XDP can run in the driver in the "normal" mode, so it's on host CPU. But for some NICs like Netronome nfp, the kernel can JIT the BPF program into the instructi

XDP can run in the driver in the "normal" mode, so it's on host CPU. But for some NICs like Netronome nfp, the kernel can JIT the BPF program into the instruction set for nfp and then run 'offloaded' on the card directly, so not even affecting host CPU in any way. See also here for a recent blog post: https://www.netronome.com/blog/bpf-ebpf-xdp-and-bpfilter-what-are-these-things-and-what-do-they-mean-enterprise/ https://www.netronome.com/blog/bpf-ebpf-xdp-and-bpfilter-wha... So both is possible, but even with XDP running on host CPU like in Cloudflare case above you get excellent performance numbers.