Express Data Path

XDP (eXpress Data Path) is an eBPF based high performance data path merged in the Linux kernel since version 4.8.[1]

The idea behind XDP is to add an early hook in the RX path of the kernel, and let a user supplied eBPF program decide the fate of the packet. The hook is placed in the NIC driver just after the interrupt processing, and before any memory allocation needed by the network stack itself, because memory allocation can be an expensive operation. Due to this design, XDP can drop 26 millions of packets per second per core with commodity hardware.[2]

The eBPF program must pass a preverifier test[3] before being loaded, to avoid executing malicious code in kernel space. The preverifier checks that the program contains no out-of-bounds accesses, loops or global variables.

Packet flow paths in the Linux kernel. XDP bypasses the networking stack and memory allocation for packet metadata.

The program is allowed to edit the packet data and, after the eBPF program returns, an action code determines what to do with the packet:

• XDP_PASS: let the packet continue through the network stack
• XDP_DROP: silently drop the packet
• XDP_ABORTED: drop the packet with trace point exception
• XDP_TX: bounce the packet back to the same NIC it arrived on
• XDP_REDIRECT: redirect the packet to another NIC or user space socket via the AF_XDP address family

XDP requires support in the NIC driver but, as not all drivers support it, it can fallback to a generic implementation, which performs the eBPF processing in the network stack, though with slower performance.[4]

XDP has infrastructure to offload the eBPF program to a NIC card which supports it, reducing the CPU load. At the time only Netronome cards supports it,[5] with Intel and Mellanox working on it.[6]