libbpf-tools: tcpstates: Fix CLOSE to SYN_SENT wrong delta

[Rtoax]

When the TCP socket is initially created, the timestamp of when sk is created is not recorded, so the delay from the CLOSE state to any state is 0, which is obviously wrong.

This patch records the time when sk is created as the start time of the CLOSE state, thereby obtaining the time from CLOSE to LISTEN or SYN_SENT.

At the same time, because some time differences are really too small, nanosecond level time display support is added (-n).

Before:

bcc/libbpf-tools$ sudo ./tcpstates | grep CLOSE
ffff8b296bd1af80 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
ffff8b296bd1df00 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
ffff8b29c851a600 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
ffff8b29c4ac4c00 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
ffff8b29c4ac6880 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
ffff8b29c4ac4280 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
ffff8b29c4ac5580 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.000
                                                                                            ^^^^^

After:

bcc/libbpf-tools$ sudo ./tcpstates | grep CLOSE
ffff8b29f6c91300 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.020
ffff8b29f6c94280 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.011
ffff8b2a1d45cc00 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.022
ffff8b2a1d45af80 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.027
ffff8b29c8518980 421523  Chrome_Chi 10.56.52.9  0  10.32.0.200  8080  CLOSE  -> SYN_SENT    0.023

[yonghong-song]

I think using tcp_v4_init_sock/tcp_v6_init_sock to initialize the sock for CLOSE->SYN_SENT does not really represent the time from CLOSE to SYNC_SENT.

The statement machine
CLOSE -> connect() (user space) -> tcp_v{4,6}_init_sock() -> SYN_SENT

At CLOSE moment, the socket is removed from the hash table, so the current implementation will have time 0.

This patch added socket back to the hash table at tcp_v{4,6}_init_sock() so the CLOSE->SYN_SENT time is actually the time from tcp_v{4,6}_init_sock() to SYN_SENT. So the time is not correct.