Skip to content

XDP Basics

The Linux eBPF (Extended Berkeley Packet Filter) framework has evolved from a tool for packet capture into a powerful, general-purpose virtual machine for safe kernel code execution. It enables low-overhead, high-performance operations in the Linux network stack by allowing programs to run in the kernel without requiring kernel module recompilation. eBPF programs are attached to various hooks in the network stack (e.g., packet processing, socket operations) and can perform tasks like filtering, monitoring, and modifying traffic. This section introduces eBPF fundamentals and explores how XDP (eXpress Data Path) leverages eBPF to achieve ultra-low-latency packet processing.

eBPF Fundamentals

eBPF programs run in a sandboxed environment within the Linux kernel, using a virtual machine (VM) that enforces strict memory safety and access controls. Key components include:

  • BPF VM: A stack-based VM with a limited instruction set (e.g., arithmetic, control flow, memory access) that ensures programs cannot corrupt kernel data.
  • Maps: In-memory data structures (e.g., hash tables, arrays) used to persist data between eBPF programs and user-space applications.
  • Program Loading: Programs are loaded via the bpf() system call and attached to specific hooks (e.g., TC (Traffic Control) or XDP).

Example: A simple eBPF program to count packets on a network interface: 

# Load a BPF program (requires a C program or eBPF bytecode)
sudo bpftool prog load /path/to/bpf_program.o /dev/bpf0
sudo bpftool prog attach pinned /dev/bpf0 dev eth0

Programs are typically written in C-like languages (e.g., LLVM IR) and compiled to eBPF bytecode. The kernel's BPF verifier ensures safety before allowing execution.

XDP: Low-Latency Packet Processing

XDP is a high-performance data plane interface that runs eBPF programs at the earliest possible point in the network stack—before packets are processed by the kernel's networking stack. This minimizes latency and reduces CPU overhead by avoiding full stack processing for simple tasks.

How XDP Works

  1. Packet Capture: Packets are captured at the NIC driver level.
  2. eBPF Execution: XDP programs run in the BPF VM, allowing actions like:
  3. Dropping packets (e.g., rate limiting).
  4. Redirecting packets to another interface (e.g., load balancing).
  5. Modifying packet headers (e.g., for tunneling).
  6. Result Handling: The program returns a result (e.g., XDP_DROP, XDP_PASS, XDP_TX) to decide the packet's fate.

XDP Modes

  • **XDP_MODE_L2`: Process packets at the Ethernet layer (L2).
  • **XDP_MODE_L3`: Process at the IP layer (L3).
  • **XDP_MODE_L4`: Process at the transport layer (L4).

Example: A simple XDP program to drop all packets: 

SEC("xdp")
int drop_all(struct xdp_md *ctx) {
    return XDP_DROP;
}
Compile and load: 
clang -O2 -target bpf -I /usr/include/xdp -c drop_all.c -o drop_all.o
sudo xdp-loader load drop_all.o xdp0

Use Cases and Benefits

eBPF and XDP enable advanced networking capabilities: - Traffic Filtering: Drop malicious traffic before it reaches the kernel. - Load Balancing: Redirect traffic to optimal paths with minimal latency. - Monitoring: Collect metrics (e.g., packet counts, latency) without overhead. - Security: Implement stateful firewalls or intrusion detection systems.

Compared to traditional kernel modules or userspace tools, eBPF/XDP offers: - Safety: Kernel code is verified for safety. - Performance: Near-raw packet processing with minimal overhead. - Flexibility: Programs can be updated without rebooting the system.

Key takeaways

  • eBPF provides a safe, general-purpose VM for kernel code execution, enabling low-overhead networking operations.
  • XDP leverages eBPF to process packets at the earliest stage of the network stack, achieving sub-microsecond latency.
  • XDP programs can filter, redirect, or modify packets, making them ideal for security, monitoring, and load balancing.
  • eBPF/XDP reduces the need for kernel modules and userspace tools, offering a unified approach to high-performance networking.