BTF
also: BPF Type Format
BPF Type Format (BTF) is a metadata format that describes the layout and type information of data structures used by eBPF programs, enabling portable and self-describing kernel instrumentation.
BTF stores type and layout information for kernel data structures in a compact binary format. It allows eBPF programs to safely access kernel memory without hardcoding offsets that vary across kernel versions and configurations.
BTF is embedded in compiled kernel images and ELF object files containing eBPF bytecode. Tools like bpftool can parse and display BTF information, making it easier to understand what data structures an eBPF program accesses.
Example: An eBPF program monitoring network packets can use BTF to understand the layout of kernel struct sk_buff at runtime rather than relying on precompiled offsets. This enables the same compiled program to run across different kernel versions without recompilation.