BPF map
also: eBPF map, BPF data structure
A BPF map is a data structure that stores and shares data between BPF programs and userspace applications, or between multiple BPF programs running in the kernel.
BPF maps are key-value stores accessible from eBPF (extended Berkeley Packet Filter) programs. They allow eBPF code to persist state across multiple program invocations and communicate with userspace tools via file descriptors.
Maps come in several types optimized for different use cases: hash maps for flexible key-value lookups, arrays for fast indexed access, ring buffers for efficient event streaming, and specialized variants like LRU maps or stack trace maps. For example, a tracing program might use a hash map to count syscall frequencies: the eBPF code increments counters by syscall number, and a userspace program reads the map to display results.
Maps are created from userspace (typically via libbpf), attached to the BPF program, and persist in the kernel even after the program completes, making them essential for observability and monitoring tools like BCC and bpftrace.