What is AF_XDP (XSK) and how does it achieve DPDK-level packet processing throughput inside the Linux kernel architecture?

AF_XDP (Address Family XDP, formerly known as XSK) is a Linux address family designed for high-performance packet processing directly from the network interface card (NIC) driver into user-space memory, bypassing the standard kernel network stack (sk_buff allocations, netfilter conntrack, routing tables, and socket queues). Unlike DPDK (Data Plane Development Kit), which requires completely unbinding the NIC from the Linux kernel and running proprietary poll-mode drivers (sacrificing all Linux administrative tools like ethtool, iproute2, and iptables), AF_XDP operates as an extension of the existing kernel driver infrastructure. An eBPF XDP program attached to the network driver returns XDP_REDIRECT into a BPF_MAP_TYPE_XSKMAP, which immediately routes raw Ethernet frames directly into a user-space memory area (UMEM) via memory-mapped ring buffers, achieving line-rate 100GbE throughput (upwards of 25 to 30 million packets per second per CPU core).

What are the 4 lockless Ring Buffers in AF_XDP and how does UMEM memory ownership transfer between user space and kernel?

AF_XDP coordinates packet I/O through a user-allocated contiguous chunk of pinned memory called UMEM (typically backed by 2MB or 1GB HugePages) divided into fixed-size frames (e.g. 2048 or 4096 bytes). Ownership of frame addresses is exchanged through four lockless Single-Producer Single-Consumer (SPSC) circular ring buffers: (1) Fill Ring (User -> Kernel): User space populates this ring with base physical/virtual addresses of empty UMEM frames that the NIC DMA engine can write incoming packets into. (2) Rx Ring (Kernel -> User): The kernel populates this ring with descriptors (address offset and packet byte length) representing received packets ready for user-space processing. (3) Tx Ring (User -> Kernel): User space submits descriptors of outgoing packets ready to be sent onto the physical wire. (4) Completion Ring (Kernel -> User): The kernel reports when transmission is finished and the underlying UMEM frame is safe to be recycled by user space.

What is the performance difference between XDP_ZEROCOPY mode and XDP_COPY mode in AF_XDP?

In XDP_COPY mode (fallback mode supported on all Linux network drivers), when the NIC receives a packet, the driver allocates an sk_buff, and the kernel performs a CPU memory copy (memcpy) from the kernel ring buffer into the user UMEM frame. This mode yields around 1.5 to 3.5 Mpps per core due to memory bus bandwidth saturation and cache evictions. In contrast, in XDP_ZEROCOPY mode (supported by modern NIC drivers like Intel i40e/ice, Mellanox mlx5, and Broadcom bnxt), the NIC DMA controller writes the incoming Ethernet frame directly into the physical address of the user UMEM frame without ANY CPU copying or sk_buff allocation. The CPU merely receives a ring buffer pointer update, skyrocketing packet processing throughput to 20 to 30+ Mpps per core with sub-microsecond latency.

How does busy-polling (SO_PREFER_BUSY_POLL) eliminate context switches in AF_XDP event loops?

In standard socket programming, when no packets are available, the application thread calls poll(), epoll_wait(), or recvmsg(), which puts the thread to sleep and triggers expensive kernel context switches when hardware interrupts fire. With AF_XDP busy-polling enabled (via setsockopt with SO_PREFER_BUSY_POLL and SO_BUSY_POLL), the user-space event loop directly executes driver-level NAPI polling routines from user-space context. The application thread continuously polls the Rx ring without yielding the CPU or taking hardware interrupt IRQs, achieving zero context switches, predictable determinism, and lower P99 tail latency.

Linux AF_XDP (XSK), UMEM Ring Buffers & Zero-Copy Packet Processing Studio

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Linux AF_XDP (XSK) & UMEM Ring Buffer Studio

Simulate high-speed kernel bypass with AF_XDP: trace frame descriptors across Fill, Rx, Tx, and Completion rings, compare Zero-Copy DMA vs SKB Copy throughput, and export production C and Rust drivers.

NIC Driver Mode:

26.8 Mpps

Core Throughput

0.42 μs

Median Latency

0 allocs

sk_buff Kernel Overheads

4,096

UMEM HugePage Frames

Busy-Poll (0 IRQs)

NAPI Polling Strategy

Fill Ring (User → Kernel) Producer: User

Provides empty UMEM frame addresses for incoming NIC DMA

Rx Ring (Kernel → User) Producer: Kernel

Delivers received packet descriptors (addr + len) to application

Tx Ring (User → Kernel) Producer: User

Submits outgoing packet descriptors for wire transmission

Completion Ring (Kernel → User) Producer: Kernel

Notifies user space that transmitted UMEM frames are freed

Linux AF_XDP (XSK) & UMEM Ring Buffer Studio

Production AF_XDP Driver Implementation

🔍 Companion Workbenches & Verification Tools

Linux eBPF bpf_iter & Kernel Task Iterators Studio | In-Kernel Streaming Observability

Linux eBPF Tail Calls & BPF-to-BPF Functions Studio

URL Encoder & Decoder

CSV to JSON Converter & Delimited Table Parser

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions