I've loaded an ebpf program using the bpftool, with the following command: sudo bpftool prog load hello.bpf.o /sys/fs/bpf/my_ebpf_program. How could I completely unload the program from the kernel? There doesn't seem to be an unload sub-command available.
Here is the output of the progs overview:
...
302: tracepoint name tracepoint__sys tag a04f5eef06a7f555 gpl
loaded_at 2023-11-08T09:51:05+0000 uid 0
xlated 16B jited 16B memlock 4096B
...
A BPF program is unloaded from the kernel once there are no more "references" to it. The reason you had to provide bpftool with a bpffs path is because it pinned your program to the FS at /sys/fs/bpf/my_ebpf_program so to unload your program you can delete this pin rm -Rf /sys/fs/bpf/my_ebpf_program which should unload the program (assuming no other processes are holding onto a reference)