Re: Xen XSM/FLASK policy, grub defaults, etc.

[Jan Beulich <jbeulich@xxxxxxxx>]

On 27.05.2020 18:08, George Dunlap wrote:
>> On May 27, 2020, at 4:41 PM, Ian Jackson <ian.jackson@xxxxxxxxxx> wrote:
>> 2. Xen should disable the XSM policy build when FLASK is disabled.
>> This is unfortunately not so simple because the XSM policy build is a
>> tools option and FLASK is a Xen option and the configuration systems
>> are disjoint.  But at the very least a default build, which has no XSM
>> support, should not build an XSM policy file either.
> 
> A simple thing to do here would be to have the flask policy controlled by a 
> configure --flask option.  If neither --flask nor --no-flask is specified, we 
> could maybe have configure also check the contents of xen/.config to see if 
> CONFIG_XSM_FLASK is enabled?

But that's creating a chicken-and-egg problem: There's no ordering
between the tools/ and xen/ builds. xen/ may not be built at all,
and this is going to become increasingly likely once the xen/ part
of the tree supports out-of-tree builds (at least I'll switch most
of my build trees to that model as soon as it's available).

Do we perhaps need to resort to a make command line option, usable
at the top level as well as for major subtree builds, and being
honored (as long as set either way, falling back to current
behavior if unset) by both ./configure and the hypervisor's
Kconfig?

Jan