From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 8236E1FF09C for ; Mon, 02 Nov 2026 16:13:46 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 561432196E; Mon, 02 Nov 2026 16:13:44 +0100 (CET) Message-ID: <16e23a80-c469-48f3-a081-51ad77d4947a@proxmox.com> Date: Mon, 2 Nov 2026 16:13:29 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: superseded: [PATCH proxmox-ebpf v4 0/5] add proxmox-ebpf library To: pve-devel@lists.proxmox.com References: <20261019142413.2255644-1-h.laimer@proxmox.com> From: Hannes Laimer Content-Language: en-US In-Reply-To: <20261019142413.2255644-1-h.laimer@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793632409666 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.351 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: VZYYDLL3HAJHSB4QVCEY5JFH2DBGOJ6U X-Message-ID-Hash: VZYYDLL3HAJHSB4QVCEY5JFH2DBGOJ6U X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: superseded-by: https://lore.proxmox.com/pve-devel/20261102150047.1584789-1-h.laimer@proxmox.com On 2026-10-19 16:25, Hannes Laimer wrote: > proxmox-ebpf holds the eBPF programs and the code that loads, attaches > and updates them, grouped into subsystems. It is a library only, whoever > needs a subsystem pulls in just that one through a cargo feature and > calls it from their side. This series is the shared part, the actual > subsystems come as their own series on top. > > The core is the shared subsystem code. It takes care of everything from > loading and attaching per interface to pinning in bpffs and tearing down > again. So nothing has to keep running, and each call picks up where the > last one left off. The build records a hash of the compiled object and a > schema version per subsystem, so a call can tell what changed. A changed > program is swapped onto the existing links without interrupting traffic. > A changed map schema keeps the links as well and starts with empty maps, > which the same call refills. The BPF C code is also built natively > against a small shim, so the parsing and packet building logic can be > tested without a kernel. Packaging is debcargo like the other Rust > crates. > > Every change runs under a lock per subsystem, a full apply takes it > exclusively and a single-interface step shared, like the pmxcfs domain > locks. The holder reads the input of its change under the lock and > writes before it lets go. So a change and a full apply reach the kernel > in the order they read their input, and nothing has to order them after > the fact. A holder that never returns makes the waiters time out instead > of hanging them. The programs of different subsystems on one interface > run in a fixed order. An attach places its link relative to the links > the other subsystems already hold there, so the order holds however the > attaches are timed, and an update keeps every link in its place. > > The series applies on top of the scaffolding commit of the repo, which > is not on the list since it carries the vendored vmlinux.h at ~167k > lines. It is on my staff repo along with these five commits. > > Changes since v3, thanks @Stefan!: > * drop the generation counter, a change takes the apply lock before it > reads its input instead, so the lock order is the input order > * new, the links of different subsystems on an interface are now > ordered > * the tc link plumbing is its own commit ahead of the subsystem code > * subsystem programs are now a list of direction and name pairs > * add short note for why not proxmox-sys's locking > * improve tc error handling > * fix smaller spacing and code stuff > > > proxmox-ebpf: > > Hannes Laimer (5): > tc: add the link plumbing > subsystem: add the shared tc program handling > subsystem: place the links of different subsystems in a fixed order > tests: add a native harness for the BPF C programs > debian: package the crate as a Rust library > > .gitignore | 1 + > Cargo.toml | 7 + > Makefile | 54 ++ > build.rs | 68 +++ > debian/changelog | 5 + > debian/control | 50 ++ > debian/copyright | 26 + > debian/debcargo.toml | 13 + > debian/source/format | 1 + > src/bpf-shim/bpf/bpf_endian.h | 12 + > src/bpf-shim/bpf/bpf_helpers.h | 34 ++ > src/bpf-shim/bpf_debug.h | 10 + > src/bpf-shim/vmlinux.h | 70 +++ > src/lib.rs | 3 + > src/subsystem.rs | 1024 ++++++++++++++++++++++++++++++++ > src/tc.rs | 313 ++++++++++ > tests/common/mod.rs | 207 +++++++ > tests/harness.rs | 65 ++ > 18 files changed, 1963 insertions(+) > create mode 100644 Makefile > create mode 100644 debian/changelog > create mode 100644 debian/control > create mode 100644 debian/copyright > create mode 100644 debian/debcargo.toml > create mode 100644 debian/source/format > create mode 100644 src/bpf-shim/bpf/bpf_endian.h > create mode 100644 src/bpf-shim/bpf/bpf_helpers.h > create mode 100644 src/bpf-shim/bpf_debug.h > create mode 100644 src/bpf-shim/vmlinux.h > create mode 100644 src/subsystem.rs > create mode 100644 src/tc.rs > create mode 100644 tests/common/mod.rs > create mode 100644 tests/harness.rs > > > Summary over all repositories: > 18 files changed, 1963 insertions(+), 0 deletions(-) >