Merge branch 'master' into i915res

147 files changed, 2352 insertions, 2447 deletions

diff --git a/gpxe/src/arch/i386/Makefile b/gpxe/src/arch/i386/Makefile
index 1392bbac..dd8da802 100644
--- a/gpxe/src/arch/i386/Makefile
+++ b/gpxe/src/arch/i386/Makefile
@@ -4,22 +4,33 @@ CFLAGS		+= -march=i386
 
 # Code size reduction.
 #
-CFLAGS		+= -fstrength-reduce -fomit-frame-pointer
+CFLAGS		+= -fomit-frame-pointer
+
+# Code size reduction.
+#
+ifeq ($(CCTYPE),gcc)
+CFLAGS		+= -fstrength-reduce
+endif
 
 # Code size reduction.  gcc3 needs a different syntax to gcc2 if you
 # want to avoid spurious warnings.
 #
+ifeq ($(CCTYPE),gcc)
 GCC_VERSION	:= $(subst ., ,$(shell $(CC) -dumpversion))
 GCC_MAJOR	:= $(firstword $(GCC_VERSION))
 ifeq ($(GCC_MAJOR),2)
 CFLAGS		+= -malign-jumps=1 -malign-loops=1 -malign-functions=1
 else
 CFLAGS		+= -falign-jumps=1 -falign-loops=1 -falign-functions=1
-endif
+endif # gcc2
+endif # gcc
 
-# Code size reduction.  This is almost always a win.  The kernel uses it, too.
+# Code size reduction.  This is almost always a win.  The kernel uses
+# it, too.
 #
+ifeq ($(CCTYPE),gcc)
 CFLAGS		+= -mpreferred-stack-boundary=2
+endif
 
 # Code size reduction.  Use regparm for all functions - C functions
 # called from assembly (or vice versa) need __asmcall now
@@ -27,7 +38,9 @@ CFLAGS		+= -mpreferred-stack-boundary=2
 CFLAGS		+= -mregparm=3
 
 # Code size reduction.  Use -mrtd (same __asmcall requirements as above)
+ifeq ($(CCTYPE),gcc)
 CFLAGS		+= -mrtd
+endif
 
 # Code size reduction.  This is the logical complement to -mregparm=3.
 # It doesn't currently buy us anything, but if anything ever tries to
@@ -67,7 +80,9 @@ SRCDIRS		+= arch/i386/drivers
 SRCDIRS		+= arch/i386/drivers/net
 SRCDIRS		+= arch/i386/interface/pcbios
 SRCDIRS		+= arch/i386/interface/pxe
+SRCDIRS		+= arch/i386/interface/pxeparent
 SRCDIRS 	+= arch/i386/interface/syslinux
+SRCDIRS		+= arch/i386/hci/commands
 
 # The various xxx_loader.c files are #included into core/loader.c and
 # should not be compiled directly.
@@ -76,11 +91,6 @@ NON_AUTO_SRCS	+= arch/i386/core/aout_loader.c
 NON_AUTO_SRCS	+= arch/i386/core/freebsd_loader.c
 NON_AUTO_SRCS	+= arch/i386/core/wince_loader.c
 
-# unnrv2b.S is used to generate a 16-bit as well as a 32-bit object.
-#
-OBJS_unnrv2b	= unnrv2b unnrv2b16
-CFLAGS_unnrv2b16 = -DCODE16
-
 # Include common x86 Makefile
 #
 MAKEDEPS	+= arch/x86/Makefile
@@ -101,13 +111,6 @@ NON_AUTO_MEDIA	+= fd0
 	$(Q)dd if=$< bs=512 conv=sync of=/dev/fd0
 	$(Q)sync
 
-# rule to create padded disk images
-NON_AUTO_MEDIA	+= pdsk
-%pdsk : %dsk
-	$(QM)$(ECHO) "  [DSKPAD] $@"
-	$(Q)cp $< $@
-	$(Q)$(PERL) ./util/dskpad.pl $@
-
 # Add NON_AUTO_MEDIA to the media list, so that they show up in the
 # output of "make"
 #
diff --git a/gpxe/src/arch/i386/Makefile.pcbios b/gpxe/src/arch/i386/Makefile.pcbios
index 64b3dac2..e38fbca0 100644
--- a/gpxe/src/arch/i386/Makefile.pcbios
+++ b/gpxe/src/arch/i386/Makefile.pcbios
@@ -11,21 +11,24 @@ LDFLAGS		+= -N --no-check-sections
 # Media types.
 #
 MEDIA		+= rom
+MEDIA		+= hrom
+MEDIA		+= xrom
 MEDIA		+= pxe
 MEDIA		+= kpxe
 MEDIA		+= kkpxe
-MEDIA		+= elf
-MEDIA		+= elfd
-MEDIA		+= lmelf
-MEDIA		+= lmelfd
 MEDIA		+= lkrn
-MEDIA		+= bImage
 MEDIA		+= dsk
 MEDIA		+= nbi
 MEDIA		+= hd
 MEDIA		+= raw
-MEDIA		+= com
-MEDIA		+= exe
+
+# Padding rules
+#
+PAD_rom		= $(PADIMG) --blksize=512 --byte=0xff $@
+PAD_hrom	= $(PAD_rom)
+PAD_xrom	= $(PAD_rom)
+PAD_dsk		= $(PADIMG) --blksize=512 $@
+PAD_hd		= $(PADIMG) --blksize=32768 $@
 
 # rule to make a non-emulation ISO boot image
 NON_AUTO_MEDIA	+= iso
@@ -39,6 +42,12 @@ NON_AUTO_MEDIA	+= liso
 	$(QM)$(ECHO) "  [GENLISO] $@"
 	$(Q)bash util/genliso $@ $<
 
+# rule to make a syslinux floppy image (mountable, bootable)
+NON_AUTO_MEDIA	+= sdsk
+%sdsk:	%lkrn util/gensdsk
+	$(QM)$(ECHO) "  [GENSDSK] $@"
+	$(Q)bash util/gensdsk $@ $<
+
 # Special target for building Master Boot Record binary
 $(BIN)/mbr.bin : $(BIN)/mbr.o
 	$(QM)$(ECHO) "  [OBJCOPY] $@"
@@ -53,3 +62,9 @@ NON_AUTO_MEDIA	+= usb
 %usb: $(BIN)/usbdisk.bin %hd
 	$(QM)$(ECHO) "  [FINISH] $@"
 	$(Q)cat $^ > $@
+
+# Padded floppy image (e.g. for iLO)
+NON_AUTO_MEDIA += pdsk
+%pdsk : %dsk
+	$(Q)cp $< $@
+	$(Q)$(PADIMG) --blksize=1474560 $@
diff --git a/gpxe/src/arch/i386/core/basemem_packet.c b/gpxe/src/arch/i386/core/basemem_packet.c
index 64e0bcc1..d487cce3 100644
--- a/gpxe/src/arch/i386/core/basemem_packet.c
+++ b/gpxe/src/arch/i386/core/basemem_packet.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
diff --git a/gpxe/src/arch/i386/core/etherboot.prefix.lds b/gpxe/src/arch/i386/core/etherboot.prefix.lds
deleted file mode 100644
index 3550a2a3..00000000
--- a/gpxe/src/arch/i386/core/etherboot.prefix.lds
+++ /dev/null
@@ -1,100 +0,0 @@
-OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
-OUTPUT_ARCH(i386)
-
-ENTRY(_prefix_start)
-SECTIONS {
-	/* Prefix */
-	.prefix : {
-		_verbatim_start = . ;
-		_prefix_start = . ;
-		*(.prefix)
-		. = ALIGN(16);
-		_prefix_end = . ;
-	} = 0x9090
-	_prefix_size = _prefix_end - _prefix_start;
-
-	.text.nocompress : {
-		*(.prefix.udata)
-	} = 0x9090
-
-	decompress_to = . ;
-	.prefix.zdata : {
-		_compressed = . ;
-		*(.prefix.zdata)
-		_compressed_end = . ;
-	}
-	_compressed_size = _compressed_end - _compressed;
-
-	. = ALIGN(16);
-	_verbatim_end = . ;
-
-
-	/* Size of the core of etherboot in memory */
-	_base_size = _end - _text;
-
-	/* _prefix_size is the length of the non-core etherboot prefix */
-	_prefix_size = _prefix_end - _prefix_start;
-
-	/* _verbatim_size is the actual amount that has to be copied to base memory */
-	_verbatim_size = _verbatim_end - _verbatim_start;
-
-	/* _image_size is the amount of base memory needed to run */
-	_image_size = _base_size +  _prefix_size;
-
-	/* Standard sizes rounded up to paragraphs */
-	_prefix_size_pgh   = (_prefix_size + 15) / 16;
-	_verbatim_size_pgh = (_verbatim_size + 15) / 16;
-	_image_size_pgh    = (_image_size + 15) / 16 ;
-	
-	/* Standard sizes in sectors */
-	_prefix_size_sct   = (_prefix_size + 511) / 512;
-	_verbatim_size_sct = (_verbatim_size + 511) / 512;
-	_image_size_sct    = (_image_size + 511) / 512;
-
-	/* Symbol offsets and sizes for the exe prefix */
-	_exe_hdr_size   = 32;
-	_exe_size       = _verbatim_size; /* Should this be - 32 to exclude the header? */
-	_exe_size_tail  = (_exe_size) % 512;
-	_exe_size_pages = ((_exe_size) + 511) / 512;
-	_exe_bss_size   = ((_image_size - _verbatim_size) + 15) / 16;
-	_exe_ss_offset  = (_stack_offset + _prefix_size - _exe_hdr_size + 15) / 16 ;
-
-	/* This is where we copy the compressed image before decompression.
-	 * Prepare to decompress in place.  The end mark is about 8.25 bytes long,
-	 * and the worst case symbol is about 16.5 bytes long.  Therefore
-	 * We need to reserve at least 25 bytes of slack here.  
-	 * Currently I reserve 2048 bytes of just slack to be safe :)
-	 * 2048 bytes easily falls within the BSS (the defualt stack is 4096 bytes)
-	 * so we really are decompressing in place.
-	 * 
-	 * Hmm. I missed a trick.  In the very worst case (no compression)
-	 * the encoded data is 9/8 the size as it started out so to be completely
-	 * safe I need to be 1/8 of the uncompressed code size past the end.
-	 * This will still fit compfortably into our bss in any conceivable scenario.
-	 */
-	_compressed_copy = _edata + _prefix_size  - _compressed_size +
-		/* The amount to overflow _edata */
-		MAX( ((_edata - _text + 7) / 8) , 2016 ) + 32; 
-	_assert = ASSERT( ( _compressed_copy - _prefix_size ) < _ebss , "Cannot decompress in place" ) ; 
-
-	decompress = DEFINED(decompress) ? decompress : 0;
-	/DISCARD/ : {
-		*(.comment)
-		*(.note)
-	}
-
-	/* Symbols used by the prefixes whose addresses are inconvinient 
-	 * to compute, at runtime in the code.
-	 */
-	image_basemem_size = DEFINED(image_basemem_size)? image_basemem_size : 65536;
-	image_basemem      = DEFINED(image_basemem)?     image_basemem : 65536;
-	_prefix_real_to_prot          = _real_to_prot         + _prefix_size ;
-	_prefix_prot_to_real          = _prot_to_real         + _prefix_size ;
-	_prefix_image_basemem_size    = image_basemem_size    + _prefix_size ;
-	_prefix_image_basemem         = image_basemem         + _prefix_size ;
-	_prefix_rm_in_call            = _rm_in_call           + _prefix_size ;
-	_prefix_in_call               = _in_call              + _prefix_size ;
-	_prefix_rom                   = rom                   + _prefix_size ;
-	_prefix_rm_etherboot_location = rm_etherboot_location + _prefix_size ;
-	_prefix_stack_end             = _stack_end            + _prefix_size ;
-}
diff --git a/gpxe/src/arch/i386/core/pic8259.c b/gpxe/src/arch/i386/core/pic8259.c
index 8a0433dd..1e2d23c5 100644
--- a/gpxe/src/arch/i386/core/pic8259.c
+++ b/gpxe/src/arch/i386/core/pic8259.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/io.h>
 #include <pic8259.h>
 
diff --git a/gpxe/src/arch/i386/core/prefixudata.lds b/gpxe/src/arch/i386/core/prefixudata.lds
deleted file mode 100644
index 1c76128e..00000000
--- a/gpxe/src/arch/i386/core/prefixudata.lds
+++ /dev/null
@@ -1,8 +0,0 @@
-OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
-OUTPUT_ARCH(i386)
-
-SECTIONS {
-	 .prefix.udata : {
-		      *(*)
-	 }
-}
diff --git a/gpxe/src/arch/i386/core/prefixzdata.lds b/gpxe/src/arch/i386/core/prefixzdata.lds
deleted file mode 100644
index bf6ea977..00000000
--- a/gpxe/src/arch/i386/core/prefixzdata.lds
+++ /dev/null
@@ -1,8 +0,0 @@
-OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
-OUTPUT_ARCH(i386)
-
-SECTIONS {
-	 .prefix.zdata : {
-		      *(*)
-	 }
-}
diff --git a/gpxe/src/arch/i386/core/rdtsc_timer.c b/gpxe/src/arch/i386/core/rdtsc_timer.c
index 443c8ada..76679173 100644
--- a/gpxe/src/arch/i386/core/rdtsc_timer.c
+++ b/gpxe/src/arch/i386/core/rdtsc_timer.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /** @file
  *
  * RDTSC timer
diff --git a/gpxe/src/arch/i386/core/realmode.c b/gpxe/src/arch/i386/core/realmode.c
deleted file mode 100644
index 9a77bd8a..00000000
--- a/gpxe/src/arch/i386/core/realmode.c
+++ /dev/null
@@ -1,23 +0,0 @@
-/* Real-mode interface: C portions.
- *
- * Initial version by Michael Brown <mbrown@fensystems.co.uk>, January 2004.
- */
-
-#include "realmode.h"
-
-/*
- * Copy data to/from base memory.
- *
- */
-
-#ifdef KEEP_IT_REAL
-
-void memcpy_to_real ( segoff_t dest, void *src, size_t n ) {
-
-}
-
-void memcpy_from_real ( void *dest, segoff_t src, size_t n ) {
-
-}
-
-#endif /* KEEP_IT_REAL */
diff --git a/gpxe/src/arch/i386/core/relocate.c b/gpxe/src/arch/i386/core/relocate.c
index bdc8498e..44e764fe 100644
--- a/gpxe/src/arch/i386/core/relocate.c
+++ b/gpxe/src/arch/i386/core/relocate.c
@@ -9,6 +9,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /*
  * The linker passes in the symbol _max_align, which is the alignment
  * that we must preserve, in bytes.
diff --git a/gpxe/src/arch/i386/core/setjmp.S b/gpxe/src/arch/i386/core/setjmp.S
index 59a1b7cb..03727148 100644
--- a/gpxe/src/arch/i386/core/setjmp.S
+++ b/gpxe/src/arch/i386/core/setjmp.S
@@ -1,5 +1,7 @@
 /* setjmp and longjmp. Use of these functions is deprecated. */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.text
 	.arch i386
 	.code32
diff --git a/gpxe/src/arch/i386/core/stack.S b/gpxe/src/arch/i386/core/stack.S
index da66d239..737ec0ee 100644
--- a/gpxe/src/arch/i386/core/stack.S
+++ b/gpxe/src/arch/i386/core/stack.S
@@ -1,3 +1,5 @@
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.arch i386
 
 /****************************************************************************
diff --git a/gpxe/src/arch/i386/core/stack16.S b/gpxe/src/arch/i386/core/stack16.S
index d1251f06..523f0288 100644
--- a/gpxe/src/arch/i386/core/stack16.S
+++ b/gpxe/src/arch/i386/core/stack16.S
@@ -1,3 +1,5 @@
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.arch i386
 
 /****************************************************************************
diff --git a/gpxe/src/arch/i386/core/start16.lds b/gpxe/src/arch/i386/core/start16.lds
deleted file mode 100644
index 544fc78f..00000000
--- a/gpxe/src/arch/i386/core/start16.lds
+++ /dev/null
@@ -1,8 +0,0 @@
-/* When linking with an uncompressed image, these symbols are not
- * defined so we provide them here.
- */
-
-__decompressor_uncompressed = 0 ;
-__decompressor__start = 0 ;
-
-INCLUDE arch/i386/core/start16z.lds
diff --git a/gpxe/src/arch/i386/core/start16z.lds b/gpxe/src/arch/i386/core/start16z.lds
deleted file mode 100644
index 711bcf7b..00000000
--- a/gpxe/src/arch/i386/core/start16z.lds
+++ /dev/null
@@ -1,65 +0,0 @@
-OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
-OUTPUT_ARCH(i386)
-
-/* Linker-generated symbols are prefixed with a double underscore.
- * Decompressor symbols are prefixed with __decompressor_.  All other
- * symbols are the same as in the original object file, i.e. the
- * runtime addresses.
- */
-
-ENTRY(_start16)
-
-SECTIONS {
-	.text : {
-		*(.text)
-	}
-	.payload : {
-		__payload_start = .;
-		*(.data)
-		__payload_end = .;
-	}
-
-	/* _payload_size is the size of the binary image appended to
-	 * start16, in bytes.
-	 */
-	__payload_size = __payload_end - __payload_start ;
-
-	/* _size is the size of the runtime image
-	 * (start32 + the C code), in bytes.
-	 */
-	__size = _end - _start ;
-
-	/* _decompressor_size is the size of the decompressor, in
-	 * bytes.  For a non-compressed image, start16.lds sets
-	 * _decompressor_uncompressed = _decompressor__start = 0.
-	 */
-	__decompressor_size = __decompressor_uncompressed - __decompressor__start ;
-
-	/* image__size is the total size of the image, after
-	 * decompression and including the decompressor if applicable.
-	 * It is therefore the amount of memory that start16's payload
-	 * needs in order to execute, in bytes.
-	 */
-	__image_size = __size + __decompressor_size ;
-
-	/* Amount to add to runtime symbols to obtain the offset of
-	 * that symbol within the image.
-	 */
-	__offset_adjust = __decompressor_size - _start ;
-
-	/* Calculations for the stack
-	 */
-	__stack_size = _estack - _stack ;
-	__offset_stack = _stack + __offset_adjust ;
-
-	/* Some symbols will be larger than 16 bits but guaranteed to
-	 * be multiples of 16.  We calculate them in paragraphs and
-	 * export these symbols which can be used in 16-bit code
-	 * without risk of overflow.
-	 */
-	__image_size_pgh = ( __image_size / 16 );
-	__start_pgh = ( _start / 16 );
-	__decompressor_size_pgh = ( __decompressor_size / 16 );
-	__offset_stack_pgh = ( __offset_stack / 16 );
-}
-
diff --git a/gpxe/src/arch/i386/core/timer2.c b/gpxe/src/arch/i386/core/timer2.c
index bb589ecc..6e76b2eb 100644
--- a/gpxe/src/arch/i386/core/timer2.c
+++ b/gpxe/src/arch/i386/core/timer2.c
@@ -11,6 +11,8 @@
  * your option) any later version.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stddef.h>
 #include <gpxe/timer2.h>
 #include <gpxe/io.h>
diff --git a/gpxe/src/arch/i386/core/virtaddr.S b/gpxe/src/arch/i386/core/virtaddr.S
index cf6da4f6..aae1e1ed 100644
--- a/gpxe/src/arch/i386/core/virtaddr.S
+++ b/gpxe/src/arch/i386/core/virtaddr.S
@@ -4,6 +4,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 #include "librm.h"
 		
 	.arch i386
diff --git a/gpxe/src/arch/i386/core/x86_io.c b/gpxe/src/arch/i386/core/x86_io.c
index 424a96cc..d2c363b9 100644
--- a/gpxe/src/arch/i386/core/x86_io.c
+++ b/gpxe/src/arch/i386/core/x86_io.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/io.h>
 #include <gpxe/x86_io.h>
 
diff --git a/gpxe/src/arch/i386/drivers/net/undi.c b/gpxe/src/arch/i386/drivers/net/undi.c
index 1090cc94..c6e253c0 100644
--- a/gpxe/src/arch/i386/drivers/net/undi.c
+++ b/gpxe/src/arch/i386/drivers/net/undi.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ -135,7 +137,7 @@ static void undipci_remove ( struct pci_device *pci ) {
 }
 
 static struct pci_device_id undipci_nics[] = {
-PCI_ROM ( 0xffff, 0xffff, "undipci", "UNDI (PCI)" ),
+PCI_ROM ( 0xffff, 0xffff, "undipci", "UNDI (PCI)", 0 ),
 };
 
 struct pci_driver undipci_driver __pci_driver = {
diff --git a/gpxe/src/arch/i386/drivers/net/undiisr.S b/gpxe/src/arch/i386/drivers/net/undiisr.S
index 2b31b414..b27effe1 100644
--- a/gpxe/src/arch/i386/drivers/net/undiisr.S
+++ b/gpxe/src/arch/i386/drivers/net/undiisr.S
@@ -1,3 +1,5 @@
+FILE_LICENCE ( GPL2_OR_LATER )
+
 #define PXENV_UNDI_ISR 0x0014
 #define PXENV_UNDI_ISR_IN_START 1
 #define PXENV_UNDI_ISR_OUT_OURS 0
@@ -29,7 +31,7 @@ undiisr:
 	movw	%ax, %ds
 
 	/* Check that we have an UNDI entry point */
-	cmpw	$0, undinet_entry_point
+	cmpw	$0, pxeparent_entry_point
 	je	chain
 	
 	/* Issue UNDI API call */
@@ -40,7 +42,7 @@ undiisr:
 	pushw	%es
 	pushw	%di
 	pushw	%bx
-	lcall	*undinet_entry_point
+	lcall	*pxeparent_entry_point
 	cli	/* Just in case */
 	addw	$6, %sp
 	cmpw	$PXENV_UNDI_ISR_OUT_OURS, funcflag
diff --git a/gpxe/src/arch/i386/drivers/net/undiload.c b/gpxe/src/arch/i386/drivers/net/undiload.c
index dbd9e7c2..1d4e88d7 100644
--- a/gpxe/src/arch/i386/drivers/net/undiload.c
+++ b/gpxe/src/arch/i386/drivers/net/undiload.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -90,11 +92,10 @@ int undi_load ( struct undi_device *undi, struct undi_rom *undirom ) {
 	undi_loader_entry = undirom->loader_entry;
 	__asm__ __volatile__ ( REAL_CODE ( "pushw %%ds\n\t"
 					   "pushw %%ax\n\t"
-					   "lcall *%c2\n\t"
+					   "lcall *undi_loader_entry\n\t"
 					   "addw $4, %%sp\n\t" )
 			       : "=a" ( exit )
-			       : "a" ( __from_data16 ( &undi_loader ) ),
-			         "p" ( __from_data16 ( &undi_loader_entry ) )
+			       : "a" ( __from_data16 ( &undi_loader ) )
 			       : "ebx", "ecx", "edx", "esi", "edi", "ebp" );
 
 	/* UNDI API calls may rudely change the status of A20 and not
diff --git a/gpxe/src/arch/i386/drivers/net/undinet.c b/gpxe/src/arch/i386/drivers/net/undinet.c
index d6db6f7c..83b79e7f 100644
--- a/gpxe/src/arch/i386/drivers/net/undinet.c
+++ b/gpxe/src/arch/i386/drivers/net/undinet.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <string.h>
 #include <pxe.h>
 #include <realmode.h>
@@ -30,6 +32,7 @@
 #include <gpxe/ethernet.h>
 #include <undi.h>
 #include <undinet.h>
+#include <pxeparent.h>
 
 
 /** @file
@@ -60,179 +63,8 @@ struct undi_nic {
 
 static void undinet_close ( struct net_device *netdev );
 
-/*****************************************************************************
- *
- * UNDI API call
- *
- *****************************************************************************
- */
-
-/**
- * Name UNDI API call
- *
- * @v function		API call number
- * @ret name		API call name
- */
-static inline __attribute__ (( always_inline )) const char *
-undinet_function_name ( unsigned int function ) {
-	switch ( function ) {
-	case PXENV_START_UNDI:
-		return "PXENV_START_UNDI";
-	case PXENV_STOP_UNDI:
-		return "PXENV_STOP_UNDI";
-	case PXENV_UNDI_STARTUP:
-		return "PXENV_UNDI_STARTUP";
-	case PXENV_UNDI_CLEANUP:
-		return "PXENV_UNDI_CLEANUP";
-	case PXENV_UNDI_INITIALIZE:
-		return "PXENV_UNDI_INITIALIZE";
-	case PXENV_UNDI_RESET_ADAPTER:
-		return "PXENV_UNDI_RESET_ADAPTER";
-	case PXENV_UNDI_SHUTDOWN:
-		return "PXENV_UNDI_SHUTDOWN";
-	case PXENV_UNDI_OPEN:
-		return "PXENV_UNDI_OPEN";
-	case PXENV_UNDI_CLOSE:
-		return "PXENV_UNDI_CLOSE";
-	case PXENV_UNDI_TRANSMIT:
-		return "PXENV_UNDI_TRANSMIT";
-	case PXENV_UNDI_SET_MCAST_ADDRESS:
-		return "PXENV_UNDI_SET_MCAST_ADDRESS";
-	case PXENV_UNDI_SET_STATION_ADDRESS:
-		return "PXENV_UNDI_SET_STATION_ADDRESS";
-	case PXENV_UNDI_SET_PACKET_FILTER:
-		return "PXENV_UNDI_SET_PACKET_FILTER";
-	case PXENV_UNDI_GET_INFORMATION:
-		return "PXENV_UNDI_GET_INFORMATION";
-	case PXENV_UNDI_GET_STATISTICS:
-		return "PXENV_UNDI_GET_STATISTICS";
-	case PXENV_UNDI_CLEAR_STATISTICS:
-		return "PXENV_UNDI_CLEAR_STATISTICS";
-	case PXENV_UNDI_INITIATE_DIAGS:
-		return "PXENV_UNDI_INITIATE_DIAGS";
-	case PXENV_UNDI_FORCE_INTERRUPT:
-		return "PXENV_UNDI_FORCE_INTERRUPT";
-	case PXENV_UNDI_GET_MCAST_ADDRESS:
-		return "PXENV_UNDI_GET_MCAST_ADDRESS";
-	case PXENV_UNDI_GET_NIC_TYPE:
-		return "PXENV_UNDI_GET_NIC_TYPE";
-	case PXENV_UNDI_GET_IFACE_INFO:
-		return "PXENV_UNDI_GET_IFACE_INFO";
-	/*
-	 * Duplicate case value; this is a bug in the PXE specification.
-	 *
-	 *	case PXENV_UNDI_GET_STATE:
-	 *		return "PXENV_UNDI_GET_STATE";
-	 */
-	case PXENV_UNDI_ISR:
-		return "PXENV_UNDI_ISR";
-	default:
-		return "UNKNOWN API CALL";
-	}
-}
-
-/**
- * UNDI parameter block
- *
- * Used as the paramter block for all UNDI API calls.  Resides in base
- * memory.
- */
-static union u_PXENV_ANY __bss16 ( undinet_params );
-#define undinet_params __use_data16 ( undinet_params )
-
-/** UNDI entry point
- *
- * Used as the indirection vector for all UNDI API calls.  Resides in
- * base memory.
- */
-SEGOFF16_t __bss16 ( undinet_entry_point );
-#define undinet_entry_point __use_data16 ( undinet_entry_point )
-
-/**
- * Issue UNDI API call
- *
- * @v undinic		UNDI NIC
- * @v function		API call number
- * @v params		UNDI parameter block
- * @v params_len	Length of UNDI parameter block
- * @ret rc		Return status code
- */
-static int undinet_call ( struct undi_nic *undinic, unsigned int function,
-			  void *params, size_t params_len ) {
-	PXENV_EXIT_t exit;
-	int discard_b, discard_D;
-	int rc;
-
-	/* Copy parameter block and entry point */
-	assert ( params_len <= sizeof ( undinet_params ) );
-	memcpy ( &undinet_params, params, params_len );
-
-	/* Call real-mode entry point.  This calling convention will
-	 * work with both the !PXE and the PXENV+ entry points.
-	 */
-	__asm__ __volatile__ ( REAL_CODE ( "pushw %%es\n\t"
-					   "pushw %%di\n\t"
-					   "pushw %%bx\n\t"
-					   "lcall *%c3\n\t"
-					   "addw $6, %%sp\n\t" )
-			       : "=a" ( exit ), "=b" ( discard_b ),
-			         "=D" ( discard_D )
-			       : "p" ( __from_data16 ( &undinet_entry_point )),
-			         "b" ( function ),
-			         "D" ( __from_data16 ( &undinet_params ) )
-			       : "ecx", "edx", "esi", "ebp" );
-
-	/* UNDI API calls may rudely change the status of A20 and not
-	 * bother to restore it afterwards.  Intel is known to be
-	 * guilty of this.
-	 *
-	 * Note that we will return to this point even if A20 gets
-	 * screwed up by the UNDI driver, because Etherboot always
-	 * resides in an even megabyte of RAM.
-	 */	
-	gateA20_set();
-
-	/* Determine return status code based on PXENV_EXIT and
-	 * PXENV_STATUS
-	 */
-	if ( exit == PXENV_EXIT_SUCCESS ) {
-		rc = 0;
-	} else {
-		rc = -undinet_params.Status;
-		/* Paranoia; don't return success for the combination
-		 * of PXENV_EXIT_FAILURE but PXENV_STATUS_SUCCESS
-		 */
-		if ( rc == 0 )
-			rc = -EIO;
-	}
-
-	/* If anything goes wrong, print as much debug information as
-	 * it's possible to give.
-	 */
-	if ( rc != 0 ) {
-		SEGOFF16_t rm_params = {
-			.segment = rm_ds,
-			.offset = __from_data16 ( &undinet_params ),
-		};
-
-		DBGC ( undinic, "UNDINIC %p %s failed: %s\n", undinic,
-		       undinet_function_name ( function ), strerror ( rc ) );
-		DBGC ( undinic, "UNDINIC %p parameters at %04x:%04x length "
-		       "%#02zx, entry point at %04x:%04x\n", undinic,
-		       rm_params.segment, rm_params.offset, params_len,
-		       undinet_entry_point.segment,
-		       undinet_entry_point.offset );
-		DBGC ( undinic, "UNDINIC %p parameters provided:\n", undinic );
-		DBGC_HDA ( undinic, rm_params, params, params_len );
-		DBGC ( undinic, "UNDINIC %p parameters returned:\n", undinic );
-		DBGC_HDA ( undinic, rm_params, &undinet_params, params_len );
-	}
-
-	/* Copy parameter block back */
-	memcpy ( params, &undinet_params, params_len );
-
-	return rc;
-}
+/** Address of UNDI entry point */
+static SEGOFF16_t undinet_entry;
 
 /*****************************************************************************
  *
@@ -335,7 +167,6 @@ static struct s_PXENV_UNDI_TBD __data16 ( undinet_tbd );
  */
 static int undinet_transmit ( struct net_device *netdev,
 			      struct io_buffer *iobuf ) {
-	struct undi_nic *undinic = netdev->priv;
 	struct s_PXENV_UNDI_TRANSMIT undi_transmit;
 	size_t len = iob_len ( iobuf );
 	int rc;
@@ -368,9 +199,9 @@ static int undinet_transmit ( struct net_device *netdev,
 	undinet_tbd.Xmit.offset = __from_data16 ( basemem_packet );
 
 	/* Issue PXE API call */
-	if ( ( rc = undinet_call ( undinic, PXENV_UNDI_TRANSMIT,
-				   &undi_transmit,
-				   sizeof ( undi_transmit ) ) ) != 0 )
+	if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_TRANSMIT,
+				     &undi_transmit,
+				     sizeof ( undi_transmit ) ) ) != 0 )
 		goto done;
 
 	/* Free I/O buffer */
@@ -440,8 +271,9 @@ static void undinet_poll ( struct net_device *netdev ) {
 
 	/* Run through the ISR loop */
 	while ( 1 ) {
-		if ( ( rc = undinet_call ( undinic, PXENV_UNDI_ISR, &undi_isr,
-					   sizeof ( undi_isr ) ) ) != 0 )
+		if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_ISR,
+					     &undi_isr,
+					     sizeof ( undi_isr ) ) ) != 0 )
 			break;
 		switch ( undi_isr.FuncFlag ) {
 		case PXENV_UNDI_ISR_OUT_TRANSMIT:
@@ -537,8 +369,8 @@ static int undinet_open ( struct net_device *netdev ) {
 	 */
 	memcpy ( undi_set_address.StationAddress, netdev->ll_addr,
 		 sizeof ( undi_set_address.StationAddress ) );
-	undinet_call ( undinic, PXENV_UNDI_SET_STATION_ADDRESS,
-		       &undi_set_address, sizeof ( undi_set_address ) );
+	pxeparent_call ( undinet_entry, PXENV_UNDI_SET_STATION_ADDRESS,
+			 &undi_set_address, sizeof ( undi_set_address ) );
 
 	/* Open NIC.  We ask for promiscuous operation, since it's the
 	 * only way to ask for all multicast addresses.  On any
@@ -547,8 +379,8 @@ static int undinet_open ( struct net_device *netdev ) {
 	 */
 	memset ( &undi_open, 0, sizeof ( undi_open ) );
 	undi_open.PktFilter = ( FLTR_DIRECTED | FLTR_BRDCST | FLTR_PRMSCS );
-	if ( ( rc = undinet_call ( undinic, PXENV_UNDI_OPEN, &undi_open,
-				   sizeof ( undi_open ) ) ) != 0 )
+	if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_OPEN,
+				     &undi_open, sizeof ( undi_open ) ) ) != 0 )
 		goto err;
 
 	DBGC ( undinic, "UNDINIC %p opened\n", undinic );
@@ -573,8 +405,9 @@ static void undinet_close ( struct net_device *netdev ) {
 	/* Ensure ISR has exited cleanly */
 	while ( undinic->isr_processing ) {
 		undi_isr.FuncFlag = PXENV_UNDI_ISR_IN_GET_NEXT;
-		if ( ( rc = undinet_call ( undinic, PXENV_UNDI_ISR, &undi_isr,
-					   sizeof ( undi_isr ) ) ) != 0 )
+		if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_ISR,
+					     &undi_isr,
+					     sizeof ( undi_isr ) ) ) != 0 )
 			break;
 		switch ( undi_isr.FuncFlag ) {
 		case PXENV_UNDI_ISR_OUT_TRANSMIT:
@@ -589,8 +422,8 @@ static void undinet_close ( struct net_device *netdev ) {
 	}
 
 	/* Close NIC */
-	undinet_call ( undinic, PXENV_UNDI_CLOSE, &undi_close,
-		       sizeof ( undi_close ) );
+	pxeparent_call ( undinet_entry, PXENV_UNDI_CLOSE,
+			 &undi_close, sizeof ( undi_close ) );
 
 	/* Disable interrupt and unhook ISR */
 	disable_irq ( undinic->irq );
@@ -650,7 +483,7 @@ int undinet_probe ( struct undi_device *undi ) {
 	undi_set_drvdata ( undi, netdev );
 	netdev->dev = &undi->dev;
 	memset ( undinic, 0, sizeof ( *undinic ) );
-	undinet_entry_point = undi->entry;
+	undinet_entry = undi->entry;
 	DBGC ( undinic, "UNDINIC %p using UNDI %p\n", undinic, undi );
 
 	/* Hook in UNDI stack */
@@ -661,9 +494,9 @@ int undinet_probe ( struct undi_device *undi ) {
 		start_undi.DX = undi->isapnp_read_port;
 		start_undi.ES = BIOS_SEG;
 		start_undi.DI = find_pnp_bios();
-		if ( ( rc = undinet_call ( undinic, PXENV_START_UNDI,
-					   &start_undi,
-					   sizeof ( start_undi ) ) ) != 0 )
+		if ( ( rc = pxeparent_call ( undinet_entry, PXENV_START_UNDI,
+					     &start_undi,
+					     sizeof ( start_undi ) ) ) != 0 )
 			goto err_start_undi;
 	}
 	undi->flags |= UNDI_FL_STARTED;
@@ -671,24 +504,25 @@ int undinet_probe ( struct undi_device *undi ) {
 	/* Bring up UNDI stack */
 	if ( ! ( undi->flags & UNDI_FL_INITIALIZED ) ) {
 		memset ( &undi_startup, 0, sizeof ( undi_startup ) );
-		if ( ( rc = undinet_call ( undinic, PXENV_UNDI_STARTUP,
-					   &undi_startup,
-					   sizeof ( undi_startup ) ) ) != 0 )
+		if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_STARTUP,
+					     &undi_startup,
+					     sizeof ( undi_startup ) ) ) != 0 )
 			goto err_undi_startup;
 		memset ( &undi_initialize, 0, sizeof ( undi_initialize ) );
-		if ( ( rc = undinet_call ( undinic, PXENV_UNDI_INITIALIZE,
-					   &undi_initialize,
-					   sizeof ( undi_initialize ))) != 0 )
+		if ( ( rc = pxeparent_call ( undinet_entry,
+					     PXENV_UNDI_INITIALIZE,
+					     &undi_initialize,
+					     sizeof ( undi_initialize ))) != 0 )
 			goto err_undi_initialize;
 	}
 	undi->flags |= UNDI_FL_INITIALIZED;
 
 	/* Get device information */
 	memset ( &undi_info, 0, sizeof ( undi_info ) );
-	if ( ( rc = undinet_call ( undinic, PXENV_UNDI_GET_INFORMATION,
-				   &undi_info, sizeof ( undi_info ) ) ) != 0 )
+	if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_GET_INFORMATION,
+				     &undi_info, sizeof ( undi_info ) ) ) != 0 )
 		goto err_undi_get_information;
-	memcpy ( netdev->ll_addr, undi_info.PermNodeAddress, ETH_ALEN );
+	memcpy ( netdev->hw_addr, undi_info.PermNodeAddress, ETH_ALEN );
 	undinic->irq = undi_info.IntNumber;
 	if ( undinic->irq > IRQ_MAX ) {
 		DBGC ( undinic, "UNDINIC %p invalid IRQ %d\n",
@@ -696,16 +530,17 @@ int undinet_probe ( struct undi_device *undi ) {
 		goto err_bad_irq;
 	}
 	DBGC ( undinic, "UNDINIC %p is %s on IRQ %d\n",
-	       undinic, eth_ntoa ( netdev->ll_addr ), undinic->irq );
+	       undinic, eth_ntoa ( netdev->hw_addr ), undinic->irq );
 
 	/* Get interface information */
 	memset ( &undi_iface, 0, sizeof ( undi_iface ) );
-	if ( ( rc = undinet_call ( undinic, PXENV_UNDI_GET_IFACE_INFO,
-				   &undi_iface,
-				   sizeof ( undi_iface ) ) ) != 0 )
+	if ( ( rc = pxeparent_call ( undinet_entry, PXENV_UNDI_GET_IFACE_INFO,
+				     &undi_iface,
+				     sizeof ( undi_iface ) ) ) != 0 )
 		goto err_undi_get_iface_info;
-	DBGC ( undinic, "UNDINIC %p has type %s and link speed %d\n",
-	       undinic, undi_iface.IfaceType, undi_iface.LinkSpeed );
+	DBGC ( undinic, "UNDINIC %p has type %s, speed %d, flags %08x\n",
+	       undinic, undi_iface.IfaceType, undi_iface.LinkSpeed,
+	       undi_iface.ServiceFlags );
 	if ( strncmp ( ( ( char * ) undi_iface.IfaceType ), "Etherboot",
 		       sizeof ( undi_iface.IfaceType ) ) == 0 ) {
 		DBGC ( undinic, "UNDINIC %p Etherboot 5.4 workaround enabled\n",
@@ -730,17 +565,17 @@ int undinet_probe ( struct undi_device *undi ) {
  err_undi_initialize:
 	/* Shut down UNDI stack */
 	memset ( &undi_shutdown, 0, sizeof ( undi_shutdown ) );
-	undinet_call ( undinic, PXENV_UNDI_SHUTDOWN, &undi_shutdown,
-		       sizeof ( undi_shutdown ) );
+	pxeparent_call ( undinet_entry, PXENV_UNDI_SHUTDOWN, &undi_shutdown,
+			 sizeof ( undi_shutdown ) );
 	memset ( &undi_cleanup, 0, sizeof ( undi_cleanup ) );
-	undinet_call ( undinic, PXENV_UNDI_CLEANUP, &undi_cleanup,
-		       sizeof ( undi_cleanup ) );
+	pxeparent_call ( undinet_entry, PXENV_UNDI_CLEANUP, &undi_cleanup,
+			 sizeof ( undi_cleanup ) );
 	undi->flags &= ~UNDI_FL_INITIALIZED;
  err_undi_startup:
 	/* Unhook UNDI stack */
 	memset ( &stop_undi, 0, sizeof ( stop_undi ) );
-	undinet_call ( undinic, PXENV_STOP_UNDI, &stop_undi,
-		       sizeof ( stop_undi ) );
+	pxeparent_call ( undinet_entry, PXENV_STOP_UNDI, &stop_undi,
+			 sizeof ( stop_undi ) );
 	undi->flags &= ~UNDI_FL_STARTED;
  err_start_undi:
 	netdev_nullify ( netdev );
@@ -771,22 +606,22 @@ void undinet_remove ( struct undi_device *undi ) {
 
 		/* Shut down UNDI stack */
 		memset ( &undi_shutdown, 0, sizeof ( undi_shutdown ) );
-		undinet_call ( undinic, PXENV_UNDI_SHUTDOWN, &undi_shutdown,
-			       sizeof ( undi_shutdown ) );
+		pxeparent_call ( undinet_entry, PXENV_UNDI_SHUTDOWN,
+				 &undi_shutdown, sizeof ( undi_shutdown ) );
 		memset ( &undi_cleanup, 0, sizeof ( undi_cleanup ) );
-		undinet_call ( undinic, PXENV_UNDI_CLEANUP, &undi_cleanup,
-			       sizeof ( undi_cleanup ) );
+		pxeparent_call ( undinet_entry, PXENV_UNDI_CLEANUP,
+				 &undi_cleanup, sizeof ( undi_cleanup ) );
 		undi->flags &= ~UNDI_FL_INITIALIZED;
 
 		/* Unhook UNDI stack */
 		memset ( &stop_undi, 0, sizeof ( stop_undi ) );
-		undinet_call ( undinic, PXENV_STOP_UNDI, &stop_undi,
-			       sizeof ( stop_undi ) );
+		pxeparent_call ( undinet_entry, PXENV_STOP_UNDI, &stop_undi,
+				 sizeof ( stop_undi ) );
 		undi->flags &= ~UNDI_FL_STARTED;
 	}
 
 	/* Clear entry point */
-	memset ( &undinet_entry_point, 0, sizeof ( undinet_entry_point ) );
+	memset ( &undinet_entry, 0, sizeof ( undinet_entry ) );
 
 	/* Free network device */
 	netdev_nullify ( netdev );
diff --git a/gpxe/src/arch/i386/drivers/net/undionly.c b/gpxe/src/arch/i386/drivers/net/undionly.c
index 4cdce677..7dfb5d15 100644
--- a/gpxe/src/arch/i386/drivers/net/undionly.c
+++ b/gpxe/src/arch/i386/drivers/net/undionly.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/gpxe/src/arch/i386/drivers/net/undipreload.c b/gpxe/src/arch/i386/drivers/net/undipreload.c
index e29d150a..a4b2f4ac 100644
--- a/gpxe/src/arch/i386/drivers/net/undipreload.c
+++ b/gpxe/src/arch/i386/drivers/net/undipreload.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <realmode.h>
 #include <undipreload.h>
 
diff --git a/gpxe/src/arch/i386/drivers/net/undirom.c b/gpxe/src/arch/i386/drivers/net/undirom.c
index e5782781..2463d969 100644
--- a/gpxe/src/arch/i386/drivers/net/undirom.c
+++ b/gpxe/src/arch/i386/drivers/net/undirom.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/gpxe/src/arch/i386/firmware/pcbios/basemem.c b/gpxe/src/arch/i386/firmware/pcbios/basemem.c
index b126d2a7..1ba7d1f6 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/basemem.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/basemem.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <realmode.h>
 #include <bios.h>
diff --git a/gpxe/src/arch/i386/firmware/pcbios/bios_console.c b/gpxe/src/arch/i386/firmware/pcbios/bios_console.c
index 91363772..1d18e54c 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/bios_console.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/bios_console.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <assert.h>
 #include <realmode.h>
 #include <console.h>
diff --git a/gpxe/src/arch/i386/firmware/pcbios/e820mangler.S b/gpxe/src/arch/i386/firmware/pcbios/e820mangler.S
index decb0835..99ca519b 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/e820mangler.S
+++ b/gpxe/src/arch/i386/firmware/pcbios/e820mangler.S
@@ -15,7 +15,9 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-	
+
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.text
 	.arch i386
 	.code16
@@ -235,6 +237,7 @@ get_underlying_e820:
 	popw	%di
 	incw	%bx
 	movl	%edx, %eax
+	clc
 	ret
 2:	
 	/* If the requested region is earlier than the cached region,
diff --git a/gpxe/src/arch/i386/firmware/pcbios/fakee820.c b/gpxe/src/arch/i386/firmware/pcbios/fakee820.c
index 552bf41d..ea116fe5 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/fakee820.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/fakee820.c
@@ -15,6 +15,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <realmode.h>
 #include <biosint.h>
 
diff --git a/gpxe/src/arch/i386/firmware/pcbios/gateA20.c b/gpxe/src/arch/i386/firmware/pcbios/gateA20.c
index 34e3ac52..1a71472d 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/gateA20.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/gateA20.c
@@ -1,3 +1,5 @@
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdio.h>
 #include <realmode.h>
 #include <bios.h>
diff --git a/gpxe/src/arch/i386/firmware/pcbios/hidemem.c b/gpxe/src/arch/i386/firmware/pcbios/hidemem.c
index 620b62e0..17082c35 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/hidemem.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/hidemem.c
@@ -15,6 +15,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <assert.h>
 #include <realmode.h>
 #include <biosint.h>
diff --git a/gpxe/src/arch/i386/firmware/pcbios/memmap.c b/gpxe/src/arch/i386/firmware/pcbios/memmap.c
index ff387d93..8a30dbae 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/memmap.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/memmap.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <errno.h>
 #include <realmode.h>
diff --git a/gpxe/src/arch/i386/firmware/pcbios/pnpbios.c b/gpxe/src/arch/i386/firmware/pcbios/pnpbios.c
index 420d2ae8..c572914f 100644
--- a/gpxe/src/arch/i386/firmware/pcbios/pnpbios.c
+++ b/gpxe/src/arch/i386/firmware/pcbios/pnpbios.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <string.h>
 #include <errno.h>
diff --git a/gpxe/src/arch/i386/hci/commands/pxe_cmd.c b/gpxe/src/arch/i386/hci/commands/pxe_cmd.c
new file mode 100644
index 00000000..b5df2d1b
--- /dev/null
+++ b/gpxe/src/arch/i386/hci/commands/pxe_cmd.c
@@ -0,0 +1,33 @@
+#include <gpxe/netdevice.h>
+#include <gpxe/command.h>
+#include <hci/ifmgmt_cmd.h>
+#include <pxe_call.h>
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+static int startpxe_payload ( struct net_device *netdev ) {
+	if ( netdev->state & NETDEV_OPEN )
+		pxe_activate ( netdev );
+	return 0;
+}
+
+static int startpxe_exec ( int argc, char **argv ) {
+	return ifcommon_exec ( argc, argv, startpxe_payload,
+			       "Activate PXE on" );
+}
+
+static int stoppxe_exec ( int argc __unused, char **argv __unused ) {
+	pxe_deactivate();
+	return 0;
+}
+
+struct command pxe_commands[] __command = {
+	{
+		.name = "startpxe",
+		.exec = startpxe_exec,
+	},
+	{
+		.name = "stoppxe",
+		.exec = stoppxe_exec,
+	},
+};
diff --git a/gpxe/src/arch/i386/image/bootsector.c b/gpxe/src/arch/i386/image/bootsector.c
index 0f297a26..f96cf201 100644
--- a/gpxe/src/arch/i386/image/bootsector.c
+++ b/gpxe/src/arch/i386/image/bootsector.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
diff --git a/gpxe/src/arch/i386/image/bzimage.c b/gpxe/src/arch/i386/image/bzimage.c
index 47d46ca4..19450990 100644
--- a/gpxe/src/arch/i386/image/bzimage.c
+++ b/gpxe/src/arch/i386/image/bzimage.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
@@ -42,9 +44,11 @@ FEATURE ( FEATURE_IMAGE, "bzImage", DHCP_EB_FEATURE_BZIMAGE, 1 );
 struct image_type bzimage_image_type __image_type ( PROBE_NORMAL );
 
 /**
- * bzImage load context
+ * bzImage context
  */
-struct bzimage_load_context {
+struct bzimage_context {
+	/** Boot protocol version */
+	unsigned int version;
 	/** Real-mode kernel portion load segment address */
 	unsigned int rm_kernel_seg;
 	/** Real-mode kernel portion load address */
@@ -55,28 +59,14 @@ struct bzimage_load_context {
 	size_t rm_heap;
 	/** Command line (offset from rm_kernel) */
 	size_t rm_cmdline;
+	/** Command line maximum length */
+	size_t cmdline_size;
 	/** Real-mode kernel portion total memory size */
 	size_t rm_memsz;
 	/** Non-real-mode kernel portion load address */
 	userptr_t pm_kernel;
 	/** Non-real-mode kernel portion file and memory size */
 	size_t pm_sz;
-};
-
-/**
- * bzImage execution context
- */
-struct bzimage_exec_context {
-	/** Real-mode kernel portion load segment address */
-	unsigned int rm_kernel_seg;
-	/** Real-mode kernel portion load address */
-	userptr_t rm_kernel;
-	/** Real-mode heap top (offset from rm_kernel) */
-	size_t rm_heap;
-	/** Command line (offset from rm_kernel) */
-	size_t rm_cmdline;
-	/** Command line maximum length */
-	size_t cmdline_size;
 	/** Video mode */
 	unsigned int vid_mode;
 	/** Memory limit */
@@ -85,18 +75,178 @@ struct bzimage_exec_context {
 	physaddr_t ramdisk_image;
 	/** Initrd size */
 	physaddr_t ramdisk_size;
+
+	/** Command line magic block */
+	struct bzimage_cmdline cmdline_magic;
+	/** bzImage header */
+	struct bzimage_header bzhdr;
 };
 
 /**
+ * Parse bzImage header
+ *
+ * @v image		bzImage file
+ * @v bzimg		bzImage context
+ * @v src		bzImage to parse
+ * @ret rc		Return status code
+ */
+static int bzimage_parse_header ( struct image *image,
+				  struct bzimage_context *bzimg,
+				  userptr_t src ) {
+	unsigned int syssize;
+	int is_bzimage;
+
+	/* Sanity check */
+	if ( image->len < ( BZI_HDR_OFFSET + sizeof ( bzimg->bzhdr ) ) ) {
+		DBGC ( image, "bzImage %p too short for kernel header\n",
+		       image );
+		return -ENOEXEC;
+	}
+
+	/* Read in header structures */
+	memset ( bzimg, 0, sizeof ( *bzimg ) );
+	copy_from_user ( &bzimg->cmdline_magic, src, BZI_CMDLINE_OFFSET,
+			 sizeof ( bzimg->cmdline_magic ) );
+	copy_from_user ( &bzimg->bzhdr, src, BZI_HDR_OFFSET,
+			 sizeof ( bzimg->bzhdr ) );
+
+	/* Calculate size of real-mode portion */
+	bzimg->rm_filesz =
+		( ( bzimg->bzhdr.setup_sects ? bzimg->bzhdr.setup_sects : 4 ) + 1 ) << 9;
+	if ( bzimg->rm_filesz > image->len ) {
+		DBGC ( image, "bzImage %p too short for %zd byte of setup\n",
+		       image, bzimg->rm_filesz );
+		return -ENOEXEC;
+	}
+	bzimg->rm_memsz = BZI_ASSUMED_RM_SIZE;
+
+	/* Calculate size of protected-mode portion */
+	bzimg->pm_sz = ( image->len - bzimg->rm_filesz );
+	syssize = ( ( bzimg->pm_sz + 15 ) / 16 );
+
+	/* Check for signatures and determine version */
+	if ( bzimg->bzhdr.boot_flag != BZI_BOOT_FLAG ) {
+		DBGC ( image, "bzImage %p missing 55AA signature\n", image );
+		return -ENOEXEC;
+	}
+	if ( bzimg->bzhdr.header == BZI_SIGNATURE ) {
+		/* 2.00+ */
+		bzimg->version = bzimg->bzhdr.version;
+	} else {
+		/* Pre-2.00.  Check that the syssize field is correct,
+		 * as a guard against accepting arbitrary binary data,
+		 * since the 55AA check is pretty lax.  Note that the
+		 * syssize field is unreliable for protocols between
+		 * 2.00 and 2.03 inclusive, so we should not always
+		 * check this field.
+		 */
+		bzimg->version = 0x0100;
+		if ( bzimg->bzhdr.syssize != syssize ) {
+			DBGC ( image, "bzImage %p bad syssize %x (expected "
+			       "%x)\n", image, bzimg->bzhdr.syssize, syssize );
+			return -ENOEXEC;
+		}
+	}
+
+	/* Determine image type */
+	is_bzimage = ( ( bzimg->version >= 0x0200 ) ?
+		       ( bzimg->bzhdr.loadflags & BZI_LOAD_HIGH ) : 0 );
+
+	/* Calculate load address of real-mode portion */
+	bzimg->rm_kernel_seg = ( is_bzimage ? 0x1000 : 0x9000 );
+	bzimg->rm_kernel = real_to_user ( bzimg->rm_kernel_seg, 0 );
+
+	/* Allow space for the stack and heap */
+	bzimg->rm_memsz += BZI_STACK_SIZE;
+	bzimg->rm_heap = bzimg->rm_memsz;
+
+	/* Allow space for the command line */
+	bzimg->rm_cmdline = bzimg->rm_memsz;
+	bzimg->rm_memsz += BZI_CMDLINE_SIZE;
+
+	/* Calculate load address of protected-mode portion */
+	bzimg->pm_kernel = phys_to_user ( is_bzimage ? BZI_LOAD_HIGH_ADDR
+					: BZI_LOAD_LOW_ADDR );
+
+	/* Extract video mode */
+	bzimg->vid_mode = bzimg->bzhdr.vid_mode;
+
+	/* Extract memory limit */
+	bzimg->mem_limit = ( ( bzimg->version >= 0x0203 ) ?
+			     bzimg->bzhdr.initrd_addr_max : BZI_INITRD_MAX );
+
+	/* Extract command line size */
+	bzimg->cmdline_size = ( ( bzimg->version >= 0x0206 ) ?
+				bzimg->bzhdr.cmdline_size : BZI_CMDLINE_SIZE );
+
+	DBGC ( image, "bzImage %p version %04x RM %#lx+%#zx PM %#lx+%#zx "
+	       "cmdlen %zd\n", image, bzimg->version,
+	       user_to_phys ( bzimg->rm_kernel, 0 ), bzimg->rm_filesz,
+	       user_to_phys ( bzimg->pm_kernel, 0 ), bzimg->pm_sz,
+	       bzimg->cmdline_size );
+
+	return 0;
+}
+
+/**
+ * Update bzImage header in loaded kernel
+ *
+ * @v image		bzImage file
+ * @v bzimg		bzImage context
+ * @v dst		bzImage to update
+ */
+static void bzimage_update_header ( struct image *image,
+				    struct bzimage_context *bzimg,
+				    userptr_t dst ) {
+
+	/* Set loader type */
+	if ( bzimg->version >= 0x0200 )
+		bzimg->bzhdr.type_of_loader = BZI_LOADER_TYPE_GPXE;
+
+	/* Set heap end pointer */
+	if ( bzimg->version >= 0x0201 ) {
+		bzimg->bzhdr.heap_end_ptr = ( bzimg->rm_heap - 0x200 );
+		bzimg->bzhdr.loadflags |= BZI_CAN_USE_HEAP;
+	}
+
+	/* Set command line */
+	if ( bzimg->version >= 0x0202 ) {
+		bzimg->bzhdr.cmd_line_ptr = user_to_phys ( bzimg->rm_kernel,
+							   bzimg->rm_cmdline );
+	} else {
+		bzimg->cmdline_magic.magic = BZI_CMDLINE_MAGIC;
+		bzimg->cmdline_magic.offset = bzimg->rm_cmdline;
+		bzimg->bzhdr.setup_move_size = bzimg->rm_memsz;
+	}
+
+	/* Set video mode */
+	bzimg->bzhdr.vid_mode = bzimg->vid_mode;
+
+	/* Set initrd address */
+	if ( bzimg->version >= 0x0200 ) {
+		bzimg->bzhdr.ramdisk_image = bzimg->ramdisk_image;
+		bzimg->bzhdr.ramdisk_size = bzimg->ramdisk_size;
+	}
+
+	/* Write out header structures */
+	copy_to_user ( dst, BZI_CMDLINE_OFFSET, &bzimg->cmdline_magic,
+		       sizeof ( bzimg->cmdline_magic ) );
+	copy_to_user ( dst, BZI_HDR_OFFSET, &bzimg->bzhdr,
+		       sizeof ( bzimg->bzhdr ) );
+
+	DBGC ( image, "bzImage %p vidmode %d\n", image, bzimg->vid_mode );
+}
+
+/**
  * Parse kernel command line for bootloader parameters
  *
  * @v image		bzImage file
- * @v exec_ctx		Execution context
+ * @v bzimg		bzImage context
  * @v cmdline		Kernel command line
  * @ret rc		Return status code
  */
 static int bzimage_parse_cmdline ( struct image *image,
-				   struct bzimage_exec_context *exec_ctx,
+				   struct bzimage_context *bzimg,
 				   const char *cmdline ) {
 	char *vga;
 	char *mem;
@@ -105,13 +255,13 @@ static int bzimage_parse_cmdline ( struct image *image,
 	if ( ( vga = strstr ( cmdline, "vga=" ) ) ) {
 		vga += 4;
 		if ( strcmp ( vga, "normal" ) == 0 ) {
-			exec_ctx->vid_mode = BZI_VID_MODE_NORMAL;
+			bzimg->vid_mode = BZI_VID_MODE_NORMAL;
 		} else if ( strcmp ( vga, "ext" ) == 0 ) {
-			exec_ctx->vid_mode = BZI_VID_MODE_EXT;
+			bzimg->vid_mode = BZI_VID_MODE_EXT;
 		} else if ( strcmp ( vga, "ask" ) == 0 ) {
-			exec_ctx->vid_mode = BZI_VID_MODE_ASK;
+			bzimg->vid_mode = BZI_VID_MODE_ASK;
 		} else {
-			exec_ctx->vid_mode = strtoul ( vga, &vga, 0 );
+			bzimg->vid_mode = strtoul ( vga, &vga, 0 );
 			if ( *vga && ( *vga != ' ' ) ) {
 				DBGC ( image, "bzImage %p strange \"vga=\""
 				       "terminator '%c'\n", image, *vga );
@@ -122,17 +272,17 @@ static int bzimage_parse_cmdline ( struct image *image,
 	/* Look for "mem=" */
 	if ( ( mem = strstr ( cmdline, "mem=" ) ) ) {
 		mem += 4;
-		exec_ctx->mem_limit = strtoul ( mem, &mem, 0 );
+		bzimg->mem_limit = strtoul ( mem, &mem, 0 );
 		switch ( *mem ) {
 		case 'G':
 		case 'g':
-			exec_ctx->mem_limit <<= 10;
+			bzimg->mem_limit <<= 10;
 		case 'M':
 		case 'm':
-			exec_ctx->mem_limit <<= 10;
+			bzimg->mem_limit <<= 10;
 		case 'K':
 		case 'k':
-			exec_ctx->mem_limit <<= 10;
+			bzimg->mem_limit <<= 10;
 			break;
 		case '\0':
 		case ' ':
@@ -142,7 +292,7 @@ static int bzimage_parse_cmdline ( struct image *image,
 			       "terminator '%c'\n", image, *mem );
 			break;
 		}
-		exec_ctx->mem_limit -= 1;
+		bzimg->mem_limit -= 1;
 	}
 
 	return 0;
@@ -152,20 +302,20 @@ static int bzimage_parse_cmdline ( struct image *image,
  * Set command line
  *
  * @v image		bzImage image
- * @v exec_ctx		Execution context
+ * @v bzimg		bzImage context
  * @v cmdline		Kernel command line
  * @ret rc		Return status code
  */
 static int bzimage_set_cmdline ( struct image *image,
-				 struct bzimage_exec_context *exec_ctx,
+				 struct bzimage_context *bzimg,
 				 const char *cmdline ) {
 	size_t cmdline_len;
 
 	/* Copy command line down to real-mode portion */
 	cmdline_len = ( strlen ( cmdline ) + 1 );
-	if ( cmdline_len > exec_ctx->cmdline_size )
-		cmdline_len = exec_ctx->cmdline_size;
-	copy_to_user ( exec_ctx->rm_kernel, exec_ctx->rm_cmdline,
+	if ( cmdline_len > bzimg->cmdline_size )
+		cmdline_len = bzimg->cmdline_size;
+	copy_to_user ( bzimg->rm_kernel, bzimg->rm_cmdline,
 		       cmdline, cmdline_len );
 	DBGC ( image, "bzImage %p command line \"%s\"\n", image, cmdline );
 
@@ -217,14 +367,16 @@ static size_t bzimage_load_initrd ( struct image *image,
 	}
 
 	/* Copy in initrd image body */
+	if ( address )
+		memcpy_user ( address, offset, initrd->data, 0, initrd->len );
+	offset += initrd->len;
 	if ( address ) {
 		DBGC ( image, "bzImage %p has initrd %p at [%lx,%lx)\n",
-		       image, initrd, address, ( address + offset ) );
-		memcpy_user ( address, offset, initrd->data, 0,
-			      initrd->len );
+		       image, initrd, user_to_phys ( address, 0 ),
+		       user_to_phys ( address, offset ) );
 	}
-	offset += initrd->len;
 
+	/* Round up to 4-byte boundary */
 	offset = ( ( offset + 0x03 ) & ~0x03 );
 	return offset;
 }
@@ -233,20 +385,19 @@ static size_t bzimage_load_initrd ( struct image *image,
  * Load initrds, if any
  *
  * @v image		bzImage image
- * @v exec_ctx		Execution context
+ * @v bzimg		bzImage context
  * @ret rc		Return status code
  */
 static int bzimage_load_initrds ( struct image *image,
-				  struct bzimage_exec_context *exec_ctx ) {
+				  struct bzimage_context *bzimg ) {
 	struct image *initrd;
 	size_t total_len = 0;
 	physaddr_t address;
 	int rc;
 
 	/* Add up length of all initrd images */
-	for_each_image ( initrd ) {
+	for_each_image ( initrd )
 		total_len += bzimage_load_initrd ( image, initrd, UNULL );
-	}
 
 	/* Give up if no initrd images found */
 	if ( ! total_len )
@@ -268,7 +419,7 @@ static int bzimage_load_initrds ( struct image *image,
 			return -ENOBUFS;
 		}
 		/* Check that we are within the kernel's range */
-		if ( ( address + total_len - 1 ) > exec_ctx->mem_limit )
+		if ( ( address + total_len - 1 ) > bzimg->mem_limit )
 			continue;
 		/* Prepare and verify segment */
 		if ( ( rc = prep_segment ( phys_to_user ( address ), 0,
@@ -279,8 +430,8 @@ static int bzimage_load_initrds ( struct image *image,
 	}
 
 	/* Record initrd location */
-	exec_ctx->ramdisk_image = address;
-	exec_ctx->ramdisk_size = total_len;
+	bzimg->ramdisk_image = address;
+	bzimg->ramdisk_size = total_len;
 
 	/* Construct initrd */
 	DBGC ( image, "bzImage %p constructing initrd at [%lx,%lx)\n",
@@ -300,60 +451,37 @@ static int bzimage_load_initrds ( struct image *image,
  * @ret rc		Return status code
  */
 static int bzimage_exec ( struct image *image ) {
-	struct bzimage_exec_context exec_ctx;
-	struct bzimage_header bzhdr;
+	struct bzimage_context bzimg;
 	const char *cmdline = ( image->cmdline ? image->cmdline : "" );
 	int rc;
 
-	/* Initialise context */
-	memset ( &exec_ctx, 0, sizeof ( exec_ctx ) );
-
-	/* Retrieve kernel header */
-	exec_ctx.rm_kernel_seg = image->priv.ul;
-	exec_ctx.rm_kernel = real_to_user ( exec_ctx.rm_kernel_seg, 0 );
-	copy_from_user ( &bzhdr, exec_ctx.rm_kernel, BZI_HDR_OFFSET,
-			 sizeof ( bzhdr ) );
-	exec_ctx.rm_cmdline = exec_ctx.rm_heap = 
-		( bzhdr.heap_end_ptr + 0x200 );
-	exec_ctx.vid_mode = bzhdr.vid_mode;
-	if ( bzhdr.version >= 0x0203 ) {
-		exec_ctx.mem_limit = bzhdr.initrd_addr_max;
-	} else {
-		exec_ctx.mem_limit = BZI_INITRD_MAX;
-	}
-	if ( bzhdr.version >= 0x0206 ) {
-		exec_ctx.cmdline_size = bzhdr.cmdline_size;
-	} else {
-		exec_ctx.cmdline_size = BZI_CMDLINE_SIZE;
-	}
-	DBG ( "cmdline_size = %zd\n", exec_ctx.cmdline_size );
+	/* Read and parse header from loaded kernel */
+	if ( ( rc = bzimage_parse_header ( image, &bzimg,
+					   image->priv.user ) ) != 0 )
+		return rc;
+	assert ( bzimg.rm_kernel == image->priv.user );
 
 	/* Parse command line for bootloader parameters */
-	if ( ( rc = bzimage_parse_cmdline ( image, &exec_ctx, cmdline ) ) != 0)
+	if ( ( rc = bzimage_parse_cmdline ( image, &bzimg, cmdline ) ) != 0)
 		return rc;
 
 	/* Store command line */
-	if ( ( rc = bzimage_set_cmdline ( image, &exec_ctx, cmdline ) ) != 0 )
+	if ( ( rc = bzimage_set_cmdline ( image, &bzimg, cmdline ) ) != 0 )
 		return rc;
 
 	/* Load any initrds */
-	if ( ( rc = bzimage_load_initrds ( image, &exec_ctx ) ) != 0 )
+	if ( ( rc = bzimage_load_initrds ( image, &bzimg ) ) != 0 )
 		return rc;
 
-	/* Update and store kernel header */
-	bzhdr.vid_mode = exec_ctx.vid_mode;
-	bzhdr.ramdisk_image = exec_ctx.ramdisk_image;
-	bzhdr.ramdisk_size = exec_ctx.ramdisk_size;
-	copy_to_user ( exec_ctx.rm_kernel, BZI_HDR_OFFSET, &bzhdr,
-		       sizeof ( bzhdr ) );
+	/* Update kernel header */
+	bzimage_update_header ( image, &bzimg, bzimg.rm_kernel );
 
 	/* Prepare for exiting */
 	shutdown ( SHUTDOWN_BOOT );
 
 	DBGC ( image, "bzImage %p jumping to RM kernel at %04x:0000 "
-	       "(stack %04x:%04zx)\n", image,
-	       ( exec_ctx.rm_kernel_seg + 0x20 ),
-	       exec_ctx.rm_kernel_seg, exec_ctx.rm_heap );
+	       "(stack %04x:%04zx)\n", image, ( bzimg.rm_kernel_seg + 0x20 ),
+	       bzimg.rm_kernel_seg, bzimg.rm_heap );
 
 	/* Jump to the kernel */
 	__asm__ __volatile__ ( REAL_CODE ( "movw %w0, %%ds\n\t"
@@ -365,9 +493,9 @@ static int bzimage_exec ( struct image *image ) {
 					   "pushw %w2\n\t"
 					   "pushw $0\n\t"
 					   "lret\n\t" )
-			       : : "r" ( exec_ctx.rm_kernel_seg ),
-			           "r" ( exec_ctx.rm_heap ),
-			           "r" ( exec_ctx.rm_kernel_seg + 0x20 ) );
+			       : : "r" ( bzimg.rm_kernel_seg ),
+			           "r" ( bzimg.rm_heap ),
+			           "r" ( bzimg.rm_kernel_seg + 0x20 ) );
 
 	/* There is no way for the image to return, since we provide
 	 * no return address.
@@ -378,192 +506,49 @@ static int bzimage_exec ( struct image *image ) {
 }
 
 /**
- * Load and parse bzImage header
- *
- * @v image		bzImage file
- * @v load_ctx		Load context
- * @v bzhdr		Buffer for bzImage header
- * @ret rc		Return status code
- */
-static int bzimage_load_header ( struct image *image,
-				 struct bzimage_load_context *load_ctx,
-				 struct bzimage_header *bzhdr ) {
-
-	/* Sanity check */
-	if ( image->len < ( BZI_HDR_OFFSET + sizeof ( *bzhdr ) ) ) {
-		DBGC ( image, "bzImage %p too short for kernel header\n",
-		       image );
-		return -ENOEXEC;
-	}
-
-	/* Read and verify header */
-	copy_from_user ( bzhdr, image->data, BZI_HDR_OFFSET,
-			 sizeof ( *bzhdr ) );
-	if ( bzhdr->header != BZI_SIGNATURE ) {
-		DBGC ( image, "bzImage %p bad signature %08x\n",
-		       image, bzhdr->header );
-		return -ENOEXEC;
-	}
-
-	/* We don't support ancient kernels */
-	if ( bzhdr->version < 0x0200 ) {
-		DBGC ( image, "bzImage %p version %04x not supported\n",
-		       image, bzhdr->version );
-		return -ENOTSUP;
-	}
-
-	/* Calculate load address and size of real-mode portion */
-	load_ctx->rm_kernel_seg = ( ( bzhdr->loadflags & BZI_LOAD_HIGH ) ?
-				    0x1000 :  /* 1000:0000 (bzImage) */
-				    0x9000 ); /* 9000:0000 (zImage) */
-	load_ctx->rm_kernel = real_to_user ( load_ctx->rm_kernel_seg, 0 );
-	load_ctx->rm_filesz =
-		( ( bzhdr->setup_sects ? bzhdr->setup_sects : 4 ) + 1 ) << 9;
-	load_ctx->rm_memsz = BZI_ASSUMED_RM_SIZE;
-	if ( load_ctx->rm_filesz > image->len ) {
-		DBGC ( image, "bzImage %p too short for %zd byte of setup\n",
-		       image, load_ctx->rm_filesz );
-		return -ENOEXEC;
-	}
-
-	/* Calculate load address and size of non-real-mode portion */
-	load_ctx->pm_kernel = ( ( bzhdr->loadflags & BZI_LOAD_HIGH ) ?
-				phys_to_user ( BZI_LOAD_HIGH_ADDR ) :
-				phys_to_user ( BZI_LOAD_LOW_ADDR ) );
-	load_ctx->pm_sz = ( image->len - load_ctx->rm_filesz );
-
-	DBGC ( image, "bzImage %p version %04x RM %#zx bytes PM %#zx bytes\n",
-	       image, bzhdr->version, load_ctx->rm_filesz, load_ctx->pm_sz );
-	return 0;
-}
-
-/**
- * Load real-mode portion of bzImage
+ * Load bzImage image into memory
  *
  * @v image		bzImage file
- * @v load_ctx		Load context
  * @ret rc		Return status code
  */
-static int bzimage_load_real ( struct image *image,
-			       struct bzimage_load_context *load_ctx ) {
+int bzimage_load ( struct image *image ) {
+	struct bzimage_context bzimg;
 	int rc;
 
-	/* Allow space for the stack and heap */
-	load_ctx->rm_memsz += BZI_STACK_SIZE;
-	load_ctx->rm_heap = load_ctx->rm_memsz;
+	/* Read and parse header from image */
+	if ( ( rc = bzimage_parse_header ( image, &bzimg,
+					   image->data ) ) != 0 )
+		return rc;
 
-	/* Allow space for the command line */
-	load_ctx->rm_cmdline = load_ctx->rm_memsz;
-	load_ctx->rm_memsz += BZI_CMDLINE_SIZE;
+	/* This is a bzImage image, valid or otherwise */
+	if ( ! image->type )
+		image->type = &bzimage_image_type;
 
-	/* Prepare, verify, and load the real-mode segment */
-	if ( ( rc = prep_segment ( load_ctx->rm_kernel, load_ctx->rm_filesz,
-				   load_ctx->rm_memsz ) ) != 0 ) {
+	/* Prepare segments */
+	if ( ( rc = prep_segment ( bzimg.rm_kernel, bzimg.rm_filesz,
+				   bzimg.rm_memsz ) ) != 0 ) {
 		DBGC ( image, "bzImage %p could not prepare RM segment: %s\n",
 		       image, strerror ( rc ) );
 		return rc;
 	}
-	memcpy_user ( load_ctx->rm_kernel, 0, image->data, 0,
-		      load_ctx->rm_filesz );
-
-	return 0;
-}
-
-/**
- * Load non-real-mode portion of bzImage
- *
- * @v image		bzImage file
- * @v load_ctx		Load context
- * @ret rc		Return status code
- */
-static int bzimage_load_non_real ( struct image *image,
-				   struct bzimage_load_context *load_ctx ) {
-	int rc;
-
-	/* Prepare, verify and load the non-real-mode segment */
-	if ( ( rc = prep_segment ( load_ctx->pm_kernel, load_ctx->pm_sz,
-				   load_ctx->pm_sz ) ) != 0 ) {
+	if ( ( rc = prep_segment ( bzimg.pm_kernel, bzimg.pm_sz,
+				   bzimg.pm_sz ) ) != 0 ) {
 		DBGC ( image, "bzImage %p could not prepare PM segment: %s\n",
 		       image, strerror ( rc ) );
 		return rc;
 	}
-	memcpy_user ( load_ctx->pm_kernel, 0, image->data, load_ctx->rm_filesz,
-		      load_ctx->pm_sz );
-
-	return 0;
-}
-
-/**
- * Update and store bzImage header
- *
- * @v image		bzImage file
- * @v load_ctx		Load context
- * @v bzhdr		Original bzImage header
- * @ret rc		Return status code
- */
-static int bzimage_write_header ( struct image *image __unused,
-				  struct bzimage_load_context *load_ctx,
-				  struct bzimage_header *bzhdr ) {
-	struct bzimage_cmdline cmdline;
-
-	/* Update the header and copy it into the loaded kernel */
-	bzhdr->type_of_loader = BZI_LOADER_TYPE_GPXE;
-	if ( bzhdr->version >= 0x0201 ) {
-		bzhdr->heap_end_ptr = ( load_ctx->rm_heap - 0x200 );
-		bzhdr->loadflags |= BZI_CAN_USE_HEAP;
-	}
-	if ( bzhdr->version >= 0x0202 ) {
-		bzhdr->cmd_line_ptr = user_to_phys ( load_ctx->rm_kernel,
-						     load_ctx->rm_cmdline );
-	} else {
-		cmdline.magic = BZI_CMDLINE_MAGIC;
-		cmdline.offset = load_ctx->rm_cmdline;
-		copy_to_user ( load_ctx->rm_kernel, BZI_CMDLINE_OFFSET,
-			       &cmdline, sizeof ( cmdline ) );
-		bzhdr->setup_move_size = load_ctx->rm_memsz;
-	}
-	copy_to_user ( load_ctx->rm_kernel, BZI_HDR_OFFSET,
-		       bzhdr, sizeof ( *bzhdr ) );
-
-	return 0;
-}
-
-/**
- * Load bzImage image into memory
- *
- * @v image		bzImage file
- * @ret rc		Return status code
- */
-int bzimage_load ( struct image *image ) {
-	struct bzimage_load_context load_ctx;
-	struct bzimage_header bzhdr;
-	int rc;
-
-	/* Initialise context */
-	memset ( &load_ctx, 0, sizeof ( load_ctx ) );
 
-	/* Load and verify header */
-	if ( ( rc = bzimage_load_header ( image, &load_ctx, &bzhdr ) ) != 0 )
-		return rc;
-
-	/* This is a bzImage image, valid or otherwise */
-	if ( ! image->type )
-		image->type = &bzimage_image_type;
-
-	/* Load real-mode portion */
-	if ( ( rc = bzimage_load_real ( image, &load_ctx ) ) != 0 )
-		return rc;
-
-	/* Load non-real-mode portion */
-	if ( ( rc = bzimage_load_non_real ( image, &load_ctx ) ) != 0 )
-		return rc;
+	/* Load segments */
+	memcpy_user ( bzimg.rm_kernel, 0, image->data,
+		      0, bzimg.rm_filesz );
+	memcpy_user ( bzimg.pm_kernel, 0, image->data,
+		      bzimg.rm_filesz, bzimg.pm_sz );
 
 	/* Update and write out header */
-	if ( ( rc = bzimage_write_header ( image, &load_ctx, &bzhdr ) ) != 0 )
-		return rc;
+	bzimage_update_header ( image, &bzimg, bzimg.rm_kernel );
 
 	/* Record real-mode segment in image private data field */
-	image->priv.ul = load_ctx.rm_kernel_seg;
+	image->priv.user = bzimg.rm_kernel;
 
 	return 0;
 }
diff --git a/gpxe/src/arch/i386/image/com32.c b/gpxe/src/arch/i386/image/com32.c
index d1b9a59f..6ab347c1 100644
--- a/gpxe/src/arch/i386/image/com32.c
+++ b/gpxe/src/arch/i386/image/com32.c
@@ -23,6 +23,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/gpxe/src/arch/i386/image/comboot.c b/gpxe/src/arch/i386/image/comboot.c
index 40e32185..a00b2b95 100644
--- a/gpxe/src/arch/i386/image/comboot.c
+++ b/gpxe/src/arch/i386/image/comboot.c
@@ -23,6 +23,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/gpxe/src/arch/i386/image/elfboot.c b/gpxe/src/arch/i386/image/elfboot.c
index c8daf72b..a41040e8 100644
--- a/gpxe/src/arch/i386/image/elfboot.c
+++ b/gpxe/src/arch/i386/image/elfboot.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <errno.h>
 #include <elf.h>
 #include <gpxe/image.h>
diff --git a/gpxe/src/arch/i386/image/eltorito.c b/gpxe/src/arch/i386/image/eltorito.c
index 9d573106..53eb2c02 100644
--- a/gpxe/src/arch/i386/image/eltorito.c
+++ b/gpxe/src/arch/i386/image/eltorito.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
diff --git a/gpxe/src/arch/i386/image/multiboot.c b/gpxe/src/arch/i386/image/multiboot.c
index 52bb10f6..5b620956 100644
--- a/gpxe/src/arch/i386/image/multiboot.c
+++ b/gpxe/src/arch/i386/image/multiboot.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
@@ -139,10 +141,11 @@ static void multiboot_build_memmap ( struct image *image,
 /**
  * Add command line in base memory
  *
+ * @v imgname		Image name
  * @v cmdline		Command line
  * @ret physaddr	Physical address of command line
  */
-physaddr_t multiboot_add_cmdline ( const char *cmdline ) {
+physaddr_t multiboot_add_cmdline ( const char *imgname, const char *cmdline ) {
 	char *mb_cmdline;
 
 	if ( ! cmdline )
@@ -153,7 +156,7 @@ physaddr_t multiboot_add_cmdline ( const char *cmdline ) {
 	mb_cmdline_offset +=
 		( snprintf ( mb_cmdline,
 			     ( sizeof ( mb_cmdlines ) - mb_cmdline_offset ),
-			     "%s", cmdline ) + 1 );
+			     "%s %s", imgname, cmdline ) + 1 );
 
 	/* Truncate to terminating NUL in buffer if necessary */
 	if ( mb_cmdline_offset > sizeof ( mb_cmdlines ) )
@@ -208,8 +211,8 @@ multiboot_build_module_list ( struct image *image,
 			  ( ( count - insert ) * sizeof ( *module ) ) );
 		module->mod_start = start;
 		module->mod_end = end;
-		module->string =
-			multiboot_add_cmdline ( module_image->cmdline );
+		module->string = multiboot_add_cmdline ( module_image->name,
+						       module_image->cmdline );
 		module->reserved = 0;
 		
 		/* We promise to page-align modules */
@@ -264,10 +267,8 @@ static int multiboot_exec ( struct image *image ) {
 	memset ( &mbinfo, 0, sizeof ( mbinfo ) );
 	mbinfo.flags = ( MBI_FLAG_LOADER | MBI_FLAG_MEM | MBI_FLAG_MMAP |
 			 MBI_FLAG_CMDLINE | MBI_FLAG_MODS );
-	multiboot_build_memmap ( image, &mbinfo, mbmemmap,
-				 ( sizeof(mbmemmap) / sizeof(mbmemmap[0]) ) );
 	mb_cmdline_offset = 0;
-	mbinfo.cmdline = multiboot_add_cmdline ( image->cmdline );
+	mbinfo.cmdline = multiboot_add_cmdline ( image->name, image->cmdline );
 	mbinfo.mods_count = multiboot_build_module_list ( image, mbmodules,
 				( sizeof(mbmodules) / sizeof(mbmodules[0]) ) );
 	mbinfo.mods_addr = virt_to_phys ( mbmodules );
@@ -279,6 +280,12 @@ static int multiboot_exec ( struct image *image ) {
 	 */
 	shutdown ( SHUTDOWN_BOOT );
 
+	/* Build memory map after unhiding bootloader memory regions as part of
+	 * shutting everything down.
+	 */
+	multiboot_build_memmap ( image, &mbinfo, mbmemmap,
+				 ( sizeof(mbmemmap) / sizeof(mbmemmap[0]) ) );
+
 	/* Jump to OS with flat physical addressing */
 	DBGC ( image, "MULTIBOOT %p starting execution at %lx\n",
 	       image, entry );
@@ -360,6 +367,13 @@ static int multiboot_load_raw ( struct image *image,
 	userptr_t buffer;
 	int rc;
 
+	/* Sanity check */
+	if ( ! ( hdr->mb.flags & MB_FLAG_RAW ) ) {
+		DBGC ( image, "MULTIBOOT %p is not flagged as a raw image\n",
+		       image );
+		return -EINVAL;
+	}
+
 	/* Verify and prepare segment */
 	offset = ( hdr->offset - hdr->mb.header_addr + hdr->mb.load_addr );
 	filesz = ( hdr->mb.load_end_addr ?
@@ -432,14 +446,14 @@ static int multiboot_load ( struct image *image ) {
 		return -ENOTSUP;
 	}
 
-	/* Load the actual image */
-	if ( hdr.mb.flags & MB_FLAG_RAW ) {
-		if ( ( rc = multiboot_load_raw ( image, &hdr ) ) != 0 )
-			return rc;
-	} else {
-		if ( ( rc = multiboot_load_elf ( image ) ) != 0 )
-			return rc;
-	}
+	/* There is technically a bit MB_FLAG_RAW to indicate whether
+	 * this is an ELF or a raw image.  In practice, grub will use
+	 * the ELF header if present, and Solaris relies on this
+	 * behaviour.
+	 */
+	if ( ( ( rc = multiboot_load_elf ( image ) ) != 0 ) &&
+	     ( ( rc = multiboot_load_raw ( image, &hdr ) ) != 0 ) )
+		return rc;
 
 	return 0;
 }
diff --git a/gpxe/src/arch/i386/image/pxe_image.c b/gpxe/src/arch/i386/image/pxe_image.c
index 90550d83..63429f87 100644
--- a/gpxe/src/arch/i386/image/pxe_image.c
+++ b/gpxe/src/arch/i386/image/pxe_image.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
@@ -42,28 +44,24 @@ struct image_type pxe_image_type __image_type ( PROBE_PXE );
  * @ret rc		Return status code
  */
 static int pxe_exec ( struct image *image ) {
+	struct net_device *netdev;
 	int rc;
 
-	/* Ensure that PXE stack is ready to use */
-	pxe_init_structures();
-	pxe_hook_int1a();
-
 	/* Arbitrarily pick the most recently opened network device */
-	pxe_set_netdev ( last_opened_netdev() );
-
-	/* Many things will break if pxe_netdev is NULL */
-	if ( ! pxe_netdev ) {
+	if ( ( netdev = last_opened_netdev() ) == NULL ) {
 		DBGC ( image, "IMAGE %p could not locate PXE net device\n",
 		       image );
 		return -ENODEV;
 	}
 
+	/* Activate PXE */
+	pxe_activate ( netdev );
+
 	/* Start PXE NBP */
 	rc = pxe_start_nbp();
 
 	/* Deactivate PXE */
-	pxe_set_netdev ( NULL );
-	pxe_unhook_int1a();
+	pxe_deactivate();
 
 	return rc;
 }
diff --git a/gpxe/src/arch/i386/include/basemem.h b/gpxe/src/arch/i386/include/basemem.h
index cd5668e0..c477c7fe 100644
--- a/gpxe/src/arch/i386/include/basemem.h
+++ b/gpxe/src/arch/i386/include/basemem.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <realmode.h>
 #include <bios.h>
diff --git a/gpxe/src/arch/i386/include/basemem_packet.h b/gpxe/src/arch/i386/include/basemem_packet.h
index e4d4f49c..3cb47767 100644
--- a/gpxe/src/arch/i386/include/basemem_packet.h
+++ b/gpxe/src/arch/i386/include/basemem_packet.h
@@ -1,6 +1,8 @@
 #ifndef BASEMEM_PACKET_H
 #define BASEMEM_PACKET_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <realmode.h>
 
 /** Maximum length of base memory packet buffer */
diff --git a/gpxe/src/arch/i386/include/bios.h b/gpxe/src/arch/i386/include/bios.h
index 979a092c..70bb73da 100644
--- a/gpxe/src/arch/i386/include/bios.h
+++ b/gpxe/src/arch/i386/include/bios.h
@@ -1,6 +1,8 @@
 #ifndef BIOS_H
 #define BIOS_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #define BDA_SEG 0x0040
 #define BDA_FBMS 0x0013
 #define BDA_NUM_DRIVES 0x0075
diff --git a/gpxe/src/arch/i386/include/biosint.h b/gpxe/src/arch/i386/include/biosint.h
index d365cf01..ab466af3 100644
--- a/gpxe/src/arch/i386/include/biosint.h
+++ b/gpxe/src/arch/i386/include/biosint.h
@@ -6,6 +6,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <realmode.h>
 
 struct segoff;
diff --git a/gpxe/src/arch/i386/include/bits/byteswap.h b/gpxe/src/arch/i386/include/bits/byteswap.h
index 98418c29..ddbd40ed 100644
--- a/gpxe/src/arch/i386/include/bits/byteswap.h
+++ b/gpxe/src/arch/i386/include/bits/byteswap.h
@@ -1,6 +1,8 @@
 #ifndef ETHERBOOT_BITS_BYTESWAP_H
 #define ETHERBOOT_BITS_BYTESWAP_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 static inline __attribute__ ((always_inline, const)) uint16_t
 __bswap_variable_16(uint16_t x)
 {
diff --git a/gpxe/src/arch/i386/include/bits/compiler.h b/gpxe/src/arch/i386/include/bits/compiler.h
index 119a9a21..000db0c1 100644
--- a/gpxe/src/arch/i386/include/bits/compiler.h
+++ b/gpxe/src/arch/i386/include/bits/compiler.h
@@ -1,6 +1,8 @@
 #ifndef _BITS_COMPILER_H
 #define _BITS_COMPILER_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifndef ASSEMBLY
 
 /** Declare a function with standard calling conventions */
diff --git a/gpxe/src/arch/i386/include/bits/endian.h b/gpxe/src/arch/i386/include/bits/endian.h
index 413e702d..84188542 100644
--- a/gpxe/src/arch/i386/include/bits/endian.h
+++ b/gpxe/src/arch/i386/include/bits/endian.h
@@ -1,6 +1,8 @@
 #ifndef ETHERBOOT_BITS_ENDIAN_H
 #define ETHERBOOT_BITS_ENDIAN_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #define __BYTE_ORDER __LITTLE_ENDIAN
 
 #endif /* ETHERBOOT_BITS_ENDIAN_H */
diff --git a/gpxe/src/arch/i386/include/bits/errfile.h b/gpxe/src/arch/i386/include/bits/errfile.h
index 5ea8a318..32b8a085 100644
--- a/gpxe/src/arch/i386/include/bits/errfile.h
+++ b/gpxe/src/arch/i386/include/bits/errfile.h
@@ -1,6 +1,8 @@
 #ifndef _BITS_ERRFILE_H
 #define _BITS_ERRFILE_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @addtogroup errfile Error file identifiers
  * @{
@@ -12,6 +14,7 @@
 #define ERRFILE_bios_smbios	( ERRFILE_ARCH | ERRFILE_CORE | 0x00030000 )
 #define ERRFILE_biosint		( ERRFILE_ARCH | ERRFILE_CORE | 0x00040000 )
 #define ERRFILE_int13		( ERRFILE_ARCH | ERRFILE_CORE | 0x00050000 )
+#define ERRFILE_pxeparent	( ERRFILE_ARCH | ERRFILE_CORE | 0x00060000 )
 
 #define ERRFILE_bootsector     ( ERRFILE_ARCH | ERRFILE_IMAGE | 0x00000000 )
 #define ERRFILE_bzimage	       ( ERRFILE_ARCH | ERRFILE_IMAGE | 0x00010000 )
diff --git a/gpxe/src/arch/i386/include/bits/io.h b/gpxe/src/arch/i386/include/bits/io.h
index dd0ee444..eded9778 100644
--- a/gpxe/src/arch/i386/include/bits/io.h
+++ b/gpxe/src/arch/i386/include/bits/io.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/x86_io.h>
 
 #endif /* _BITS_IO_H */
diff --git a/gpxe/src/arch/i386/include/bits/nap.h b/gpxe/src/arch/i386/include/bits/nap.h
index f8ba7a7c..1354f6bb 100644
--- a/gpxe/src/arch/i386/include/bits/nap.h
+++ b/gpxe/src/arch/i386/include/bits/nap.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/bios_nap.h>
 #include <gpxe/efi/efix86_nap.h>
 
diff --git a/gpxe/src/arch/i386/include/bits/smbios.h b/gpxe/src/arch/i386/include/bits/smbios.h
index 647ea19e..a68413aa 100644
--- a/gpxe/src/arch/i386/include/bits/smbios.h
+++ b/gpxe/src/arch/i386/include/bits/smbios.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/bios_smbios.h>
 
 #endif /* _BITS_SMBIOS_H */
diff --git a/gpxe/src/arch/i386/include/bits/stdint.h b/gpxe/src/arch/i386/include/bits/stdint.h
index 6ccf0971..8edf1319 100644
--- a/gpxe/src/arch/i386/include/bits/stdint.h
+++ b/gpxe/src/arch/i386/include/bits/stdint.h
@@ -1,8 +1,10 @@
 #ifndef _BITS_STDINT_H
 #define _BITS_STDINT_H
 
-typedef unsigned int		size_t;
-typedef signed int		ssize_t;
+FILE_LICENCE ( GPL2_OR_LATER );
+
+typedef __SIZE_TYPE__		size_t;
+typedef signed long		ssize_t;
 typedef signed long		off_t;
 
 typedef unsigned char		uint8_t;
diff --git a/gpxe/src/arch/i386/include/bits/timer.h b/gpxe/src/arch/i386/include/bits/timer.h
index 99666d84..32e6bd47 100644
--- a/gpxe/src/arch/i386/include/bits/timer.h
+++ b/gpxe/src/arch/i386/include/bits/timer.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/bios_timer.h>
 #include <gpxe/rdtsc_timer.h>
 
diff --git a/gpxe/src/arch/i386/include/bits/uaccess.h b/gpxe/src/arch/i386/include/bits/uaccess.h
index 0ecc5028..2bb52e02 100644
--- a/gpxe/src/arch/i386/include/bits/uaccess.h
+++ b/gpxe/src/arch/i386/include/bits/uaccess.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <librm.h>
 
 #endif /* _BITS_UACCESS_H */
diff --git a/gpxe/src/arch/i386/include/bits/umalloc.h b/gpxe/src/arch/i386/include/bits/umalloc.h
index dcbd0a6b..17ba2cb2 100644
--- a/gpxe/src/arch/i386/include/bits/umalloc.h
+++ b/gpxe/src/arch/i386/include/bits/umalloc.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/memtop_umalloc.h>
 
 #endif /* _BITS_UMALLOC_H */
diff --git a/gpxe/src/arch/i386/include/bootsector.h b/gpxe/src/arch/i386/include/bootsector.h
index e9071052..8730fbfc 100644
--- a/gpxe/src/arch/i386/include/bootsector.h
+++ b/gpxe/src/arch/i386/include/bootsector.h
@@ -6,6 +6,8 @@
  * x86 bootsector image format
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 extern int call_bootsector ( unsigned int segment, unsigned int offset,
 			     unsigned int drive );
 
diff --git a/gpxe/src/arch/i386/include/bzimage.h b/gpxe/src/arch/i386/include/bzimage.h
index aee058ae..42b31fe4 100644
--- a/gpxe/src/arch/i386/include/bzimage.h
+++ b/gpxe/src/arch/i386/include/bzimage.h
@@ -1,6 +1,8 @@
 #ifndef _BZIMAGE_H
 #define _BZIMAGE_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 
 /**
@@ -75,6 +77,9 @@ struct bzimage_header {
 /** Offset of bzImage header within kernel image */
 #define BZI_HDR_OFFSET 0x1f1
 
+/** bzImage boot flag value */
+#define BZI_BOOT_FLAG 0xaa55
+
 /** bzImage magic signature value */
 #define BZI_SIGNATURE 0x53726448
 
diff --git a/gpxe/src/arch/i386/include/callbacks_arch.h b/gpxe/src/arch/i386/include/callbacks_arch.h
deleted file mode 100644
index f9cba488..00000000
--- a/gpxe/src/arch/i386/include/callbacks_arch.h
+++ /dev/null
@@ -1,243 +0,0 @@
-/* Callout/callback interface for Etherboot
- *
- * This file provides the mechanisms for making calls from Etherboot
- * to external programs and vice-versa.
- *
- * Initial version by Michael Brown <mbrown@fensystems.co.uk>, January 2004.
- *
- * $Id$
- */
-
-#ifndef CALLBACKS_ARCH_H
-#define CALLBACKS_ARCH_H
-
-/* Skip the definitions that won't make sense to the assembler */
-#ifndef ASSEMBLY
-
-/* Struct to hold general-purpose register values.  PUSHAL and POPAL
- * can work directly with this structure; do not change the order of
- * registers.
- */
-typedef struct {
-	union {
-		uint16_t di;
-		uint32_t edi;
-	};
-	union {
-		uint16_t si;
-		uint32_t esi;
-	};
-	union {
-		uint16_t bp;
-		uint32_t ebp;
-	};
-	union {
-		uint16_t sp;
-		uint32_t esp;
-	};
-	union {
-		struct {
-			uint8_t bl;
-			uint8_t bh;
-		} PACKED;
-		uint16_t bx;
-		uint32_t ebx;
-	};
-	union {
-		struct {
-			uint8_t dl;
-			uint8_t dh;
-		} PACKED;
-		uint16_t dx;
-		uint32_t edx;
-	};
-	union {
-		struct {
-			uint8_t cl;
-			uint8_t ch;
-		} PACKED;
-		uint16_t cx;
-		uint32_t ecx;
-	};
-	union {
-		struct {
-			uint8_t al;
-			uint8_t ah;
-		} PACKED;
-		uint16_t ax;
-		uint32_t eax;
-	};
-} regs_t;
-
-/* Struct to hold segment register values.  Don't change the order;
- * many bits of assembly code rely on it.
- */
-typedef struct {
-	uint16_t cs;
-	uint16_t ss;
-	uint16_t ds;
-	uint16_t es;
-	uint16_t fs;
-	uint16_t gs;
-} PACKED seg_regs_t;
-
-/* Struct for a GDT descriptor */
-typedef struct {
-		uint16_t limit;
-		uint32_t address;
-		uint16_t padding;
-} PACKED gdt_descriptor_t;
-
-/* Struct for a GDT entry.  Use GDT_SEGMENT() to fill it in.
- */
-typedef struct {
-	uint16_t limit_0_15;
-	uint16_t base_0_15;
-	uint8_t base_16_23;
-	uint8_t accessed__type__sflag__dpl__present;
-	uint8_t limit_16_19__avl__size__granularity;
-	uint8_t base_24_31;
-} PACKED gdt_segment_t;
-
-#define GDT_SEGMENT(base,limit,type,sflag,dpl,avl,size,granularity) \
-	( (gdt_segment_t) { \
-		( (limit) & 0xffff ), \
-		( (base) & 0xffff ), \
-		( ( (base) >> 16 ) & 0xff ), \
-		( ( 1 << 0 ) | ( (type) << 1 ) | \
-		  ( (sflag) << 4 ) | ( (dpl) << 5 ) | ( 1 << 7 ) ), \
-		( ( (limit) >> 16 ) | \
-		  ( (avl) << 4 ) | ( (size) << 5 ) | ( (granularity) << 7 ) ),\
-		( (base) >> 24 ) \
-	} )
-#define GDT_SEGMENT_BASE(gdt_segment) \
-	( (gdt_segment)->base_0_15 | \
-	  (gdt_segment)->base_16_23 << 16 | \
-	  (gdt_segment)->base_24_31 << 24 )
-#define GDT_SEGMENT_LIMIT(gdt_segment) \
-	( (gdt_segment)->limit_0_15 | \
-	  ( ( (gdt_segment)->limit_16_19__avl__size__granularity \
-	      & 0xf ) << 16 ) )
-#define GDT_SEGMENT_GRANULARITY(gdt_segment) \
-	( ( (gdt_segment)->limit_16_19__avl__size__granularity \
-	    & 0x80 ) >> 7 )
-#define GDT_SEGMENT_TYPE(gdt_segment) \
-	( ( (gdt_segment)->accessed__type__sflag__dpl__present & 0x0e ) >> 1 )
-#define GDT_SEGMENT_SIZE(gdt_segment) \
-	( ( (gdt_segment)->limit_16_19__avl__size__granularity \
-	    & 0x60 ) >> 5 )
-
-#define GDT_TYPE_DATA			(0x0)
-#define GDT_TYPE_STACK			(0x2)
-#define GDT_TYPE_WRITEABLE		(0x1)
-#define GDT_TYPE_CODE			(0x6)
-#define GDT_TYPE_EXEC_ONLY_CODE		(0x4)
-#define GDT_TYPE_CONFORMING		(0x1)
-#define GDT_SFLAG_SYSTEM		(0)
-#define GDT_SFLAG_NORMAL		(1)
-#define GDT_AVL_NORMAL			(0)
-#define GDT_SIZE_16BIT			(0x0)
-#define GDT_SIZE_32BIT			(0x2)
-#define GDT_SIZE_64BIT			(0x1)
-#define GDT_SIZE_UNKNOWN		(0x3)
-#define GDT_GRANULARITY_SMALL		(0)
-#define GDT_GRANULARITY_LARGE		(1)
-#define GDT_SEGMENT_NORMAL(base,limit,type,size,granularity) \
-	GDT_SEGMENT ( base, limit, type, \
-		      GDT_SFLAG_NORMAL, 0, GDT_AVL_NORMAL, \
-		      size, granularity )
-
-/* Protected mode code segment */
-#define GDT_SEGMENT_PMCS(base) GDT_SEGMENT_NORMAL ( \
-	base, 0xfffff, GDT_TYPE_CODE | GDT_TYPE_CONFORMING, \
-	GDT_SIZE_32BIT, GDT_GRANULARITY_LARGE )
-#define GDT_SEGMENT_PMCS_PHYS GDT_SEGMENT_PMCS(0)
-/* Protected mode data segment */
-#define GDT_SEGMENT_PMDS(base) GDT_SEGMENT_NORMAL ( \
-	base, 0xfffff, GDT_TYPE_DATA | GDT_TYPE_WRITEABLE, \
-	GDT_SIZE_32BIT, GDT_GRANULARITY_LARGE )
-#define GDT_SEGMENT_PMDS_PHYS GDT_SEGMENT_PMDS(0)
-/* Real mode code segment */
-/* Not sure if there's any reason to use GDT_TYPE_EXEC_ONLY_CODE
- * instead of just GDT_TYPE_CODE, but that's what our old GDT did and
- * it worked, so I'm not changing it.
- */
-#define GDT_SEGMENT_RMCS(base) GDT_SEGMENT_NORMAL ( \
-	base, 0xffff, GDT_TYPE_EXEC_ONLY_CODE | GDT_TYPE_CONFORMING, \
-	GDT_SIZE_16BIT, GDT_GRANULARITY_SMALL )
-/* Real mode data segment */
-#define GDT_SEGMENT_RMDS(base) GDT_SEGMENT_NORMAL ( \
-	base, 0xffff, GDT_TYPE_DATA | GDT_TYPE_WRITEABLE, \
-	GDT_SIZE_16BIT, GDT_GRANULARITY_SMALL )
-/* Long mode code segment */
-#define GDT_SEGMENT_LMCS(base) GDT_SEGMENT_NORMAL ( \
-	base, 0xfffff, GDT_TYPE_CODE | GDT_TYPE_CONFORMING, \
-	GDT_SIZE_64BIT, GDT_GRANULARITY_LARGE )
-#define GDT_SEGMENT_LMCS_PHYS GDT_SEGMENT_LMCS(0)
-/* Long mode data segment */
-/* AFIACT, GDT_SIZE_64BIT applies only to code segments */
-#define GDT_SEGMENT_LMDS(base) GDT_SEGMENT_NORMAL ( \
-	base, 0xfffff, GDT_TYPE_DATA | GDT_TYPE_WRITEABLE, \
-	GDT_SIZE_32BIT, GDT_GRANULARITY_LARGE )
-#define GDT_SEGMENT_LMDS_PHYS GDT_SEGMENT_LMDS(0)
-
-/* Template for creating GDT structures (including segment register
- * lists), suitable for passing as parameters to external_call().
- */
-#define GDT_STRUCT_t(num_segments) \
-	struct { \
-		gdt_descriptor_t descriptor; \
-		gdt_segment_t segments[num_segments]; \
-	} PACKED
-/* And utility function for filling it in */
-#define GDT_ADJUST(structure) { \
-	(structure)->descriptor.address = \
-		virt_to_phys(&((structure)->descriptor.limit)); \
-	(structure)->descriptor.limit = \
-		sizeof((structure)->segments) + 8 - 1; \
-	(structure)->descriptor.padding = 0; \
-}
-
-/* Data passed in to in_call() by assembly wrapper.
- */
-typedef struct {
-	regs_t		regs;
-	seg_regs_t	seg_regs;
-	gdt_descriptor_t gdt_desc;
-	uint32_t	flags;
-	struct {
-		uint32_t offset;
-		uint32_t segment;
-	} ret_addr;
-} PACKED i386_pm_in_call_data_t;
-
-typedef struct {
-	seg_regs_t	seg_regs;
-	union {
-		uint16_t	pad;
-		uint16_t	prefix_sp;
-	};
-	uint16_t	flags;
-	struct {
-		uint16_t offset;
-		uint16_t segment;
-	} ret_addr;
-	uint32_t orig_opcode;
-} PACKED i386_rm_in_call_data_t;
-
-typedef struct {
-	i386_pm_in_call_data_t *pm;
-	i386_rm_in_call_data_t *rm;
-} i386_in_call_data_t;
-#define in_call_data_t i386_in_call_data_t
-
-/* Function prototypes
- */
-extern int install_rm_callback_interface ( void *address, size_t available );
-
-#endif /* ASSEMBLY */
-
-#define RM_IN_CALL	(0)
-#define RM_IN_CALL_FAR	(2)
-
-#endif /* CALLBACKS_ARCH_H */
diff --git a/gpxe/src/arch/i386/include/comboot.h b/gpxe/src/arch/i386/include/comboot.h
index 56661a80..1232f0a7 100644
--- a/gpxe/src/arch/i386/include/comboot.h
+++ b/gpxe/src/arch/i386/include/comboot.h
@@ -7,6 +7,8 @@
  * SYSLINUX COMBOOT
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <setjmp.h>
 #include <gpxe/in.h>
diff --git a/gpxe/src/arch/i386/include/fakee820.h b/gpxe/src/arch/i386/include/fakee820.h
index f1fe8aff..9d00fb67 100644
--- a/gpxe/src/arch/i386/include/fakee820.h
+++ b/gpxe/src/arch/i386/include/fakee820.h
@@ -1,6 +1,8 @@
 #ifndef _FAKEE820_H
 #define _FAKEE820_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 extern void fake_e820 ( void );
 extern void unfake_e820 ( void );
 
diff --git a/gpxe/src/arch/i386/include/gpxe/abft.h b/gpxe/src/arch/i386/include/gpxe/abft.h
index 1c651ef1..9065e61a 100644
--- a/gpxe/src/arch/i386/include/gpxe/abft.h
+++ b/gpxe/src/arch/i386/include/gpxe/abft.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <gpxe/acpi.h>
 #include <gpxe/if_ether.h>
diff --git a/gpxe/src/arch/i386/include/gpxe/bios_nap.h b/gpxe/src/arch/i386/include/gpxe/bios_nap.h
index f1c721e9..c32429b9 100644
--- a/gpxe/src/arch/i386/include/gpxe/bios_nap.h
+++ b/gpxe/src/arch/i386/include/gpxe/bios_nap.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifdef NAP_PCBIOS
 #define NAP_PREFIX_pcbios
 #else
diff --git a/gpxe/src/arch/i386/include/gpxe/bios_smbios.h b/gpxe/src/arch/i386/include/gpxe/bios_smbios.h
index 0a6f277a..83726b11 100644
--- a/gpxe/src/arch/i386/include/gpxe/bios_smbios.h
+++ b/gpxe/src/arch/i386/include/gpxe/bios_smbios.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifdef SMBIOS_PCBIOS
 #define SMBIOS_PREFIX_pcbios
 #else
diff --git a/gpxe/src/arch/i386/include/gpxe/bios_timer.h b/gpxe/src/arch/i386/include/gpxe/bios_timer.h
index 7e3caa3c..ed9df522 100644
--- a/gpxe/src/arch/i386/include/gpxe/bios_timer.h
+++ b/gpxe/src/arch/i386/include/gpxe/bios_timer.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifdef TIMER_PCBIOS
 #define TIMER_PREFIX_pcbios
 #else
diff --git a/gpxe/src/arch/i386/include/gpxe/ibft.h b/gpxe/src/arch/i386/include/gpxe/ibft.h
index 5eef547b..c41e2e40 100644
--- a/gpxe/src/arch/i386/include/gpxe/ibft.h
+++ b/gpxe/src/arch/i386/include/gpxe/ibft.h
@@ -28,6 +28,8 @@
  *
  */
 
+FILE_LICENCE ( BSD2 );
+
 /** @file
  *
  * iSCSI boot firmware table
diff --git a/gpxe/src/arch/i386/include/gpxe/memtop_umalloc.h b/gpxe/src/arch/i386/include/gpxe/memtop_umalloc.h
index a3cd2c01..eaf7025b 100644
--- a/gpxe/src/arch/i386/include/gpxe/memtop_umalloc.h
+++ b/gpxe/src/arch/i386/include/gpxe/memtop_umalloc.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifdef UMALLOC_MEMTOP
 #define UMALLOC_PREFIX_memtop
 #else
diff --git a/gpxe/src/arch/i386/include/gpxe/rdtsc_timer.h b/gpxe/src/arch/i386/include/gpxe/rdtsc_timer.h
index 0e03d707..67ba22f0 100644
--- a/gpxe/src/arch/i386/include/gpxe/rdtsc_timer.h
+++ b/gpxe/src/arch/i386/include/gpxe/rdtsc_timer.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifdef TIMER_RDTSC
 #define TIMER_PREFIX_rdtsc
 #else
diff --git a/gpxe/src/arch/i386/include/gpxe/sbft.h b/gpxe/src/arch/i386/include/gpxe/sbft.h
new file mode 100644
index 00000000..30038436
--- /dev/null
+++ b/gpxe/src/arch/i386/include/gpxe/sbft.h
@@ -0,0 +1,125 @@
+#ifndef _GPXE_SBFT_H
+#define _GPXE_SBFT_H
+
+/*
+ * Copyright (C) 2009 Fen Systems Ltd <mbrown@fensystems.co.uk>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *   Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ *   Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+FILE_LICENCE ( BSD2 );
+
+/** @file
+ *
+ * SRP boot firmware table
+ *
+ * The working draft specification for the SRP boot firmware table can
+ * be found at
+ *
+ *   http://etherboot.org/wiki/srp/sbft
+ *
+ */
+
+#include <stdint.h>
+#include <gpxe/acpi.h>
+#include <gpxe/scsi.h>
+#include <gpxe/srp.h>
+#include <gpxe/ib_srp.h>
+
+/** SRP Boot Firmware Table signature */
+#define SBFT_SIG "sBFT"
+
+/** An offset from the start of the sBFT */
+typedef uint16_t sbft_off_t;
+
+/**
+ * SRP Boot Firmware Table
+ */
+struct sbft_table {
+	/** ACPI header */
+	struct acpi_description_header acpi;
+	/** Offset to SCSI subtable */
+	sbft_off_t scsi_offset;
+	/** Offset to SRP subtable */
+	sbft_off_t srp_offset;
+	/** Offset to IB subtable, if present */
+	sbft_off_t ib_offset;
+	/** Reserved */
+	uint8_t reserved[6];
+} __attribute__ (( packed ));
+
+/**
+ * sBFT SCSI subtable
+ */
+struct sbft_scsi_subtable {
+	/** LUN */
+	struct scsi_lun lun;
+} __attribute__ (( packed ));
+
+/**
+ * sBFT SRP subtable
+ */
+struct sbft_srp_subtable {
+	/** Initiator and target ports */
+	struct srp_port_ids port_ids;
+} __attribute__ (( packed ));
+
+/**
+ * sBFT IB subtable
+ */
+struct sbft_ib_subtable {
+	/** Source GID */
+	struct ib_gid sgid;
+	/** Destination GID */
+	struct ib_gid dgid;
+	/** Service ID */
+	struct ib_gid_half service_id;
+	/** Partition key */
+	uint16_t pkey;
+	/** Reserved */
+	uint8_t reserved[6];
+} __attribute__ (( packed ));
+
+/**
+ * An sBFT created by gPXE
+ */
+struct gpxe_sbft {
+	/** The table header */
+	struct sbft_table table;
+	/** The SCSI subtable */
+	struct sbft_scsi_subtable scsi;
+	/** The SRP subtable */
+	struct sbft_srp_subtable srp;
+	/** The IB subtable */
+	struct sbft_ib_subtable ib;
+} __attribute__ (( packed, aligned ( 16 ) ));
+
+struct srp_device;
+
+extern int sbft_fill_data ( struct srp_device *srp );
+
+#endif /* _GPXE_SBFT_H */
diff --git a/gpxe/src/arch/i386/include/gpxe/timer2.h b/gpxe/src/arch/i386/include/gpxe/timer2.h
index 59705fa2..8f119515 100644
--- a/gpxe/src/arch/i386/include/gpxe/timer2.h
+++ b/gpxe/src/arch/i386/include/gpxe/timer2.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 extern void timer2_udelay ( unsigned long usecs );
 
 #endif /* _GPXE_TIMER2_H */
diff --git a/gpxe/src/arch/i386/include/gpxe/x86_io.h b/gpxe/src/arch/i386/include/gpxe/x86_io.h
index b1ae3bac..beb5b22a 100644
--- a/gpxe/src/arch/i386/include/gpxe/x86_io.h
+++ b/gpxe/src/arch/i386/include/gpxe/x86_io.h
@@ -15,6 +15,8 @@
  * into a machine with such an old CPU anyway.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifdef IOAPI_X86
 #define IOAPI_PREFIX_x86
 #else
diff --git a/gpxe/src/arch/i386/include/int13.h b/gpxe/src/arch/i386/include/int13.h
index bf6d0318..e1884d94 100644
--- a/gpxe/src/arch/i386/include/int13.h
+++ b/gpxe/src/arch/i386/include/int13.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <gpxe/list.h>
 #include <realmode.h>
diff --git a/gpxe/src/arch/i386/include/librm.h b/gpxe/src/arch/i386/include/librm.h
index 9eb2767a..f193f5e3 100755..100644
--- a/gpxe/src/arch/i386/include/librm.h
+++ b/gpxe/src/arch/i386/include/librm.h
@@ -1,6 +1,8 @@
 #ifndef LIBRM_H
 #define LIBRM_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /* Segment selectors as used in our protected-mode GDTs.
  *
  * Don't change these unless you really know what you're doing.
diff --git a/gpxe/src/arch/i386/include/limits.h b/gpxe/src/arch/i386/include/limits.h
index f13db267..031b6c57 100644
--- a/gpxe/src/arch/i386/include/limits.h
+++ b/gpxe/src/arch/i386/include/limits.h
@@ -1,6 +1,8 @@
 #ifndef LIMITS_H
 #define LIMITS_H	1
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /* Number of bits in a `char' */
 #define CHAR_BIT	8
 
diff --git a/gpxe/src/arch/i386/include/memsizes.h b/gpxe/src/arch/i386/include/memsizes.h
index 6222fd66..7b217494 100644
--- a/gpxe/src/arch/i386/include/memsizes.h
+++ b/gpxe/src/arch/i386/include/memsizes.h
@@ -1,6 +1,8 @@
 #ifndef _MEMSIZES_H
 #define _MEMSIZES_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <basemem.h>
 
 /**
diff --git a/gpxe/src/arch/i386/include/multiboot.h b/gpxe/src/arch/i386/include/multiboot.h
index 4ca7089b..44614c73 100644
--- a/gpxe/src/arch/i386/include/multiboot.h
+++ b/gpxe/src/arch/i386/include/multiboot.h
@@ -8,6 +8,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 
 /** The magic number for the Multiboot header */
diff --git a/gpxe/src/arch/i386/include/pic8259.h b/gpxe/src/arch/i386/include/pic8259.h
index 0c501a9c..f8e20c4c 100644
--- a/gpxe/src/arch/i386/include/pic8259.h
+++ b/gpxe/src/arch/i386/include/pic8259.h
@@ -4,6 +4,8 @@
  * Initially written by Michael Brown (mcb30).
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifndef PIC8259_H
 #define PIC8259_H
 
diff --git a/gpxe/src/arch/i386/include/pnpbios.h b/gpxe/src/arch/i386/include/pnpbios.h
index ab31c699..4c20e73e 100644
--- a/gpxe/src/arch/i386/include/pnpbios.h
+++ b/gpxe/src/arch/i386/include/pnpbios.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /* BIOS segment address */
 #define BIOS_SEG 0xf000
 
diff --git a/gpxe/src/arch/i386/include/pxe.h b/gpxe/src/arch/i386/include/pxe.h
index 6d332ac7..041ee7ba 100644
--- a/gpxe/src/arch/i386/include/pxe.h
+++ b/gpxe/src/arch/i386/include/pxe.h
@@ -1,6 +1,8 @@
 #ifndef PXE_H
 #define PXE_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include "pxe_types.h"
 #include "pxe_api.h"
 #include <gpxe/device.h>
@@ -65,6 +67,7 @@ union u_PXENV_ANY {
 	struct s_PXENV_GET_FILE_SIZE		get_file_size;
 	struct s_PXENV_FILE_EXEC		file_exec;
 	struct s_PXENV_FILE_API_CHECK		file_api_check;
+	struct s_PXENV_FILE_EXIT_HOOK		file_exit_hook;
 };
 
 typedef union u_PXENV_ANY PXENV_ANY_t;
diff --git a/gpxe/src/arch/i386/include/pxe_api.h b/gpxe/src/arch/i386/include/pxe_api.h
index b3d4bca8..92f046f7 100644
--- a/gpxe/src/arch/i386/include/pxe_api.h
+++ b/gpxe/src/arch/i386/include/pxe_api.h
@@ -15,6 +15,31 @@
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * As an alternative, at your option, you may use this file under the
+ * following terms, known as the "MIT license":
+ *
+ * Copyright (c) 2005-2009 Michael Brown <mbrown@fensystems.co.uk>
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
  */
 
 /** @file
@@ -23,6 +48,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include "pxe_types.h"
 
 /** @addtogroup pxe Preboot eXecution Environment (PXE) API
@@ -1415,6 +1442,25 @@ extern PXENV_EXIT_t pxenv_undi_get_nic_type (
 /** PXE API function code for pxenv_undi_get_iface_info() */
 #define	PXENV_UNDI_GET_IFACE_INFO	0x0013
 
+/** Broadcast supported */
+#define SUPPORTED_BROADCAST		0x0001
+/** Multicast supported */
+#define SUPPORTED_MULTICAST		0x0002
+/** Functional/group addressing supported */
+#define SUPPORTED_GROUP			0x0004
+/** Promiscuous mode supported */
+#define SUPPORTED_PROMISCUOUS		0x0008
+/** Software settable station address */
+#define SUPPORTED_SET_STATION_ADDRESS	0x0010
+/** InitiateDiagnostics supported */
+#define SUPPORTED_DIAGNOSTICS		0x0040
+/** Reset MAC supported */
+#define SUPPORTED_RESET			0x0400
+/** Open / Close Adapter supported */
+#define SUPPORTED_OPEN_CLOSE		0x0800
+/** Interrupt Request supported */
+#define SUPPORTED_IRQ			0x1000
+
 /** Parameter block for pxenv_undi_get_iface_info() */
 struct s_PXENV_UNDI_GET_IFACE_INFO {
 	PXENV_STATUS_t	Status;		/**< PXE status code */
@@ -1732,6 +1778,28 @@ extern PXENV_EXIT_t pxenv_file_api_check ( struct s_PXENV_FILE_API_CHECK *file_a
 
 /** @} */ /* pxenv_file_api_check */
 
+/** @defgroup pxenv_file_exit_hook PXENV_FILE_EXIT_HOOK
+ *
+ * FILE EXIT HOOK
+ *
+ * @{
+ */
+
+/** PXE API function code for pxenv_file_exit_hook() */
+#define PXENV_FILE_EXIT_HOOK			0x00e7
+
+/** Parameter block for pxenv_file_exit_hook() */
+struct s_PXENV_FILE_EXIT_HOOK {
+	PXENV_STATUS_t Status;		/**< PXE status code */
+	SEGOFF16_t Hook;		/**< SEG16:OFF16 to jump to */
+} PACKED;
+
+typedef struct s_PXENV_FILE_EXIT_HOOK PXENV_FILE_EXIT_HOOK_t;
+
+extern PXENV_EXIT_t pxenv_file_exit_hook ( struct s_PXENV_FILE_EXIT_HOOK *file_exit_hook );
+
+/** @} */ /* pxenv_file_exit_hook */
+
 /** @} */ /* pxe_file_api */
 
 /** @defgroup pxe_loader_api PXE Loader API
diff --git a/gpxe/src/arch/i386/include/pxe_call.h b/gpxe/src/arch/i386/include/pxe_call.h
index 2f3ea15a..4d245616 100644
--- a/gpxe/src/arch/i386/include/pxe_call.h
+++ b/gpxe/src/arch/i386/include/pxe_call.h
@@ -6,9 +6,13 @@
  * PXE API entry point
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <pxe_api.h>
 #include <realmode.h>
 
+struct net_device;
+
 /** PXE load address segment */
 #define PXE_LOAD_SEGMENT 0
 
@@ -26,10 +30,28 @@ extern struct s_PXE __text16 ( ppxe );
 extern struct s_PXENV __text16 ( pxenv );
 #define pxenv __use_text16 ( pxenv )
 
-extern void pxe_hook_int1a ( void );
-extern int pxe_unhook_int1a ( void );
-extern void pxe_init_structures ( void );
+extern void pxe_activate ( struct net_device *netdev );
+extern int pxe_deactivate ( void );
 extern int pxe_start_nbp ( void );
 extern __asmcall void pxe_api_call ( struct i386_all_regs *ix86 );
+extern int _pxe_api_call_weak ( struct i386_all_regs *ix86 )
+	__attribute__ (( weak ));
+
+/**
+ * Dispatch PXE API call weakly
+ *
+ * @v ix86		Registers for PXE call
+ * @ret present		Zero if the PXE stack is present, nonzero if not
+ *
+ * A successful return only indicates that the PXE stack was available
+ * for dispatching the call; it says nothing about the success of
+ * whatever the call asked for.
+ */
+static inline int pxe_api_call_weak ( struct i386_all_regs *ix86 )
+{
+	if ( _pxe_api_call_weak != NULL )
+		return _pxe_api_call_weak ( ix86 );
+	return -1;
+}
 
 #endif /* _PXE_CALL_H */
diff --git a/gpxe/src/arch/i386/include/pxe_types.h b/gpxe/src/arch/i386/include/pxe_types.h
index dd9092ef..a6516d25 100644
--- a/gpxe/src/arch/i386/include/pxe_types.h
+++ b/gpxe/src/arch/i386/include/pxe_types.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <errno.h> /* PXE status codes */
 
diff --git a/gpxe/src/arch/i386/include/pxeparent.h b/gpxe/src/arch/i386/include/pxeparent.h
new file mode 100644
index 00000000..b31e24a7
--- /dev/null
+++ b/gpxe/src/arch/i386/include/pxeparent.h
@@ -0,0 +1,11 @@
+#ifndef PXEPARENT_H
+#define PXEPARENT_H
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <pxe_types.h>
+
+extern int pxeparent_call ( SEGOFF16_t entry, unsigned int function,
+			    void *params, size_t params_len );
+
+#endif
diff --git a/gpxe/src/arch/i386/include/realmode.h b/gpxe/src/arch/i386/include/realmode.h
index 26e6dd77..a0a830b9 100644
--- a/gpxe/src/arch/i386/include/realmode.h
+++ b/gpxe/src/arch/i386/include/realmode.h
@@ -10,6 +10,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /*
  * Declaration of variables in .data16
  *
diff --git a/gpxe/src/arch/i386/include/registers.h b/gpxe/src/arch/i386/include/registers.h
index e68fa85a..2839e2bd 100644
--- a/gpxe/src/arch/i386/include/registers.h
+++ b/gpxe/src/arch/i386/include/registers.h
@@ -10,6 +10,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 
 /**
diff --git a/gpxe/src/arch/i386/include/setjmp.h b/gpxe/src/arch/i386/include/setjmp.h
index c18d03e1..5d3c11b6 100644
--- a/gpxe/src/arch/i386/include/setjmp.h
+++ b/gpxe/src/arch/i386/include/setjmp.h
@@ -1,6 +1,8 @@
 #ifndef ETHERBOOT_SETJMP_H
 #define ETHERBOOT_SETJMP_H
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <realmode.h>
 
diff --git a/gpxe/src/arch/i386/include/undi.h b/gpxe/src/arch/i386/include/undi.h
index c6253d0a..de6925b6 100644
--- a/gpxe/src/arch/i386/include/undi.h
+++ b/gpxe/src/arch/i386/include/undi.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #ifndef ASSEMBLY
 
 #include <gpxe/device.h>
diff --git a/gpxe/src/arch/i386/include/undiload.h b/gpxe/src/arch/i386/include/undiload.h
index bfc11874..426830e8 100644
--- a/gpxe/src/arch/i386/include/undiload.h
+++ b/gpxe/src/arch/i386/include/undiload.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 struct undi_device;
 struct undi_rom;
 
diff --git a/gpxe/src/arch/i386/include/undinet.h b/gpxe/src/arch/i386/include/undinet.h
index 1a4a385e..c3c17c11 100644
--- a/gpxe/src/arch/i386/include/undinet.h
+++ b/gpxe/src/arch/i386/include/undinet.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 struct undi_device;
 
 extern int undinet_probe ( struct undi_device *undi );
diff --git a/gpxe/src/arch/i386/include/undipreload.h b/gpxe/src/arch/i386/include/undipreload.h
index d9bc8cb9..de9b8fb5 100644
--- a/gpxe/src/arch/i386/include/undipreload.h
+++ b/gpxe/src/arch/i386/include/undipreload.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <realmode.h>
 #include <undi.h>
 
diff --git a/gpxe/src/arch/i386/include/undirom.h b/gpxe/src/arch/i386/include/undirom.h
index a2636007..86d7077b 100644
--- a/gpxe/src/arch/i386/include/undirom.h
+++ b/gpxe/src/arch/i386/include/undirom.h
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <pxe_types.h>
 
 /** An UNDI PCI device ID */
diff --git a/gpxe/src/arch/i386/interface/pcbios/abft.c b/gpxe/src/arch/i386/interface/pcbios/abft.c
index af28bbcf..86941728 100644
--- a/gpxe/src/arch/i386/interface/pcbios/abft.c
+++ b/gpxe/src/arch/i386/interface/pcbios/abft.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <realmode.h>
 #include <gpxe/aoe.h>
 #include <gpxe/netdevice.h>
diff --git a/gpxe/src/arch/i386/interface/pcbios/aoeboot.c b/gpxe/src/arch/i386/interface/pcbios/aoeboot.c
index 6e1e51cb..2670b15d 100644
--- a/gpxe/src/arch/i386/interface/pcbios/aoeboot.c
+++ b/gpxe/src/arch/i386/interface/pcbios/aoeboot.c
@@ -1,58 +1,74 @@
 #include <stdint.h>
 #include <string.h>
+#include <stdlib.h>
 #include <stdio.h>
-#include <byteswap.h>
+#include <errno.h>
 #include <gpxe/aoe.h>
 #include <gpxe/ata.h>
 #include <gpxe/netdevice.h>
-#include <gpxe/settings.h>
 #include <gpxe/sanboot.h>
 #include <gpxe/abft.h>
 #include <int13.h>
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 static int aoeboot ( const char *root_path ) {
-	struct ata_device ata;
-	struct int13_drive drive;
+	struct ata_device *ata;
+	struct int13_drive *drive;
 	int rc;
 
-	memset ( &ata, 0, sizeof ( ata ) );
-	memset ( &drive, 0, sizeof ( drive ) );
-
-	printf ( "AoE booting from %s\n", root_path );
+	ata = zalloc ( sizeof ( *ata ) );
+	if ( ! ata ) {
+		rc = -ENOMEM;
+		goto err_alloc_ata;
+	}
+	drive = zalloc ( sizeof ( *drive ) );
+	if ( ! drive ) {
+		rc = -ENOMEM;
+		goto err_alloc_drive;
+	}
 
 	/* FIXME: ugly, ugly hack */
 	struct net_device *netdev = last_opened_netdev();
 
-	if ( ( rc = aoe_attach ( &ata, netdev, root_path ) ) != 0 ) {
+	if ( ( rc = aoe_attach ( ata, netdev, root_path ) ) != 0 ) {
 		printf ( "Could not attach AoE device: %s\n",
 			 strerror ( rc ) );
-		goto error_attach;
+		goto err_attach;
 	}
-	if ( ( rc = init_atadev ( &ata ) ) != 0 ) {
+	if ( ( rc = init_atadev ( ata ) ) != 0 ) {
 		printf ( "Could not initialise AoE device: %s\n",
 			 strerror ( rc ) );
-		goto error_init;
+		goto err_init;
 	}
 
 	/* FIXME: ugly, ugly hack */
 	struct aoe_session *aoe =
-		container_of ( ata.backend, struct aoe_session, refcnt );
+		container_of ( ata->backend, struct aoe_session, refcnt );
 	abft_fill_data ( aoe );
 
-	drive.blockdev = &ata.blockdev;
+	drive->blockdev = &ata->blockdev;
 
-	register_int13_drive ( &drive );
-	printf ( "Registered as BIOS drive %#02x\n", drive.drive );
-	printf ( "Booting from BIOS drive %#02x\n", drive.drive );
-	rc = int13_boot ( drive.drive );
+	register_int13_drive ( drive );
+	printf ( "Registered as BIOS drive %#02x\n", drive->drive );
+	printf ( "Booting from BIOS drive %#02x\n", drive->drive );
+	rc = int13_boot ( drive->drive );
 	printf ( "Boot failed\n" );
 
-	printf ( "Unregistering BIOS drive %#02x\n", drive.drive );
-	unregister_int13_drive ( &drive );
+	/* Leave drive registered, if instructed to do so */
+	if ( keep_san() )
+		return rc;
+
+	printf ( "Unregistering BIOS drive %#02x\n", drive->drive );
+	unregister_int13_drive ( drive );
 
- error_init:
-	aoe_detach ( &ata );
- error_attach:
+ err_init:
+	aoe_detach ( ata );
+ err_attach:
+	free ( drive );
+ err_alloc_drive:
+	free ( ata );
+ err_alloc_ata:
 	return rc;
 }
 
diff --git a/gpxe/src/arch/i386/interface/pcbios/bios_nap.c b/gpxe/src/arch/i386/interface/pcbios/bios_nap.c
index 2f4a0513..e38cac7a 100644
--- a/gpxe/src/arch/i386/interface/pcbios/bios_nap.c
+++ b/gpxe/src/arch/i386/interface/pcbios/bios_nap.c
@@ -1,6 +1,8 @@
 #include <gpxe/nap.h>
 #include <realmode.h>
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * Save power by halting the CPU until the next interrupt
  *
diff --git a/gpxe/src/arch/i386/interface/pcbios/bios_smbios.c b/gpxe/src/arch/i386/interface/pcbios/bios_smbios.c
index efaaef0d..094214bd 100644
--- a/gpxe/src/arch/i386/interface/pcbios/bios_smbios.c
+++ b/gpxe/src/arch/i386/interface/pcbios/bios_smbios.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <string.h>
 #include <errno.h>
diff --git a/gpxe/src/arch/i386/interface/pcbios/bios_timer.c b/gpxe/src/arch/i386/interface/pcbios/bios_timer.c
index 0b475ea3..8ecf7c12 100644
--- a/gpxe/src/arch/i386/interface/pcbios/bios_timer.c
+++ b/gpxe/src/arch/i386/interface/pcbios/bios_timer.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /** @file
  *
  * BIOS timer
diff --git a/gpxe/src/arch/i386/interface/pcbios/biosint.c b/gpxe/src/arch/i386/interface/pcbios/biosint.c
index 1306f918..a193defa 100644
--- a/gpxe/src/arch/i386/interface/pcbios/biosint.c
+++ b/gpxe/src/arch/i386/interface/pcbios/biosint.c
@@ -7,6 +7,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * Hook INT vector
  *
diff --git a/gpxe/src/arch/i386/interface/pcbios/ib_srpboot.c b/gpxe/src/arch/i386/interface/pcbios/ib_srpboot.c
new file mode 100644
index 00000000..b1cbc337
--- /dev/null
+++ b/gpxe/src/arch/i386/interface/pcbios/ib_srpboot.c
@@ -0,0 +1,73 @@
+#include <stdint.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <gpxe/sanboot.h>
+#include <int13.h>
+#include <gpxe/srp.h>
+#include <gpxe/sbft.h>
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+static int ib_srpboot ( const char *root_path ) {
+	struct scsi_device *scsi;
+	struct int13_drive *drive;
+	int rc;
+
+	scsi = zalloc ( sizeof ( *scsi ) );
+	if ( ! scsi ) {
+		rc = -ENOMEM;
+		goto err_alloc_scsi;
+	}
+	drive = zalloc ( sizeof ( *drive ) );
+	if ( ! drive ) {
+		rc = -ENOMEM;
+		goto err_alloc_drive;
+	}
+
+	if ( ( rc = srp_attach ( scsi, root_path ) ) != 0 ) {
+		printf ( "Could not attach IB_SRP device: %s\n",
+			 strerror ( rc ) );
+		goto err_attach;
+	}
+	if ( ( rc = init_scsidev ( scsi ) ) != 0 ) {
+		printf ( "Could not initialise IB_SRP device: %s\n",
+			 strerror ( rc ) );
+		goto err_init;
+	}
+
+	drive->blockdev = &scsi->blockdev;
+
+	/* FIXME: ugly, ugly hack */
+	struct srp_device *srp =
+		container_of ( scsi->backend, struct srp_device, refcnt );
+	sbft_fill_data ( srp );
+
+	register_int13_drive ( drive );
+	printf ( "Registered as BIOS drive %#02x\n", drive->drive );
+	printf ( "Booting from BIOS drive %#02x\n", drive->drive );
+	rc = int13_boot ( drive->drive );
+	printf ( "Boot failed\n" );
+
+	/* Leave drive registered, if instructed to do so */
+	if ( keep_san() )
+		return rc;
+
+	printf ( "Unregistering BIOS drive %#02x\n", drive->drive );
+	unregister_int13_drive ( drive );
+
+ err_init:
+	srp_detach ( scsi );
+ err_attach:
+	free ( drive );
+ err_alloc_drive:
+	free ( scsi );
+ err_alloc_scsi:
+	return rc;
+}
+
+struct sanboot_protocol ib_srp_sanboot_protocol __sanboot_protocol = {
+	.prefix = "ib_srp:",
+	.boot = ib_srpboot,
+};
diff --git a/gpxe/src/arch/i386/interface/pcbios/ibft.c b/gpxe/src/arch/i386/interface/pcbios/ibft.c
index 43d1f85f..adf8e6b9 100644
--- a/gpxe/src/arch/i386/interface/pcbios/ibft.c
+++ b/gpxe/src/arch/i386/interface/pcbios/ibft.c
@@ -25,6 +25,8 @@
  *
  */
 
+FILE_LICENCE ( BSD2 );
+
 #include <stdint.h>
 #include <stdio.h>
 #include <string.h>
@@ -35,6 +37,7 @@
 #include <gpxe/acpi.h>
 #include <gpxe/in.h>
 #include <gpxe/netdevice.h>
+#include <gpxe/ethernet.h>
 #include <gpxe/dhcp.h>
 #include <gpxe/iscsi.h>
 #include <gpxe/ibft.h>
@@ -234,7 +237,8 @@ static int ibft_set_string_option ( struct ibft_string_block *strings,
  */
 static const char * ibft_string ( struct ibft_string_block *strings,
 				  struct ibft_string *string ) {
-	return ( ( ( char * ) strings->table ) + string->offset );
+	return ( string->offset ?
+		 ( ( ( char * ) strings->table ) + string->offset ) : NULL );
 }
 
 /**
@@ -248,6 +252,7 @@ static const char * ibft_string ( struct ibft_string_block *strings,
 static int ibft_fill_nic ( struct ibft_nic *nic,
 			   struct ibft_string_block *strings,
 			   struct net_device *netdev ) {
+	struct ll_protocol *ll_protocol = netdev->ll_protocol;
 	struct in_addr netmask_addr = { 0 };
 	unsigned int netmask_count = 0;
 	int rc;
@@ -276,10 +281,12 @@ static int ibft_fill_nic ( struct ibft_nic *nic,
 	DBG ( "iBFT NIC subnet = /%d\n", nic->subnet_mask_prefix );
 
 	/* Extract values from net-device configuration */
-	memcpy ( nic->mac_address, netdev->ll_addr,
-		 sizeof ( nic->mac_address ) );
-	DBG ( "iBFT NIC MAC = %s\n",
-	      netdev->ll_protocol->ntoa ( nic->mac_address ) );
+	if ( ( rc = ll_protocol->eth_addr ( netdev->ll_addr,
+					    nic->mac_address ) ) != 0 ) {
+		DBG ( "Could not determine iBFT MAC: %s\n", strerror ( rc ) );
+		return rc;
+	}
+	DBG ( "iBFT NIC MAC = %s\n", eth_ntoa ( nic->mac_address ) );
 	nic->pci_bus_dev_func = netdev->dev->desc.location;
 	DBG ( "iBFT NIC PCI = %04x\n", nic->pci_bus_dev_func );
 
diff --git a/gpxe/src/arch/i386/interface/pcbios/int13.c b/gpxe/src/arch/i386/interface/pcbios/int13.c
index 2e9de5cb..87b613a8 100644
--- a/gpxe/src/arch/i386/interface/pcbios/int13.c
+++ b/gpxe/src/arch/i386/interface/pcbios/int13.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <limits.h>
 #include <byteswap.h>
@@ -50,6 +52,48 @@ extern void int13_wrapper ( void );
 static LIST_HEAD ( drives );
 
 /**
+ * Number of BIOS drives
+ *
+ * Note that this is the number of drives in the system as a whole
+ * (i.e. a mirror of the counter at 40:75), rather than a count of the
+ * number of emulated drives.
+ */
+static uint8_t num_drives;
+
+/**
+ * Update BIOS drive count
+ */
+static void int13_set_num_drives ( void ) {
+	struct int13_drive *drive;
+
+	/* Get current drive count */
+	get_real ( num_drives, BDA_SEG, BDA_NUM_DRIVES );
+
+	/* Ensure count is large enough to cover all of our emulated drives */
+	list_for_each_entry ( drive, &drives, list ) {
+		if ( num_drives <= ( drive->drive & 0x7f ) )
+			num_drives = ( ( drive->drive & 0x7f ) + 1 );
+	}
+
+	/* Update current drive count */
+	put_real ( num_drives, BDA_SEG, BDA_NUM_DRIVES );
+}
+
+/**
+ * Check number of drives
+ */
+static void int13_check_num_drives ( void ) {
+	uint8_t check_num_drives;
+
+	get_real ( check_num_drives, BDA_SEG, BDA_NUM_DRIVES );
+	if ( check_num_drives != num_drives ) {
+		int13_set_num_drives();
+		DBG ( "INT13 fixing up number of drives from %d to %d\n",
+		      check_num_drives, num_drives );
+	}
+}
+
+/**
  * INT 13, 00 - Reset disk system
  *
  * @v drive		Emulated drive
@@ -98,6 +142,7 @@ static int int13_rw_sectors ( struct int13_drive *drive,
 	unsigned long lba;
 	unsigned int count;
 	userptr_t buffer;
+	int rc;
 
 	/* Validate blocksize */
 	if ( blockdev->blksize != INT13_BLKSIZE ) {
@@ -122,8 +167,10 @@ static int int13_rw_sectors ( struct int13_drive *drive,
 	      head, sector, lba, ix86->segs.es, ix86->regs.bx, count );
 
 	/* Read from / write to block device */
-	if ( io ( blockdev, lba, count, buffer ) != 0 )
+	if ( ( rc = io ( blockdev, lba, count, buffer ) ) != 0 ) {
+		DBG ( "INT 13 failed: %s\n", strerror ( rc ) );
 		return -INT13_STATUS_READ_ERROR;
+	}
 
 	return 0;
 }
@@ -202,9 +249,13 @@ static int int13_get_parameters ( struct int13_drive *drive,
  */
 static int int13_get_disk_type ( struct int13_drive *drive,
 				 struct i386_all_regs *ix86 ) {
+	uint32_t blocks;
+
 	DBG ( "Get disk type\n" );
-	ix86->regs.cx = ( drive->cylinders >> 16 );
-	ix86->regs.dx = ( drive->cylinders & 0xffff );
+	blocks = ( ( drive->blockdev->blocks <= 0xffffffffUL ) ?
+		   drive->blockdev->blocks : 0xffffffffUL );
+	ix86->regs.cx = ( blocks >> 16 );
+	ix86->regs.dx = ( blocks & 0xffff );
 	return INT13_DISK_TYPE_HDD;
 }
 
@@ -248,6 +299,7 @@ static int int13_extended_rw ( struct int13_drive *drive,
 	uint64_t lba;
 	unsigned long count;
 	userptr_t buffer;
+	int rc;
 
 	/* Read parameters from disk address structure */
 	copy_from_real ( &addr, ix86->segs.ds, ix86->regs.si, sizeof ( addr ));
@@ -259,8 +311,10 @@ static int int13_extended_rw ( struct int13_drive *drive,
 	      addr.buffer.segment, addr.buffer.offset, count );
 	
 	/* Read from / write to block device */
-	if ( io ( blockdev, lba, count, buffer ) != 0 )
+	if ( ( rc = io ( blockdev, lba, count, buffer ) ) != 0 ) {
+		DBG ( "INT 13 failed: %s\n", strerror ( rc ) );
 		return -INT13_STATUS_READ_ERROR;
+	}
 
 	return 0;
 }
@@ -328,6 +382,9 @@ static __asmcall void int13 ( struct i386_all_regs *ix86 ) {
 	struct int13_drive *drive;
 	int status;
 
+	/* Check BIOS hasn't killed off our drive */
+	int13_check_num_drives();
+
 	list_for_each_entry ( drive, &drives, list ) {
 
 		if ( bios_drive != drive->drive ) {
@@ -387,7 +444,7 @@ static __asmcall void int13 ( struct i386_all_regs *ix86 ) {
 		/* Negative status indicates an error */
 		if ( status < 0 ) {
 			status = -status;
-			DBG ( "INT13 failed with status %x\n", status );
+			DBG ( "INT 13 returning failure status %x\n", status );
 		} else {
 			ix86->flags &= ~CF;
 		}
@@ -543,7 +600,6 @@ void register_int13_drive ( struct int13_drive *drive ) {
 	/* Assign natural drive number */
 	get_real ( num_drives, BDA_SEG, BDA_NUM_DRIVES );
 	drive->natural_drive = ( num_drives | 0x80 );
-	num_drives++;
 
 	/* Assign drive number */
 	if ( ( drive->drive & 0xff ) == 0xff ) {
@@ -552,13 +608,8 @@ void register_int13_drive ( struct int13_drive *drive ) {
 	} else {
 		/* Use specified drive number (+0x80 if necessary) */
 		drive->drive |= 0x80;
-		if ( num_drives <= ( drive->drive & 0x7f ) )
-			num_drives = ( ( drive->drive & 0x7f ) + 1 );
 	}
 
-	/* Update BIOS drive count */
-	put_real ( num_drives, BDA_SEG, BDA_NUM_DRIVES );
-
 	DBG ( "Registered INT13 drive %02x (naturally %02x) with C/H/S "
 	      "geometry %d/%d/%d\n", drive->drive, drive->natural_drive,
 	      drive->cylinders, drive->heads, drive->sectors_per_track );
@@ -569,6 +620,9 @@ void register_int13_drive ( struct int13_drive *drive ) {
 
 	/* Add to list of emulated drives */
 	list_add ( &drive->list, &drives );
+
+	/* Update BIOS drive count */
+	int13_set_num_drives();
 }
 
 /**
@@ -652,7 +706,8 @@ int int13_boot ( unsigned int drive ) {
 
 	/* Jump to boot sector */
 	if ( ( rc = call_bootsector ( 0x0, 0x7c00, drive ) ) != 0 ) {
-		DBG ( "INT 13 drive %02x boot returned\n", drive );
+		DBG ( "INT 13 drive %02x boot returned: %s\n",
+		      drive, strerror ( rc ) );
 		return rc;
 	}
 
diff --git a/gpxe/src/arch/i386/interface/pcbios/iscsiboot.c b/gpxe/src/arch/i386/interface/pcbios/iscsiboot.c
index 02aec4ba..00efd8ff 100644
--- a/gpxe/src/arch/i386/interface/pcbios/iscsiboot.c
+++ b/gpxe/src/arch/i386/interface/pcbios/iscsiboot.c
@@ -4,26 +4,16 @@
 #include <stdio.h>
 #include <errno.h>
 #include <gpxe/iscsi.h>
-#include <gpxe/settings.h>
-#include <gpxe/dhcp.h>
 #include <gpxe/netdevice.h>
 #include <gpxe/ibft.h>
-#include <gpxe/init.h>
 #include <gpxe/sanboot.h>
 #include <int13.h>
-#include <usr/autoboot.h>
 
-struct setting keep_san_setting __setting = {
-	.name = "keep-san",
-	.description = "Preserve SAN connection",
-	.tag = DHCP_EB_KEEP_SAN,
-	.type = &setting_type_int8,
-};
+FILE_LICENCE ( GPL2_OR_LATER );
 
 static int iscsiboot ( const char *root_path ) {
 	struct scsi_device *scsi;
 	struct int13_drive *drive;
-	int keep_san;
 	int rc;
 
 	scsi = zalloc ( sizeof ( *scsi ) );
@@ -37,8 +27,6 @@ static int iscsiboot ( const char *root_path ) {
 		goto err_alloc_drive;
 	}
 
-	printf ( "iSCSI booting from %s\n", root_path );
-
 	if ( ( rc = iscsi_attach ( scsi, root_path ) ) != 0 ) {
 		printf ( "Could not attach iSCSI device: %s\n",
 			 strerror ( rc ) );
@@ -65,12 +53,8 @@ static int iscsiboot ( const char *root_path ) {
 	printf ( "Boot failed\n" );
 
 	/* Leave drive registered, if instructed to do so */
-	keep_san = fetch_intz_setting ( NULL, &keep_san_setting );
-	if ( keep_san ) {
-		printf ( "Preserving connection to SAN disk\n" );
-		shutdown_exit_flags |= SHUTDOWN_KEEP_DEVICES;
+	if ( keep_san() )
 		return rc;
-	}
 
 	printf ( "Unregistering BIOS drive %#02x\n", drive->drive );
 	unregister_int13_drive ( drive );
diff --git a/gpxe/src/arch/i386/interface/pcbios/keepsan.c b/gpxe/src/arch/i386/interface/pcbios/keepsan.c
new file mode 100644
index 00000000..904e017d
--- /dev/null
+++ b/gpxe/src/arch/i386/interface/pcbios/keepsan.c
@@ -0,0 +1,26 @@
+#include <stdint.h>
+#include <stdio.h>
+#include <gpxe/settings.h>
+#include <gpxe/dhcp.h>
+#include <gpxe/init.h>
+#include <gpxe/sanboot.h>
+#include <usr/autoboot.h>
+
+struct setting keep_san_setting __setting = {
+	.name = "keep-san",
+	.description = "Preserve SAN connection",
+	.tag = DHCP_EB_KEEP_SAN,
+	.type = &setting_type_int8,
+};
+
+int keep_san ( void ) {
+	int keep_san;
+
+	keep_san = fetch_intz_setting ( NULL, &keep_san_setting );
+	if ( ! keep_san )
+		return 0;
+
+	printf ( "Preserving connection to SAN disk\n" );
+	shutdown_exit_flags |= SHUTDOWN_KEEP_DEVICES;
+	return 1;
+}
diff --git a/gpxe/src/arch/i386/interface/pcbios/memtop_umalloc.c b/gpxe/src/arch/i386/interface/pcbios/memtop_umalloc.c
index 744d8e30..0645fe63 100644
--- a/gpxe/src/arch/i386/interface/pcbios/memtop_umalloc.c
+++ b/gpxe/src/arch/i386/interface/pcbios/memtop_umalloc.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /**
  * @file
  *
diff --git a/gpxe/src/arch/i386/interface/pcbios/pcibios.c b/gpxe/src/arch/i386/interface/pcbios/pcibios.c
index 81b4fd3c..f2c3880c 100644
--- a/gpxe/src/arch/i386/interface/pcbios/pcibios.c
+++ b/gpxe/src/arch/i386/interface/pcbios/pcibios.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <gpxe/pci.h>
 #include <realmode.h>
diff --git a/gpxe/src/arch/i386/interface/pcbios/sbft.c b/gpxe/src/arch/i386/interface/pcbios/sbft.c
new file mode 100644
index 00000000..12927c77
--- /dev/null
+++ b/gpxe/src/arch/i386/interface/pcbios/sbft.c
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Fen Systems Ltd <mbrown@fensystems.co.uk>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *   Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ *
+ *   Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the
+ *   distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+FILE_LICENCE ( BSD2 );
+
+/** @file
+ *
+ * SRP boot firmware table
+ *
+ */
+
+#include <assert.h>
+#include <realmode.h>
+#include <gpxe/srp.h>
+#include <gpxe/ib_srp.h>
+#include <gpxe/acpi.h>
+#include <gpxe/sbft.h>
+
+#define sbftab __use_data16 ( sbftab )
+/** The sBFT used by gPXE */
+struct gpxe_sbft __data16 ( sbftab ) = {
+	/* Table header */
+	.table = {
+		/* ACPI header */
+		.acpi = {
+			.signature = SBFT_SIG,
+			.length = sizeof ( sbftab ),
+			.revision = 1,
+			.oem_id = "FENSYS",
+			.oem_table_id = "gPXE",
+		},
+		.scsi_offset = offsetof ( typeof ( sbftab ), scsi ),
+		.srp_offset = offsetof ( typeof ( sbftab ), srp ),
+		.ib_offset = offsetof ( typeof ( sbftab ), ib ),
+	},
+};
+
+/**
+ * Fill in all variable portions of sBFT
+ *
+ * @v srp		SRP device
+ * @ret rc		Return status code
+ */
+int sbft_fill_data ( struct srp_device *srp ) {
+	struct sbft_scsi_subtable *sbft_scsi = &sbftab.scsi;
+	struct sbft_srp_subtable *sbft_srp = &sbftab.srp;
+	struct sbft_ib_subtable *sbft_ib = &sbftab.ib;
+	struct ib_srp_parameters *ib_params;
+	struct segoff rm_sbftab = {
+		.segment = rm_ds,
+		.offset = __from_data16 ( &sbftab ),
+	};
+
+	/* Fill in the SCSI subtable */
+	memcpy ( &sbft_scsi->lun, &srp->lun, sizeof ( sbft_scsi->lun ) );
+
+	/* Fill in the SRP subtable */
+	memcpy ( &sbft_srp->port_ids, &srp->port_ids,
+		 sizeof ( sbft_srp->port_ids ) );
+
+	/* Fill in the IB subtable */
+	assert ( srp->transport == &ib_srp_transport );
+	ib_params = ib_srp_params ( srp );
+	memcpy ( &sbft_ib->sgid, &ib_params->sgid, sizeof ( sbft_ib->sgid ) );
+	memcpy ( &sbft_ib->dgid, &ib_params->dgid, sizeof ( sbft_ib->dgid ) );
+	memcpy ( &sbft_ib->service_id, &ib_params->service_id,
+		 sizeof ( sbft_ib->service_id ) );
+	sbft_ib->pkey = ib_params->pkey;
+
+	/* Update checksum */
+	acpi_fix_checksum ( &sbftab.table.acpi );
+
+	DBGC ( &sbftab, "SRP Boot Firmware Table at %04x:%04x:\n",
+	       rm_sbftab.segment, rm_sbftab.offset );
+	DBGC_HDA ( &sbftab, rm_sbftab, &sbftab, sizeof ( sbftab ) );
+
+	return 0;
+}
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_call.c b/gpxe/src/arch/i386/interface/pxe/pxe_call.c
index 06dee25c..66a9b1e2 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_call.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_call.c
@@ -16,7 +16,10 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/uaccess.h>
+#include <gpxe/init.h>
 #include <registers.h>
 #include <biosint.h>
 #include <pxe.h>
@@ -34,6 +37,9 @@ extern struct segoff __text16 ( pxe_int_1a_vector );
 /** INT 1A handler */
 extern void pxe_int_1a ( void );
 
+/** INT 1A hooked flag */
+static int int_1a_hooked = 0;
+
 /** A function pointer to hold any PXE API call
  *
  * Used by pxe_api_call() to avoid large swathes of duplicated code.
@@ -98,6 +104,7 @@ union pxenv_call {
 	PXENV_EXIT_t ( * get_file_size ) ( struct s_PXENV_GET_FILE_SIZE * );
 	PXENV_EXIT_t ( * file_exec ) ( struct s_PXENV_FILE_EXEC * );
 	PXENV_EXIT_t ( * file_api_check ) ( struct s_PXENV_FILE_API_CHECK * );
+	PXENV_EXIT_t ( * file_exit_hook ) ( struct s_PXENV_FILE_EXIT_HOOK * );
 };
 
 /**
@@ -304,6 +311,10 @@ __asmcall void pxe_api_call ( struct i386_all_regs *ix86 ) {
 		pxenv_call.file_api_check = pxenv_file_api_check;
 		param_len = sizeof ( pxenv_any.file_api_check );
 		break;
+	case PXENV_FILE_EXIT_HOOK:
+		pxenv_call.file_exit_hook = pxenv_file_exit_hook;
+		param_len = sizeof ( pxenv_any.file_exit_hook );
+		break;
 	default:
 		DBG ( "PXENV_UNKNOWN_%hx", opcode );
 		pxenv_call.unknown = pxenv_unknown;
@@ -334,6 +345,18 @@ __asmcall void pxe_api_call ( struct i386_all_regs *ix86 ) {
 }
 
 /**
+ * Dispatch weak PXE API call with PXE stack available
+ *
+ * @v ix86		Registers for PXE call
+ * @ret present		Zero (PXE stack present)
+ */
+int _pxe_api_call_weak ( struct i386_all_regs *ix86 )
+{
+	pxe_api_call ( ix86 );
+	return 0;
+}
+
+/**
  * Dispatch PXE loader call
  *
  * @v es:di		Address of PXE parameter block
@@ -362,25 +385,6 @@ __asmcall void pxe_loader_call ( struct i386_all_regs *ix86 ) {
 }
 
 /**
- * Hook INT 1A for PXE
- *
- */
-void pxe_hook_int1a ( void ) {
-	hook_bios_interrupt ( 0x1a, ( unsigned int ) pxe_int_1a,
-			      &pxe_int_1a_vector );
-}
-
-/**
- * Unhook INT 1A for PXE
- *
- * @ret rc		Return status code
- */
-int pxe_unhook_int1a ( void ) {
-	return unhook_bios_interrupt ( 0x1a, ( unsigned int ) pxe_int_1a,
-				       &pxe_int_1a_vector );
-}
-
-/**
  * Calculate byte checksum as used by PXE
  *
  * @v data		Data
@@ -401,7 +405,7 @@ static uint8_t pxe_checksum ( void *data, size_t size ) {
  * Initialise !PXE and PXENV+ structures
  *
  */
-void pxe_init_structures ( void ) {
+static void pxe_init_structures ( void ) {
 	uint32_t rm_cs_phys = ( rm_cs << 4 );
 	uint32_t rm_ds_phys = ( rm_ds << 4 );
 
@@ -427,6 +431,55 @@ void pxe_init_structures ( void ) {
 	pxenv.Checksum -= pxe_checksum ( &pxenv, sizeof ( pxenv ) );
 }
 
+/** PXE structure initialiser */
+struct init_fn pxe_init_fn __init_fn ( INIT_NORMAL ) = {
+	.initialise = pxe_init_structures,
+};
+
+/**
+ * Activate PXE stack
+ *
+ * @v netdev		Net device to use as PXE net device
+ */
+void pxe_activate ( struct net_device *netdev ) {
+
+	/* Ensure INT 1A is hooked */
+	if ( ! int_1a_hooked ) {
+		hook_bios_interrupt ( 0x1a, ( unsigned int ) pxe_int_1a,
+				      &pxe_int_1a_vector );
+		int_1a_hooked = 1;
+	}
+
+	/* Set PXE network device */
+	pxe_set_netdev ( netdev );
+}
+
+/**
+ * Deactivate PXE stack
+ *
+ * @ret rc		Return status code
+ */
+int pxe_deactivate ( void ) {
+	int rc;
+
+	/* Clear PXE network device */
+	pxe_set_netdev ( NULL );
+
+	/* Ensure INT 1A is unhooked, if possible */
+	if ( int_1a_hooked ) {
+		if ( ( rc = unhook_bios_interrupt ( 0x1a,
+						    (unsigned int) pxe_int_1a,
+						    &pxe_int_1a_vector ))!= 0){
+			DBG ( "Could not unhook INT 1A: %s\n",
+			      strerror ( rc ) );
+			return rc;
+		}
+		int_1a_hooked = 0;
+	}
+
+	return 0;
+}
+
 /**
  * Start PXE NBP at 0000:7c00
  *
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_entry.S b/gpxe/src/arch/i386/interface/pxe/pxe_entry.S
index 0e8c8e2d..0d3a57cd 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_entry.S
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_entry.S
@@ -17,6 +17,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.arch i386
 
 /****************************************************************************
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_file.c b/gpxe/src/arch/i386/interface/pxe/pxe_file.c
index 41674588..8d832123 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_file.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_file.c
@@ -12,9 +12,12 @@
 #include <gpxe/posix_io.h>
 #include <gpxe/features.h>
 #include <pxe.h>
+#include <realmode.h>
 
 /*
  * Copyright (C) 2007 Michael Brown <mbrown@fensystems.co.uk>.
+ * Portions (C) 2010 Shao Miller <shao.miller@yrdsb.edu.on.ca>.
+ *              [PXE exit hook logic]
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -31,6 +34,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 FEATURE ( FEATURE_MISC, "PXEXT", DHCP_EB_FEATURE_PXE_EXT, 2 );
 
 /**
@@ -228,6 +233,9 @@ PXENV_EXIT_t pxenv_file_exec ( struct s_PXENV_FILE_EXEC *file_exec ) {
 	return PXENV_EXIT_SUCCESS;
 }
 
+segoff_t __data16 ( pxe_exit_hook ) = { 0, 0 };
+#define pxe_exit_hook __use_data16 ( pxe_exit_hook )
+
 /**
  * FILE API CHECK
  *
@@ -258,7 +266,41 @@ PXENV_EXIT_t pxenv_file_api_check ( struct s_PXENV_FILE_API_CHECK *file_api_chec
 		file_api_check->Magic    = 0xe9c17b20;
 		file_api_check->Provider = 0x45585067; /* "gPXE" */
 		file_api_check->APIMask  = 0x0000007f; /* Functions e0-e6 */
+		/* Check to see if we have a PXE exit hook */
+		if ( pxe_exit_hook.segment | pxe_exit_hook.offset )
+			/* Function e7, also */
+			file_api_check->APIMask |= 0x00000080;
 		file_api_check->Flags    = 0;	       /* None defined */
 		return PXENV_EXIT_SUCCESS;
 	}
 }
+
+/**
+ * FILE EXIT HOOK
+ *
+ * @v file_exit_hook			Pointer to a struct
+ *					s_PXENV_FILE_EXIT_HOOK
+ * @v s_PXENV_FILE_EXIT_HOOK::Hook	SEG16:OFF16 to jump to
+ * @ret #PXENV_EXIT_SUCCESS		Successfully set hook
+ * @ret #PXENV_EXIT_FAILURE		We're not an NBP build
+ * @ret s_PXENV_FILE_EXIT_HOOK::Status	PXE status code
+ *
+ */
+PXENV_EXIT_t pxenv_file_exit_hook ( struct s_PXENV_FILE_EXIT_HOOK
+					*file_exit_hook ) {
+	DBG ( "PXENV_FILE_EXIT_HOOK" );
+
+	/* Check to see if we have a PXE exit hook */
+	if ( pxe_exit_hook.segment | pxe_exit_hook.offset ) {
+		/* We'll jump to the specified SEG16:OFF16 during exit */
+		pxe_exit_hook.segment = file_exit_hook->Hook.segment;
+		pxe_exit_hook.offset = file_exit_hook->Hook.offset;
+		file_exit_hook->Status = PXENV_STATUS_SUCCESS;
+		return PXENV_EXIT_SUCCESS;
+	}
+
+	DBG ( " not NBP" );
+	file_exit_hook->Status = PXENV_STATUS_UNSUPPORTED;
+	return PXENV_EXIT_FAILURE;
+}
+
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_loader.c b/gpxe/src/arch/i386/interface/pxe/pxe_loader.c
index d228a36d..b35caf77 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_loader.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_loader.c
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <gpxe/init.h>
 #include "pxe.h"
 #include "pxe_call.h"
@@ -37,9 +39,6 @@ PXENV_EXIT_t undi_loader ( struct s_UNDI_LOADER *undi_loader ) {
 	DBG ( "[PXENV_UNDI_LOADER to CS %04x DS %04x]",
 	      undi_loader->UNDI_CS, undi_loader->UNDI_DS );
 
-	/* Set up PXE data structures */
-	pxe_init_structures();
-
 	/* Fill in UNDI loader structure */
 	undi_loader->PXEptr.segment = rm_cs;
 	undi_loader->PXEptr.offset = __from_text16 ( &ppxe );
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_preboot.c b/gpxe/src/arch/i386/interface/pxe/pxe_preboot.c
index 193abc3d..3939c7bf 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_preboot.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_preboot.c
@@ -23,6 +23,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <string.h>
 #include <stdlib.h>
@@ -35,6 +37,7 @@
 #include <gpxe/init.h>
 #include <gpxe/if_ether.h>
 #include <basemem_packet.h>
+#include <biosint.h>
 #include "pxe.h"
 #include "pxe_call.h"
 
@@ -294,11 +297,8 @@ PXENV_EXIT_t pxenv_start_undi ( struct s_PXENV_START_UNDI *start_undi ) {
 	}
 	DBG ( " using netdev %s", netdev->name );
 
-	/* Save as PXE net device */
-	pxe_set_netdev ( netdev );
-
-	/* Hook INT 1A */
-	pxe_hook_int1a();
+	/* Activate PXE */
+	pxe_activate ( netdev );
 
 	start_undi->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
@@ -311,15 +311,20 @@ PXENV_EXIT_t pxenv_start_undi ( struct s_PXENV_START_UNDI *start_undi ) {
 PXENV_EXIT_t pxenv_stop_undi ( struct s_PXENV_STOP_UNDI *stop_undi ) {
 	DBG ( "PXENV_STOP_UNDI" );
 
-	/* Unhook INT 1A */
-	pxe_unhook_int1a();
-
-	/* Clear PXE net device */
-	pxe_set_netdev ( NULL );
+	/* Deactivate PXE */
+	pxe_deactivate();
 
 	/* Prepare for unload */
 	shutdown ( SHUTDOWN_BOOT );
 
+	/* Check to see if we still have any hooked interrupts */
+	if ( hooked_bios_interrupts != 0 ) {
+		DBG ( "PXENV_STOP_UNDI failed: %d interrupts still hooked\n",
+		      hooked_bios_interrupts );
+		stop_undi->Status = PXENV_STATUS_KEEP_UNDI;
+		return PXENV_EXIT_FAILURE;
+	}
+
 	stop_undi->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_tftp.c b/gpxe/src/arch/i386/interface/pxe/pxe_tftp.c
index 715a0b61..0e3ca3c5 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_tftp.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_tftp.c
@@ -22,6 +22,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdlib.h>
 #include <stdio.h>
 #include <errno.h>
@@ -138,7 +140,7 @@ static void pxe_tftp_xfer_close ( struct xfer_interface *xfer __unused,
 
 static struct xfer_interface_operations pxe_tftp_xfer_ops = {
 	.close		= pxe_tftp_xfer_close,
-	.vredirect	= xfer_vopen,
+	.vredirect	= xfer_vreopen,
 	.window		= unlimited_xfer_window,
 	.alloc_iob	= default_xfer_alloc_iob,
 	.deliver_iob	= pxe_tftp_xfer_deliver_iob,
@@ -163,7 +165,8 @@ static struct xfer_interface_operations pxe_tftp_xfer_ops = {
  * @ret rc		Return status code
  */
 static int pxe_tftp_open ( uint32_t ipaddress, unsigned int port,
-			   const unsigned char *filename, size_t blksize ) {
+			   const unsigned char *filename, size_t blksize,
+			   int sizeonly ) {
 	char uri_string[PXE_TFTP_URI_LEN];
 	struct in_addr address;
 	int rc;
@@ -183,7 +186,8 @@ static int pxe_tftp_open ( uint32_t ipaddress, unsigned int port,
 	if ( blksize < TFTP_DEFAULT_BLKSIZE )
 		blksize = TFTP_DEFAULT_BLKSIZE;
 	snprintf ( uri_string, sizeof ( uri_string ),
-		   "tftp://%s:%d%s%s?blksize=%zd",
+		   "tftp%s://%s:%d%s%s?blksize=%zd",
+		   sizeonly ? "size" : "",
 		   inet_ntoa ( address ), ntohs ( port ),
 		   ( ( filename[0] == '/' ) ? "" : "/" ), filename, blksize );
 	DBG ( " %s", uri_string );
@@ -252,7 +256,8 @@ PXENV_EXIT_t pxenv_tftp_open ( struct s_PXENV_TFTP_OPEN *tftp_open ) {
 	if ( ( rc = pxe_tftp_open ( tftp_open->ServerIPAddress,
 				    tftp_open->TFTPPort,
 				    tftp_open->FileName,
-				    tftp_open->PacketSize ) ) != 0 ) {
+				    tftp_open->PacketSize,
+				    0) ) != 0 ) {
 		tftp_open->Status = PXENV_STATUS ( rc );
 		return PXENV_EXIT_FAILURE;
 	}
@@ -486,7 +491,7 @@ PXENV_EXIT_t pxenv_tftp_read_file ( struct s_PXENV_TFTP_READ_FILE
 
 	/* Open TFTP file */
 	if ( ( rc = pxe_tftp_open ( tftp_read_file->ServerIPAddress, 0,
-				    tftp_read_file->FileName, 0 ) ) != 0 ) {
+				    tftp_read_file->FileName, 0, 0 ) ) != 0 ) {
 		tftp_read_file->Status = PXENV_STATUS ( rc );
 		return PXENV_EXIT_FAILURE;
 	}
@@ -556,7 +561,7 @@ PXENV_EXIT_t pxenv_tftp_get_fsize ( struct s_PXENV_TFTP_GET_FSIZE
 
 	/* Open TFTP file */
 	if ( ( rc = pxe_tftp_open ( tftp_get_fsize->ServerIPAddress, 0,
-				    tftp_get_fsize->FileName, 0 ) ) != 0 ) {
+				    tftp_get_fsize->FileName, 0, 1 ) ) != 0 ) {
 		tftp_get_fsize->Status = PXENV_STATUS ( rc );
 		return PXENV_EXIT_FAILURE;
 	}
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_udp.c b/gpxe/src/arch/i386/interface/pxe/pxe_udp.c
index 033b1ad9..f4702201 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_udp.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_udp.c
@@ -30,6 +30,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 /** A PXE UDP connection */
 struct pxe_udp_connection {
 	/** Data transfer interface to UDP stack */
diff --git a/gpxe/src/arch/i386/interface/pxe/pxe_undi.c b/gpxe/src/arch/i386/interface/pxe/pxe_undi.c
index 4e4a3da0..c9b67c06 100644
--- a/gpxe/src/arch/i386/interface/pxe/pxe_undi.c
+++ b/gpxe/src/arch/i386/interface/pxe/pxe_undi.c
@@ -22,6 +22,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <stdio.h>
 #include <string.h>
@@ -88,12 +90,26 @@ static void pxe_netdev_close ( void ) {
 	undi_tx_count = 0;
 }
 
+/**
+ * Dump multicast address list
+ *
+ * @v mcast		PXE multicast address list
+ */
+static void pxe_dump_mcast_list ( struct s_PXENV_UNDI_MCAST_ADDRESS *mcast ) {
+	struct ll_protocol *ll_protocol = pxe_netdev->ll_protocol;
+	unsigned int i;
+
+	for ( i = 0 ; i < mcast->MCastAddrCount ; i++ ) {
+		DBG ( " %s", ll_protocol->ntoa ( mcast->McastAddr[i] ) );
+	}
+}
+
 /* PXENV_UNDI_STARTUP
  *
  * Status: working
  */
 PXENV_EXIT_t pxenv_undi_startup ( struct s_PXENV_UNDI_STARTUP *undi_startup ) {
-	DBG ( "PXENV_UNDI_STARTUP" );
+	DBG ( "PXENV_UNDI_STARTUP\n" );
 
 	undi_startup->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
@@ -104,7 +120,7 @@ PXENV_EXIT_t pxenv_undi_startup ( struct s_PXENV_UNDI_STARTUP *undi_startup ) {
  * Status: working
  */
 PXENV_EXIT_t pxenv_undi_cleanup ( struct s_PXENV_UNDI_CLEANUP *undi_cleanup ) {
-	DBG ( "PXENV_UNDI_CLEANUP" );
+	DBG ( "PXENV_UNDI_CLEANUP\n" );
 
 	pxe_netdev_close();
 
@@ -118,7 +134,8 @@ PXENV_EXIT_t pxenv_undi_cleanup ( struct s_PXENV_UNDI_CLEANUP *undi_cleanup ) {
  */
 PXENV_EXIT_t pxenv_undi_initialize ( struct s_PXENV_UNDI_INITIALIZE
 				     *undi_initialize ) {
-	DBG ( "PXENV_UNDI_INITIALIZE" );
+	DBG ( "PXENV_UNDI_INITIALIZE protocolini %08x\n",
+	      undi_initialize->ProtocolIni );
 
 	undi_initialize->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
@@ -133,9 +150,13 @@ PXENV_EXIT_t pxenv_undi_reset_adapter ( struct s_PXENV_UNDI_RESET
 	int rc;
 
 	DBG ( "PXENV_UNDI_RESET_ADAPTER" );
+	pxe_dump_mcast_list ( &undi_reset_adapter->R_Mcast_Buf );
+	DBG ( "\n" );
 
 	pxe_netdev_close();
 	if ( ( rc = pxe_netdev_open() ) != 0 ) {
+		DBG ( "PXENV_UNDI_RESET_ADAPTER could not reopen %s: %s\n",
+		      pxe_netdev->name, strerror ( rc ) );
 		undi_reset_adapter->Status = PXENV_STATUS ( rc );
 		return PXENV_EXIT_FAILURE;
 	}
@@ -150,7 +171,7 @@ PXENV_EXIT_t pxenv_undi_reset_adapter ( struct s_PXENV_UNDI_RESET
  */
 PXENV_EXIT_t pxenv_undi_shutdown ( struct s_PXENV_UNDI_SHUTDOWN
 				   *undi_shutdown ) {
-	DBG ( "PXENV_UNDI_SHUTDOWN" );
+	DBG ( "PXENV_UNDI_SHUTDOWN\n" );
 
 	pxe_netdev_close();
 
@@ -165,9 +186,14 @@ PXENV_EXIT_t pxenv_undi_shutdown ( struct s_PXENV_UNDI_SHUTDOWN
 PXENV_EXIT_t pxenv_undi_open ( struct s_PXENV_UNDI_OPEN *undi_open ) {
 	int rc;
 
-	DBG ( "PXENV_UNDI_OPEN" );
+	DBG ( "PXENV_UNDI_OPEN flag %04x filter %04x",
+	      undi_open->OpenFlag, undi_open->PktFilter );
+	pxe_dump_mcast_list ( &undi_open->R_Mcast_Buf );
+	DBG ( "\n" );
 
 	if ( ( rc = pxe_netdev_open() ) != 0 ) {
+		DBG ( "PXENV_UNDI_OPEN could not open %s: %s\n",
+		      pxe_netdev->name, strerror ( rc ) );
 		undi_open->Status = PXENV_STATUS ( rc );
 		return PXENV_EXIT_FAILURE;
 	}
@@ -181,7 +207,7 @@ PXENV_EXIT_t pxenv_undi_open ( struct s_PXENV_UNDI_OPEN *undi_open ) {
  * Status: working
  */
 PXENV_EXIT_t pxenv_undi_close ( struct s_PXENV_UNDI_CLOSE *undi_close ) {
-	DBG ( "PXENV_UNDI_CLOSE" );
+	DBG ( "PXENV_UNDI_CLOSE\n" );
 
 	pxe_netdev_close();
 
@@ -207,7 +233,13 @@ PXENV_EXIT_t pxenv_undi_transmit ( struct s_PXENV_UNDI_TRANSMIT
 	unsigned int i;
 	int rc;
 
-	DBG ( "PXENV_UNDI_TRANSMIT" );
+	DBG2 ( "PXENV_UNDI_TRANSMIT" );
+
+	/* Forcibly enable interrupts at this point, to work around
+	 * callers that never call PXENV_UNDI_OPEN before attempting
+	 * to use the UNDI API.
+	 */
+	netdev_irq ( pxe_netdev, 1 );
 
 	/* Identify network-layer protocol */
 	switch ( undi_transmit->Protocol ) {
@@ -219,25 +251,29 @@ PXENV_EXIT_t pxenv_undi_transmit ( struct s_PXENV_UNDI_TRANSMIT
 		ll_hlen = 0;
 		break;
 	default:
+		DBG2 ( " %02x invalid protocol\n", undi_transmit->Protocol );
 		undi_transmit->Status = PXENV_STATUS_UNDI_INVALID_PARAMETER;
 		return PXENV_EXIT_FAILURE;
 	}
-	DBG ( " %s", ( net_protocol ? net_protocol->name : "RAW" ) );
+	DBG2 ( " %s", ( net_protocol ? net_protocol->name : "RAW" ) );
 
 	/* Calculate total packet length */
 	copy_from_real ( &tbd, undi_transmit->TBD.segment,
 			 undi_transmit->TBD.offset, sizeof ( tbd ) );
 	len = tbd.ImmedLength;
-	DBG ( " %d", tbd.ImmedLength );
+	DBG2 ( " %04x:%04x+%x", tbd.Xmit.segment, tbd.Xmit.offset,
+	       tbd.ImmedLength );
 	for ( i = 0 ; i < tbd.DataBlkCount ; i++ ) {
 		datablk = &tbd.DataBlock[i];
 		len += datablk->TDDataLen;
-		DBG ( "+%d", datablk->TDDataLen );
+		DBG2 ( " %04x:%04x+%x", datablk->TDDataPtr.segment,
+		       datablk->TDDataPtr.offset, datablk->TDDataLen );
 	}
 
 	/* Allocate and fill I/O buffer */
 	iobuf = alloc_iob ( ll_hlen + len );
 	if ( ! iobuf ) {
+		DBG2 ( " could not allocate iobuf\n" );
 		undi_transmit->Status = PXENV_STATUS_OUT_OF_RESOURCES;
 		return PXENV_EXIT_FAILURE;
 	}
@@ -262,45 +298,57 @@ PXENV_EXIT_t pxenv_undi_transmit ( struct s_PXENV_UNDI_TRANSMIT
 					 undi_transmit->DestAddr.offset,
 					 ll_protocol->ll_addr_len );
 			ll_dest = destaddr;
+			DBG2 ( " DEST %s", ll_protocol->ntoa ( ll_dest ) );
 		} else {
-			DBG ( " BCAST" );
-			ll_dest = ll_protocol->ll_broadcast;
+			ll_dest = pxe_netdev->ll_broadcast;
+			DBG2 ( " BCAST" );
 		}
 
 		/* Add link-layer header */
-		if ( ( rc = ll_protocol->push ( iobuf, ll_dest,
+		if ( ( rc = ll_protocol->push ( pxe_netdev, iobuf, ll_dest,
 						pxe_netdev->ll_addr,
 						net_protocol->net_proto ))!=0){
+			DBG2 ( " could not add link-layer header: %s\n",
+			       strerror ( rc ) );
 			free_iob ( iobuf );
 			undi_transmit->Status = PXENV_STATUS ( rc );
 			return PXENV_EXIT_FAILURE;
 		}
 	}
 
+	/* Flag transmission as in-progress.  Do this before starting
+	 * to transmit the packet, because the ISR may trigger before
+	 * we return from netdev_tx().
+	 */
+	undi_tx_count++;
+
 	/* Transmit packet */
+	DBG2 ( "\n" );
 	if ( ( rc = netdev_tx ( pxe_netdev, iobuf ) ) != 0 ) {
+		DBG2 ( "PXENV_UNDI_TRANSMIT could not transmit: %s\n",
+		       strerror ( rc ) );
+		undi_tx_count--;
 		undi_transmit->Status = PXENV_STATUS ( rc );
 		return PXENV_EXIT_FAILURE;
 	}
 
-	/* Flag transmission as in-progress */
-	undi_tx_count++;
-
 	undi_transmit->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
 
 /* PXENV_UNDI_SET_MCAST_ADDRESS
  *
- * Status: stub (no PXE multicast support)
+ * Status: working (for NICs that support receive-all-multicast)
  */
 PXENV_EXIT_t
 pxenv_undi_set_mcast_address ( struct s_PXENV_UNDI_SET_MCAST_ADDRESS
 			       *undi_set_mcast_address ) {
 	DBG ( "PXENV_UNDI_SET_MCAST_ADDRESS" );
+	pxe_dump_mcast_list ( &undi_set_mcast_address->R_Mcast_Buf );
+	DBG ( "\n" );
 
-	undi_set_mcast_address->Status = PXENV_STATUS_UNSUPPORTED;
-	return PXENV_EXIT_FAILURE;
+	undi_set_mcast_address->Status = PXENV_STATUS_SUCCESS;
+	return PXENV_EXIT_SUCCESS;
 }
 
 /* PXENV_UNDI_SET_STATION_ADDRESS
@@ -310,13 +358,16 @@ pxenv_undi_set_mcast_address ( struct s_PXENV_UNDI_SET_MCAST_ADDRESS
 PXENV_EXIT_t 
 pxenv_undi_set_station_address ( struct s_PXENV_UNDI_SET_STATION_ADDRESS
 				 *undi_set_station_address ) {
+	struct ll_protocol *ll_protocol = pxe_netdev->ll_protocol;
 
-	DBG ( "PXENV_UNDI_SET_STATION_ADDRESS" );
+	DBG ( "PXENV_UNDI_SET_STATION_ADDRESS %s",
+	      ll_protocol->ntoa ( undi_set_station_address->StationAddress ) );
 
 	/* If adapter is open, the change will have no effect; return
 	 * an error
 	 */
 	if ( pxe_netdev->state & NETDEV_OPEN ) {
+		DBG ( " failed: netdev is open\n" );
 		undi_set_station_address->Status =
 			PXENV_STATUS_UNDI_INVALID_STATE;
 		return PXENV_EXIT_FAILURE;
@@ -325,8 +376,9 @@ pxenv_undi_set_station_address ( struct s_PXENV_UNDI_SET_STATION_ADDRESS
 	/* Update MAC address */
 	memcpy ( pxe_netdev->ll_addr,
 		 &undi_set_station_address->StationAddress,
-		 pxe_netdev->ll_protocol->ll_addr_len );
+		 ll_protocol->ll_addr_len );
 
+	DBG ( "\n" );
 	undi_set_station_address->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
@@ -339,10 +391,17 @@ pxenv_undi_set_station_address ( struct s_PXENV_UNDI_SET_STATION_ADDRESS
 PXENV_EXIT_t
 pxenv_undi_set_packet_filter ( struct s_PXENV_UNDI_SET_PACKET_FILTER
 			       *undi_set_packet_filter ) {
-	DBG ( "PXENV_UNDI_SET_PACKET_FILTER" );
 
-	undi_set_packet_filter->Status = PXENV_STATUS_UNSUPPORTED;
-	return PXENV_EXIT_FAILURE;
+	DBG ( "PXENV_UNDI_SET_PACKET_FILTER %02x\n",
+	      undi_set_packet_filter->filter );
+
+	/* Pretend that we succeeded, otherwise the 3Com DOS UNDI
+	 * driver refuses to load.  (We ignore the filter value in the
+	 * PXENV_UNDI_OPEN call anyway.)
+	 */
+	undi_set_packet_filter->Status = PXENV_STATUS_SUCCESS;
+
+	return PXENV_EXIT_SUCCESS;
 }
 
 /* PXENV_UNDI_GET_INFORMATION
@@ -353,6 +412,7 @@ PXENV_EXIT_t pxenv_undi_get_information ( struct s_PXENV_UNDI_GET_INFORMATION
 					  *undi_get_information ) {
 	struct device *dev = pxe_netdev->dev;
 	struct ll_protocol *ll_protocol = pxe_netdev->ll_protocol;
+	size_t ll_addr_len = ll_protocol->ll_addr_len;
 
 	DBG ( "PXENV_UNDI_GET_INFORMATION" );
 
@@ -361,17 +421,14 @@ PXENV_EXIT_t pxenv_undi_get_information ( struct s_PXENV_UNDI_GET_INFORMATION
 	/* Cheat: assume all cards can cope with this */
 	undi_get_information->MaxTranUnit = ETH_MAX_MTU;
 	undi_get_information->HwType = ntohs ( ll_protocol->ll_proto );
-	undi_get_information->HwAddrLen = ll_protocol->ll_addr_len;
-	/* Cheat: assume card is always configured with its permanent
-	 * node address.  This is a valid assumption within Etherboot
-	 * at the time of writing.
-	 */
+	undi_get_information->HwAddrLen = ll_addr_len;
+	assert ( ll_addr_len <=
+		 sizeof ( undi_get_information->CurrentNodeAddress ) );
 	memcpy ( &undi_get_information->CurrentNodeAddress,
 		 pxe_netdev->ll_addr,
 		 sizeof ( undi_get_information->CurrentNodeAddress ) );
-	memcpy ( &undi_get_information->PermNodeAddress,
-		 pxe_netdev->ll_addr,
-		 sizeof ( undi_get_information->PermNodeAddress ) );
+	ll_protocol->init_addr ( pxe_netdev->hw_addr,
+				 &undi_get_information->PermNodeAddress );
 	undi_get_information->ROMAddress = 0;
 		/* nic.rom_info->rom_segment; */
 	/* We only provide the ability to receive or transmit a single
@@ -380,6 +437,10 @@ PXENV_EXIT_t pxenv_undi_get_information ( struct s_PXENV_UNDI_GET_INFORMATION
 	undi_get_information->RxBufCt = 1;
 	undi_get_information->TxBufCt = 1;
 
+	DBG ( " io %04x irq %d mtu %d %s %s\n",
+	      undi_get_information->BaseIo, undi_get_information->IntNumber,
+	      undi_get_information->MaxTranUnit, ll_protocol->name,
+	      ll_protocol->ntoa ( &undi_get_information->CurrentNodeAddress ));
 	undi_get_information->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
@@ -397,6 +458,11 @@ PXENV_EXIT_t pxenv_undi_get_statistics ( struct s_PXENV_UNDI_GET_STATISTICS
 	undi_get_statistics->RcvCRCErrors = pxe_netdev->rx_stats.bad;
 	undi_get_statistics->RcvResourceErrors = pxe_netdev->rx_stats.bad;
 
+	DBG ( " txok %d rxok %d rxcrc %d rxrsrc %d\n",
+	      undi_get_statistics->XmtGoodFrames,
+	      undi_get_statistics->RcvGoodFrames,
+	      undi_get_statistics->RcvCRCErrors,
+	      undi_get_statistics->RcvResourceErrors );
 	undi_get_statistics->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
@@ -407,7 +473,7 @@ PXENV_EXIT_t pxenv_undi_get_statistics ( struct s_PXENV_UNDI_GET_STATISTICS
  */
 PXENV_EXIT_t pxenv_undi_clear_statistics ( struct s_PXENV_UNDI_CLEAR_STATISTICS
 					   *undi_clear_statistics ) {
-	DBG ( "PXENV_UNDI_CLEAR_STATISTICS" );
+	DBG ( "PXENV_UNDI_CLEAR_STATISTICS\n" );
 
 	memset ( &pxe_netdev->tx_stats, 0, sizeof ( pxe_netdev->tx_stats ) );
 	memset ( &pxe_netdev->rx_stats, 0, sizeof ( pxe_netdev->rx_stats ) );
@@ -423,7 +489,7 @@ PXENV_EXIT_t pxenv_undi_clear_statistics ( struct s_PXENV_UNDI_CLEAR_STATISTICS
  */
 PXENV_EXIT_t pxenv_undi_initiate_diags ( struct s_PXENV_UNDI_INITIATE_DIAGS
 					 *undi_initiate_diags ) {
-	DBG ( "PXENV_UNDI_INITIATE_DIAGS" );
+	DBG ( "PXENV_UNDI_INITIATE_DIAGS failed: unsupported\n" );
 
 	undi_initiate_diags->Status = PXENV_STATUS_UNSUPPORTED;
 	return PXENV_EXIT_FAILURE;
@@ -436,7 +502,7 @@ PXENV_EXIT_t pxenv_undi_initiate_diags ( struct s_PXENV_UNDI_INITIATE_DIAGS
  */
 PXENV_EXIT_t pxenv_undi_force_interrupt ( struct s_PXENV_UNDI_FORCE_INTERRUPT
 					  *undi_force_interrupt ) {
-	DBG ( "PXENV_UNDI_FORCE_INTERRUPT" );
+	DBG ( "PXENV_UNDI_FORCE_INTERRUPT failed: unsupported\n" );
 
 	undi_force_interrupt->Status = PXENV_STATUS_UNSUPPORTED;
 	return PXENV_EXIT_FAILURE;
@@ -444,15 +510,28 @@ PXENV_EXIT_t pxenv_undi_force_interrupt ( struct s_PXENV_UNDI_FORCE_INTERRUPT
 
 /* PXENV_UNDI_GET_MCAST_ADDRESS
  *
- * Status: stub (no PXE multicast support)
+ * Status: working
  */
 PXENV_EXIT_t
 pxenv_undi_get_mcast_address ( struct s_PXENV_UNDI_GET_MCAST_ADDRESS
 			       *undi_get_mcast_address ) {
-	DBG ( "PXENV_UNDI_GET_MCAST_ADDRESS" );
+	struct ll_protocol *ll_protocol = pxe_netdev->ll_protocol;
+	struct in_addr ip = { .s_addr = undi_get_mcast_address->InetAddr };
+	int rc;
 
-	undi_get_mcast_address->Status = PXENV_STATUS_UNSUPPORTED;
-	return PXENV_EXIT_FAILURE;
+	DBG ( "PXENV_UNDI_GET_MCAST_ADDRESS %s", inet_ntoa ( ip ) );
+
+	if ( ( rc = ll_protocol->mc_hash ( AF_INET, &ip,
+				      undi_get_mcast_address->MediaAddr ))!=0){
+		DBG ( " failed: %s\n", strerror ( rc ) );
+		undi_get_mcast_address->Status = PXENV_STATUS ( rc );
+		return PXENV_EXIT_FAILURE;
+	}
+	DBG ( "=>%s\n",
+	      ll_protocol->ntoa ( undi_get_mcast_address->MediaAddr ) );
+
+	undi_get_mcast_address->Status = PXENV_STATUS_SUCCESS;
+	return PXENV_EXIT_SUCCESS;
 }
 
 /* PXENV_UNDI_GET_NIC_TYPE
@@ -484,6 +563,13 @@ PXENV_EXIT_t pxenv_undi_get_nic_type ( struct s_PXENV_UNDI_GET_NIC_TYPE
 		 */
 		undi_get_nic_type->info.pci.SubVendor_ID = 0xffff;
 		undi_get_nic_type->info.pci.SubDevice_ID = 0xffff;
+		DBG ( " PCI %02x:%02x.%x %04x:%04x (%04x:%04x) %02x%02x%02x "
+		      "rev %02x\n", PCI_BUS ( info->BusDevFunc ),
+		      PCI_SLOT ( info->BusDevFunc ),
+		      PCI_FUNC ( info->BusDevFunc ), info->Vendor_ID,
+		      info->Dev_ID, info->SubVendor_ID, info->SubDevice_ID,
+		      info->Base_Class, info->Sub_Class, info->Prog_Intf,
+		      info->Rev );
 		break; }
 	case BUS_TYPE_ISAPNP: {
 		struct pnp_nic_info *info = &undi_get_nic_type->info.pnp;
@@ -495,8 +581,12 @@ PXENV_EXIT_t pxenv_undi_get_nic_type ( struct s_PXENV_UNDI_GET_NIC_TYPE
 		/* Cheat: remaining fields are probably unnecessary,
 		 * and would require adding extra code to isapnp.c.
 		 */
+		DBG ( " ISAPnP CSN %04x %08x %02x%02x%02x\n",
+		      info->CardSelNum, info->EISA_Dev_ID,
+		      info->Base_Class, info->Sub_Class, info->Prog_Intf );
 		break; }
 	default:
+		DBG ( " failed: unknown bus type\n" );
 		undi_get_nic_type->Status = PXENV_STATUS_FAILURE;
 		return PXENV_EXIT_FAILURE;
 	}
@@ -517,12 +607,18 @@ PXENV_EXIT_t pxenv_undi_get_iface_info ( struct s_PXENV_UNDI_GET_IFACE_INFO
 	 * Most PXE stacks seem to take this approach.
 	 */
 	snprintf ( ( char * ) undi_get_iface_info->IfaceType,
-		   sizeof ( undi_get_iface_info->IfaceType ), "gPXE" );
+		   sizeof ( undi_get_iface_info->IfaceType ), "DIX+802.3" );
 	undi_get_iface_info->LinkSpeed = 10000000; /* 10 Mbps */
-	undi_get_iface_info->ServiceFlags = 0;
+	undi_get_iface_info->ServiceFlags =
+		( SUPPORTED_BROADCAST | SUPPORTED_MULTICAST |
+		  SUPPORTED_SET_STATION_ADDRESS | SUPPORTED_RESET |
+		  SUPPORTED_OPEN_CLOSE | SUPPORTED_IRQ );
 	memset ( undi_get_iface_info->Reserved, 0,
 		 sizeof(undi_get_iface_info->Reserved) );
 
+	DBG ( " %s %dbps flags %08x\n", undi_get_iface_info->IfaceType,
+	      undi_get_iface_info->LinkSpeed,
+	      undi_get_iface_info->ServiceFlags );
 	undi_get_iface_info->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
@@ -533,7 +629,7 @@ PXENV_EXIT_t pxenv_undi_get_iface_info ( struct s_PXENV_UNDI_GET_IFACE_INFO
  */
 PXENV_EXIT_t pxenv_undi_get_state ( struct s_PXENV_UNDI_GET_STATE
 				    *undi_get_state ) {
-	DBG ( "PXENV_UNDI_GET_STATE" );
+	DBG ( "PXENV_UNDI_GET_STATE failed: unsupported\n" );
 
 	undi_get_state->Status = PXENV_STATUS_UNSUPPORTED;
 	return PXENV_EXIT_FAILURE;
@@ -555,7 +651,10 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 	unsigned int prottype;
 	int rc;
 
-	DBG ( "PXENV_UNDI_ISR" );
+	/* Use coloured debug, since UNDI ISR messages are likely to
+	 * be interspersed amongst other UNDI messages.
+	 */
+	DBGC2 ( &pxenv_undi_isr, "PXENV_UNDI_ISR" );
 
 	/* Just in case some idiot actually looks at these fields when
 	 * we weren't meant to fill them in...
@@ -568,7 +667,7 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 
 	switch ( undi_isr->FuncFlag ) {
 	case PXENV_UNDI_ISR_IN_START :
-		DBG ( " START" );
+		DBGC2 ( &pxenv_undi_isr, " START" );
 
 		/* Call poll().  This should acknowledge the device
 		 * interrupt and queue up any received packet.
@@ -579,13 +678,14 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 		netdev_irq ( pxe_netdev, 0 );
 
 		/* Always say it was ours for the sake of simplicity */
+		DBGC2 ( &pxenv_undi_isr, " OURS" );
 		undi_isr->FuncFlag = PXENV_UNDI_ISR_OUT_OURS;
 		break;
 	case PXENV_UNDI_ISR_IN_PROCESS :
-		DBG ( " PROCESS" );
-		/* Fall through */
 	case PXENV_UNDI_ISR_IN_GET_NEXT :
-		DBG ( " GET_NEXT" );
+		DBGC2 ( &pxenv_undi_isr, " %s",
+			( ( undi_isr->FuncFlag == PXENV_UNDI_ISR_IN_PROCESS ) ?
+			  "PROCESS" : "GET_NEXT" ) );
 
 		/* Some dumb NBPs (e.g. emBoot's winBoot/i) never call
 		 * PXENV_UNDI_ISR with FuncFlag=PXENV_UNDI_ISR_START;
@@ -600,7 +700,7 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 		 * netdev TX queue is empty, report the TX completion.
 		 */
 		if ( undi_tx_count && list_empty ( &pxe_netdev->tx_queue ) ) {
-			DBG ( " TXC" );
+			DBGC2 ( &pxenv_undi_isr, " TXC" );
 			undi_tx_count--;
 			undi_isr->FuncFlag = PXENV_UNDI_ISR_OUT_TRANSMIT;
 			break;
@@ -609,7 +709,7 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 		/* Remove first packet from netdev RX queue */
 		iobuf = netdev_rx_dequeue ( pxe_netdev );
 		if ( ! iobuf ) {
-			DBG ( " DONE" );
+			DBGC2 ( &pxenv_undi_isr, " DONE" );
 			/* No more packets remaining */
 			undi_isr->FuncFlag = PXENV_UNDI_ISR_OUT_DONE;
 			/* Re-enable interrupts */
@@ -619,17 +719,18 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 
 		/* Copy packet to base memory buffer */
 		len = iob_len ( iobuf );
-		DBG ( " RX %zd", len );
+		DBGC2 ( &pxenv_undi_isr, " RX" );
 		if ( len > sizeof ( basemem_packet ) ) {
 			/* Should never happen */
+			DBGC2 ( &pxenv_undi_isr, " overlength (%zx)", len );
 			len = sizeof ( basemem_packet );
 		}
 		memcpy ( basemem_packet, iobuf->data, len );
 
 		/* Strip link-layer header */
 		ll_protocol = pxe_netdev->ll_protocol;
-		if ( ( rc = ll_protocol->pull ( iobuf, &ll_dest, &ll_source,
-						&net_proto ) ) != 0 ) {
+		if ( ( rc = ll_protocol->pull ( pxe_netdev, iobuf, &ll_dest,
+						&ll_source, &net_proto )) !=0){
 			/* Assume unknown net_proto and no ll_source */
 			net_proto = 0;
 			ll_source = NULL;
@@ -655,7 +756,6 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 			prottype = P_UNKNOWN;
 			break;
 		}
-		DBG ( " %s", ( net_protocol ? net_protocol->name : "RAW" ) );
 
 		/* Fill in UNDI_ISR structure */
 		undi_isr->FuncFlag = PXENV_UNDI_ISR_OUT_RECEIVE;
@@ -666,12 +766,18 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 		undi_isr->Frame.offset = __from_data16 ( basemem_packet );
 		undi_isr->ProtType = prottype;
 		undi_isr->PktType = XMT_DESTADDR;
+		DBGC2 ( &pxenv_undi_isr, " %04x:%04x+%x(%x) %s hlen %d",
+			undi_isr->Frame.segment, undi_isr->Frame.offset,
+			undi_isr->BufferLength, undi_isr->FrameLength,
+			( net_protocol ? net_protocol->name : "RAW" ),
+			undi_isr->FrameHeaderLength );
 
 		/* Free packet */
 		free_iob ( iobuf );
 		break;
 	default :
-		DBG ( " INVALID(%04x)", undi_isr->FuncFlag );
+		DBGC2 ( &pxenv_undi_isr, " INVALID(%04x)\n",
+			undi_isr->FuncFlag );
 
 		/* Should never happen */
 		undi_isr->FuncFlag = PXENV_UNDI_ISR_OUT_DONE;
@@ -679,6 +785,7 @@ PXENV_EXIT_t pxenv_undi_isr ( struct s_PXENV_UNDI_ISR *undi_isr ) {
 		return PXENV_EXIT_FAILURE;
 	}
 
+	DBGC2 ( &pxenv_undi_isr, "\n" );
 	undi_isr->Status = PXENV_STATUS_SUCCESS;
 	return PXENV_EXIT_SUCCESS;
 }
diff --git a/gpxe/src/arch/i386/interface/pxeparent/pxeparent.c b/gpxe/src/arch/i386/interface/pxeparent/pxeparent.c
new file mode 100644
index 00000000..582db5d2
--- /dev/null
+++ b/gpxe/src/arch/i386/interface/pxeparent/pxeparent.c
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2007 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <gpxe/dhcp.h>
+#include <pxeparent.h>
+#include <pxe_api.h>
+#include <pxe_types.h>
+#include <pxe.h>
+
+/** @file
+ *
+ * Call interface to parent PXE stack
+ *
+ */
+
+/**
+ * Name PXE API call
+ *
+ * @v function		API call number
+ * @ret name		API call name
+ */
+static inline __attribute__ (( always_inline )) const char *
+pxeparent_function_name ( unsigned int function ) {
+	switch ( function ) {
+	case PXENV_START_UNDI:
+		return "PXENV_START_UNDI";
+	case PXENV_STOP_UNDI:
+		return "PXENV_STOP_UNDI";
+	case PXENV_UNDI_STARTUP:
+		return "PXENV_UNDI_STARTUP";
+	case PXENV_UNDI_CLEANUP:
+		return "PXENV_UNDI_CLEANUP";
+	case PXENV_UNDI_INITIALIZE:
+		return "PXENV_UNDI_INITIALIZE";
+	case PXENV_UNDI_RESET_ADAPTER:
+		return "PXENV_UNDI_RESET_ADAPTER";
+	case PXENV_UNDI_SHUTDOWN:
+		return "PXENV_UNDI_SHUTDOWN";
+	case PXENV_UNDI_OPEN:
+		return "PXENV_UNDI_OPEN";
+	case PXENV_UNDI_CLOSE:
+		return "PXENV_UNDI_CLOSE";
+	case PXENV_UNDI_TRANSMIT:
+		return "PXENV_UNDI_TRANSMIT";
+	case PXENV_UNDI_SET_MCAST_ADDRESS:
+		return "PXENV_UNDI_SET_MCAST_ADDRESS";
+	case PXENV_UNDI_SET_STATION_ADDRESS:
+		return "PXENV_UNDI_SET_STATION_ADDRESS";
+	case PXENV_UNDI_SET_PACKET_FILTER:
+		return "PXENV_UNDI_SET_PACKET_FILTER";
+	case PXENV_UNDI_GET_INFORMATION:
+		return "PXENV_UNDI_GET_INFORMATION";
+	case PXENV_UNDI_GET_STATISTICS:
+		return "PXENV_UNDI_GET_STATISTICS";
+	case PXENV_UNDI_CLEAR_STATISTICS:
+		return "PXENV_UNDI_CLEAR_STATISTICS";
+	case PXENV_UNDI_INITIATE_DIAGS:
+		return "PXENV_UNDI_INITIATE_DIAGS";
+	case PXENV_UNDI_FORCE_INTERRUPT:
+		return "PXENV_UNDI_FORCE_INTERRUPT";
+	case PXENV_UNDI_GET_MCAST_ADDRESS:
+		return "PXENV_UNDI_GET_MCAST_ADDRESS";
+	case PXENV_UNDI_GET_NIC_TYPE:
+		return "PXENV_UNDI_GET_NIC_TYPE";
+	case PXENV_UNDI_GET_IFACE_INFO:
+		return "PXENV_UNDI_GET_IFACE_INFO";
+	/*
+	 * Duplicate case value; this is a bug in the PXE specification.
+	 *
+	 *	case PXENV_UNDI_GET_STATE:
+	 *		return "PXENV_UNDI_GET_STATE";
+	 */
+	case PXENV_UNDI_ISR:
+		return "PXENV_UNDI_ISR";
+	case PXENV_GET_CACHED_INFO:
+		return "PXENV_GET_CACHED_INFO";
+	default:
+		return "UNKNOWN API CALL";
+	}
+}
+
+/**
+ * PXE parent parameter block
+ *
+ * Used as the paramter block for all parent PXE API calls.  Resides in base
+ * memory.
+ */
+static union u_PXENV_ANY __bss16 ( pxeparent_params );
+#define pxeparent_params __use_data16 ( pxeparent_params )
+
+/** PXE parent entry point
+ *
+ * Used as the indirection vector for all parent PXE API calls.  Resides in
+ * base memory.
+ */
+SEGOFF16_t __bss16 ( pxeparent_entry_point );
+#define pxeparent_entry_point __use_data16 ( pxeparent_entry_point )
+
+/**
+ * Issue parent PXE API call
+ *
+ * @v entry		Parent PXE stack entry point
+ * @v function		API call number
+ * @v params		PXE parameter block
+ * @v params_len	Length of PXE parameter block
+ * @ret rc		Return status code
+ */
+int pxeparent_call ( SEGOFF16_t entry, unsigned int function,
+		     void *params, size_t params_len ) {
+	PXENV_EXIT_t exit;
+	int discard_b, discard_D;
+	int rc;
+
+	/* Copy parameter block and entry point */
+	assert ( params_len <= sizeof ( pxeparent_params ) );
+	memcpy ( &pxeparent_params, params, params_len );
+	memcpy ( &pxeparent_entry_point, &entry, sizeof ( entry ) );
+
+	/* Call real-mode entry point.  This calling convention will
+	 * work with both the !PXE and the PXENV+ entry points.
+	 */
+	__asm__ __volatile__ ( REAL_CODE ( "pushw %%es\n\t"
+					   "pushw %%di\n\t"
+					   "pushw %%bx\n\t"
+					   "lcall *pxeparent_entry_point\n\t"
+					   "addw $6, %%sp\n\t" )
+			       : "=a" ( exit ), "=b" ( discard_b ),
+			         "=D" ( discard_D )
+			       : "b" ( function ),
+			         "D" ( __from_data16 ( &pxeparent_params ) )
+			       : "ecx", "edx", "esi", "ebp" );
+
+	/* PXE API calls may rudely change the status of A20 and not
+	 * bother to restore it afterwards.  Intel is known to be
+	 * guilty of this.
+	 *
+	 * Note that we will return to this point even if A20 gets
+	 * screwed up by the parent PXE stack, because Etherboot always
+	 * resides in an even megabyte of RAM.
+	 */
+	gateA20_set();
+
+	/* Determine return status code based on PXENV_EXIT and
+	 * PXENV_STATUS
+	 */
+	if ( exit == PXENV_EXIT_SUCCESS ) {
+		rc = 0;
+	} else {
+		rc = -pxeparent_params.Status;
+		/* Paranoia; don't return success for the combination
+		 * of PXENV_EXIT_FAILURE but PXENV_STATUS_SUCCESS
+		 */
+		if ( rc == 0 )
+			rc = -EIO;
+	}
+
+	/* If anything goes wrong, print as much debug information as
+	 * it's possible to give.
+	 */
+	if ( rc != 0 ) {
+		SEGOFF16_t rm_params = {
+			.segment = rm_ds,
+			.offset = __from_data16 ( &pxeparent_params ),
+		};
+
+		DBG ( "PXEPARENT %s failed: %s\n",
+		       pxeparent_function_name ( function ), strerror ( rc ) );
+		DBG ( "PXEPARENT parameters at %04x:%04x length "
+		       "%#02zx, entry point at %04x:%04x\n",
+		       rm_params.segment, rm_params.offset, params_len,
+		       pxeparent_entry_point.segment,
+		       pxeparent_entry_point.offset );
+		DBG ( "PXEPARENT parameters provided:\n" );
+		DBG_HDA ( rm_params, params, params_len );
+		DBG ( "PXEPARENT parameters returned:\n" );
+		DBG_HDA ( rm_params, &pxeparent_params, params_len );
+	}
+
+	/* Copy parameter block back */
+	memcpy ( params, &pxeparent_params, params_len );
+
+	return rc;
+}
+
diff --git a/gpxe/src/arch/i386/interface/pxeparent/pxeparent_dhcp.c b/gpxe/src/arch/i386/interface/pxeparent/pxeparent_dhcp.c
new file mode 100644
index 00000000..66059437
--- /dev/null
+++ b/gpxe/src/arch/i386/interface/pxeparent/pxeparent_dhcp.c
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Joshua Oreman <oremanj@rwcr.net>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <string.h>
+#include <gpxe/dhcp.h>
+#include <gpxe/netdevice.h>
+#include <undipreload.h>
+#include <pxeparent.h>
+#include <realmode.h>
+#include <pxe_api.h>
+
+/**
+ * Present cached DHCP packet if it exists
+ */
+void __weak_impl ( get_cached_dhcpack ) ( void ) {
+	struct undi_device *undi;
+	struct s_PXENV_GET_CACHED_INFO get_cached_info;
+	int rc;
+
+	/* Use preloaded UNDI device to get at PXE entry point */
+	undi = &preloaded_undi;
+	if ( ! undi->entry.segment ) {
+		DBG ( "PXEDHCP no preloaded UNDI device found\n" );
+		return;
+	}
+
+	/* Check that stack is available to get cached info */
+	if ( ! ( undi->flags & UNDI_FL_KEEP_ALL ) ) {
+		DBG ( "PXEDHCP stack was unloaded, no cache available\n" );
+		return;
+	}
+
+	/* Obtain cached DHCP packet */
+	memset ( &get_cached_info, 0, sizeof ( get_cached_info ) );
+	get_cached_info.PacketType = PXENV_PACKET_TYPE_DHCP_ACK;
+
+	if ( ( rc = pxeparent_call ( undi->entry, PXENV_GET_CACHED_INFO,
+				     &get_cached_info,
+				     sizeof ( get_cached_info ) ) ) != 0 ) {
+		DBG ( "PXEDHCP GET_CACHED_INFO failed: %s\n", strerror ( rc ) );
+		return;
+	}
+
+	DBG ( "PXEDHCP got cached info at %04x:%04x length %d\n",
+	      get_cached_info.Buffer.segment, get_cached_info.Buffer.offset,
+	      get_cached_info.BufferSize );
+
+	/* Present cached DHCP packet */
+	store_cached_dhcpack ( real_to_user ( get_cached_info.Buffer.segment,
+					      get_cached_info.Buffer.offset ),
+			       get_cached_info.BufferSize );
+}
diff --git a/gpxe/src/arch/i386/interface/syslinux/com32_call.c b/gpxe/src/arch/i386/interface/syslinux/com32_call.c
index 4a782dce..d2c3f918 100644
--- a/gpxe/src/arch/i386/interface/syslinux/com32_call.c
+++ b/gpxe/src/arch/i386/interface/syslinux/com32_call.c
@@ -21,6 +21,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <realmode.h>
 #include <comboot.h>
diff --git a/gpxe/src/arch/i386/interface/syslinux/com32_wrapper.S b/gpxe/src/arch/i386/interface/syslinux/com32_wrapper.S
index 08d7398a..5c5bd139 100644
--- a/gpxe/src/arch/i386/interface/syslinux/com32_wrapper.S
+++ b/gpxe/src/arch/i386/interface/syslinux/com32_wrapper.S
@@ -16,6 +16,8 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.text
 	.arch i386
 	.code32
diff --git a/gpxe/src/arch/i386/interface/syslinux/comboot_call.c b/gpxe/src/arch/i386/interface/syslinux/comboot_call.c
index bf6c4c66..0a17bf13 100644
--- a/gpxe/src/arch/i386/interface/syslinux/comboot_call.c
+++ b/gpxe/src/arch/i386/interface/syslinux/comboot_call.c
@@ -21,6 +21,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <errno.h>
 #include <realmode.h>
 #include <biosint.h>
@@ -37,6 +39,8 @@
 #include <gpxe/init.h>
 #include <gpxe/image.h>
 #include <usr/imgmgmt.h>
+#include "config/console.h"
+#include "config/serial.h"
 
 /** The "SYSLINUX" version string */
 static char __data16_array ( syslinux_version, [] ) = "gPXE " VERSION;
@@ -324,7 +328,7 @@ static __asmcall void int22 ( struct i386_all_regs *ix86 ) {
 	case 0x0001: /* Get Version */
 
 		/* Number of INT 22h API functions available */
-		ix86->regs.ax = 0x001B;
+		ix86->regs.ax = 0x001D;
 
 		/* SYSLINUX version number */
 		ix86->regs.ch = 0; /* major */
@@ -441,8 +445,10 @@ static __asmcall void int22 ( struct i386_all_regs *ix86 ) {
 		break;
 
 	case 0x0009: /* Call PXE Stack */
-		pxe_api_call ( ix86 );
-		ix86->flags &= ~CF;
+		if ( pxe_api_call_weak ( ix86 ) != 0 )
+			ix86->flags |= CF;
+		else
+			ix86->flags &= ~CF;
 		break;
 
 	case 0x000A: /* Get Derivative-Specific Information */
@@ -454,8 +460,14 @@ static __asmcall void int22 ( struct i386_all_regs *ix86 ) {
 		break;
 
 	case 0x000B: /* Get Serial Console Configuration */
-		/* FIXME: stub */
+#if defined(CONSOLE_SERIAL) && !defined(COMPRESERVE)
+		ix86->regs.dx = COMCONSOLE;
+		ix86->regs.cx = 115200 / COMSPEED;
+		ix86->regs.bx = 0;
+#else
 		ix86->regs.dx = 0;
+#endif
+
 		ix86->flags &= ~CF;
 		break;
 
@@ -629,6 +641,17 @@ static __asmcall void int22 ( struct i386_all_regs *ix86 ) {
 
 		break;
 
+	case 0x001C: /* Get pointer to auxilliary data vector */
+		/* FIXME: stub */
+		ix86->regs.cx = 0; /* Size of the ADV */
+		ix86->flags &= ~CF;
+		break;
+
+	case 0x001D: /* Write auxilliary data vector */
+		/* FIXME: stub */
+		ix86->flags &= ~CF;
+		break;
+
 	default:
 		DBG ( "COMBOOT unknown int22 function %04x\n", ix86->regs.ax );
 		break;
diff --git a/gpxe/src/arch/i386/interface/syslinux/comboot_resolv.c b/gpxe/src/arch/i386/interface/syslinux/comboot_resolv.c
index 41c3af7a..30ac502e 100644
--- a/gpxe/src/arch/i386/interface/syslinux/comboot_resolv.c
+++ b/gpxe/src/arch/i386/interface/syslinux/comboot_resolv.c
@@ -5,6 +5,8 @@
 #include <gpxe/process.h>
 #include <gpxe/resolv.h>
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 static int comboot_resolv_rc;
 static struct in_addr comboot_resolv_addr;
 
diff --git a/gpxe/src/arch/i386/prefix/bImageprefix.S b/gpxe/src/arch/i386/prefix/bImageprefix.S
deleted file mode 100644
index 30020f73..00000000
--- a/gpxe/src/arch/i386/prefix/bImageprefix.S
+++ /dev/null
@@ -1,611 +0,0 @@
-/*
-	Copyright (C) 2000, Entity Cyber, Inc.
-
-	Authors: Gary Byers (gb@thinguin.org)
-		 Marty Connor (mdc@thinguin.org)
-		 Eric Biederman (ebiederman@lnxi.com)
-
-	This code also derives a lot from arch/i386/boot/setup.S in
-	the linux kernel.
-
-	This software may be used and distributed according to the terms
-	of the GNU Public License (GPL), incorporated herein by reference.
-
-	Description:	
-
-	This is just a little bit of code and data that can get prepended
-	to an Etherboot ROM image in order to allow LILO to load the
-	result as if it were a Linux kernel image.
-
-	A real Linux kernel image consists of a one-sector boot loader
-	(to load the image from a floppy disk), followed a few sectors
-	of setup code, followed by the kernel code itself.  There's
-	a table in the first sector (starting at offset 497) that indicates
-	how many sectors of setup code follow the first sector and which
-	contains some other parameters that aren't interesting in this
-	case.
-
-	When LILO loads the sectors that comprise a kernel image, it doesn't
-	execute the code in the first sector (since that code would try to
-	load the image from a floppy disk.)  The code in the first sector
-	below doesn't expect to get executed (and prints an error message
-	if it ever -is- executed.)  LILO's only interested in knowing the
-	number of setup sectors advertised in the table (at offset 497 in
-	the first sector.)
-
-	Etherboot doesn't require much in the way of setup code.
-	Historically, the Linux kernel required at least 4 sectors of
-	setup code.  Current versions of LILO look at the byte at
-	offset 497 in the first sector to indicate how many sectors
-	of setup code are contained in the image.
-
-	The setup code that is present here does a lot of things
-	exactly the way the linux kernel does them instead of in
-	ways more typical of etherboot.  Generally this is so
-	the code can be strongly compatible with the linux kernel.
-	In addition the general etherboot technique of enabling the a20
-	after we switch into protected mode does not work if etherboot
-	is being loaded at 1MB.
-*/
-
-	.equ	CR0_PE,1
-
-#ifdef	GAS291
-#define DATA32 data32;
-#define ADDR32 addr32;
-#define	LJMPI(x)	ljmp	x
-#else
-#define DATA32 data32
-#define ADDR32 addr32
-/* newer GAS295 require #define	LJMPI(x)	ljmp	*x */
-#define	LJMPI(x)	ljmp	x
-#endif
-
-/* Simple and small GDT entries for booting only */
-#define GDT_ENTRY_BOOT_CS	2
-#define GDT_ENTRY_BOOT_DS	(GDT_ENTRY_BOOT_CS + 1)
-#define __BOOT_CS	(GDT_ENTRY_BOOT_CS * 8)
-#define __BOOT_DS	(GDT_ENTRY_BOOT_DS * 8)
-
-
-#define	SETUPSECS 4		/* Minimal nr of setup-sectors */
-#define PREFIXSIZE ((SETUPSECS+1)*512)
-#define PREFIXPGH (PREFIXSIZE / 16 )
-#define	BOOTSEG  0x07C0		/* original address of boot-sector */
-#define	INITSEG  0x9000		/* we move boot here - out of the way */
-#define	SETUPSEG 0x9020		/* setup starts here */
-#define SYSSEG   0x1000		/* system loaded at 0x10000 (65536). */
-
-#define DELTA_INITSEG  (SETUPSEG - INITSEG) /* 0x0020 */
-	
-/* Signature words to ensure LILO loaded us right */
-#define SIG1	0xAA55
-#define SIG2	0x5A5A
-
-	.text
-	.code16
-	.arch i386
-	.org	0
-	.section ".prefix", "ax", @progbits
-_prefix:
-
-/* 
-	This is a minimal boot sector.	If anyone tries to execute it (e.g., if
-	a .lkrn file is dd'ed to a floppy), print an error message. 
-*/
-
-bootsector: 
-	jmp	$BOOTSEG, $go - _prefix	/* reload cs:ip to match relocation addr */
-go: 
-	movw	$0x2000, %di		/*  0x2000 is arbitrary value >= length
-					    of bootsect + room for stack */
-
-	movw	$BOOTSEG, %ax
-	movw	%ax,%ds
-	movw	%ax,%es
-
-	cli
-	movw	%ax, %ss		/* put stack at BOOTSEG:0x2000. */
-	movw	%di,%sp
-	sti
-
-	movw	$why_end-why, %cx
-	movw	$why - _prefix, %si
-
-	movw	$0x0007, %bx		/* page 0, attribute 7 (normal) */
-	movb	$0x0e, %ah		/* write char, tty mode */
-prloop: 
-	lodsb
-	int	$0x10
-	loop	prloop
-freeze: jmp	freeze
-
-why:	.ascii	"This image cannot be loaded from a floppy disk.\r\n"
-why_end: 
-
-
-	.org	497
-setup_sects: 
-	.byte	SETUPSECS
-root_flags: 
-	.word	0
-syssize: 
-	.word	_verbatim_size_pgh - PREFIXPGH
-swap_dev: 
-	.word	0
-ram_size: 
-	.word	0
-vid_mode: 
-	.word	0
-root_dev: 
-	.word	0
-boot_flag: 
-	.word	0xAA55
-
-/*
-	We're now at the beginning of the second sector of the image -
-	where the setup code goes.
-
-	We don't need to do too much setup for Etherboot.
-
-	This code gets loaded at SETUPSEG:0.  It wants to start
-	executing the Etherboot image that's loaded at SYSSEG:0 and
-	whose entry point is SYSSEG:0.
-*/
-setup_code:
-	jmp	trampoline
-# This is the setup header, and it must start at %cs:2 (old 0x9020:2)
-
-		.ascii	"HdrS"		# header signature
-		.word	0x0203		# header version number (>= 0x0105)
-					# or else old loadlin-1.5 will fail)
-realmode_swtch:	.word	0, 0		# default_switch, SETUPSEG
-start_sys_seg:	.word	SYSSEG		# low load segment (obsolete)
-		.word	kernel_version - setup_code
-					# pointing to kernel version string
-					# above section of header is compatible
-					# with loadlin-1.5 (header v1.5). Don't
-					# change it.
-
-type_of_loader:	.byte	0		# = 0, old one (LILO, Loadlin,
-					#      Bootlin, SYSLX, bootsect...)
-					# See Documentation/i386/boot.txt for
-					# assigned ids
-	
-# flags, unused bits must be zero (RFU) bit within loadflags
-loadflags:
-LOADED_HIGH	= 1			# If set, the kernel is loaded high
-CAN_USE_HEAP	= 0x80			# If set, the loader also has set
-					# heap_end_ptr to tell how much
-					# space behind setup.S can be used for
-					# heap purposes.
-					# Only the loader knows what is free
-		.byte	LOADED_HIGH
-
-setup_move_size: .word  0x8000		# size to move, when setup is not
-					# loaded at 0x90000. We will move setup 
-					# to 0x90000 then just before jumping
-					# into the kernel. However, only the
-					# loader knows how much data behind
-					# us also needs to be loaded.
-
-code32_start:				# here loaders can put a different
-					# start address for 32-bit code.
-		.long	0x100000	# 0x100000 = default for big kernel
-
-ramdisk_image:	.long	0		# address of loaded ramdisk image
-					# Here the loader puts the 32-bit
-					# address where it loaded the image.
-					# This only will be read by the kernel.
-
-ramdisk_size:	.long	0		# its size in bytes
-
-bootsect_kludge:
-		.long	0		# obsolete
-
-heap_end_ptr:	.word	0		# (Header version 0x0201 or later)
-					# space from here (exclusive) down to
-					# end of setup code can be used by setup
-					# for local heap purposes.
-
-pad1:		.word	0
-cmd_line_ptr:	.long 0			# (Header version 0x0202 or later)
-					# If nonzero, a 32-bit pointer
-					# to the kernel command line.
-					# The command line should be
-					# located between the start of
-					# setup and the end of low
-					# memory (0xa0000), or it may
-					# get overwritten before it
-					# gets read.  If this field is
-					# used, there is no longer
-					# anything magical about the
-					# 0x90000 segment; the setup
-					# can be located anywhere in
-					# low memory 0x10000 or higher.
-
-ramdisk_max:	.long 0			# (Header version 0x0203 or later)
-					# The highest safe address for
-					# the contents of an initrd
-
-trampoline:	call	start_of_setup
-trampoline_end:
-		.space	1024
-# End of setup header #####################################################
-
-start_of_setup:
-# Set %ds = %cs, we know that SETUPSEG = %cs at this point
-	movw	%cs, %ax		# aka SETUPSEG
-	movw	%ax, %ds
-# Check signature at end of setup
-	cmpw	$SIG1, (setup_sig1 - setup_code)
-	jne	bad_sig
-
-	cmpw	$SIG2, (setup_sig2 - setup_code)
-	jne	bad_sig
-
-	jmp	good_sig1
-
-# Routine to print asciiz string at ds:si
-prtstr:
-	lodsb
-	andb	%al, %al
-	jz	fin
-
-	call	prtchr
-	jmp	prtstr
-
-fin:	ret
-
-# Part of above routine, this one just prints ascii al
-prtchr:	pushw	%ax
-	pushw	%cx
-	movw	$7,%bx
-	movw	$0x01, %cx
-	movb	$0x0e, %ah
-	int	$0x10
-	popw	%cx
-	popw	%ax
-	ret
-
-no_sig_mess: .string	"No setup signature found ..."
-
-good_sig1:
-	jmp	good_sig
-
-# We now have to find the rest of the setup code/data
-bad_sig:
-	movw	%cs, %ax			# SETUPSEG
-	subw	$DELTA_INITSEG, %ax		# INITSEG
-	movw	%ax, %ds
-	xorb	%bh, %bh
-	movb	(497), %bl			# get setup sect from bootsect
-	subw	$4, %bx				# LILO loads 4 sectors of setup
-	shlw	$8, %bx				# convert to words (1sect=2^8 words)
-	movw	%bx, %cx
-	shrw	$3, %bx				# convert to segment
-	addw	$SYSSEG, %bx
-	movw	%bx, %cs:(start_sys_seg - setup_code)
-# Move rest of setup code/data to here
-	movw	$2048, %di			# four sectors loaded by LILO
-	subw	%si, %si
-	pushw	%cs
-	popw	%es
-	movw	$SYSSEG, %ax
-	movw	%ax, %ds
-	rep
-	movsw
-	movw	%cs, %ax			# aka SETUPSEG
-	movw	%ax, %ds
-	cmpw	$SIG1, (setup_sig1 - setup_code)
-	jne	no_sig
-
-	cmpw	$SIG2, (setup_sig2 - setup_code)
-	jne	no_sig
-
-	jmp	good_sig
-
-no_sig:
-	lea	(no_sig_mess - setup_code), %si
-	call	prtstr
-
-no_sig_loop:
-	hlt
-	jmp	no_sig_loop
-
-good_sig:
-	cmpw	$0, %cs:(realmode_swtch - setup_code)
-	jz	rmodeswtch_normal
-
-	lcall	*%cs:(realmode_swtch - setup_code)
-	jmp	rmodeswtch_end
-
-rmodeswtch_normal:
-	pushw	%cs
-	call	default_switch
-
-rmodeswtch_end:
-# we get the code32 start address and modify the below 'jmpi'
-# (loader may have changed it)
-	movl	%cs:(code32_start - setup_code), %eax
-	movl	%eax, %cs:(code32 - setup_code)
-
-# then we load the segment descriptors
-	movw	%cs, %ax			# aka SETUPSEG
-	movw	%ax, %ds
-
-#
-# Enable A20.  This is at the very best an annoying procedure.
-# A20 code ported from SYSLINUX 1.52-1.63 by H. Peter Anvin.
-#
-
-A20_TEST_LOOPS		=  32		# Iterations per wait
-A20_ENABLE_LOOPS	= 255		# Total loops to try		
-
-a20_try_loop:
-
-	# First, see if we are on a system with no A20 gate.
-a20_none:
-	call	a20_test
-	jnz	a20_done
-
-	# Next, try the BIOS (INT 0x15, AX=0x2401)
-a20_bios:
-	movw	$0x2401, %ax
-	pushfl					# Be paranoid about flags
-	int	$0x15
-	popfl
-
-	call	a20_test
-	jnz	a20_done
-
-	# Try enabling A20 through the keyboard controller
-a20_kbc:
-	call	empty_8042
-
-	call	a20_test			# Just in case the BIOS worked
-	jnz	a20_done			# but had a delayed reaction.
-
-	movb	$0xD1, %al			# command write
-	outb	%al, $0x64
-	call	empty_8042
-
-	movb	$0xDF, %al			# A20 on
-	outb	%al, $0x60
-	call	empty_8042
-
-	# Wait until a20 really *is* enabled; it can take a fair amount of
-	# time on certain systems; Toshiba Tecras are known to have this
-	# problem.
-a20_kbc_wait:
-	xorw	%cx, %cx
-a20_kbc_wait_loop:
-	call	a20_test
-	jnz	a20_done
-	loop	a20_kbc_wait_loop
-
-	# Final attempt: use "configuration port A"
-a20_fast:
-	inb	$0x92, %al			# Configuration Port A
-	orb	$0x02, %al			# "fast A20" version
-	andb	$0xFE, %al			# don't accidentally reset
-	outb	%al, $0x92
-
-	# Wait for configuration port A to take effect
-a20_fast_wait:
-	xorw	%cx, %cx
-a20_fast_wait_loop:
-	call	a20_test
-	jnz	a20_done
-	loop	a20_fast_wait_loop
-
-	# A20 is still not responding.  Try frobbing it again.
-	# 
-	decb	(a20_tries - setup_code)
-	jnz	a20_try_loop
-	
-	movw	$(a20_err_msg - setup_code), %si
-	call	prtstr
-
-a20_die:
-	hlt
-	jmp	a20_die
-
-a20_tries:
-	.byte	A20_ENABLE_LOOPS
-
-a20_err_msg:
-	.ascii	"linux: fatal error: A20 gate not responding!"
-	.byte	13, 10, 0
-
-	# If we get here, all is good
-a20_done:
-	# Leave the idt alone
-	
-	# set up gdt 
-	xorl	%eax, %eax				# Compute gdt_base
-	movw	%ds, %ax				# (Convert %ds:gdt to a linear ptr)
-	shll	$4, %eax
-	addl	$(bImage_gdt - setup_code), %eax
-	movl	%eax, (bImage_gdt_48+2 - setup_code)
-	DATA32 lgdt %ds:(bImage_gdt_48 - setup_code)	# load gdt with whatever is
-							# appropriate
-
-	# Switch to protected mode
-	movl	%cr0, %eax
-	orb	$CR0_PE, %al
-	movl	%eax, %cr0
-
-	DATA32 ljmp *%ds:(code32 - setup_code)
-code32:
-	.long	0x100000
-	.word	__BOOT_CS, 0
-	
-# Here's a bunch of information about your current kernel..
-kernel_version:	.ascii	"Etherboot "
-		.ascii	VERSION
-		.byte	0
-
-# This is the default real mode switch routine.
-# to be called just before protected mode transition
-default_switch:
-	cli					# no interrupts allowed !
-	movb	$0x80, %al			# disable NMI for bootup
-						# sequence
-	outb	%al, $0x70
-	lret
-
-# This routine tests whether or not A20 is enabled.  If so, it
-# exits with zf = 0.
-#
-# The memory address used, 0x200, is the int $0x80 vector, which
-# should be safe.
-
-A20_TEST_ADDR = 4*0x80
-
-a20_test:
-	pushw	%cx
-	pushw	%ax
-	xorw	%cx, %cx
-	movw	%cx, %fs			# Low memory
-	decw	%cx
-	movw	%cx, %gs			# High memory area
-	movw	$A20_TEST_LOOPS, %cx
-	movw	%fs:(A20_TEST_ADDR), %ax
-	pushw	%ax
-a20_test_wait:
-	incw	%ax
-	movw	%ax, %fs:(A20_TEST_ADDR)
-	call	delay				# Serialize and make delay constant
-	cmpw	%gs:(A20_TEST_ADDR+0x10), %ax
-	loope	a20_test_wait
-
-	popw	%fs:(A20_TEST_ADDR)
-	popw	%ax
-	popw	%cx
-	ret	
-
-
-# This routine checks that the keyboard command queue is empty
-# (after emptying the output buffers)
-#
-# Some machines have delusions that the keyboard buffer is always full
-# with no keyboard attached...
-#
-# If there is no keyboard controller, we will usually get 0xff
-# to all the reads.  With each IO taking a microsecond and
-# a timeout of 100,000 iterations, this can take about half a
-# second ("delay" == outb to port 0x80). That should be ok,
-# and should also be plenty of time for a real keyboard controller
-# to empty.
-#
-
-empty_8042:
-	pushl	%ecx
-	movl	$100000, %ecx
-
-empty_8042_loop:
-	decl	%ecx
-	jz	empty_8042_end_loop
-
-	call	delay
-
-	inb	$0x64, %al			# 8042 status port
-	testb	$1, %al				# output buffer?
-	jz	no_output
-
-	call	delay
-	inb	$0x60, %al			# read it
-	jmp	empty_8042_loop
-
-no_output:
-	testb	$2, %al				# is input buffer full?
-	jnz	empty_8042_loop			# yes - loop
-empty_8042_end_loop:
-	popl	%ecx
-
-		
-# Delay is needed after doing I/O
-delay:
-	outb	%al,$0x80
-	ret
-
-# Descriptor tables
-#
-# NOTE: The intel manual says gdt should be sixteen bytes aligned for
-# efficiency reasons.  However, there are machines which are known not
-# to boot with misaligned GDTs, so alter this at your peril!  If you alter
-# GDT_ENTRY_BOOT_CS (in asm/segment.h) remember to leave at least two
-# empty GDT entries (one for NULL and one reserved).
-#
-# NOTE:	On some CPUs, the GDT must be 8 byte aligned.  This is
-# true for the Voyager Quad CPU card which will not boot without
-# This directive.  16 byte aligment is recommended by intel.
-#
-	.balign 16
-bImage_gdt:
-	.fill GDT_ENTRY_BOOT_CS,8,0
-
-	.word	0xFFFF				# 4Gb - (0x100000*0x1000 = 4Gb)
-	.word	0				# base address = 0
-	.word	0x9A00				# code read/exec
-	.word	0x00CF				# granularity = 4096, 386
-						#  (+5th nibble of limit)
-
-	.word	0xFFFF				# 4Gb - (0x100000*0x1000 = 4Gb)
-	.word	0				# base address = 0
-	.word	0x9200				# data read/write
-	.word	0x00CF				# granularity = 4096, 386
-						#  (+5th nibble of limit)
-bImage_gdt_end:
-	.balign	4
-	
-	.word	0				# alignment byte
-bImage_idt_48:
-	.word	0				# idt limit = 0
-	.long	0				# idt base = 0L
-
-	.word	0				# alignment byte
-bImage_gdt_48:
-	.word	bImage_gdt_end - bImage_gdt - 1	# gdt limit
-	.long	bImage_gdt_48 - setup_code	# gdt base (filled in later)
-
-	.section ".text16", "ax", @progbits
-prefix_exit:
-	int	$0x19		/* should try to boot machine */
-prefix_exit_end:
-	.previous
-	
-	
-	.org (PREFIXSIZE - 4)
-# Setup signature -- must be last
-setup_sig1:	.word	SIG1
-setup_sig2:	.word	SIG2
-	/* Etherboot expects to be contiguous in memory once loaded.
-	 * The linux bImage protocol does not do this, but since we
-	 * don't need any information that's left in the prefix, it
-	 * doesn't matter: we just have to ensure that we make it to _start
-	 *
-	 * protected_start will live at 0x100000 and it will be the
-	 * the first code called as we enter protected mode.
-	 */
-	.code32
-protected_start:
-	/* Load segment registers */
-	movw	$__BOOT_DS, %ax
-	movw	%ax, %ss
-	movw	%ax, %ds
-	movw	%ax, %es
-	movw	%ax, %fs
-	movw	%ax, %gs
-
-	/* Use the internal etherboot stack */
-	movl	$(_prefix_stack_end - protected_start + 0x100000), %esp
-
-	pushl	$0		/* No parameters to preserve for exit path */
-	pushl	$0		/* Use prefix exit path mechanism */
-	
-	jmp	_start
-/*
-	That's about it.
-*/
diff --git a/gpxe/src/arch/i386/prefix/bootpart.S b/gpxe/src/arch/i386/prefix/bootpart.S
index d60fe9bc..968da1a3 100644
--- a/gpxe/src/arch/i386/prefix/bootpart.S
+++ b/gpxe/src/arch/i386/prefix/bootpart.S
@@ -1,3 +1,5 @@
+FILE_LICENCE ( GPL2_OR_LATER )
+
 #define BOOT_SEG	0x07c0
 #define EXEC_SEG	0x0100
 #define STACK_SEG 	0x0200
diff --git a/gpxe/src/arch/i386/prefix/comprefix.S b/gpxe/src/arch/i386/prefix/comprefix.S
deleted file mode 100644
index 2cbbca50..00000000
--- a/gpxe/src/arch/i386/prefix/comprefix.S
+++ /dev/null
@@ -1,46 +0,0 @@
-/* We need a real mode stack that won't be stomped on by Etherboot
-   which starts at 0x20000. Choose something that's sufficiently high,
-   but not in DOC territory. Note that we couldn't do this in a real
-   .com program since stack variables are in the same segment as the
-   code and data, but this isn't really a .com program, it just looks
-   like one to make DOS load it into memory. It still has the 64kB
-   limitation of .com files though. */
-#define STACK_SEG	0x7000
-#define STACK_SIZE	0x4000
-
-	.text
-	.code16
-	.arch i386
-	.section ".prefix", "ax", @progbits
-
-/* Cheat a little with the relocations: .COM files are loaded at 0x100 */
-_prefix:
-	/* Set up temporary stack */ 
-	movw	$STACK_SEG, %ax
-	movw	%ax, %ss
-	movw	$STACK_SIZE, %sp
-
-	pushl	$0	/* No parameters to preserve for exit path */
-	pushw	$0	/* Dummy return address - use prefix_exit */
-
-	/* Calculate segment address of image start */
-	pushw	%cs
-	popw	%ax
-	addw	$(0x100/16), %ax
-	pushw	%ax
-	pushw	$_start
-	/* Calculated lcall to _start with %cs:0000 = image start */
-	lret
-
-	.section ".text16", "ax", @progbits
-prefix_exit:
-	movw	$0x4c00,%ax		/* return to DOS */
-	int	$0x21			/* reach this on Quit */
-prefix_exit_end:
-	.previous
-
-/* The body of etherboot is attached here at build time.
- * Force 16 byte alignment
- */
-	.align 16,0
-_body: 
diff --git a/gpxe/src/arch/i386/prefix/dskprefix.S b/gpxe/src/arch/i386/prefix/dskprefix.S
index 0156812a..60d351f7 100644
--- a/gpxe/src/arch/i386/prefix/dskprefix.S
+++ b/gpxe/src/arch/i386/prefix/dskprefix.S
@@ -16,6 +16,8 @@
  * getting whole tracks at a time whenever possible.
  */
 
+FILE_LICENCE ( GPL2_ONLY )
+
 .equ	BOOTSEG, 0x07C0			/* original address of boot-sector */
 
 .equ	SYSSEG, 0x1000			/* system loaded at SYSSEG<<4 */
@@ -144,9 +146,9 @@ got_sectors:
 	/* Jump to loaded copy */
 	ljmp	$SYSSEG, $start_runtime
 
-endseg:	.word SYSSEG + _filesz_pgh
+endseg:	.word SYSSEG
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
-	.ascii	"SUBW"
+	.ascii	"ADDW"
 	.long	endseg
 	.long	16
 	.long	0
diff --git a/gpxe/src/arch/i386/prefix/elf_dprefix.S b/gpxe/src/arch/i386/prefix/elf_dprefix.S
deleted file mode 100644
index 0eac77e0..00000000
--- a/gpxe/src/arch/i386/prefix/elf_dprefix.S
+++ /dev/null
@@ -1,94 +0,0 @@
-#include "elf.h"
-
-	.arch i386
-	.section ".prefix", "a", @progbits
-
-#define LOAD_ADDR 0x10000
-
-	/* ELF Header */
-	.globl elf_header
-elf_header:	
-e_ident:	.byte	0x7f, 'E', 'L', 'F', 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0
-e_type:		.short	ET_DYN
-e_machine:	.short	EM_386
-e_version:	.long	1
-e_entry:	.long	LOAD_ADDR + _start - elf_header
-e_phoff:	.long	elf_program_header - elf_header
-e_shoff:	.long	0
-e_flags:	.long	0
-e_ehsize:	.short	elf_header_end - elf_header
-e_phentsize:	.short	ELF32_PHDR_SIZE
-e_phnum:	.short	(elf_program_header_end - elf_program_header)/ELF32_PHDR_SIZE
-e_shentsize:	.short	0
-e_shnum:	.short	0
-e_shstrndx:	.short	0
-elf_header_end:
-	
-elf_program_header:
-phdr1_p_type:	.long	PT_NOTE
-phdr1_p_offset:	.long	elf_note - elf_header
-phdr1_p_vaddr:	.long	elf_note
-phdr1_p_paddr:	.long	elf_note
-phdr1_p_filesz:	.long	elf_note_end - elf_note
-phdr1_p_memsz:	.long	elf_note_end - elf_note
-phdr1_p_flags:	.long	PF_R | PF_W | PF_X
-phdr1_p_align:	.long	0
-
-/* The decompressor */
-phdr2_p_type:	.long	PT_LOAD
-phdr2_p_offset:	.long	0
-phdr2_p_vaddr:	.long	elf_header
-phdr2_p_paddr:	.long	LOAD_ADDR
-phdr2_p_filesz:	.long	_verbatim_size
-phdr2_p_memsz:	.long	_image_size
-phdr2_p_flags:	.long	PF_R | PF_W | PF_X
-phdr2_p_align:	.long	16
-
-elf_program_header_end:
-
-	.globl elf_note
-elf_note:
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_NAME
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz "Etherboot"
-4:
-
-
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_VERSION
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz VERSION
-4:
-
-#if 0
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_CHECKSUM
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.word 0
-4:
-#endif
-	.balign 4
-elf_note_end:
-
-	/* Dummy routines to satisfy the build */
-	.section ".text16", "ax", @progbits
-prefix_exit:
-
-prefix_exit_end:
-	.previous
diff --git a/gpxe/src/arch/i386/prefix/elfprefix.S b/gpxe/src/arch/i386/prefix/elfprefix.S
deleted file mode 100644
index d712753a..00000000
--- a/gpxe/src/arch/i386/prefix/elfprefix.S
+++ /dev/null
@@ -1,94 +0,0 @@
-#include "elf.h"
-
-	.arch i386
-	.section ".prefix", "a", @progbits
-
-#define LOAD_ADDR 0x10000
-
-	/* ELF Header */
-	.globl elf_header
-elf_header:	
-e_ident:	.byte	0x7f, 'E', 'L', 'F', 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0
-e_type:		.short	ET_EXEC
-e_machine:	.short	EM_386
-e_version:	.long	1
-e_entry:	.long	LOAD_ADDR + _start - elf_header
-e_phoff:	.long	elf_program_header - elf_header
-e_shoff:	.long	0
-e_flags:	.long	0
-e_ehsize:	.short	elf_header_end - elf_header
-e_phentsize:	.short	ELF32_PHDR_SIZE
-e_phnum:	.short	(elf_program_header_end - elf_program_header)/ELF32_PHDR_SIZE
-e_shentsize:	.short	0
-e_shnum:	.short	0
-e_shstrndx:	.short	0
-elf_header_end:
-	
-elf_program_header:
-phdr1_p_type:	.long	PT_NOTE
-phdr1_p_offset:	.long	elf_note - elf_header
-phdr1_p_vaddr:	.long	elf_note
-phdr1_p_paddr:	.long	elf_note
-phdr1_p_filesz:	.long	elf_note_end - elf_note
-phdr1_p_memsz:	.long	elf_note_end - elf_note
-phdr1_p_flags:	.long	PF_R | PF_W | PF_X
-phdr1_p_align:	.long	0
-
-/* The decompressor */
-phdr2_p_type:	.long	PT_LOAD
-phdr2_p_offset:	.long	0
-phdr2_p_vaddr:	.long	elf_header
-phdr2_p_paddr:	.long	LOAD_ADDR
-phdr2_p_filesz:	.long	_verbatim_size
-phdr2_p_memsz:	.long	_image_size
-phdr2_p_flags:	.long	PF_R | PF_W | PF_X
-phdr2_p_align:	.long	16
-
-elf_program_header_end:
-
-	.globl elf_note
-elf_note:
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_NAME
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz "Etherboot"
-4:
-
-
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_VERSION
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz VERSION
-4:
-
-#if 0
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_CHECKSUM
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.word 0
-4:
-#endif
-	.balign 4
-elf_note_end:
-
-	/* Dummy routines to satisfy the build */
-	.section ".text16", "ax", @progbits
-prefix_exit:
-
-prefix_exit_end:
-	.previous
diff --git a/gpxe/src/arch/i386/prefix/exeprefix.S b/gpxe/src/arch/i386/prefix/exeprefix.S
deleted file mode 100755
index f1b402b7..00000000
--- a/gpxe/src/arch/i386/prefix/exeprefix.S
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
-	Prefix for .exe images
-	Doesn't work yet, even though it starts off the same as a .com
-	image as shown by DOS debug.
-*/
-
-	.text
-	.code16
-	.arch i386
-	.section	".prefix", "ax", @progbits
-
-_prefix:
-	.byte	'M', 'Z'
-	.short	_exe_size_tail			/* tail */
-	.short	_exe_size_pages			/* pages */
-	.short	0				/* relocations */
-	.short	2				/* header paras */
-	.short	_exe_bss_size			/* min */
-	.short	0xFFFF				/* max paras */
-	.short	_exe_ss_offset			/* SS */
-	.short	_stack_size			/* SP */
-	.short	0				/* checksum */
-	.short	0				/* IP */
-	.short	0				/* CS */
-	.short	0x1C				/* reloc offset */
-	.short	0				/* overlay number */
-	.short	0				/* fill */
-	.short	0				/* fill */
-
-	.section ".text16", "ax", @progbits
-prefix_exit:
-	movw	$0x4c00,%ax		/* return to DOS */
-	int	$0x21			/* reach this on Quit */
-prefix_exit_end:
-	.previous
-
-/* The body of etherboot is attached here at build time.
- * Force 16 byte alignment
- */
-	.align 16,0
-_body: 
diff --git a/gpxe/src/arch/i386/prefix/hdprefix.S b/gpxe/src/arch/i386/prefix/hdprefix.S
index 086d7f45..05767567 100644
--- a/gpxe/src/arch/i386/prefix/hdprefix.S
+++ b/gpxe/src/arch/i386/prefix/hdprefix.S
@@ -1,3 +1,5 @@
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.text
 	.arch i386
 	.section ".prefix", "awx", @progbits
@@ -63,10 +65,10 @@ max_sector:
 max_head:
 	.byte	0
 load_length:
-	.long	_filesz_sect
+	.long	0
 	
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
-	.ascii	"SUBL"
+	.ascii	"ADDL"
 	.long	load_length
 	.long	512
 	.long	0
diff --git a/gpxe/src/arch/i386/prefix/hromprefix.S b/gpxe/src/arch/i386/prefix/hromprefix.S
new file mode 100644
index 00000000..03acf1e2
--- /dev/null
+++ b/gpxe/src/arch/i386/prefix/hromprefix.S
@@ -0,0 +1,12 @@
+/*****************************************************************************
+ * ROM prefix that relocates to HIGHMEM_LOADPOINT during POST if PMM allocation
+ * fails. Intended to be used, with caution, on BIOSes that support PCI3.00 but
+ * have limited PMM support, such as most AMI BIOSes.
+ *****************************************************************************
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER )
+
+#define SHRINK_WITHOUT_PMM
+
+#include "romprefix.S"
diff --git a/gpxe/src/arch/i386/prefix/kkpxeprefix.S b/gpxe/src/arch/i386/prefix/kkpxeprefix.S
index e0bea0cd..02cc6fee 100644
--- a/gpxe/src/arch/i386/prefix/kkpxeprefix.S
+++ b/gpxe/src/arch/i386/prefix/kkpxeprefix.S
@@ -3,6 +3,11 @@
  *****************************************************************************
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
+/* Since we have the whole stack, we can use cached DHCP information */
+REQUEST_OBJECT ( pxeparent_dhcp )
+
 #define PXELOADER_KEEP_UNDI
 #define PXELOADER_KEEP_PXE
 #include "pxeprefix.S"
diff --git a/gpxe/src/arch/i386/prefix/kpxeprefix.S b/gpxe/src/arch/i386/prefix/kpxeprefix.S
index d708604b..923faccc 100644
--- a/gpxe/src/arch/i386/prefix/kpxeprefix.S
+++ b/gpxe/src/arch/i386/prefix/kpxeprefix.S
@@ -3,5 +3,7 @@
  *****************************************************************************
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 #define PXELOADER_KEEP_UNDI
 #include "pxeprefix.S"
diff --git a/gpxe/src/arch/i386/prefix/libprefix.S b/gpxe/src/arch/i386/prefix/libprefix.S
index 42189135..9e6ba6f0 100644
--- a/gpxe/src/arch/i386/prefix/libprefix.S
+++ b/gpxe/src/arch/i386/prefix/libprefix.S
@@ -17,6 +17,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 	.arch i386
 
 /**
diff --git a/gpxe/src/arch/i386/prefix/lkrnprefix.S b/gpxe/src/arch/i386/prefix/lkrnprefix.S
index 094263d2..101d0388 100644
--- a/gpxe/src/arch/i386/prefix/lkrnprefix.S
+++ b/gpxe/src/arch/i386/prefix/lkrnprefix.S
@@ -34,6 +34,8 @@
 
 */
 
+FILE_LICENCE ( GPL_ANY )
+
 #define	SETUPSECS 4		/* Minimal nr of setup-sectors */
 #define PREFIXSIZE ((SETUPSECS+1)*512)
 #define PREFIXPGH (PREFIXSIZE / 16 )
@@ -92,10 +94,10 @@ setup_sects:
 root_flags: 
 	.word	0
 syssize: 
-	.long	_filesz_pgh - PREFIXPGH
+	.long	-PREFIXPGH
 
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
-	.ascii	"SUBL"
+	.ascii	"ADDL"
 	.long	syssize
 	.long	16
 	.long	0
diff --git a/gpxe/src/arch/i386/prefix/lmelf_dprefix.S b/gpxe/src/arch/i386/prefix/lmelf_dprefix.S
deleted file mode 100644
index 93534df5..00000000
--- a/gpxe/src/arch/i386/prefix/lmelf_dprefix.S
+++ /dev/null
@@ -1,161 +0,0 @@
-#include "elf.h"
-	.arch sledgehammer
-	.code32
-	.equ	FLAT_CODE_SEG,_pmcs-_gdt
-	.equ	FLAT_DATA_SEG,_pmds-_gdt
-	.equ	MSR_K6_EFER,   0xC0000080
-	.equ	EFER_LME,      0x00000100
-	.equ	X86_CR4_PAE,   0x00000020
-	.equ	CR0_PG,        0x80000000
-
-	.section ".prefix", "ax", @progbits
-
-#define LOAD_ADDR 0x10000
-		
-	/* ELF Header */
-	.globl elf_header
-elf_header:	
-e_ident:	.byte	0x7f, 'E', 'L', 'F', 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0
-e_type:		.short	ET_DYN
-e_machine:	.short	EM_X86_64
-e_version:	.long	1
-e_entry:	.long	LOAD_ADDR + elf_start - elf_header
-e_phoff:	.long	elf_program_header - elf_header
-e_shoff:	.long	0
-e_flags:	.long	0
-e_ehsize:	.short	elf_header_end - elf_header
-e_phentsize:	.short	ELF32_PHDR_SIZE
-e_phnum:	.short	(elf_program_header_end - elf_program_header)/ELF32_PHDR_SIZE
-e_shentsize:	.short	0
-e_shnum:	.short	0
-e_shstrndx:	.short	0
-elf_header_end:
-	
-elf_program_header:
-phdr1_p_type:	.long	PT_NOTE
-phdr1_p_offset:	.long	elf_note - elf_header
-phdr1_p_vaddr:	.long	elf_note
-phdr1_p_paddr:	.long	elf_note
-phdr1_p_filesz:	.long	elf_note_end - elf_note
-phdr1_p_memsz:	.long	elf_note_end - elf_note
-phdr1_p_flags:	.long	PF_R | PF_W | PF_X
-phdr1_p_align:	.long	0
-
-/* The decompressor */
-phdr2_p_type:	.long	PT_LOAD
-phdr2_p_offset:	.long	0
-phdr2_p_vaddr:	.long	elf_header
-phdr2_p_paddr:	.long	LOAD_ADDR
-phdr2_p_filesz:	.long	_verbatim_size
-phdr2_p_memsz:	.long	_image_size
-phdr2_p_flags:	.long	PF_R | PF_W | PF_X
-phdr2_p_align:	.long	16
-
-elf_program_header_end:
-
-	.globl elf_note
-elf_note:
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_NAME
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz "Etherboot"
-4:
-
-
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_VERSION
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz VERSION
-4:
-
-#if 0
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_CHECKSUM
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.word 0
-4:
-#endif
-	.balign 4
-elf_note_end:
-
-elf_start:
-	.code64
-	/* Reload the gdt to something I know */
-	leaq	_gdt(%rip), %rax
-	movq	%rax, 0x02 + gdtptr(%rip)
-	lgdt	gdtptr(%rip)
-
-	/* Enter 32bit compatibility mode */
-	leaq	elf_start32(%rip), %rax
-	movl	%eax, 0x00 + elf_start32_addr(%rip)
-	ljmp	*elf_start32_addr(%rip)
-
-elf_start32:	
-	.code32
-	/* Reload the data segments */
-	movl	$FLAT_DATA_SEG, %eax
-	movl	%eax, %ds
-	movl	%eax, %es
-	movl	%eax, %ss
-	
-	/* Disable paging */
-	movl	%cr0, %eax
-	andl	$~CR0_PG, %eax
-	movl	%eax, %cr0
-
-	/* Disable long mode */
-	movl	$MSR_K6_EFER, %ecx
-	rdmsr
-	andl	$~EFER_LME, %eax
-	wrmsr
-
-	/* Disable PAE */
-	movl	%cr4, %eax
-	andl	$~X86_CR4_PAE, %eax
-	movl	%eax, %cr4
-
-	/* Save the first argument */
-	pushl	%ebx
-	jmp	_start
-
-gdtptr:	
-	.word	_gdt_end - _gdt -1
-	.long	_gdt
-	.long	0
-_gdt:
-elf_start32_addr:
-	.long	elf_start32
-	.long	FLAT_CODE_SEG
-_pmcs:
-	/* 32 bit protected mode code segment, base 0 */
-	.word	0xffff,0
-	.byte	0,0x9f,0xcf,0
-
-_pmds:
-	/* 32 bit protected mode data segment, base 0 */
-	.word	0xffff,0
-	.byte	0,0x93,0xcf,0
-_gdt_end:	
-
-
-	/* Dummy routines to satisfy the build */
-	.section ".text16", "ax", @progbits
-prefix_exit:
-
-prefix_exit_end:
-	.previous
diff --git a/gpxe/src/arch/i386/prefix/lmelf_prefix.S b/gpxe/src/arch/i386/prefix/lmelf_prefix.S
deleted file mode 100644
index 3c1e7251..00000000
--- a/gpxe/src/arch/i386/prefix/lmelf_prefix.S
+++ /dev/null
@@ -1,161 +0,0 @@
-#include "elf.h"
-	.arch sledgehammer
-	.code32
-	.equ	FLAT_CODE_SEG,_pmcs-_gdt
-	.equ	FLAT_DATA_SEG,_pmds-_gdt
-	.equ	MSR_K6_EFER,   0xC0000080
-	.equ	EFER_LME,      0x00000100
-	.equ	X86_CR4_PAE,   0x00000020
-	.equ	CR0_PG,        0x80000000
-
-	.section ".prefix", "ax", @progbits
-
-#define LOAD_ADDR 0x10000
-		
-	/* ELF Header */
-	.globl elf_header
-elf_header:	
-e_ident:	.byte	0x7f, 'E', 'L', 'F', 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0
-e_type:		.short	ET_EXEC
-e_machine:	.short	EM_X86_64
-e_version:	.long	1
-e_entry:	.long	LOAD_ADDR + elf_start - elf_header
-e_phoff:	.long	elf_program_header - elf_header
-e_shoff:	.long	0
-e_flags:	.long	0
-e_ehsize:	.short	elf_header_end - elf_header
-e_phentsize:	.short	ELF32_PHDR_SIZE
-e_phnum:	.short	(elf_program_header_end - elf_program_header)/ELF32_PHDR_SIZE
-e_shentsize:	.short	0
-e_shnum:	.short	0
-e_shstrndx:	.short	0
-elf_header_end:
-	
-elf_program_header:
-phdr1_p_type:	.long	PT_NOTE
-phdr1_p_offset:	.long	elf_note - elf_header
-phdr1_p_vaddr:	.long	elf_note
-phdr1_p_paddr:	.long	elf_note
-phdr1_p_filesz:	.long	elf_note_end - elf_note
-phdr1_p_memsz:	.long	elf_note_end - elf_note
-phdr1_p_flags:	.long	PF_R | PF_W | PF_X
-phdr1_p_align:	.long	0
-
-/* The decompressor */
-phdr2_p_type:	.long	PT_LOAD
-phdr2_p_offset:	.long	0
-phdr2_p_vaddr:	.long	elf_header
-phdr2_p_paddr:	.long	LOAD_ADDR
-phdr2_p_filesz:	.long	_verbatim_size
-phdr2_p_memsz:	.long	_image_size
-phdr2_p_flags:	.long	PF_R | PF_W | PF_X
-phdr2_p_align:	.long	16
-
-elf_program_header_end:
-
-	.globl elf_note
-elf_note:
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_NAME
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz "Etherboot"
-4:
-
-
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_VERSION
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.asciz VERSION
-4:
-
-#if 0
-	.balign 4
-	.int 2f - 1f
-	.int 4f - 3f
-	.int EIN_PROGRAM_CHECKSUM
-1:	.asciz "ELFBoot"
-2:
-	.balign 4
-3:	
-	.word 0
-4:
-#endif
-	.balign 4
-elf_note_end:
-
-elf_start:
-	.code64
-	/* Reload the gdt to something I know */
-	leaq	_gdt(%rip), %rax
-	movq	%rax, 0x02 + gdtptr(%rip)
-	lgdt	gdtptr(%rip)
-
-	/* Enter 32bit compatibility mode */
-	leaq	elf_start32(%rip), %rax
-	movl	%eax, 0x00 + elf_start32_addr(%rip)
-	ljmp	*elf_start32_addr(%rip)
-
-elf_start32:	
-	.code32
-	/* Reload the data segments */
-	movl	$FLAT_DATA_SEG, %eax
-	movl	%eax, %ds
-	movl	%eax, %es
-	movl	%eax, %ss
-	
-	/* Disable paging */
-	movl	%cr0, %eax
-	andl	$~CR0_PG, %eax
-	movl	%eax, %cr0
-
-	/* Disable long mode */
-	movl	$MSR_K6_EFER, %ecx
-	rdmsr
-	andl	$~EFER_LME, %eax
-	wrmsr
-
-	/* Disable PAE */
-	movl	%cr4, %eax
-	andl	$~X86_CR4_PAE, %eax
-	movl	%eax, %cr4
-
-	/* Save the first argument */
-	pushl	%ebx
-	jmp	_start
-
-gdtptr:	
-	.word	_gdt_end - _gdt -1
-	.long	_gdt
-	.long	0
-_gdt:
-elf_start32_addr:
-	.long	elf_start32
-	.long	FLAT_CODE_SEG
-_pmcs:
-	/* 32 bit protected mode code segment, base 0 */
-	.word	0xffff,0
-	.byte	0,0x9f,0xcf,0
-
-_pmds:
-	/* 32 bit protected mode data segment, base 0 */
-	.word	0xffff,0
-	.byte	0,0x93,0xcf,0
-_gdt_end:	
-
-
-	/* Dummy routines to satisfy the build */
-	.section ".text16", "ax", @progbits
-prefix_exit:
-
-prefix_exit_end:
-	.previous
diff --git a/gpxe/src/arch/i386/prefix/nbiprefix.S b/gpxe/src/arch/i386/prefix/nbiprefix.S
index 4fb4acb1..607d80fb 100644
--- a/gpxe/src/arch/i386/prefix/nbiprefix.S
+++ b/gpxe/src/arch/i386/prefix/nbiprefix.S
@@ -30,16 +30,16 @@ segment_header:
 	.byte	0
 	.byte	0x04		/* Last segment */
 	.long	0x00007e00
-imglen:	.long	_filesz - 512
-memlen:	.long	_filesz - 512
+imglen:	.long	-512
+memlen:	.long	-512
 	.size	segment_header, . - segment_header
 
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
-	.ascii	"SUBL"
+	.ascii	"ADDL"
 	.long	imglen
 	.long	1
 	.long	0
-	.ascii	"SUBL"
+	.ascii	"ADDL"
 	.long	memlen
 	.long	1
 	.long	0
diff --git a/gpxe/src/arch/i386/prefix/pxeprefix.S b/gpxe/src/arch/i386/prefix/pxeprefix.S
index b3b7947f..e728c482 100644
--- a/gpxe/src/arch/i386/prefix/pxeprefix.S
+++ b/gpxe/src/arch/i386/prefix/pxeprefix.S
@@ -1,8 +1,13 @@
+FILE_LICENCE ( GPL2_OR_LATER )
+
 #define PXENV_UNDI_SHUTDOWN		0x0005
 #define	PXENV_UNDI_GET_NIC_TYPE		0x0012
+#define PXENV_UNDI_GET_IFACE_INFO	0x0013
 #define	PXENV_STOP_UNDI			0x0015
 #define PXENV_UNLOAD_STACK		0x0070
 
+#define PXE_HACK_EB54			0x0001
+
 	.text
 	.arch i386
 	.org 0
@@ -11,6 +16,8 @@
 #include <undi.h>
 
 #define STACK_MAGIC ( 'L' + ( 'R' << 8 ) + ( 'E' << 16 ) + ( 'T' << 24 ) )
+#define EB_MAGIC_1 ( 'E' + ( 't' << 8 ) + ( 'h' << 16 ) + ( 'e' << 24 ) )
+#define EB_MAGIC_2 ( 'r' + ( 'b' << 8 ) + ( 'o' << 16 ) + ( 'o' << 24 ) )
 
 /*****************************************************************************
  * Entry point:	set operating context, print welcome message
@@ -105,20 +112,13 @@ have_pxenv:
 
 	/* Record entry point and UNDI segments */
 	pushl	%es:0x0a(%bx)		/* Entry point */
-	popl	entry_segoff
 	pushw	%es:0x24(%bx)		/* UNDI code segment */
 	pushw	%es:0x26(%bx)		/* UNDI code size */
-	popl	undi_code_segoff
 	pushw	%es:0x20(%bx)		/* UNDI data segment */
 	pushw	%es:0x22(%bx)		/* UNDI data size */
-	popl	undi_data_segoff
 
 	/* Print "PXENV+ at <address>" */
 	movw	$10f, %si
-	call	print_message
-	call	print_segoff
-	movb	$( ',' ), %al
-	call	print_character
 	jmp	check_have_stack
 	.section ".prefix.data", "aw", @progbits
 10:	.asciz	" PXENV+ at "
@@ -129,19 +129,13 @@ have_ppxe:
 	movw	%es, ppxe_segment
 	
 	pushl	%es:0x10(%bx)		/* Entry point */
-	popl	entry_segoff
 	pushw	%es:0x30(%bx)		/* UNDI code segment */
 	pushw	%es:0x36(%bx)		/* UNDI code size */
-	popl	undi_code_segoff
 	pushw	%es:0x28(%bx)		/* UNDI data segment */
 	pushw	%es:0x2e(%bx)		/* UNDI data size */
-	popl	undi_data_segoff
+
 	/* Print "!PXE at <address>" */
 	movw	$10f, %si
-	call	print_message
-	call	print_segoff
-	movb	$( ',' ), %al
-	call	print_character
 	jmp	check_have_stack
 	.section ".prefix.data", "aw", @progbits
 10:	.asciz	" !PXE at "
@@ -201,6 +195,17 @@ memory_scan_common:
  *****************************************************************************
  */
 check_have_stack:
+	/* Save common values pushed onto the stack */
+	popl	undi_data_segoff
+	popl	undi_code_segoff
+	popl	entry_segoff
+
+	/* Print have !PXE/PXENV+ message; structure pointer in %es:%bx */
+	call	print_message
+	call	print_segoff
+	movb	$( ',' ), %al
+	call	print_character
+
 	/* Check for entry point */
 	movl	entry_segoff, %eax
 	testl	%eax, %eax
@@ -309,8 +314,6 @@ pci_physical_device:
 	movw	$10f, %si
 	call	print_message
 	call	print_pci_busdevfn
-	movb	$0x0a, %al
-	call	print_character
 	jmp	99f
 	.section ".prefix.data", "aw", @progbits
 10:	.asciz	"         UNDI device is PCI "
@@ -321,12 +324,47 @@ no_physical_device:
 	movw	$10f, %si
 	call	print_message
 	.section ".prefix.data", "aw", @progbits
-10:	.asciz	"         Unable to determine UNDI physical device\n"
+10:	.asciz	"         Unable to determine UNDI physical device"
 	.previous
 
 99:
 
 /*****************************************************************************
+ * Determine interface type
+ *****************************************************************************
+ */
+get_iface_type:
+	/* Issue PXENV_UNDI_GET_IFACE_INFO */
+	movw	$PXENV_UNDI_GET_IFACE_INFO, %bx
+	call	pxe_call
+	jnc	1f
+	call	print_pxe_error
+	jmp	99f
+1:	/* Print interface type */
+	movw	$10f, %si
+	call	print_message
+	leaw	( pxe_parameter_structure + 0x02 ), %si
+	call	print_message
+	.section ".prefix.data", "aw", @progbits
+10:	.asciz	", type "
+	.previous
+	/* Check for "Etherboot" interface type */
+	cmpl	$EB_MAGIC_1, ( pxe_parameter_structure + 0x02 )
+	jne	99f
+	cmpl	$EB_MAGIC_2, ( pxe_parameter_structure + 0x06 )
+	jne	99f
+	movw	$10f, %si
+	call	print_message
+	.section ".prefix.data", "aw", @progbits
+10:	.asciz	" (workaround enabled)"
+	.previous
+	/* Flag Etherboot workarounds as required */
+	orw	$PXE_HACK_EB54, pxe_hacks
+
+99:	movb	$0x0a, %al
+	call	print_character
+
+/*****************************************************************************
  * Leave NIC in a safe state
  *****************************************************************************
  */
@@ -339,6 +377,14 @@ shutdown_nic:
 	call	print_pxe_error
 1:
 unload_base_code:
+	/* Etherboot treats PXENV_UNLOAD_STACK as PXENV_STOP_UNDI, so
+	 * we must not issue this call if the underlying stack is
+	 * Etherboot and we were not intending to issue a PXENV_STOP_UNDI.
+	 */
+#ifdef PXELOADER_KEEP_UNDI
+	testw	$PXE_HACK_EB54, pxe_hacks
+	jnz	99f
+#endif /* PXELOADER_KEEP_UNDI */
 	/* Issue PXENV_UNLOAD_STACK */
 	movw	$PXENV_UNLOAD_STACK, %bx
 	call	pxe_call
@@ -551,7 +597,9 @@ pxe_call:
 	testw	%ax, %ax
 	jz	1f
 	stc
-1:	/* Restore registers and return */
+1:	/* Clear direction flag, for the sake of sanity */
+	cld
+	/* Restore registers and return */
 	popw	%es
 	popw	%di
 	ret
@@ -595,7 +643,7 @@ print_pxe_error:
 pxe_esp:		.long 0
 pxe_ss:			.word 0
 
-pxe_parameter_structure: .fill 20
+pxe_parameter_structure: .fill 64
 
 undi_code_segoff:
 undi_code_size:		.word 0
@@ -605,6 +653,8 @@ undi_data_segoff:
 undi_data_size:		.word 0
 undi_data_segment:	.word 0
 
+pxe_hacks:		.word 0
+
 /* The following fields are part of a struct undi_device */
 
 undi_device:
@@ -668,6 +718,13 @@ run_gpxe:
 	lret
 	.section ".text16", "ax", @progbits
 1:
+	/* Update the exit hook */
+	movw	%cs,pxe_exit_hook+2
+	push	%ax
+	mov	$2f,%ax
+	mov	%ax,pxe_exit_hook
+	pop	%ax
+
 	/* Run main program */
 	pushl	$main
 	pushw	%cs
@@ -681,7 +738,10 @@ run_gpxe:
 	movw	%di, %ss
 	movl	%ebp, %esp
 
-	/* Check PXE stack magic */
+	/* Jump to hook if applicable */
+	ljmpw	*pxe_exit_hook
+
+2:	/* Check PXE stack magic */
 	popl	%eax
 	cmpl	$STACK_MAGIC, %eax
 	jne	1f
diff --git a/gpxe/src/arch/i386/prefix/romprefix.S b/gpxe/src/arch/i386/prefix/romprefix.S
index 7d532375..02e54976 100644
--- a/gpxe/src/arch/i386/prefix/romprefix.S
+++ b/gpxe/src/arch/i386/prefix/romprefix.S
@@ -6,6 +6,8 @@
  * table so using a noticeable amount of stack space is a no-no.
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 #include <config/general.h>
 
 #define PNP_SIGNATURE ( '$' + ( 'P' << 8 ) + ( 'n' << 16 ) + ( 'P' << 24 ) )
@@ -23,6 +25,19 @@
  */
 #define ROM_BANNER_TIMEOUT ( 2 * ( 18 * BANNER_TIMEOUT ) / 10 )
 
+/* We can load a ROM in two ways: have the BIOS load all of it (.rom prefix)
+ * or have the BIOS load a stub that loads the rest using PCI (.xrom prefix).
+ * The latter is not as widely supported, but allows the use of large ROMs
+ * on some systems with crowded option ROM space.
+ */
+
+#ifdef LOAD_ROM_FROM_PCI
+#define ROM_SIZE_VALUE	_prefix_filesz_sect /* Amount to load in BIOS */
+#else
+#define ROM_SIZE_VALUE	0		/* Load amount (before compr. fixup) */
+#endif
+
+
 	.text
 	.code16
 	.arch i386
@@ -31,10 +46,12 @@
 	.org	0x00
 romheader:
 	.word	0xAA55			/* BIOS extension signature */
-romheader_size:	.byte _filesz_sect	/* Size in 512-byte blocks */
+romheader_size:	.byte ROM_SIZE_VALUE	/* Size in 512-byte blocks */
 	jmp	init			/* Initialisation vector */
 checksum:
-	.byte	0
+	.byte	0, 0
+real_size:
+	.word	0
 	.org	0x16
 	.word	undiheader
 	.org	0x18
@@ -42,12 +59,18 @@ checksum:
 	.org	0x1a
 	.word	pnpheader
 	.size romheader, . - romheader
-	
+
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
-	.ascii	"SUBB"
+#ifndef LOAD_ROM_FROM_PCI
+	.ascii	"ADDB"
 	.long	romheader_size
 	.long	512
 	.long	0
+#endif
+	.ascii	"ADDB"
+	.long	real_size
+	.long	512
+	.long	0
 	.previous
 
 pciheader:
@@ -59,27 +82,29 @@ pciheader:
 	.byte	0x03			/* PCI data structure revision */
 	.byte	0x02, 0x00, 0x00	/* Class code */
 pciheader_image_length:
-	.word	_filesz_sect		/* Image length */
+	.word	ROM_SIZE_VALUE		/* Image length */
 	.word	0x0001			/* Revision level */
 	.byte	0x00			/* Code type */
 	.byte	0x80			/* Last image indicator */
 pciheader_runtime_length:
-	.word	_filesz_sect		/* Maximum run-time image length */
+	.word	ROM_SIZE_VALUE		/* Maximum run-time image length */
 	.word	0x0000			/* Configuration utility code header */
 	.word	0x0000			/* DMTF CLP entry point */
 	.equ pciheader_len, . - pciheader
 	.size pciheader, . - pciheader
-	
+
+#ifndef LOAD_ROM_FROM_PCI
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
-	.ascii	"SUBW"
+	.ascii	"ADDW"
 	.long	pciheader_image_length
 	.long	512
 	.long	0
-	.ascii	"SUBW"
+	.ascii	"ADDW"
 	.long	pciheader_runtime_length
 	.long	512
 	.long	0
 	.previous
+#endif
 
 pnpheader:
 	.ascii	"$PnP"			/* Signature */
@@ -124,6 +149,7 @@ prodstr_pci_id:
 	.size prodstr, . - prodstr
 
 	.globl	undiheader	
+	.weak	undiloader
 undiheader:
 	.ascii	"UNDI"			/* Signature */
 	.byte	undiheader_len		/* Length of structure */
@@ -172,6 +198,11 @@ init:
 	call	print_message
 	call	print_pci_busdevfn
 
+#ifdef LOAD_ROM_FROM_PCI
+	/* Save PCI bus:dev.fn for later use */
+	movw	%ax, pci_busdevfn
+#endif
+
 	/* Fill in product name string, if possible */
 	movw	$prodstr_pci_id, %di
 	call	print_pci_busdevfn
@@ -196,6 +227,9 @@ init:
 	jne	no_pci3
 	testb	%ah, %ah
 	jnz	no_pci3
+#ifdef LOAD_ROM_FROM_PCI
+	incb	pcibios_present
+#endif
 	movw	$init_message_pci, %si
 	xorw	%di, %di
 	call	print_message
@@ -236,24 +270,37 @@ no_pci3:
 	popl	%edx
 	popl	%ebx
 
-	/* Check for PnP BIOS */
-	testw	$0x0f, %bx	/* PnP signature must be aligned - bochs    */
-	jnz	no_bbs		/* uses unalignment to indicate 'fake' PnP. */
-	cmpl	$PNP_SIGNATURE, %es:0(%bx)
-	jne	no_bbs
+	/* Check for PnP BIOS.  Although %es:di should point to the
+	 * PnP BIOS signature on entry, some BIOSes fail to do this.
+	 */
+	movw	$( 0xf000 - 1 ), %bx
+pnp_scan:
+	incw	%bx
+	jz	no_pnp
+	movw	%bx, %es
+	cmpl	$PNP_SIGNATURE, %es:0
+	jne	pnp_scan
+	xorw	%dx, %dx
+	xorw	%si, %si
+	movzbw	%es:5, %cx
+1:	es lodsb
+	addb	%al, %dl
+	loop	1b
+	jnz	pnp_scan
 	/* Is PnP: print PnP message */
 	movw	$init_message_pnp, %si
 	xorw	%di, %di
 	call	print_message
 	/* Check for BBS */
-	pushw	%es:0x1b(%bx)	/* Real-mode data segment */
+	pushw	%es:0x1b	/* Real-mode data segment */
 	pushw	%ds		/* &(bbs_version) */
 	pushw	$bbs_version
 	pushw	$PNP_GET_BBS_VERSION
-	lcall	*%es:0xd(%bx)
+	lcall	*%es:0xd
 	addw	$8, %sp
 	testw	%ax, %ax
 	je	got_bbs
+no_pnp:	/* Not PnP-compliant - therefore cannot be BBS-compliant */
 no_bbs:	/* Not BBS-compliant - must hook INT 19 */
 	movw	$init_message_int19, %si
 	xorw	%di, %di
@@ -294,7 +341,7 @@ pmm_scan:
 	/* We have PMM and so a 1kB stack: preserve upper register halves */
 	pushal
 	/* Calculate required allocation size in %esi */
-	movzbl	romheader_size, %eax
+	movzwl	real_size, %eax
 	shll	$9, %eax
 	addl	$_textdata_memsz, %eax
 	orw	$0xffff, %ax	/* Ensure allocation size is at least 64kB */
@@ -336,6 +383,7 @@ got_pmm: /* PMM allocation succeeded */
 	call	print_character
 	movw	%si, %ax
 	call	print_hex_byte
+pmm_copy:
 	/* Copy ROM to PMM block */
 	xorw	%ax, %ax
 	movw	%ax, %es
@@ -347,11 +395,43 @@ got_pmm: /* PMM allocation succeeded */
 	movl	%edi, decompress_to
 	/* Shrink ROM */
 	movb	$_prefix_memsz_sect, romheader_size
+#if defined(SHRINK_WITHOUT_PMM) || defined(LOAD_ROM_FROM_PCI)
+	jmp	pmm_done
+pmm_fail:
+	/* Print marker and copy ourselves to high memory */
+	movl	$HIGHMEM_LOADPOINT, image_source
+	xorw	%di, %di
+	movb	$( '!' ), %al
+	call	print_character
+	jmp	pmm_copy
+pmm_done:
+#else
 pmm_fail:
+#endif
 	/* Restore upper register halves */
 	popal
+#if defined(LOAD_ROM_FROM_PCI)
+	call	load_from_pci
+	jc	load_err
+	jmp	load_ok
 no_pmm:
+	/* Cannot continue without PMM - print error message */
+	xorw	%di, %di
+	movw	$init_message_no_pmm, %si
+	call	print_message
+load_err:
+	/* Wait for five seconds to let user see message */
+	movw	$90, %cx
+1:	call	wait_for_tick
+	loop	1b
+	/* Mark environment as invalid and return */
+	movl	$0, decompress_to
+	jmp	out
 
+load_ok:
+#else
+no_pmm:
+#endif
 	/* Update checksum */
 	xorw	%bx, %bx
 	xorw	%si, %si
@@ -396,14 +476,14 @@ no_pmm:
 	movw	$init_message_done, %si
 	call	print_message
 	popf
-	jnz	2f
+	jnz	out
 	/* Ctrl-B was pressed: invoke gPXE.  The keypress will be
 	 * picked up by the initial shell prompt, and we will drop
 	 * into a shell.
 	 */
 	pushw	%cs
 	call	exec
-2:
+out:
 	/* Restore registers */
 	popw	%gs
 	popw	%fs
@@ -450,6 +530,11 @@ init_message_bbs:
 init_message_pmm:
 	.asciz	" PMM"
 	.size	init_message_pmm, . - init_message_pmm
+#ifdef LOAD_ROM_FROM_PCI
+init_message_no_pmm:
+	.asciz	"\nPMM required but not present!\n"
+	.size	init_message_no_pmm, . - init_message_no_pmm
+#endif
 init_message_int19:
 	.asciz	" INT19"
 	.size	init_message_int19, . - init_message_int19
@@ -467,6 +552,7 @@ init_message_done:
  *
  * May be either within option ROM space, or within PMM-allocated block.
  */
+	.globl	image_source
 image_source:
 	.long	0
 	.size	image_source, . - image_source
@@ -474,11 +560,32 @@ image_source:
 /* Temporary decompression area
  *
  * May be either at HIGHMEM_LOADPOINT, or within PMM-allocated block.
+ * If a PCI ROM load fails, this will be set to zero.
  */
+	.globl	decompress_to
 decompress_to:
 	.long	HIGHMEM_LOADPOINT
 	.size	decompress_to, . - decompress_to
 
+#ifdef LOAD_ROM_FROM_PCI
+
+/* Set if the PCI BIOS is present, even <3.0 */
+pcibios_present:
+	.byte	0
+	.byte	0		/* for alignment */
+	.size	pcibios_present, . - pcibios_present
+
+/* PCI bus:device.function word
+ *
+ * Filled in by init in the .xrom case, so the remainder of the ROM
+ * can be located.
+ */
+pci_busdevfn:
+	.word	0
+	.size	pci_busdevfn, . - pci_busdevfn
+
+#endif
+
 /* BBS version
  *
  * Filled in by BBS BIOS.  We ignore the value.
@@ -497,6 +604,289 @@ bev_entry:
 	lret
 	.size	bev_entry, . - bev_entry
 
+
+#ifdef LOAD_ROM_FROM_PCI
+
+#define PCI_ROM_ADDRESS		0x30	/* Bits 31:11 address, 10:1 reserved */
+#define PCI_ROM_ADDRESS_ENABLE	 0x00000001
+#define PCI_ROM_ADDRESS_MASK	 0xfffff800
+
+#define PCIBIOS_READ_WORD	0xb109
+#define PCIBIOS_READ_DWORD	0xb10a
+#define PCIBIOS_WRITE_WORD	0xb10c
+#define PCIBIOS_WRITE_DWORD	0xb10d
+
+/* Determine size of PCI BAR
+ *
+ *  %bx : PCI bus:dev.fn to probe
+ *  %di : Address of BAR to find size of
+ * %edx : Mask of address bits within BAR
+ *
+ * %ecx : Size for a memory resource,
+ *	  1 for an I/O resource (bit 0 set).
+ *   CF : Set on error or nonexistent device (all-ones read)
+ *
+ * All other registers saved.
+ */
+pci_bar_size:
+	/* Save registers */
+	pushw	%ax
+	pushl	%esi
+	pushl	%edx
+
+	/* Read current BAR value */
+	movw	$PCIBIOS_READ_DWORD, %ax
+	int	$0x1a
+
+	/* Check for device existence and save it */
+	testb	$1, %cl		/* I/O bit? */
+	jz	1f
+	andl	$1, %ecx	/* If so, exit with %ecx = 1 */
+	jmp	99f
+1:	notl	%ecx
+	testl	%ecx, %ecx	/* Set ZF iff %ecx was all-ones */
+	notl	%ecx
+	jnz	1f
+	stc			/* All ones - exit with CF set */
+	jmp	99f
+1:	movl	%ecx, %esi	/* Save in %esi */
+
+	/* Write all ones to BAR */
+	movl	%edx, %ecx
+	movw	$PCIBIOS_WRITE_DWORD, %ax
+	int	$0x1a
+
+	/* Read back BAR */
+	movw	$PCIBIOS_READ_DWORD, %ax
+	int	$0x1a
+
+	/* Find decode size from least set bit in mask BAR */
+	bsfl	%ecx, %ecx	/* Find least set bit, log2(decode size) */
+	jz	1f		/* Mask BAR should not be zero */
+	xorl	%edx, %edx
+	incl	%edx
+	shll	%cl, %edx	/* %edx = decode size */
+	jmp	2f
+1:	xorl	%edx, %edx	/* Return zero size for mask BAR zero */
+
+	/* Restore old BAR value */
+2:	movl	%esi, %ecx
+	movw	$PCIBIOS_WRITE_DWORD, %ax
+	int	$0x1a
+
+	movl	%edx, %ecx	/* Return size in %ecx */
+
+	/* Restore registers and return */
+99:	popl	%edx
+	popl	%esi
+	popw	%ax
+	ret
+
+	.size	pci_bar_size, . - pci_bar_size
+
+/* PCI ROM loader
+ *
+ * Called from init in the .xrom case to load the non-prefix code
+ * using the PCI ROM BAR.
+ *
+ * Returns with carry flag set on error. All registers saved.
+ */
+load_from_pci:
+	/*
+	 * Use PCI BIOS access to config space. The calls take
+	 *
+	 *   %ah : 0xb1		%al : function
+	 *   %bx : bus/dev/fn
+	 *   %di : config space address
+	 *  %ecx : value to write (for writes)
+	 *
+	 *  %ecx : value read (for reads)
+	 *   %ah : return code
+	 *    CF : error indication
+	 *
+	 * All registers not used for return are preserved.
+	 */
+
+	/* Save registers and set up %es for big real mode */
+	pushal
+	pushw	%es
+	xorw	%ax, %ax
+	movw	%ax, %es
+
+	/* Check PCI BIOS presence */
+	cmpb	$0, pcibios_present
+	jz	err_pcibios
+
+	/* Load existing PCI ROM BAR */
+	movw	$PCIBIOS_READ_DWORD, %ax
+	movw	pci_busdevfn, %bx
+	movw	$PCI_ROM_ADDRESS, %di
+	int	$0x1a
+
+	/* Maybe it's already enabled? */
+	testb	$PCI_ROM_ADDRESS_ENABLE, %cl
+	jz	1f
+	movb	$1, %dl		/* Flag indicating no deinit required */
+	movl	%ecx, %ebp
+	jmp	check_rom
+
+	/* Determine PCI BAR decode size */
+1:	movl	$PCI_ROM_ADDRESS_MASK, %edx
+	call	pci_bar_size	/* Returns decode size in %ecx */
+	jc	err_size_insane	/* CF => no ROM BAR, %ecx == ffffffff */
+
+	/* Check sanity of decode size */
+	xorl	%eax, %eax
+	movw	real_size, %ax
+	shll	$9, %eax	/* %eax = ROM size */
+	cmpl	%ecx, %eax
+	ja	err_size_insane	/* Insane if decode size < ROM size */
+	cmpl	$0x100000, %ecx
+	jae	err_size_insane	/* Insane if decode size >= 1MB */
+
+	/* Find a place to map the BAR
+	 * In theory we should examine e820 and all PCI BARs to find a
+	 * free region. However, we run at POST when e820 may not be
+	 * available, and memory reads of an unmapped location are
+	 * de facto standardized to return all-ones. Thus, we can get
+	 * away with searching high memory (0xf0000000 and up) on
+	 * multiples of the ROM BAR decode size for a sufficiently
+	 * large all-ones region.
+	 */
+	movl	%ecx, %edx	/* Save ROM BAR size in %edx */
+	movl	$0xf0000000, %ebp
+	xorl	%eax, %eax
+	notl	%eax		/* %eax = all ones */
+bar_search:
+	movl	%ebp, %edi
+	movl	%edx, %ecx
+	shrl	$2, %ecx
+	addr32 repe scasl	/* Scan %es:edi for anything not all-ones */
+	jz	bar_found
+	addl	%edx, %ebp
+	testl	$0x80000000, %ebp
+	jz	err_no_bar
+	jmp	bar_search
+
+bar_found:
+	movl	%edi, %ebp
+	/* Save current BAR value on stack to restore later */
+	movw	$PCIBIOS_READ_DWORD, %ax
+	movw	$PCI_ROM_ADDRESS, %di
+	int	$0x1a
+	pushl	%ecx
+
+	/* Map the ROM */
+	movw	$PCIBIOS_WRITE_DWORD, %ax
+	movl	%ebp, %ecx
+	orb	$PCI_ROM_ADDRESS_ENABLE, %cl
+	int	$0x1a
+
+	xorb	%dl, %dl	/* %dl = 0 : ROM was not already mapped */
+check_rom:
+	/* Check and copy ROM - enter with %dl set to skip unmapping,
+	 * %ebp set to mapped ROM BAR address.
+	 * We check up to prodstr_separator for equality, since anything past
+	 * that may have been modified. Since our check includes the checksum
+	 * byte over the whole ROM stub, that should be sufficient.
+	 */
+	xorb	%dh, %dh	/* %dh = 0 : ROM did not fail integrity check */
+
+	/* Verify ROM integrity */
+	xorl	%esi, %esi
+	movl	%ebp, %edi
+	movl	$prodstr_separator, %ecx
+	addr32 repe cmpsb
+	jz	copy_rom
+	incb	%dh		/* ROM failed integrity check */
+	movl	%ecx, %ebp	/* Save number of bytes left */
+	jmp	skip_load
+
+copy_rom:
+	/* Print BAR address and indicate whether we mapped it ourselves */
+	movb	$( ' ' ), %al
+	xorw	%di, %di
+	call	print_character
+	movl	%ebp, %eax
+	call	print_hex_dword
+	movb	$( '-' ), %al	/* '-' for self-mapped */
+	subb	%dl, %al
+	subb	%dl, %al	/* '+' = '-' - 2 for BIOS-mapped */
+	call	print_character
+
+	/* Copy ROM at %ebp to PMM or highmem block */
+	movl	%ebp, %esi
+	movl	image_source, %edi
+	movzwl	real_size, %ecx
+	shll	$9, %ecx
+	addr32 es rep movsb
+	movl	%edi, decompress_to
+skip_load:
+	testb	%dl, %dl	/* Was ROM already mapped? */
+	jnz	skip_unmap
+
+	/* Unmap the ROM by restoring old ROM BAR */
+	movw	$PCIBIOS_WRITE_DWORD, %ax
+	movw	$PCI_ROM_ADDRESS, %di
+	popl	%ecx
+	int	$0x1a
+
+skip_unmap:
+	/* Error handling */
+	testb	%dh, %dh
+	jnz	err_rom_invalid
+	clc
+	jmp	99f
+
+err_pcibios:			/* No PCI BIOS available */
+	movw	$load_message_no_pcibios, %si
+	xorl	%eax, %eax	/* "error code" is zero */
+	jmp	1f
+err_size_insane:		/* BAR has size (%ecx) that is insane */
+	movw	$load_message_size_insane, %si
+	movl	%ecx, %eax
+	jmp	1f
+err_no_bar:			/* No space of sufficient size (%edx) found */
+	movw	$load_message_no_bar, %si
+	movl	%edx, %eax
+	jmp	1f
+err_rom_invalid:		/* Loaded ROM does not match (%ebp bytes left) */
+	movw	$load_message_rom_invalid, %si
+	movzbl	romheader_size, %eax
+	shll	$9, %eax
+	subl	%ebp, %eax
+	decl	%eax		/* %eax is now byte index of failure */
+
+1:	/* Error handler - print message at %si and dword in %eax */
+	xorw	%di, %di
+	call	print_message
+	call	print_hex_dword
+	stc
+99:	popw	%es
+	popal
+	ret
+
+	.size	load_from_pci, . - load_from_pci
+
+load_message_no_pcibios:
+	.asciz	"\nNo PCI BIOS found! "
+	.size	load_message_no_pcibios, . - load_message_no_pcibios
+
+load_message_size_insane:
+	.asciz	"\nROM resource has invalid size "
+	.size	load_message_size_insane, . - load_message_size_insane
+
+load_message_no_bar:
+	.asciz	"\nNo memory hole of sufficient size "
+	.size	load_message_no_bar, . - load_message_no_bar
+
+load_message_rom_invalid:
+	.asciz	"\nLoaded ROM is invalid at "
+	.size	load_message_rom_invalid, . - load_message_rom_invalid
+
+#endif /* LOAD_ROM_FROM_PCI */
+
+
 /* INT19 entry point
  *
  * Called via the hooked INT 19 if we detected a non-PnP BIOS.  We
@@ -557,6 +947,14 @@ exec:	/* Set %ds = %cs */
 	pushw	%cs
 	popw	%ds
 
+#ifdef LOAD_ROM_FROM_PCI
+	/* Don't execute if load was invalid */
+	cmpl	$0, decompress_to
+	jne	1f
+	lret
+1:
+#endif
+
 	/* Print message as soon as possible */
 	movw	$prodstr, %si
 	xorw	%di, %di
@@ -616,50 +1014,6 @@ exec_message:
 	.asciz	" starting execution\n"
 	.size exec_message, . - exec_message
 
-/* UNDI loader
- *
- * Called by an external program to load our PXE stack.
- */
-undiloader:
-	/* Save registers */
-	pushl	%esi
-	pushl	%edi
-	pushw	%ds
-	pushw	%es
-	pushw	%bx
-	/* ROM segment address to %ds */
-	pushw	%cs
-	popw	%ds
-	/* UNDI loader parameter structure address into %es:%di */
-	movw	%sp, %bx
-	movw	%ss:18(%bx), %di
-	movw	%ss:20(%bx), %es
-	/* Install to specified real-mode addresses */
-	pushw	%di
-	movw	%es:12(%di), %bx
-	movw	%es:14(%di), %ax
-	movl	image_source, %esi
-	movl	decompress_to, %edi
-	call	install_prealloc
-	popw	%di
-	/* Call UNDI loader C code */
-	pushl	$pxe_loader_call
-	pushw	%cs
-	pushw	$1f
-	pushw	%ax
-	pushw	$prot_call
-	lret
-1:	popw	%bx	/* discard */
-	popw	%bx	/* discard */
-	/* Restore registers and return */
-	popw	%bx
-	popw	%es
-	popw	%ds
-	popl	%edi
-	popl	%esi
-	lret
-	.size undiloader, . - undiloader
-
 /* Wait for key press specified by %bl (masked by %bh)
  *
  * Used by init and INT19 code when prompting user.  If the specified
diff --git a/gpxe/src/arch/i386/prefix/undiloader.S b/gpxe/src/arch/i386/prefix/undiloader.S
new file mode 100644
index 00000000..36c1bef3
--- /dev/null
+++ b/gpxe/src/arch/i386/prefix/undiloader.S
@@ -0,0 +1,49 @@
+	.text
+	.code16
+	.arch i386
+	.section ".prefix", "ax", @progbits
+
+/* UNDI loader
+ *
+ * Called by an external program to load our PXE stack.
+ */
+	.globl	undiloader
+undiloader:
+	/* Save registers */
+	pushl	%esi
+	pushl	%edi
+	pushw	%ds
+	pushw	%es
+	pushw	%bx
+	/* ROM segment address to %ds */
+	pushw	%cs
+	popw	%ds
+	/* UNDI loader parameter structure address into %es:%di */
+	movw	%sp, %bx
+	movw	%ss:18(%bx), %di
+	movw	%ss:20(%bx), %es
+	/* Install to specified real-mode addresses */
+	pushw	%di
+	movw	%es:12(%di), %bx
+	movw	%es:14(%di), %ax
+	movl	image_source, %esi
+	movl	decompress_to, %edi
+	call	install_prealloc
+	popw	%di
+	/* Call UNDI loader C code */
+	pushl	$pxe_loader_call
+	pushw	%cs
+	pushw	$1f
+	pushw	%ax
+	pushw	$prot_call
+	lret
+1:	popw	%bx	/* discard */
+	popw	%bx	/* discard */
+	/* Restore registers and return */
+	popw	%bx
+	popw	%es
+	popw	%ds
+	popl	%edi
+	popl	%esi
+	lret
+	.size undiloader, . - undiloader
diff --git a/gpxe/src/arch/i386/prefix/unnrv2b.S b/gpxe/src/arch/i386/prefix/unnrv2b.S
index 70167a14..f5724c13 100644
--- a/gpxe/src/arch/i386/prefix/unnrv2b.S
+++ b/gpxe/src/arch/i386/prefix/unnrv2b.S
@@ -20,6 +20,8 @@
  *   Michael Brown 9 Mar 2005
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 /****************************************************************************
  * This file provides the decompress() and decompress16() functions
  * which can be called in order to decompress an image compressed with
diff --git a/gpxe/src/arch/i386/prefix/unnrv2b16.S b/gpxe/src/arch/i386/prefix/unnrv2b16.S
new file mode 100644
index 00000000..b24c2846
--- /dev/null
+++ b/gpxe/src/arch/i386/prefix/unnrv2b16.S
@@ -0,0 +1,9 @@
+/*
+ * 16-bit version of the decompressor
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER )
+
+#define CODE16
+#include "unnrv2b.S"
diff --git a/gpxe/src/arch/i386/prefix/xromprefix.S b/gpxe/src/arch/i386/prefix/xromprefix.S
new file mode 100644
index 00000000..d7c861f5
--- /dev/null
+++ b/gpxe/src/arch/i386/prefix/xromprefix.S
@@ -0,0 +1,9 @@
+/*
+ * ROM prefix that loads the bulk of the ROM using direct PCI accesses,
+ * so as not to take up much option ROM space on PCI <3.0 systems.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER )
+
+#define LOAD_ROM_FROM_PCI
+#include "romprefix.S"
diff --git a/gpxe/src/arch/i386/scripts/i386-kir.lds b/gpxe/src/arch/i386/scripts/i386-kir.lds
index b213c605..c19480f0 100644
--- a/gpxe/src/arch/i386/scripts/i386-kir.lds
+++ b/gpxe/src/arch/i386/scripts/i386-kir.lds
@@ -130,6 +130,7 @@ SECTIONS {
     /DISCARD/ : {
 	*(.comment)
 	*(.note)
+	*(.discard)
     }
 
     /*
diff --git a/gpxe/src/arch/i386/scripts/i386.lds b/gpxe/src/arch/i386/scripts/i386.lds
index 8a0c6733..33c75f90 100644
--- a/gpxe/src/arch/i386/scripts/i386.lds
+++ b/gpxe/src/arch/i386/scripts/i386.lds
@@ -152,6 +152,7 @@ SECTIONS {
 	*(.eh_frame.*)
 	*(.rel)
 	*(.rel.*)
+	*(.discard)
     }
 
     /*
@@ -193,17 +194,9 @@ SECTIONS {
      * Values calculated to save code from doing it
      *
      */
+    _prefix_filesz_sect = ( ( _prefix_filesz + 511 ) / 512 );
     _prefix_memsz_pgh	= ( ( _prefix_memsz + 15 ) / 16 );
     _prefix_memsz_sect	= ( ( _prefix_memsz + 511 ) / 512 );
     _text16_memsz_pgh	= ( ( _text16_memsz + 15 ) / 16 );
     _data16_memsz_pgh	= ( ( _data16_memsz + 15 ) / 16 );
-
-    /*
-     * File size in paragraphs and sectors.  Note that wherever the
-     * _filesz variables are used, there must be a corresponding
-     * .zinfo.fixup section.
-     *
-     */
-    _filesz_pgh		= ( ( _filesz + 15 ) / 16 );
-    _filesz_sect	= ( ( _filesz + 511 ) / 512 );
 }
diff --git a/gpxe/src/arch/i386/transitions/libkir.S b/gpxe/src/arch/i386/transitions/libkir.S
index 1023ddd0..1176fcce 100644
--- a/gpxe/src/arch/i386/transitions/libkir.S
+++ b/gpxe/src/arch/i386/transitions/libkir.S
@@ -5,6 +5,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 /****************************************************************************
  * This file defines libkir: an interface between external and
  * internal environments when -DKEEP_IT_REAL is used, so that both
diff --git a/gpxe/src/arch/i386/transitions/librm.S b/gpxe/src/arch/i386/transitions/librm.S
index 8cf1f7f5..cb27ef35 100755..100644
--- a/gpxe/src/arch/i386/transitions/librm.S
+++ b/gpxe/src/arch/i386/transitions/librm.S
@@ -5,6 +5,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER )
+
 /* Drag in local definitions */
 #include "librm.h"
 
diff --git a/gpxe/src/arch/i386/transitions/librm_mgmt.c b/gpxe/src/arch/i386/transitions/librm_mgmt.c
index 50569f8e..f00be811 100755..100644
--- a/gpxe/src/arch/i386/transitions/librm_mgmt.c
+++ b/gpxe/src/arch/i386/transitions/librm_mgmt.c
@@ -5,6 +5,8 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER );
+
 #include <stdint.h>
 #include <realmode.h>