Express Data Path

XDP(eXpress Data Path) is aneBPF-based high-performancedata pathused to send and receivenetwork packetsat high rates by bypassing most of theoperating systemnetworking stack.It is merged in theLinux kernelsince version 4.8.This implementation is licensed underGPL.Large technology firms including Amazon, Google and Intel support its development. Microsoft released theirfree and open sourceimplementationXDP for Windowsin May 2022.It is licensed underMIT License.

XDP

Original author(s)	Brenden Blanco, Tom Herbert
Developer(s)	Open source community,Google,Amazon,Intel,Microsoft
Initial release	2016(2016)
Written in	C
Operating system	Linux,Windows
Type	Packet filtering
License	Linux:GPL Windows:MIT License

Data path

Packet flow paths in theLinux kernel.XDP bypasses thenetworking stackandmemory allocationfor packetmetadata.

The idea behind XDP is to add an early hook in the RX path of the kernel, and let a user supplied eBPF program decide the fate of the packet. The hook is placed in thenetwork interface controller(NIC) driver just after theinterruptprocessing, and before any memory allocation needed by thenetwork stackitself, because memory allocation can be an expensive operation. Due to this design, XDP can drop 26 million packets per second per core with commodity hardware.

The eBPF program must pass a preverifier testbefore being loaded, to avoid executing malicious code in kernel space. The preverifier checks that the program contains no out-of-bounds accesses, loops or global variables.

The program is allowed to edit the packet data and, after the eBPF program returns, an action code determines what to do with the packet:

• XDP_PASS:let the packet continue through the network stack
• XDP_DROP:silently drop the packet
• XDP_ABORTED:drop the packet with trace point exception
• XDP_TX:bounce the packet back to the same NIC it arrived on
• XDP_REDIRECT:redirect the packet to another NIC or user space socket via theAF_XDPaddress family

XDP requires support in the NIC driver but, as not all drivers support it, it can fallback to a generic implementation, which performs the eBPF processing in the network stack, though with slower performance.

XDP has infrastructure to offload the eBPF program to a network interface controller which supports it, reducing the CPU load. In 2023, onlyNetronomecards support it.

Microsoft is partnering with other companies and adding support for XDP in itsMsQuicimplementation of theQUICprotocol.

AF_XDP

Along with XDP, a newaddress familyentered in the Linux kernel starting 4.18.AF_XDP, formerly known as AF_PACKETv4 (which was never included in the mainline kernel),is araw socketoptimized for high performance packet processing and allowszero-copybetween kernel and applications. As the socket can be used for both receiving and transmitting, it supports high performance network applications purely in user space.

See also

• Application layer
• Network layer
• Data link layer

External links

• XDP documentationonRead the Docs
• AF_XDP documentationonkernel.org
• xdp-for-windowsonGitHub
• XDP walkthroughatFOSDEM2017 by Daniel Borkmann, Cilium
• AF_XDPatFOSDEM2018 by Magnus Karlsson,Intel
• eBPF.io - Introduction, Tutorials & Community Resources
• L4Drop: XDP DDoS Mitigations,Cloudflare
• Unimog: Cloudflare's edge load balancer,Cloudflare
• Open-sourcing Katran, a scalable network load balancer,Facebook
• Cilium's L4LB: standalone XDP load balancer,Cilium
• Kube-proxy replacement at the XDP layer,Cilium
• eCHO Podcast on XDP and load balancing