eBPF the Hard Way
Summary
The post dives into eBPF programming with raw bytecode workflows (without libbpf/LLVM), using Linux 6.18. It covers program loading, maps, BPF verifier restrictions for unprivileged users, and introduces BTF and function pointers (KFuncs) for callbacks, with Zig code samples illustrating the concepts and risks. The piece blends practical examples with discussion on verification outputs and security implications for kernel-level packet processing and networking.