Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> wrote: > > + if (IS_ENABLED(CONFIG_EFI)) { > > Shouldn't this be a runtime check? Interesting question. The original patch I was working from had a #ifdef here. Possibly it doesn't need to be there at all. We could rely entirely on the value of boot_params.secure_boot. David -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html