Express Data Path

XDP

Original author(s)	Tom Herbert, Alexei Starovoitov
Initial release	2016
Written in	C
Operating system	Linux
Type	Packet filtering
License	GPL

XDP (eXpress Data Path) is an eBPF based high performance data path merged in the Linux kernel since version 4.8.

The idea behind XDP is to add an early hook in the RX path of the kernel, and let an user supplied eBPF program decide the fate of the packet. The hook is placed in the NIC driver just after the interrupt processing, and before any memory allocation needed by the network stack itself, because memory allocation can be an expensive operation.

The eBPF program passes by a preverifier before being loaded, to avoid executing malicious code in kernel space. The preveifier checks that the program contains no out-of-bounds accesses, loops or global variables.

The eBPF program is allowed to edit the packet data, and after the eBPF program returns an action code determines what to do with the packet:

• let the packet continue through the network stack
• silently drop the packet
• bounce the packet back from the same NIC it arrived on

XDP requires support in the NIC driver but, as not all drivers supports it, it can fallback to a generic implementation, which does the eBPF processing in the network stack, though with slower performances.