Re: Query Regarding Backporting klp-build from Linux 6.19 to 6.12.x

[Joe Lawrence <joe.lawrence@redhat.com>]

On 7/23/26 9:05 AM, Joe Lawrence wrote:
> On Thu, Jul 23, 2026 at 05:58:58PM +0530, ahamed wrote:
>> Hi Josh,
>>
>> I hope you're doing well.
>>
>> We're currently using Linux kernel versions 6.12.74 and 6.12.90 in our
>> environment. We have been using kpatch-build for livepatch generation,
>> but it doesn't work on these kernels because CONFIG_X86_KERNEL_IBT is
>> enabled.
>>
>> Since IBT is an important security feature, disabling
>> CONFIG_X86_KERNEL_IBT is not an option for us.
>>
>> While looking for alternatives, I came across the new klp-build
>> infrastructure that was introduced upstream in Linux 6.19. I also
>> found your patch series:
>>
>> https://lists.openwall.net/linux-kernel/2025/06/26/1920
>>
>> From what I understand, this series introduces the new klp-build
>> workflow along with the required objtool and livepatch infrastructure.
>>
>> I wanted to ask whether it would be feasible to backport this entire
>> patch series to Linux 6.12.74/6.12.90.
>>
>> Specifically:
>>
>> Would backporting the complete klp-build patch series be sufficient to
>> make klp-build functional on a 6.12 kernel?
>> Are there any additional dependencies or upstream changes outside this
>> patch series that would also need to be backported?
>> Have you or anyone else attempted such a backport, or would you expect
>> significant compatibility issues with the 6.12 stable kernel?
>> In your opinion, is backporting klp-build to 6.12 a practical
>> approach, or would you recommend another solution?
>>
>> Any guidance or recommendations would be greatly appreciated.
>>
>> Thank you for your time and for all the work you've done on the new
>> livepatch infrastructure.
>>
> 
> Hello Ahamed,
> 
> I'm replying to your mail here since this one is on the list and the
> info might be helpful to fellow travelers.
> 
> The klp-build tool and support infra should be backport-able to a 6.12
> downstream kernel if you are diligent in tracking all the dependencies.
> I don't think there was a definitive commit list, but you could get a
> massive headstart by looking at the CentOS-Stream-10 kernel [1], which
> is also based on 6.12.
> 
> If my gitlab search foo is correct, these would be the MRs in
> chronological order for cs-10 objtool:
> 
>   objtool: selected fixes for rhel-10.1
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/580
> 
>   objtool: rebase to 6.15 with supporting commits
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/995
> 
>   objtool: backport v6.17 updates to rhel-10.2
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1737
> 
>   objtool: backport klp-build and late fixes
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1964
> 
>   module.lds: force 0 sh_addr for .text, .data, .bss, and .rodata sections
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2213
> 
>   objtool: backport v7.0 updates to rhel-10.3
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2589
> 
>   objtool: backport v7.1 updates to rhel-10.3
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2793
> 
> Keep in mind those ~200 backports are for the entire objtool and
> supporting patchsets, with some skipped along the way.  And to a
> downstream moving CentOS-Stream franken-kernel.  Stable 6.12.74 and
> 6.12.90 may be more or less work, I don't know.
> 
> Good luck!
> 
> [1] https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10
> 
Ahamed asked a follow up that I'll answer here, in case it's helpful to
anyone else backporting klp-build patches:

"If we successfully backport the complete klp-build infrastructure to
Linux 6.12 and use it to build a livepatch module, should that module
be expected to load on other unmodified Linux 6.12.74/6.12.90 systems
running the same kernel version and configuration?"

This is possible, but you will need to be very careful about potential
binary output differences.  For example:

  1735858caa4b ("objtool/x86: Reorder ORC register numbering")

would change constants like ORC_REG_AX, ORC_REG_SP, etc. in the
livepatch.ko and could mismatch the target kernel's values for those.
You will want to evaluate such changes on a per-commit backport basis.

-- 
Joe