In the recent years, eBPF is extended across several other fields besides networking in Linux kernel, such as tracing, security, and error injection, and eXpress Data Path (XDP) leads the attention back to networking. Previously, eBPF is used in the generic network stack, and XDP goes further to integrate eBPF into the network drivers. With XDP, it's possible to dynamically inspect the packets right after harvesting them from the network cards. This is especially useful when dealing with the DDoS attack because the packets from the attackers are useless to the whole system, and it's better to drop them as early as possible to save the processing power. Furthermore, the newly merged AF_XDP patch set allows the user to do the zero-copy access to the packets, and this could bring more performance improvement to the userspace program. In this talk, I'll introduce the concept of XDP, the related mechanisms, and the recent updates in Linux upstream.
