DevConf.CZ 2020

BTF started as a file format describing the data structures present in
a BPF program, but is fast becoming much more than that.

A series of advancements are adding new capabilities such as matching data
structures in BPF programs against those for the running kernel, which in turn
allows for a BPF object file built using the data structures of one kernel to
work with another where those structures have changed.

Recent additions include BTF_KIND_FUNC and BTF_KIND_FUNC_PROTO, describing the
kernel global functions, the ones in /proc/kallsyms.

These in turn allows for the BPF verifier to check accesses to kernel function
arguments to avoid the cost of using bpf_probe_read since it now knows both the
function signatures and types and the ones used in the BPF bytecode being
verified.

The status of tools used to generate BTF will be described, from clang/LLVM,
gcc, binutils, pahole.

Ditto for how this is being used in tools and libraries such as libbpf,
bpftrace, bpftool, perf, pahole.