Re: Query Regarding Backporting klp-build from Linux 6.19 to 6.12.x

[Joe Lawrence <joe.lawrence@redhat.com>]

On Thu, Jul 23, 2026 at 05:58:58PM +0530, ahamed wrote:
> Hi Josh,
>
> I hope you're doing well.
>
> We're currently using Linux kernel versions 6.12.74 and 6.12.90 in our
> environment. We have been using kpatch-build for livepatch generation,
> but it doesn't work on these kernels because CONFIG_X86_KERNEL_IBT is
> enabled.
>
> Since IBT is an important security feature, disabling
> CONFIG_X86_KERNEL_IBT is not an option for us.
>
> While looking for alternatives, I came across the new klp-build
> infrastructure that was introduced upstream in Linux 6.19. I also
> found your patch series:
>
> https://lists.openwall.net/linux-kernel/2025/06/26/1920
>
> From what I understand, this series introduces the new klp-build
> workflow along with the required objtool and livepatch infrastructure.
>
> I wanted to ask whether it would be feasible to backport this entire
> patch series to Linux 6.12.74/6.12.90.
>
> Specifically:
>
> Would backporting the complete klp-build patch series be sufficient to
> make klp-build functional on a 6.12 kernel?
> Are there any additional dependencies or upstream changes outside this
> patch series that would also need to be backported?
> Have you or anyone else attempted such a backport, or would you expect
> significant compatibility issues with the 6.12 stable kernel?
> In your opinion, is backporting klp-build to 6.12 a practical
> approach, or would you recommend another solution?
>
> Any guidance or recommendations would be greatly appreciated.
>
> Thank you for your time and for all the work you've done on the new
> livepatch infrastructure.
>

Hello Ahamed,

I'm replying to your mail here since this one is on the list and the
info might be helpful to fellow travelers.

The klp-build tool and support infra should be backport-able to a 6.12
downstream kernel if you are diligent in tracking all the dependencies.
I don't think there was a definitive commit list, but you could get a
massive headstart by looking at the CentOS-Stream-10 kernel [1], which
is also based on 6.12.

If my gitlab search foo is correct, these would be the MRs in
chronological order for cs-10 objtool:

  objtool: selected fixes for rhel-10.1
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/580

  objtool: rebase to 6.15 with supporting commits
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/995

  objtool: backport v6.17 updates to rhel-10.2
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1737

  objtool: backport klp-build and late fixes
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1964

  module.lds: force 0 sh_addr for .text, .data, .bss, and .rodata sections
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2213

  objtool: backport v7.0 updates to rhel-10.3
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2589

  objtool: backport v7.1 updates to rhel-10.3
  https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2793

Keep in mind those ~200 backports are for the entire objtool and
supporting patchsets, with some skipped along the way.  And to a
downstream moving CentOS-Stream franken-kernel.  Stable 6.12.74 and
6.12.90 may be more or less work, I don't know.

Good luck!

[1] https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10

--
Joe