diff --git a/.clang-format b/.clang-format
index 016cbec..c83c7f7 100644
--- a/.clang-format
+++ b/.clang-format
@@ -1,9 +1,24 @@
 BasedOnStyle: Google
+
 IndentWidth: 8
 ContinuationIndentWidth: 8
 UseTab: Always
+
 BreakBeforeBraces: Linux
 AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: false
 AllowShortLoopsOnASingleLine: false
 IndentCaseLabels: false
+
+IncludeBlocks: Regroup
+IncludeCategories:
+  - Regex:    '^<[[:alnum:].]+>'
+    Priority: 1
+  - Regex:    '^"hf/arch/'
+    Priority: 2
+  - Regex:    '^"hf/'
+    Priority: 3
+  - Regex:    '^"vmapi/'
+    Priority: 4
+  - Regex:    '.*'
+    Priority: 5
diff --git a/.clang-tidy b/.clang-tidy
index f426a64..bc5bcaa 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,2 +1,3 @@
 Checks: 'readability-*,portability-*,performance-*,misc-*,bugprone-*,modernize-*'
 HeaderFilterRegex: '.*'
+FormatStyle: file
diff --git a/inc/addr.h b/inc/hf/addr.h
similarity index 98%
rename from inc/addr.h
rename to inc/hf/addr.h
index 15d32b5..1d4ec39 100644
--- a/inc/addr.h
+++ b/inc/hf/addr.h
@@ -4,7 +4,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "arch_addr.h"
+#include "hf/arch/addr.h"
 
 /* An opaque type for a physical address. */
 typedef struct {
diff --git a/inc/alloc.h b/inc/hf/alloc.h
similarity index 100%
rename from inc/alloc.h
rename to inc/hf/alloc.h
diff --git a/inc/api.h b/inc/hf/api.h
similarity index 94%
rename from inc/api.h
rename to inc/hf/api.h
index 1db9ca8..0009ac8 100644
--- a/inc/api.h
+++ b/inc/hf/api.h
@@ -1,8 +1,8 @@
 #ifndef _API_H
 #define _API_H
 
-#include "cpu.h"
-#include "vm.h"
+#include "hf/cpu.h"
+#include "hf/vm.h"
 
 /* TODO: Can we hide these? */
 extern struct vm secondary_vm[MAX_VMS];
diff --git a/inc/arch.h b/inc/hf/arch.h
similarity index 80%
rename from inc/arch.h
rename to inc/hf/arch.h
index 195d149..fcdead1 100644
--- a/inc/arch.h
+++ b/inc/hf/arch.h
@@ -1,7 +1,7 @@
 #ifndef _ARCH_H
 #define _ARCH_H
 
-#include "cpu.h"
+#include "hf/cpu.h"
 
 void arch_putchar(char c);
 
diff --git a/inc/boot_params.h b/inc/hf/boot_params.h
similarity index 95%
rename from inc/boot_params.h
rename to inc/hf/boot_params.h
index 1b4fe06..4841654 100644
--- a/inc/boot_params.h
+++ b/inc/hf/boot_params.h
@@ -3,7 +3,7 @@
 
 #include <stdbool.h>
 
-#include "mm.h"
+#include "hf/mm.h"
 
 struct boot_params {
 	paddr_t mem_begin;
diff --git a/inc/cpio.h b/inc/hf/cpio.h
similarity index 89%
rename from inc/cpio.h
rename to inc/hf/cpio.h
index ad6f4b7..de33ba6 100644
--- a/inc/cpio.h
+++ b/inc/hf/cpio.h
@@ -4,7 +4,7 @@
 #include <stdbool.h>
 #include <stddef.h>
 
-#include "memiter.h"
+#include "hf/memiter.h"
 
 bool cpio_next(struct memiter *iter, const char **name, const void **contents,
 	       size_t *size);
diff --git a/inc/cpu.h b/inc/hf/cpu.h
similarity index 94%
rename from inc/cpu.h
rename to inc/hf/cpu.h
index e949db7..a779679 100644
--- a/inc/cpu.h
+++ b/inc/hf/cpu.h
@@ -5,9 +5,10 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "addr.h"
-#include "arch_cpu.h"
-#include "spinlock.h"
+#include "hf/arch/cpu.h"
+
+#include "hf/addr.h"
+#include "hf/spinlock.h"
 
 enum vcpu_state {
 	vcpu_state_off,
diff --git a/inc/decl_offsets.h b/inc/hf/decl_offsets.h
similarity index 100%
rename from inc/decl_offsets.h
rename to inc/hf/decl_offsets.h
diff --git a/inc/dlog.h b/inc/hf/dlog.h
similarity index 100%
rename from inc/dlog.h
rename to inc/hf/dlog.h
diff --git a/inc/fdt.h b/inc/hf/fdt.h
similarity index 100%
rename from inc/fdt.h
rename to inc/hf/fdt.h
diff --git a/inc/fdt_handler.h b/inc/hf/fdt_handler.h
similarity index 75%
rename from inc/fdt_handler.h
rename to inc/hf/fdt_handler.h
index e85b8f5..4d3fa8f 100644
--- a/inc/fdt_handler.h
+++ b/inc/hf/fdt_handler.h
@@ -1,9 +1,9 @@
 #ifndef _FDT_HANDLER_H
 #define _FDT_HANDLER_H
 
-#include "boot_params.h"
-#include "fdt.h"
-#include "mm.h"
+#include "hf/boot_params.h"
+#include "hf/fdt.h"
+#include "hf/mm.h"
 
 bool fdt_get_boot_params(paddr_t fdt_addr, struct boot_params *p);
 bool fdt_patch(paddr_t fdt_addr, struct boot_params_update *p);
diff --git a/inc/load.h b/inc/hf/load.h
similarity index 81%
rename from inc/load.h
rename to inc/hf/load.h
index 6d19ae6..ba67f38 100644
--- a/inc/load.h
+++ b/inc/hf/load.h
@@ -4,9 +4,9 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "cpio.h"
-#include "memiter.h"
-#include "mm.h"
+#include "hf/cpio.h"
+#include "hf/memiter.h"
+#include "hf/mm.h"
 
 bool load_primary(const struct memiter *cpio, size_t kernel_arg,
 		  struct memiter *initrd);
diff --git a/inc/memiter.h b/inc/hf/memiter.h
similarity index 100%
rename from inc/memiter.h
rename to inc/hf/memiter.h
diff --git a/inc/mm.h b/inc/hf/mm.h
similarity index 97%
rename from inc/mm.h
rename to inc/hf/mm.h
index 6c539df..b62133c 100644
--- a/inc/mm.h
+++ b/inc/hf/mm.h
@@ -4,8 +4,9 @@
 #include <stdbool.h>
 #include <stdint.h>
 
-#include "addr.h"
-#include "arch_mm.h"
+#include "hf/arch/mm.h"
+
+#include "hf/addr.h"
 
 struct mm_ptable {
 	paddr_t table;
diff --git a/inc/spinlock.h b/inc/hf/spinlock.h
similarity index 100%
rename from inc/spinlock.h
rename to inc/hf/spinlock.h
diff --git a/inc/std.h b/inc/hf/std.h
similarity index 100%
rename from inc/std.h
rename to inc/hf/std.h
diff --git a/inc/vm.h b/inc/hf/vm.h
similarity index 93%
rename from inc/vm.h
rename to inc/hf/vm.h
index cd9dd32..ce88adc 100644
--- a/inc/vm.h
+++ b/inc/hf/vm.h
@@ -1,8 +1,8 @@
 #ifndef _VM_H
 #define _VM_H
 
-#include "cpu.h"
-#include "mm.h"
+#include "hf/cpu.h"
+#include "hf/mm.h"
 
 enum rpc_state {
 	rpc_state_idle,
diff --git a/src/alloc.c b/src/alloc.c
index cd6844a..0e4f468 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -1,7 +1,7 @@
-#include "alloc.h"
+#include "hf/alloc.h"
 
-#include "dlog.h"
-#include "spinlock.h"
+#include "hf/dlog.h"
+#include "hf/spinlock.h"
 
 static size_t alloc_base;
 static size_t alloc_limit;
diff --git a/src/api.c b/src/api.c
index f6895ca..4176941 100644
--- a/src/api.c
+++ b/src/api.c
@@ -1,7 +1,8 @@
-#include "api.h"
+#include "hf/api.h"
 
-#include "std.h"
-#include "vm.h"
+#include "hf/std.h"
+#include "hf/vm.h"
+
 #include "vmapi/hf/call.h"
 
 struct vm secondary_vm[MAX_VMS];
diff --git a/src/arch/aarch64/handler.c b/src/arch/aarch64/handler.c
index 7088216..d79ac4c 100644
--- a/src/arch/aarch64/handler.c
+++ b/src/arch/aarch64/handler.c
@@ -1,11 +1,12 @@
-#include "api.h"
-#include "cpu.h"
-#include "dlog.h"
-#include "psci.h"
-#include "vm.h"
+#include "hf/api.h"
+#include "hf/cpu.h"
+#include "hf/dlog.h"
+#include "hf/vm.h"
+
 #include "vmapi/hf/call.h"
 
 #include "msr.h"
+#include "psci.h"
 
 struct hvc_handler_return {
 	long user_ret;
diff --git a/src/arch/aarch64/inc/arch_addr.h b/src/arch/aarch64/inc/hf/arch/addr.h
similarity index 100%
rename from src/arch/aarch64/inc/arch_addr.h
rename to src/arch/aarch64/inc/hf/arch/addr.h
diff --git a/src/arch/aarch64/inc/arch_barriers.h b/src/arch/aarch64/inc/hf/arch/barriers.h
similarity index 100%
rename from src/arch/aarch64/inc/arch_barriers.h
rename to src/arch/aarch64/inc/hf/arch/barriers.h
diff --git a/src/arch/aarch64/inc/arch_cpu.h b/src/arch/aarch64/inc/hf/arch/cpu.h
similarity index 98%
rename from src/arch/aarch64/inc/arch_cpu.h
rename to src/arch/aarch64/inc/hf/arch/cpu.h
index 9aa96ef..1efc8b3 100644
--- a/src/arch/aarch64/inc/arch_cpu.h
+++ b/src/arch/aarch64/inc/hf/arch/cpu.h
@@ -6,7 +6,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "addr.h"
+#include "hf/addr.h"
 
 struct arch_regs {
 	/* General purpose registers. */
diff --git a/src/arch/aarch64/inc/arch_mm.h b/src/arch/aarch64/inc/hf/arch/mm.h
similarity index 98%
rename from src/arch/aarch64/inc/arch_mm.h
rename to src/arch/aarch64/inc/hf/arch/mm.h
index e904dab..4a23074 100644
--- a/src/arch/aarch64/inc/arch_mm.h
+++ b/src/arch/aarch64/inc/hf/arch/mm.h
@@ -4,7 +4,7 @@
 #include <stdbool.h>
 #include <stddef.h>
 
-#include "addr.h"
+#include "hf/addr.h"
 
 /* A page table entry. */
 typedef uint64_t pte_t;
diff --git a/src/arch/aarch64/inc/vm/shutdown.h b/src/arch/aarch64/inc/hf/arch/vm/shutdown.h
similarity index 100%
rename from src/arch/aarch64/inc/vm/shutdown.h
rename to src/arch/aarch64/inc/hf/arch/vm/shutdown.h
diff --git a/src/arch/aarch64/inc/io.h b/src/arch/aarch64/io.h
similarity index 93%
rename from src/arch/aarch64/inc/io.h
rename to src/arch/aarch64/io.h
index 45b2924..18a9dec 100644
--- a/src/arch/aarch64/inc/io.h
+++ b/src/arch/aarch64/io.h
@@ -4,7 +4,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "arch_barriers.h"
+#include "hf/arch/barriers.h"
 
 static inline uint32_t io_read(size_t addr)
 {
diff --git a/src/arch/aarch64/mm.c b/src/arch/aarch64/mm.c
index 7729491..29bad76 100644
--- a/src/arch/aarch64/mm.c
+++ b/src/arch/aarch64/mm.c
@@ -1,6 +1,9 @@
-#include "mm.h"
-#include "arch_cpu.h"
-#include "dlog.h"
+#include "hf/mm.h"
+
+#include "hf/arch/cpu.h"
+
+#include "hf/dlog.h"
+
 #include "msr.h"
 
 /* Keep macro alignment */
diff --git a/src/arch/aarch64/offsets.c b/src/arch/aarch64/offsets.c
index 8e7e9df..4c005df 100644
--- a/src/arch/aarch64/offsets.c
+++ b/src/arch/aarch64/offsets.c
@@ -2,8 +2,8 @@
 #include "offsets.h"
 #endif /* GEN_OFFSETS */
 
-#include "cpu.h"
-#include "decl_offsets.h"
+#include "hf/cpu.h"
+#include "hf/decl_offsets.h"
 
 DECL(CPU_CURRENT, struct cpu, current);
 DECL(CPU_STACK_BOTTOM, struct cpu, stack_bottom);
diff --git a/src/arch/aarch64/params.c b/src/arch/aarch64/params.c
index 00d181a..d4d709c 100644
--- a/src/arch/aarch64/params.c
+++ b/src/arch/aarch64/params.c
@@ -1,5 +1,5 @@
-#include "boot_params.h"
-#include "fdt_handler.h"
+#include "hf/boot_params.h"
+#include "hf/fdt_handler.h"
 
 /* This is set by entry.S. */
 uintpaddr_t fdt_addr;
diff --git a/src/arch/aarch64/pl011.c b/src/arch/aarch64/pl011.c
index cf2f465..de86f9d 100644
--- a/src/arch/aarch64/pl011.c
+++ b/src/arch/aarch64/pl011.c
@@ -1,4 +1,5 @@
-#include "dlog.h"
+#include "hf/dlog.h"
+
 #include "io.h"
 
 /* UART Data Register. */
diff --git a/src/arch/aarch64/inc/psci.h b/src/arch/aarch64/psci.h
similarity index 100%
rename from src/arch/aarch64/inc/psci.h
rename to src/arch/aarch64/psci.h
diff --git a/src/arch/aarch64/vm/shutdown.c b/src/arch/aarch64/vm/shutdown.c
index 8175cdf..6299880 100644
--- a/src/arch/aarch64/vm/shutdown.c
+++ b/src/arch/aarch64/vm/shutdown.c
@@ -1,8 +1,9 @@
-#include "vm/shutdown.h"
+#include "hf/arch/vm/shutdown.h"
 
-#include "psci.h"
 #include "vmapi/hf/call.h"
 
+#include "../psci.h"
+
 /*
  * Shutdown the system or exit emulation.
  */
diff --git a/src/cpio.c b/src/cpio.c
index c6db268..d613e54 100644
--- a/src/cpio.c
+++ b/src/cpio.c
@@ -1,8 +1,8 @@
-#include "cpio.h"
+#include "hf/cpio.h"
 
 #include <stdint.h>
 
-#include "std.h"
+#include "hf/std.h"
 
 #pragma pack(push, 1)
 struct cpio_header {
diff --git a/src/cpu.c b/src/cpu.c
index 5e179dd..217baea 100644
--- a/src/cpu.c
+++ b/src/cpu.c
@@ -1,10 +1,11 @@
-#include "cpu.h"
+#include "hf/cpu.h"
 
-#include "api.h"
-#include "arch_cpu.h"
-#include "dlog.h"
-#include "std.h"
-#include "vm.h"
+#include "hf/arch/cpu.h"
+
+#include "hf/api.h"
+#include "hf/dlog.h"
+#include "hf/std.h"
+#include "hf/vm.h"
 
 /* The stack to be used by the CPUs. */
 alignas(2 * sizeof(size_t)) static char callstacks[STACK_SIZE * MAX_CPUS];
diff --git a/src/dlog.c b/src/dlog.c
index db619ee..7f4e935 100644
--- a/src/dlog.c
+++ b/src/dlog.c
@@ -1,11 +1,11 @@
-#include "dlog.h"
+#include "hf/dlog.h"
 
 #include <stdbool.h>
 #include <stddef.h>
 
-#include "arch.h"
-#include "spinlock.h"
-#include "std.h"
+#include "hf/arch.h"
+#include "hf/spinlock.h"
+#include "hf/std.h"
 
 /* Keep macro alignment */
 /* clang-format off */
diff --git a/src/fdt.c b/src/fdt.c
index faf42b3..6383164 100644
--- a/src/fdt.c
+++ b/src/fdt.c
@@ -1,9 +1,9 @@
-#include "fdt.h"
+#include "hf/fdt.h"
 
 #include <stdint.h>
 
-#include "dlog.h"
-#include "std.h"
+#include "hf/dlog.h"
+#include "hf/std.h"
 
 struct fdt_header {
 	uint32_t magic;
diff --git a/src/fdt_handler.c b/src/fdt_handler.c
index 06320e4..aaf193e 100644
--- a/src/fdt_handler.c
+++ b/src/fdt_handler.c
@@ -1,10 +1,10 @@
-#include "fdt_handler.h"
+#include "hf/fdt_handler.h"
 
-#include "boot_params.h"
-#include "dlog.h"
-#include "fdt.h"
-#include "mm.h"
-#include "std.h"
+#include "hf/boot_params.h"
+#include "hf/dlog.h"
+#include "hf/fdt.h"
+#include "hf/mm.h"
+#include "hf/std.h"
 
 static uint64_t convert_number(const char *data, uint32_t size)
 {
diff --git a/src/load.c b/src/load.c
index 44c282c..eb6074d 100644
--- a/src/load.c
+++ b/src/load.c
@@ -1,13 +1,13 @@
-#include "load.h"
+#include "hf/load.h"
 
 #include <stdbool.h>
 
-#include "api.h"
-#include "dlog.h"
-#include "memiter.h"
-#include "mm.h"
-#include "std.h"
-#include "vm.h"
+#include "hf/api.h"
+#include "hf/dlog.h"
+#include "hf/memiter.h"
+#include "hf/mm.h"
+#include "hf/std.h"
+#include "hf/vm.h"
 
 /**
  * Copies data to an unmapped location by mapping it for write, copying the
diff --git a/src/main.c b/src/main.c
index 0b21bbf..53f89bd 100644
--- a/src/main.c
+++ b/src/main.c
@@ -2,16 +2,16 @@
 #include <stddef.h>
 #include <stdnoreturn.h>
 
-#include "alloc.h"
-#include "api.h"
-#include "boot_params.h"
-#include "cpio.h"
-#include "cpu.h"
-#include "dlog.h"
-#include "load.h"
-#include "mm.h"
-#include "std.h"
-#include "vm.h"
+#include "hf/alloc.h"
+#include "hf/api.h"
+#include "hf/boot_params.h"
+#include "hf/cpio.h"
+#include "hf/cpu.h"
+#include "hf/dlog.h"
+#include "hf/load.h"
+#include "hf/mm.h"
+#include "hf/std.h"
+#include "hf/vm.h"
 
 char ptable_buf[PAGE_SIZE * 40];
 
diff --git a/src/memiter.c b/src/memiter.c
index 6dd9d8c..57cf98b 100644
--- a/src/memiter.c
+++ b/src/memiter.c
@@ -1,6 +1,6 @@
-#include "memiter.h"
+#include "hf/memiter.h"
 
-#include "std.h"
+#include "hf/std.h"
 
 /**
  * Initialises the given memory iterator.
diff --git a/src/mm.c b/src/mm.c
index b4ef264..d3b6a46 100644
--- a/src/mm.c
+++ b/src/mm.c
@@ -1,11 +1,11 @@
-#include "mm.h"
+#include "hf/mm.h"
 
 #include <assert.h>
 #include <stdatomic.h>
 #include <stdint.h>
 
-#include "alloc.h"
-#include "dlog.h"
+#include "hf/alloc.h"
+#include "hf/dlog.h"
 
 /* The type of addresses stored in the page table. */
 typedef uintvaddr_t ptable_addr_t;
diff --git a/src/std.c b/src/std.c
index 9ea1591..6d26bef 100644
--- a/src/std.c
+++ b/src/std.c
@@ -1,4 +1,4 @@
-#include "std.h"
+#include "hf/std.h"
 
 void *memset(void *s, int c, size_t n)
 {
diff --git a/src/vm.c b/src/vm.c
index 1eafb63..963531a 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1,8 +1,8 @@
-#include "vm.h"
+#include "hf/vm.h"
 
-#include "api.h"
-#include "cpu.h"
-#include "std.h"
+#include "hf/api.h"
+#include "hf/cpu.h"
+#include "hf/std.h"
 
 bool vm_init(struct vm *vm, uint32_t id, uint32_t vcpu_count)
 {
diff --git a/test/vm/hf_test.h b/test/vm/hf_test.h
index 2959ff5..4a1acc3 100644
--- a/test/vm/hf_test.h
+++ b/test/vm/hf_test.h
@@ -4,7 +4,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 
-#include "dlog.h"
+#include "hf/dlog.h"
 
 /*
  * Prefixed to log lines from tests for easy filtering in the console.
diff --git a/test/vm/primary_only/primary.c b/test/vm/primary_only/primary.c
index e9f70ee..03dc95c 100644
--- a/test/vm/primary_only/primary.c
+++ b/test/vm/primary_only/primary.c
@@ -1,8 +1,9 @@
 #include <stdint.h>
 
-#include "../hf_test.h"
 #include "vmapi/hf/call.h"
 
+#include "../hf_test.h"
+
 uint8_t kstack[4096] __attribute__((aligned(4096)));
 
 TEST(vm_get_count)
diff --git a/test/vm/primary_with_secondary/primary.c b/test/vm/primary_with_secondary/primary.c
index bcbb592..5502904 100644
--- a/test/vm/primary_with_secondary/primary.c
+++ b/test/vm/primary_with_secondary/primary.c
@@ -2,10 +2,12 @@
 #include <stdalign.h>
 #include <stdint.h>
 
-#include "../hf_test.h"
-#include "mm.h"
+#include "hf/mm.h"
+
 #include "vmapi/hf/call.h"
 
+#include "../hf_test.h"
+
 alignas(4096) uint8_t kstack[4096];
 
 alignas(PAGE_SIZE) uint8_t send_page[PAGE_SIZE];
diff --git a/test/vm/primary_with_secondary/secondary.c b/test/vm/primary_with_secondary/secondary.c
index bf6a5c7..19f6901 100644
--- a/test/vm/primary_with_secondary/secondary.c
+++ b/test/vm/primary_with_secondary/secondary.c
@@ -1,8 +1,9 @@
 #include <stdint.h>
 
-#include "../hf_test.h"
 #include "vmapi/hf/call.h"
 
+#include "../hf_test.h"
+
 uint8_t kstack[4096] __attribute__((aligned(4096)));
 
 void kmain(void)