On Thu, Apr 09, 2020 at 12:26:37PM +0900, Daniel T. Lee wrote: > > So, I think this 'unable to attach bpf program on BPF map function (read,write)' > is a bug. Or is it desired action? desired action. > If it is a bug, bpf_{enable|disable}_instrumentation() should only > cover stackmap > as the upper commit intended. Not sure but adding another flag for > lock might work? > > Or if this is an desired action, this should be covered at > documentation with a limitation > and tracex6 sample has to be removed. Right. That test has to be fixed. These two old commits: commit 020a32d9581a ("bpf: add a test case for helper bpf_perf_event_read_value") commit 41e9a8046c92 ("samples/bpf: add tests for more perf event types") attached kprobe bpf to inner map accessors get_next and lookup. That's safe only for a subset of map types and not allowed in general. It works for hash and array because they don't take locks in these operations.