[PATCH pve-kernel] build: ship Rust artifacts for external modules

[Krzysztof Hajdamowicz <krzysztof@hajdamowicz.info>]

External kernel modules containing Rust code cannot currently be built
against the Proxmox kernel headers alone.

Unlike C modules, Rust modules depend on libraries, metadata and
procedural macros generated while building the kernel. In particular,
Kbuild needs the matching .rlib, .rmeta and proc-macro .so files from
the rust/ output directory.

These files are tied not only to the kernel version and configuration,
but also to the exact Rust compiler used for the kernel build. They
cannot be regenerated reliably by DKMS from the installed headers.

This is currently relevant to the out-of-tree bcachefs DKMS work
described by the bcachefs maintainer:

https://www.patreon.com/bcachefs/posts/in-kernel-rust-162419215

Ship the generated Rust artifacts in a separate, versioned package:

  proxmox-kernel-${KVNAME}-rust

The package installs them under:

  /usr/src/proxmox-kernel-${KVNAME}-rust/rust

The matching headers package exposes this directory as:

  /usr/src/linux-headers-${KVNAME}/rust

using a relative symlink.

Keeping the artifacts in a separate package avoids increasing the size
of the regular headers package for users who only build C modules. The
headers package therefore Recommends the matching Rust package, while
the Rust package has an exact dependency on the matching headers
package. The exact version relationship is intentional: Rust metadata
is not portable between different kernel or compiler builds.

The resulting packages were tested on a Debian Trixie builder.

The Rust package contained:

  - 3 .rlib files
  - 8 .rmeta files
  - 2 procedural-macro shared objects
  - no Kbuild .cmd or .o.ur-* temporary files

Its compressed package size was approximately 30 MiB and its installed
size approximately 155 MiB. Keeping it separate therefore substantially
reduces the impact on users who do not need Rust external modules.

After installing the generated headers and Rust packages:

  - an upstream kernel minimal out-of-tree Rust sample module built successfully;
  - the resulting module had the expected 7.0.14-11-pve vermagic;
  - bcachefs-tools v1.39.1, built with BCACHEFS_RUST=1, produced a
    bcachefs.ko containing compiled Rust objects and Rust symbols;
  - lintian reported no issues for the new package.

The modules could not be loaded in the build environment because the
LXC container runs the host kernel rather than the newly built kernel.

The normal ABI check was also investigated. The kernel configuration
expects rustc 1.93.1 built from the source tarball. The available rustup
toolchain reported the same version and compiler commit, but was not an
identical compiler build.

A rebuild with that toolchain resulted in 736 missing and 770 new ABI
symbols. All of those differences were Rust symbols; no C ABI symbols
differed. This is consistent with Rust crate metadata and symbol hashes
depending on the exact compiler build.

SKIPABI=1 was used only to finish the local test packages and perform
the external-module build tests. This patch does not disable, bypass or
otherwise modify abicheck. A package built in the official Proxmox
environment with the exact expected compiler should still run the
normal ABI check. The result should be verified by an official package
build.

The ABI result also reinforces why the generated Rust artifacts need to
be shipped from the original kernel build instead of being reconstructed
later by DKMS.

Signed-off-by: Krzysztof Hajdamowicz <krzysztof@hajdamowicz.info>
---
 Makefile          |  6 ++++--
 debian/control.in | 10 ++++++++++
 debian/rules      | 14 +++++++++++---
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index f328de3..5625f5d 100644
--- a/Makefile
+++ b/Makefile
@@ -23,6 +23,7 @@ EXTRAVERSION=-$(KREL)$(KREL_EXTRA)-pve
 KVNAME=$(KERNEL_VER)$(EXTRAVERSION)
 PACKAGE=proxmox-kernel-$(KVNAME)
 HDRPACKAGE=proxmox-headers-$(KVNAME)
+RUSTPACKAGE=proxmox-kernel-$(KVNAME)-rust
 
 ARCH=$(shell dpkg-architecture -qDEB_HOST_ARCH)
 
@@ -58,12 +59,13 @@ DST_DEB=$(PACKAGE)_$(DEB_VERSION)_$(ARCH).deb
 SIGNED_TEMPLATE_DEB=$(PACKAGE)-signed-template_$(DEB_VERSION)_$(ARCH).deb
 META_DEB=proxmox-kernel-$(KERNEL_MAJMIN)_$(DEB_VERSION)_$(ARCH).deb
 HDR_DEB=$(HDRPACKAGE)_$(DEB_VERSION)_$(ARCH).deb
+RUST_DEB=$(RUSTPACKAGE)_$(DEB_VERSION)_$(ARCH).deb
 META_HDR_DEB=proxmox-headers-$(KERNEL_MAJMIN)_$(DEB_VERSION)_$(ARCH).deb
 USR_HDR_DEB=proxmox-kernel-libc-dev_$(DEB_VERSION)_$(ARCH).deb
 LINUX_TOOLS_DEB=linux-tools-$(KERNEL_MAJMIN)_$(DEB_VERSION)_$(ARCH).deb
 LINUX_TOOLS_DBG_DEB=linux-tools-$(KERNEL_MAJMIN)-dbgsym_$(DEB_VERSION)_$(ARCH).deb
 
-DEBS=$(DST_DEB) $(META_DEB) $(HDR_DEB) $(META_HDR_DEB) $(LINUX_TOOLS_DEB) $(LINUX_TOOLS_DBG_DEB) $(SIGNED_TEMPLATE_DEB) # $(USR_HDR_DEB)
+DEBS=$(DST_DEB) $(META_DEB) $(HDR_DEB) $(RUST_DEB) $(META_HDR_DEB) $(LINUX_TOOLS_DEB) $(LINUX_TOOLS_DBG_DEB) $(SIGNED_TEMPLATE_DEB) # $(USR_HDR_DEB)
 
 all: deb
 deb: $(DEBS)
@@ -71,7 +73,7 @@ deb: $(DEBS)
 	#lintian $(HDR_DEB)
 	lintian $(LINUX_TOOLS_DEB)
 
-$(META_DEB) $(META_HDR_DEB) $(LINUX_TOOLS_DEB) $(HDR_DEB) $(DST_DEB) &: $(BUILD_DIR).prepared
+$(META_DEB) $(META_HDR_DEB) $(LINUX_TOOLS_DEB) $(HDR_DEB) $(RUST_DEB) $(DST_DEB) &: $(BUILD_DIR).prepared
 	cd $(BUILD_DIR); dpkg-buildpackage --jobs=auto -b -uc -us
 
 dsc:
diff --git a/debian/control.in b/debian/control.in
index b7048b6..98a5a60 100644
--- a/debian/control.in
+++ b/debian/control.in
@@ -57,9 +57,19 @@ Priority: optional
 Architecture: any
 Provides: linux-headers-@KVNAME@-@ARCH@, pve-headers-@KVNAME@
 Depends: ${misc:Depends},
+Recommends: proxmox-kernel-@KVNAME@-rust (= ${binary:Version}),
 Description: Proxmox Kernel Headers
  This package contains the linux kernel headers
 
+Package: proxmox-kernel-@KVNAME@-rust
+Section: devel
+Priority: optional
+Architecture: any
+Depends: proxmox-headers-@KVNAME@ (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends},
+Description: Rust build artifacts for the Proxmox Kernel
+ This package contains the Rust build artifacts required to compile external
+ kernel modules written in Rust.
+
 Package: proxmox-kernel-@KVNAME@
 Section: admin
 Priority: optional
diff --git a/debian/rules b/debian/rules
index 71f9804..56e0248 100755
--- a/debian/rules
+++ b/debian/rules
@@ -20,6 +20,7 @@ PMX_KERNEL_PKG=proxmox-kernel-$(KVNAME)
 PMX_KERNEL_SERIES_PKG=proxmox-kernel-$(KERNEL_MAJMIN)
 PMX_DEBUG_KERNEL_PKG=proxmox-kernel-$(KVNAME)-dbgsym
 PMX_HEADER_PKG=proxmox-headers-$(KVNAME)
+PMX_RUST_PKG=proxmox-kernel-$(KVNAME)-rust
 PMX_USR_HEADER_PKG=proxmox-kernel-libc-dev
 PMX_KERNEL_SIGNING_TEMPLATE_PKG=proxmox-kernel-${KVNAME}-signed-template
 PMX_KERNEL_SIGNED_VERSION := $(shell echo ${DEB_VERSION} | sed -e 's/-/+/')
@@ -69,7 +70,7 @@ install: .install_mark .tools_install_mark .headers_install_mark .usr_headers_in
 
 binary: install
 	debian/rules fwcheck abicheck
-	dh_strip -N$(PMX_HEADER_PKG) -N$(PMX_USR_HEADER_PKG) -Xvmlinux -Xvmlinuz
+	dh_strip -N$(PMX_HEADER_PKG) -N$(PMX_RUST_PKG) -N$(PMX_USR_HEADER_PKG) -Xvmlinux -Xvmlinuz
 	dh_makeshlibs
 	dh_shlibdeps
 	dh_installdeb
@@ -179,7 +180,7 @@ endif
 	touch $@
 
 .headers_prepare_mark: .config_mark
-	rm -rf debian/$(PMX_HEADER_PKG)
+	rm -rf debian/$(PMX_HEADER_PKG) debian/$(PMX_RUST_PKG)
 	mkdir -p debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
 	install -m 0644 $(KERNEL_SRC)/.config debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
 	make -C $(KERNEL_SRC_COPY) mrproper
@@ -210,9 +211,16 @@ endif
 	mkdir -p $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)
 	cp $(KERNEL_SRC)/.config $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)/.config
 	$(MAKE) -C $(KERNEL_SRC_COPY) O=$(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG) -j1 syncconfig modules_prepare prepare scripts
-	cd $(KERNEL_SRC_COPY); cp -a include scripts $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
 	find $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG) -name \*.o.ur-\* -o -name '*.cmd' | xargs rm -f
+	# External Rust modules need the artifacts generated by the exact kernel build.
+	mkdir -p debian/$(PMX_RUST_PKG)/usr/src/$(PMX_RUST_PKG)
+	mv $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)/rust debian/$(PMX_RUST_PKG)/usr/src/$(PMX_RUST_PKG)/
+	rm -f debian/$(PMX_RUST_PKG)/usr/src/$(PMX_RUST_PKG)/rust/Makefile
+	install -m 0644 $(KERNEL_SRC_COPY)/rust/Makefile debian/$(PMX_RUST_PKG)/usr/src/$(PMX_RUST_PKG)/rust/Makefile
+	cd $(KERNEL_SRC_COPY); cp -a include scripts $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
 	rsync --ignore-existing -r -v -a $(addprefix $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)/,arch include kernel scripts tools) $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)/
+	rm -rf debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)/rust
+	ln -s ../$(PMX_RUST_PKG)/rust debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)/rust
 	rm -rf $(BUILD_DIR)/$(KERNEL_SRC_COPY)
 	touch $@
 
-- 
2.55.0