| XDP | |
|---|---|
| Original authors | Brenden Blanco, Tom Herbert |
| Developers | Open source community,Google,Amazon,Intel,Microsoft[1] |
| Initial release | 2016; 9 years ago (2016) |
| Written in | C |
| Operating system | Linux,Windows |
| Type | Packet filtering |
| License | Linux:GPL Windows:MIT License |
XDP (eXpress Data Path) is aneBPF-based high-performance network data path used to send and receivenetwork packets at high rates by bypassing most of theoperating systemnetworking stack. It is merged in theLinux kernel since version 4.8.[2] This implementation is licensed underGPL. Large technology firms including Amazon, Google and Intel support its development. Microsoft released theirfree and open source implementationXDP for Windows in May 2022.[1] It is licensed underMIT License.[3]
The idea behind XDP is to add an early hook in the RX path of the kernel, and let a user supplied eBPF program decide the fate of the packet. The hook is placed in thenetwork interface controller (NIC) driver just after theinterrupt processing, and before any memory allocation needed by thenetwork stack itself, because memory allocation can be an expensive operation. Due to this design, XDP can drop 26 million packets per second per core withcommodity hardware.[4]
The eBPF program must pass a preverifier test[5] before being loaded, to avoid executing malicious code in kernel space. The preverifier checks that the program contains no out-of-bounds accesses, loops or global variables.
The program is allowed to edit the packet data and, after the eBPF program returns, an action code determines what to do with the packet:
XDP_PASS: let the packet continue through the network stackXDP_DROP: silently drop the packetXDP_ABORTED: drop the packet with trace point exceptionXDP_TX: bounce the packet back to the same NIC it arrived onXDP_REDIRECT: redirect the packet to another NIC oruser space socket via theAF_XDP address familyXDP requires support in the NIC driver but, as not all drivers support it, it can fallback to a generic implementation, which performs the eBPF processing in the network stack, though with slower performance.[6]
XDP has infrastructure to offload the eBPF program to a network interface controller which supports it, reducing the CPU load. In 2023, only Netronome[7] cards support it.
Microsoft is partnering with other companies and adding support for XDP in itsMsQuic implementation of theQUIC protocol.[1]
Along with XDP, a newaddress family entered in the Linux kernel starting 4.18.[8] AF_XDP, formerly known as AF_PACKETv4 (which was never included in the mainline kernel),[9] is araw socket optimized for high performance packet processing and allowszero-copy between kernel and applications. As the socket can be used for both receiving and transmitting, it supports high performance network applications purely in user space.[10]
