superseded: [PATCH proxmox-ebpf v4 0/5] add proxmox-ebpf library

[Hannes Laimer <h.laimer@proxmox.com>]

superseded-by:
https://lore.proxmox.com/pve-devel/20261102150047.1584789-1-h.laimer@proxmox.com

On 2026-10-19 16:25, Hannes Laimer wrote:
> proxmox-ebpf holds the eBPF programs and the code that loads, attaches
> and updates them, grouped into subsystems. It is a library only, whoever
> needs a subsystem pulls in just that one through a cargo feature and
> calls it from their side. This series is the shared part, the actual
> subsystems come as their own series on top.
> 
> The core is the shared subsystem code. It takes care of everything from
> loading and attaching per interface to pinning in bpffs and tearing down
> again. So nothing has to keep running, and each call picks up where the
> last one left off. The build records a hash of the compiled object and a
> schema version per subsystem, so a call can tell what changed. A changed
> program is swapped onto the existing links without interrupting traffic.
> A changed map schema keeps the links as well and starts with empty maps,
> which the same call refills. The BPF C code is also built natively
> against a small shim, so the parsing and packet building logic can be
> tested without a kernel. Packaging is debcargo like the other Rust
> crates.
> 
> Every change runs under a lock per subsystem, a full apply takes it
> exclusively and a single-interface step shared, like the pmxcfs domain
> locks. The holder reads the input of its change under the lock and
> writes before it lets go. So a change and a full apply reach the kernel
> in the order they read their input, and nothing has to order them after
> the fact. A holder that never returns makes the waiters time out instead
> of hanging them. The programs of different subsystems on one interface
> run in a fixed order. An attach places its link relative to the links
> the other subsystems already hold there, so the order holds however the
> attaches are timed, and an update keeps every link in its place.
> 
> The series applies on top of the scaffolding commit of the repo, which
> is not on the list since it carries the vendored vmlinux.h at ~167k
> lines. It is on my staff repo along with these five commits.
> 
> Changes since v3, thanks @Stefan!:
>  * drop the generation counter, a change takes the apply lock before it
>    reads its input instead, so the lock order is the input order
>  * new, the links of different subsystems on an interface are now
>    ordered
>  * the tc link plumbing is its own commit ahead of the subsystem code
>  * subsystem programs are now a list of direction and name pairs
>  * add short note for why not proxmox-sys's locking
>  * improve tc error handling
>  * fix smaller spacing and code stuff
> 
> 
> proxmox-ebpf:
> 
> Hannes Laimer (5):
>   tc: add the link plumbing
>   subsystem: add the shared tc program handling
>   subsystem: place the links of different subsystems in a fixed order
>   tests: add a native harness for the BPF C programs
>   debian: package the crate as a Rust library
> 
>  .gitignore                     |    1 +
>  Cargo.toml                     |    7 +
>  Makefile                       |   54 ++
>  build.rs                       |   68 +++
>  debian/changelog               |    5 +
>  debian/control                 |   50 ++
>  debian/copyright               |   26 +
>  debian/debcargo.toml           |   13 +
>  debian/source/format           |    1 +
>  src/bpf-shim/bpf/bpf_endian.h  |   12 +
>  src/bpf-shim/bpf/bpf_helpers.h |   34 ++
>  src/bpf-shim/bpf_debug.h       |   10 +
>  src/bpf-shim/vmlinux.h         |   70 +++
>  src/lib.rs                     |    3 +
>  src/subsystem.rs               | 1024 ++++++++++++++++++++++++++++++++
>  src/tc.rs                      |  313 ++++++++++
>  tests/common/mod.rs            |  207 +++++++
>  tests/harness.rs               |   65 ++
>  18 files changed, 1963 insertions(+)
>  create mode 100644 Makefile
>  create mode 100644 debian/changelog
>  create mode 100644 debian/control
>  create mode 100644 debian/copyright
>  create mode 100644 debian/debcargo.toml
>  create mode 100644 debian/source/format
>  create mode 100644 src/bpf-shim/bpf/bpf_endian.h
>  create mode 100644 src/bpf-shim/bpf/bpf_helpers.h
>  create mode 100644 src/bpf-shim/bpf_debug.h
>  create mode 100644 src/bpf-shim/vmlinux.h
>  create mode 100644 src/subsystem.rs
>  create mode 100644 src/tc.rs
>  create mode 100644 tests/common/mod.rs
>  create mode 100644 tests/harness.rs
> 
> 
> Summary over all repositories:
>   18 files changed, 1963 insertions(+), 0 deletions(-)
>