Hi Sasha, Peter,
Another data point: Ubuntu picked up the same backport in its 7.0 kernel
(7.0.0-38-generic), and it breaks Inspektor Gadget and bpftrace in the same
way. A BPF program on sys_enter_execve or sys_enter_openat only runs on CPU 0;
sys_exit_* and sys_enter_close keep working on all CPUs. Reproducer:
bpftrace -e 'tracepoint:syscalls:sys_enter_openat /comm == "cat"/ { @[cpu] =
count(); }' &
for c in $(seq 0 7); do taskset -c $c cat /etc/hostname >/dev/null; done
Only @[0] shows up.
I also tested v7.1.13 under QEMU with 4 CPUs, using a small cilium/ebpf test
that counts per-CPU hits of a tracepoint program while running 10 syscalls
pinned to each CPU:
v7.1.13: sys_enter_openat [10 0 0 0], sys_enter_close [10 10 10 10],
sys_exit_openat [10 10 10 10]
v7.1.13 + revert: sys_enter_openat [10 10 10 10], sys_enter_close [10 10 10
10], sys_exit_openat [10 10 10 10]
The revert looks right to me for 7.1.y, and for any other stable branch without
57918341dd19.
Tested-by: Alban Crequy <[email protected]>
Alban
