BPF maps are kernel objects that store data used by BPF programs, typically in the form of key-value pairs. Applications access these maps via file descriptors. Checkpointing and restoring BPF maps involves serializing both their metadata and their data contents.
CRIU collects essential map attributes from several sources:
map_type, key_size, value_size, max_entries, and the frozen status are parsed from the task’s fdinfo.bpf system call with the BPF_OBJ_GET_INFO_BY_FD command to retrieve additional information, including the map name and interface index (ifindex).To preserve the map’s contents, CRIU relies on batch operations:
BPF_MAP_LOOKUP_BATCH to efficiently read all key-value pairs from the map.BPF_MAP_UPDATE_BATCH to repopulate it with the saved key-value pairs.CRIU currently supports data serialization for the following BPF map types:
BPF_MAP_TYPE_HASHBPF_MAP_TYPE_ARRAYFor other map types, CRIU may be able to restore the map itself (metadata) but not its contents, depending on kernel support for batch operations on those types.
If a BPF map was marked as read-only (frozen) using bpf_map_freeze(), CRIU detects this state from fdinfo and reapplies the freeze during restoration after the data has been repopulated.
BPF_MAP_TYPE_PERF_EVENT_ARRAY, BPF_MAP_TYPE_LPM_TRIE).map_extra fields introduced in recent kernels (currently only partially parsed with limited restoration).