Skip to content

Bump openssl to 3.0 and dlopen it#420

Closed
evelikov wants to merge 5 commits into
kmod-project:masterfrom
evelikov:dlopen-openssl
Closed

Bump openssl to 3.0 and dlopen it#420
evelikov wants to merge 5 commits into
kmod-project:masterfrom
evelikov:dlopen-openssl

Conversation

@evelikov
Copy link
Copy Markdown
Collaborator

@evelikov evelikov commented Feb 8, 2026

Bit of a follow-up to #47, this allows us to dlopen the final dependency - openssl.

Due their unique versioning for 1.0/1.1 and extensive use of macros/inline functions in their API, I've bumped the requirement to 3.0 as a prep. This should be fine for anything but the deep maintenance more enterprise linuxes, which are not targeting the latest kmod AFAICT.

With that done, recommend the use of -D dlopen=all since it can bring measurable/noticable perf/memory improvements.

NOTE: while the compression libraries are tagged "recommended", libcrypto is only a suggested since the only user that I could find is modinfo.

@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 8, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 87.87879% with 4 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
libkmod/libkmod-signature.c 87.87% 2 Missing and 2 partials ⚠️
Files with missing lines Coverage Δ
libkmod/libkmod-signature.c 74.49% <87.87%> (+2.88%) ⬆️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@evelikov
Copy link
Copy Markdown
Collaborator Author

evelikov commented Feb 8, 2026

v2: Add/install a valgrind suppression file, to silence (most of) the complaints brought by using dlopen.

@evelikov
Copy link
Copy Markdown
Collaborator Author

evelikov commented Feb 10, 2026

v3:

  • don't add "openssl" to kmod.pc's module_compressions
  • remove unreachable DLSYM_LOCALLY_ENABLED block

@evelikov evelikov mentioned this pull request Feb 15, 2026
Draft
@evelikov evelikov requested a review from lucasdemarchi April 20, 2026 13:53
@evelikov evelikov added the for-lucas The code/issue needs a second pair of eyes and/or is ready to be merged by Lucas. label Apr 20, 2026
lucasdemarchi
lucasdemarchi reviewed Apr 23, 2026
View reviewed changes
Comment thread README.md Outdated
@lucasdemarchi lucasdemarchi added the status:reviewed The proposed change is in good condition and ready for merging. label Apr 23, 2026
evelikov and others added 5 commits April 24, 2026 09:55
@evelikov @lucasdemarchi
meson: bump minimal openssl/libcrypto to 3.0.0
74adeda 
OpenSSL 3.0 introduces semantic versioning, thus one can reason about
the supported (and/or broken) API/ABI by glancing at the number.

Version 3.0 was released in late 2021 and is adopted by, at least:
 - CentOS Stream 9
 - Debian 11 aka oldoldstable
 - Fedora 38
 - openSUSE Leap 15.5
 - Ubuntu 22.04

This means that some older, yet maintained, enterprise-y linuxes will be
left in the dark. Namely:
 - RHEL 6,7
 - SLES 11,12,15?
 - Ubuntu {14,16,18,20}.04

To the best of my knowledge, all of them are in deep maintenance mode
and do not target latest kmod releases.

Bumping the requirement, allows us to focus on a single DSO and its API,
as we move to dlopen(libcrypto.so) with the next commit(s).

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
@evelikov @lucasdemarchi
libkmod: Allow to load libcrypto.so on demand
426580a 
Use dlfcn helpers to load libcrypto once it's needed.

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
@evelikov @lucasdemarchi
libkmod: Add ELF note for openssl library
22dcc08 
Follow the new spec for ELF notes as detailed in
https://systemd.io/ELF_PACKAGE_METADATA/.

We can copy mostly verbatim the macros from systemd codebase.

Example output:

	$ meson setup --native-file build-dev.ini -Ddlopen=openssl build
	...
	    dlopen           : openssl

	    features         : +ZSTD +XZ +ZLIB +OPENSSL

	$ dlopen-notes.py build/libkmod.so.2
	# build/libkmod.so.2
	[
	  {
	    "feature": "openssl",
	    "description": "Support for reading module signatures",
	    "priority": "suggested",
	    "soname": [
	      "libcrypto.so.3"
	    ]
	  }
	]

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
@lucasdemarchi
meson: Make dlopen=all the default
d7d28dd 
As of earlier commit, all dependencies can be dlopen'd on demand. Do
that for all optional libraries by default, but still allow it to be
overridden during build.

Example numbers/benefits taken from `modprobe --show-depends nouveau`:

 - fewer instr - 50% reduction, 1.2M -> 0.5M
 - less memory use - Rss by ~33%, 3M -> 2M
 - reduced attack surface

Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
@evelikov @lucasdemarchi
Add and install valgrind suppression file
947e140 
We're leaking some dlopen handles, by design. It is cleaned up when the
process is closed and there is no reason to be concerned/alarmed.

To indicate that, let's ship a valgrind suppression file.

Admittedly these are not 100% enough since depending on the c runtime
and/or version it can leak some global state, which gets caught.

The newer the glibc version, the more likely it is to exbibit such
behaviour.

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
lucasdemarchi pushed a commit that referenced this pull request May 7, 2026
@evelikov @lucasdemarchi
meson: bump minimal openssl/libcrypto to 3.0.0
65ad534 
OpenSSL 3.0 introduces semantic versioning, thus one can reason about
the supported (and/or broken) API/ABI by glancing at the number.

Version 3.0 was released in late 2021 and is adopted by, at least:
 - CentOS Stream 9
 - Debian 11 aka oldoldstable
 - Fedora 38
 - openSUSE Leap 15.5
 - Ubuntu 22.04

This means that some older, yet maintained, enterprise-y linuxes will be
left in the dark. Namely:
 - RHEL 6,7
 - SLES 11,12,15?
 - Ubuntu {14,16,18,20}.04

To the best of my knowledge, all of them are in deep maintenance mode
and do not target latest kmod releases.

Bumping the requirement, allows us to focus on a single DSO and its API,
as we move to dlopen(libcrypto.so) with the next commit(s).

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: #420
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
lucasdemarchi pushed a commit that referenced this pull request May 7, 2026
@evelikov @lucasdemarchi
libkmod: Allow to load libcrypto.so on demand
4596bc6 
Use dlfcn helpers to load libcrypto once it's needed.

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: #420
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
lucasdemarchi pushed a commit that referenced this pull request May 7, 2026
@evelikov @lucasdemarchi
libkmod: Add ELF note for openssl library
ca20fb9 
Follow the new spec for ELF notes as detailed in
https://systemd.io/ELF_PACKAGE_METADATA/.

We can copy mostly verbatim the macros from systemd codebase.

Example output:

	$ meson setup --native-file build-dev.ini -Ddlopen=openssl build
	...
	    dlopen           : openssl

	    features         : +ZSTD +XZ +ZLIB +OPENSSL

	$ dlopen-notes.py build/libkmod.so.2
	# build/libkmod.so.2
	[
	  {
	    "feature": "openssl",
	    "description": "Support for reading module signatures",
	    "priority": "suggested",
	    "soname": [
	      "libcrypto.so.3"
	    ]
	  }
	]

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: #420
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
lucasdemarchi added a commit that referenced this pull request May 7, 2026
@lucasdemarchi
meson: Make dlopen=all the default
c7441ff 
As of earlier commit, all dependencies can be dlopen'd on demand. Do
that for all optional libraries by default, but still allow it to be
overridden during build.

Example numbers/benefits taken from `modprobe --show-depends nouveau`:

 - fewer instr - 50% reduction, 1.2M -> 0.5M
 - less memory use - Rss by ~33%, 3M -> 2M
 - reduced attack surface

Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: #420
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
lucasdemarchi pushed a commit that referenced this pull request May 7, 2026
@evelikov @lucasdemarchi
Add and install valgrind suppression file
21acc57 
We're leaking some dlopen handles, by design. It is cleaned up when the
process is closed and there is no reason to be concerned/alarmed.

To indicate that, let's ship a valgrind suppression file.

Admittedly these are not 100% enough since depending on the c runtime
and/or version it can leak some global state, which gets caught.

The newer the glibc version, the more likely it is to exbibit such
behaviour.

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: #420
Signed-off-by: Lucas De Marchi <demarchi@kernel.org>
@lucasdemarchi
Copy link
Copy Markdown
Contributor

lucasdemarchi commented May 7, 2026

Applied, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lucasdemarchi lucasdemarchi lucasdemarchi approved these changes

Assignees

No one assigned

Labels

for-lucas The code/issue needs a second pair of eyes and/or is ready to be merged by Lucas. status:reviewed The proposed change is in good condition and ready for merging.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@evelikov @lucasdemarchi