Query Regarding Backporting klp-build from Linux 6.19 to 6.12.x

Query Regarding Backporting klp-build from Linux 6.19 to 6.12.x

[ahamed]

Hi Josh,

I hope you're doing well.

We're currently using Linux kernel versions 6.12.74 and 6.12.90 in our
environment. We have been using kpatch-build for livepatch generation,
but it doesn't work on these kernels because CONFIG_X86_KERNEL_IBT is
enabled.

Since IBT is an important security feature, disabling
CONFIG_X86_KERNEL_IBT is not an option for us.

While looking for alternatives, I came across the new klp-build
infrastructure that was introduced upstream in Linux 6.19. I also
found your patch series:

https://lists.openwall.net/linux-kernel/2025/06/26/1920

From what I understand, this series introduces the new klp-build
workflow along with the required objtool and livepatch infrastructure.

I wanted to ask whether it would be feasible to backport this entire
patch series to Linux 6.12.74/6.12.90.

Specifically:

Would backporting the complete klp-build patch series be sufficient to
make klp-build functional on a 6.12 kernel?
Are there any additional dependencies or upstream changes outside this
patch series that would also need to be backported?
Have you or anyone else attempted such a backport, or would you expect
significant compatibility issues with the 6.12 stable kernel?
In your opinion, is backporting klp-build to 6.12 a practical
approach, or would you recommend another solution?

Any guidance or recommendations would be greatly appreciated.

Thank you for your time and for all the work you've done on the new
livepatch infrastructure.

Best regards,

Ahamed

Re: Query Regarding Backporting klp-build from Linux 6.19 to 6.12.x

[Joe Lawrence]

On Thu, Jul 23, 2026 at 05:58:58PM +0530, ahamed wrote:
> Hi Josh,
>
> I hope you're doing well.
>
> We're currently using Linux kernel versions 6.12.74 and 6.12.90 in our
> environment. We have been using kpatch-build for livepatch generation,
> but it doesn't work on these kernels because CONFIG_X86_KERNEL_IBT is
> enabled.
>
> Since IBT is an important security feature, disabling
> CONFIG_X86_KERNEL_IBT is not an option for us.
>
> While looking for alternatives, I came across the new klp-build
> infrastructure that was introduced upstream in Linux 6.19. I also
> found your patch series:
>
> https://lists.openwall.net/linux-kernel/2025/06/26/1920
>
> From what I understand, this series introduces the new klp-build
> workflow along with the required objtool and livepatch infrastructure.
>
> I wanted to ask whether it would be feasible to backport this entire
> patch series to Linux 6.12.74/6.12.90.
>
> Specifically:
>
> Would backporting the complete klp-build patch series be sufficient to
> make klp-build functional on a 6.12 kernel?
> Are there any additional dependencies or upstream changes outside this
> patch series that would also need to be backported?
> Have you or anyone else attempted such a backport, or would you expect
> significant compatibility issues with the 6.12 stable kernel?
> In your opinion, is backporting klp-build to 6.12 a practical
> approach, or would you recommend another solution?
>
> Any guidance or recommendations would be greatly appreciated.
>
> Thank you for your time and for all the work you've done on the new
> livepatch infrastructure.
>

Hello Ahamed,

I'm replying to your mail here since this one is on the list and the
info might be helpful to fellow travelers.

The klp-build tool and support infra should be backport-able to a 6.12
downstream kernel if you are diligent in tracking all the dependencies.
I don't think there was a definitive commit list, but you could get a
massive headstart by looking at the CentOS-Stream-10 kernel [1], which
is also based on 6.12.

If my gitlab search foo is correct, these would be the MRs in
chronological order for cs-10 objtool:

  objtool: selected fixes for rhel-10.1
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/580

  objtool: rebase to 6.15 with supporting commits
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/995

  objtool: backport v6.17 updates to rhel-10.2
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1737

  objtool: backport klp-build and late fixes
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1964

  module.lds: force 0 sh_addr for .text, .data, .bss, and .rodata sections
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2213

  objtool: backport v7.0 updates to rhel-10.3
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2589

  objtool: backport v7.1 updates to rhel-10.3
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2793

Keep in mind those ~200 backports are for the entire objtool and
supporting patchsets, with some skipped along the way.  And to a
downstream moving CentOS-Stream franken-kernel.  Stable 6.12.74 and
6.12.90 may be more or less work, I don't know.

Good luck!

[1] https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10

--
Joe

Re: Query Regarding Backporting klp-build from Linux 6.19 to 6.12.x

[Joe Lawrence]

On 7/23/26 9:05 AM, Joe Lawrence wrote:
> On Thu, Jul 23, 2026 at 05:58:58PM +0530, ahamed wrote:
>> Hi Josh,
>>
>> I hope you're doing well.
>>
>> We're currently using Linux kernel versions 6.12.74 and 6.12.90 in our
>> environment. We have been using kpatch-build for livepatch generation,
>> but it doesn't work on these kernels because CONFIG_X86_KERNEL_IBT is
>> enabled.
>>
>> Since IBT is an important security feature, disabling
>> CONFIG_X86_KERNEL_IBT is not an option for us.
>>
>> While looking for alternatives, I came across the new klp-build
>> infrastructure that was introduced upstream in Linux 6.19. I also
>> found your patch series:
>>
>> https://lists.openwall.net/linux-kernel/2025/06/26/1920
>>
>> From what I understand, this series introduces the new klp-build
>> workflow along with the required objtool and livepatch infrastructure.
>>
>> I wanted to ask whether it would be feasible to backport this entire
>> patch series to Linux 6.12.74/6.12.90.
>>
>> Specifically:
>>
>> Would backporting the complete klp-build patch series be sufficient to
>> make klp-build functional on a 6.12 kernel?
>> Are there any additional dependencies or upstream changes outside this
>> patch series that would also need to be backported?
>> Have you or anyone else attempted such a backport, or would you expect
>> significant compatibility issues with the 6.12 stable kernel?
>> In your opinion, is backporting klp-build to 6.12 a practical
>> approach, or would you recommend another solution?
>>
>> Any guidance or recommendations would be greatly appreciated.
>>
>> Thank you for your time and for all the work you've done on the new
>> livepatch infrastructure.
>>
> 
> Hello Ahamed,
> 
> I'm replying to your mail here since this one is on the list and the
> info might be helpful to fellow travelers.
> 
> The klp-build tool and support infra should be backport-able to a 6.12
> downstream kernel if you are diligent in tracking all the dependencies.
> I don't think there was a definitive commit list, but you could get a
> massive headstart by looking at the CentOS-Stream-10 kernel [1], which
> is also based on 6.12.
> 
> If my gitlab search foo is correct, these would be the MRs in
> chronological order for cs-10 objtool:
> 
>   objtool: selected fixes for rhel-10.1
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/580
> 
>   objtool: rebase to 6.15 with supporting commits
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/995
> 
>   objtool: backport v6.17 updates to rhel-10.2
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1737
> 
>   objtool: backport klp-build and late fixes
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1964
> 
>   module.lds: force 0 sh_addr for .text, .data, .bss, and .rodata sections
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2213
> 
>   objtool: backport v7.0 updates to rhel-10.3
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2589
> 
>   objtool: backport v7.1 updates to rhel-10.3
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2793
> 
> Keep in mind those ~200 backports are for the entire objtool and
> supporting patchsets, with some skipped along the way.  And to a
> downstream moving CentOS-Stream franken-kernel.  Stable 6.12.74 and
> 6.12.90 may be more or less work, I don't know.
> 
> Good luck!
> 
> [1] https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10
> 
Ahamed asked a follow up that I'll answer here, in case it's helpful to
anyone else backporting klp-build patches:

"If we successfully backport the complete klp-build infrastructure to
Linux 6.12 and use it to build a livepatch module, should that module
be expected to load on other unmodified Linux 6.12.74/6.12.90 systems
running the same kernel version and configuration?"

This is possible, but you will need to be very careful about potential
binary output differences.  For example:

  1735858caa4b ("objtool/x86: Reorder ORC register numbering")

would change constants like ORC_REG_AX, ORC_REG_SP, etc. in the
livepatch.ko and could mismatch the target kernel's values for those.
You will want to evaluate such changes on a per-commit backport basis.

-- 
Joe