BTF is currently used in two ways:
- From
btf.c: to look into the current kernel’s structures and find out the offset of some fields in different structures (e.g. net_device->ifindex)
- From
map.c: to attach to the map, so bpftool pretty-prints the data, useful for debugging and investigations. However, this not supported for every map, so if BTF is not supported, it will log a warning and continue
For the first use case, we should investigate the alternatives to allow users to build bpfilter without BTF support (as this option can be disabled on some kernels).