X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=47b44567ca6169775d0a95478d02e09defaf85ac;hb=17c22224ac5b20c3d0ed49e7859642756e178bd9;hp=2084ea8bbb63a7b7d4421e984fc067d533c103d1;hpb=918b12cf6f652ad148c885d1a802459e73d20c48;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index 2084ea8..47b4456 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -232,6 +232,8 @@ def construct_checklist(checklist, arch):
                         OptCheck('DEBUG_SET_MODULE_RONX',    'y', 'defconfig', 'self_protection'), \
                         modules_not_set)) # DEBUG_SET_MODULE_RONX was before v4.11
     checklist.append(OptCheck('GCC_PLUGINS',                 'y', 'defconfig', 'self_protection'))
+    checklist.append(OR(OptCheck('REFCOUNT_FULL',               'y', 'defconfig', 'self_protection'), \
+                        VerCheck((5, 5)))) # REFCOUNT_FULL is enabled by default since v5.5
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('MICROCODE',                   'y', 'defconfig', 'self_protection')) # is needed for mitigating CPU bugs
         checklist.append(OptCheck('RETPOLINE',                   'y', 'defconfig', 'self_protection'))
@@ -262,7 +264,6 @@ def construct_checklist(checklist, arch):
         checklist.append(OptCheck('CPU_SW_DOMAIN_PAN',           'y', 'defconfig', 'self_protection'))
         checklist.append(OptCheck('STACKPROTECTOR_PER_TASK',     'y', 'defconfig', 'self_protection'))
     if debug_mode or arch == 'ARM64' or arch == 'ARM':
-        checklist.append(OptCheck('REFCOUNT_FULL',               'y', 'defconfig', 'self_protection'))
         checklist.append(OptCheck('HARDEN_BRANCH_PREDICTOR',     'y', 'defconfig', 'self_protection'))
 
     checklist.append(OptCheck('BUG_ON_DATA_CORRUPTION',           'y', 'kspp', 'self_protection'))
@@ -293,7 +294,6 @@ def construct_checklist(checklist, arch):
                         modules_not_set)) # refers to LOCK_DOWN_KERNEL
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR',            '65536', 'kspp', 'self_protection'))
-        checklist.append(OptCheck('REFCOUNT_FULL',                    'y', 'kspp', 'self_protection'))
     if debug_mode or arch == 'X86_32':
         checklist.append(OptCheck('HIGHMEM64G',                       'y', 'kspp', 'self_protection'))
         checklist.append(OptCheck('X86_PAE',                          'y', 'kspp', 'self_protection'))