[build] Mark existing files as explicitly forbidden for Secure Boot

The third-party 802.11 stack and NFS protocol code are known to
include multiple potential vulnerabilities and are explicitly
forbidden from being included in Secure Boot signed builds.  This is
currently handled at the per-directory level by defining a list of
source directories (SRCDIRS_INSEC) that are to be excluded from Secure
Boot builds.

Annotate all files in these directories with FILE_SECBOOT() to convey
this information to the new per-file Secure Boot permissibility check,
and remove the old separation between SRCDIRS and SRCDIRS_INSEC.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

src/Makefile

@@ -107,16 +107,12 @@ SRCDIRS		+= hci/mucurses hci/mucurses/widgets
 SRCDIRS		+= hci/keymap
 SRCDIRS		+= usr
 SRCDIRS		+= config
-
+SRCDIRS		+= net/oncrpc
-# These directories contain code that is not eligible for UEFI Secure
+SRCDIRS		+= net/80211
-# Boot signing.
+SRCDIRS		+= drivers/net/rtl818x
-#
+SRCDIRS		+= drivers/net/ath
-SRCDIRS_INSEC	+= net/oncrpc
+SRCDIRS		+= drivers/net/ath/ath5k
-SRCDIRS_INSEC	+= net/80211
+SRCDIRS		+= drivers/net/ath/ath9k
-SRCDIRS_INSEC	+= drivers/net/rtl818x
-SRCDIRS_INSEC	+= drivers/net/ath
-SRCDIRS_INSEC	+= drivers/net/ath/ath5k
-SRCDIRS_INSEC	+= drivers/net/ath/ath9k
 
 # NON_AUTO_SRCS lists files that are excluded from the normal
 # automatic build system.

src/Makefile.housekeeping

@@ -436,11 +436,6 @@ endif
 #
 # Source file handling
 
-# Exclude known-insecure files from Secure Boot builds
-ifeq ($(SECUREBOOT),0)
-SRCDIRS		+= $(SRCDIRS_INSEC)
-endif
-
 # SRCDIRS lists all directories containing source files.
 srcdirs :
 	@$(ECHO) $(SRCDIRS)

src/drivers/net/ath/ath.h

@@ -21,6 +21,7 @@
 #define ATH_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <unistd.h>
 #include <string.h>

src/drivers/net/ath/ath5k/ath5k.c

@@ -44,6 +44,7 @@
  */
 
 FILE_LICENCE ( BSD3 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <stdlib.h>
 #include <ipxe/malloc.h>

src/drivers/net/ath/ath5k/ath5k.h

@@ -22,6 +22,7 @@
 #define _ATH5K_H
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <stddef.h>
 #include <string.h>

src/drivers/net/ath/ath5k/ath5k_attach.c

@@ -20,6 +20,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /*************************************\
 * Attach/Detach Functions and helpers *

src/drivers/net/ath/ath5k/ath5k_caps.c

@@ -20,6 +20,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /**************\
 * Capabilities *

src/drivers/net/ath/ath5k/ath5k_desc.c

@@ -20,6 +20,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /******************************\
  Hardware Descriptor Functions

src/drivers/net/ath/ath5k/ath5k_dma.c

@@ -19,6 +19,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /*************************************\
 * DMA and interrupt masking functions *

src/drivers/net/ath/ath5k/ath5k_eeprom.c

@@ -20,6 +20,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /*************************************\
 * EEPROM access functions and helpers *

src/drivers/net/ath/ath5k/ath5k_gpio.c

@@ -19,6 +19,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /****************\
   GPIO Functions

src/drivers/net/ath/ath5k/ath5k_initvals.c

@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <unistd.h>
 

src/drivers/net/ath/ath5k/ath5k_pcu.c

@@ -23,6 +23,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /*********************************\
 * Protocol Control Unit Functions *

src/drivers/net/ath/ath5k/ath5k_phy.c

@@ -23,6 +23,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define _ATH5K_PHY
 

src/drivers/net/ath/ath5k/ath5k_qcu.c

@@ -19,6 +19,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 /********************************************\
 Queue Control Unit, DFS Control Unit Functions

src/drivers/net/ath/ath5k/ath5k_reset.c

@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define _ATH5K_RESET
 

src/drivers/net/ath/ath5k/ath5k_rfkill.c

@@ -35,6 +35,7 @@
  */
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "base.h"
 

src/drivers/net/ath/ath5k/base.h

@@ -45,6 +45,7 @@
 #define _DEV_ATH_ATHVAR_H
 
 FILE_LICENCE ( BSD3 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "ath5k.h"
 #include <ipxe/iobuf.h>

src/drivers/net/ath/ath5k/desc.h

@@ -16,6 +16,8 @@
  *
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /*
  * Internal RX/TX descriptor structures
  * (rX: reserved fields possibily used by future versions of the ar5k chipset)

src/drivers/net/ath/ath5k/eeprom.h

@@ -16,6 +16,8 @@
  *
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /*
  * Common ar5xxx EEPROM data offsets (set these on AR5K_EEPROM_BASE)
  */

src/drivers/net/ath/ath5k/reg.h

@@ -17,6 +17,8 @@
  *
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /*
  * Register values for Atheros 5210/5211/5212 cards from OpenBSD's ar5k
  * maintained by Reyk Floeter

src/drivers/net/ath/ath5k/rfbuffer.h

@@ -17,6 +17,7 @@
  *
  */
 
+FILE_SECBOOT ( FORBIDDEN );
 
 /*
  * There are some special registers on the RF chip

src/drivers/net/ath/ath5k/rfgain.h

@@ -18,6 +18,8 @@
  *
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /*
  * Mode-specific RF Gain table (64bytes) for RF5111/5112
  * (RF5110 only comes with AR5210 and only supports a/turbo a mode so initial

src/drivers/net/ath/ath9k/ani.h

@@ -21,6 +21,7 @@
 #define ANI_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define HAL_PROCESS_ANI           0x00000001
 

src/drivers/net/ath/ath9k/ar5008_initvals.h

@@ -15,6 +15,7 @@
  */
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 static const u32 ar5416Modes[][6] = {
 	{0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0},

src/drivers/net/ath/ath9k/ar9001_initvals.h

@@ -15,6 +15,7 @@
  */
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 static const u32 ar5416Modes_9100[][6] = {
 	{0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0},

src/drivers/net/ath/ath9k/ar9002_initvals.h

@@ -15,6 +15,7 @@
  */
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 static __unused const u32 ar9280Modes_9280_2[][6] = {
 	{0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0},

src/drivers/net/ath/ath9k/ar9002_phy.h

@@ -17,6 +17,7 @@
 #define AR9002_PHY_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define AR_PHY_TEST             0x9800
 #define PHY_AGC_CLR             0x10000000

src/drivers/net/ath/ath9k/ar9003_2p2_initvals.h

@@ -17,6 +17,8 @@
 #ifndef INITVALS_9003_2P2_H
 #define INITVALS_9003_2P2_H
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /* AR9003 2.2 */
 
 static __unused const u32 ar9300_2p2_radio_postamble[][5] = {

src/drivers/net/ath/ath9k/ar9003_eeprom.h

@@ -21,6 +21,7 @@
 #define AR9003_EEPROM_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define AR9300_EEP_VER               0xD000
 #define AR9300_EEP_VER_MINOR_MASK    0xFFF

src/drivers/net/ath/ath9k/ar9003_mac.h

@@ -20,6 +20,8 @@
 #ifndef AR9003_MAC_H
 #define AR9003_MAC_H
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #define AR_DescId	0xffff0000
 #define AR_DescId_S	16
 #define AR_CtrlStat	0x00004000

src/drivers/net/ath/ath9k/ar9003_phy.h

@@ -17,6 +17,8 @@
 #ifndef AR9003_PHY_H
 #define AR9003_PHY_H
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /*
  * Channel Register Map
  */

src/drivers/net/ath/ath9k/ar9340_initvals.h

@@ -17,6 +17,8 @@
 #ifndef INITVALS_9340_H
 #define INITVALS_9340_H
 
+FILE_SECBOOT ( FORBIDDEN );
+
 static __unused const u32 ar9340_1p0_radio_postamble[][5] = {
 	/*  Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20  */
 	{0x000160ac, 0xa4646800, 0xa4646800, 0xa4646800, 0xa4646800},

src/drivers/net/ath/ath9k/ar9485_initvals.h

@@ -17,6 +17,8 @@
 #ifndef INITVALS_9485_H
 #define INITVALS_9485_H
 
+FILE_SECBOOT ( FORBIDDEN );
+
 static __unused const u32 ar9485_1_1_mac_core[][2] = {
 	/*  Addr       allmodes */
 	{0x00000008, 0x00000000},

src/drivers/net/ath/ath9k/ath9k.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/pci.h>
 
 #include "ath9k.h"

src/drivers/net/ath/ath9k/ath9k.h

@@ -21,6 +21,7 @@
 #define ATH9K_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "common.h"
 

src/drivers/net/ath/ath9k/ath9k_ani.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include "hw.h"
 #include "hw-ops.h"
 

src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/malloc.h>
 #include <ipxe/io.h>
 

src/drivers/net/ath/ath9k/ath9k_ar9002_calib.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include "hw.h"
 #include "hw-ops.h"
 #include "ar9002_phy.h"

src/drivers/net/ath/ath9k/ath9k_ar9002_hw.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "hw.h"
 #include "ar5008_initvals.h"

src/drivers/net/ath/ath9k/ath9k_ar9002_mac.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /**
  * DOC: Programming Atheros 802.11n analog front end radios
  *

src/drivers/net/ath/ath9k/ath9k_ar9003_calib.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_ar9003_eeprom.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 #include <ipxe/malloc.h>
 

src/drivers/net/ath/ath9k/ath9k_ar9003_hw.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include "hw.h"
 #include "ar9003_mac.h"
 #include "ar9003_2p2_initvals.h"

src/drivers/net/ath/ath9k/ath9k_ar9003_mac.c

@@ -16,6 +16,9 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
+
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_calib.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include "hw.h"
 #include "hw-ops.h"
 

src/drivers/net/ath/ath9k/ath9k_common.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 /*
  * Module for common driver code between ath9k and ath9k_htc
  */

src/drivers/net/ath/ath9k/ath9k_eeprom.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_eeprom_def.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_hw.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/vsprintf.h>
 #include <ipxe/io.h>
 

src/drivers/net/ath/ath9k/ath9k_init.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <ipxe/malloc.h>
 #include <ipxe/pci_io.h>

src/drivers/net/ath/ath9k/ath9k_mac.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "hw.h"

src/drivers/net/ath/ath9k/ath9k_main.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "ath9k.h"

src/drivers/net/ath/ath9k/ath9k_recv.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "ath9k.h"

src/drivers/net/ath/ath9k/ath9k_xmit.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "ath9k.h"

src/drivers/net/ath/ath9k/calib.h

@@ -21,6 +21,7 @@
 #define CALIB_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "hw.h"
 

src/drivers/net/ath/ath9k/common.h

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "../ath.h"
 

src/drivers/net/ath/ath9k/eeprom.h

@@ -21,6 +21,7 @@
 #define EEPROM_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define AR_EEPROM_MODAL_SPURS   5
 

src/drivers/net/ath/ath9k/hw-ops.h

@@ -18,6 +18,7 @@
 #define ATH9K_HW_OPS_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "hw.h"
 

src/drivers/net/ath/ath9k/hw.h

@@ -21,6 +21,7 @@
 #define HW_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <errno.h>
 

src/drivers/net/ath/ath9k/mac.h

@@ -21,6 +21,7 @@
 #define MAC_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <unistd.h>
 

src/drivers/net/ath/ath9k/phy.h

@@ -18,6 +18,7 @@
 #define PHY_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define CHANSEL_DIV		15
 #define CHANSEL_2G(_freq)	(((_freq) * 0x10000) / CHANSEL_DIV)

src/drivers/net/ath/ath9k/reg.h

@@ -18,6 +18,7 @@
 #define REG_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "../reg.h"
 

src/drivers/net/ath/ath_hw.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <ipxe/io.h>
 
 #include "ath.h"

src/drivers/net/ath/ath_key.c

@@ -18,6 +18,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include "ath.h"
 #include "reg.h"
 

src/drivers/net/ath/ath_regd.c

@@ -17,6 +17,8 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include "regd.h"
 #include "regd_common.h"
 

src/drivers/net/ath/reg.h

@@ -21,6 +21,7 @@
 #define ATH_REGISTERS_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #define AR_MIBC			0x0040
 #define AR_MIBC_COW		0x00000001

src/drivers/net/ath/regd.h

@@ -21,6 +21,7 @@
 #define REGD_H
 
 FILE_LICENCE ( BSD2 );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include "ath.h"
 

src/drivers/net/ath/regd_common.h

@@ -20,6 +20,8 @@
 #ifndef REGD_COMMON_H
 #define REGD_COMMON_H
 
+FILE_SECBOOT ( FORBIDDEN );
+
 enum EnumRd {
 	NO_ENUMRD = 0x00,
 	NULL1_WORLD = 0x03,

src/drivers/net/rtl818x/rtl8180.c

@@ -1,6 +1,7 @@
 /* Realtek 8180 card: rtl818x driver + rtl8180 RF modules */
 
 FILE_LICENCE(GPL2_OR_LATER);
+FILE_SECBOOT(FORBIDDEN);
 
 #include <ipxe/pci.h>
 #include "rtl818x.h"

src/drivers/net/rtl818x/rtl8180_grf5101.c

@@ -27,6 +27,7 @@
 #include "rtl818x.h"
 
 FILE_LICENCE(GPL2_ONLY);
+FILE_SECBOOT(FORBIDDEN);
 
 #define GRF5101_ANTENNA 0xA3
 

src/drivers/net/rtl818x/rtl8180_max2820.c

@@ -27,6 +27,7 @@
 #include "rtl818x.h"
 
 FILE_LICENCE(GPL2_ONLY);
+FILE_SECBOOT(FORBIDDEN);
 
 #define MAXIM_ANTENNA 0xb3
 

src/drivers/net/rtl818x/rtl8180_sa2400.c

@@ -27,6 +27,7 @@
 #include "rtl818x.h"
 
 FILE_LICENCE(GPL2_ONLY);
+FILE_SECBOOT(FORBIDDEN);
 
 #define SA2400_ANTENNA 0x91
 #define SA2400_DIG_ANAPARAM_PWR1_ON 0x8

src/drivers/net/rtl818x/rtl8185.c

@@ -1,6 +1,7 @@
 /* Realtek 8185 card: rtl818x driver + rtl8185_rtl8225 RF module */
 
 FILE_LICENCE(GPL2_OR_LATER);
+FILE_SECBOOT(FORBIDDEN);
 
 #include <ipxe/pci.h>
 #include "rtl818x.h"

src/drivers/net/rtl818x/rtl8185_rtl8225.c

@@ -23,6 +23,7 @@
 #include "rtl818x.h"
 
 FILE_LICENCE(GPL2_ONLY);
+FILE_SECBOOT(FORBIDDEN);
 
 #define RTL8225_ANAPARAM_ON	0xa0000b59
 #define RTL8225_ANAPARAM2_ON	0x860dec11

src/drivers/net/rtl818x/rtl818x.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE(GPL2_ONLY);
+FILE_SECBOOT(FORBIDDEN);
 
 #include <stdint.h>
 #include <string.h>

src/drivers/net/rtl818x/rtl818x.h

@@ -22,6 +22,7 @@
 #include <ipxe/net80211.h>
 
 FILE_LICENCE(GPL2_ONLY);
+FILE_SECBOOT(FORBIDDEN);
 
 struct rtl818x_csr {
 	u8	MAC[6];

src/net/80211/net80211.c

@@ -20,6 +20,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <string.h>
 #include <byteswap.h>

src/net/80211/rc80211.c

@@ -20,6 +20,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <stdlib.h>
 #include <ipxe/net80211.h>

src/net/80211/sec80211.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <stdlib.h>
 #include <string.h>

src/net/80211/wep.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <ipxe/net80211.h>
 #include <ipxe/sec80211.h>

src/net/80211/wpa.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <ipxe/net80211.h>
 #include <ipxe/sec80211.h>

src/net/80211/wpa_ccmp.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <string.h>
 #include <ipxe/net80211.h>

src/net/80211/wpa_psk.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <string.h>
 #include <ipxe/net80211.h>

src/net/80211/wpa_tkip.c

@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( FORBIDDEN );
 
 #include <string.h>
 #include <ipxe/net80211.h>

src/net/oncrpc/mount.c

@@ -17,6 +17,8 @@
  * 02110-1301, USA.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>

src/net/oncrpc/nfs.c

@@ -17,6 +17,8 @@
  * 02110-1301, USA.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>

src/net/oncrpc/nfs_open.c

@@ -17,6 +17,8 @@
  * 02110-1301, USA.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>

src/net/oncrpc/nfs_uri.c

@@ -17,6 +17,8 @@
  * 02110-1301, USA.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>

src/net/oncrpc/oncrpc_iob.c

@@ -17,6 +17,8 @@
  * 02110-1301, USA.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>

src/net/oncrpc/portmap.c

@@ -17,6 +17,8 @@
  * 02110-1301, USA.
  */
 
+FILE_SECBOOT ( FORBIDDEN );
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <stdio.h>