Merge pull request #26446 from medhefgo/efi-headers

boot: Provide our own EFI API headers

58 files changed, 1376 insertions, 634 deletions

diff --git a/src/boot/efi/bcd.h b/src/boot/efi/bcd.h
index c27af55c1e..bb12d891ae 100644
--- a/src/boot/efi/bcd.h
+++ b/src/boot/efi/bcd.h
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdint.h>
-#include <uchar.h>
+#include "efi.h"
 
 char16_t *get_bcd_title(uint8_t *bcd, size_t bcd_len);
diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index 6d4da0c51c..79cb36c717 100644
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -1,8 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efigpt.h>
-#include <efilib.h>
 #include <inttypes.h>
 
 #include "bcd.h"
@@ -18,12 +15,15 @@
 #include "measure.h"
 #include "part-discovery.h"
 #include "pe.h"
-#include "vmm.h"
+#include "proto/block-io.h"
+#include "proto/device-path.h"
+#include "proto/simple-text-io.h"
 #include "random-seed.h"
 #include "secure-boot.h"
 #include "shim.h"
 #include "ticks.h"
 #include "util.h"
+#include "vmm.h"
 
 #ifndef GNU_EFI_USE_MS_ABI
         /* We do not use uefi_call_wrapper() in systemd-boot. As such, we rely on the
@@ -32,8 +32,6 @@
         #error systemd-boot requires compilation with GNU_EFI_USE_MS_ABI defined.
 #endif
 
-#define TEXT_ATTR_SWAP(c) EFI_TEXT_ATTR(((c) & 0b11110000) >> 4, (c) & 0b1111)
-
 /* Magic string for recognizing our own binaries */
 _used_ _section_(".sdmagic") static const char magic[] =
         "#### LoaderInfo: systemd-boot " GIT_VERSION " ####";
@@ -152,7 +150,7 @@ static bool line_edit(char16_t **line_in, size_t x_max, size_t y_pos) {
         for (;;) {
                 EFI_STATUS err;
                 uint64_t key;
-                size_t j, cursor_color = TEXT_ATTR_SWAP(COLOR_EDIT);
+                size_t j, cursor_color = EFI_TEXT_ATTR_SWAP(COLOR_EDIT);
 
                 j = MIN(len - first, x_max);
                 memcpy(print, line + first, j * sizeof(char16_t));
@@ -170,7 +168,7 @@ static bool line_edit(char16_t **line_in, size_t x_max, size_t y_pos) {
                 print[cursor+1] = '\0';
                 do {
                         print_at(cursor + 1, y_pos, cursor_color, print + cursor);
-                        cursor_color = TEXT_ATTR_SWAP(cursor_color);
+                        cursor_color = EFI_TEXT_ATTR_SWAP(cursor_color);
 
                         err = console_key_read(&key, 750 * 1000);
                         if (!IN_SET(err, EFI_SUCCESS, EFI_TIMEOUT, EFI_NOT_READY))
@@ -264,7 +262,7 @@ static bool line_edit(char16_t **line_in, size_t x_max, size_t y_pos) {
 
                 case KEYPRESS(EFI_CONTROL_PRESSED, 0, 'w'):
                 case KEYPRESS(EFI_CONTROL_PRESSED, 0, CHAR_CTRL('w')):
-                case KEYPRESS(EFI_ALT_PRESSED, 0, CHAR_BACKSPACE):
+                case KEYPRESS(EFI_ALT_PRESSED, 0, '\b'):
                         /* backward-kill-word */
                         clear = 0;
                         if ((first + cursor) > 0 && line[first + cursor-1] == ' ') {
@@ -307,17 +305,17 @@ static bool line_edit(char16_t **line_in, size_t x_max, size_t y_pos) {
                         len = first + cursor;
                         continue;
 
-                case KEYPRESS(0, 0, CHAR_LINEFEED):
-                case KEYPRESS(0, 0, CHAR_CARRIAGE_RETURN):
+                case KEYPRESS(0, 0, '\n'):
+                case KEYPRESS(0, 0, '\r'):
                 case KEYPRESS(0, SCAN_F3, 0): /* EZpad Mini 4s firmware sends malformed events */
-                case KEYPRESS(0, SCAN_F3, CHAR_CARRIAGE_RETURN): /* Teclast X98+ II firmware sends malformed events */
+                case KEYPRESS(0, SCAN_F3, '\r'): /* Teclast X98+ II firmware sends malformed events */
                         if (!streq16(line, *line_in)) {
                                 free(*line_in);
                                 *line_in = TAKE_PTR(line);
                         }
                         return true;
 
-                case KEYPRESS(0, 0, CHAR_BACKSPACE):
+                case KEYPRESS(0, 0, '\b'):
                         if (len == 0)
                                 continue;
                         if (first == 0 && cursor == 0)
@@ -828,7 +826,7 @@ static bool menu_run(
 
                 if (firmware_setup) {
                         firmware_setup = false;
-                        if (key == KEYPRESS(0, 0, CHAR_CARRIAGE_RETURN))
+                        if (IN_SET(key, KEYPRESS(0, 0, '\r'), KEYPRESS(0, 0, '\n')))
                                 reboot_into_firmware();
                         continue;
                 }
@@ -877,10 +875,10 @@ static bool menu_run(
                                 idx_highlight = config->entry_count-1;
                         break;
 
-                case KEYPRESS(0, 0, CHAR_LINEFEED):
-                case KEYPRESS(0, 0, CHAR_CARRIAGE_RETURN):
+                case KEYPRESS(0, 0, '\n'):
+                case KEYPRESS(0, 0, '\r'):
                 case KEYPRESS(0, SCAN_F3, 0): /* EZpad Mini 4s firmware sends malformed events */
-                case KEYPRESS(0, SCAN_F3, CHAR_CARRIAGE_RETURN): /* Teclast X98+ II firmware sends malformed events */
+                case KEYPRESS(0, SCAN_F3, '\r'): /* Teclast X98+ II firmware sends malformed events */
                 case KEYPRESS(0, SCAN_RIGHT, 0):
                         exit = true;
                         break;
diff --git a/src/boot/efi/console.c b/src/boot/efi/console.c
index 343d965692..41ad03cb46 100644
--- a/src/boot/efi/console.c
+++ b/src/boot/efi/console.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "console.h"
+#include "proto/graphics-output.h"
 #include "util.h"
 
 #define SYSTEM_FONT_WIDTH 8
diff --git a/src/boot/efi/console.h b/src/boot/efi/console.h
index 83c219bc73..c4d821a481 100644
--- a/src/boot/efi/console.h
+++ b/src/boot/efi/console.h
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "missing_efi.h"
+#include "efi.h"
+#include "proto/simple-text-io.h"
 
 enum {
         EFI_SHIFT_PRESSED   = EFI_RIGHT_SHIFT_PRESSED|EFI_LEFT_SHIFT_PRESSED,
diff --git a/src/boot/efi/cpio.c b/src/boot/efi/cpio.c
index 1fd16a98d1..bcd5e975ea 100644
--- a/src/boot/efi/cpio.c
+++ b/src/boot/efi/cpio.c
@@ -2,6 +2,7 @@
 
 #include "cpio.h"
 #include "measure.h"
+#include "proto/device-path.h"
 #include "util.h"
 
 static char *write_cpio_word(char *p, uint32_t v) {
diff --git a/src/boot/efi/cpio.h b/src/boot/efi/cpio.h
index afd689f61e..26851e3c15 100644
--- a/src/boot/efi/cpio.h
+++ b/src/boot/efi/cpio.h
@@ -1,9 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <stdbool.h>
-#include <uchar.h>
+#include "efi.h"
+#include "proto/loaded-image.h"
 
 EFI_STATUS pack_cpio(
                 EFI_LOADED_IMAGE_PROTOCOL *loaded_image,
diff --git a/src/boot/efi/devicetree.c b/src/boot/efi/devicetree.c
index eef08985f1..2304daa23b 100644
--- a/src/boot/efi/devicetree.c
+++ b/src/boot/efi/devicetree.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-
 #include "devicetree.h"
-#include "missing_efi.h"
+#include "proto/dt-fixup.h"
 #include "util.h"
 
 #define FDT_V1_SIZE (7*4)
diff --git a/src/boot/efi/devicetree.h b/src/boot/efi/devicetree.h
index 1a05c85d85..33eaa2256c 100644
--- a/src/boot/efi/devicetree.h
+++ b/src/boot/efi/devicetree.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <uchar.h>
+#include "efi.h"
 
 struct devicetree_state {
         EFI_PHYSICAL_ADDRESS addr;
diff --git a/src/boot/efi/disk.c b/src/boot/efi/disk.c
index a7ad2dd0e2..44be3232ee 100644
--- a/src/boot/efi/disk.c
+++ b/src/boot/efi/disk.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "disk.h"
+#include "proto/device-path.h"
 #include "util.h"
 
 EFI_STATUS disk_get_part_uuid(EFI_HANDLE *handle, char16_t uuid[static 37]) {
diff --git a/src/boot/efi/disk.h b/src/boot/efi/disk.h
index 1a5a18733e..2da5bca133 100644
--- a/src/boot/efi/disk.h
+++ b/src/boot/efi/disk.h
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <uchar.h>
+#include "efi.h"
 
 EFI_STATUS disk_get_part_uuid(EFI_HANDLE *handle, char16_t uuid[static 37]);
diff --git a/src/boot/efi/drivers.c b/src/boot/efi/drivers.c
index 7b4164513c..e38e3e3b8c 100644
--- a/src/boot/efi/drivers.c
+++ b/src/boot/efi/drivers.c
@@ -1,8 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "drivers.h"
 #include "util.h"
 
diff --git a/src/boot/efi/drivers.h b/src/boot/efi/drivers.h
index 4ad526e83e..ecd0b4ea56 100644
--- a/src/boot/efi/drivers.h
+++ b/src/boot/efi/drivers.h
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
+#include "efi.h"
+#include "proto/loaded-image.h"
 
 EFI_STATUS reconnect_all_drivers(void);
 EFI_STATUS load_drivers(
diff --git a/src/boot/efi/efi-string.c b/src/boot/efi/efi-string.c
index 22923d60f6..ee3dc1c4a9 100644
--- a/src/boot/efi/efi-string.c
+++ b/src/boot/efi/efi-string.c
@@ -1,13 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <stdbool.h>
-#include <stdint.h>
-#include <wchar.h>
-
 #include "efi-string.h"
 
 #if SD_BOOT
-#  include "missing_efi.h"
+#  include "proto/simple-text-io.h"
 #  include "util.h"
 #else
 #  include <stdlib.h>
@@ -382,7 +378,6 @@ DEFINE_PARSE_NUMBER(char16_t, parse_number16);
 
 static const char * const warn_table[] = {
         [EFI_SUCCESS]               = "Success",
-#if SD_BOOT
         [EFI_WARN_UNKNOWN_GLYPH]    = "Unknown glyph",
         [EFI_WARN_DELETE_FAILURE]   = "Delete failure",
         [EFI_WARN_WRITE_FAILURE]    = "Write failure",
@@ -390,7 +385,6 @@ static const char * const warn_table[] = {
         [EFI_WARN_STALE_DATA]       = "Stale data",
         [EFI_WARN_FILE_SYSTEM]      = "File system",
         [EFI_WARN_RESET_REQUIRED]   = "Reset required",
-#endif
 };
 
 /* Errors have MSB set, remove it to keep the table compact. */
@@ -399,7 +393,6 @@ static const char * const warn_table[] = {
 static const char * const err_table[] = {
         [NOERR(EFI_ERROR_MASK)]           = "Error",
         [NOERR(EFI_LOAD_ERROR)]           = "Load error",
-#if SD_BOOT
         [NOERR(EFI_INVALID_PARAMETER)]    = "Invalid parameter",
         [NOERR(EFI_UNSUPPORTED)]          = "Unsupported",
         [NOERR(EFI_BAD_BUFFER_SIZE)]      = "Bad buffer size",
@@ -427,14 +420,13 @@ static const char * const err_table[] = {
         [NOERR(EFI_SECURITY_VIOLATION)]   = "Security violation",
         [NOERR(EFI_CRC_ERROR)]            = "CRC error",
         [NOERR(EFI_END_OF_MEDIA)]         = "End of media",
-        [29]                              = "Reserved (29)",
-        [30]                              = "Reserved (30)",
+        [NOERR(EFI_ERROR_RESERVED_29)]    = "Reserved (29)",
+        [NOERR(EFI_ERROR_RESERVED_30)]    = "Reserved (30)",
         [NOERR(EFI_END_OF_FILE)]          = "End of file",
         [NOERR(EFI_INVALID_LANGUAGE)]     = "Invalid language",
         [NOERR(EFI_COMPROMISED_DATA)]     = "Compromised data",
         [NOERR(EFI_IP_ADDRESS_CONFLICT)]  = "IP address conflict",
         [NOERR(EFI_HTTP_ERROR)]           = "HTTP error",
-#endif
 };
 
 static const char *status_to_string(EFI_STATUS status) {
diff --git a/src/boot/efi/efi-string.h b/src/boot/efi/efi-string.h
index 2a28db3593..ea9493bcbb 100644
--- a/src/boot/efi/efi-string.h
+++ b/src/boot/efi/efi-string.h
@@ -1,11 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <uchar.h>
-
+#include "efi.h"
 #include "macro-fundamental.h"
 
 size_t strnlen8(const char *s, size_t n);
@@ -110,17 +106,6 @@ bool efi_fnmatch(const char16_t *pattern, const char16_t *haystack);
 bool parse_number8(const char *s, uint64_t *ret_u, const char **ret_tail);
 bool parse_number16(const char16_t *s, uint64_t *ret_u, const char16_t **ret_tail);
 
-typedef size_t EFI_STATUS;
-
-#if !SD_BOOT
-/* Provide these for unit testing. */
-enum {
-        EFI_ERROR_MASK = ((EFI_STATUS) 1 << (sizeof(EFI_STATUS) * CHAR_BIT - 1)),
-        EFI_SUCCESS = 0,
-        EFI_LOAD_ERROR = 1 | EFI_ERROR_MASK,
-};
-#endif
-
 #ifdef __clang__
 #  define _gnu_printf_(a, b) _printf_(a, b)
 #else
diff --git a/src/boot/efi/efi.h b/src/boot/efi/efi.h
new file mode 100644
index 0000000000..4e51078d3d
--- /dev/null
+++ b/src/boot/efi/efi.h
@@ -0,0 +1,446 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "macro-fundamental.h"
+
+#if SD_BOOT
+/* uchar.h/wchar.h are not suitable for freestanding environments. */
+typedef __WCHAR_TYPE__ wchar_t;
+typedef __CHAR16_TYPE__ char16_t;
+typedef __CHAR32_TYPE__ char32_t;
+
+/* Let's be paranoid and do some sanity checks. */
+assert_cc(__STDC_HOSTED__ == 0);
+assert_cc(sizeof(bool) == 1);
+assert_cc(sizeof(uint8_t) == 1);
+assert_cc(sizeof(uint16_t) == 2);
+assert_cc(sizeof(uint32_t) == 4);
+assert_cc(sizeof(uint64_t) == 8);
+assert_cc(sizeof(wchar_t) == 2);
+assert_cc(sizeof(char16_t) == 2);
+assert_cc(sizeof(char32_t) == 4);
+assert_cc(sizeof(size_t) == sizeof(void *));
+assert_cc(sizeof(size_t) == sizeof(uintptr_t));
+#else
+#  include <uchar.h>
+#  include <wchar.h>
+#endif
+
+/* We use size_t/ssize_t to represent UEFI UINTN/INTN. */
+typedef size_t EFI_STATUS;
+typedef intptr_t ssize_t;
+
+typedef void* EFI_HANDLE;
+typedef void* EFI_EVENT;
+typedef size_t EFI_TPL;
+typedef uint64_t EFI_LBA;
+typedef uint64_t EFI_PHYSICAL_ADDRESS;
+
+#if defined(__x86_64__)
+#  define EFIAPI __attribute__((ms_abi))
+#else
+#  define EFIAPI
+#endif
+
+#if __SIZEOF_POINTER__ == 8
+#  define EFI_ERROR_MASK 0x8000000000000000ULL
+#elif __SIZEOF_POINTER__ == 4
+#  define EFI_ERROR_MASK 0x80000000ULL
+#else
+#  error Unsupported pointer size
+#endif
+
+#define EFIWARN(s) ((EFI_STATUS) s)
+#define EFIERR(s) ((EFI_STATUS) (s | EFI_ERROR_MASK))
+
+#define EFI_SUCCESS               EFIWARN(0)
+#define EFI_WARN_UNKNOWN_GLYPH    EFIWARN(1)
+#define EFI_WARN_DELETE_FAILURE   EFIWARN(2)
+#define EFI_WARN_WRITE_FAILURE    EFIWARN(3)
+#define EFI_WARN_BUFFER_TOO_SMALL EFIWARN(4)
+#define EFI_WARN_STALE_DATA       EFIWARN(5)
+#define EFI_WARN_FILE_SYSTEM      EFIWARN(6)
+#define EFI_WARN_RESET_REQUIRED   EFIWARN(7)
+
+#define EFI_LOAD_ERROR           EFIERR(1)
+#define EFI_INVALID_PARAMETER    EFIERR(2)
+#define EFI_UNSUPPORTED          EFIERR(3)
+#define EFI_BAD_BUFFER_SIZE      EFIERR(4)
+#define EFI_BUFFER_TOO_SMALL     EFIERR(5)
+#define EFI_NOT_READY            EFIERR(6)
+#define EFI_DEVICE_ERROR         EFIERR(7)
+#define EFI_WRITE_PROTECTED      EFIERR(8)
+#define EFI_OUT_OF_RESOURCES     EFIERR(9)
+#define EFI_VOLUME_CORRUPTED     EFIERR(10)
+#define EFI_VOLUME_FULL          EFIERR(11)
+#define EFI_NO_MEDIA             EFIERR(12)
+#define EFI_MEDIA_CHANGED        EFIERR(13)
+#define EFI_NOT_FOUND            EFIERR(14)
+#define EFI_ACCESS_DENIED        EFIERR(15)
+#define EFI_NO_RESPONSE          EFIERR(16)
+#define EFI_NO_MAPPING           EFIERR(17)
+#define EFI_TIMEOUT              EFIERR(18)
+#define EFI_NOT_STARTED          EFIERR(19)
+#define EFI_ALREADY_STARTED      EFIERR(20)
+#define EFI_ABORTED              EFIERR(21)
+#define EFI_ICMP_ERROR           EFIERR(22)
+#define EFI_TFTP_ERROR           EFIERR(23)
+#define EFI_PROTOCOL_ERROR       EFIERR(24)
+#define EFI_INCOMPATIBLE_VERSION EFIERR(25)
+#define EFI_SECURITY_VIOLATION   EFIERR(26)
+#define EFI_CRC_ERROR            EFIERR(27)
+#define EFI_END_OF_MEDIA         EFIERR(28)
+#define EFI_ERROR_RESERVED_29    EFIERR(29)
+#define EFI_ERROR_RESERVED_30    EFIERR(30)
+#define EFI_END_OF_FILE          EFIERR(31)
+#define EFI_INVALID_LANGUAGE     EFIERR(32)
+#define EFI_COMPROMISED_DATA     EFIERR(33)
+#define EFI_IP_ADDRESS_CONFLICT  EFIERR(34)
+#define EFI_HTTP_ERROR           EFIERR(35)
+
+typedef struct {
+        uint32_t Data1;
+        uint16_t Data2;
+        uint16_t Data3;
+        uint8_t Data4[8];
+} EFI_GUID;
+
+#define GUID_DEF(d1, d2, d3, d4_1, d4_2, d4_3, d4_4, d4_5, d4_6, d4_7, d4_8) \
+    { d1, d2, d3, { d4_1, d4_2, d4_3, d4_4, d4_5, d4_6, d4_7, d4_8 } }
+
+/* Creates a EFI_GUID pointer suitable for EFI APIs. Use of const allows the compiler to merge multiple
+ * uses (although, currently compilers do that regardless). Most EFI APIs declare their EFI_GUID input
+ * as non-const, but almost all of them are in fact const. */
+#define MAKE_GUID_PTR(name) ((EFI_GUID *) &(const EFI_GUID) name##_GUID)
+
+/* These allow MAKE_GUID_PTR() to work without requiring an extra _GUID in the passed name. We want to
+ * keep the GUID definitions in line with the UEFI spec. */
+#define EFI_GLOBAL_VARIABLE_GUID EFI_GLOBAL_VARIABLE
+#define EFI_FILE_INFO_GUID EFI_FILE_INFO_ID
+
+#define EFI_GLOBAL_VARIABLE \
+        GUID_DEF(0x8be4df61, 0x93ca, 0x11d2, 0xaa, 0x0d, 0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c)
+#define EFI_IMAGE_SECURITY_DATABASE_GUID \
+        GUID_DEF(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
+
+#define EVT_TIMER                         0x80000000U
+#define EVT_RUNTIME                       0x40000000U
+#define EVT_NOTIFY_WAIT                   0x00000100U
+#define EVT_NOTIFY_SIGNAL                 0x00000200U
+#define EVT_SIGNAL_EXIT_BOOT_SERVICES     0x00000201U
+#define EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE 0x60000202U
+
+#define EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL  0x01U
+#define EFI_OPEN_PROTOCOL_GET_PROTOCOL        0x02U
+#define EFI_OPEN_PROTOCOL_TEST_PROTOCOL       0x04U
+#define EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER 0x08U
+#define EFI_OPEN_PROTOCOL_BY_DRIVER           0x10U
+#define EFI_OPEN_PROTOCOL_EXCLUSIVE           0x20U
+
+#define EFI_VARIABLE_NON_VOLATILE                          0x01U
+#define EFI_VARIABLE_BOOTSERVICE_ACCESS                    0x02U
+#define EFI_VARIABLE_RUNTIME_ACCESS                        0x04U
+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD                 0x08U
+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS            0x10U
+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x20U
+#define EFI_VARIABLE_APPEND_WRITE                          0x40U
+#define EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS         0x80U
+
+#define EFI_TIME_ADJUST_DAYLIGHT 0x001U
+#define EFI_TIME_IN_DAYLIGHT     0x002U
+#define EFI_UNSPECIFIED_TIMEZONE 0x7FFU
+
+#define EFI_OS_INDICATIONS_BOOT_TO_FW_UI                   0x01U
+#define EFI_OS_INDICATIONS_TIMESTAMP_REVOCATION            0x02U
+#define EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED 0x04U
+#define EFI_OS_INDICATIONS_FMP_CAPSULE_SUPPORTED           0x08U
+#define EFI_OS_INDICATIONS_CAPSULE_RESULT_VAR_SUPPORTED    0x10U
+#define EFI_OS_INDICATIONS_START_OS_RECOVERY               0x20U
+#define EFI_OS_INDICATIONS_START_PLATFORM_RECOVERY         0x40U
+#define EFI_OS_INDICATIONS_JSON_CONFIG_DATA_REFRESH        0x80U
+
+#define EFI_PAGE_SIZE 4096U
+#define EFI_SIZE_TO_PAGES(s) ((s) + 0xFFFU) >> 12U
+
+/* These are common enough to warrant forward declaration. We also give them a
+ * shorter name for convenience. */
+typedef struct EFI_FILE_PROTOCOL EFI_FILE;
+typedef struct EFI_DEVICE_PATH_PROTOCOL EFI_DEVICE_PATH;
+
+typedef struct EFI_SIMPLE_TEXT_INPUT_PROTOCOL EFI_SIMPLE_TEXT_INPUT_PROTOCOL;
+typedef struct EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL;
+
+typedef enum {
+        TimerCancel,
+        TimerPeriodic,
+        TimerRelative,
+} EFI_TIMER_DELAY;
+
+typedef enum {
+        AllocateAnyPages,
+        AllocateMaxAddress,
+        AllocateAddress,
+        MaxAllocateType,
+} EFI_ALLOCATE_TYPE;
+
+typedef enum {
+        EfiReservedMemoryType,
+        EfiLoaderCode,
+        EfiLoaderData,
+        EfiBootServicesCode,
+        EfiBootServicesData,
+        EfiRuntimeServicesCode,
+        EfiRuntimeServicesData,
+        EfiConventionalMemory,
+        EfiUnusableMemory,
+        EfiACPIReclaimMemory,
+        EfiACPIMemoryNVS,
+        EfiMemoryMappedIO,
+        EfiMemoryMappedIOPortSpace,
+        EfiPalCode,
+        EfiPersistentMemory,
+        EfiUnacceptedMemoryType,
+        EfiMaxMemoryType,
+} EFI_MEMORY_TYPE;
+
+typedef enum {
+        AllHandles,
+        ByRegisterNotify,
+        ByProtocol,
+} EFI_LOCATE_SEARCH_TYPE;
+
+typedef enum {
+        EfiResetCold,
+        EfiResetWarm,
+        EfiResetShutdown,
+        EfiResetPlatformSpecific,
+} EFI_RESET_TYPE;
+
+typedef struct {
+        uint16_t Year;
+        uint8_t Month;
+        uint8_t Day;
+        uint8_t Hour;
+        uint8_t Minute;
+        uint8_t Second;
+        uint8_t Pad1;
+        uint32_t Nanosecond;
+        int16_t TimeZone;
+        uint8_t Daylight;
+        uint8_t Pad2;
+} EFI_TIME;
+
+typedef struct {
+        uint32_t Resolution;
+        uint32_t Accuracy;
+        bool SetsToZero;
+} EFI_TIME_CAPABILITIES;
+
+typedef struct {
+        uint64_t Signature;
+        uint32_t Revision;
+        uint32_t HeaderSize;
+        uint32_t CRC32;
+        uint32_t Reserved;
+} EFI_TABLE_HEADER;
+
+typedef struct {
+        EFI_TABLE_HEADER Hdr;
+        void *RaiseTPL;
+        void *RestoreTPL;
+        EFI_STATUS (EFIAPI *AllocatePages)(
+                        EFI_ALLOCATE_TYPE Type,
+                        EFI_MEMORY_TYPE MemoryType,
+                        size_t Pages,
+                        EFI_PHYSICAL_ADDRESS *Memory);
+        EFI_STATUS (EFIAPI *FreePages)(
+                        EFI_PHYSICAL_ADDRESS Memory,
+                        size_t Pages);
+        void *GetMemoryMap;
+        EFI_STATUS (EFIAPI *AllocatePool)(
+                        EFI_MEMORY_TYPE PoolType,
+                        size_t Size,
+                        void **Buffer);
+        EFI_STATUS (EFIAPI *FreePool)(void *Buffer);
+        EFI_STATUS (EFIAPI *CreateEvent)(
+                        uint32_t Type,
+                        EFI_TPL NotifyTpl,
+                        void *NotifyFunction,
+                        void *NotifyContext,
+                        EFI_EVENT *Event);
+        EFI_STATUS (EFIAPI *SetTimer)(
+                        EFI_EVENT Event,
+                        EFI_TIMER_DELAY Type,
+                        uint64_t TriggerTime);
+        EFI_STATUS (EFIAPI *WaitForEvent)(
+                        size_t NumberOfEvents,
+                        EFI_EVENT *Event,
+                        size_t *Index);
+        void *SignalEvent;
+        EFI_STATUS (EFIAPI *CloseEvent)(EFI_EVENT Event);
+        EFI_STATUS (EFIAPI *CheckEvent)(EFI_EVENT Event);
+        void *InstallProtocolInterface;
+        EFI_STATUS (EFIAPI *ReinstallProtocolInterface)(
+                        EFI_HANDLE Handle,
+                        EFI_GUID *Protocol,
+                        void *OldInterface,
+                        void *NewInterface);
+        void *UninstallProtocolInterface;
+        EFI_STATUS (EFIAPI *HandleProtocol)(
+                        EFI_HANDLE Handle,
+                        EFI_GUID *Protocol,
+                        void **Interface);
+        void *Reserved;
+        void *RegisterProtocolNotify;
+        EFI_STATUS (EFIAPI *LocateHandle)(
+                        EFI_LOCATE_SEARCH_TYPE SearchType,
+                        EFI_GUID *Protocol,
+                        void *SearchKey,
+                        size_t *BufferSize,
+                        EFI_HANDLE *Buffer);
+        EFI_STATUS (EFIAPI *LocateDevicePath)(
+                        EFI_GUID *Protocol,
+                        EFI_DEVICE_PATH **DevicePath,
+                        EFI_HANDLE *Device);
+        EFI_STATUS (EFIAPI *InstallConfigurationTable)(
+                        EFI_GUID *Guid,
+                        void *Table);
+        EFI_STATUS (EFIAPI *LoadImage)(
+                        bool BootPolicy,
+                        EFI_HANDLE ParentImageHandle,
+                        EFI_DEVICE_PATH *DevicePath,
+                        void *SourceBuffer,
+                        size_t SourceSize,
+                        EFI_HANDLE *ImageHandle);
+        EFI_STATUS (EFIAPI *StartImage)(
+                        EFI_HANDLE ImageHandle,
+                        size_t *ExitDataSize,
+                        char16_t **ExitData);
+        EFI_STATUS (EFIAPI *Exit)(
+                        EFI_HANDLE ImageHandle,
+                        EFI_STATUS ExitStatus,
+                        size_t ExitDataSize,
+                        char16_t *ExitData);
+        EFI_STATUS (EFIAPI *UnloadImage)(EFI_HANDLE ImageHandle);
+        void *ExitBootServices;
+        EFI_STATUS (EFIAPI *GetNextMonotonicCount)(uint64_t *Count);
+        EFI_STATUS (EFIAPI *Stall)(size_t Microseconds);
+        EFI_STATUS (EFIAPI *SetWatchdogTimer)(
+                        size_t Timeout,
+                        uint64_t WatchdogCode,
+                        size_t DataSize,
+                        char16_t *WatchdogData);
+        EFI_STATUS (EFIAPI *ConnectController)(
+                        EFI_HANDLE ControllerHandle,
+                        EFI_HANDLE *DriverImageHandle,
+                        EFI_DEVICE_PATH *RemainingDevicePath,
+                        bool Recursive);
+        EFI_STATUS (EFIAPI *DisconnectController)(
+                        EFI_HANDLE ControllerHandle,
+                        EFI_HANDLE DriverImageHandle,
+                        EFI_HANDLE ChildHandle);
+        EFI_STATUS (EFIAPI *OpenProtocol)(
+                        EFI_HANDLE Handle,
+                        EFI_GUID *Protocol,
+                        void **Interface,
+                        EFI_HANDLE AgentHandle,
+                        EFI_HANDLE ControllerHandle,
+                        uint32_t Attributes);
+        EFI_STATUS (EFIAPI *CloseProtocol)(
+                        EFI_HANDLE Handle,
+                        EFI_GUID *Protocol,
+                        EFI_HANDLE AgentHandle,
+                        EFI_HANDLE ControllerHandle);
+        void *OpenProtocolInformation;
+        EFI_STATUS (EFIAPI *ProtocolsPerHandle)(
+                        EFI_HANDLE Handle,
+                        EFI_GUID ***ProtocolBuffer,
+                        size_t *ProtocolBufferCount);
+        EFI_STATUS (EFIAPI *LocateHandleBuffer)(
+                        EFI_LOCATE_SEARCH_TYPE SearchType,
+                        EFI_GUID *Protocol,
+                        void *SearchKey,
+                        size_t *NoHandles,
+                        EFI_HANDLE **Buffer);
+        EFI_STATUS (EFIAPI *LocateProtocol)(
+                        EFI_GUID *Protocol,
+                        void *Registration,
+                        void **Interface);
+        EFI_STATUS (EFIAPI *InstallMultipleProtocolInterfaces)(EFI_HANDLE *Handle, ...);
+        EFI_STATUS (EFIAPI *UninstallMultipleProtocolInterfaces)(EFI_HANDLE Handle, ...);
+        EFI_STATUS (EFIAPI *CalculateCrc32)(
+                        void *Data,
+                        size_t DataSize,
+                        uint32_t *Crc32);
+        void (EFIAPI *CopyMem)(
+                        void *Destination,
+                        void *Source,
+                        size_t Length);
+        void (EFIAPI *SetMem)(
+                        void *Buffer,
+                        size_t Size,
+                        uint8_t Value);
+        void *CreateEventEx;
+} EFI_BOOT_SERVICES;
+
+typedef struct {
+        EFI_TABLE_HEADER Hdr;
+        EFI_STATUS (EFIAPI *GetTime)(
+                        EFI_TIME *Time,
+                        EFI_TIME_CAPABILITIES *Capabilities);
+        EFI_STATUS (EFIAPI *SetTime)(EFI_TIME *Time);
+        void *GetWakeupTime;
+        void *SetWakeupTime;
+        void *SetVirtualAddressMap;
+        void *ConvertPointer;
+        EFI_STATUS (EFIAPI *GetVariable)(
+                        char16_t *VariableName,
+                        EFI_GUID *VendorGuid,
+                        uint32_t *Attributes,
+                        size_t *DataSize,
+                        void *Data);
+        void *GetNextVariableName;
+        EFI_STATUS (EFIAPI *SetVariable)(
+                        char16_t *VariableName,
+                        EFI_GUID *VendorGuid,
+                        uint32_t Attributes,
+                        size_t  DataSize,
+                        void *Data);
+        EFI_STATUS (EFIAPI *GetNextHighMonotonicCount)(uint32_t *HighCount);
+        void (EFIAPI *ResetSystem)(
+                        EFI_RESET_TYPE ResetType,
+                        EFI_STATUS ResetStatus,
+                        size_t DataSize,
+                        void *ResetData);
+        void *UpdateCapsule;
+        void *QueryCapsuleCapabilities;
+        void *QueryVariableInfo;
+} EFI_RUNTIME_SERVICES;
+
+typedef struct {
+        EFI_TABLE_HEADER Hdr;
+        char16_t *FirmwareVendor;
+        uint32_t FirmwareRevision;
+        EFI_HANDLE ConsoleInHandle;
+        EFI_SIMPLE_TEXT_INPUT_PROTOCOL *ConIn;
+        EFI_HANDLE ConsoleOutHandle;
+        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *ConOut;
+        EFI_HANDLE StandardErrorHandle;
+        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *StdErr;
+        EFI_RUNTIME_SERVICES *RuntimeServices;
+        EFI_BOOT_SERVICES *BootServices;
+        size_t NumberOfTableEntries;
+        struct {
+                EFI_GUID VendorGuid;
+                void *VendorTable;
+        } *ConfigurationTable;
+} EFI_SYSTEM_TABLE;
+
+extern EFI_SYSTEM_TABLE *ST;
+extern EFI_BOOT_SERVICES *BS;
+extern EFI_RUNTIME_SERVICES *RT;
diff --git a/src/boot/efi/graphics.c b/src/boot/efi/graphics.c
index d68123df58..496fc69189 100644
--- a/src/boot/efi/graphics.c
+++ b/src/boot/efi/graphics.c
@@ -4,22 +4,19 @@
  *   Authored by Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
  */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "graphics.h"
-#include "missing_efi.h"
+#include "proto/console-control.h"
+#include "proto/simple-text-io.h"
 #include "util.h"
 
 EFI_STATUS graphics_mode(bool on) {
         EFI_CONSOLE_CONTROL_PROTOCOL *ConsoleControl = NULL;
         EFI_CONSOLE_CONTROL_SCREEN_MODE new;
         EFI_CONSOLE_CONTROL_SCREEN_MODE current;
-        BOOLEAN uga_exists;
-        BOOLEAN stdin_locked;
+        bool uga_exists, stdin_locked;
         EFI_STATUS err;
 
-        err = BS->LocateProtocol(MAKE_GUID_PTR(EFI_CONSOLE_CONTROL), NULL, (void **) &ConsoleControl);
+        err = BS->LocateProtocol(MAKE_GUID_PTR(EFI_CONSOLE_CONTROL_PROTOCOL), NULL, (void **) &ConsoleControl);
         if (err != EFI_SUCCESS)
                 /* console control protocol is nonstandard and might not exist. */
                 return err == EFI_NOT_FOUND ? EFI_SUCCESS : err;
diff --git a/src/boot/efi/graphics.h b/src/boot/efi/graphics.h
index 9dadd3985e..33ab7f8c5e 100644
--- a/src/boot/efi/graphics.h
+++ b/src/boot/efi/graphics.h
@@ -5,7 +5,6 @@
  */
 #pragma once
 
-#include <efi.h>
-#include <stdbool.h>
+#include "efi.h"
 
 EFI_STATUS graphics_mode(bool on);
diff --git a/src/boot/efi/initrd.c b/src/boot/efi/initrd.c
index 6d362435c4..e8af999508 100644
--- a/src/boot/efi/initrd.c
+++ b/src/boot/efi/initrd.c
@@ -1,13 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "initrd.h"
 #include "macro-fundamental.h"
-#include "missing_efi.h"
+#include "proto/device-path.h"
+#include "proto/load-file.h"
 #include "util.h"
 
+#define LINUX_INITRD_MEDIA_GUID \
+        GUID_DEF(0x5568e427, 0x68fc, 0x4f3d, 0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68)
+
 /* extend LoadFileProtocol */
 struct initrd_loader {
         EFI_LOAD_FILE_PROTOCOL load_file;
@@ -26,21 +27,21 @@ static const struct {
                 .Header = {
                         .Type = MEDIA_DEVICE_PATH,
                         .SubType = MEDIA_VENDOR_DP,
-                        .Length = { sizeof(efi_initrd_device_path.vendor), 0 }
+                        .Length = sizeof(efi_initrd_device_path.vendor),
                 },
                 .Guid = LINUX_INITRD_MEDIA_GUID
         },
         .end = {
                 .Type = END_DEVICE_PATH_TYPE,
                 .SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE,
-                .Length = { sizeof(efi_initrd_device_path.end), 0 }
+                .Length = sizeof(efi_initrd_device_path.end),
         }
 };
 
 static EFIAPI EFI_STATUS initrd_load_file(
                 EFI_LOAD_FILE_PROTOCOL *this,
                 EFI_DEVICE_PATH *file_path,
-                BOOLEAN boot_policy,
+                bool boot_policy,
                 size_t *buffer_size,
                 void *buffer) {
 
diff --git a/src/boot/efi/initrd.h b/src/boot/efi/initrd.h
index c3dda6d8c1..e7685aeb4a 100644
--- a/src/boot/efi/initrd.h
+++ b/src/boot/efi/initrd.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <stddef.h>
+#include "efi.h"
 
 EFI_STATUS initrd_register(
                 const void *initrd_address,
diff --git a/src/boot/efi/linux.c b/src/boot/efi/linux.c
index 8feea1d3c9..65bc176df7 100644
--- a/src/boot/efi/linux.c
+++ b/src/boot/efi/linux.c
@@ -8,12 +8,11 @@
  * This method works for Linux 5.8 and newer on ARM/Aarch64, x86/x68_64 and RISC-V.
  */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "initrd.h"
 #include "linux.h"
 #include "pe.h"
+#include "proto/device-path.h"
+#include "proto/loaded-image.h"
 #include "secure-boot.h"
 #include "util.h"
 
@@ -57,14 +56,14 @@ static EFI_STATUS load_image(EFI_HANDLE parent, const void *source, size_t len,
                         .Header = {
                                 .Type = MEDIA_DEVICE_PATH,
                                 .SubType = MEDIA_VENDOR_DP,
-                                .Length = { sizeof(payload_device_path.payload), 0 },
+                                .Length = sizeof(payload_device_path.payload),
                         },
                         .Guid = STUB_PAYLOAD_GUID,
                 },
                 .end = {
                         .Type = END_DEVICE_PATH_TYPE,
                         .SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE,
-                        .Length = { sizeof(payload_device_path.end), 0 },
+                        .Length = sizeof(payload_device_path.end),
                 },
         };
 
diff --git a/src/boot/efi/linux.h b/src/boot/efi/linux.h
index f0a6a37ed1..46b5f4f4d7 100644
--- a/src/boot/efi/linux.h
+++ b/src/boot/efi/linux.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <uchar.h>
+#include "efi.h"
 
 EFI_STATUS linux_exec(
                 EFI_HANDLE parent,
diff --git a/src/boot/efi/linux_x86.c b/src/boot/efi/linux_x86.c
index eaae988d97..5021b076cb 100644
--- a/src/boot/efi/linux_x86.c
+++ b/src/boot/efi/linux_x86.c
@@ -10,9 +10,6 @@
  * see https://docs.kernel.org/x86/boot.html
  */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "initrd.h"
 #include "linux.h"
 #include "macro-fundamental.h"
diff --git a/src/boot/efi/log.c b/src/boot/efi/log.c
index b1a613e4e5..4d8ad93716 100644
--- a/src/boot/efi/log.c
+++ b/src/boot/efi/log.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "log.h"
+#include "proto/simple-text-io.h"
 
 static unsigned log_count = 0;
 
@@ -20,7 +18,7 @@ EFI_STATUS log_internal(EFI_STATUS status, const char *format, ...) {
 
         if (ST->ConOut->Mode->CursorColumn > 0)
                 ST->ConOut->OutputString(ST->ConOut, (char16_t *) u"\r\n");
-        ST->ConOut->SetAttribute(ST->ConOut, EFI_LIGHTRED | EFI_BACKGROUND_BLACK);
+        ST->ConOut->SetAttribute(ST->ConOut, EFI_TEXT_ATTR(EFI_LIGHTRED, EFI_BLACK));
 
         va_list ap;
         va_start(ap, format);
diff --git a/src/boot/efi/measure.c b/src/boot/efi/measure.c
index 2f9b2b9e9d..c2552268d5 100644
--- a/src/boot/efi/measure.c
+++ b/src/boot/efi/measure.c
@@ -2,17 +2,14 @@
 
 #if ENABLE_TPM
 
-#include <efi.h>
-#include <efilib.h>
-
-#include "tpm-pcr.h"
 #include "macro-fundamental.h"
 #include "measure.h"
-#include "missing_efi.h"
+#include "proto/tcg.h"
+#include "tpm-pcr.h"
 #include "util.h"
 
 static EFI_STATUS tpm1_measure_to_pcr_and_event_log(
-                const EFI_TCG *tcg,
+                const EFI_TCG_PROTOCOL *tcg,
                 uint32_t pcrindex,
                 EFI_PHYSICAL_ADDRESS buffer,
                 size_t buffer_size,
@@ -37,7 +34,7 @@ static EFI_STATUS tpm1_measure_to_pcr_and_event_log(
         memcpy(tcg_event->Event, description, desc_len);
 
         return tcg->HashLogExtendEvent(
-                        (EFI_TCG *) tcg,
+                        (EFI_TCG_PROTOCOL *) tcg,
                         buffer, buffer_size,
                         TCG_ALG_SHA,
                         tcg_event,
@@ -46,7 +43,7 @@ static EFI_STATUS tpm1_measure_to_pcr_and_event_log(
 }
 
 static EFI_STATUS tpm2_measure_to_pcr_and_event_log(
-                EFI_TCG2 *tcg,
+                EFI_TCG2_PROTOCOL *tcg,
                 uint32_t pcrindex,
                 EFI_PHYSICAL_ADDRESS buffer,
                 uint64_t buffer_size,
@@ -78,16 +75,16 @@ static EFI_STATUS tpm2_measure_to_pcr_and_event_log(
                         tcg_event);
 }
 
-static EFI_TCG* tcg1_interface_check(void) {
+static EFI_TCG_PROTOCOL *tcg1_interface_check(void) {
         EFI_PHYSICAL_ADDRESS event_log_location, event_log_last_entry;
-        TCG_BOOT_SERVICE_CAPABILITY capability = {
+        EFI_TCG_BOOT_SERVICE_CAPABILITY capability = {
                 .Size = sizeof(capability),
         };
         EFI_STATUS err;
         uint32_t features;
-        EFI_TCG *tcg;
+        EFI_TCG_PROTOCOL *tcg;
 
-        err = BS->LocateProtocol(MAKE_GUID_PTR(EFI_TCG), NULL, (void **) &tcg);
+        err = BS->LocateProtocol(MAKE_GUID_PTR(EFI_TCG_PROTOCOL), NULL, (void **) &tcg);
         if (err != EFI_SUCCESS)
                 return NULL;
 
@@ -109,14 +106,14 @@ static EFI_TCG* tcg1_interface_check(void) {
         return tcg;
 }
 
-static EFI_TCG2* tcg2_interface_check(void) {
+static EFI_TCG2_PROTOCOL *tcg2_interface_check(void) {
         EFI_TCG2_BOOT_SERVICE_CAPABILITY capability = {
                 .Size = sizeof(capability),
         };
         EFI_STATUS err;
-        EFI_TCG2 *tcg;
+        EFI_TCG2_PROTOCOL *tcg;
 
-        err = BS->LocateProtocol(MAKE_GUID_PTR(EFI_TCG2), NULL, (void **) &tcg);
+        err = BS->LocateProtocol(MAKE_GUID_PTR(EFI_TCG2_PROTOCOL), NULL, (void **) &tcg);
         if (err != EFI_SUCCESS)
                 return NULL;
 
@@ -126,8 +123,8 @@ static EFI_TCG2* tcg2_interface_check(void) {
 
         if (capability.StructureVersion.Major == 1 &&
             capability.StructureVersion.Minor == 0) {
-                TCG_BOOT_SERVICE_CAPABILITY *caps_1_0 =
-                        (TCG_BOOT_SERVICE_CAPABILITY*) &capability;
+                EFI_TCG_BOOT_SERVICE_CAPABILITY *caps_1_0 =
+                        (EFI_TCG_BOOT_SERVICE_CAPABILITY*) &capability;
                 if (caps_1_0->TPMPresentFlag)
                         return tcg;
         }
@@ -143,7 +140,7 @@ bool tpm_present(void) {
 }
 
 EFI_STATUS tpm_log_event(uint32_t pcrindex, EFI_PHYSICAL_ADDRESS buffer, size_t buffer_size, const char16_t *description, bool *ret_measured) {
-        EFI_TCG2 *tpm2;
+        EFI_TCG2_PROTOCOL *tpm2;
         EFI_STATUS err;
 
         assert(description || pcrindex == UINT32_MAX);
@@ -162,7 +159,7 @@ EFI_STATUS tpm_log_event(uint32_t pcrindex, EFI_PHYSICAL_ADDRESS buffer, size_t
         if (tpm2)
                 err = tpm2_measure_to_pcr_and_event_log(tpm2, pcrindex, buffer, buffer_size, description);
         else {
-                EFI_TCG *tpm1;
+                EFI_TCG_PROTOCOL *tpm1;
 
                 tpm1 = tcg1_interface_check();
                 if (tpm1)
diff --git a/src/boot/efi/measure.h b/src/boot/efi/measure.h
index 44d23fe75c..d252f0f832 100644
--- a/src/boot/efi/measure.h
+++ b/src/boot/efi/measure.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <stdbool.h>
-#include <uchar.h>
+#include "efi.h"
 
 #if ENABLE_TPM
 
diff --git a/src/boot/efi/meson.build b/src/boot/efi/meson.build
index 6c1934d9f1..01ec8f0171 100644
--- a/src/boot/efi/meson.build
+++ b/src/boot/efi/meson.build
@@ -184,8 +184,6 @@ efi_cflags = [
         '-I', meson.current_source_dir(),
         '-include', efi_config_h,
         '-include', version_h,
-        '-isystem', efi_incdir / efi_arch[1],
-        '-isystem', efi_incdir,
         '-std=gnu11',
         '-Wall',
         '-Wextra',
@@ -338,14 +336,27 @@ efi_headers = files(
         'disk.h',
         'drivers.h',
         'efi-string.h',
+        'efi.h',
         'graphics.h',
         'initrd.h',
         'linux.h',
         'log.h',
         'measure.h',
-        'missing_efi.h',
         'part-discovery.h',
         'pe.h',
+        'proto/block-io.h',
+        'proto/console-control.h',
+        'proto/device-path.h',
+        'proto/dt-fixup.h',
+        'proto/file-io.h',
+        'proto/graphics-output.h',
+        'proto/load-file.h',
+        'proto/loaded-image.h',
+        'proto/rng.h',
+        'proto/security-arch.h',
+        'proto/shell-parameters.h',
+        'proto/simple-text-io.h',
+        'proto/tcg.h',
         'random-seed.h',
         'secure-boot.h',
         'shim.h',
diff --git a/src/boot/efi/missing_efi.h b/src/boot/efi/missing_efi.h
deleted file mode 100644
index 3c35a85e46..0000000000
--- a/src/boot/efi/missing_efi.h
+++ /dev/null
@@ -1,412 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include <efi.h>
-
-#include "macro-fundamental.h"
-
-/* gnu-efi 3.0.13 */
-#ifndef EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL_GUID
-
-#define EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL_GUID \
-    { 0xdd9e7534, 0x7762, 0x4698, {0x8c, 0x14, 0xf5, 0x85, 0x17, 0xa6, 0x25, 0xaa} }
-#define SimpleTextInputExProtocol ((EFI_GUID)EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL_GUID)
-
-#define EFI_SHIFT_STATE_VALID           0x80000000
-#define EFI_RIGHT_SHIFT_PRESSED         0x00000001
-#define EFI_LEFT_SHIFT_PRESSED          0x00000002
-#define EFI_RIGHT_CONTROL_PRESSED       0x00000004
-#define EFI_LEFT_CONTROL_PRESSED        0x00000008
-#define EFI_RIGHT_ALT_PRESSED           0x00000010
-#define EFI_LEFT_ALT_PRESSED            0x00000020
-#define EFI_RIGHT_LOGO_PRESSED          0x00000040
-#define EFI_LEFT_LOGO_PRESSED           0x00000080
-
-struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL;
-
-typedef EFI_STATUS (EFIAPI *EFI_INPUT_RESET_EX)(
-        struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
-        BOOLEAN ExtendedVerification
-);
-
-typedef UINT8 EFI_KEY_TOGGLE_STATE;
-
-typedef struct {
-        UINT32 KeyShiftState;
-        EFI_KEY_TOGGLE_STATE KeyToggleState;
-} EFI_KEY_STATE;
-
-typedef struct {
-        EFI_INPUT_KEY Key;
-        EFI_KEY_STATE KeyState;
-} EFI_KEY_DATA;
-
-typedef EFI_STATUS (EFIAPI *EFI_INPUT_READ_KEY_EX)(
-        struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
-        EFI_KEY_DATA *KeyData
-);
-
-typedef EFI_STATUS (EFIAPI *EFI_SET_STATE)(
-        struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
-        EFI_KEY_TOGGLE_STATE *KeyToggleState
-);
-
-typedef EFI_STATUS (EFIAPI *EFI_KEY_NOTIFY_FUNCTION)(
-        EFI_KEY_DATA *KeyData
-);
-
-typedef EFI_STATUS (EFIAPI *EFI_REGISTER_KEYSTROKE_NOTIFY)(
-        struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
-        EFI_KEY_DATA KeyData,
-        EFI_KEY_NOTIFY_FUNCTION KeyNotificationFunction,
-        VOID **NotifyHandle
-);
-
-typedef EFI_STATUS (EFIAPI *EFI_UNREGISTER_KEYSTROKE_NOTIFY)(
-        struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
-        VOID *NotificationHandle
-);
-
-typedef struct _EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL {
-        EFI_INPUT_RESET_EX Reset;
-        EFI_INPUT_READ_KEY_EX ReadKeyStrokeEx;
-        EFI_EVENT WaitForKeyEx;
-        EFI_SET_STATE SetState;
-        EFI_REGISTER_KEYSTROKE_NOTIFY RegisterKeyNotify;
-        EFI_UNREGISTER_KEYSTROKE_NOTIFY UnregisterKeyNotify;
-} EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL;
-
-#endif
-
-/* gnu-efi 3.0.14 */
-#ifndef EFI_IMAGE_MACHINE_RISCV64
-        #define EFI_IMAGE_MACHINE_RISCV64 0x5064
-#endif
-
-/* gnu-efi 3.0.14 */
-#ifndef EFI_DTB_TABLE_GUID
-#define EFI_DTB_TABLE_GUID \
-        { 0xb1b621d5, 0xf19c, 0x41a5, {0x83, 0x0b, 0xd9, 0x15, 0x2c, 0x69, 0xaa, 0xe0} }
-#define EfiDtbTableGuid ((EFI_GUID)EFI_DTB_TABLE_GUID)
-#endif
-
-#ifndef EFI_DT_FIXUP_PROTOCOL_GUID
-#define EFI_DT_FIXUP_PROTOCOL_GUID \
-        { 0xe617d64c, 0xfe08, 0x46da, {0xf4, 0xdc, 0xbb, 0xd5, 0x87, 0x0c, 0x73, 0x00} }
-#define EfiDtFixupProtocol ((EFI_GUID)EFI_DT_FIXUP_PROTOCOL_GUID)
-
-#define EFI_DT_FIXUP_PROTOCOL_REVISION 0x00010000
-
-/* Add nodes and update properties */
-#define EFI_DT_APPLY_FIXUPS    0x00000001
-/*
- * Reserve memory according to the /reserved-memory node
- * and the memory reservation block
- */
-#define EFI_DT_RESERVE_MEMORY  0x00000002
-
-typedef struct _EFI_DT_FIXUP_PROTOCOL EFI_DT_FIXUP_PROTOCOL;
-
-typedef EFI_STATUS (EFIAPI *EFI_DT_FIXUP) (
-        IN EFI_DT_FIXUP_PROTOCOL *This,
-        IN VOID                  *Fdt,
-        IN OUT UINTN             *BufferSize,
-        IN UINT32                Flags);
-
-struct _EFI_DT_FIXUP_PROTOCOL {
-        UINT64         Revision;
-        EFI_DT_FIXUP   Fixup;
-};
-
-#endif
-
-/* TCG EFI Protocol Specification */
-#ifndef EFI_TCG_GUID
-
-#define EFI_TCG_GUID \
-        { 0xf541796d, 0xa62e, 0x4954, { 0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd } }
-
-typedef struct _TCG_VERSION {
-        UINT8 Major;
-        UINT8 Minor;
-        UINT8 RevMajor;
-        UINT8 RevMinor;
-} TCG_VERSION;
-
-typedef struct tdEFI_TCG2_VERSION {
-        UINT8 Major;
-        UINT8 Minor;
-} EFI_TCG2_VERSION;
-
-typedef struct _TCG_BOOT_SERVICE_CAPABILITY {
-        UINT8 Size;
-        struct _TCG_VERSION StructureVersion;
-        struct _TCG_VERSION ProtocolSpecVersion;
-        UINT8 HashAlgorithmBitmap;
-        BOOLEAN TPMPresentFlag;
-        BOOLEAN TPMDeactivatedFlag;
-} TCG_BOOT_SERVICE_CAPABILITY;
-
-typedef struct tdTREE_BOOT_SERVICE_CAPABILITY {
-        UINT8 Size;
-        EFI_TCG2_VERSION StructureVersion;
-        EFI_TCG2_VERSION ProtocolVersion;
-        UINT32 HashAlgorithmBitmap;
-        UINT32 SupportedEventLogs;
-        BOOLEAN TrEEPresentFlag;
-        UINT16 MaxCommandSize;
-        UINT16 MaxResponseSize;
-        UINT32 ManufacturerID;
-} TREE_BOOT_SERVICE_CAPABILITY;
-
-typedef UINT32 TCG_ALGORITHM_ID;
-#define TCG_ALG_SHA 0x00000004  // The SHA1 algorithm
-
-#define SHA1_DIGEST_SIZE 20
-
-typedef struct _TCG_DIGEST {
-        UINT8 Digest[SHA1_DIGEST_SIZE];
-} TCG_DIGEST;
-
-#define EV_IPL 13
-
-typedef struct _TCG_PCR_EVENT {
-        UINT32 PCRIndex;
-        UINT32 EventType;
-        struct _TCG_DIGEST digest;
-        UINT32 EventSize;
-        UINT8 Event[1];
-} TCG_PCR_EVENT;
-
-INTERFACE_DECL(_EFI_TCG);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG_STATUS_CHECK) (IN struct _EFI_TCG * This,
-                                                   OUT struct _TCG_BOOT_SERVICE_CAPABILITY * ProtocolCapability,
-                                                   OUT UINT32 * TCGFeatureFlags,
-                                                   OUT EFI_PHYSICAL_ADDRESS * EventLogLocation,
-                                                   OUT EFI_PHYSICAL_ADDRESS * EventLogLastEntry);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG_HASH_ALL) (IN struct _EFI_TCG * This,
-                                               IN UINT8 * HashData,
-                                               IN UINT64 HashDataLen,
-                                               IN TCG_ALGORITHM_ID AlgorithmId,
-                                               IN OUT UINT64 * HashedDataLen, IN OUT UINT8 ** HashedDataResult);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG_LOG_EVENT) (IN struct _EFI_TCG * This,
-                                                IN struct _TCG_PCR_EVENT * TCGLogData,
-                                                IN OUT UINT32 * EventNumber, IN UINT32 Flags);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG_PASS_THROUGH_TO_TPM) (IN struct _EFI_TCG * This,
-                                                          IN UINT32 TpmInputParameterBlockSize,
-                                                          IN UINT8 * TpmInputParameterBlock,
-                                                          IN UINT32 TpmOutputParameterBlockSize,
-                                                          IN UINT8 * TpmOutputParameterBlock);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG_HASH_LOG_EXTEND_EVENT) (IN struct _EFI_TCG * This,
-                                                            IN EFI_PHYSICAL_ADDRESS HashData,
-                                                            IN UINT64 HashDataLen,
-                                                            IN TCG_ALGORITHM_ID AlgorithmId,
-                                                            IN struct _TCG_PCR_EVENT * TCGLogData,
-                                                            IN OUT UINT32 * EventNumber,
-                                                            OUT EFI_PHYSICAL_ADDRESS * EventLogLastEntry);
-
-typedef struct _EFI_TCG {
-        EFI_TCG_STATUS_CHECK StatusCheck;
-        EFI_TCG_HASH_ALL HashAll;
-        EFI_TCG_LOG_EVENT LogEvent;
-        EFI_TCG_PASS_THROUGH_TO_TPM PassThroughToTPM;
-        EFI_TCG_HASH_LOG_EXTEND_EVENT HashLogExtendEvent;
-} EFI_TCG;
-
-#endif
-
-/* TCG EFI Protocol Specification */
-#ifndef EFI_TCG2_GUID
-
-#define EFI_TCG2_GUID \
-        { 0x607f766c, 0x7455, 0x42be, { 0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f } }
-
-typedef struct tdEFI_TCG2_PROTOCOL EFI_TCG2_PROTOCOL;
-
-typedef UINT32 EFI_TCG2_EVENT_LOG_BITMAP;
-typedef UINT32 EFI_TCG2_EVENT_LOG_FORMAT;
-typedef UINT32 EFI_TCG2_EVENT_ALGORITHM_BITMAP;
-
-typedef struct tdEFI_TCG2_BOOT_SERVICE_CAPABILITY {
-        UINT8 Size;
-        EFI_TCG2_VERSION StructureVersion;
-        EFI_TCG2_VERSION ProtocolVersion;
-        EFI_TCG2_EVENT_ALGORITHM_BITMAP HashAlgorithmBitmap;
-        EFI_TCG2_EVENT_LOG_BITMAP SupportedEventLogs;
-        BOOLEAN TPMPresentFlag;
-        UINT16 MaxCommandSize;
-        UINT16 MaxResponseSize;
-        UINT32 ManufacturerID;
-        UINT32 NumberOfPCRBanks;
-        EFI_TCG2_EVENT_ALGORITHM_BITMAP ActivePcrBanks;
-} EFI_TCG2_BOOT_SERVICE_CAPABILITY;
-
-#define EFI_TCG2_EVENT_HEADER_VERSION  1
-
-typedef struct {
-        UINT32 HeaderSize;
-        UINT16 HeaderVersion;
-        UINT32 PCRIndex;
-        UINT32 EventType;
-} _packed_ EFI_TCG2_EVENT_HEADER;
-
-typedef struct tdEFI_TCG2_EVENT {
-        UINT32 Size;
-        EFI_TCG2_EVENT_HEADER Header;
-        UINT8 Event[1];
-} _packed_ EFI_TCG2_EVENT;
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_GET_CAPABILITY) (IN EFI_TCG2_PROTOCOL * This,
-                                                      IN OUT EFI_TCG2_BOOT_SERVICE_CAPABILITY * ProtocolCapability);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_GET_EVENT_LOG) (IN EFI_TCG2_PROTOCOL * This,
-                                                     IN EFI_TCG2_EVENT_LOG_FORMAT EventLogFormat,
-                                                     OUT EFI_PHYSICAL_ADDRESS * EventLogLocation,
-                                                     OUT EFI_PHYSICAL_ADDRESS * EventLogLastEntry,
-                                                     OUT BOOLEAN * EventLogTruncated);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_HASH_LOG_EXTEND_EVENT) (IN EFI_TCG2_PROTOCOL * This,
-                                                             IN UINT64 Flags,
-                                                             IN EFI_PHYSICAL_ADDRESS DataToHash,
-                                                             IN UINT64 DataToHashLen, IN EFI_TCG2_EVENT * EfiTcgEvent);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_SUBMIT_COMMAND) (IN EFI_TCG2_PROTOCOL * This,
-                                                      IN UINT32 InputParameterBlockSize,
-                                                      IN UINT8 * InputParameterBlock,
-                                                      IN UINT32 OutputParameterBlockSize, IN UINT8 * OutputParameterBlock);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_GET_ACTIVE_PCR_BANKS) (IN EFI_TCG2_PROTOCOL * This, OUT UINT32 * ActivePcrBanks);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_SET_ACTIVE_PCR_BANKS) (IN EFI_TCG2_PROTOCOL * This, IN UINT32 ActivePcrBanks);
-
-typedef EFI_STATUS(EFIAPI * EFI_TCG2_GET_RESULT_OF_SET_ACTIVE_PCR_BANKS) (IN EFI_TCG2_PROTOCOL * This,
-                                                                          OUT UINT32 * OperationPresent, OUT UINT32 * Response);
-
-typedef struct tdEFI_TCG2_PROTOCOL {
-        EFI_TCG2_GET_CAPABILITY GetCapability;
-        EFI_TCG2_GET_EVENT_LOG GetEventLog;
-        EFI_TCG2_HASH_LOG_EXTEND_EVENT HashLogExtendEvent;
-        EFI_TCG2_SUBMIT_COMMAND SubmitCommand;
-        EFI_TCG2_GET_ACTIVE_PCR_BANKS GetActivePcrBanks;
-        EFI_TCG2_SET_ACTIVE_PCR_BANKS SetActivePcrBanks;
-        EFI_TCG2_GET_RESULT_OF_SET_ACTIVE_PCR_BANKS GetResultOfSetActivePcrBanks;
-} EFI_TCG2;
-
-#endif
-
-#ifndef EFI_LOAD_FILE2_PROTOCOL_GUID
-#define EFI_LOAD_FILE2_PROTOCOL_GUID \
-        {0x4006c0c1, 0xfcb3, 0x403e, {0x99, 0x6d, 0x4a, 0x6c, 0x87, 0x24, 0xe0, 0x6d} }
-#define EfiLoadFile2Protocol ((EFI_GUID)EFI_LOAD_FILE2_PROTOCOL_GUID)
-#endif
-
-#define LINUX_INITRD_MEDIA_GUID \
-        {0x5568e427, 0x68fc, 0x4f3d, {0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68} }
-
-/* UEFI Platform Initialization (Vol2: DXE) */
-#ifndef EFI_SECURITY_ARCH_PROTOCOL_GUID
-
-#define EFI_SECURITY_ARCH_PROTOCOL_GUID \
-        { 0xa46423e3, 0x4617, 0x49f1, { 0xb9, 0xff, 0xd1, 0xbf, 0xa9, 0x11, 0x58, 0x39 } }
-#define EFI_SECURITY2_ARCH_PROTOCOL_GUID \
-        { 0x94ab2f58, 0x1438, 0x4ef1, { 0x91, 0x52, 0x18, 0x94, 0x1a, 0x3a, 0x0e, 0x68 } }
-
-typedef struct EFI_SECURITY_ARCH_PROTOCOL EFI_SECURITY_ARCH_PROTOCOL;
-typedef struct EFI_SECURITY2_ARCH_PROTOCOL EFI_SECURITY2_ARCH_PROTOCOL;
-
-typedef EFI_STATUS (EFIAPI *EFI_SECURITY_FILE_AUTHENTICATION_STATE)(
-                const EFI_SECURITY_ARCH_PROTOCOL *This,
-                uint32_t AuthenticationStatus,
-                const EFI_DEVICE_PATH *File);
-
-struct EFI_SECURITY_ARCH_PROTOCOL {
-        EFI_SECURITY_FILE_AUTHENTICATION_STATE FileAuthenticationState;
-};
-
-typedef EFI_STATUS (EFIAPI *EFI_SECURITY2_FILE_AUTHENTICATION)(
-                const EFI_SECURITY2_ARCH_PROTOCOL *This,
-                const EFI_DEVICE_PATH *DevicePath,
-                void *FileBuffer,
-                UINTN FileSize,
-                BOOLEAN BootPolicy);
-
-struct EFI_SECURITY2_ARCH_PROTOCOL {
-        EFI_SECURITY2_FILE_AUTHENTICATION FileAuthentication;
-};
-
-#endif
-
-#ifndef EFI_CONSOLE_CONTROL_GUID
-
-#define EFI_CONSOLE_CONTROL_GUID \
-        { 0xf42f7782, 0x12e, 0x4c12, { 0x99, 0x56, 0x49, 0xf9, 0x43, 0x4, 0xf7, 0x21 } }
-
-struct _EFI_CONSOLE_CONTROL_PROTOCOL;
-
-typedef enum {
-        EfiConsoleControlScreenText,
-        EfiConsoleControlScreenGraphics,
-        EfiConsoleControlScreenMaxValue,
-} EFI_CONSOLE_CONTROL_SCREEN_MODE;
-
-typedef EFI_STATUS (EFIAPI *EFI_CONSOLE_CONTROL_PROTOCOL_GET_MODE)(
-        struct _EFI_CONSOLE_CONTROL_PROTOCOL *This,
-        EFI_CONSOLE_CONTROL_SCREEN_MODE *Mode,
-        BOOLEAN *UgaExists,
-        BOOLEAN *StdInLocked
-);
-
-typedef EFI_STATUS (EFIAPI *EFI_CONSOLE_CONTROL_PROTOCOL_SET_MODE)(
-        struct _EFI_CONSOLE_CONTROL_PROTOCOL *This,
-        EFI_CONSOLE_CONTROL_SCREEN_MODE Mode
-);
-
-typedef EFI_STATUS (EFIAPI *EFI_CONSOLE_CONTROL_PROTOCOL_LOCK_STD_IN)(
-        struct _EFI_CONSOLE_CONTROL_PROTOCOL *This,
-        CHAR16 *Password
-);
-
-typedef struct _EFI_CONSOLE_CONTROL_PROTOCOL {
-        EFI_CONSOLE_CONTROL_PROTOCOL_GET_MODE GetMode;
-        EFI_CONSOLE_CONTROL_PROTOCOL_SET_MODE SetMode;
-        EFI_CONSOLE_CONTROL_PROTOCOL_LOCK_STD_IN LockStdIn;
-} EFI_CONSOLE_CONTROL_PROTOCOL;
-
-#endif
-
-#ifndef EFI_IMAGE_SECURITY_DATABASE_VARIABLE
-
-#define EFI_IMAGE_SECURITY_DATABASE_VARIABLE \
-        { 0xd719b2cb, 0x3d3a, 0x4596, {0xa3, 0xbc, 0xda, 0xd0,  0xe, 0x67, 0x65, 0x6f }}
-
-#endif
-
-#ifndef EFI_SHELL_PARAMETERS_PROTOCOL_GUID
-#  define EFI_SHELL_PARAMETERS_PROTOCOL_GUID \
-        { 0x752f3136, 0x4e16, 0x4fdc, { 0xa2, 0x2a, 0xe5, 0xf4, 0x68, 0x12, 0xf4, 0xca } }
-
-typedef struct {
-        CHAR16 **Argv;
-        UINTN Argc;
-        void *StdIn;
-        void *StdOut;
-        void *StdErr;
-} EFI_SHELL_PARAMETERS_PROTOCOL;
-#endif
-
-#ifndef EFI_WARN_UNKNOWN_GLYPH
-#  define EFI_WARN_UNKNOWN_GLYPH 1
-#endif
-
-#ifndef EFI_WARN_RESET_REQUIRED
-#  define EFI_WARN_STALE_DATA 5
-#  define EFI_WARN_FILE_SYSTEM 6
-#  define EFI_WARN_RESET_REQUIRED 7
-#  define EFI_IP_ADDRESS_CONFLICT EFIERR(34)
-#  define EFI_HTTP_ERROR EFIERR(35)
-#endif
diff --git a/src/boot/efi/part-discovery.c b/src/boot/efi/part-discovery.c
index eb22df95b6..e25905ff48 100644
--- a/src/boot/efi/part-discovery.c
+++ b/src/boot/efi/part-discovery.c
@@ -1,16 +1,33 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efigpt.h>
-#include <efilib.h>
-
 #include "part-discovery.h"
+#include "proto/block-io.h"
+#include "proto/device-path.h"
 #include "util.h"
 
-union GptHeaderBuffer {
-        EFI_PARTITION_TABLE_HEADER gpt_header;
-        uint8_t space[CONST_ALIGN_TO(sizeof(EFI_PARTITION_TABLE_HEADER), 512)];
-};
+typedef struct {
+        EFI_GUID PartitionTypeGUID;
+        EFI_GUID UniquePartitionGUID;
+        EFI_LBA StartingLBA;
+        EFI_LBA EndingLBA;
+        uint64_t Attributes;
+        char16_t PartitionName[36];
+} EFI_PARTITION_ENTRY;
+
+typedef struct {
+        EFI_TABLE_HEADER Header;
+        EFI_LBA MyLBA;
+        EFI_LBA AlternateLBA;
+        EFI_LBA FirstUsableLBA;
+        EFI_LBA LastUsableLBA;
+        EFI_GUID DiskGUID;
+        EFI_LBA PartitionEntryLBA;
+        uint32_t NumberOfPartitionEntries;
+        uint32_t SizeOfPartitionEntry;
+        uint32_t PartitionEntryArrayCRC32;
+        uint8_t _pad[420];
+} _packed_ GptHeader;
+assert_cc(sizeof(GptHeader) == 512);
 
 static EFI_DEVICE_PATH *path_replace_hd(
                 const EFI_DEVICE_PATH *path,
@@ -27,7 +44,7 @@ static EFI_DEVICE_PATH *path_replace_hd(
         if (new_node)
                 new_node_len = DevicePathNodeLength(&new_node->Header);
 
-        EFI_DEVICE_PATH *ret = xmalloc(len + new_node_len + END_DEVICE_PATH_LENGTH);
+        EFI_DEVICE_PATH *ret = xmalloc(len + new_node_len + sizeof(EFI_DEVICE_PATH));
         EFI_DEVICE_PATH *end = mempcpy(ret, path, len);
 
         if (new_node)
@@ -37,14 +54,11 @@ static EFI_DEVICE_PATH *path_replace_hd(
         return ret;
 }
 
-static bool verify_gpt(union GptHeaderBuffer *gpt_header_buffer, EFI_LBA lba_expected) {
-        EFI_PARTITION_TABLE_HEADER *h;
+static bool verify_gpt(/*const*/ GptHeader *h, EFI_LBA lba_expected) {
         uint32_t crc32, crc32_saved;
         EFI_STATUS err;
 
-        assert(gpt_header_buffer);
-
-        h = &gpt_header_buffer->gpt_header;
+        assert(h);
 
         /* Some superficial validation of the GPT header */
         if (memcmp(&h->Header.Signature, "EFI PART", sizeof(h->Header.Signature)) != 0)
@@ -59,7 +73,7 @@ static bool verify_gpt(union GptHeaderBuffer *gpt_header_buffer, EFI_LBA lba_exp
         /* Calculate CRC check */
         crc32_saved = h->Header.CRC32;
         h->Header.CRC32 = 0;
-        err = BS->CalculateCrc32(gpt_header_buffer, h->Header.HeaderSize, &crc32);
+        err = BS->CalculateCrc32(h, h->Header.HeaderSize, &crc32);
         h->Header.CRC32 = crc32_saved;
         if (err != EFI_SUCCESS || crc32 != crc32_saved)
                 return false;
@@ -88,7 +102,7 @@ static EFI_STATUS try_gpt(
                 HARDDRIVE_DEVICE_PATH *ret_hd) {
 
         _cleanup_free_ EFI_PARTITION_ENTRY *entries = NULL;
-        union GptHeaderBuffer gpt;
+        GptHeader gpt;
         EFI_STATUS err;
         uint32_t crc32;
         size_t size;
@@ -107,32 +121,32 @@ static EFI_STATUS try_gpt(
 
         /* Indicate the location of backup LBA even if the rest of the header is corrupt. */
         if (ret_backup_lba)
-                *ret_backup_lba = gpt.gpt_header.AlternateLBA;
+                *ret_backup_lba = gpt.AlternateLBA;
 
         if (!verify_gpt(&gpt, lba))
                 return EFI_NOT_FOUND;
 
         /* Now load the GPT entry table */
-        size = ALIGN_TO((size_t) gpt.gpt_header.SizeOfPartitionEntry * (size_t) gpt.gpt_header.NumberOfPartitionEntries, 512);
+        size = ALIGN_TO((size_t) gpt.SizeOfPartitionEntry * (size_t) gpt.NumberOfPartitionEntries, 512);
         entries = xmalloc(size);
 
         err = block_io->ReadBlocks(
                         block_io,
                         block_io->Media->MediaId,
-                        gpt.gpt_header.PartitionEntryLBA,
+                        gpt.PartitionEntryLBA,
                         size, entries);
         if (err != EFI_SUCCESS)
                 return err;
 
         /* Calculate CRC of entries array, too */
         err = BS->CalculateCrc32(entries, size, &crc32);
-        if (err != EFI_SUCCESS || crc32 != gpt.gpt_header.PartitionEntryArrayCRC32)
+        if (err != EFI_SUCCESS || crc32 != gpt.PartitionEntryArrayCRC32)
                 return EFI_CRC_ERROR;
 
         /* Now we can finally look for xbootloader partitions. */
-        for (size_t i = 0; i < gpt.gpt_header.NumberOfPartitionEntries; i++) {
+        for (size_t i = 0; i < gpt.NumberOfPartitionEntries; i++) {
                 EFI_PARTITION_ENTRY *entry =
-                                (EFI_PARTITION_ENTRY *) ((uint8_t *) entries + gpt.gpt_header.SizeOfPartitionEntry * i);
+                                (EFI_PARTITION_ENTRY *) ((uint8_t *) entries + gpt.SizeOfPartitionEntry * i);
 
                 if (!efi_guid_equal(&entry->PartitionTypeGUID, type))
                         continue;
@@ -144,6 +158,7 @@ static EFI_STATUS try_gpt(
                         .Header = {
                                 .Type = MEDIA_DEVICE_PATH,
                                 .SubType = MEDIA_HARDDRIVE_DP,
+                                .Length = sizeof(HARDDRIVE_DEVICE_PATH),
                         },
                         .PartitionNumber = i + 1,
                         .PartitionStart = entry->StartingLBA,
@@ -153,11 +168,6 @@ static EFI_STATUS try_gpt(
                 };
                 memcpy(ret_hd->Signature, &entry->UniquePartitionGUID, sizeof(ret_hd->Signature));
 
-                /* HARDDRIVE_DEVICE_PATH has padding, which at least OVMF does not like. */
-                SetDevicePathNodeLength(
-                                &ret_hd->Header,
-                                offsetof(HARDDRIVE_DEVICE_PATH, SignatureType) + sizeof(ret_hd->SignatureType));
-
                 return EFI_SUCCESS;
         }
 
diff --git a/src/boot/efi/part-discovery.h b/src/boot/efi/part-discovery.h
index 18d34ec7f8..597ded3b3e 100644
--- a/src/boot/efi/part-discovery.h
+++ b/src/boot/efi/part-discovery.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
+#include "efi.h"
 
 #define XBOOTLDR_GUID \
         { 0xbc13c2ff, 0x59e6, 0x4262, { 0xa3, 0x52, 0xb2, 0x75, 0xfd, 0x6f, 0x71, 0x72 } }
diff --git a/src/boot/efi/pe.c b/src/boot/efi/pe.c
index c946ce2b0a..5128eeecb5 100644
--- a/src/boot/efi/pe.c
+++ b/src/boot/efi/pe.c
@@ -1,9 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
-#include "missing_efi.h"
 #include "pe.h"
 #include "util.h"
 
@@ -12,16 +8,16 @@
 #define MAX_SECTIONS 96
 
 #if defined(__i386__)
-#  define TARGET_MACHINE_TYPE EFI_IMAGE_MACHINE_IA32
-#  define TARGET_MACHINE_TYPE_COMPATIBILITY EFI_IMAGE_MACHINE_X64
+#  define TARGET_MACHINE_TYPE 0x014CU
+#  define TARGET_MACHINE_TYPE_COMPATIBILITY 0x8664U
 #elif defined(__x86_64__)
-#  define TARGET_MACHINE_TYPE EFI_IMAGE_MACHINE_X64
+#  define TARGET_MACHINE_TYPE 0x8664U
 #elif defined(__aarch64__)
-#  define TARGET_MACHINE_TYPE EFI_IMAGE_MACHINE_AARCH64
+#  define TARGET_MACHINE_TYPE 0xAA64U
 #elif defined(__arm__)
-#  define TARGET_MACHINE_TYPE EFI_IMAGE_MACHINE_ARMTHUMB_MIXED
+#  define TARGET_MACHINE_TYPE 0x01C2U
 #elif defined(__riscv) && __riscv_xlen == 64
-#  define TARGET_MACHINE_TYPE EFI_IMAGE_MACHINE_RISCV64
+#  define TARGET_MACHINE_TYPE 0x5064U
 #else
 #  error Unknown EFI arch
 #endif
diff --git a/src/boot/efi/pe.h b/src/boot/efi/pe.h
index 99dcbb3a1b..7e2258fceb 100644
--- a/src/boot/efi/pe.h
+++ b/src/boot/efi/pe.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efidef.h>
-#include <uchar.h>
+#include "efi.h"
 
 EFI_STATUS pe_memory_locate_sections(
                 const void *base,
diff --git a/src/boot/efi/proto/block-io.h b/src/boot/efi/proto/block-io.h
new file mode 100644
index 0000000000..e977f70e48
--- /dev/null
+++ b/src/boot/efi/proto/block-io.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_BLOCK_IO_PROTOCOL_GUID \
+        GUID_DEF(0x0964e5b21, 0x6459, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+
+typedef struct EFI_BLOCK_IO_PROTOCOL EFI_BLOCK_IO_PROTOCOL;
+struct EFI_BLOCK_IO_PROTOCOL {
+        uint64_t Revision;
+        struct {
+                uint32_t MediaId;
+                bool RemovableMedia;
+                bool MediaPresent;
+                bool LogicalPartition;
+                bool ReadOnly;
+                bool WriteCaching;
+                uint32_t BlockSize;
+                uint32_t IoAlign;
+                EFI_LBA LastBlock;
+                EFI_LBA LowestAlignedLba;
+                uint32_t LogicalBlocksPerPhysicalBlock;
+                uint32_t OptimalTransferLengthGranularity;
+        } *Media;
+
+        EFI_STATUS (EFIAPI *Reset)(
+                        EFI_BLOCK_IO_PROTOCOL *This,
+                        bool ExtendedVerification);
+        EFI_STATUS (EFIAPI *ReadBlocks)(
+                        EFI_BLOCK_IO_PROTOCOL *This,
+                        uint32_t MediaId,
+                        EFI_LBA LBA,
+                        size_t BufferSize,
+                        void *Buffer);
+        EFI_STATUS (EFIAPI *WriteBlocks)(
+                        EFI_BLOCK_IO_PROTOCOL *This,
+                        uint32_t MediaId,
+                        EFI_LBA LBA,
+                        size_t BufferSize,
+                        void *Buffer);
+        EFI_STATUS (EFIAPI *FlushBlocks)(EFI_BLOCK_IO_PROTOCOL *This);
+};
diff --git a/src/boot/efi/proto/console-control.h b/src/boot/efi/proto/console-control.h
new file mode 100644
index 0000000000..d3a92ea537
--- /dev/null
+++ b/src/boot/efi/proto/console-control.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_CONSOLE_CONTROL_PROTOCOL_GUID \
+        GUID_DEF(0xf42f7782, 0x12e, 0x4c12, 0x99, 0x56, 0x49, 0xf9, 0x43, 0x4, 0xf7, 0x21)
+
+typedef enum {
+        EfiConsoleControlScreenText,
+        EfiConsoleControlScreenGraphics,
+        EfiConsoleControlScreenMaxValue,
+} EFI_CONSOLE_CONTROL_SCREEN_MODE;
+
+typedef struct EFI_CONSOLE_CONTROL_PROTOCOL EFI_CONSOLE_CONTROL_PROTOCOL;
+struct EFI_CONSOLE_CONTROL_PROTOCOL {
+        EFI_STATUS (EFIAPI *GetMode)(
+                        EFI_CONSOLE_CONTROL_PROTOCOL *This,
+                        EFI_CONSOLE_CONTROL_SCREEN_MODE *Mode,
+                        bool *UgaExists,
+                        bool *StdInLocked);
+        EFI_STATUS (EFIAPI *SetMode)(
+                        EFI_CONSOLE_CONTROL_PROTOCOL *This,
+                        EFI_CONSOLE_CONTROL_SCREEN_MODE Mode);
+        EFI_STATUS(EFIAPI *LockStdIn)(
+                        EFI_CONSOLE_CONTROL_PROTOCOL *This,
+                        char16_t *Password);
+};
diff --git a/src/boot/efi/proto/device-path.h b/src/boot/efi/proto/device-path.h
new file mode 100644
index 0000000000..8d8bd0c3f7
--- /dev/null
+++ b/src/boot/efi/proto/device-path.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_DEVICE_PATH_PROTOCOL_GUID \
+        GUID_DEF(0x09576e91, 0x6d3f, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+#define EFI_DEVICE_PATH_TO_TEXT_PROTOCOL_GUID \
+        GUID_DEF(0x8b843e20, 0x8132, 0x4852, 0x90, 0xcc, 0x55, 0x1a, 0x4e, 0x4a, 0x7f, 0x1c)
+#define EFI_DEVICE_PATH_FROM_TEXT_PROTOCOL_GUID \
+        GUID_DEF(0x05c99a21, 0xc70f, 0x4ad2, 0x8a, 0x5f, 0x35, 0xdf, 0x33, 0x43, 0xf5, 0x1e)
+
+/* Device path types. */
+enum {
+        HARDWARE_DEVICE_PATH  = 0x01,
+        ACPI_DEVICE_PATH      = 0x02,
+        MESSAGING_DEVICE_PATH = 0x03,
+        MEDIA_DEVICE_PATH     = 0x04,
+        BBS_DEVICE_PATH       = 0x05,
+        END_DEVICE_PATH_TYPE  = 0x7f,
+};
+
+/* Device path sub-types. */
+enum {
+        END_INSTANCE_DEVICE_PATH_SUBTYPE = 0x01,
+        END_ENTIRE_DEVICE_PATH_SUBTYPE   = 0xff,
+
+        MEDIA_HARDDRIVE_DP               = 0x01,
+        MEDIA_VENDOR_DP                  = 0x03,
+        MEDIA_FILEPATH_DP                = 0x04,
+        MEDIA_PIWG_FW_FILE_DP            = 0x06,
+        MEDIA_PIWG_FW_VOL_DP             = 0x07,
+};
+
+struct _packed_ EFI_DEVICE_PATH_PROTOCOL {
+        uint8_t Type;
+        uint8_t SubType;
+        uint16_t Length;
+};
+
+typedef struct {
+        EFI_DEVICE_PATH Header;
+        EFI_GUID Guid;
+} _packed_ VENDOR_DEVICE_PATH;
+
+#define MBR_TYPE_PCAT                        0x01U
+#define MBR_TYPE_EFI_PARTITION_TABLE_HEADER  0x02U
+#define NO_DISK_SIGNATURE    0x00U
+#define SIGNATURE_TYPE_MBR   0x01U
+#define SIGNATURE_TYPE_GUID  0x02U
+
+typedef struct {
+        EFI_DEVICE_PATH Header;
+        uint32_t PartitionNumber;
+        uint64_t PartitionStart;
+        uint64_t PartitionSize;
+        uint8_t Signature[16];
+        uint8_t MBRType;
+        uint8_t SignatureType;
+} _packed_ HARDDRIVE_DEVICE_PATH;
+
+typedef struct {
+        EFI_DEVICE_PATH Header;
+        char16_t PathName[];
+} _packed_ FILEPATH_DEVICE_PATH;
+
+typedef struct {
+        char16_t* (EFIAPI *ConvertDeviceNodeToText)(
+                        const EFI_DEVICE_PATH *DeviceNode,
+                        bool DisplayOnly,
+                        bool AllowShortcuts);
+        char16_t* (EFIAPI *ConvertDevicePathToText)(
+                        const EFI_DEVICE_PATH *DevicePath,
+                        bool DisplayOnly,
+                        bool AllowShortcuts);
+} EFI_DEVICE_PATH_TO_TEXT_PROTOCOL;
+
+typedef struct {
+        EFI_DEVICE_PATH* (EFIAPI *ConvertTextToDevicNode)(
+                        const char16_t *TextDeviceNode);
+        EFI_DEVICE_PATH* (EFIAPI *ConvertTextToDevicPath)(
+                        const char16_t *ConvertTextToDevicPath);
+} EFI_DEVICE_PATH_FROM_TEXT_PROTOCOL;
+
+#define DevicePathType(dp) ((dp)->Type)
+#define DevicePathSubType(dp) ((dp)->SubType)
+#define DevicePathNodeLength(dp) ((dp)->Length)
+
+static inline EFI_DEVICE_PATH *NextDevicePathNode(const EFI_DEVICE_PATH *dp) {
+        assert(dp);
+        return (EFI_DEVICE_PATH *) ((uint8_t *) dp + dp->Length);
+}
+
+static inline bool IsDevicePathEnd(const EFI_DEVICE_PATH *dp) {
+        assert(dp);
+        return dp->Type == END_DEVICE_PATH_TYPE && dp->SubType == END_ENTIRE_DEVICE_PATH_SUBTYPE;
+}
+
+static inline void SetDevicePathEndNode(EFI_DEVICE_PATH *dp) {
+        assert(dp);
+        dp->Type = END_DEVICE_PATH_TYPE;
+        dp->SubType = END_ENTIRE_DEVICE_PATH_SUBTYPE;
+        dp->Length = sizeof(EFI_DEVICE_PATH);
+}
diff --git a/src/boot/efi/proto/dt-fixup.h b/src/boot/efi/proto/dt-fixup.h
new file mode 100644
index 0000000000..6edbef58e0
--- /dev/null
+++ b/src/boot/efi/proto/dt-fixup.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_DTB_TABLE_GUID \
+        GUID_DEF(0xb1b621d5, 0xf19c, 0x41a5, 0x83, 0x0b, 0xd9, 0x15, 0x2c, 0x69, 0xaa, 0xe0)
+#define EFI_DT_FIXUP_PROTOCOL_GUID \
+        GUID_DEF(0xe617d64c, 0xfe08, 0x46da, 0xf4, 0xdc, 0xbb, 0xd5, 0x87, 0x0c, 0x73, 0x00)
+
+#define EFI_DT_FIXUP_PROTOCOL_REVISION 0x00010000
+
+/* Add nodes and update properties */
+#define EFI_DT_APPLY_FIXUPS 0x00000001
+
+/*
+ * Reserve memory according to the /reserved-memory node
+ * and the memory reservation block
+ */
+#define EFI_DT_RESERVE_MEMORY 0x00000002
+
+typedef struct EFI_DT_FIXUP_PROTOCOL EFI_DT_FIXUP_PROTOCOL;
+struct EFI_DT_FIXUP_PROTOCOL {
+        uint64_t Revision;
+        EFI_STATUS (EFIAPI *Fixup)(
+                EFI_DT_FIXUP_PROTOCOL *This,
+                void *Fdt,
+                size_t *BufferSize,
+                uint32_t Flags);
+};
diff --git a/src/boot/efi/proto/file-io.h b/src/boot/efi/proto/file-io.h
new file mode 100644
index 0000000000..106c267fdf
--- /dev/null
+++ b/src/boot/efi/proto/file-io.h
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID \
+        GUID_DEF(0x0964e5b22, 0x6459, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+#define EFI_FILE_INFO_ID \
+        GUID_DEF(0x009576e92, 0x6d3f, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+
+#define EFI_FILE_MODE_READ   0x0000000000000001U
+#define EFI_FILE_MODE_WRITE  0x0000000000000002U
+#define EFI_FILE_MODE_CREATE 0x8000000000000000U
+
+#define EFI_FILE_READ_ONLY  0x01U
+#define EFI_FILE_HIDDEN     0x02U
+#define EFI_FILE_SYSTEM     0x04U
+#define EFI_FILE_RESERVED   0x08U
+#define EFI_FILE_DIRECTORY  0x10U
+#define EFI_FILE_ARCHIVE    0x20U
+#define EFI_FILE_VALID_ATTR 0x37U
+
+typedef struct {
+        uint64_t Size;
+        uint64_t FileSize;
+        uint64_t PhysicalSize;
+        EFI_TIME CreateTime;
+        EFI_TIME LastAccessTime;
+        EFI_TIME ModificationTime;
+        uint64_t Attribute;
+        char16_t FileName[];
+} EFI_FILE_INFO;
+
+typedef struct EFI_SIMPLE_FILE_SYSTEM_PROTOCOL EFI_SIMPLE_FILE_SYSTEM_PROTOCOL;
+struct EFI_SIMPLE_FILE_SYSTEM_PROTOCOL {
+        uint64_t Revision;
+        EFI_STATUS (EFIAPI *OpenVolume)(
+                        EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *This,
+                        EFI_FILE **Root);
+};
+
+struct EFI_FILE_PROTOCOL {
+        uint64_t Revision;
+        EFI_STATUS (EFIAPI *Open)(
+                        EFI_FILE *This,
+                        EFI_FILE **NewHandle,
+                        char16_t *FileName,
+                        uint64_t OpenMode,
+                        uint64_t Attributes);
+        EFI_STATUS (EFIAPI *Close)(EFI_FILE *This);
+        EFI_STATUS (EFIAPI *Delete)(EFI_FILE *This);
+        EFI_STATUS (EFIAPI *Read)(
+                        EFI_FILE *This,
+                        size_t *BufferSize,
+                        void *Buffer);
+        EFI_STATUS (EFIAPI *Write)(
+                        EFI_FILE *This,
+                        size_t *BufferSize,
+                        void *Buffer);
+        EFI_STATUS (EFIAPI *GetPosition)(EFI_FILE *This, uint64_t *Position);
+        EFI_STATUS (EFIAPI *SetPosition)(EFI_FILE *This, uint64_t Position);
+        EFI_STATUS (EFIAPI *GetInfo)(
+                        EFI_FILE *This,
+                        EFI_GUID *InformationType,
+                        size_t *BufferSize,
+                        void *Buffer);
+        EFI_STATUS (EFIAPI *SetInfo)(
+                        EFI_FILE *This,
+                        EFI_GUID *InformationType,
+                        size_t BufferSize,
+                        void *Buffer);
+        EFI_STATUS (EFIAPI *Flush)(EFI_FILE *This);
+        void *OpenEx;
+        void *ReadEx;
+        void *WriteEx;
+        void *FlushEx;
+};
diff --git a/src/boot/efi/proto/graphics-output.h b/src/boot/efi/proto/graphics-output.h
new file mode 100644
index 0000000000..f49e5809f7
--- /dev/null
+++ b/src/boot/efi/proto/graphics-output.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID \
+        GUID_DEF(0x9042a9de, 0x23dc, 0x4a38, 0x96, 0xfb, 0x7a, 0xde, 0xd0, 0x80, 0x51, 0x6a)
+
+typedef enum {
+        PixelRedGreenBlueReserved8BitPerColor,
+        PixelBlueGreenRedReserved8BitPerColor,
+        PixelBitMask,
+        PixelBltOnly,
+        PixelFormatMax,
+} EFI_GRAPHICS_PIXEL_FORMAT;
+
+typedef enum {
+        EfiBltVideoFill,
+        EfiBltVideoToBltBuffer,
+        EfiBltBufferToVideo,
+        EfiBltVideoToVideo,
+        EfiGraphicsOutputBltOperationMax,
+} EFI_GRAPHICS_OUTPUT_BLT_OPERATION;
+
+typedef struct {
+        uint32_t RedMask;
+        uint32_t GreenMask;
+        uint32_t BlueMask;
+        uint32_t ReservedMask;
+} EFI_PIXEL_BITMASK;
+
+typedef struct {
+        uint8_t Blue;
+        uint8_t Green;
+        uint8_t Red;
+        uint8_t Reserved;
+} EFI_GRAPHICS_OUTPUT_BLT_PIXEL;
+
+typedef struct {
+        uint32_t Version;
+        uint32_t HorizontalResolution;
+        uint32_t VerticalResolution;
+        EFI_GRAPHICS_PIXEL_FORMAT PixelFormat;
+        EFI_PIXEL_BITMASK PixelInformation;
+        uint32_t PixelsPerScanLine;
+} EFI_GRAPHICS_OUTPUT_MODE_INFORMATION;
+
+typedef struct EFI_GRAPHICS_OUTPUT_PROTOCOL EFI_GRAPHICS_OUTPUT_PROTOCOL;
+struct EFI_GRAPHICS_OUTPUT_PROTOCOL {
+        EFI_STATUS (EFIAPI *QueryMode)(
+                        EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+                        uint32_t ModeNumber,
+                        size_t *SizeOfInfo,
+                        EFI_GRAPHICS_OUTPUT_MODE_INFORMATION **Info);
+        EFI_STATUS(EFIAPI *SetMode)(
+                        EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+                        uint32_t ModeNumber);
+        EFI_STATUS (EFIAPI *Blt)(
+                        EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+                        EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltBuffer,
+                        EFI_GRAPHICS_OUTPUT_BLT_OPERATION BltOperation,
+                        size_t SourceX,
+                        size_t SourceY,
+                        size_t DestinationX,
+                        size_t DestinationY,
+                        size_t Width,
+                        size_t Height,
+                        size_t Delta);
+
+        struct {
+                uint32_t MaxMode;
+                uint32_t Mode;
+                EFI_GRAPHICS_OUTPUT_MODE_INFORMATION *Info;
+                size_t SizeOfInfo;
+                EFI_PHYSICAL_ADDRESS FrameBufferBase;
+                size_t FrameBufferSize;
+        } *Mode;
+};
diff --git a/src/boot/efi/proto/load-file.h b/src/boot/efi/proto/load-file.h
new file mode 100644
index 0000000000..2e01ce5744
--- /dev/null
+++ b/src/boot/efi/proto/load-file.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_LOAD_FILE_PROTOCOL_GUID \
+        GUID_DEF(0x56EC3091, 0x954C, 0x11d2, 0x8e, 0x3f, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+#define EFI_LOAD_FILE2_PROTOCOL_GUID \
+        GUID_DEF(0x4006c0c1, 0xfcb3, 0x403e, 0x99, 0x6d, 0x4a, 0x6c, 0x87, 0x24, 0xe0, 0x6d)
+
+typedef struct EFI_LOAD_FILE_PROTOCOL EFI_LOAD_FILE_PROTOCOL;
+typedef EFI_LOAD_FILE_PROTOCOL EFI_LOAD_FILE2_PROTOCOL;
+
+struct EFI_LOAD_FILE_PROTOCOL {
+        EFI_STATUS (EFIAPI *LoadFile)(
+                        EFI_LOAD_FILE_PROTOCOL *This,
+                        EFI_DEVICE_PATH *FilePath,
+                        bool BootPolicy,
+                        size_t *BufferSize,
+                        void *Buffer);
+};
diff --git a/src/boot/efi/proto/loaded-image.h b/src/boot/efi/proto/loaded-image.h
new file mode 100644
index 0000000000..46371e7db4
--- /dev/null
+++ b/src/boot/efi/proto/loaded-image.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_LOADED_IMAGE_PROTOCOL_GUID \
+        GUID_DEF(0x5B1B31A1, 0x9562, 0x11d2, 0x8E, 0x3F, 0x00, 0xA0, 0xC9, 0x69, 0x72, 0x3B)
+#define EFI_LOADED_IMAGE_DEVICE_PATH_PROTOCOL_GUID \
+        GUID_DEF(0xbc62157e, 0x3e33, 0x4fec, 0x99, 0x20, 0x2d, 0x3b, 0x36, 0xd7, 0x50, 0xdf)
+
+typedef EFI_STATUS (EFIAPI *EFI_IMAGE_ENTRY_POINT)(
+        EFI_HANDLE ImageHandle,
+        EFI_SYSTEM_TABLE *SystemTable);
+
+typedef struct {
+        uint32_t Revision;
+        EFI_HANDLE ParentHandle;
+        EFI_SYSTEM_TABLE *SystemTable;
+        EFI_HANDLE DeviceHandle;
+        EFI_DEVICE_PATH *FilePath;
+        void *Reserved;
+        uint32_t LoadOptionsSize;
+        void *LoadOptions;
+        void *ImageBase;
+        uint64_t ImageSize;
+        EFI_MEMORY_TYPE ImageCodeType;
+        EFI_MEMORY_TYPE ImageDataType;
+        EFI_STATUS (EFIAPI *Unload)(EFI_HANDLE ImageHandle);
+} EFI_LOADED_IMAGE_PROTOCOL;
diff --git a/src/boot/efi/proto/rng.h b/src/boot/efi/proto/rng.h
new file mode 100644
index 0000000000..8ed1fd451e
--- /dev/null
+++ b/src/boot/efi/proto/rng.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_RNG_PROTOCOL_GUID \
+        GUID_DEF(0x3152bca5, 0xeade, 0x433d, 0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44)
+
+typedef struct EFI_RNG_PROTOCOL EFI_RNG_PROTOCOL;
+struct EFI_RNG_PROTOCOL {
+        EFI_STATUS (EFIAPI *GetInfo)(
+                        EFI_RNG_PROTOCOL *This,
+                        size_t *RNGAlgorithmListSize,
+                        EFI_GUID *RNGAlgorithmList);
+        EFI_STATUS (EFIAPI *GetRNG)(
+                        EFI_RNG_PROTOCOL *This,
+                        EFI_GUID *RNGAlgorithm,
+                        size_t RNGValueLength,
+                        uint8_t *RNGValue);
+};
diff --git a/src/boot/efi/proto/security-arch.h b/src/boot/efi/proto/security-arch.h
new file mode 100644
index 0000000000..2675c61def
--- /dev/null
+++ b/src/boot/efi/proto/security-arch.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_SECURITY_ARCH_PROTOCOL_GUID \
+        GUID_DEF(0xA46423E3, 0x4617, 0x49f1, 0xB9, 0xFF, 0xD1, 0xBF, 0xA9, 0x11, 0x58, 0x39)
+#define EFI_SECURITY2_ARCH_PROTOCOL_GUID \
+        GUID_DEF(0x94ab2f58, 0x1438, 0x4ef1, 0x91, 0x52, 0x18, 0x94, 0x1a, 0x3a, 0x0e, 0x68)
+
+typedef struct EFI_SECURITY_ARCH_PROTOCOL EFI_SECURITY_ARCH_PROTOCOL;
+typedef struct EFI_SECURITY2_ARCH_PROTOCOL EFI_SECURITY2_ARCH_PROTOCOL;
+
+typedef EFI_STATUS (EFIAPI *EFI_SECURITY_FILE_AUTHENTICATION_STATE)(
+                const EFI_SECURITY_ARCH_PROTOCOL *This,
+                uint32_t AuthenticationStatus,
+                const EFI_DEVICE_PATH *File);
+
+typedef EFI_STATUS (EFIAPI *EFI_SECURITY2_FILE_AUTHENTICATION)(
+                const EFI_SECURITY2_ARCH_PROTOCOL *This,
+                const EFI_DEVICE_PATH *DevicePath,
+                void *FileBuffer,
+                size_t FileSize,
+                bool BootPolicy);
+
+struct EFI_SECURITY_ARCH_PROTOCOL {
+        EFI_SECURITY_FILE_AUTHENTICATION_STATE FileAuthenticationState;
+};
+
+struct EFI_SECURITY2_ARCH_PROTOCOL {
+        EFI_SECURITY2_FILE_AUTHENTICATION FileAuthentication;
+};
diff --git a/src/boot/efi/proto/shell-parameters.h b/src/boot/efi/proto/shell-parameters.h
new file mode 100644
index 0000000000..8080922ba0
--- /dev/null
+++ b/src/boot/efi/proto/shell-parameters.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_SHELL_PARAMETERS_PROTOCOL_GUID \
+        GUID_DEF(0x752f3136, 0x4e16, 0x4fdc, 0xa2, 0x2a, 0xe5, 0xf4, 0x68, 0x12, 0xf4, 0xca)
+
+typedef struct {
+        char16_t **Argv;
+        size_t Argc;
+        void *StdIn;
+        void *StdOut;
+        void *StdErr;
+} EFI_SHELL_PARAMETERS_PROTOCOL;
diff --git a/src/boot/efi/proto/simple-text-io.h b/src/boot/efi/proto/simple-text-io.h
new file mode 100644
index 0000000000..95016d3ea6
--- /dev/null
+++ b/src/boot/efi/proto/simple-text-io.h
@@ -0,0 +1,182 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_SIMPLE_TEXT_INPUT_PROTOCOL_GUID \
+        GUID_DEF(0x387477c1, 0x69c7, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+#define EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL_GUID \
+        GUID_DEF(0xdd9e7534, 0x7762, 0x4698, 0x8c, 0x14, 0xf5, 0x85, 0x17, 0xa6, 0x25, 0xaa)
+#define EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL_GUID \
+        GUID_DEF(0x387477c2, 0x69c7, 0x11d2, 0x8e, 0x39, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
+
+#define EFI_SHIFT_STATE_VALID     0x80000000U
+#define EFI_RIGHT_SHIFT_PRESSED   0x00000001U
+#define EFI_LEFT_SHIFT_PRESSED    0x00000002U
+#define EFI_RIGHT_CONTROL_PRESSED 0x00000004U
+#define EFI_LEFT_CONTROL_PRESSED  0x00000008U
+#define EFI_RIGHT_ALT_PRESSED     0x00000010U
+#define EFI_LEFT_ALT_PRESSED      0x00000020U
+#define EFI_RIGHT_LOGO_PRESSED    0x00000040U
+#define EFI_LEFT_LOGO_PRESSED     0x00000080U
+#define EFI_MENU_KEY_PRESSED      0x00000100U
+#define EFI_SYS_REQ_PRESSED       0x00000200U
+
+#define EFI_TOGGLE_STATE_VALID 0x80U
+#define EFI_KEY_STATE_EXPOSED  0x40U
+#define EFI_SCROLL_LOCK_ACTIVE 0x01U
+#define EFI_NUM_LOCK_ACTIVE    0x02U
+#define EFI_CAPS_LOCK_ACTIVE   0x04U
+
+enum {
+        EFI_BLACK        = 0x00,
+        EFI_BLUE         = 0x01,
+        EFI_GREEN        = 0x02,
+        EFI_CYAN         = EFI_BLUE | EFI_GREEN,
+        EFI_RED          = 0x04,
+        EFI_MAGENTA      = EFI_BLUE | EFI_RED,
+        EFI_BROWN        = EFI_GREEN | EFI_RED,
+        EFI_LIGHTGRAY    = EFI_BLUE | EFI_GREEN | EFI_RED,
+        EFI_BRIGHT       = 0x08,
+        EFI_DARKGRAY     = EFI_BLACK | EFI_BRIGHT,
+        EFI_LIGHTBLUE    = EFI_BLUE | EFI_BRIGHT,
+        EFI_LIGHTGREEN   = EFI_GREEN | EFI_BRIGHT,
+        EFI_LIGHTCYAN    = EFI_CYAN | EFI_BRIGHT,
+        EFI_LIGHTRED     = EFI_RED | EFI_BRIGHT,
+        EFI_LIGHTMAGENTA = EFI_MAGENTA | EFI_BRIGHT,
+        EFI_YELLOW       = EFI_BROWN | EFI_BRIGHT,
+        EFI_WHITE        = EFI_BLUE | EFI_GREEN | EFI_RED | EFI_BRIGHT,
+};
+
+#define EFI_TEXT_ATTR(fg, bg) ((fg) | ((bg) << 4))
+#define EFI_TEXT_ATTR_SWAP(c) EFI_TEXT_ATTR(((c) & 0xF0U) >> 4, (c) & 0xFU)
+
+enum {
+        SCAN_NULL            = 0x000,
+        SCAN_UP              = 0x001,
+        SCAN_DOWN            = 0x002,
+        SCAN_RIGHT           = 0x003,
+        SCAN_LEFT            = 0x004,
+        SCAN_HOME            = 0x005,
+        SCAN_END             = 0x006,
+        SCAN_INSERT          = 0x007,
+        SCAN_DELETE          = 0x008,
+        SCAN_PAGE_UP         = 0x009,
+        SCAN_PAGE_DOWN       = 0x00A,
+        SCAN_F1              = 0x00B,
+        SCAN_F2              = 0x00C,
+        SCAN_F3              = 0x00D,
+        SCAN_F4              = 0x00E,
+        SCAN_F5              = 0x00F,
+        SCAN_F6              = 0x010,
+        SCAN_F7              = 0x011,
+        SCAN_F8              = 0x012,
+        SCAN_F9              = 0x013,
+        SCAN_F10             = 0x014,
+        SCAN_F11             = 0x015,
+        SCAN_F12             = 0x016,
+        SCAN_ESC             = 0x017,
+        SCAN_PAUSE           = 0x048,
+        SCAN_F13             = 0x068,
+        SCAN_F14             = 0x069,
+        SCAN_F15             = 0x06A,
+        SCAN_F16             = 0x06B,
+        SCAN_F17             = 0x06C,
+        SCAN_F18             = 0x06D,
+        SCAN_F19             = 0x06E,
+        SCAN_F20             = 0x06F,
+        SCAN_F21             = 0x070,
+        SCAN_F22             = 0x071,
+        SCAN_F23             = 0x072,
+        SCAN_F24             = 0x073,
+        SCAN_MUTE            = 0x07F,
+        SCAN_VOLUME_UP       = 0x080,
+        SCAN_VOLUME_DOWN     = 0x081,
+        SCAN_BRIGHTNESS_UP   = 0x100,
+        SCAN_BRIGHTNESS_DOWN = 0x101,
+        SCAN_SUSPEND         = 0x102,
+        SCAN_HIBERNATE       = 0x103,
+        SCAN_TOGGLE_DISPLAY  = 0x104,
+        SCAN_RECOVERY        = 0x105,
+        SCAN_EJECT           = 0x106,
+};
+
+typedef struct {
+        uint16_t ScanCode;
+        char16_t UnicodeChar;
+} EFI_INPUT_KEY;
+
+typedef struct {
+        uint32_t KeyShiftState;
+        uint8_t KeyToggleState;
+} EFI_KEY_STATE;
+
+typedef struct {
+        EFI_INPUT_KEY Key;
+        EFI_KEY_STATE KeyState;
+} EFI_KEY_DATA;
+
+struct EFI_SIMPLE_TEXT_INPUT_PROTOCOL {
+        EFI_STATUS (EFIAPI *Reset)(
+                        EFI_SIMPLE_TEXT_INPUT_PROTOCOL *This,
+                        bool ExtendedVerification);
+        EFI_STATUS (EFIAPI *ReadKeyStroke)(
+                        EFI_SIMPLE_TEXT_INPUT_PROTOCOL *This,
+                        EFI_INPUT_KEY *Key);
+        EFI_EVENT WaitForKey;
+};
+
+typedef struct EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL;
+struct EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL {
+        EFI_STATUS (EFIAPI *Reset)(
+                        EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
+                        bool ExtendedVerification);
+        EFI_STATUS (EFIAPI *ReadKeyStrokeEx)(
+                        EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *This,
+                        EFI_KEY_DATA *KeyData);
+        EFI_EVENT WaitForKeyEx;
+        void *SetState;
+        void *RegisterKeyNotify;
+        void *UnregisterKeyNotify;
+};
+
+typedef struct EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL;
+struct EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL {
+        EFI_STATUS (EFIAPI *Reset)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        bool ExtendedVerification);
+        EFI_STATUS (EFIAPI *OutputString)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        char16_t *String);
+        EFI_STATUS (EFIAPI *TestString)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        char16_t *String);
+        EFI_STATUS (EFIAPI *QueryMode)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        size_t ModeNumber,
+                        size_t *Columns,
+                        size_t *Rows);
+        EFI_STATUS (EFIAPI *SetMode)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        size_t ModeNumber);
+        EFI_STATUS (EFIAPI *SetAttribute)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        size_t Attribute);
+        EFI_STATUS (EFIAPI *ClearScreen)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This);
+        EFI_STATUS (EFIAPI *SetCursorPosition)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        size_t Column,
+                        size_t Row);
+        EFI_STATUS (EFIAPI *EnableCursor)(
+                        EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL *This,
+                        bool Visible);
+        struct {
+                int32_t MaxMode;
+                int32_t Mode;
+                int32_t Attribute;
+                int32_t CursorColumn;
+                int32_t CursorRow;
+                bool CursorVisible;
+        } *Mode;
+};
diff --git a/src/boot/efi/proto/tcg.h b/src/boot/efi/proto/tcg.h
new file mode 100644
index 0000000000..af6989c854
--- /dev/null
+++ b/src/boot/efi/proto/tcg.h
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "efi.h"
+
+#define EFI_TCG_PROTOCOL_GUID \
+        GUID_DEF(0xf541796d, 0xa62e, 0x4954, 0xa7, 0x75, 0x95, 0x84, 0xf6, 0x1b, 0x9c, 0xdd)
+#define EFI_TCG2_PROTOCOL_GUID \
+        GUID_DEF(0x607f766c, 0x7455, 0x42be, 0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f)
+
+#define TCG_ALG_SHA 0x4
+#define EFI_TCG2_EVENT_HEADER_VERSION 1
+#define EV_IPL 13
+
+typedef struct {
+        uint8_t Major;
+        uint8_t Minor;
+        uint8_t RevMajor;
+        uint8_t RevMinor;
+} TCG_VERSION;
+
+typedef struct {
+        uint8_t Major;
+        uint8_t Minor;
+} EFI_TCG2_VERSION;
+
+typedef struct {
+        uint8_t Size;
+        TCG_VERSION StructureVersion;
+        TCG_VERSION ProtocolSpecVersion;
+        uint8_t HashAlgorithmBitmap;
+        bool TPMPresentFlag;
+        bool TPMDeactivatedFlag;
+} EFI_TCG_BOOT_SERVICE_CAPABILITY;
+
+typedef struct {
+        uint8_t Size;
+        EFI_TCG2_VERSION StructureVersion;
+        EFI_TCG2_VERSION ProtocolVersion;
+        uint32_t HashAlgorithmBitmap;
+        uint32_t SupportedEventLogs;
+        bool TPMPresentFlag;
+        uint16_t MaxCommandSize;
+        uint16_t MaxResponseSize;
+        uint32_t ManufacturerID;
+        uint32_t NumberOfPCRBanks;
+        uint32_t ActivePcrBanks;
+} EFI_TCG2_BOOT_SERVICE_CAPABILITY;
+
+typedef struct {
+        uint32_t PCRIndex;
+        uint32_t EventType;
+        struct {
+                uint8_t Digest[20];
+        } Digest;
+        uint32_t EventSize;
+        uint8_t Event[0];
+} _packed_ TCG_PCR_EVENT;
+
+typedef struct {
+        uint32_t HeaderSize;
+        uint16_t HeaderVersion;
+        uint32_t PCRIndex;
+        uint32_t EventType;
+} _packed_ EFI_TCG2_EVENT_HEADER;
+
+typedef struct {
+        uint32_t Size;
+        EFI_TCG2_EVENT_HEADER Header;
+        uint8_t Event[];
+} _packed_ EFI_TCG2_EVENT;
+
+typedef struct EFI_TCG_PROTOCOL EFI_TCG_PROTOCOL;
+struct EFI_TCG_PROTOCOL {
+        EFI_STATUS (EFIAPI *StatusCheck)(
+                        EFI_TCG_PROTOCOL *This,
+                        EFI_TCG_BOOT_SERVICE_CAPABILITY *ProtocolCapability,
+                        uint32_t *TCGFeatureFlags,
+                        EFI_PHYSICAL_ADDRESS *EventLogLocation,
+                        EFI_PHYSICAL_ADDRESS *EventLogLastEntry);
+        void *HashAll;
+        void *LogEvent;
+        void *PassThroughToTpm;
+        EFI_STATUS (EFIAPI *HashLogExtendEvent)(
+                        EFI_TCG_PROTOCOL *This,
+                        EFI_PHYSICAL_ADDRESS HashData,
+                        uint64_t HashDataLen,
+                        uint32_t AlgorithmId,
+                        TCG_PCR_EVENT *TCGLogData,
+                        uint32_t *EventNumber,
+                        EFI_PHYSICAL_ADDRESS *EventLogLastEntry);
+};
+
+typedef struct EFI_TCG2_PROTOCOL EFI_TCG2_PROTOCOL;
+struct EFI_TCG2_PROTOCOL {
+        EFI_STATUS (EFIAPI *GetCapability)(
+                        EFI_TCG2_PROTOCOL *This,
+                        EFI_TCG2_BOOT_SERVICE_CAPABILITY *ProtocolCapability);
+        void *GetEventLog;
+        EFI_STATUS (EFIAPI *HashLogExtendEvent)(
+                        EFI_TCG2_PROTOCOL *This,
+                        uint64_t Flags,
+                        EFI_PHYSICAL_ADDRESS DataToHash,
+                        uint64_t DataToHashLen,
+                        EFI_TCG2_EVENT *EfiTcgEvent);
+        void *SubmitCommand;
+        void *GetActivePcrBanks;
+        void *SetActivePcrBanks;
+        void *GetResultOfSetActivePcrBanks;
+};
diff --git a/src/boot/efi/random-seed.c b/src/boot/efi/random-seed.c
index 0370de1147..daf0a4c0a9 100644
--- a/src/boot/efi/random-seed.c
+++ b/src/boot/efi/random-seed.c
@@ -1,10 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "memory-util-fundamental.h"
-#include "missing_efi.h"
+#include "proto/rng.h"
 #include "random-seed.h"
 #include "secure-boot.h"
 #include "sha256.h"
diff --git a/src/boot/efi/random-seed.h b/src/boot/efi/random-seed.h
index 40aaf85860..67f005dff5 100644
--- a/src/boot/efi/random-seed.h
+++ b/src/boot/efi/random-seed.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
+#include "efi.h"
 
 EFI_STATUS process_random_seed(EFI_FILE *root_dir);
diff --git a/src/boot/efi/secure-boot.c b/src/boot/efi/secure-boot.c
index 8b796db65f..3a80712fe0 100644
--- a/src/boot/efi/secure-boot.c
+++ b/src/boot/efi/secure-boot.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "console.h"
+#include "proto/security-arch.h"
 #include "sbat.h"
 #include "secure-boot.h"
 #include "util.h"
@@ -93,7 +94,7 @@ EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool
                 char *buffer;
                 size_t size;
         } sb_vars[] = {
-                { u"db",  u"db.auth",  EFI_IMAGE_SECURITY_DATABASE_VARIABLE, NULL, 0 },
+                { u"db",  u"db.auth",  EFI_IMAGE_SECURITY_DATABASE_GUID, NULL, 0 },
                 { u"KEK", u"KEK.auth", EFI_GLOBAL_VARIABLE, NULL, 0 },
                 { u"PK",  u"PK.auth",  EFI_GLOBAL_VARIABLE, NULL, 0 },
         };
@@ -164,7 +165,7 @@ static EFIAPI EFI_STATUS security2_hook(
                 const EFI_DEVICE_PATH *device_path,
                 void *file_buffer,
                 size_t file_size,
-                BOOLEAN boot_policy) {
+                bool boot_policy) {
 
         assert(security_override.validator);
         assert(security_override.security2);
diff --git a/src/boot/efi/secure-boot.h b/src/boot/efi/secure-boot.h
index bdc34150da..347113135f 100644
--- a/src/boot/efi/secure-boot.h
+++ b/src/boot/efi/secure-boot.h
@@ -1,10 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-
+#include "efi.h"
 #include "efivars-fundamental.h"
-#include "missing_efi.h"
 
 typedef enum {
         ENROLL_OFF,         /* no Secure Boot key enrollment whatsoever, even manual entries are not generated */
diff --git a/src/boot/efi/shim.c b/src/boot/efi/shim.c
index 5da298c10a..e0bb470cf2 100644
--- a/src/boot/efi/shim.c
+++ b/src/boot/efi/shim.c
@@ -8,13 +8,9 @@
  * https://github.com/mjg59/efitools
  */
 
-#include <efi.h>
-#include <efilib.h>
-
-#include "missing_efi.h"
-#include "util.h"
 #include "secure-boot.h"
 #include "shim.h"
+#include "util.h"
 
 #if defined(__x86_64__) || defined(__i386__)
 #define __sysv_abi__ __attribute__((sysv_abi))
diff --git a/src/boot/efi/shim.h b/src/boot/efi/shim.h
index 6d213f5efa..44155d21fc 100644
--- a/src/boot/efi/shim.h
+++ b/src/boot/efi/shim.h
@@ -9,8 +9,7 @@
  */
 #pragma once
 
-#include <efi.h>
-#include <stdbool.h>
+#include "efi.h"
 
 bool shim_loaded(void);
 EFI_STATUS shim_load_image(EFI_HANDLE parent, const EFI_DEVICE_PATH *device_path, EFI_HANDLE *ret_image);
diff --git a/src/boot/efi/splash.c b/src/boot/efi/splash.c
index 15518b692a..0dc58675cc 100644
--- a/src/boot/efi/splash.c
+++ b/src/boot/efi/splash.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "graphics.h"
+#include "proto/graphics-output.h"
 #include "splash.h"
 #include "util.h"
 
diff --git a/src/boot/efi/splash.h b/src/boot/efi/splash.h
index bb49740ab2..a66eb24d06 100644
--- a/src/boot/efi/splash.h
+++ b/src/boot/efi/splash.h
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <stddef.h>
+#include "efi.h"
 
 EFI_STATUS graphics_splash(const uint8_t *content, size_t len);
diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c
index 92229d8dee..d85424ceae 100644
--- a/src/boot/efi/stub.c
+++ b/src/boot/efi/stub.c
@@ -1,8 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "cpio.h"
 #include "devicetree.h"
 #include "disk.h"
@@ -11,6 +8,7 @@
 #include "measure.h"
 #include "part-discovery.h"
 #include "pe.h"
+#include "proto/shell-parameters.h"
 #include "random-seed.h"
 #include "secure-boot.h"
 #include "splash.h"
diff --git a/src/boot/efi/ticks.c b/src/boot/efi/ticks.c
index 6549296998..13972528cd 100644
--- a/src/boot/efi/ticks.c
+++ b/src/boot/efi/ticks.c
@@ -1,8 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-
 #include "ticks.h"
 #include "util.h"
 #include "vmm.h"
diff --git a/src/boot/efi/util.c b/src/boot/efi/util.c
index 683724b66c..48b30a8f5a 100644
--- a/src/boot/efi/util.c
+++ b/src/boot/efi/util.c
@@ -1,9 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
 #include <inttypes.h>
 
+#include "proto/device-path.h"
+#include "proto/simple-text-io.h"
 #include "ticks.h"
 #include "util.h"
 
@@ -186,24 +186,25 @@ EFI_STATUS efivar_get_uint64_le(const EFI_GUID *vendor, const char16_t *name, ui
 }
 
 EFI_STATUS efivar_get_raw(const EFI_GUID *vendor, const char16_t *name, char **ret, size_t *ret_size) {
-        _cleanup_free_ char *buf = NULL;
-        size_t l;
         EFI_STATUS err;
 
         assert(vendor);
         assert(name);
 
-        l = sizeof(char16_t *) * EFI_MAXIMUM_VARIABLE_SIZE;
-        buf = xmalloc(l);
+        size_t size = 0;
+        err = RT->GetVariable((char16_t *) name, (EFI_GUID *) vendor, NULL, &size, NULL);
+        if (err != EFI_BUFFER_TOO_SMALL)
+                return err;
 
-        err = RT->GetVariable((char16_t *) name, (EFI_GUID *) vendor, NULL, &l, buf);
+        _cleanup_free_ void *buf = xmalloc(size);
+        err = RT->GetVariable((char16_t *) name, (EFI_GUID *) vendor, NULL, &size, buf);
         if (err != EFI_SUCCESS)
                 return err;
 
         if (ret)
                 *ret = TAKE_PTR(buf);
         if (ret_size)
-                *ret_size = l;
+                *ret_size = size;
 
         return EFI_SUCCESS;
 }
@@ -648,15 +649,15 @@ EFI_STATUS make_file_device_path(EFI_HANDLE device, const char16_t *file, EFI_DE
         size_t dp_size = (uint8_t *) end_node - (uint8_t *) dp;
 
         /* Make a copy that can also hold a file media device path. */
-        *ret_dp = xmalloc(dp_size + file_size + SIZE_OF_FILEPATH_DEVICE_PATH + END_DEVICE_PATH_LENGTH);
+        *ret_dp = xmalloc(dp_size + file_size + sizeof(FILEPATH_DEVICE_PATH) + sizeof(EFI_DEVICE_PATH));
         dp = mempcpy(*ret_dp, dp, dp_size);
 
         /* Replace end node with file media device path. Use memcpy() in case dp is unaligned (if accessed as
          * FILEPATH_DEVICE_PATH). */
         dp->Type = MEDIA_DEVICE_PATH;
         dp->SubType = MEDIA_FILEPATH_DP;
-        memcpy((uint8_t *) dp + offsetof(FILEPATH_DEVICE_PATH, PathName), file, file_size);
-        SetDevicePathNodeLength(dp, offsetof(FILEPATH_DEVICE_PATH, PathName) + file_size);
+        dp->Length = sizeof(FILEPATH_DEVICE_PATH) + file_size;
+        memcpy((uint8_t *) dp + sizeof(FILEPATH_DEVICE_PATH), file, file_size);
 
         dp = NextDevicePathNode(dp);
         SetDevicePathEndNode(dp);
diff --git a/src/boot/efi/util.h b/src/boot/efi/util.h
index d42c23730d..ab15e2bf23 100644
--- a/src/boot/efi/util.h
+++ b/src/boot/efi/util.h
@@ -1,11 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <efilib.h>
-#include <stddef.h>
-
+#include "efi.h"
 #include "log.h"
+#include "proto/file-io.h"
 #include "string-util-fundamental.h"
 
 static inline void free(void *p) {
@@ -113,16 +111,6 @@ static inline void unload_imagep(EFI_HANDLE *image) {
                 (void) BS->UnloadImage(*image);
 }
 
-/* Creates a EFI_GUID pointer suitable for EFI APIs. Use of const allows the compiler to merge multiple
- * uses (although, currently compilers do that regardless). Most EFI APIs declare their EFI_GUID input
- * as non-const, but almost all of them are in fact const. */
-#define MAKE_GUID_PTR(name) ((EFI_GUID *) &(const EFI_GUID) name##_GUID)
-
-/* These allow MAKE_GUID_PTR() to work without requiring an extra _GUID in the passed name. We want to
- * keep the GUID definitions in line with the UEFI spec. */
-#define EFI_GLOBAL_VARIABLE_GUID EFI_GLOBAL_VARIABLE
-#define EFI_FILE_INFO_GUID EFI_FILE_INFO_ID
-
 /*
  * Allocated random UUID, intended to be shared across tools that implement
  * the (ESP)\loader\entries\<vendor>-<revision>.conf convention and the
diff --git a/src/boot/efi/vmm.c b/src/boot/efi/vmm.c
index 6bd440f032..c3816e1b2d 100644
--- a/src/boot/efi/vmm.c
+++ b/src/boot/efi/vmm.c
@@ -1,14 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <efi.h>
-#include <efilib.h>
-#include <stdbool.h>
 #if defined(__i386__) || defined(__x86_64__)
 #  include <cpuid.h>
 #endif
 
 #include "drivers.h"
 #include "efi-string.h"
+#include "proto/device-path.h"
 #include "string-util-fundamental.h"
 #include "util.h"
 
@@ -154,6 +152,11 @@ static bool cpuid_in_hypervisor(void) {
         return false;
 }
 
+#define SMBIOS_TABLE_GUID \
+        GUID_DEF(0xeb9d2d31, 0x2d88, 0x11d3, 0x9a, 0x16, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d)
+#define SMBIOS3_TABLE_GUID \
+        GUID_DEF(0xf2fd1544, 0x9794, 0x4a2c, 0x99, 0x2e, 0xe5, 0xbb, 0xcf, 0x20, 0xe3, 0x94)
+
 typedef struct {
         uint8_t anchor_string[4];
         uint8_t entry_point_structure_checksum;
diff --git a/src/boot/efi/vmm.h b/src/boot/efi/vmm.h
index e98ec74af1..32f4fa3345 100644
--- a/src/boot/efi/vmm.h
+++ b/src/boot/efi/vmm.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <efi.h>
-#include <efilib.h>
+#include "efi.h"
 
 bool is_direct_boot(EFI_HANDLE device);
 EFI_STATUS vmm_open(EFI_HANDLE *ret_qemu_dev, EFI_FILE **ret_qemu_dir);