Uninstall and Recovery

Uninstall and Recovery

Before uninstalling a remote host

Removing Auto XDP changes host firewall state and deletes its configuration. Confirm that provider firewalls, nftables managed elsewhere, or another host firewall will preserve required access. Keep a second management session or console available.

Complete uninstall

sudo axdp uninstall

If the installed interface list cannot be determined:

sudo axdp uninstall eth0 eth1

The command requires root and performs these stages:

1. Stops and disables xdp-port-sync and auto-xdp-relay under systemd/OpenRC.
2. Stops remaining processes only when their command line matches installed Auto XDP runtime paths.
3. Detaches native, generic, and offload XDP modes from each target interface.
4. Removes the owned tc egress filter at preference 49152/handle 1.
5. Deletes the configured nftables table.
6. Verifies XDP, tc, and nftables removal before deleting runtime files.
7. Removes active, candidate, and rollback BPF pin directories.
8. Removes service definitions and reloads systemd when present.
9. Removes /usr/local/lib/auto_xdp, /run/auto_xdp, /etc/auto_xdp, and /usr/local/bin/axdp.
10. Removes the installer-created auto-xdp group only when its marker exists and it has no members.

If attachment/ruleset removal cannot be verified, uninstall stops before deleting runtime files so it can be retried safely.

Verify removal

ip -d link show dev eth0
tc filter show dev eth0 egress
sudo nft list table inet auto_xdp
test ! -e /sys/fs/bpf/xdp_fw
test ! -e /usr/local/lib/auto_xdp
test ! -e /etc/auto_xdp
test ! -e /usr/local/bin/axdp

The nft command should report that the table does not exist. Check every previously protected interface.

Interrupted update recovery

Auto XDP records release changes in /etc/auto_xdp/install-transaction.json. If startup sees an active transaction stopped during the switching phase and the previous release still exists, it atomically points current back to the previous generation and marks the transaction recovered.

Inspect without editing:

sudo cat /etc/auto_xdp/install-transaction.json
readlink -f /usr/local/lib/auto_xdp/current
sudo axdp backend

Restart the service to invoke normal recovery:

sudo axdp restart

Do not manually rewrite the transaction or current symlink unless automatic recovery has failed and you have verified the exact release directories.

Interrupted XDP generation recovery

The runtime can leave /sys/fs/bpf/xdp_fw_next or /sys/fs/bpf/xdp_fw_rollback after a killed loader. Startup first tries to complete the candidate; if it is unusable, it verifies and restores the last committed generation. Pins are intentionally retained when rollback verification is incomplete.

Use service logs and axdp backend before deleting any generation. A pinned program may still protect an interface even when userspace appears stopped.

Reinstall after removal

Run a fresh tagged archive or source checkout:

bash setup_xdp.sh --dry-run
bash setup_xdp.sh
sudo axdp status

Uninstall deletes /etc/auto_xdp, so restore any desired configuration from your own backup before or after reinstall and then restart the daemon.