How to release a BPF map that was created by the bpftool?

Question

I am a complete novice at anything ebpf but trying out some random ideas to get some knowledge. I've built the libbpf library downloaded from (https://github.com/libbpf/libbpf-bootstrap) and test bpftool at first. And then I tried to create a map by using the command below and it worked.

$ ./bpftool map create /sys/fs/bpf/map3 type array key 4 value 4 entries 1024 name test_map
$ ./bpftool map list
147: array  name test_map  flags 0x0
        key 4B  value 1B  max_entries 2  memlock 4096B
360: array  name test_map  flags 0x0
        key 4B  value 1B  max_entries 1024  memlock 8192B
369: array  name test_map  flags 0x0
        key 4B  value 1B  max_entries 1024  memlock 8192B
371: array  name test_map  flags 0x0
        key 4B  value 1B  max_entries 102400  memlock 819200B
377: array  name test_map  flags 0x0
        key 4B  value 4B  max_entries 1024  memlock 8192B
382: hash  name test_map  flags 0x0
        key 4B  value 4B  max_entries 1024  memlock 8192B
387: hash  name test_map  flags 0x0
        key 4B  value 1B  max_entries 1024  memlock 8192B
395: array  name pid_iter.rodata  flags 0x480
        key 4B  value 4B  max_entries 1  memlock 4096B
        btf_id 403  frozen
        pids bpftool(28399)
396: array  name libbpf_det_bind  flags 0x0
        key 4B  value 32B  max_entries 1  memlock 4096B

But when I'm trying to delete them I got nothing to do that from the bpftool command list.

I've read the Docs like "bpftool/docs/bpftool.8" or "bpftool/docs/bpftool-map.8" in the repo and still got no idea and I've also searched the web and known that when the FD of the map is closed the map will release automatically. So my question is:

How to release the BPF map created by bpftool?
Why does the map still stay in the kernel when the bpftool command finished executing?

Qeole · Answer 1 · 2023-08-15T17:06:07.080

How to release the BPF map created by bpftool?

Simply delete its pinned path (rm /sys/fs/bpf/map3).

If other references to the map have been created after the map was pinned, you have to remove them as well. For example, if you loaded a program that uses this map, you have to unload the program first before you can release the map. Otherwise, the kernel will keep the map in memory as long as it is referenced (by a program, a pinned path, a file descriptor, and - if I remember correctly - a map-in-map reference).

Why does the map still stay in the kernel when the bpftool command finished executing?

It stays because bpftool pins the map, at the path you provide on the command line. If it didn't do that, the map would indeed be removed by the kernel as soon as bpftool exits (and closes it files descriptors). This would make it very difficult to reuse maps in programs. Pinning a BPF object (a map or a program, for example) is used precisely to make it persistent in the absence of other references to this object (and also to provide a handy way to manipulate this object, more deterministic that the IDs generated at their creation).

You may also want to have a look at this post I wrote on the subject.

P.S. Improvements to bpftool docs are welcome :)

How to release a BPF map that was created by the bpftool?

1 Answers1