1 files changed, 19 insertions, 17 deletions

diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 549f6d3aec5b..55347662e5ed 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -1037,24 +1037,26 @@ config ARCH_SUPPORTS_BIG_ENDIAN
           This option specifies the architecture can support big endian
           operation.
 
-config ARM_KERNMEM_PERMS
-        bool "Restrict kernel memory permissions"
-        depends on MMU
-        help
-          If this is set, kernel memory other than kernel text (and rodata)
-          will be made non-executable. The tradeoff is that each region is
-          padded to section-size (1MiB) boundaries (because their permissions
-          are different and splitting the 1M pages into 4K ones causes TLB
-          performance problems), wasting memory.
-
 config DEBUG_RODATA
         bool "Make kernel text and rodata read-only"
-        depends on ARM_KERNMEM_PERMS
+        depends on MMU && !XIP_KERNEL
+        default y if CPU_V7
+        help
+          If this is set, kernel text and rodata memory will be made
+          read-only, and non-text kernel memory will be made non-executable.
+          The tradeoff is that each region is padded to section-size (1MiB)
+          boundaries (because their permissions are different and splitting
+          the 1M pages into 4K ones causes TLB performance problems), which
+          can waste memory.
+
+config DEBUG_ALIGN_RODATA
+        bool "Make rodata strictly non-executable"
+        depends on DEBUG_RODATA
         default y
         help
-          If this is set, kernel text and rodata will be made read-only. This
-          is to help catch accidental or malicious attempts to change the
-          kernel's executable code. Additionally splits rodata from kernel
-          text so it can be made explicitly non-executable. This creates
-          another section-size padded region, so it can waste more memory
-          space while gaining the read-only protections.
+          If this is set, rodata will be made explicitly non-executable. This
+          provides protection on the rare chance that attackers might find and
+          use ROP gadgets that exist in the rodata section. This adds an
+          additional section-aligned split of rodata from kernel text so it
+          can be made explicitly non-executable. This padding may waste memory
+          space to gain the additional protection.