XDP Path and Hook Points

In this lesson, you will learn how XDP (eXpress Data Path) achieves record-breaking performance by processing packets at the very moment they arrive at the network interface card (NIC) driver, before the Linux kernel even knows they exist.

The "Early Exit" Strategy

In standard Linux networking, a packet must traverse the entire kernel stack: moving from the NIC into a DMA buffer, creating an sk_buff (socket buffer) object, navigating the interrupt handler, and passing through various protocol layers (IP, TCP/UDP) before hitting a firewall or application. This overhead is costly.

XDP changes the game by inserting a hook point directly into the driver’s receive path. When a packet arrives, the XDP program executes immediately in the context of the NIC driver. Because this happens before the sk_buff is ever allocated, you avoid the significant memory management overhead that usually slows down packet processing.

Execution Path

When an XDP-enabled driver receives a frame, it looks for an attached eBPF program. The program executes on the raw packet data. Based on the logic defined in your eBPF code, the program returns an action:

• XDP_DROP: The packet is discarded instantly, saving the CPU from processing it further.
• XDP_PASS: The packet continues up the standard kernel stack as if nothing happened.
• XDP_TX / XDP_REDIRECT: The packet is sent back out or redirected to another interface without leaving the driver context.

Conceptual Visualization

Imagine the kernel as a multi-story building. Standard packets must visit the security desk, the mailroom, and every floor's administrative office. XDP acts as a "bouncer" standing at the front door. If the bouncer decides to reject a packet (like a DDoS attack vector), it never enters the building at all, leaving the internal offices (the kernel stack) completely unburdened.

SEC("xdp")
int xdp_filter_program(struct xdp_md *ctx) {
    // Access the raw data at the driver level
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    // Decision made in nanoseconds before sk_buff allocation
    if (is_malicious(data, data_end)) {
        return XDP_DROP;
    }
    return XDP_PASS;
}

Key Takeaway: By hooking into the driver’s receive path, XDP minimizes latency and CPU consumption by deciding the fate of a packet before the kernel’s networking stack is even initialized.