Change the way that the latency histograms are stored in BPF
maps. Instead of keeping a separate array map for each histogram,
store all histograms in a single hash map, encoding the hook as part
of the key.

This results in higher overhead (as hash lookups are slower than array
lookups), but is much more flexible. This makes it easier to add
additional hook points as no new maps (and related code for mapping
hooks to maps) need to be added. Furthermore, in the future it allows
to easily group the results on various aspects by adding additional
members to the key.

On the userspace side, maintain a sorted array of the encountered
histogram keys and a mapping to the corresponding histogram
buckets. Instead of keeping a separate key for each histogram
bucket (as the BPF maps do to be compatible with ebpf-exporter),
restructure the data so only a single key is used per
histogram. Essentially remove the bucket member from the key, keeping
a full histogram (where any missing buckets are zeroed) for the
remaining unique members in the histogram key (so far just the hook
identifier).

Keeping the array of histogram keys sorted allows for relatively quick
lookups using binary search. When a new histogram key is encountered
it will incur significant overhead the first time as it needs to be
inserted into the right place in the array, but lookups ought to be
much more common than inserting new keys. While this data structure
will not scale well to a very large amount of unique keys (insertion
time is O(n), lookup O(log n)), it avoids implementing or adding
dependencies to more complicated data structures like trees or
hash maps. As long as we do not need to keep track of many thousands
of histograms, this solution should be good enough.

Signed-off-by: Simon Sundberg <[email protected]>

Update the ebpf-exporter config to match the change to how the
histograms are stored in the previous commit.

As all histograms are stored in a single map, adding additional hooks
in the future will only require adding a single line to the hook
static_map.

Signed-off-by: Simon Sundberg <[email protected]>

Refactor the parsing of arguments that accept lists of
values (eg. --pids 1,2,3). Introduce a generic function for
parsing delimited string lists and reuse that function to avoid
repeating similar logic. This will simplify adding additional
arguments that accept lists of values in the future.

Signed-off-by: Simon Sundberg <[email protected]>

Add the option -i/--interfaces option to filter for specific network
interfaces. The interfaces can either be provided as interface names
or indices, although if the interfaces are in another namespace than
the netstacklat userspace agent is running in they SHOULD be provided
as indices. The names are resolved in the current namespace, and may
therefore fail or yield incorrect indices if the interface is in
another namespace.

Unlike the previous -p/--pids option, this option applies to all
existing probe points in netstacklat. On the eBPF side, use
skb->skb_iif if the skb is available as context, otherwise use the
sk->sk_rx_dst_ifindex from the socket. Use a similar approach as the
previous PID filter, where an array map is used to hold ifindices that
should be filtered for, allowing a quick lookup. While the
ifindex (unlike the PID) does not seem to have a clear upper limit,
limit it to 16384 (IFINDEX_MAX) to keep the filter map reasonably
small while still supporting the vast majority of scenarios.

Note that internally filtering is applied on the interface
index (ifindex), regardless if the option provided the index or the
name for the interface. If the same ifindex is repeated in multiple
network namespaces, it will include traffic for all of them. A future
commit will add an option to also filter for a specific network
namespace.

Renames MAX_FILTER_PIDS to MAX_PARSED_PIDS to better reflect what the
actual limit is for, and use same naming convention limit on parsed
ifaces. Also fixes an off-by-one error in the map size for pid filter
map (netstack_pidfilter), as it was unable to fit the largest allowed
pid (PID_MAX_LIMIT).

Signed-off-by: Simon Sundberg <[email protected]>

Add the -c/--cgroups option that lets the user specify one or more
cgroups (v2) to filter for. The cgroups can either be provided through
their absolute path (including mount path) or as the cgroup
ID (inode). This filter only applies to the probe points running in
process context, just like the PIDs filter, which is currently only
the socket dequeue probes (tcp-read and udp-read).

To keep it simple (and avoid high run-time overhead), only do an exact
match on the cgroup ID. Do not consider the hierarchical relationship
between cgroups. I.e. if the output is filtered for a parent cgroup,
the children of that cgroup will NOT be included unless the children
cgroups have also been explicitly specified.

To support the wide range of possible cgroup IDs, keep the cgroups to
filter for in a sparse hasmap (where only values to include have
entries) instead of the dense array maps (where all possible values
have keys but those to include have non-zero values) like previous
multi-valued filters. This unfortuantely adds considerable overhead
for doing an additional hash map lookup, but keeping a dense map for
all possible IDs is not feasible. Using cgroup
storage (BPF_MAP_TYPE_CGRP_STORAGE) has also been considered, but that
was found to be even slower than the hashmap lookup.

If running with ebpf-exporter, the cgroup filter map can be populated
and maintained by ebpf-exporter by configuring the cgroup_id_map
setting in the YAML config. Update the YAML config to show an example
of how it can be set (in this case including all cgroups under the
system.slice).

Signed-off-by: Simon Sundberg <[email protected]>

Make the userspace agent set the BPF map sizes based on configured
options. This allows more suitable map sizes to be used during run
time than the static limits set in the BPF programs. This avoids
wasting memory by using unnecessary large maps, and might slightly
improve hashmap lookup performance by sizing them based on the
expected number of entries (small enough that many entries may fit in
cache, large enough to avoid excessive hash collisions).

Scale the histogram map based on the expected number of histograms,
the PID and ifindex filter maps to fit the largest key they need to
include and the cgroup filter map to fit all tracked cgroups.

This also fixes a bug where the maximum allowed PID (PID_MAX_LIMIT)
and ifindex (IFINDEX_MAX) did not fit in their corresponding filter
maps (off-by-one error).

Signed-off-by: Simon Sundberg <[email protected]>

Add the -I/--groupby-interface option to collect and report the data
on a per-interface (or rather ifindex) basis. Note that the network
interfaces are tracked based on their ifindex, so if network namespace
filtering has been disabled and there exists interfaces in different
namespaces with a common ifindex, their data will be merged into the
same histogram.

Always write the interface index rather than the interface name in the
output. While the interface name for the same network namespace as the
user space agent runs in can easily be retrieved with
e.g. if_indextoname(), that will only be valid if the user has
configured netstacklat to only monitor its own network namespace. If a
different network namespace is monitored, or filtration for network
namespaces is disabled, translating to the interface names in the
current namespace might produce misleading results.

An alternative could be to print out the interface names in case the
current network namespace is the one monitored (the default), or the
index if there's a risk that the data might be from a different
namespace. However, in addition to that added complexity, that will
produce somewhat inconsistent output (i.e. you might get interface
names or interface indices depending on how you configure
netstacklat).

Signed-off-by: Simon Sundberg <[email protected]>

Add the -C/--groupby-cgroup option to collect and report data on a
per-cgroup basis. Just like the -c/--cgroups option, this will only
apply to probes in the process context, which is currently only
tcp-socket-read and udp-socket-read.

When reporting the data, print out the cgroup ID (inode number)
directly instead of the cgroup path. As far as I can tell, the only
way to resolve the ID into a path is the walk the entire cgroup
mount (e.g. /sys/fs/cgroup) and stat each path to find the matching
inode. Doing this every time the cgroup needs to be printed seems
highly inefficient, and to create an efficient cache the most suitable
data structure seems like a hashmap, which C lacks. Adding support for
printing out the cgroup path would thus be a significant
implementation effort for something we in the end primarily will rely
on ebpf-exporter for anyways.

Signed-off-by: Simon Sundberg <[email protected]>

Many of the options to filter for a subset of values (--pids,
--interfaces, and --cgroups) rely on filling BPF maps with the values
to include. When running together with the provided netstacklat user
space process, the user space process handles filling these maps with
the values passed on the command line. However, when using the
netstacklat eBPF programs with some external loader, like the
ebpf-exporter, these maps have to be filled by the user in some other
manner.

To make it easier to use netstacklat with external eBPF loaders,
provide the fill_filter_maps.sh script. Rely on bpftool to fill the
BPF maps (based on the map names as defined in the netstacklat.bpf.c
file). in the script. Make the script support all the current filters
that make use of maps, i.e. PIDs (pid), network interfaces (iface) and
cgroups (cgroup).

The pid option only supports integers. The iface option support either
interface names or their ifindex. The cgroup option accepts either the
cgroup ID (their inode number) or the full path to the cgroup.

Examples:
$ ./fill_filter_maps.sh pid 1234 98765
$ ./fill_filter_maps.sh iface veth0 lo 123
$ ./fill_filter_maps.sh cgroup /sys/fs/cgroup/system.slice/prometheus.service/ 12345

Note that for the values in the filter map to actually be used by the
netstacklat eBPF programs, the corresponding
filter_{pid,ifindex,cgroup} value must be true (by default they're all
false). The netstacklat user space process normally takes care of
enabling these as needed, but if used with an external loader the
easiest way to enable these is probably to just change them in
user_config at the start of netstacklat.bpf.c (and recompile).

Also note that this script can also be used together with the
netstacklat user space loader to add additional values to filter for
after starting the program. However, the netstacklat user space loader
automatically minimizes the size of the filter maps since commit
"netstacklat: Dynamically configure map sizes". So unless the initial
filter values provided as netstacklat CLI arguments resulted in
sufficiently large filter maps, the fill_filter_maps.sh script may not
be able to successfully add the desired values.

Finally, note that as bpftool expects you to feed it the individual
bytes of the keys, the order of the bytes will be dependant on the
endianess of the machine. Currently only support little-endian
machines, big-endian support can be added later if needed.

Signed-off-by: Simon Sundberg <[email protected]>