From adcaaf9b93f9de14ba93bea54aecef103fe16b5f Mon Sep 17 00:00:00 2001
From: Michael Brown
Date: Wed, 14 Jan 2026 14:36:49 +0000
Subject: [build] Mark known reviewed files as permitted for UEFI Secure Boot

Some past security reviews carried out for UEFI Secure Boot signing
submissions have covered specific drivers or functional areas of iPXE.
Mark all of the files comprising these areas as permitted for UEFI
Secure Boot.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/include/xen/arch-x86/xen-x86_64.h | 1 +
 src/include/xen/arch-x86/xen.h        | 1 +
 src/include/xen/event_channel.h       | 1 +
 src/include/xen/grant_table.h         | 1 +
 src/include/xen/io/netif.h            | 1 +
 src/include/xen/io/ring.h             | 1 +
 src/include/xen/io/xenbus.h           | 1 +
 src/include/xen/io/xs_wire.h          | 1 +
 src/include/xen/xen-compat.h          | 1 +
 src/include/xen/xen.h                 | 1 +
 10 files changed, 10 insertions(+)

(limited to 'src/include/xen')

diff --git a/src/include/xen/arch-x86/xen-x86_64.h b/src/include/xen/arch-x86/xen-x86_64.h
index 8287fd20f..618bf07d7 100644
--- a/src/include/xen/arch-x86/xen-x86_64.h
+++ b/src/include/xen/arch-x86/xen-x86_64.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_ARCH_X86_XEN_X86_64_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /*
  * Hypercall interface:
diff --git a/src/include/xen/arch-x86/xen.h b/src/include/xen/arch-x86/xen.h
index 2b7afb2f4..7df850650 100644
--- a/src/include/xen/arch-x86/xen.h
+++ b/src/include/xen/arch-x86/xen.h
@@ -13,6 +13,7 @@
 #define __XEN_PUBLIC_ARCH_X86_XEN_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /* Structural guest handles introduced in 0x00030201. */
 #if __XEN_INTERFACE_VERSION__ >= 0x00030201
diff --git a/src/include/xen/event_channel.h b/src/include/xen/event_channel.h
index 0c3752723..a3145d76f 100644
--- a/src/include/xen/event_channel.h
+++ b/src/include/xen/event_channel.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_EVENT_CHANNEL_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "xen.h"
 
diff --git a/src/include/xen/grant_table.h b/src/include/xen/grant_table.h
index f0ae17c41..141a17f56 100644
--- a/src/include/xen/grant_table.h
+++ b/src/include/xen/grant_table.h
@@ -12,6 +12,7 @@
 #define __XEN_PUBLIC_GRANT_TABLE_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "xen.h"
 
diff --git a/src/include/xen/io/netif.h b/src/include/xen/io/netif.h
index bec61ab3e..59887a80f 100644
--- a/src/include/xen/io/netif.h
+++ b/src/include/xen/io/netif.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_IO_NETIF_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "ring.h"
 #include "../grant_table.h"
diff --git a/src/include/xen/io/ring.h b/src/include/xen/io/ring.h
index 41b50e2cf..3451bbb52 100644
--- a/src/include/xen/io/ring.h
+++ b/src/include/xen/io/ring.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_IO_RING_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /*
  * When #include'ing this header, you need to provide the following
diff --git a/src/include/xen/io/xenbus.h b/src/include/xen/io/xenbus.h
index 473f538b8..3bf417c3a 100644
--- a/src/include/xen/io/xenbus.h
+++ b/src/include/xen/io/xenbus.h
@@ -11,6 +11,7 @@
 #define _XEN_PUBLIC_IO_XENBUS_H
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /*
  * The state of either end of the Xenbus, i.e. the current communication
diff --git a/src/include/xen/io/xs_wire.h b/src/include/xen/io/xs_wire.h
index cffd75cde..99dc91781 100644
--- a/src/include/xen/io/xs_wire.h
+++ b/src/include/xen/io/xs_wire.h
@@ -10,6 +10,7 @@
 #define _XS_WIRE_H
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 enum xsd_sockmsg_type
 {
diff --git a/src/include/xen/xen-compat.h b/src/include/xen/xen-compat.h
index 8b2361807..8e4ed2434 100644
--- a/src/include/xen/xen-compat.h
+++ b/src/include/xen/xen-compat.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_XEN_COMPAT_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #define __XEN_LATEST_INTERFACE_VERSION__ 0x00040e00
 
diff --git a/src/include/xen/xen.h b/src/include/xen/xen.h
index c35008aa0..6d8192f8d 100644
--- a/src/include/xen/xen.h
+++ b/src/include/xen/xen.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_XEN_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "xen-compat.h"
 
-- 
cgit v1.2.3-55-g7522