chore(ebpf): optimize filldir64 program

[NDStrahilevitz]

1. Explain what the PR does

0aa855c chore(ebpf): optimize filldir64 program

The filldir64 program runs very frequently, and as such incurs great
overhead. However, its usecase only requires the submission of events
from non 0 process inodes. Since this filter is faster than scope
evaluation, move this condition check before program data initialization
and scope evaluation.

Optimization reduces the average runtime to ~18% of the previous
overhead. Note, that even for more run amounts, the overall runtime is
now 27% from the previous version.

Before:
PROGRAM: filldir64 (type: kprobe, runtime: 61047110 ns, amount: 53135 times, average: 1148 ns)
After:
PROGRAM: filldir64 (type: kprobe, runtime: 16507056 ns, amount: 80350 times, average: 205 ns)

2. Explain how to test it

hidden_inodes event should work the same.

3. Other comments

[geyslan]

Awesome. ❤️

I have only one question: as evaluate_scope_filters() updates p, it could somehow jeopardise some expected behaviour?

Doubt:

Commit says:

However, its usecase only requires the submission of events from non 0 process inodes.

Wouldn't it be the opposite? ... only ... from 0 process...?

[yanivagman]

LGTM

[NDStrahilevitz]

I have only one question: as evaluate_scope_filters() updates p, it could somehow jeopardise some expected behaviour?

I don't think so, since this isn't a program_data struct which is shared later on.

However, its usecase only requires the submission of events from non 0 process inodes.
Wouldn't it be the opposite? ... only ... from 0 process...?

You're right, changed the commit message accordingly. Will merge once e2e passes again.