anchor.diff:        PARAVIRT_SPINLOCKS  = option yes;
   
         KVM_ASYNC_PF                      = yes;
  -      KVM_COMPAT = { optional = true; tristate = whenBetween "4.0" "4.12" "y"; };
  -      KVM_DEVICE_ASSIGNMENT  = { optional = true; tristate = whenBetween "3.10" "4.12" "y"; };
  +      KVM_COMPAT                        = whenOlder "4.12" (option yes);
  +      KVM_DEVICE_ASSIGNMENT             = whenOlder "4.12" (option yes);
         KVM_GENERIC_DIRTYLOG_READ_PROTECT = yes;
         KVM_GUEST                         = yes;
         KVM_MMIO                          = yes;
  
positive.code:       DRM_GMA600             = whenOlder "5.13" yes;
        DRM_GMA3600            = whenOlder "5.12" yes;
        DRM_VMWGFX_FBCON       = yes;
        # necessary for amdgpu polaris support
        DRM_AMD_POWERPLAY = whenBetween "4.5" "4.9" yes;
        # (experimental) amdgpu support for verde and newer chipsets
        DRM_AMDGPU_SI = yes;
        # (stable) amdgpu support for bonaire and newer chipsets
  
negative.code:       # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
        DEBUG_LIST                       = yes;
        # Detect writes to read-only module pages
        DEBUG_SET_MODULE_RONX            = whenOlder "4.11" (option yes);
        RANDOMIZE_BASE                   = option yes;
        STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
        IO_STRICT_DEVMEM                 = mkDefault yes;
  