anchor.diff:        XEN_PVH                     = option yes;
         XEN_PVHVM                   = option yes;
         XEN_SAVE_RESTORE            = option yes;
  -      XEN_SCRUB_PAGES             = option yes;
  -      XEN_SELFBALLOONING          = option yes;
  -      XEN_STUB                    = option yes;
  -      XEN_TMEM                    = option yes;
  +      XEN_SCRUB_PAGES             = whenOlder "4.19" yes;
  +      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
       };
   
       media = {
  
positive.code:       DEBUG_DEVRES              = no;
        DYNAMIC_DEBUG             = yes;
        DEBUG_STACK_USAGE         = no;
        DEBUG_STACKOVERFLOW       = option no;
        RCU_TORTURE_TEST          = no;
        SCHEDSTATS                = no;
        DETECT_HUNG_TASK          = yes;
  
negative.code:       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
        # Depends on MODULE_SIG and only really helps when you sign your modules
        # and enforce signatures which we don't do by default.
        SECURITY_LOCKDOWN_LSM = whenAtLeast "5.4" no;
  
        # provides a register of persistent per-UID keyrings, useful for encrypting storage pools in stratis
        PERSISTENT_KEYRINGS              = yes;
  