BPF eBPF (which is no longer an acronym for anything), also commonly referred to as BPF, is a technology with origins in the Linux kernel that can safely run programs in a privileged context such as the operating system kernel. eBPF is increasingly being used beyond just the Linux kernel, with implementations in network interface cards, Microsoft Windows, etc. There is currently no formal standard for eBPF and no clear scope for what is part of eBPF and what is not. The bpf working group is initially tasked with documenting the existing state of the eBPF ecosystem, and a clear process for extensions, including initial extensions that are widely useful and showcase the process. The working group shall not adopt new work until these documents have progressed to working group last call. The working group will produce one or more documents on the following work item topics: * The eBPF instruction set architecture (ISA) that defines the instructions and low-level virtual machine for eBPF programs, * Verifier expectations and building blocks for allowing safe execution of untrusted eBPF programs, * the BPF Type Format (BTF) that defines debug information and introspection capabilities for eBPF programs, * the eBPF bindings for the ELF executable file format, * the platform support ABI, including calling convention, linker requirements, and relocations, * Cross-platform map types allowing native data structure access from eBPF programs, * Cross-platform helper functions, such as for manipulation of maps, * Cross-platform eBPF program types that define the higher level execution environment for eBPF programs, * and an architecture and framework informational document. The bpf working group shall actively engage the eBPF Foundation steering committee and the broader implementation community to ensure inclusion in the IETF's consensus-driven process. The working group is intended to only work on cross-platform aspects of eBPF that are useful to the wider internet community and not operating or otherwise platform specific.