_ipv4_setting ( struct settings *settings,
+				struct setting *setting, struct in_addr *inp );
+extern int fetch_int_setting ( struct settings *settings,
+			       struct setting *setting, long *value );
+extern int fetch_uint_setting ( struct settings *settings,
+				struct setting *setting,
+				unsigned long *value );
+extern long fetch_intz_setting ( struct settings *settings,
+				 struct setting *setting );
+extern unsigned long fetch_uintz_setting ( struct settings *settings,
+					   struct setting *setting );
+extern int fetch_uuid_setting ( struct settings *settings,
+				struct setting *setting, union uuid *uuid );
+extern void clear_settings ( struct settings *settings );
+extern int setting_cmp ( struct setting *a, struct setting *b );
+
+extern struct settings * find_settings ( const char *name );
+
+extern int storef_setting ( struct settings *settings,
+			    struct setting *setting,
+			    const char *value );
+extern int storef_named_setting ( const char *name, const char *value );
+extern int fetchf_named_setting ( const char *name, char *buf, size_t len );
+
+extern struct setting_type setting_type_string __setting_type;
+extern struct setting_type setting_type_ipv4 __setting_type;
+extern struct setting_type setting_type_int8 __setting_type;
+extern struct setting_type setting_type_int16 __setting_type;
+extern struct setting_type setting_type_int32 __setting_type;
+extern struct setting_type setting_type_uint8 __setting_type;
+extern struct setting_type setting_type_uint16 __setting_type;
+extern struct setting_type setting_type_uint32 __setting_type;
+extern struct setting_type setting_type_hex __setting_type;
+extern struct setting_type setting_type_uuid __setting_type;
+
+extern struct setting ip_setting __setting;
+extern struct setting netmask_setting __setting;
+extern struct setting gateway_setting __setting;
+extern struct setting dns_setting __setting;
+extern struct setting domain_setting __setting;
+extern struct setting hostname_setting __setting;
+extern struct setting filename_setting __setting;
+extern struct setting root_path_setting __setting;
+extern struct setting username_setting __setting;
+extern struct setting password_setting __setting;
+extern struct setting priority_setting __setting;
+extern struct setting uuid_setting __setting;
+extern struct setting next_server_setting __setting;
+extern struct setting mac_setting __setting;
+extern struct setting busid_setting __setting;
+extern struct setting user_class_setting __setting;
+
+/**
+ * Initialise a settings block
+ *
+ * @v settings		Settings block
+ * @v op		Settings block operations
+ * @v refcnt		Containing object reference counter, or NULL
+ * @v name		Settings block name
+ * @v tag_magic		Tag magic
+ */
+static inline void settings_init ( struct settings *settings,
+				   struct settings_operations *op,
+				   struct refcnt *refcnt,
+				   const char *name,
+				   unsigned int tag_magic ) {
+	INIT_LIST_HEAD ( &settings->siblings );
+	INIT_LIST_HEAD ( &settings->children );
+	settings->op = op;
+	settings->refcnt = refcnt;
+	settings->name = name;
+	settings->tag_magic = tag_magic;
+}
+
+/**
+ * Initialise a settings block
+ *
+ * @v generics		Generic settings block
+ * @v refcnt		Containing object reference counter, or NULL
+ * @v name		Settings block name
+ */
+static inline void generic_settings_init ( struct generic_settings *generics,
+					   struct refcnt *refcnt,
+					   const char *name ) {
+	settings_init ( &generics->settings, &generic_settings_operations,
+			refcnt, name, 0 );
+	INIT_LIST_HEAD ( &generics->list );
+}
+
+/**
+ * Delete setting
+ *
+ * @v settings		Settings block
+ * @v setting		Setting to delete
+ * @ret rc		Return status code
+ */
+static inline int delete_setting ( struct settings *settings,
+				   struct setting *setting ) {
+	return store_setting ( settings, setting, NULL, 0 );
+}
+
+/**
+ * Fetch and format value of setting
+ *
+ * @v settings		Settings block, or NULL to search all blocks
+ * @v setting		Setting to fetch
+ * @v type		Settings type
+ * @v buf		Buffer to contain formatted value
+ * @v len		Length of buffer
+ * @ret len		Length of formatted value, or negative error
+ */
+static inline int fetchf_setting ( struct settings *settings,
+				   struct setting *setting,
+				   char *buf, size_t len ) {
+	return setting->type->fetchf ( settings, setting, buf, len );
+}
+
+/**
+ * Delete named setting
+ *
+ * @v name		Name of setting
+ * @ret rc		Return status code
+ */
+static inline int delete_named_setting ( const char *name ) {
+	return storef_named_setting ( name, NULL );
+}
+
+/**
+ * Check existence of setting
+ *
+ * @v settings		Settings block, or NULL to search all blocks
+ * @v setting		Setting to fetch
+ * @ret exists		Setting exists
+ */
+static inline int setting_exists ( struct settings *settings,
+				   struct setting *setting ) {
+	return ( fetch_setting_len ( settings, setting ) >= 0 );
+}
+
+#endif /* _IPXE_SETTINGS_H */
diff --git a/src/include/ipxe/settings_ui.h b/src/include/ipxe/settings_ui.h
new file mode 100644
index 0000000..5f7be30
--- /dev/null
+++ b/src/include/ipxe/settings_ui.h
@@ -0,0 +1,16 @@
+#ifndef _IPXE_SETTINGS_UI_H
+#define _IPXE_SETTINGS_UI_H
+
+/** @file
+ *
+ * Option configuration console
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+struct settings;
+
+extern int settings_ui ( struct settings *settings ) __nonnull;
+
+#endif /* _IPXE_SETTINGS_UI_H */
diff --git a/src/include/ipxe/sha1.h b/src/include/ipxe/sha1.h
new file mode 100644
index 0000000..9b6f551
--- /dev/null
+++ b/src/include/ipxe/sha1.h
@@ -0,0 +1,24 @@
+#ifndef _IPXE_SHA1_H
+#define _IPXE_SHA1_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include "crypto/axtls/crypto.h"
+
+struct digest_algorithm;
+
+#define SHA1_CTX_SIZE sizeof ( SHA1_CTX )
+#define SHA1_DIGEST_SIZE SHA1_SIZE
+
+extern struct digest_algorithm sha1_algorithm;
+
+/* SHA1-wrapping functions defined in sha1extra.c: */
+
+void prf_sha1 ( const void *key, size_t key_len, const char *label,
+		const void *data, size_t data_len, void *prf, size_t prf_len );
+
+void pbkdf2_sha1 ( const void *passphrase, size_t pass_len,
+		   const void *salt, size_t salt_len,
+		   int iterations, void *key, size_t key_len );
+
+#endif /* _IPXE_SHA1_H */
diff --git a/src/include/ipxe/shell.h b/src/include/ipxe/shell.h
new file mode 100644
index 0000000..635de24
--- /dev/null
+++ b/src/include/ipxe/shell.h
@@ -0,0 +1,14 @@
+#ifndef _IPXE_SHELL_H
+#define _IPXE_SHELL_H
+
+/** @file
+ *
+ * Minimal command shell
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+extern void shell ( void );
+
+#endif /* _IPXE_SHELL_H */
diff --git a/src/include/ipxe/shell_banner.h b/src/include/ipxe/shell_banner.h
new file mode 100644
index 0000000..d03fcba
--- /dev/null
+++ b/src/include/ipxe/shell_banner.h
@@ -0,0 +1,14 @@
+#ifndef _IPXE_SHELL_BANNER_H
+#define _IPXE_SHELL_BANNER_H
+
+/** @file
+ *
+ * Shell startup banner
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+extern int shell_banner ( void );
+
+#endif /* _IPXE_SHELL_BANNER_H */
diff --git a/src/include/ipxe/smbios.h b/src/include/ipxe/smbios.h
new file mode 100644
index 0000000..dc34bbe
--- /dev/null
+++ b/src/include/ipxe/smbios.h
@@ -0,0 +1,161 @@
+#ifndef _IPXE_SMBIOS_H
+#define _IPXE_SMBIOS_H
+
+/** @file
+ *
+ * System Management BIOS
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/api.h>
+#include <config/general.h>
+#include <ipxe/uaccess.h>
+
+/**
+ * Provide an SMBIOS API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_SMBIOS( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( SMBIOS_PREFIX_ ## _subsys, _api_func, _func )
+
+/* Include all architecture-independent SMBIOS API headers */
+#include <ipxe/efi/efi_smbios.h>
+
+/* Include all architecture-dependent SMBIOS API headers */
+#include <bits/smbios.h>
+
+/** Signature for SMBIOS entry point */
+#define SMBIOS_SIGNATURE \
+        ( ( '_' << 0 ) + ( 'S' << 8 ) + ( 'M' << 16 ) + ( '_' << 24 ) )
+
+/**
+ * SMBIOS entry point
+ *
+ * This is the single table which describes the list of SMBIOS
+ * structures.  It is located by scanning through the BIOS segment.
+ */
+struct smbios_entry {
+	/** Signature
+	 *
+	 * Must be equal to SMBIOS_SIGNATURE
+	 */
+	uint32_t signature;
+	/** Checksum */
+	uint8_t checksum;
+	/** Length */
+	uint8_t len;
+	/** Major version */
+	uint8_t major;
+	/** Minor version */
+	uint8_t minor;
+	/** Maximum structure size */
+	uint16_t max;
+	/** Entry point revision */
+	uint8_t revision;
+	/** Formatted area */
+	uint8_t formatted[5];
+	/** DMI Signature */
+	uint8_t dmi_signature[5];
+	/** DMI checksum */
+	uint8_t dmi_checksum;
+	/** Structure table length */
+	uint16_t smbios_len;
+	/** Structure table address */
+	uint32_t smbios_address;
+	/** Number of SMBIOS structures */
+	uint16_t smbios_count;
+	/** BCD revision */
+	uint8_t bcd_revision;
+} __attribute__ (( packed ));
+
+/** An SMBIOS structure header */
+struct smbios_header {
+	/** Type */
+	uint8_t type;
+	/** Length */
+	uint8_t len;
+	/** Handle */
+	uint16_t handle;
+} __attribute__ (( packed ));
+
+/** SMBIOS structure descriptor */
+struct smbios_structure {
+	/** Copy of SMBIOS structure header */
+	struct smbios_header header;
+	/** Offset of structure within SMBIOS */
+	size_t offset;
+	/** Length of strings section */
+	size_t strings_len;
+};
+
+/** SMBIOS system information structure */
+struct smbios_system_information {
+	/** SMBIOS structure header */
+	struct smbios_header header;
+	/** Manufacturer string */
+	uint8_t manufacturer;
+	/** Product string */
+	uint8_t product;
+	/** Version string */
+	uint8_t version;
+	/** Serial number string */
+	uint8_t serial;
+	/** UUID */
+	uint8_t uuid[16];
+	/** Wake-up type */
+	uint8_t wakeup;
+} __attribute__ (( packed ));
+
+/** SMBIOS system information structure type */
+#define SMBIOS_TYPE_SYSTEM_INFORMATION 1
+
+/** SMBIOS enclosure information structure */
+struct smbios_enclosure_information {
+	/** SMBIOS structure header */
+	struct smbios_header header;
+	/** Manufacturer string */
+	uint8_t manufacturer;
+	/** Type string */
+	uint8_t type;
+	/** Version string */
+	uint8_t version;
+	/** Serial number string */
+	uint8_t serial;
+	/** Asset tag */
+	uint8_t asset_tag;
+} __attribute__ (( packed ));
+
+/** SMBIOS enclosure information structure type */
+#define SMBIOS_TYPE_ENCLOSURE_INFORMATION 3
+
+/**
+ * SMBIOS entry point descriptor
+ *
+ * This contains the information from the SMBIOS entry point that we
+ * care about.
+ */
+struct smbios {
+	/** Start of SMBIOS structures */
+	userptr_t address;
+	/** Length of SMBIOS structures */
+	size_t len;
+	/** Number of SMBIOS structures */
+	unsigned int count;
+};
+
+extern int find_smbios ( struct smbios *smbios );
+extern int find_smbios_structure ( unsigned int type,
+				   struct smbios_structure *structure );
+extern int read_smbios_structure ( struct smbios_structure *structure,
+				   void *data, size_t len );
+extern int read_smbios_string ( struct smbios_structure *structure,
+				unsigned int index,
+				void *data, size_t len );
+
+#endif /* _IPXE_SMBIOS_H */
diff --git a/src/include/ipxe/socket.h b/src/include/ipxe/socket.h
new file mode 100644
index 0000000..ea2972a
--- /dev/null
+++ b/src/include/ipxe/socket.h
@@ -0,0 +1,101 @@
+#ifndef _IPXE_SOCKET_H
+#define _IPXE_SOCKET_H
+
+/** @file
+ *
+ * Socket addresses
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/**
+ * @defgroup commtypes Communication semantics
+ *
+ * @{
+ */
+
+/** Connection-based, reliable streams */
+extern int tcp_sock_stream;
+#define TCP_SOCK_STREAM 0x1
+#define SOCK_STREAM tcp_sock_stream
+
+/** Connectionless, unreliable streams */
+extern int udp_sock_dgram;
+#define UDP_SOCK_DGRAM 0x2
+#define SOCK_DGRAM udp_sock_dgram
+
+/** @} */
+
+/**
+ * Name communication semantics
+ *
+ * @v semantics		Communication semantics (e.g. SOCK_STREAM)
+ * @ret name		Name of communication semantics
+ */
+static inline __attribute__ (( always_inline )) const char *
+socket_semantics_name ( int semantics ) {
+	/* Cannot use a switch() because of the {TCP_UDP}_SOCK_XXX hack */
+	if ( semantics == SOCK_STREAM ) {
+		return "SOCK_STREAM";
+	} else if ( semantics == SOCK_DGRAM ) {
+		return "SOCK_DGRAM";
+	} else {
+		return "SOCK_UNKNOWN";
+	}
+}
+
+/**
+ * @defgroup addrfam Address families
+ *
+ * @{
+ */
+#define AF_INET		1	/**< IPv4 Internet addresses */
+#define AF_INET6	2	/**< IPv6 Internet addresses */
+/** @} */
+
+/**
+ * Name address family
+ *
+ * @v family		Address family (e.g. AF_INET)
+ * @ret name		Name of address family
+ */
+static inline __attribute__ (( always_inline )) const char *
+socket_family_name ( int family ) {
+	switch ( family ) {
+	case AF_INET:		return "AF_INET";
+	case AF_INET6:		return "AF_INET6";
+	default:		return "AF_UNKNOWN";
+	}
+}
+
+/** A socket address family */
+typedef uint16_t sa_family_t;
+
+/** Length of a @c struct @c sockaddr */
+#define SA_LEN 32
+
+/**
+ * Generalized socket address structure
+ *
+ * This contains the fields common to socket addresses for all address
+ * families.
+ */
+struct sockaddr {
+	/** Socket address family
+	 *
+	 * This is an AF_XXX constant.
+	 */
+        sa_family_t sa_family;
+	/** Padding
+	 *
+	 * This ensures that a struct @c sockaddr_tcpip is large
+	 * enough to hold a socket address for any TCP/IP address
+	 * family.
+	 */
+	char pad[ SA_LEN - sizeof ( sa_family_t ) ];
+} __attribute__ (( may_alias ));
+
+#endif /* _IPXE_SOCKET_H */
diff --git a/src/include/ipxe/spi.h b/src/include/ipxe/spi.h
new file mode 100644
index 0000000..d92d1ae
--- /dev/null
+++ b/src/include/ipxe/spi.h
@@ -0,0 +1,258 @@
+#ifndef _IPXE_SPI_H
+#define _IPXE_SPI_H
+
+/** @file
+ *
+ * SPI interface
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/nvs.h>
+
+/**
+ * @defgroup spicmds SPI commands
+ * @{
+ */
+
+/** Write status register */
+#define SPI_WRSR 0x01
+
+/** Write data to memory array */
+#define SPI_WRITE 0x02
+
+/** Read data from memory array */
+#define SPI_READ 0x03
+
+/** Reset write enable latch */
+#define SPI_WRDI 0x04
+
+/** Read status register */
+#define SPI_RDSR 0x05
+
+/** Set write enable latch */
+#define SPI_WREN 0x06
+
+/**
+ * @defgroup atmelcmds Atmel-specific SPI commands
+ * @{
+ */
+
+/** Erase one sector in memory array (Not supported on all devices) */
+#define ATMEL_SECTOR_ERASE 0x52
+
+/** Erase all sections in memory array (Not supported on all devices) */
+#define ATMEL_CHIP_ERASE 0x62
+
+/** Read manufacturer and product ID (Not supported on all devices) */
+#define ATMEL_RDID 0x15
+
+/** @} */
+
+/** @} */
+
+/**
+ * @defgroup spistatus SPI status register bits (not present on all devices)
+ * @{
+ */
+
+/** Write-protect pin enabled */
+#define SPI_STATUS_WPEN 0x80
+
+/** Block protection bit 2 */
+#define SPI_STATUS_BP2 0x10
+
+/** Block protection bit 1 */
+#define SPI_STATUS_BP1 0x08
+
+/** Block protection bit 0 */
+#define SPI_STATUS_BP0 0x04
+
+/** State of the write enable latch */
+#define SPI_STATUS_WEN 0x02
+
+/** Device busy flag */
+#define SPI_STATUS_NRDY 0x01
+
+/** @} */
+
+/**
+ * An SPI device
+ *
+ * This data structure represents a physical SPI device attached to an
+ * SPI bus.
+ */
+struct spi_device {
+	/** NVS device */
+	struct nvs_device nvs;
+	/** SPI bus to which device is attached */
+	struct spi_bus *bus;
+	/** Slave number */
+	unsigned int slave;
+	/** Command length, in bits */
+	unsigned int command_len;
+	/** Address length, in bits */
+	unsigned int address_len;
+	/** Address is munged
+	 *
+	 * Some devices with 9-bit addresses (e.g. AT25040A EEPROM)
+	 * use bit 3 of the command byte as address bit A8, rather
+	 * than having a two-byte address.  If this flag is set, then
+	 * commands should be munged in this way.
+	 */
+	unsigned int munge_address : 1;
+};
+
+/**
+ * SPI magic autodetection address length
+ *
+ * Set @c spi_device::address_len to @c SPI_AUTODETECT_ADDRESS_LEN if
+ * the address length should be autodetected.
+ */
+#define SPI_AUTODETECT_ADDRESS_LEN 0
+
+static inline __attribute__ (( always_inline )) struct spi_device *
+nvs_to_spi ( struct nvs_device *nvs ) {
+	return container_of ( nvs, struct spi_device, nvs );
+}
+
+/**
+ * An SPI bus
+ *
+ * This data structure represents an SPI bus controller capable of
+ * issuing commands to attached SPI devices.
+ */
+struct spi_bus {
+	/** SPI interface mode
+	 *
+	 * This is the bitwise OR of zero or more of @c SPI_MODE_CPHA
+	 * and @c SPI_MODE_CPOL.  It is also the number conventionally
+	 * used to describe the SPI interface mode.  For example, SPI
+	 * mode 1 is the mode in which CPOL=0 and CPHA=1, which
+	 * therefore corresponds to a mode value of (0|SPI_MODE_CPHA)
+	 * which, happily, equals 1.
+	 */
+	unsigned int mode;
+	/**
+	 * Read/write data via SPI bus
+	 *
+	 * @v bus		SPI bus
+	 * @v device		SPI device
+	 * @v command		Command
+	 * @v address		Address to read/write (<0 for no address)
+	 * @v data_out		TX data buffer (or NULL)
+	 * @v data_in		RX data buffer (or NULL)
+	 * @v len		Length of data buffer(s)
+	 *
+	 * This issues the specified command and optional address to
+	 * the SPI device, then reads and/or writes data to/from the
+	 * data buffers.
+	 */
+	int ( * rw ) ( struct spi_bus *bus, struct spi_device *device,
+		       unsigned int command, int address,
+		       const void *data_out, void *data_in, size_t len );
+};
+
+/** Clock phase (CPHA) mode bit
+ *
+ * Phase 0 is sample on rising edge, shift data on falling edge.
+ *
+ * Phase 1 is shift data on rising edge, sample data on falling edge.
+ */
+#define SPI_MODE_CPHA 0x01
+
+/** Clock polarity (CPOL) mode bit
+ *
+ * This bit reflects the idle state of the clock line (SCLK).
+ */
+#define SPI_MODE_CPOL 0x02
+
+/** Slave select polarity mode bit
+ *
+ * This bit reflects that active state of the slave select lines.  It
+ * is not part of the normal SPI mode number (which covers only @c
+ * SPI_MODE_CPOL and @c SPI_MODE_CPHA), but is included here for
+ * convenience.
+ */
+#define SPI_MODE_SSPOL 0x10
+
+/** Microwire-compatible mode
+ *
+ * This is SPI mode 1 (i.e. CPOL=0, CPHA=1), and is compatible with
+ * the original Microwire protocol.
+ */
+#define SPI_MODE_MICROWIRE 1
+
+/** Microwire/Plus-compatible mode
+ *
+ * This is SPI mode 0 (i.e. CPOL=0, CPHA=0), and is compatible with
+ * the Microwire/Plus protocol
+ */
+#define SPI_MODE_MICROWIRE_PLUS 0
+
+/** Threewire-compatible mode
+ *
+ * This mode is compatible with Atmel's series of "three-wire"
+ * interfaces.
+ */
+#define SPI_MODE_THREEWIRE ( SPI_MODE_MICROWIRE_PLUS | SPI_MODE_SSPOL )
+
+extern int spi_read ( struct nvs_device *nvs, unsigned int address,
+		      void *data, size_t len );
+extern int spi_write ( struct nvs_device *nvs, unsigned int address,
+		       const void *data, size_t len );
+
+/**
+ * @defgroup spidevs SPI device types
+ * @{
+ */
+
+static inline __attribute__ (( always_inline )) void
+init_spi ( struct spi_device *device ) {
+	device->nvs.word_len_log2 = 0;
+	device->command_len = 8,
+	device->nvs.read = spi_read;
+	device->nvs.write = spi_write;	
+}
+
+/** Atmel AT25F1024 serial flash */
+static inline __attribute__ (( always_inline )) void
+init_at25f1024 ( struct spi_device *device ) {
+	device->address_len = 24;
+	device->nvs.size = ( 128 * 1024 );
+	device->nvs.block_size = 256;
+	init_spi ( device );
+}
+
+/** Atmel 25040 serial EEPROM */
+static inline __attribute__ (( always_inline )) void
+init_at25040 ( struct spi_device *device ) {
+	device->address_len = 8;
+	device->munge_address = 1;
+	device->nvs.size = 512;
+	device->nvs.block_size = 8;
+	init_spi ( device );
+}
+
+/** ST M25P32 serial flash */
+static inline __attribute__ (( always_inline )) void
+init_m25p32 ( struct spi_device *device ) {
+	device->address_len = 24;
+	device->nvs.size = ( 4 * 1024 * 1024 );
+	device->nvs.block_size = 256;
+	init_spi ( device );
+}
+
+/** Microchip 25XX640 serial EEPROM */
+static inline __attribute__ (( always_inline )) void
+init_mc25xx640 ( struct spi_device *device ) {
+	device->address_len = 16;
+	device->nvs.size = ( 8 * 1024 );
+	device->nvs.block_size = 32;
+	init_spi ( device );
+}
+
+/** @} */
+
+#endif /* _IPXE_SPI_H */
diff --git a/src/include/ipxe/spi_bit.h b/src/include/ipxe/spi_bit.h
new file mode 100644
index 0000000..9cfa7b8
--- /dev/null
+++ b/src/include/ipxe/spi_bit.h
@@ -0,0 +1,63 @@
+#ifndef _IPXE_SPI_BIT_H
+#define _IPXE_SPI_BIT_H
+
+/** @file
+ *
+ * SPI bit-bashing interface
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/spi.h>
+#include <ipxe/bitbash.h>
+
+/** A bit-bashing SPI bus */
+struct spi_bit_basher {
+	/** SPI bus */
+	struct spi_bus bus;
+	/** Bit-bashing interface */
+	struct bit_basher basher;
+	/** Endianness of data
+	 *
+	 * SPI commands and addresses are always big-endian (i.e. MSB
+	 * transmitted first on the wire), but some cards
+	 * (e.g. natsemi) choose to regard the data stored in the
+	 * EEPROM as little-endian (i.e. LSB transmitted first on the
+	 * wire).
+	 */
+	int endianness;
+};
+
+/** Bit indices used for SPI bit-bashing interface */
+enum {
+	/** Serial clock */
+	SPI_BIT_SCLK = 0,
+	/** Master Out Slave In */
+	SPI_BIT_MOSI,
+	/** Master In Slave Out */
+	SPI_BIT_MISO,
+	/** Slave 0 select */
+	SPI_BIT_SS0,
+};
+
+/**
+ * Determine bit index for a particular slave
+ *
+ * @v slave		Slave number
+ * @ret index		Bit index (i.e. SPI_BIT_SSN, where N=slave) 
+ */
+#define SPI_BIT_SS( slave ) ( SPI_BIT_SS0 + (slave) )
+
+/** Delay between SCLK transitions */
+#define SPI_BIT_UDELAY 1
+
+/** SPI bit basher treats data as big-endian */
+#define SPI_BIT_BIG_ENDIAN 0
+
+/** SPI bit basher treats data as little-endian */
+#define SPI_BIT_LITTLE_ENDIAN 1
+
+extern void init_spi_bit_basher ( struct spi_bit_basher *spibit );
+
+#endif /* _IPXE_SPI_BIT_H */
diff --git a/src/include/ipxe/srp.h b/src/include/ipxe/srp.h
new file mode 100644
index 0000000..7c0ff4c
--- /dev/null
+++ b/src/include/ipxe/srp.h
@@ -0,0 +1,868 @@
+#ifndef _IPXE_SRP_H
+#define _IPXE_SRP_H
+
+/** @file
+ *
+ * SCSI RDMA Protocol
+ *
+ */
+
+FILE_LICENCE ( BSD2 );
+
+#include <stdint.h>
+#include <byteswap.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/xfer.h>
+#include <ipxe/scsi.h>
+
+/*****************************************************************************
+ *
+ * Common fields
+ *
+ *****************************************************************************
+ */
+
+/** An SRP information unit tag */
+struct srp_tag {
+	uint32_t dwords[2];
+} __attribute__ (( packed ));
+
+/** An SRP port ID */
+struct srp_port_id {
+	uint8_t bytes[16];
+} __attribute__ (( packed ));
+
+/** An SRP port ID pair */
+struct srp_port_ids {
+	/** Initiator port ID */
+	struct srp_port_id initiator;
+	/** Target port ID */
+	struct srp_port_id target;
+} __attribute__ (( packed ));
+
+/** SRP information unit common fields */
+struct srp_common {
+	/** Information unit type */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[7];
+	/** Tag */
+	struct srp_tag tag;
+} __attribute__ (( packed ));
+
+/*****************************************************************************
+ *
+ * Login request
+ *
+ *****************************************************************************
+ */
+
+/** An SRP login request information unit */
+struct srp_login_req {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_LOGIN_REQ
+	 */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[7];
+	/** Tag */
+	struct srp_tag tag;
+	/** Requested maximum initiator to target IU length */
+	uint32_t max_i_t_iu_len;
+	/** Reserved */
+	uint8_t reserved1[4];
+	/** Required buffer formats
+	 *
+	 * This is the bitwise OR of one or more @c
+	 * SRP_LOGIN_REQ_FMT_XXX constants.
+	 */
+	uint16_t required_buffer_formats;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more @c
+	 * SRP_LOGIN_REQ_FLAG_XXX and @c SRP_LOGIN_REQ_MCA_XXX
+	 * constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved2[5];
+	/** Initiator and target port identifiers */
+	struct srp_port_ids port_ids;
+} __attribute__ (( packed ));
+
+/** Type of an SRP login request */
+#define SRP_LOGIN_REQ 0x00
+
+/** Require indirect data buffer descriptor format */
+#define SRP_LOGIN_REQ_FMT_IDBD 0x04
+
+/** Require direct data buffer descriptor format */
+#define SRP_LOGIN_REQ_FMT_DDBD 0x02
+
+/** Use solicited notification for asynchronous events */
+#define SRP_LOGIN_REQ_FLAG_AESOLNT 0x40
+
+/** Use solicited notification for credit request */
+#define SRP_LOGIN_REQ_FLAG_CRSOLNT 0x20
+
+/** Use solicited notification for logouts */
+#define SRP_LOGIN_REQ_FLAG_LOSOLNT 0x10
+
+/** Multi-channel action mask */
+#define SRP_LOGIN_REQ_MCA_MASK 0x03
+
+/** Single RDMA channel operation */
+#define SRP_LOGIN_REQ_MCA_SINGLE_CHANNEL 0x00
+
+/** Multiple independent RDMA channel operation */
+#define SRP_LOGIN_REQ_MCA_MULTIPLE_CHANNELS 0x01
+
+/*****************************************************************************
+ *
+ * Login response
+ *
+ *****************************************************************************
+ */
+
+/** An SRP login response */
+struct srp_login_rsp {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_LOGIN_RSP
+	 */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[3];
+	/** Request limit delta */
+	uint32_t request_limit_delta;
+	/** Tag */
+	struct srp_tag tag;
+	/** Maximum initiator to target IU length */
+	uint32_t max_i_t_iu_len;
+	/** Maximum target to initiator IU length */
+	uint32_t max_t_i_iu_len;
+	/** Supported buffer formats
+	 *
+	 * This is the bitwise OR of one or more @c
+	 * SRP_LOGIN_RSP_FMT_XXX constants.
+	 */
+	uint16_t supported_buffer_formats;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more @c
+	 * SRP_LOGIN_RSP_FLAG_XXX and @c SRP_LOGIN_RSP_MCR_XXX
+	 * constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved1[25];
+} __attribute__ (( packed ));
+
+/** Type of an SRP login response */
+#define SRP_LOGIN_RSP 0xc0
+
+/** Indirect data buffer descriptor format supported */
+#define SRP_LOGIN_RSP_FMT_IDBD 0x04
+
+/** Direct data buffer descriptor format supported */
+#define SRP_LOGIN_RSP_FMT_DDBD 0x02
+
+/** Solicited notification is supported */
+#define SRP_LOGIN_RSP_FLAG_SOLNTSUP 0x10
+
+/** Multi-channel result mask */
+#define SRP_LOGIN_RSP_MCR_MASK 0x03
+
+/** No existing RDMA channels were associated with the same I_T nexus */
+#define SRP_LOGIN_RSP_MCR_NO_EXISTING_CHANNELS 0x00
+
+/** One or more existing RDMA channels were terminated */
+#define SRP_LOGIN_RSP_MCR_EXISTING_CHANNELS_TERMINATED 0x01
+
+/** One or more existing RDMA channels continue to operate independently */
+#define SRP_LOGIN_RSP_MCR_EXISTING_CHANNELS_CONTINUE 0x02
+
+/*****************************************************************************
+ *
+ * Login rejection
+ *
+ *****************************************************************************
+ */
+
+/** An SRP login rejection */
+struct srp_login_rej {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_LOGIN_REJ
+	 */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[3];
+	/** Reason
+	 *
+	 * This is a @c SRP_LOGIN_REJ_REASON_XXX constant.
+	 */
+	uint32_t reason;
+	/** Tag */
+	struct srp_tag tag;
+	/** Reserved */
+	uint8_t reserved1[8];
+	/** Supported buffer formats
+	 *
+	 * This is the bitwise OR of one or more @c
+	 * SRP_LOGIN_REJ_FMT_XXX constants.
+	 */
+	uint16_t supported_buffer_formats;
+	/** Reserved */
+	uint8_t reserved2[6];
+} __attribute__ (( packed ));
+
+/** Type of an SRP login rejection */
+#define SRP_LOGIN_REJ 0xc2
+
+/** Unable to establish RDMA channel, no reason specified */
+#define SRP_LOGIN_REJ_REASON_UNKNOWN 0x00010000UL
+
+/** Insufficient RDMA channel resources */
+#define SRP_LOGIN_REJ_REASON_INSUFFICIENT_RESOURCES 0x00010001UL
+
+/** Requested maximum initiator to target IU length value too large */
+#define SRP_LOGIN_REJ_REASON_BAD_MAX_I_T_IU_LEN 0x00010002UL
+
+/** Unable to associate RDMA channel with specified I_T nexus */
+#define SRP_LOGIN_REJ_REASON_CANNOT_ASSOCIATE 0x00010003UL
+
+/** One or more requested data buffer descriptor formats are not supported */
+#define SRP_LOGIN_REJ_REASON_UNSUPPORTED_BUFFER_FORMAT 0x00010004UL
+
+/** SRP target port does not support multiple RDMA channels per I_T nexus */
+#define SRP_LOGIN_REJ_REASON_NO_MULTIPLE_CHANNELS 0x00010005UL
+
+/** RDMA channel limit reached for this initiator */
+#define SRP_LOGIN_REJ_REASON_NO_MORE_CHANNELS 0x00010006UL
+
+/** Indirect data buffer descriptor format supported */
+#define SRP_LOGIN_REJ_FMT_IDBD 0x04
+
+/** Direct data buffer descriptor format supported */
+#define SRP_LOGIN_REJ_FMT_DDBD 0x02
+
+/*****************************************************************************
+ *
+ * Initiator logout
+ *
+ *****************************************************************************
+ */
+
+/** An SRP initiator logout request */
+struct srp_i_logout {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_I_LOGOUT
+	 */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[7];
+	/** Tag */
+	struct srp_tag tag;
+} __attribute__ (( packed ));
+
+/** Type of an SRP initiator logout request */
+#define SRP_I_LOGOUT 0x03
+
+/*****************************************************************************
+ *
+ * Target logout
+ *
+ *****************************************************************************
+ */
+
+/** An SRP target logout request */
+struct srp_t_logout {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_T_LOGOUT
+	 */
+	uint8_t type;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more @c
+	 * SRP_T_LOGOUT_FLAG_XXX constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved0[2];
+	/** Reason
+	 *
+	 * This is a @c SRP_T_LOGOUT_REASON_XXX constant.
+	 */
+	uint32_t reason;
+	/** Tag */
+	struct srp_tag tag;
+} __attribute__ (( packed ));
+
+/** Type of an SRP target logout request */
+#define SRP_T_LOGOUT 0x80
+
+/** The initiator specified solicited notification of logouts */
+#define SRP_T_LOGOUT_FLAG_SOLNT 0x01
+
+/** No reason specified */
+#define SRP_T_LOGOUT_REASON_UNKNOWN 0x00000000UL
+
+/** Inactive RDMA channel (reclaiming resources) */
+#define SRP_T_LOGOUT_REASON_INACTIVE 0x00000001UL
+
+/** Invalid information unit type code received by SRP target port */
+#define SRP_T_LOGOUT_REASON_INVALID_TYPE 0x00000002UL
+
+/** SRP initiator port sent response with no corresponding request */
+#define SRP_T_LOGOUT_REASON_SPURIOUS_RESPONSE 0x00000003UL
+
+/** RDMA channel disconnected due to multi-channel action code in new login */
+#define SRP_T_LOGOUT_REASON_MCA 0x00000004UL
+
+/** Unsuppported format code value specified in data-out buffer descriptor */
+#define SRP_T_LOGOUT_UNSUPPORTED_DATA_OUT_FORMAT 0x00000005UL
+
+/** Unsuppported format code value specified in data-in buffer descriptor */
+#define SRP_T_LOGOUT_UNSUPPORTED_DATA_IN_FORMAT 0x00000006UL
+
+/** Invalid length for IU type */
+#define SRP_T_LOGOUT_INVALID_IU_LEN 0x00000008UL
+
+/*****************************************************************************
+ *
+ * Task management
+ *
+ *****************************************************************************
+ */
+
+/** An SRP task management request */
+struct srp_tsk_mgmt {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_TSK_MGMT
+	 */
+	uint8_t type;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more
+	 * @c SRP_TSK_MGMT_FLAG_XXX constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved0[6];
+	/** Tag */
+	struct srp_tag tag;
+	/** Reserved */
+	uint8_t reserved1[4];
+	/** Logical unit number */
+	struct scsi_lun lun;
+	/** Reserved */
+	uint8_t reserved2[2];
+	/** Task management function
+	 *
+	 * This is a @c SRP_TASK_MGMT_FUNC_XXX constant
+	 */
+	uint8_t function;
+	/** Reserved */
+	uint8_t reserved3[1];
+	/** Tag of task to be managed */
+	struct srp_tag managed_tag;
+	/** Reserved */
+	uint8_t reserved4[8];
+} __attribute__ (( packed ));
+
+/** Type of an SRP task management request */
+#define SRP_TSK_MGMT 0x01
+
+/** Use solicited notification for unsuccessful completions */
+#define SRP_TSK_MGMT_FLAG_UCSOLNT 0x04
+
+/** Use solicited notification for successful completions */
+#define SRP_TSK_MGMT_FLAG_SCSOLNT 0x02
+
+/** The task manager shall perform an ABORT TASK function */
+#define SRP_TSK_MGMT_FUNC_ABORT_TASK 0x01
+
+/** The task manager shall perform an ABORT TASK SET function */
+#define SRP_TSK_MGMT_FUNC_ABORT_TASK_SET 0x02
+
+/** The task manager shall perform a CLEAR TASK SET function */
+#define SRP_TSK_MGMT_FUNC_CLEAR_TASK_SET 0x04
+
+/** The task manager shall perform a LOGICAL UNIT RESET function */
+#define SRP_TSK_MGMT_FUNC_LOGICAL_UNIT_RESET 0x08
+
+/** The task manager shall perform a CLEAR ACA function */
+#define SRP_TSK_MGMT_FUNC_CLEAR_ACA 0x40
+
+/*****************************************************************************
+ *
+ * SCSI command
+ *
+ *****************************************************************************
+ */
+
+/** An SRP SCSI command */
+struct srp_cmd {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_CMD
+	 */
+	uint8_t type;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more @c SRP_CMD_FLAG_XXX
+	 * constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved0[3];
+	/** Data buffer descriptor formats
+	 *
+	 * This is the bitwise OR of one @c SRP_CMD_DO_FMT_XXX and one @c
+	 * SRP_CMD_DI_FMT_XXX constant.
+	 */
+	uint8_t data_buffer_formats;
+	/** Data-out buffer descriptor count */
+	uint8_t data_out_buffer_count;
+	/** Data-in buffer descriptor count */
+	uint8_t data_in_buffer_count;
+	/** Tag */
+	struct srp_tag tag;
+	/** Reserved */
+	uint8_t reserved1[4];
+	/** Logical unit number */
+	struct scsi_lun lun;
+	/** Reserved */
+	uint8_t reserved2[1];
+	/** Task attribute
+	 *
+	 * This is a @c SRP_CMD_TASK_ATTR_XXX constant.
+	 */
+	uint8_t task_attr;
+	/** Reserved */
+	uint8_t reserved3[1];
+	/** Additional CDB length */
+	uint8_t additional_cdb_len;
+	/** Command data block */
+	union scsi_cdb cdb;
+} __attribute__ (( packed ));
+
+/** Type of an SRP SCSI command */
+#define SRP_CMD 0x02
+
+/** Use solicited notification for unsuccessful completions */
+#define SRP_CMD_FLAG_UCSOLNT 0x04
+
+/** Use solicited notification for successful completions */
+#define SRP_CMD_FLAG_SCSOLNT 0x02
+
+/** Data-out buffer format mask */
+#define SRP_CMD_DO_FMT_MASK 0xf0
+
+/** Direct data-out buffer format */
+#define SRP_CMD_DO_FMT_DIRECT 0x10
+
+/** Indirect data-out buffer format */
+#define SRP_CMD_DO_FMT_INDIRECT 0x20
+
+/** Data-in buffer format mask */
+#define SRP_CMD_DI_FMT_MASK 0x0f
+
+/** Direct data-in buffer format */
+#define SRP_CMD_DI_FMT_DIRECT 0x01
+
+/** Indirect data-in buffer format */
+#define SRP_CMD_DI_FMT_INDIRECT 0x02
+
+/** Use the rules for a simple task attribute */
+#define SRP_CMD_TASK_ATTR_SIMPLE 0x00
+
+/** Use the rules for a head of queue task attribute */
+#define SRP_CMD_TASK_ATTR_QUEUE_HEAD 0x01
+
+/** Use the rules for an ordered task attribute */
+#define SRP_CMD_TASK_ATTR_ORDERED 0x02
+
+/** Use the rules for an automatic contingent allegiance task attribute */
+#define SRP_CMD_TASK_ATTR_AUTOMATIC_CONTINGENT_ALLEGIANCE 0x08
+
+/** An SRP memory descriptor */
+struct srp_memory_descriptor {
+	/** Virtual address */
+	uint64_t address;
+	/** Memory handle */
+	uint32_t handle;
+	/** Data length */
+	uint32_t len;
+} __attribute__ (( packed ));
+
+/*****************************************************************************
+ *
+ * SCSI response
+ *
+ *****************************************************************************
+ */
+
+/** An SRP SCSI response */
+struct srp_rsp {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_RSP
+	 */
+	uint8_t type;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more @c SRP_RSP_FLAG_XXX
+	 * constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved0[2];
+	/** Request limit delta */
+	uint32_t request_limit_delta;
+	/** Tag */
+	struct srp_tag tag;
+	/** Reserved */
+	uint8_t reserved1[2];
+	/** Valid fields
+	 *
+	 * This is the bitwise OR of zero or more @c SRP_RSP_VALID_XXX
+	 * constants.
+	 */
+	uint8_t valid;
+	/** Status
+	 *
+	 * This is the SCSI status code.
+	 */
+	uint8_t status;
+	/** Data-out residual count */
+	uint32_t data_out_residual_count;
+	/** Data-in residual count */
+	uint32_t data_in_residual_count;
+	/** Sense data list length */
+	uint32_t sense_data_len;
+	/** Response data list length */
+	uint32_t response_data_len;
+} __attribute__ (( packed ));
+
+/** Type of an SRP SCSI response */
+#define SRP_RSP 0xc1
+
+/** The initiator specified solicited notification of this response */
+#define SRP_RSP_FLAG_SOLNT 0x01
+
+/** Data-in residual count field is valid and represents an underflow */
+#define SRP_RSP_VALID_DIUNDER 0x20
+
+/** Data-in residual count field is valid and represents an overflow */
+#define SRP_RSP_VALID_DIOVER 0x10
+
+/** Data-out residual count field is valid and represents an underflow */
+#define SRP_RSP_VALID_DOUNDER 0x08
+
+/** Data-out residual count field is valid and represents an overflow */
+#define SRP_RSP_VALID_DOOVER 0x04
+
+/** Sense data list length field is valid */
+#define SRP_RSP_VALID_SNSVALID 0x02
+
+/** Response data list length field is valid */
+#define SRP_RSP_VALID_RSPVALID 0x01
+
+/**
+ * Get response data portion of SCSI response
+ *
+ * @v rsp			SCSI response
+ * @ret response_data		Response data, or NULL if not present
+ */
+static inline void * srp_rsp_response_data ( struct srp_rsp *rsp ) {
+	return ( ( rsp->valid & SRP_RSP_VALID_RSPVALID ) ?
+		 ( ( ( void * ) rsp ) + sizeof ( *rsp ) ) : NULL );
+}
+
+/**
+ * Get length of response data portion of SCSI response
+ *
+ * @v rsp			SCSI response
+ * @ret response_data_len	Response data length
+ */
+static inline size_t srp_rsp_response_data_len ( struct srp_rsp *rsp ) {
+	return ( ( rsp->valid & SRP_RSP_VALID_RSPVALID ) ?
+		 ntohl ( rsp->response_data_len ) : 0 );
+}
+
+/**
+ * Get sense data portion of SCSI response
+ *
+ * @v rsp			SCSI response
+ * @ret sense_data		Sense data, or NULL if not present
+ */
+static inline void * srp_rsp_sense_data ( struct srp_rsp *rsp ) {
+	return ( ( rsp->valid & SRP_RSP_VALID_SNSVALID ) ?
+		 ( ( ( void * ) rsp ) + sizeof ( *rsp ) +
+		   srp_rsp_response_data_len ( rsp ) ) : NULL );
+}
+
+/**
+ * Get length of sense data portion of SCSI response
+ *
+ * @v rsp			SCSI response
+ * @ret sense_data_len		Sense data length
+ */
+static inline size_t srp_rsp_sense_data_len ( struct srp_rsp *rsp ) {
+	return ( ( rsp->valid & SRP_RSP_VALID_SNSVALID ) ?
+		 ntohl ( rsp->sense_data_len ) : 0 );
+}
+
+/*****************************************************************************
+ *
+ * Credit request
+ *
+ *****************************************************************************
+ */
+
+/** An SRP credit request */
+struct srp_cred_req {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_CRED_REQ
+	 */
+	uint8_t type;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more
+	 * @c SRP_CRED_REQ_FLAG_XXX constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved0[2];
+	/** Request limit delta */
+	uint32_t request_limit_delta;
+	/** Tag */
+	struct srp_tag tag;
+} __attribute__ (( packed ));
+
+/** Type of an SRP credit request */
+#define SRP_CRED_REQ 0x81
+
+/** The initiator specified solicited notification of credit requests */
+#define SRP_CRED_REQ_FLAG_SOLNT 0x01
+
+/*****************************************************************************
+ *
+ * Credit response
+ *
+ *****************************************************************************
+ */
+
+/** An SRP credit response */
+struct srp_cred_rsp {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_CRED_RSP
+	 */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[7];
+	/** Tag */
+	struct srp_tag tag;
+} __attribute__ (( packed ));
+
+/** Type of an SRP credit response */
+#define SRP_CRED_RSP 0x41
+
+/*****************************************************************************
+ *
+ * Asynchronous event request
+ *
+ *****************************************************************************
+ */
+
+/** An SRP asynchronous event request */
+struct srp_aer_req {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_AER_REQ
+	 */
+	uint8_t type;
+	/** Flags
+	 *
+	 * This is the bitwise OR of zero or more @c
+	 * SRP_AER_REQ_FLAG_XXX constants.
+	 */
+	uint8_t flags;
+	/** Reserved */
+	uint8_t reserved0[2];
+	/** Request limit delta */
+	uint32_t request_limit_delta;
+	/** Tag */
+	struct srp_tag tag;
+	/** Reserved */
+	uint8_t reserved1[4];
+	/** Logical unit number */
+	struct scsi_lun lun;
+	/** Sense data list length */
+	uint32_t sense_data_len;
+	/** Reserved */
+	uint8_t reserved2[4];
+} __attribute__ (( packed ));
+
+/** Type of an SRP asynchronous event request */
+#define SRP_AER_REQ 0x82
+
+/** The initiator specified solicited notification of asynchronous events */
+#define SRP_AER_REQ_FLAG_SOLNT 0x01
+
+/**
+ * Get sense data portion of asynchronous event request
+ *
+ * @v aer_req			SRP asynchronous event request
+ * @ret sense_data		Sense data
+ */
+static inline __always_inline void *
+srp_aer_req_sense_data ( struct srp_aer_req *aer_req ) {
+	return ( ( ( void * ) aer_req ) + sizeof ( *aer_req ) );
+}
+
+/**
+ * Get length of sense data portion of asynchronous event request
+ *
+ * @v aer_req			SRP asynchronous event request
+ * @ret sense_data_len		Sense data length
+ */
+static inline __always_inline size_t
+srp_aer_req_sense_data_len ( struct srp_aer_req *aer_req ) {
+	return ( ntohl ( aer_req->sense_data_len ) );
+}
+
+/*****************************************************************************
+ *
+ * Asynchronous event response
+ *
+ *****************************************************************************
+ */
+
+/** An SRP asynchronous event response */
+struct srp_aer_rsp {
+	/** Information unit type
+	 *
+	 * This must be @c SRP_AER_RSP
+	 */
+	uint8_t type;
+	/** Reserved */
+	uint8_t reserved0[7];
+	/** Tag */
+	struct srp_tag tag;
+} __attribute__ (( packed ));
+
+/** Type of an SRP asynchronous event response */
+#define SRP_AER_RSP 0x42
+
+/*****************************************************************************
+ *
+ * Information units
+ *
+ *****************************************************************************
+ */
+
+/** Maximum length of any initiator-to-target IU that we will send
+ *
+ * The longest IU is a SRP_CMD with no additional CDB and two direct
+ * data buffer descriptors, which comes to 80 bytes.
+ */
+#define SRP_MAX_I_T_IU_LEN 80
+
+/*****************************************************************************
+ *
+ * SRP device
+ *
+ *****************************************************************************
+ */
+
+struct srp_device;
+
+/** An SRP transport type */
+struct srp_transport_type {
+	/** Length of transport private data */
+	size_t priv_len;
+	/** Parse root path
+	 *
+	 * @v srp		SRP device
+	 * @v root_path		Root path
+	 * @ret 		Return status code
+	 */
+	int ( * parse_root_path ) ( struct srp_device *srp,
+				    const char *root_path );
+	/** Connect SRP session
+	 *
+	 * @v srp		SRP device
+	 * @ret rc		Return status code
+	 *
+	 * This method should open the underlying socket.
+	 */
+	int ( * connect ) ( struct srp_device *srp );
+};
+
+/** An SRP device */
+struct srp_device {
+	/** Reference count */
+	struct refcnt refcnt;
+
+	/** Initiator and target port IDs */
+	struct srp_port_ids port_ids;
+	/** Logical unit number */
+	struct scsi_lun lun;
+	/** Memory handle */
+	uint32_t memory_handle;
+
+	/** Current state
+	 *
+	 * This is the bitwise-OR of zero or more @c SRP_STATE_XXX
+	 * flags.
+	 */
+	unsigned int state;
+	/** Retry counter */
+	unsigned int retry_count;
+	/** Current SCSI command */
+	struct scsi_command *command;
+
+	/** Underlying data transfer interface */
+	struct xfer_interface socket;
+
+	/** Transport type */
+	struct srp_transport_type *transport;
+	/** Transport private data */
+	char transport_priv[0];
+};
+
+/**
+ * Get SRP transport private data
+ *
+ * @v srp		SRP device
+ * @ret priv		SRP transport private data
+ */
+static inline __always_inline void *
+srp_transport_priv ( struct srp_device *srp ) {
+	return ( ( void * ) srp->transport_priv );
+}
+
+/** SRP state flags */
+enum srp_state {
+	/** Underlying socket is open */
+	SRP_STATE_SOCKET_OPEN = 0x0001,
+	/** Session is logged in */
+	SRP_STATE_LOGGED_IN = 0x0002,
+};
+
+/** Maximum number of SRP retry attempts */
+#define SRP_MAX_RETRIES 3
+
+extern int srp_attach ( struct scsi_device *scsi, const char *root_path );
+extern void srp_detach ( struct scsi_device *scsi );
+
+#endif /* _IPXE_SRP_H */
diff --git a/src/include/ipxe/tables.h b/src/include/ipxe/tables.h
new file mode 100644
index 0000000..130486c
--- /dev/null
+++ b/src/include/ipxe/tables.h
@@ -0,0 +1,434 @@
+#ifndef _IPXE_TABLES_H
+#define _IPXE_TABLES_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** @page ifdef_harmful #ifdef considered harmful
+ *
+ * Overuse of @c #ifdef has long been a problem in Etherboot.
+ * Etherboot provides a rich array of features, but all these features
+ * take up valuable space in a ROM image.  The traditional solution to
+ * this problem has been for each feature to have its own @c #ifdef
+ * option, allowing the feature to be compiled in only if desired.
+ *
+ * The problem with this is that it becomes impossible to compile, let
+ * alone test, all possible versions of Etherboot.  Code that is not
+ * typically used tends to suffer from bit-rot over time.  It becomes
+ * extremely difficult to predict which combinations of compile-time
+ * options will result in code that can even compile and link
+ * correctly.
+ *
+ * To solve this problem, we have adopted a new approach from
+ * Etherboot 5.5 onwards.  @c #ifdef is now "considered harmful", and
+ * its use should be minimised.  Separate features should be
+ * implemented in separate @c .c files, and should \b always be
+ * compiled (i.e. they should \b not be guarded with a @c #ifdef @c
+ * MY_PET_FEATURE statement).  By making (almost) all code always
+ * compile, we avoid the problem of bit-rot in rarely-used code.
+ *
+ * The file config.h, in combination with the @c make command line,
+ * specifies the objects that will be included in any particular build
+ * of Etherboot.  For example, suppose that config.h includes the line
+ *
+ * @code
+ *
+ *   #define CONSOLE_SERIAL
+ *   #define DOWNLOAD_PROTO_TFTP
+ *
+ * @endcode
+ *
+ * When a particular Etherboot image (e.g. @c bin/rtl8139.zdsk) is
+ * built, the options specified in config.h are used to drag in the
+ * relevant objects at link-time.  For the above example, serial.o and
+ * tftp.o would be linked in.
+ *
+ * There remains one problem to solve: how do these objects get used?
+ * Traditionally, we had code such as
+ *
+ * @code
+ *
+ *    #ifdef CONSOLE_SERIAL
+ *      serial_init();
+ *    #endif
+ *
+ * @endcode
+ *
+ * in main.c, but this reintroduces @c #ifdef and so is a Bad Idea.
+ * We cannot simply remove the @c #ifdef and make it
+ *
+ * @code
+ *
+ *   serial_init();
+ *
+ * @endcode
+ *
+ * because then serial.o would end up always being linked in.
+ *
+ * The solution is to use @link tables.h linker tables @endlink.
+ *
+ */
+
+/** @file
+ *
+ * Linker tables
+ *
+ * Read @ref ifdef_harmful first for some background on the motivation
+ * for using linker tables.
+ *
+ * This file provides macros for dealing with linker-generated tables
+ * of fixed-size symbols.  We make fairly extensive use of these in
+ * order to avoid @c #ifdef spaghetti and/or linker symbol pollution.
+ * For example, instead of having code such as
+ *
+ * @code
+ *
+ *    #ifdef CONSOLE_SERIAL
+ *      serial_init();
+ *    #endif
+ *
+ * @endcode
+ *
+ * we make serial.c generate an entry in the initialisation function
+ * table, and then have a function call_init_fns() that simply calls
+ * all functions present in this table.  If and only if serial.o gets
+ * linked in, then its initialisation function will be called.  We
+ * avoid linker symbol pollution (i.e. always dragging in serial.o
+ * just because of a call to serial_init()) and we also avoid @c
+ * #ifdef spaghetti (having to conditionalise every reference to
+ * functions in serial.c).
+ *
+ * The linker script takes care of assembling the tables for us.  All
+ * our table sections have names of the format @c .tbl.NAME.NN where
+ * @c NAME designates the data structure stored in the table (e.g. @c
+ * init_fns) and @c NN is a two-digit decimal number used to impose an
+ * ordering upon the tables if required.  @c NN=00 is reserved for the
+ * symbol indicating "table start", and @c NN=99 is reserved for the
+ * symbol indicating "table end".
+ *
+ * As an example, suppose that we want to create a "frobnicator"
+ * feature framework, and allow for several independent modules to
+ * provide frobnicating services.  Then we would create a frob.h
+ * header file containing e.g.
+ *
+ * @code
+ *
+ *   struct frobnicator {
+ *      const char *name;		// Name of the frobnicator
+ *	void ( *frob ) ( void ); 	// The frobnicating function itself
+ *   };
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   #define __frobnicator __table_entry ( FROBNICATORS, 01 )
+ *
+ * @endcode
+ *
+ * Any module providing frobnicating services would look something
+ * like
+ *
+ * @code
+ *
+ *   #include "frob.h"
+ *
+ *   static void my_frob ( void ) {
+ *	// Do my frobnicating
+ *	...
+ *   }
+ *
+ *   struct frob my_frobnicator __frobnicator = {
+ *	.name = "my_frob",
+ *	.frob = my_frob,
+ *   };
+ *
+ * @endcode
+ *
+ * The central frobnicator code (frob.c) would use the frobnicating
+ * modules as follows
+ *
+ * @code
+ *
+ *   #include "frob.h"
+ *
+ *   // Call all linked-in frobnicators
+ *   void frob_all ( void ) {
+ *	struct frob *frob;
+ *
+ *	for_each_table ( frob, FROBNICATORS ) {
+ *         printf ( "Calling frobnicator \"%s\"\n", frob->name );
+ *	   frob->frob ();
+ *	}
+ *   }
+ *
+ * @endcode
+ *
+ * See init.h and init.c for a real-life example.
+ *
+ */
+
+#ifdef DOXYGEN
+#define __attribute__( x )
+#endif
+
+/**
+ * Declare a linker table
+ *
+ * @v type		Data type
+ * @v name		Table name
+ * @ret table		Linker table
+ */
+#define __table( type, name ) ( type, name )
+
+/**
+ * Get linker table data type
+ *
+ * @v table		Linker table
+ * @ret type		Data type
+ */
+#define __table_type( table ) __table_extract_type table
+#define __table_extract_type( type, name ) type
+
+/**
+ * Get linker table name
+ *
+ * @v table		Linker table
+ * @ret name		Table name
+ */
+#define __table_name( table ) __table_extract_name table
+#define __table_extract_name( type, name ) name
+
+/**
+ * Get linker table section name
+ *
+ * @v table		Linker table
+ * @v idx		Sub-table index
+ * @ret section		Section name
+ */
+#define __table_section( table, idx ) \
+	".tbl." __table_name ( table ) "." __table_str ( idx )
+#define __table_str( x ) #x
+
+/**
+ * Get linker table alignment
+ *
+ * @v table		Linker table
+ * @ret align		Alignment
+ */
+#define __table_alignment( table ) __alignof__ ( __table_type ( table ) )
+
+/**
+ * Declare a linker table entry
+ *
+ * @v table		Linker table
+ * @v idx		Sub-table index
+ *
+ * Example usage:
+ *
+ * @code
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   #define __frobnicator __table_entry ( FROBNICATORS, 01 )
+ *
+ *   struct frobnicator my_frob __frobnicator = {
+ *      ...
+ *   };
+ *
+ * @endcode
+ */
+#define __table_entry( table, idx )					\
+	__attribute__ (( __section__ ( __table_section ( table, idx ) ),\
+			 __aligned__ ( __table_alignment ( table ) ) ))
+
+/**
+ * Get start of linker table entries
+ *
+ * @v table		Linker table
+ * @v idx		Sub-table index
+ * @ret entries		Start of entries
+ */
+#define __table_entries( table, idx ) ( {				\
+	static __table_type ( table ) __table_entries[0]		\
+		__table_entry ( table, idx ); 				\
+	__table_entries; } )
+
+/**
+ * Get start of linker table
+ *
+ * @v table		Linker table
+ * @ret start		Start of linker table
+ *
+ * Example usage:
+ *
+ * @code
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   struct frobnicator *frobs = table_start ( FROBNICATORS );
+ *
+ * @endcode
+ */
+#define table_start( table ) __table_entries ( table, 00 )
+
+/**
+ * Get end of linker table
+ *
+ * @v table		Linker table
+ * @ret end		End of linker table
+ *
+ * Example usage:
+ *
+ * @code
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   struct frobnicator *frobs_end = table_end ( FROBNICATORS );
+ *
+ * @endcode
+ */
+#define table_end( table ) __table_entries ( table, 99 )
+
+/**
+ * Get number of entries in linker table
+ *
+ * @v table		Linker table
+ * @ret num_entries	Number of entries in linker table
+ *
+ * Example usage:
+ *
+ * @code
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   unsigned int num_frobs = table_num_entries ( FROBNICATORS );
+ *
+ * @endcode
+ *
+ */
+#define table_num_entries( table )					\
+	( ( unsigned int ) ( table_end ( table ) -			\
+			     table_start ( table ) ) )
+
+/**
+ * Iterate through all entries within a linker table
+ *
+ * @v pointer		Entry pointer
+ * @v table		Linker table
+ *
+ * Example usage:
+ *
+ * @code
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   struct frobnicator *frob;
+ *
+ *   for_each_table_entry ( frob, FROBNICATORS ) {
+ *     ...
+ *   }
+ *
+ * @endcode
+ *
+ */
+#define for_each_table_entry( pointer, table )				\
+	for ( pointer = table_start ( table ) ;				\
+	      pointer < table_end ( table ) ;				\
+	      pointer++ )
+
+/**
+ * Iterate through all entries within a linker table in reverse order
+ *
+ * @v pointer		Entry pointer
+ * @v table		Linker table
+ *
+ * Example usage:
+ *
+ * @code
+ *
+ *   #define FROBNICATORS __table ( struct frobnicator, "frobnicators" )
+ *
+ *   struct frobnicator *frob;
+ *
+ *   for_each_table_entry_reverse ( frob, FROBNICATORS ) {
+ *     ...
+ *   }
+ *
+ * @endcode
+ *
+ */
+#define for_each_table_entry_reverse( pointer, table )			\
+	for ( pointer = ( table_end ( table ) - 1 ) ;			\
+	      pointer >= table_start ( table ) ;			\
+	      pointer-- )
+
+/******************************************************************************
+ *
+ * Intel's C compiler chokes on several of the constructs used in this
+ * file.  The workarounds are ugly, so we use them only for an icc
+ * build.
+ *
+ */
+#define ICC_ALIGN_HACK_FACTOR 128
+#ifdef __ICC
+
+/*
+ * icc miscompiles zero-length arrays by inserting padding to a length
+ * of two array elements.  We therefore have to generate the
+ * __table_entries() symbols by hand in asm.
+ *
+ */
+#undef __table_entries
+#define __table_entries( table, idx ) ( {				\
+	extern __table_type ( table )					\
+		__table_temp_sym ( idx, __LINE__ ) []			\
+		__table_entry ( table, idx ) 				\
+		asm ( __table_entries_sym ( table, idx ) );		\
+	__asm__ ( ".ifndef %c0\n\t"					\
+		  ".section " __table_section ( table, idx ) "\n\t"	\
+		  ".align %c1\n\t"					\
+	          "\n%c0:\n\t"						\
+		  ".previous\n\t" 					\
+		  ".endif\n\t"						\
+		  : : "i" ( __table_temp_sym ( idx, __LINE__ ) ),	\
+		      "i" ( __table_alignment ( table ) ) );		\
+	__table_temp_sym ( idx, __LINE__ ); } )
+#define __table_entries_sym( table, idx )				\
+	"__tbl_" __table_name ( table ) "_" #idx
+#define __table_temp_sym( a, b )					\
+	___table_temp_sym( __table_, a, _, b )
+#define ___table_temp_sym( a, b, c, d ) a ## b ## c ## d
+
+/*
+ * icc ignores __attribute__ (( aligned (x) )) when it is used to
+ * decrease the compiler's default choice of alignment (which may be
+ * higher than the alignment actually required by the structure).  We
+ * work around this by forcing the alignment to a large multiple of
+ * the required value (so that we are never attempting to decrease the
+ * default alignment) and then postprocessing the object file to
+ * reduce the alignment back down to the "real" value.
+ *
+ */
+#undef __table_alignment
+#define __table_alignment( table ) \
+	( ICC_ALIGN_HACK_FACTOR * __alignof__ ( __table_type ( table ) ) )
+
+/*
+ * Because of the alignment hack, we must ensure that the compiler
+ * never tries to place multiple objects within the same section,
+ * otherwise the assembler will insert padding to the (incorrect)
+ * alignment boundary.  Do this by appending the line number to table
+ * section names.
+ *
+ * Note that we don't need to worry about padding between array
+ * elements, since the alignment is declared on the variable (i.e. the
+ * whole array) rather than on the type (i.e. on all individual array
+ * elements).
+ */
+#undef __table_section
+#define __table_section( table, idx ) \
+	".tbl." __table_name ( table ) "." __table_str ( idx ) \
+	"." __table_xstr ( __LINE__ )
+#define __table_xstr( x ) __table_str ( x )
+
+#endif /* __ICC */
+
+#endif /* _IPXE_TABLES_H */
diff --git a/src/include/ipxe/tcp.h b/src/include/ipxe/tcp.h
new file mode 100644
index 0000000..f834cc3
--- /dev/null
+++ b/src/include/ipxe/tcp.h
@@ -0,0 +1,318 @@
+#ifndef _IPXE_TCP_H
+#define _IPXE_TCP_H
+
+/** @file
+ *
+ * TCP protocol
+ *
+ * This file defines the iPXE TCP API.
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/tcpip.h>
+
+/**
+ * A TCP header
+ */
+struct tcp_header {
+	uint16_t src;		/* Source port */
+	uint16_t dest;		/* Destination port */
+	uint32_t seq;		/* Sequence number */
+	uint32_t ack;		/* Acknowledgement number */
+	uint8_t hlen;		/* Header length (4), Reserved (4) */
+	uint8_t flags;		/* Reserved (2), Flags (6) */
+	uint16_t win;		/* Advertised window */
+	uint16_t csum;		/* Checksum */
+	uint16_t urg;		/* Urgent pointer */
+};
+
+/** @defgroup tcpopts TCP options
+ * @{
+ */
+
+/** End of TCP options list */
+#define TCP_OPTION_END 0
+
+/** TCP option pad */
+#define TCP_OPTION_NOP 1
+
+/** Generic TCP option */
+struct tcp_option {
+	uint8_t kind;
+	uint8_t length;
+} __attribute__ (( packed ));
+
+/** TCP MSS option */
+struct tcp_mss_option {
+	uint8_t kind;
+	uint8_t length;
+	uint16_t mss;
+} __attribute__ (( packed ));
+
+/** Code for the TCP MSS option */
+#define TCP_OPTION_MSS 2
+
+/** TCP timestamp option */
+struct tcp_timestamp_option {
+	uint8_t kind;
+	uint8_t length;
+	uint32_t tsval;
+	uint32_t tsecr;
+} __attribute__ (( packed ));
+
+/** Padded TCP timestamp option (used for sending) */
+struct tcp_timestamp_padded_option {
+	uint8_t nop[2];
+	struct tcp_timestamp_option tsopt;
+} __attribute__ (( packed ));
+
+/** Code for the TCP timestamp option */
+#define TCP_OPTION_TS 8
+
+/** Parsed TCP options */
+struct tcp_options {
+	/** MSS option, if present */
+	const struct tcp_mss_option *mssopt;
+	/** Timestampe option, if present */
+	const struct tcp_timestamp_option *tsopt;
+};
+
+/** @} */
+
+/*
+ * TCP flags
+ */
+#define TCP_CWR		0x80
+#define TCP_ECE		0x40
+#define TCP_URG		0x20
+#define TCP_ACK		0x10
+#define TCP_PSH		0x08
+#define TCP_RST		0x04
+#define TCP_SYN		0x02
+#define TCP_FIN		0x01
+
+/**
+* @defgroup tcpstates TCP states
+*
+* The TCP state is defined by a combination of the flags that have
+* been sent to the peer, the flags that have been acknowledged by the
+* peer, and the flags that have been received from the peer.
+*
+* @{
+*/
+
+/** TCP flags that have been sent in outgoing packets */
+#define TCP_STATE_SENT(flags) ( (flags) << 0 )
+#define TCP_FLAGS_SENT(state) ( ( (state) >> 0 ) & 0xff )
+
+/** TCP flags that have been acknowledged by the peer
+ *
+ * Note that this applies only to SYN and FIN.
+ */
+#define TCP_STATE_ACKED(flags) ( (flags) << 8 )
+#define TCP_FLAGS_ACKED(state) ( ( (state) >> 8 ) & 0xff )
+
+/** TCP flags that have been received from the peer
+ *
+ * Note that this applies only to SYN and FIN, and that once SYN has
+ * been received, we should always be sending ACK.
+ */
+#define TCP_STATE_RCVD(flags) ( (flags) << 16 )
+#define TCP_FLAGS_RCVD(state) ( ( (state) >> 16 ) & 0xff )
+
+/** TCP flags that are currently being sent in outgoing packets */
+#define TCP_FLAGS_SENDING(state) \
+	( TCP_FLAGS_SENT ( state ) & ~TCP_FLAGS_ACKED ( state ) )
+
+/** CLOSED
+ *
+ * The connection has not yet been used for anything.
+ */
+#define TCP_CLOSED TCP_RST
+
+/** LISTEN
+ *
+ * Not currently used as a state; we have no support for listening
+ * connections.  Given a unique value to avoid compiler warnings.
+ */
+#define TCP_LISTEN 0
+
+/** SYN_SENT
+ *
+ * SYN has been sent, nothing has yet been received or acknowledged.
+ */
+#define TCP_SYN_SENT	( TCP_STATE_SENT ( TCP_SYN ) )
+
+/** SYN_RCVD
+ *
+ * SYN has been sent but not acknowledged, SYN has been received.
+ */
+#define TCP_SYN_RCVD	( TCP_STATE_SENT ( TCP_SYN | TCP_ACK ) |	    \
+			  TCP_STATE_RCVD ( TCP_SYN ) )
+
+/** ESTABLISHED
+ *
+ * SYN has been sent and acknowledged, SYN has been received.
+ */
+#define TCP_ESTABLISHED	( TCP_STATE_SENT ( TCP_SYN | TCP_ACK ) |	    \
+			  TCP_STATE_ACKED ( TCP_SYN ) |			    \
+			  TCP_STATE_RCVD ( TCP_SYN ) )
+
+/** FIN_WAIT_1
+ *
+ * SYN has been sent and acknowledged, SYN has been received, FIN has
+ * been sent but not acknowledged, FIN has not been received.
+ *
+ * RFC 793 shows that we can enter FIN_WAIT_1 without have had SYN
+ * acknowledged, i.e. if the application closes the connection after
+ * sending and receiving SYN, but before having had SYN acknowledged.
+ * However, we have to *pretend* that SYN has been acknowledged
+ * anyway, otherwise we end up sending SYN and FIN in the same
+ * sequence number slot.  Therefore, when we transition from SYN_RCVD
+ * to FIN_WAIT_1, we have to remember to set TCP_STATE_ACKED(TCP_SYN)
+ * and increment our sequence number.
+ */
+#define TCP_FIN_WAIT_1	( TCP_STATE_SENT ( TCP_SYN | TCP_ACK | TCP_FIN ) |  \
+			  TCP_STATE_ACKED ( TCP_SYN ) |			    \
+			  TCP_STATE_RCVD ( TCP_SYN ) )
+
+/** FIN_WAIT_2
+ *
+ * SYN has been sent and acknowledged, SYN has been received, FIN has
+ * been sent and acknowledged, FIN ha not been received.
+ */
+#define TCP_FIN_WAIT_2	( TCP_STATE_SENT ( TCP_SYN | TCP_ACK | TCP_FIN ) |  \
+			  TCP_STATE_ACKED ( TCP_SYN | TCP_FIN ) |	    \
+			  TCP_STATE_RCVD ( TCP_SYN ) )
+
+/** CLOSING / LAST_ACK
+ *
+ * SYN has been sent and acknowledged, SYN has been received, FIN has
+ * been sent but not acknowledged, FIN has been received.
+ *
+ * This state actually encompasses both CLOSING and LAST_ACK; they are
+ * identical with the definition of state that we use.  I don't
+ * *believe* that they need to be distinguished.
+ */
+#define TCP_CLOSING_OR_LAST_ACK						    \
+			( TCP_STATE_SENT ( TCP_SYN | TCP_ACK | TCP_FIN ) |  \
+			  TCP_STATE_ACKED ( TCP_SYN ) |			    \
+			  TCP_STATE_RCVD ( TCP_SYN | TCP_FIN ) )
+
+/** TIME_WAIT
+ *
+ * SYN has been sent and acknowledged, SYN has been received, FIN has
+ * been sent and acknowledged, FIN has been received.
+ */
+#define TCP_TIME_WAIT	( TCP_STATE_SENT ( TCP_SYN | TCP_ACK | TCP_FIN ) |  \
+			  TCP_STATE_ACKED ( TCP_SYN | TCP_FIN ) |	    \
+			  TCP_STATE_RCVD ( TCP_SYN | TCP_FIN ) )
+
+/** CLOSE_WAIT
+ *
+ * SYN has been sent and acknowledged, SYN has been received, FIN has
+ * been received.
+ */
+#define TCP_CLOSE_WAIT	( TCP_STATE_SENT ( TCP_SYN | TCP_ACK ) |	    \
+			  TCP_STATE_ACKED ( TCP_SYN ) |			    \
+			  TCP_STATE_RCVD ( TCP_SYN | TCP_FIN ) )
+
+/** Can send data in current state
+ *
+ * We can send data if and only if we have had our SYN acked and we
+ * have not yet sent our FIN.
+ */
+#define TCP_CAN_SEND_DATA(state)					    \
+	( ( (state) & ( TCP_STATE_ACKED ( TCP_SYN ) |			    \
+			TCP_STATE_SENT ( TCP_FIN ) ) )			    \
+	  == TCP_STATE_ACKED ( TCP_SYN ) )
+
+/** Have ever been fully established
+ *
+ * We have been fully established if we have both received a SYN and
+ * had our own SYN acked.
+ */
+#define TCP_HAS_BEEN_ESTABLISHED(state)					    \
+	( ( (state) & ( TCP_STATE_ACKED ( TCP_SYN ) |			    \
+			TCP_STATE_RCVD ( TCP_SYN ) ) )			    \
+	  == ( TCP_STATE_ACKED ( TCP_SYN ) | TCP_STATE_RCVD ( TCP_SYN ) ) )
+
+/** Have closed gracefully
+ *
+ * We have closed gracefully if we have both received a FIN and had
+ * our own FIN acked.
+ */
+#define TCP_CLOSED_GRACEFULLY(state)					    \
+	( ( (state) & ( TCP_STATE_ACKED ( TCP_FIN ) |			    \
+			TCP_STATE_RCVD ( TCP_FIN ) ) )			    \
+	  == ( TCP_STATE_ACKED ( TCP_FIN ) | TCP_STATE_RCVD ( TCP_FIN ) ) )
+
+/** @} */
+
+/** Mask for TCP header length field */
+#define TCP_MASK_HLEN	0xf0
+
+/** Smallest port number on which a TCP connection can listen */
+#define TCP_MIN_PORT 1
+
+/* Some IOB constants */
+#define MAX_HDR_LEN	100
+#define MAX_IOB_LEN	1500
+#define MIN_IOB_LEN	MAX_HDR_LEN + 100 /* To account for padding by LL */
+
+/**
+ * Maxmimum advertised TCP window size
+ *
+ * We estimate the TCP window size as the amount of free memory we
+ * have.  This is not strictly accurate (since it ignores any space
+ * already allocated as RX buffers), but it will do for now.
+ *
+ * Since we don't store out-of-order received packets, the
+ * retransmission penalty is that the whole window contents must be
+ * resent.  This suggests keeping the window size small, but bear in
+ * mind that the maximum bandwidth on any link is limited to
+ *
+ *    max_bandwidth = ( tcp_window / round_trip_time )
+ *
+ * With a 48kB window, which probably accurately reflects our amount
+ * of free memory, and a WAN RTT of say 200ms, this gives a maximum
+ * bandwidth of 240kB/s.  This is sufficiently close to realistic that
+ * we will need to be careful that our advertised window doesn't end
+ * up limiting WAN download speeds.
+ *
+ * Finally, since the window goes into a 16-bit field and we cannot
+ * actually use 65536, we use a window size of (65536-4) to ensure
+ * that payloads remain dword-aligned.
+ */
+//#define TCP_MAX_WINDOW_SIZE	( 65536 - 4 )
+#define TCP_MAX_WINDOW_SIZE	4096
+
+/**
+ * Path MTU
+ *
+ * We really ought to implement Path MTU discovery.  Until we do,
+ * anything with a path MTU greater than this may fail.
+ */
+#define TCP_PATH_MTU 1460
+
+/**
+ * Advertised TCP MSS
+ *
+ * We currently hardcode this to a reasonable value and hope that the
+ * sender uses path MTU discovery.  The alternative is breaking the
+ * abstraction layer so that we can find out the MTU from the IP layer
+ * (which would have to find out from the net device layer).
+ */
+#define TCP_MSS 1460
+
+/** TCP maximum segment lifetime
+ *
+ * Currently set to 2 minutes, as per RFC 793.
+ */
+#define TCP_MSL ( 2 * 60 * TICKS_PER_SEC )
+
+extern struct tcpip_protocol tcp_protocol;
+
+#endif /* _IPXE_TCP_H */
diff --git a/src/include/ipxe/tcpip.h b/src/include/ipxe/tcpip.h
new file mode 100644
index 0000000..cdf554e
--- /dev/null
+++ b/src/include/ipxe/tcpip.h
@@ -0,0 +1,128 @@
+#ifndef _IPXE_TCPIP_H
+#define _IPXE_TCPIP_H
+
+/** @file
+ *
+ * Transport-network layer interface
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/socket.h>
+#include <ipxe/in.h>
+#include <ipxe/tables.h>
+
+struct io_buffer;
+struct net_device;
+
+/** Empty checksum value
+ *
+ * This is the TCP/IP checksum over a zero-length block of data.
+ */
+#define TCPIP_EMPTY_CSUM 0xffff
+
+/**
+ * TCP/IP socket address
+ *
+ * This contains the fields common to socket addresses for all TCP/IP
+ * address families.
+ */
+struct sockaddr_tcpip {
+	/** Socket address family (part of struct @c sockaddr) */
+	sa_family_t st_family;
+	/** TCP/IP port */
+	uint16_t st_port;
+	/** Padding
+	 *
+	 * This ensures that a struct @c sockaddr_tcpip is large
+	 * enough to hold a socket address for any TCP/IP address
+	 * family.
+	 */
+	char pad[ sizeof ( struct sockaddr ) -
+		  ( sizeof ( sa_family_t ) + sizeof ( uint16_t ) ) ];
+} __attribute__ (( may_alias ));
+
+/** 
+ * A transport-layer protocol of the TCP/IP stack (eg. UDP, TCP, etc)
+ */
+struct tcpip_protocol {
+	/** Protocol name */
+	const char *name;
+       	/**
+         * Process received packet
+         *
+         * @v iobuf		I/O buffer
+	 * @v st_src		Partially-filled source address
+	 * @v st_dest		Partially-filled destination address
+	 * @v pshdr_csum	Pseudo-header checksum
+	 * @ret rc		Return status code
+         *
+         * This method takes ownership of the I/O buffer.
+         */
+        int ( * rx ) ( struct io_buffer *iobuf, struct sockaddr_tcpip *st_src,
+		       struct sockaddr_tcpip *st_dest, uint16_t pshdr_csum );
+        /** 
+	 * Transport-layer protocol number
+	 *
+	 * This is a constant of the type IP_XXX
+         */
+        uint8_t tcpip_proto;
+};
+
+/**
+ * A network-layer protocol of the TCP/IP stack (eg. IPV4, IPv6, etc)
+ */
+struct tcpip_net_protocol {
+	/** Protocol name */
+	const char *name;
+	/** Network address family */
+	sa_family_t sa_family;
+	/**
+	 * Transmit packet
+	 *
+	 * @v iobuf		I/O buffer
+	 * @v tcpip_protocol	Transport-layer protocol
+	 * @v st_src		Source address, or NULL to use default
+	 * @v st_dest		Destination address
+	 * @v netdev		Network device (or NULL to route automatically)
+	 * @v trans_csum	Transport-layer checksum to complete, or NULL
+	 * @ret rc		Return status code
+	 *
+	 * This function takes ownership of the I/O buffer.
+	 */
+	int ( * tx ) ( struct io_buffer *iobuf,
+		       struct tcpip_protocol *tcpip_protocol,
+		       struct sockaddr_tcpip *st_src,
+		       struct sockaddr_tcpip *st_dest,
+		       struct net_device *netdev,
+		       uint16_t *trans_csum );
+};
+
+/** TCP/IP transport-layer protocol table */
+#define TCPIP_PROTOCOLS __table ( struct tcpip_protocol, "tcpip_protocols" )
+
+/** Declare a TCP/IP transport-layer protocol */
+#define __tcpip_protocol __table_entry ( TCPIP_PROTOCOLS, 01 )
+
+/** TCP/IP network-layer protocol table */
+#define TCPIP_NET_PROTOCOLS \
+	__table ( struct tcpip_net_protocol, "tcpip_net_protocols" )
+
+/** Declare a TCP/IP network-layer protocol */
+#define __tcpip_net_protocol __table_entry ( TCPIP_NET_PROTOCOLS, 01 )
+
+extern int tcpip_rx ( struct io_buffer *iobuf, uint8_t tcpip_proto,
+		      struct sockaddr_tcpip *st_src,
+		      struct sockaddr_tcpip *st_dest, uint16_t pshdr_csum );
+extern int tcpip_tx ( struct io_buffer *iobuf, struct tcpip_protocol *tcpip,
+		      struct sockaddr_tcpip *st_src,
+		      struct sockaddr_tcpip *st_dest,
+		      struct net_device *netdev,
+		      uint16_t *trans_csum );
+extern uint16_t tcpip_continue_chksum ( uint16_t partial,
+					const void *data, size_t len );
+extern uint16_t tcpip_chksum ( const void *data, size_t len );
+
+#endif /* _IPXE_TCPIP_H */
diff --git a/src/include/ipxe/tftp.h b/src/include/ipxe/tftp.h
new file mode 100644
index 0000000..38be0d4
--- /dev/null
+++ b/src/include/ipxe/tftp.h
@@ -0,0 +1,85 @@
+#ifndef	_IPXE_TFTP_H
+#define	_IPXE_TFTP_H
+
+/** @file
+ *
+ * TFTP protocol
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+#define TFTP_PORT	       69 /**< Default TFTP server port */
+#define	TFTP_DEFAULT_BLKSIZE  512 /**< Default TFTP data block size */
+#define	TFTP_MAX_BLKSIZE     1432
+
+#define TFTP_RRQ		1 /**< Read request opcode */
+#define TFTP_WRQ		2 /**< Write request opcode */
+#define TFTP_DATA		3 /**< Data block opcode */
+#define TFTP_ACK		4 /**< Data block acknowledgement opcode */
+#define TFTP_ERROR		5 /**< Error opcode */
+#define TFTP_OACK		6 /**< Options acknowledgement opcode */
+
+#define TFTP_ERR_FILE_NOT_FOUND	1 /**< File not found */
+#define TFTP_ERR_ACCESS_DENIED	2 /**< Access violation */
+#define TFTP_ERR_DISK_FULL	3 /**< Disk full or allocation exceeded */
+#define TFTP_ERR_ILLEGAL_OP	4 /**< Illegal TFTP operation */
+#define TFTP_ERR_UNKNOWN_TID	5 /**< Unknown transfer ID */
+#define TFTP_ERR_FILE_EXISTS	6 /**< File already exists */
+#define TFTP_ERR_UNKNOWN_USER	7 /**< No such user */
+#define TFTP_ERR_BAD_OPTS	8 /**< Option negotiation failed */
+
+#define MTFTP_PORT	     1759 /**< Default MTFTP server port */
+
+/** A TFTP read request (RRQ) packet */
+struct tftp_rrq {
+	uint16_t opcode;
+	char data[0];
+} __attribute__ (( packed ));
+
+/** A TFTP data (DATA) packet */
+struct tftp_data {
+	uint16_t opcode;
+	uint16_t block;
+	uint8_t data[0];
+} __attribute__ (( packed ));
+ 
+/** A TFTP acknowledgement (ACK) packet */
+struct tftp_ack {
+	uint16_t opcode;
+	uint16_t block;
+} __attribute__ (( packed ));
+
+/** A TFTP error (ERROR) packet */
+struct tftp_error {
+	uint16_t opcode;
+	uint16_t errcode;
+	char errmsg[0];
+} __attribute__ (( packed ));
+
+/** A TFTP options acknowledgement (OACK) packet */
+struct tftp_oack {
+	uint16_t opcode;
+	char data[0];
+} __attribute__ (( packed ));
+
+/** The common header of all TFTP packets */
+struct tftp_common {
+	uint16_t opcode;
+} __attribute__ (( packed ));
+
+/** A union encapsulating all TFTP packet types */
+union tftp_any {
+	struct tftp_common	common;
+	struct tftp_rrq		rrq;
+	struct tftp_data	data;
+	struct tftp_ack		ack;
+	struct tftp_error	error;
+	struct tftp_oack	oack;
+};
+
+extern void tftp_set_request_blksize ( unsigned int blksize );
+
+#endif /* _IPXE_TFTP_H */
diff --git a/src/include/ipxe/threewire.h b/src/include/ipxe/threewire.h
new file mode 100644
index 0000000..135ef56
--- /dev/null
+++ b/src/include/ipxe/threewire.h
@@ -0,0 +1,105 @@
+#ifndef _IPXE_THREEWIRE_H
+#define _IPXE_THREEWIRE_H
+
+/** @file
+ *
+ * Three-wire serial interface
+ *
+ * The Atmel three-wire interface is a subset of the (newer) SPI
+ * interface, and is implemented here as a layer on top of the SPI
+ * support.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/spi.h>
+#include <limits.h>
+
+/**
+ * @defgroup tcmds Three-wire commands
+ * @{
+ */
+
+/** Read data from memory array */
+#define THREEWIRE_READ 0x6
+
+/** Write data to memory array */
+#define THREEWIRE_WRITE 0x5
+
+/** Write enable */
+#define THREEWIRE_EWEN 0x4
+
+/** Address to be used for write enable command */
+#define THREEWIRE_EWEN_ADDRESS INT_MAX
+
+/** Time to wait for write cycles to complete
+ *
+ * This is sufficient for AT93C46/AT93C56 devices, but may need to be
+ * increased in future when other devices are added.
+ */
+#define THREEWIRE_WRITE_MDELAY 10
+
+/** @} */
+
+extern int threewire_read ( struct nvs_device *nvs, unsigned int address,
+			    void *data, size_t len );
+extern int threewire_write ( struct nvs_device *nvs, unsigned int address,
+			     const void *data, size_t len );
+extern int threewire_detect_address_len ( struct spi_device *device );
+
+/**
+ * @defgroup tdevs Three-wire device types
+ * @{
+ */
+
+static inline __attribute__ (( always_inline )) void
+init_at93cx6 ( struct spi_device *device, unsigned int organisation ) {
+	device->nvs.word_len_log2 = ( ( organisation == 8 ) ? 0 : 1 );
+	device->nvs.block_size = 1;
+	device->command_len = 3,
+	device->nvs.read = threewire_read;
+	device->nvs.write = threewire_write;
+}
+
+/**
+ * Initialise Atmel AT93C46 serial EEPROM
+ *
+ * @v device		SPI device
+ * @v organisation	Word organisation (8 or 16)
+ */
+static inline __attribute__ (( always_inline )) void
+init_at93c46 ( struct spi_device *device, unsigned int organisation ) {
+	device->nvs.size = ( 1024 / organisation );
+	device->address_len = ( ( organisation == 8 ) ? 7 : 6 );
+	init_at93cx6 ( device, organisation );
+}
+
+/**
+ * Initialise Atmel AT93C56 serial EEPROM
+ *
+ * @v device		SPI device
+ * @v organisation	Word organisation (8 or 16)
+ */
+static inline __attribute__ (( always_inline )) void
+init_at93c56 ( struct spi_device *device, unsigned int organisation ) {
+	device->nvs.size = ( 2048 / organisation );
+	device->address_len = ( ( organisation == 8 ) ? 9 : 8 );
+	init_at93cx6 ( device, organisation );
+}
+
+/**
+ * Initialise Atmel AT93C66 serial EEPROM
+ *
+ * @v device		SPI device
+ * @v organisation	Word organisation (8 or 16)
+ */
+static inline __attribute__ (( always_inline )) void
+init_at93c66 ( struct spi_device *device, unsigned int organisation ) {
+	device->nvs.size = ( 4096 / organisation );
+	device->address_len = ( ( organisation == 8 ) ? 9 : 8 );
+	init_at93cx6 ( device, organisation );
+}
+
+/** @} */
+
+#endif /* _IPXE_THREEWIRE_H */
diff --git a/src/include/ipxe/timer.h b/src/include/ipxe/timer.h
new file mode 100644
index 0000000..d59122f
--- /dev/null
+++ b/src/include/ipxe/timer.h
@@ -0,0 +1,76 @@
+#ifndef	_IPXE_TIMER_H
+#define _IPXE_TIMER_H
+
+/** @file
+ *
+ * iPXE timer API
+ *
+ * The timer API provides udelay() for fixed delays, and currticks()
+ * for a monotonically increasing tick counter.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/api.h>
+#include <config/timer.h>
+
+/**
+ * Calculate static inline timer API function name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ */
+#define TIMER_INLINE( _subsys, _api_func ) \
+	SINGLE_API_INLINE ( TIMER_PREFIX_ ## _subsys, _api_func )
+
+/**
+ * Provide a timer API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_TIMER( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( TIMER_PREFIX_ ## _subsys, _api_func, _func )
+
+/**
+ * Provide a static inline timer API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ */
+#define PROVIDE_TIMER_INLINE( _subsys, _api_func ) \
+	PROVIDE_SINGLE_API_INLINE ( TIMER_PREFIX_ ## _subsys, _api_func )
+
+/* Include all architecture-independent I/O API headers */
+#include <ipxe/efi/efi_timer.h>
+
+/* Include all architecture-dependent I/O API headers */
+#include <bits/timer.h>
+
+/**
+ * Delay for a fixed number of microseconds
+ *
+ * @v usecs		Number of microseconds for which to delay
+ */
+void udelay ( unsigned long usecs );
+
+/**
+ * Get current system time in ticks
+ *
+ * @ret ticks		Current time, in ticks
+ */
+unsigned long currticks ( void );
+
+/**
+ * Get number of ticks per second
+ *
+ * @ret ticks_per_sec	Number of ticks per second
+ */
+unsigned long ticks_per_sec ( void );
+
+/** Number of ticks per second */
+#define TICKS_PER_SEC ( ticks_per_sec() )
+
+#endif /* _IPXE_TIMER_H */
diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h
new file mode 100644
index 0000000..2cc36dd
--- /dev/null
+++ b/src/include/ipxe/tls.h
@@ -0,0 +1,187 @@
+#ifndef _IPXE_TLS_H
+#define _IPXE_TLS_H
+
+/**
+ * @file
+ *
+ * Transport Layer Security Protocol
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <ipxe/refcnt.h>
+#include <ipxe/filter.h>
+#include <ipxe/process.h>
+#include <ipxe/crypto.h>
+#include <ipxe/md5.h>
+#include <ipxe/sha1.h>
+#include <ipxe/x509.h>
+
+/** A TLS header */
+struct tls_header {
+	/** Content type
+	 *
+	 * This is a TLS_TYPE_XXX constant
+	 */
+	uint8_t type;
+	/** Protocol version
+	 *
+	 * This is a TLS_VERSION_XXX constant
+	 */
+	uint16_t version;
+	/** Length of payload */
+	uint16_t length;
+} __attribute__ (( packed ));
+
+/** TLS version 1.0 */
+#define TLS_VERSION_TLS_1_0 0x0301
+
+/** TLS version 1.1 */
+#define TLS_VERSION_TLS_1_1 0x0302
+
+/** Change cipher content type */
+#define TLS_TYPE_CHANGE_CIPHER 20
+
+/** Alert content type */
+#define TLS_TYPE_ALERT 21
+
+/** Handshake content type */
+#define TLS_TYPE_HANDSHAKE 22
+
+/** Application data content type */
+#define TLS_TYPE_DATA 23
+
+/* Handshake message types */
+#define TLS_HELLO_REQUEST 0
+#define TLS_CLIENT_HELLO 1
+#define TLS_SERVER_HELLO 2
+#define TLS_CERTIFICATE 11
+#define TLS_SERVER_KEY_EXCHANGE 12
+#define TLS_CERTIFICATE_REQUEST 13
+#define TLS_SERVER_HELLO_DONE 14
+#define TLS_CERTIFICATE_VERIFY 15
+#define TLS_CLIENT_KEY_EXCHANGE 16
+#define TLS_FINISHED 20
+
+/* TLS alert levels */
+#define TLS_ALERT_WARNING 1
+#define TLS_ALERT_FATAL 2
+
+/* TLS cipher specifications */
+#define TLS_RSA_WITH_NULL_MD5 0x0001
+#define TLS_RSA_WITH_NULL_SHA 0x0002
+#define TLS_RSA_WITH_AES_128_CBC_SHA 0x002f
+#define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035
+
+/** TLS RX state machine state */
+enum tls_rx_state {
+	TLS_RX_HEADER = 0,
+	TLS_RX_DATA,
+};
+
+/** TLS TX state machine state */
+enum tls_tx_state {
+	TLS_TX_NONE = 0,
+	TLS_TX_CLIENT_HELLO,
+	TLS_TX_CLIENT_KEY_EXCHANGE,
+	TLS_TX_CHANGE_CIPHER,
+	TLS_TX_FINISHED,
+	TLS_TX_DATA
+};
+
+/** A TLS cipher specification */
+struct tls_cipherspec {
+	/** Public-key encryption algorithm */
+	struct pubkey_algorithm *pubkey;
+	/** Bulk encryption cipher algorithm */
+	struct cipher_algorithm *cipher;
+	/** MAC digest algorithm */
+	struct digest_algorithm *digest;
+	/** Key length */
+	size_t key_len;
+	/** Dynamically-allocated storage */
+	void *dynamic;
+	/** Public key encryption context */
+	void *pubkey_ctx;
+	/** Bulk encryption cipher context */
+	void *cipher_ctx;
+	/** Next bulk encryption cipher context (TX only) */
+	void *cipher_next_ctx;
+	/** MAC secret */
+	void *mac_secret;
+};
+
+/** TLS pre-master secret */
+struct tls_pre_master_secret {
+	/** TLS version */
+	uint16_t version;
+	/** Random data */
+	uint8_t random[46];
+} __attribute__ (( packed ));
+
+/** TLS client random data */
+struct tls_client_random {
+	/** GMT Unix time */
+	uint32_t gmt_unix_time;
+	/** Random data */
+	uint8_t random[28];
+} __attribute__ (( packed ));
+
+/** A TLS session */
+struct tls_session {
+	/** Reference counter */
+	struct refcnt refcnt;
+
+	/** Plaintext stream */
+	struct xfer_filter_half plainstream;
+	/** Ciphertext stream */
+	struct xfer_filter_half cipherstream;
+
+	/** Current TX cipher specification */
+	struct tls_cipherspec tx_cipherspec;
+	/** Next TX cipher specification */
+	struct tls_cipherspec tx_cipherspec_pending;
+	/** Current RX cipher specification */
+	struct tls_cipherspec rx_cipherspec;
+	/** Next RX cipher specification */
+	struct tls_cipherspec rx_cipherspec_pending;
+	/** Premaster secret */
+	struct tls_pre_master_secret pre_master_secret;
+	/** Master secret */
+	uint8_t master_secret[48];
+	/** Server random bytes */
+	uint8_t server_random[32];
+	/** Client random bytes */
+	struct tls_client_random client_random;
+	/** MD5 context for handshake verification */
+	uint8_t handshake_md5_ctx[MD5_CTX_SIZE];
+	/** SHA1 context for handshake verification */
+	uint8_t handshake_sha1_ctx[SHA1_CTX_SIZE];
+
+	/** Hack: server RSA public key */
+	struct x509_rsa_public_key rsa;
+
+	/** TX sequence number */
+	uint64_t tx_seq;
+	/** TX state */
+	enum tls_tx_state tx_state;
+	/** TX process */
+	struct process process;
+
+	/** RX sequence number */
+	uint64_t rx_seq;
+	/** RX state */
+	enum tls_rx_state rx_state;
+	/** Offset within current RX state */
+	size_t rx_rcvd;
+	/** Current received record header */
+	struct tls_header rx_header;
+	/** Current received raw data buffer */
+	void *rx_data;
+};
+
+extern int add_tls ( struct xfer_interface *xfer,
+		     struct xfer_interface **next );
+
+#endif /* _IPXE_TLS_H */
diff --git a/src/include/ipxe/uaccess.h b/src/include/ipxe/uaccess.h
new file mode 100644
index 0000000..7d4ab9c
--- /dev/null
+++ b/src/include/ipxe/uaccess.h
@@ -0,0 +1,344 @@
+#ifndef _IPXE_UACCESS_H
+#define _IPXE_UACCESS_H
+
+/**
+ * @file
+ *
+ * Access to external ("user") memory
+ *
+ * iPXE often needs to transfer data between internal and external
+ * buffers.  On i386, the external buffers may require access via a
+ * different segment, and the buffer address cannot be encoded into a
+ * simple void * pointer.  The @c userptr_t type encapsulates the
+ * information needed to identify an external buffer, and the
+ * copy_to_user() and copy_from_user() functions provide methods for
+ * transferring data between internal and external buffers.
+ *
+ * Note that userptr_t is an opaque type; in particular, performing
+ * arithmetic upon a userptr_t is not allowed.
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <string.h>
+#include <ipxe/api.h>
+#include <config/ioapi.h>
+
+/**
+ * A pointer to a user buffer
+ *
+ */
+typedef unsigned long userptr_t;
+
+/** Equivalent of NULL for user pointers */
+#define UNULL ( ( userptr_t ) 0 )
+
+/**
+ * @defgroup uaccess_trivial Trivial user access API implementations
+ *
+ * User access API implementations that can be used by environments in
+ * which virtual addresses allow access to all of memory.
+ *
+ * @{
+ *
+ */
+
+/**
+ * Convert virtual address to user pointer
+ *
+ * @v addr		Virtual address
+ * @ret userptr		User pointer
+ */
+static inline __always_inline userptr_t
+trivial_virt_to_user ( volatile const void *addr ) {
+	return ( ( userptr_t ) addr );
+}
+
+/**
+ * Convert user pointer to virtual address
+ *
+ * @v userptr		User pointer
+ * @v offset		Offset from user pointer
+ * @ret addr		Virtual address
+ *
+ * This operation is not available under all memory models.
+ */
+static inline __always_inline void *
+trivial_user_to_virt ( userptr_t userptr, off_t offset ) {
+	return ( ( void * ) userptr + offset );
+}
+
+/**
+ * Add offset to user pointer
+ *
+ * @v userptr		User pointer
+ * @v offset		Offset
+ * @ret userptr		New pointer value
+ */
+static inline __always_inline userptr_t
+trivial_userptr_add ( userptr_t userptr, off_t offset ) {
+	return ( userptr + offset );
+}
+
+/**
+ * Copy data between user buffers
+ *
+ * @v dest		Destination
+ * @v dest_off		Destination offset
+ * @v src		Source
+ * @v src_off		Source offset
+ * @v len		Length
+ */
+static inline __always_inline void
+trivial_memcpy_user ( userptr_t dest, off_t dest_off,
+		      userptr_t src, off_t src_off, size_t len ) {
+	memcpy ( ( ( void * ) dest + dest_off ),
+		 ( ( void * ) src + src_off ), len );
+}
+
+/**
+ * Copy data between user buffers, allowing for overlap
+ *
+ * @v dest		Destination
+ * @v dest_off		Destination offset
+ * @v src		Source
+ * @v src_off		Source offset
+ * @v len		Length
+ */
+static inline __always_inline void
+trivial_memmove_user ( userptr_t dest, off_t dest_off,
+		       userptr_t src, off_t src_off, size_t len ) {
+	memmove ( ( ( void * ) dest + dest_off ),
+		  ( ( void * ) src + src_off ), len );
+}
+
+/**
+ * Fill user buffer with a constant byte
+ *
+ * @v buffer		User buffer
+ * @v offset		Offset within buffer
+ * @v c			Constant byte with which to fill
+ * @v len		Length
+ */
+static inline __always_inline void
+trivial_memset_user ( userptr_t buffer, off_t offset, int c, size_t len ) {
+	memset ( ( ( void * ) buffer + offset ), c, len );
+}
+
+/**
+ * Find length of NUL-terminated string in user buffer
+ *
+ * @v buffer		User buffer
+ * @v offset		Offset within buffer
+ * @ret len		Length of string (excluding NUL)
+ */
+static inline __always_inline size_t
+trivial_strlen_user ( userptr_t buffer, off_t offset ) {
+	return strlen ( ( void * ) buffer + offset );
+}
+
+/**
+ * Find character in user buffer
+ *
+ * @v buffer		User buffer
+ * @v offset		Starting offset within buffer
+ * @v c			Character to search for
+ * @v len		Length of user buffer
+ * @ret offset		Offset of character, or <0 if not found
+ */
+static inline __always_inline off_t
+trivial_memchr_user ( userptr_t buffer, off_t offset, int c, size_t len ) {
+	void *found;
+
+	found = memchr ( ( ( void * ) buffer + offset ), c, len );
+	return ( found ? ( found - ( void * ) buffer ) : -1 );
+}
+
+/** @} */
+
+/**
+ * Calculate static inline user access API function name
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @ret _subsys_func	Subsystem API function
+ */
+#define UACCESS_INLINE( _subsys, _api_func ) \
+	SINGLE_API_INLINE ( UACCESS_PREFIX_ ## _subsys, _api_func )
+
+/**
+ * Provide an user access API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_UACCESS( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( UACCESS_PREFIX_ ## _subsys, _api_func, _func )
+
+/**
+ * Provide a static inline user access API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ */
+#define PROVIDE_UACCESS_INLINE( _subsys, _api_func ) \
+	PROVIDE_SINGLE_API_INLINE ( UACCESS_PREFIX_ ## _subsys, _api_func )
+
+/* Include all architecture-independent user access API headers */
+#include <ipxe/efi/efi_uaccess.h>
+
+/* Include all architecture-dependent user access API headers */
+#include <bits/uaccess.h>
+
+/**
+ * Convert physical address to user pointer
+ *
+ * @v phys_addr		Physical address
+ * @ret userptr		User pointer
+ */
+userptr_t phys_to_user ( unsigned long phys_addr );
+
+/**
+ * Convert user pointer to physical address
+ *
+ * @v userptr		User pointer
+ * @v offset		Offset from user pointer
+ * @ret phys_addr	Physical address
+ */
+unsigned long user_to_phys ( userptr_t userptr, off_t offset );
+
+/**
+ * Convert virtual address to user pointer
+ *
+ * @v addr		Virtual address
+ * @ret userptr		User pointer
+ */
+userptr_t virt_to_user ( volatile const void *addr );
+
+/**
+ * Convert user pointer to virtual address
+ *
+ * @v userptr		User pointer
+ * @v offset		Offset from user pointer
+ * @ret addr		Virtual address
+ *
+ * This operation is not available under all memory models.
+ */
+void * user_to_virt ( userptr_t userptr, off_t offset );
+
+/**
+ * Add offset to user pointer
+ *
+ * @v userptr		User pointer
+ * @v offset		Offset
+ * @ret userptr		New pointer value
+ */
+userptr_t userptr_add ( userptr_t userptr, off_t offset );
+
+/**
+ * Convert virtual address to a physical address
+ *
+ * @v addr		Virtual address
+ * @ret phys_addr	Physical address
+ */
+static inline __always_inline unsigned long
+virt_to_phys ( volatile const void *addr ) {
+	return user_to_phys ( virt_to_user ( addr ), 0 );
+}
+
+/**
+ * Convert physical address to a virtual address
+ *
+ * @v addr		Virtual address
+ * @ret phys_addr	Physical address
+ *
+ * This operation is not available under all memory models.
+ */
+static inline __always_inline void * phys_to_virt ( unsigned long phys_addr ) {
+	return user_to_virt ( phys_to_user ( phys_addr ), 0 );
+}
+
+/**
+ * Copy data between user buffers
+ *
+ * @v dest		Destination
+ * @v dest_off		Destination offset
+ * @v src		Source
+ * @v src_off		Source offset
+ * @v len		Length
+ */
+void memcpy_user ( userptr_t dest, off_t dest_off,
+		   userptr_t src, off_t src_off, size_t len );
+
+/**
+ * Copy data to user buffer
+ *
+ * @v dest		Destination
+ * @v dest_off		Destination offset
+ * @v src		Source
+ * @v len		Length
+ */
+static inline __always_inline void
+copy_to_user ( userptr_t dest, off_t dest_off, const void *src, size_t len ) {
+	memcpy_user ( dest, dest_off, virt_to_user ( src ), 0, len );
+}
+
+/**
+ * Copy data from user buffer
+ *
+ * @v dest		Destination
+ * @v src		Source
+ * @v src_off		Source offset
+ * @v len		Length
+ */
+static inline __always_inline void
+copy_from_user ( void *dest, userptr_t src, off_t src_off, size_t len ) {
+	memcpy_user ( virt_to_user ( dest ), 0, src, src_off, len );
+}
+
+/**
+ * Copy data between user buffers, allowing for overlap
+ *
+ * @v dest		Destination
+ * @v dest_off		Destination offset
+ * @v src		Source
+ * @v src_off		Source offset
+ * @v len		Length
+ */
+void memmove_user ( userptr_t dest, off_t dest_off,
+		    userptr_t src, off_t src_off, size_t len );
+
+/**
+ * Fill user buffer with a constant byte
+ *
+ * @v userptr		User buffer
+ * @v offset		Offset within buffer
+ * @v c			Constant byte with which to fill
+ * @v len		Length
+ */
+void memset_user ( userptr_t userptr, off_t offset, int c, size_t len );
+
+/**
+ * Find length of NUL-terminated string in user buffer
+ *
+ * @v userptr		User buffer
+ * @v offset		Offset within buffer
+ * @ret len		Length of string (excluding NUL)
+ */
+size_t strlen_user ( userptr_t userptr, off_t offset );
+
+/**
+ * Find character in user buffer
+ *
+ * @v userptr		User buffer
+ * @v offset		Starting offset within buffer
+ * @v c			Character to search for
+ * @v len		Length of user buffer
+ * @ret offset		Offset of character, or <0 if not found
+ */
+off_t memchr_user ( userptr_t userptr, off_t offset, int c, size_t len );
+
+#endif /* _IPXE_UACCESS_H */
diff --git a/src/include/ipxe/udp.h b/src/include/ipxe/udp.h
new file mode 100644
index 0000000..5e55c5e
--- /dev/null
+++ b/src/include/ipxe/udp.h
@@ -0,0 +1,48 @@
+#ifndef _IPXE_UDP_H
+#define _IPXE_UDP_H
+
+/** @file
+ *
+ * UDP protocol
+ *
+ * This file defines the iPXE UDP API.
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stddef.h>
+#include <ipxe/iobuf.h>
+#include <ipxe/tcpip.h>
+#include <ipxe/if_ether.h>
+
+struct xfer_interface;
+
+/**
+ * UDP constants
+ */
+
+#define UDP_MAX_HLEN	72
+#define UDP_MAX_TXIOB	ETH_MAX_MTU
+#define UDP_MIN_TXIOB	ETH_ZLEN
+
+/**
+ * A UDP header
+ */
+struct udp_header {
+	/** Source port */
+	uint16_t src;
+	/** Destination port */
+	uint16_t dest;
+	/** Length */
+	uint16_t len;
+	/** Checksum */
+	uint16_t chksum;
+};
+
+extern int udp_open_promisc ( struct xfer_interface *xfer );
+extern int udp_open ( struct xfer_interface *xfer, struct sockaddr *peer,
+		      struct sockaddr *local );
+
+#endif /* _IPXE_UDP_H */
+
diff --git a/src/include/ipxe/umalloc.h b/src/include/ipxe/umalloc.h
new file mode 100644
index 0000000..4afa0c9
--- /dev/null
+++ b/src/include/ipxe/umalloc.h
@@ -0,0 +1,68 @@
+#ifndef _IPXE_UMALLOC_H
+#define _IPXE_UMALLOC_H
+
+/**
+ * @file
+ *
+ * User memory allocation
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <ipxe/api.h>
+#include <config/umalloc.h>
+#include <ipxe/uaccess.h>
+
+/**
+ * Provide a user memory allocation API implementation
+ *
+ * @v _prefix		Subsystem prefix
+ * @v _api_func		API function
+ * @v _func		Implementing function
+ */
+#define PROVIDE_UMALLOC( _subsys, _api_func, _func ) \
+	PROVIDE_SINGLE_API ( UMALLOC_PREFIX_ ## _subsys, _api_func, _func )
+
+/* Include all architecture-independent I/O API headers */
+#include <ipxe/efi/efi_umalloc.h>
+
+/* Include all architecture-dependent I/O API headers */
+#include <bits/umalloc.h>
+
+/**
+ * Reallocate external memory
+ *
+ * @v userptr		Memory previously allocated by umalloc(), or UNULL
+ * @v new_size		Requested size
+ * @ret userptr		Allocated memory, or UNULL
+ *
+ * Calling realloc() with a new size of zero is a valid way to free a
+ * memory block.
+ */
+userptr_t urealloc ( userptr_t userptr, size_t new_size );
+
+/**
+ * Allocate external memory
+ *
+ * @v size		Requested size
+ * @ret userptr		Memory, or UNULL
+ *
+ * Memory is guaranteed to be aligned to a page boundary.
+ */
+static inline __always_inline userptr_t umalloc ( size_t size ) {
+	return urealloc ( UNULL, size );
+}
+
+/**
+ * Free external memory
+ *
+ * @v userptr		Memory allocated by umalloc(), or UNULL
+ *
+ * If @c ptr is UNULL, no action is taken.
+ */
+static inline __always_inline void ufree ( userptr_t userptr ) {
+	urealloc ( userptr, 0 );
+}
+
+#endif /* _IPXE_UMALLOC_H */
diff --git a/src/include/ipxe/uri.h b/src/include/ipxe/uri.h
new file mode 100644
index 0000000..cb0898e
--- /dev/null
+++ b/src/include/ipxe/uri.h
@@ -0,0 +1,182 @@
+#ifndef _IPXE_URI_H
+#define _IPXE_URI_H
+
+/** @file
+ *
+ * Uniform Resource Identifiers
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <ipxe/refcnt.h>
+
+/** A Uniform Resource Identifier
+ *
+ * Terminology for this data structure is as per uri(7), except that
+ * "path" is defined to include the leading '/' for an absolute path.
+ *
+ * Note that all fields within a URI are optional and may be NULL.
+ *
+ * The pointers to the various fields are packed together so they can
+ * be accessed in array fashion in some places in uri.c where doing so
+ * saves significant code size.
+ *
+ * Some examples are probably helpful:
+ *
+ *   http://www.ipxe.org/wiki :
+ *
+ *   scheme = "http", host = "www.ipxe.org", path = "/wiki"
+ *
+ *   /var/lib/tftpboot :
+ *
+ *   path = "/var/lib/tftpboot"
+ *
+ *   mailto:bob@nowhere.com :
+ *
+ *   scheme = "mailto", opaque = "bob@nowhere.com"
+ *
+ *   ftp://joe:secret@insecure.org:8081/hidden/path/to?what=is#this
+ *
+ *   scheme = "ftp", user = "joe", password = "secret",
+ *   host = "insecure.org", port = "8081", path = "/hidden/path/to",
+ *   query = "what=is", fragment = "this"
+ */
+struct uri {
+	/** Reference count */
+	struct refcnt refcnt;
+	/** Scheme */
+	const char *scheme;
+	/** Opaque part */
+	const char *opaque;
+	/** User name */
+	const char *user;
+	/** Password */
+	const char *password;
+	/** Host name */
+	const char *host;
+	/** Port number */
+	const char *port;
+	/** Path */
+	const char *path;
+	/** Query */
+	const char *query;
+	/** Fragment */
+	const char *fragment;
+} __attribute__ (( packed ));
+
+/** A field in a URI
+ *
+ * The order of the indices in this enumeration must match the order
+ * of the fields in the URI structure.
+ */
+enum {
+	URI_SCHEME = 0,		URI_SCHEME_BIT = ( 1 << URI_SCHEME ),
+	URI_OPAQUE = 1,		URI_OPAQUE_BIT = ( 1 << URI_OPAQUE ),
+	URI_USER = 2,		URI_USER_BIT = ( 1 << URI_USER ),
+	URI_PASSWORD = 3,	URI_PASSWORD_BIT = ( 1 << URI_PASSWORD ),
+	URI_HOST = 4,		URI_HOST_BIT = ( 1 << URI_HOST ),
+	URI_PORT = 5,		URI_PORT_BIT = ( 1 << URI_PORT ),
+	URI_PATH = 6,		URI_PATH_BIT = ( 1 << URI_PATH ),
+	URI_QUERY = 7,		URI_QUERY_BIT = ( 1 << URI_QUERY ),
+	URI_FRAGMENT = 8,	URI_FRAGMENT_BIT = ( 1 << URI_FRAGMENT ),
+
+	URI_FIRST_FIELD = URI_SCHEME,
+	URI_LAST_FIELD = URI_FRAGMENT,
+};
+
+/** Extract field from URI */
+#define uri_get_field( uri, field )	(&uri->scheme)[field]
+
+/** All URI fields */
+#define URI_ALL		( URI_SCHEME_BIT | URI_OPAQUE_BIT | URI_USER_BIT | \
+			  URI_PASSWORD_BIT | URI_HOST_BIT | URI_PORT_BIT | \
+			  URI_PATH_BIT | URI_QUERY_BIT | URI_FRAGMENT_BIT )
+
+/** URI fields that should be decoded on storage */
+#define URI_ENCODED	( URI_USER_BIT | URI_PASSWORD_BIT | URI_HOST_BIT | \
+			  URI_PATH_BIT | URI_QUERY_BIT | URI_FRAGMENT_BIT )
+
+/**
+ * URI is an absolute URI
+ *
+ * @v uri			URI
+ * @ret is_absolute		URI is absolute
+ *
+ * An absolute URI begins with a scheme, e.g. "http:" or "mailto:".
+ * Note that this is a separate concept from a URI with an absolute
+ * path.
+ */
+static inline int uri_is_absolute ( struct uri *uri ) {
+	return ( uri->scheme != NULL );
+}
+
+/**
+ * URI has an absolute path
+ *
+ * @v uri			URI
+ * @ret has_absolute_path	URI has an absolute path
+ *
+ * An absolute path begins with a '/'.  Note that this is a separate
+ * concept from an absolute URI.  Note also that a URI may not have a
+ * path at all.
+ */
+static inline int uri_has_absolute_path ( struct uri *uri ) {
+	return ( uri->path && ( uri->path[0] == '/' ) );
+}
+
+/**
+ * URI has a relative path
+ *
+ * @v uri			URI
+ * @ret has_relative_path	URI has a relative path
+ *
+ * A relative path begins with something other than a '/'.  Note that
+ * this is a separate concept from a relative URI.  Note also that a
+ * URI may not have a path at all.
+ */
+static inline int uri_has_relative_path ( struct uri *uri ) {
+	return ( uri->path && ( uri->path[0] != '/' ) );
+}
+
+/**
+ * Increment URI reference count
+ *
+ * @v uri		URI, or NULL
+ * @ret uri		URI as passed in
+ */
+static inline __attribute__ (( always_inline )) struct uri *
+uri_get ( struct uri *uri ) {
+	ref_get ( &uri->refcnt );
+	return uri;
+}
+
+/**
+ * Decrement URI reference count
+ *
+ * @v uri		URI, or NULL
+ */
+static inline __attribute__ (( always_inline )) void
+uri_put ( struct uri *uri ) {
+	ref_put ( &uri->refcnt );
+}
+
+extern struct uri *cwuri;
+
+extern struct uri * parse_uri ( const char *uri_string );
+extern unsigned int uri_port ( struct uri *uri, unsigned int default_port );
+extern int unparse_uri ( char *buf, size_t size, struct uri *uri,
+			 unsigned int fields );
+extern struct uri * uri_dup ( struct uri *uri );
+extern char * resolve_path ( const char *base_path,
+			     const char *relative_path );
+extern struct uri * resolve_uri ( struct uri *base_uri,
+				  struct uri *relative_uri );
+extern void churi ( struct uri *uri );
+extern size_t uri_encode ( const char *raw_string, char *buf, ssize_t len,
+			   int field );
+extern size_t uri_decode ( const char *encoded_string, char *buf, ssize_t len );
+
+#endif /* _IPXE_URI_H */
diff --git a/src/include/ipxe/uuid.h b/src/include/ipxe/uuid.h
new file mode 100644
index 0000000..2f3c224
--- /dev/null
+++ b/src/include/ipxe/uuid.h
@@ -0,0 +1,33 @@
+#ifndef _IPXE_UUID_H
+#define _IPXE_UUID_H
+
+/** @file
+ *
+ * Universally unique IDs
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+/** A universally unique ID */
+union uuid {
+	/** Canonical form (00000000-0000-0000-0000-000000000000) */
+	struct {
+		/** 8 hex digits, big-endian */
+		uint32_t a;
+		/** 2 hex digits, big-endian */
+		uint16_t b;
+		/** 2 hex digits, big-endian */
+		uint16_t c;
+		/** 2 hex digits, big-endian */
+		uint16_t d;
+		/** 12 hex digits, big-endian */
+		uint8_t e[6];
+	} canonical;
+	uint8_t raw[16];
+};
+
+extern char * uuid_ntoa ( union uuid *uuid );
+
+#endif /* _IPXE_UUID_H */
diff --git a/src/include/ipxe/virtio-pci.h b/src/include/ipxe/virtio-pci.h
new file mode 100644
index 0000000..f0c17e8
--- /dev/null
+++ b/src/include/ipxe/virtio-pci.h
@@ -0,0 +1,97 @@
+#ifndef _VIRTIO_PCI_H_
+# define _VIRTIO_PCI_H_
+
+/* A 32-bit r/o bitmask of the features supported by the host */
+#define VIRTIO_PCI_HOST_FEATURES        0
+
+/* A 32-bit r/w bitmask of features activated by the guest */
+#define VIRTIO_PCI_GUEST_FEATURES       4
+
+/* A 32-bit r/w PFN for the currently selected queue */
+#define VIRTIO_PCI_QUEUE_PFN            8
+
+/* A 16-bit r/o queue size for the currently selected queue */
+#define VIRTIO_PCI_QUEUE_NUM            12
+
+/* A 16-bit r/w queue selector */
+#define VIRTIO_PCI_QUEUE_SEL            14
+
+/* A 16-bit r/w queue notifier */
+#define VIRTIO_PCI_QUEUE_NOTIFY         16
+
+/* An 8-bit device status register.  */
+#define VIRTIO_PCI_STATUS               18
+
+/* An 8-bit r/o interrupt status register.  Reading the value will return the
+ * current contents of the ISR and will also clear it.  This is effectively
+ * a read-and-acknowledge. */
+#define VIRTIO_PCI_ISR                  19
+
+/* The bit of the ISR which indicates a device configuration change. */
+#define VIRTIO_PCI_ISR_CONFIG           0x2
+
+/* The remaining space is defined by each driver as the per-driver
+ * configuration space */
+#define VIRTIO_PCI_CONFIG               20
+
+/* Virtio ABI version, this must match exactly */
+#define VIRTIO_PCI_ABI_VERSION          0
+
+static inline u32 vp_get_features(unsigned int ioaddr)
+{
+   return inl(ioaddr + VIRTIO_PCI_HOST_FEATURES);
+}
+
+static inline void vp_set_features(unsigned int ioaddr, u32 features)
+{
+        outl(features, ioaddr + VIRTIO_PCI_GUEST_FEATURES);
+}
+
+static inline void vp_get(unsigned int ioaddr, unsigned offset,
+                     void *buf, unsigned len)
+{
+   u8 *ptr = buf;
+   unsigned i;
+
+   for (i = 0; i < len; i++)
+           ptr[i] = inb(ioaddr + VIRTIO_PCI_CONFIG + offset + i);
+}
+
+static inline u8 vp_get_status(unsigned int ioaddr)
+{
+   return inb(ioaddr + VIRTIO_PCI_STATUS);
+}
+
+static inline void vp_set_status(unsigned int ioaddr, u8 status)
+{
+   if (status == 0)        /* reset */
+           return;
+   outb(status, ioaddr + VIRTIO_PCI_STATUS);
+}
+
+
+static inline void vp_reset(unsigned int ioaddr)
+{
+   outb(0, ioaddr + VIRTIO_PCI_STATUS);
+   (void)inb(ioaddr + VIRTIO_PCI_ISR);
+}
+
+static inline void vp_notify(unsigned int ioaddr, int queue_index)
+{
+   outw(queue_index, ioaddr + VIRTIO_PCI_QUEUE_NOTIFY);
+}
+
+static inline void vp_del_vq(unsigned int ioaddr, int queue_index)
+{
+   /* select the queue */
+
+   outw(queue_index, ioaddr + VIRTIO_PCI_QUEUE_SEL);
+
+   /* deactivate the queue */
+
+   outl(0, ioaddr + VIRTIO_PCI_QUEUE_PFN);
+}
+
+int vp_find_vq(unsigned int ioaddr, int queue_index,
+               struct vring_virtqueue *vq);
+#endif /* _VIRTIO_PCI_H_ */
diff --git a/src/include/ipxe/virtio-ring.h b/src/include/ipxe/virtio-ring.h
new file mode 100644
index 0000000..e96dd37
--- /dev/null
+++ b/src/include/ipxe/virtio-ring.h
@@ -0,0 +1,142 @@
+#ifndef _VIRTIO_RING_H_
+# define _VIRTIO_RING_H_
+#define PAGE_SHIFT (12)
+#define PAGE_SIZE  (1<<PAGE_SHIFT)
+#define PAGE_MASK  (PAGE_SIZE-1)
+
+/* Status byte for guest to report progress, and synchronize features. */
+/* We have seen device and processed generic fields (VIRTIO_CONFIG_F_VIRTIO) */
+#define VIRTIO_CONFIG_S_ACKNOWLEDGE     1
+/* We have found a driver for the device. */
+#define VIRTIO_CONFIG_S_DRIVER          2
+/* Driver has used its parts of the config, and is happy */
+#define VIRTIO_CONFIG_S_DRIVER_OK       4
+/* We've given up on this device. */
+#define VIRTIO_CONFIG_S_FAILED          0x80
+
+#define MAX_QUEUE_NUM      (512)
+
+#define VRING_DESC_F_NEXT  1
+#define VRING_DESC_F_WRITE 2
+
+#define VRING_AVAIL_F_NO_INTERRUPT 1
+
+#define VRING_USED_F_NO_NOTIFY     1
+
+struct vring_desc
+{
+   u64 addr;
+   u32 len;
+   u16 flags;
+   u16 next;
+};
+
+struct vring_avail
+{
+   u16 flags;
+   u16 idx;
+   u16 ring[0];
+};
+
+struct vring_used_elem
+{
+   u32 id;
+   u32 len;
+};
+
+struct vring_used
+{
+   u16 flags;
+   u16 idx;
+   struct vring_used_elem ring[];
+};
+
+struct vring {
+   unsigned int num;
+   struct vring_desc *desc;
+   struct vring_avail *avail;
+   struct vring_used *used;
+};
+
+#define vring_size(num) \
+   (((((sizeof(struct vring_desc) * num) + \
+      (sizeof(struct vring_avail) + sizeof(u16) * num)) \
+         + PAGE_MASK) & ~PAGE_MASK) + \
+         (sizeof(struct vring_used) + sizeof(struct vring_used_elem) * num))
+
+typedef unsigned char virtio_queue_t[PAGE_MASK + vring_size(MAX_QUEUE_NUM)];
+
+struct vring_virtqueue {
+   virtio_queue_t queue;
+   struct vring vring;
+   u16 free_head;
+   u16 last_used_idx;
+   u16 vdata[MAX_QUEUE_NUM];
+   /* PCI */
+   int queue_index;
+};
+
+struct vring_list {
+  char *addr;
+  unsigned int length;
+};
+
+static inline void vring_init(struct vring *vr,
+                         unsigned int num, unsigned char *queue)
+{
+   unsigned int i;
+   unsigned long pa;
+
+        vr->num = num;
+
+   /* physical address of desc must be page aligned */
+
+   pa = virt_to_phys(queue);
+   pa = (pa + PAGE_MASK) & ~PAGE_MASK;
+   vr->desc = phys_to_virt(pa);
+
+        vr->avail = (struct vring_avail *)&vr->desc[num];
+
+   /* physical address of used must be page aligned */
+
+   pa = virt_to_phys(&vr->avail->ring[num]);
+   pa = (pa + PAGE_MASK) & ~PAGE_MASK;
+        vr->used = phys_to_virt(pa);
+
+   for (i = 0; i < num - 1; i++)
+           vr->desc[i].next = i + 1;
+   vr->desc[i].next = 0;
+}
+
+static inline void vring_enable_cb(struct vring_virtqueue *vq)
+{
+   vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+}
+
+static inline void vring_disable_cb(struct vring_virtqueue *vq)
+{
+   vq->vring.avail->flags |= VRING_AVAIL_F_NO_INTERRUPT;
+}
+
+
+/*
+ * vring_more_used
+ *
+ * is there some used buffers ?
+ *
+ */
+
+static inline int vring_more_used(struct vring_virtqueue *vq)
+{
+   wmb();
+   return vq->last_used_idx != vq->vring.used->idx;
+}
+
+void vring_detach(struct vring_virtqueue *vq, unsigned int head);
+int vring_get_buf(struct vring_virtqueue *vq, unsigned int *len);
+void vring_add_buf(struct vring_virtqueue *vq, struct vring_list list[],
+                   unsigned int out, unsigned int in,
+                   int index, int num_added);
+void vring_kick(unsigned int ioaddr, struct vring_virtqueue *vq, int num_added);
+
+#endif /* _VIRTIO_RING_H_ */
diff --git a/src/include/ipxe/vsprintf.h b/src/include/ipxe/vsprintf.h
new file mode 100644
index 0000000..c48c97a
--- /dev/null
+++ b/src/include/ipxe/vsprintf.h
@@ -0,0 +1,74 @@
+#ifndef _IPXE_VSPRINTF_H
+#define _IPXE_VSPRINTF_H
+
+/** @file
+ *
+ * printf() and friends
+ *
+ * Etherboot's printf() functions understand the following subset of
+ * the standard C printf()'s format specifiers:
+ *
+ *	- Flag characters
+ *		- '#'		- Alternate form (i.e. "0x" prefix)
+ *		- '0'		- Zero-pad
+ *	- Field widths
+ *	- Length modifiers
+ *		- 'hh'		- Signed / unsigned char
+ *		- 'h'		- Signed / unsigned short
+ *		- 'l'		- Signed / unsigned long
+ *		- 'll'		- Signed / unsigned long long
+ *		- 'z'		- Signed / unsigned size_t
+ *	- Conversion specifiers
+ *		- 'd'		- Signed decimal
+ *		- 'x','X'	- Unsigned hexadecimal
+ *		- 'c'		- Character
+ *		- 's'		- String
+ *		- 'p'		- Pointer
+ *
+ * Hexadecimal numbers are always zero-padded to the specified field
+ * width (if any); decimal numbers are always space-padded.  Decimal
+ * long longs are not supported.
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+#include <stdarg.h>
+#include <stdio.h>
+
+/**
+ * A printf context
+ *
+ * Contexts are used in order to be able to share code between
+ * vprintf() and vsnprintf(), without requiring the allocation of a
+ * buffer for vprintf().
+ */
+struct printf_context {
+	/**
+	 * Character handler
+	 *
+	 * @v ctx	Context
+	 * @v c		Character
+	 *
+	 * This method is called for each character written to the
+	 * formatted string.
+	 */
+	void ( * handler ) ( struct printf_context *ctx, unsigned int c );
+	/** Length of formatted string
+	 *
+	 * When handler() is called, @len will be set to the number of
+	 * characters written so far (i.e. zero for the first call to
+	 * handler()).
+	 */
+	size_t len;
+};
+
+extern size_t vcprintf ( struct printf_context *ctx, const char *fmt,
+			 va_list args );
+extern int vssnprintf ( char *buf, ssize_t ssize, const char *fmt,
+			va_list args );
+extern int __attribute__ (( format ( printf, 3, 4 ) ))
+ssnprintf ( char *buf, ssize_t ssize, const char *fmt, ... );
+
+#endif /* _IPXE_VSPRINTF_H */
diff --git a/src/include/ipxe/wpa.h b/src/include/ipxe/wpa.h
new file mode 100644
index 0000000..2934228
--- /dev/null
+++ b/src/include/ipxe/wpa.h
@@ -0,0 +1,503 @@
+/*
+ * Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _IPXE_WPA_H
+#define _IPXE_WPA_H
+
+#include <ipxe/ieee80211.h>
+#include <ipxe/list.h>
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+/** @file
+ *
+ * Common definitions for all types of WPA-protected networks.
+ */
+
+
+/** EAPOL-Key type field for modern 802.11i/RSN WPA packets */
+#define EAPOL_KEY_TYPE_RSN	2
+
+/** Old EAPOL-Key type field used by WPA1 hardware before 802.11i ratified */
+#define EAPOL_KEY_TYPE_WPA	254
+
+
+/**
+ * @defgroup eapol_key_info EAPOL-Key Info field bits
+ * @{
+ */
+
+/** Key descriptor version, indicating WPA or WPA2 */
+#define EAPOL_KEY_INFO_VERSION	0x0007
+
+/** Key type bit, indicating pairwise or group */
+#define EAPOL_KEY_INFO_TYPE	0x0008
+
+/** Key install bit; set on message 3 except when legacy hacks are used */
+#define EAPOL_KEY_INFO_INSTALL	0x0040
+
+/** Key ACK bit; set when a response is required, on all messages except #4 */
+#define EAPOL_KEY_INFO_KEY_ACK	0x0080
+
+/** Key MIC bit; set when the MIC field is valid, on messages 3 and 4 */
+#define EAPOL_KEY_INFO_KEY_MIC	0x0100
+
+/** Secure bit; set when both sides have both keys, on messages 3 and 4 */
+#define EAPOL_KEY_INFO_SECURE	0x0200
+
+/** Error bit; set on a MIC failure for TKIP */
+#define EAPOL_KEY_INFO_ERROR	0x0400
+
+/** Request bit; set when authentication is initiated by the Peer (unusual) */
+#define EAPOL_KEY_INFO_REQUEST	0x0800
+
+/** Key Encrypted bit; set when the Key Data field is encrypted */
+#define EAPOL_KEY_INFO_KEY_ENC	0x1000
+
+/** SMC Message bit; set when this frame is part of an IBSS SMK handshake */
+#define EAPOL_KEY_INFO_SMC_MESS	0x2000
+
+
+/** Key descriptor version field value for WPA (TKIP) */
+#define EAPOL_KEY_VERSION_WPA	1
+
+/** Key descriptor version field value for WPA2 (CCMP) */
+#define EAPOL_KEY_VERSION_WPA2	2
+
+/** Key type field value for a PTK (pairwise) key handshake */
+#define EAPOL_KEY_TYPE_PTK	0x0008
+
+/** Key type field value for a GTK (group) key handshake */
+#define EAPOL_KEY_TYPE_GTK	0x0000
+
+/** @} */
+
+
+
+/** An EAPOL-Key packet.
+ *
+ * These are used for the WPA 4-Way Handshake, whether or not prior
+ * authentication has been performed using EAP.
+ *
+ * On LANs, an eapol_key_pkt is always encapsulated in the data field
+ * of an eapol_frame, with the frame's type code set to EAPOL_TYPE_KEY.
+ *
+ * Unlike 802.11 frame headers, the fields in this structure are
+ * stored in big-endian!
+ */
+struct eapol_key_pkt
+{
+	/** One of the EAPOL_KEY_TYPE_* defines. */
+	u8 type;
+
+	/** Bitfield of key characteristics, network byte order */
+	u16 info;
+
+	/** Length of encryption key to be used, network byte order
+	 *
+	 * This is 16 for CCMP, 32 for TKIP, and 5 or 13 for WEP.
+	 */
+	u16 keysize;
+
+	/** Monotonically increasing value for EAPOL-Key conversations
+	 *
+	 * In another classic demonstration of overengineering, this
+	 * 8-byte value will rarely be anything above 1. It's stored
+	 * in network byte order.
+	 */
+	u64 replay;
+
+	/** Nonce value
+	 *
+	 * This is the authenticator's ANonce in frame 1, the peer's
+	 * SNonce in frame 2, and 0 in frames 3 and 4.
+	 */
+	u8 nonce[32];
+
+	/** Initialization vector
+	 *
+	 * This contains the IV used with the Key Encryption Key, or 0
+	 * if the key is unencrypted or encrypted using an algorithm
+	 * that does not require an IV.
+	 */
+	u8 iv[16];
+
+	/** Receive sequence counter for GTK
+	 *
+	 * This is used to synchronize the client's replay counter for
+	 * ordinary data packets. The first six bytes contain PN0
+	 * through PN5 for CCMP mode, or TSC0 through TSC5 for TKIP
+	 * mode. The last two bytes are zero.
+	 */
+	u8 rsc[8];
+
+	/** Reserved bytes */
+	u8 _reserved[8];
+
+	/** Message integrity code over the entire EAPOL frame
+	 *
+	 * This is calculated using HMAC-MD5 when the key descriptor
+	 * version field in @a info is 1, and HMAC-SHA1 ignoring the
+	 * last 4 bytes of the hash when the version field in @a info
+	 * is 2.
+	 */
+	u8 mic[16];
+
+	/** Length of the @a data field in bytes, network byte order */
+	u16 datalen;
+
+	/** Key data
+	 *
+	 * This is formatted as a series of 802.11 information
+	 * elements, with cryptographic data encapsulated using a
+	 * "vendor-specific IE" code and an IEEE-specified OUI.
+	 */
+	u8 data[0];
+} __attribute__ (( packed ));
+
+
+/** WPA handshaking state */
+enum wpa_state {
+	/** Waiting for PMK to be set */
+	WPA_WAITING = 0,
+
+	/** Ready for 4-Way Handshake */
+	WPA_READY,
+
+	/** Performing 4-Way Handshake */
+	WPA_WORKING,
+
+	/** 4-Way Handshake succeeded */
+	WPA_SUCCESS,
+
+	/** 4-Way Handshake failed */
+	WPA_FAILURE,
+};
+
+/** Bitfield indicating a selection of WPA transient keys */
+enum wpa_keymask {
+	/** Pairwise transient key */
+	WPA_PTK = 1,
+
+	/** Group transient key */
+	WPA_GTK = 2,
+};
+
+
+/** Length of a nonce */
+#define WPA_NONCE_LEN		32
+
+/** Length of a TKIP main key */
+#define WPA_TKIP_KEY_LEN	16
+
+/** Length of a TKIP MIC key */
+#define WPA_TKIP_MIC_KEY_LEN	8
+
+/** Length of a CCMP key */
+#define WPA_CCMP_KEY_LEN	16
+
+/** Length of an EAPOL Key Confirmation Key */
+#define WPA_KCK_LEN		16
+
+/** Length of an EAPOL Key Encryption Key */
+#define WPA_KEK_LEN		16
+
+/** Usual length of a Pairwise Master Key */
+#define WPA_PMK_LEN		32
+
+/** Length of a PMKID */
+#define WPA_PMKID_LEN		16
+
+
+/** Structure of the Temporal Key for TKIP encryption */
+struct tkip_tk
+{
+	/** Main key: input to TKIP Phase 1 and Phase 2 key mixing functions */
+	u8 key[WPA_TKIP_KEY_LEN];
+
+	/** Michael MIC keys */
+	struct {
+		/** MIC key for packets from the AP */
+		u8 rx[WPA_TKIP_MIC_KEY_LEN];
+
+		/** MIC key for packets to the AP */
+		u8 tx[WPA_TKIP_MIC_KEY_LEN];
+	} __attribute__ (( packed )) mic;
+} __attribute__ (( packed ));
+
+/** Structure of a generic Temporal Key */
+union wpa_tk
+{
+	/** CCMP key */
+	u8 ccmp[WPA_CCMP_KEY_LEN];
+
+	/** TKIP keys */
+	struct tkip_tk tkip;
+};
+
+/** Structure of the Pairwise Transient Key */
+struct wpa_ptk
+{
+	/** EAPOL-Key Key Confirmation Key (KCK) */
+	u8 kck[WPA_KCK_LEN];
+
+	/** EAPOL-Key Key Encryption Key (KEK) */
+	u8 kek[WPA_KEK_LEN];
+
+	/** Temporal key */
+	union wpa_tk tk;
+} __attribute__ (( packed ));
+
+/** Structure of the Group Transient Key */
+struct wpa_gtk
+{
+	/** Temporal key */
+	union wpa_tk tk;
+} __attribute__ (( packed ));
+
+
+/** Common context for WPA security handshaking
+ *
+ * Any implementor of a particular handshaking type (e.g. PSK or EAP)
+ * must include this structure at the very beginning of their private
+ * data context structure, to allow the EAPOL-Key handling code to
+ * work. When the preliminary authentication is done, it is necessary
+ * to call wpa_start(), passing the PMK (derived from PSK or EAP MSK)
+ * as an argument. The handshaker can use its @a step function to
+ * monitor @a state in this wpa_ctx structure for success or
+ * failure. On success, the keys will be available in @a ptk and @a
+ * gtk according to the state of the @a valid bitmask.
+ *
+ * After an initial success, the parent handshaker does not need to
+ * concern itself with rekeying; the WPA common code takes care of
+ * that.
+ */
+struct wpa_common_ctx
+{
+	/** 802.11 device we are authenticating for */
+	struct net80211_device *dev;
+
+	/** The Pairwise Master Key to use in handshaking
+	 *
+	 * This is set either by running the PBKDF2 algorithm on a
+	 * passphrase with the SSID as salt to generate a pre-shared
+	 * key, or by copying the first 32 bytes of the EAP Master
+	 * Session Key in 802.1X-served authentication.
+	 */
+	u8 pmk[WPA_PMK_LEN];
+
+	/** Length of the Pairwise Master Key
+	 *
+	 * This is always 32 except with one EAP method which only
+	 * gives 16 bytes.
+	 */
+	int pmk_len;
+
+	/** State of EAPOL-Key handshaking */
+	enum wpa_state state;
+
+	/** Replay counter for this association
+	 *
+	 * This stores the replay counter value for the most recent
+	 * packet we've accepted. It is initially initialised to ~0 to
+	 * show we'll accept anything.
+	 */
+	u64 replay;
+
+	/** Mask of valid keys after authentication success
+	 *
+	 * If the PTK is not valid, the GTK should be used for both
+	 * unicast and multicast decryption; if the GTK is not valid,
+	 * multicast packets cannot be decrypted.
+	 */
+	enum wpa_keymask valid;
+
+	/** The cipher to use for unicast RX and all TX */
+	enum net80211_crypto_alg crypt;
+
+	/** The cipher to use for broadcast and multicast RX */
+	enum net80211_crypto_alg gcrypt;
+
+	/** The Pairwise Transient Key derived from the handshake */
+	struct wpa_ptk ptk;
+
+	/** The Group Transient Key derived from the handshake */
+	struct wpa_gtk gtk;
+
+	/** Authenticator-provided nonce */
+	u8 Anonce[WPA_NONCE_LEN];
+
+	/** Supplicant-generated nonce (that's us) */
+	u8 Snonce[WPA_NONCE_LEN];
+
+	/** Whether we should refrain from generating another SNonce */
+	int have_Snonce;
+
+	/** Data in WPA or RSN IE from AP's beacon frame */
+	void *ap_rsn_ie;
+
+	/** Length of @a ap_rsn_ie */
+	int ap_rsn_ie_len;
+
+	/** Whether @a ap_rsn_ie is an RSN IE (as opposed to old WPA) */
+	int ap_rsn_is_rsn;
+
+	/** List entry */
+	struct list_head list;
+};
+
+
+/** WPA handshake key integrity and encryption handler
+ *
+ * Note that due to the structure of the 4-Way Handshake we never
+ * actually need to encrypt key data, only decrypt it.
+ */
+struct wpa_kie {
+	/** Value of version bits in EAPOL-Key info field for which to use
+	 *
+	 * This should be one of the @c EAPOL_KEY_VERSION_* constants.
+	 */
+	int version;
+
+	/** Calculate MIC over message
+	 *
+	 * @v kck	Key Confirmation Key, 16 bytes
+	 * @v msg	Message to calculate MIC over
+	 * @v len	Number of bytes to calculate MIC over
+	 * @ret mic	Calculated MIC, 16 bytes long
+	 *
+	 * The @a mic return may point within @a msg, so it must not
+	 * be filled until the calculation has been performed.
+	 */
+	void ( * mic ) ( const void *kck, const void *msg, size_t len,
+			 void *mic );
+
+	/** Decrypt key data
+	 *
+	 * @v kek	Key Encryption Key, 16 bytes
+	 * @v iv	Initialisation vector for encryption, 16 bytes
+	 * @v msg	Message to decrypt (Key Data field)
+	 * @v len	Length of message
+	 * @ret msg	Decrypted message in place of original
+	 * @ret len	Updated to reflect encrypted length
+	 * @ret rc	Return status code
+	 *
+	 * The decrypted message is written over the encrypted one.
+	 */
+	int ( * decrypt ) ( const void *kek, const void *iv, void *msg,
+			    u16 *len );
+};
+
+#define WPA_KIES	__table ( struct wpa_kie, "wpa_kies" )
+#define __wpa_kie	__table_entry ( WPA_KIES, 01 )
+
+
+
+/**
+ * @defgroup wpa_kde Key descriptor element types
+ * @{
+ */
+
+/** Payload structure of the GTK-encapsulating KDE
+ *
+ * This does not include the IE type, length, or OUI bytes, which are
+ * generic to all KDEs.
+ */
+struct wpa_kde_gtk_encap
+{
+	/** Key ID and TX bit */
+	u8 id;
+
+	/** Reserved byte */
+	u8 _rsvd;
+
+	/** Encapsulated group transient key */
+	struct wpa_gtk gtk;
+} __attribute__ (( packed ));
+
+/** Mask for Key ID in wpa_kde_gtk::id field */
+#define WPA_GTK_KID	0x03
+
+/** Mask for Tx bit in wpa_kde_gtk::id field */
+#define WPA_GTK_TXBIT	0x04
+
+
+/** KDE type for an encapsulated Group Transient Key (requires encryption) */
+#define WPA_KDE_GTK	_MKOUI ( 0x00, 0x0F, 0xAC, 0x01 )
+
+/** KDE type for a MAC address */
+#define WPA_KDE_MAC	_MKOUI ( 0x00, 0x0F, 0xAC, 0x03 )
+
+/** KDE type for a PMKID */
+#define WPA_KDE_PMKID	_MKOUI ( 0x00, 0x0F, 0xAC, 0x04 )
+
+/** KDE type for a nonce */
+#define WPA_KDE_NONCE	_MKOUI ( 0x00, 0x0F, 0xAC, 0x06 )
+
+/** KDE type for a lifetime value */
+#define WPA_KDE_LIFETIME _MKOUI ( 0x00, 0x0F, 0xAC, 0x07 )
+
+
+/** Any key descriptor element type
+ *
+ * KDEs follow the 802.11 information element format of a type byte
+ * (in this case "vendor-specific", with the requisite OUI+subtype
+ * after length) and a length byte whose value does not include the
+ * length of the type and length bytes.
+ */
+struct wpa_kde
+{
+	/** Information element type: always 0xDD (IEEE80211_IE_VENDOR) */
+	u8 ie_type;
+
+	/** Length, not including ie_type and length fields */
+	u8 len;
+
+	/** OUI + type byte */
+	u32 oui_type;
+
+	/** Payload data */
+	union {
+		/** For GTK-type KDEs, encapsulated GTK */
+		struct wpa_kde_gtk_encap gtk_encap;
+
+		/** For MAC-type KDEs, the MAC address */
+		u8 mac[ETH_ALEN];
+
+		/** For PMKID-type KDEs, the PMKID */
+		u8 pmkid[WPA_PMKID_LEN];
+
+		/** For Nonce-type KDEs, the nonce */
+		u8 nonce[WPA_NONCE_LEN];
+
+		/** For Lifetime-type KDEs, the lifetime in seconds
+		 *
+		 * This is in network byte order!
+		 */
+		u32 lifetime;
+	};
+} __attribute__ (( packed ));
+
+/** @} */
+
+int wpa_make_rsn_ie ( struct net80211_device *dev, union ieee80211_ie **ie );
+int wpa_start ( struct net80211_device *dev, struct wpa_common_ctx *ctx,
+		const void *pmk, size_t pmk_len );
+void wpa_stop ( struct net80211_device *dev );
+
+#endif /* _IPXE_WPA_H */
diff --git a/src/include/ipxe/x509.h b/src/include/ipxe/x509.h
new file mode 100644
index 0000000..37c5a4e
--- /dev/null
+++ b/src/include/ipxe/x509.h
@@ -0,0 +1,41 @@
+#ifndef _IPXE_X509_H
+#define _IPXE_X509_H
+
+/** @file
+ *
+ * X.509 certificates
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stdint.h>
+
+struct asn1_cursor;
+
+/** An X.509 RSA public key */
+struct x509_rsa_public_key {
+	/** Modulus */
+	uint8_t *modulus;
+	/** Modulus length */
+	size_t modulus_len;
+	/** Exponent */
+	uint8_t *exponent;
+	/** Exponent length */
+	size_t exponent_len;
+};
+
+/**
+ * Free X.509 RSA public key
+ *
+ * @v rsa_pubkey	RSA public key
+ */
+static inline void
+x509_free_rsa_public_key ( struct x509_rsa_public_key *rsa_pubkey ) {
+	free ( rsa_pubkey->modulus );
+}
+
+extern int x509_rsa_public_key ( const struct asn1_cursor *certificate,
+				 struct x509_rsa_public_key *rsa_pubkey );
+
+#endif /* _IPXE_X509_H */
diff --git a/src/include/ipxe/xfer.h b/src/include/ipxe/xfer.h
new file mode 100644
index 0000000..ad41e93
--- /dev/null
+++ b/src/include/ipxe/xfer.h
@@ -0,0 +1,277 @@
+#ifndef _IPXE_XFER_H
+#define _IPXE_XFER_H
+
+/** @file
+ *
+ * Data transfer interfaces
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <stddef.h>
+#include <stdarg.h>
+#include <ipxe/interface.h>
+#include <ipxe/iobuf.h>
+
+struct xfer_interface;
+struct xfer_metadata;
+
+/** Data transfer interface operations */
+struct xfer_interface_operations {
+	/** Close interface
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v rc		Reason for close
+	 */
+	void ( * close ) ( struct xfer_interface *xfer, int rc );
+	/** Redirect to new location
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v type		New location type
+	 * @v args		Remaining arguments depend upon location type
+	 * @ret rc		Return status code
+	 */
+	int ( * vredirect ) ( struct xfer_interface *xfer, int type,
+			      va_list args );
+	/** Check flow control window
+	 *
+	 * @v xfer		Data transfer interface
+	 * @ret len		Length of window
+	 *
+	 * Flow control is regarded as advisory but not mandatory.
+	 * Users who have control over their own rate of data
+	 * generation should perform a flow control check before
+	 * generating new data.  Users who have no control (such as
+	 * NIC drivers or filter layers) are not obliged to check.
+	 *
+	 * Data transfer interfaces must be prepared to accept
+	 * datagrams even if they are advertising a window of zero
+	 * bytes.
+	 */
+	size_t ( * window ) ( struct xfer_interface *xfer );
+	/** Allocate I/O buffer
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v len		I/O buffer payload length
+	 * @ret iobuf		I/O buffer
+	 */
+	struct io_buffer * ( * alloc_iob ) ( struct xfer_interface *xfer,
+					     size_t len );
+	/** Deliver datagram as I/O buffer with metadata
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v iobuf		Datagram I/O buffer
+	 * @v meta		Data transfer metadata
+	 * @ret rc		Return status code
+	 *
+	 * A data transfer interface that wishes to support only raw
+	 * data delivery should set this method to
+	 * xfer_deliver_as_raw().
+	 */
+	int ( * deliver_iob ) ( struct xfer_interface *xfer,
+				struct io_buffer *iobuf,
+				struct xfer_metadata *meta );
+	/** Deliver datagram as raw data
+	 *
+	 * @v xfer		Data transfer interface
+	 * @v data		Data buffer
+	 * @v len		Length of data buffer
+	 * @ret rc		Return status code
+	 *
+	 * A data transfer interface that wishes to support only I/O
+	 * buffer delivery should set this method to
+	 * xfer_deliver_as_iob().
+	 */
+	int ( * deliver_raw ) ( struct xfer_interface *xfer,
+				const void *data, size_t len );
+};
+
+/** A data transfer interface */
+struct xfer_interface {
+	/** Generic object communication interface */
+	struct interface intf;
+	/** Operations for received messages */
+	struct xfer_interface_operations *op;
+};
+
+/** Basis positions for seek() events */
+enum seek_whence {
+	SEEK_CUR = 0,
+	SEEK_SET,
+};
+
+/** Data transfer metadata */
+struct xfer_metadata {
+	/** Position of data within stream */
+	off_t offset;
+	/** Basis for data position
+	 *
+	 * Must be one of @c SEEK_CUR or @c SEEK_SET.
+	 */
+	int whence;
+	/** Source socket address, or NULL */
+	struct sockaddr *src;
+	/** Destination socket address, or NULL */
+	struct sockaddr *dest;
+	/** Network device, or NULL */
+	struct net_device *netdev;
+};
+
+/**
+ * Describe seek basis
+ *
+ * @v whence		Basis for new position
+ */
+static inline __attribute__ (( always_inline )) const char *
+whence_text ( int whence ) {
+	switch ( whence ) {
+	case SEEK_CUR:	return "CUR";
+	case SEEK_SET:	return "SET";
+	default:	return "INVALID";
+	}
+}
+
+extern struct xfer_interface null_xfer;
+extern struct xfer_interface_operations null_xfer_ops;
+
+extern void xfer_close ( struct xfer_interface *xfer, int rc );
+extern int xfer_vredirect ( struct xfer_interface *xfer, int type,
+			    va_list args );
+extern int xfer_redirect ( struct xfer_interface *xfer, int type, ... );
+extern size_t xfer_window ( struct xfer_interface *xfer );
+extern struct io_buffer * xfer_alloc_iob ( struct xfer_interface *xfer,
+					   size_t len );
+extern int xfer_deliver_iob ( struct xfer_interface *xfer,
+			      struct io_buffer *iobuf );
+extern int xfer_deliver_iob_meta ( struct xfer_interface *xfer,
+				   struct io_buffer *iobuf,
+				   struct xfer_metadata *meta );
+extern int xfer_deliver_raw ( struct xfer_interface *xfer,
+			      const void *data, size_t len );
+extern int xfer_vprintf ( struct xfer_interface *xfer,
+			  const char *format, va_list args );
+extern int __attribute__ (( format ( printf, 2, 3 ) ))
+xfer_printf ( struct xfer_interface *xfer, const char *format, ... );
+extern int xfer_seek ( struct xfer_interface *xfer, off_t offset, int whence );
+
+extern void ignore_xfer_close ( struct xfer_interface *xfer, int rc );
+extern int ignore_xfer_vredirect ( struct xfer_interface *xfer,
+				   int type, va_list args );
+extern size_t unlimited_xfer_window ( struct xfer_interface *xfer );
+extern size_t no_xfer_window ( struct xfer_interface *xfer );
+extern struct io_buffer * default_xfer_alloc_iob ( struct xfer_interface *xfer,
+						   size_t len );
+extern int xfer_deliver_as_raw ( struct xfer_interface *xfer,
+				 struct io_buffer *iobuf,
+				 struct xfer_metadata *meta );
+extern int xfer_deliver_as_iob ( struct xfer_interface *xfer,
+				 const void *data, size_t len );
+extern int ignore_xfer_deliver_raw ( struct xfer_interface *xfer,
+				     const void *data __unused, size_t len );
+
+/**
+ * Initialise a data transfer interface
+ *
+ * @v xfer		Data transfer interface
+ * @v op		Data transfer interface operations
+ * @v refcnt		Containing object reference counter, or NULL
+ */
+static inline void xfer_init ( struct xfer_interface *xfer,
+			       struct xfer_interface_operations *op,
+			       struct refcnt *refcnt ) {
+	xfer->intf.dest = &null_xfer.intf;
+	xfer->intf.refcnt = refcnt;
+	xfer->op = op;
+}
+
+/**
+ * Initialise a static data transfer interface
+ *
+ * @v operations		Data transfer interface operations
+ */
+#define XFER_INIT( operations ) {			\
+		.intf = {				\
+			.dest = &null_xfer.intf,	\
+			.refcnt = NULL,			\
+		},					\
+		.op = operations,			\
+	}
+
+/**
+ * Get data transfer interface from generic object communication interface
+ *
+ * @v intf		Generic object communication interface
+ * @ret xfer		Data transfer interface
+ */
+static inline __attribute__ (( always_inline )) struct xfer_interface *
+intf_to_xfer ( struct interface *intf ) {
+	return container_of ( intf, struct xfer_interface, intf );
+}
+
+/**
+ * Get reference to destination data transfer interface
+ *
+ * @v xfer		Data transfer interface
+ * @ret dest		Destination interface
+ */
+static inline __attribute__ (( always_inline )) struct xfer_interface *
+xfer_get_dest ( struct xfer_interface *xfer ) {
+	return intf_to_xfer ( intf_get ( xfer->intf.dest ) );
+}
+
+/**
+ * Drop reference to data transfer interface
+ *
+ * @v xfer		Data transfer interface
+ */
+static inline __attribute__ (( always_inline )) void
+xfer_put ( struct xfer_interface *xfer ) {
+	intf_put ( &xfer->intf );
+}
+
+/**
+ * Plug a data transfer interface into a new destination interface
+ *
+ * @v xfer		Data transfer interface
+ * @v dest		New destination interface
+ */
+static inline __attribute__ (( always_inline )) void
+xfer_plug ( struct xfer_interface *xfer, struct xfer_interface *dest ) {
+	plug ( &xfer->intf, &dest->intf );
+}
+
+/**
+ * Plug two data transfer interfaces together
+ *
+ * @v a			Data transfer interface A
+ * @v b			Data transfer interface B
+ */
+static inline __attribute__ (( always_inline )) void
+xfer_plug_plug ( struct xfer_interface *a, struct xfer_interface *b ) {
+	plug_plug ( &a->intf, &b->intf );
+}
+
+/**
+ * Unplug a data transfer interface
+ *
+ * @v xfer		Data transfer interface
+ */
+static inline __attribute__ (( always_inline )) void
+xfer_unplug ( struct xfer_interface *xfer ) {
+	plug ( &xfer->intf, &null_xfer.intf );
+}
+
+/**
+ * Stop using a data transfer interface
+ *
+ * @v xfer		Data transfer interface
+ *
+ * After calling this method, no further messages will be received via
+ * the interface.
+ */
+static inline void xfer_nullify ( struct xfer_interface *xfer ) {
+	xfer->op = &null_xfer_ops;
+};
+
+#endif /* _IPXE_XFER_H */