use single chan to emit events and errors, support new struct inode *time fields

cmd/eventstrace/main.go

@@ -39,21 +39,23 @@ func main() {
 	}
 	log.Println("probes loaded!")
 
-	events := make(chan ebpfevents.Event)
-	errors := make(chan error)
-	go l.EventLoop(context.Background(), events, errors)
+	records := make(chan ebpfevents.Record, l.BufferLen())
+	go l.EventLoop(context.Background(), records)
 
 	for {
 		select {
-		case err := <-errors:
-			fmt.Printf("ERROR: %v\n", err)
-			continue
-		case ev := <-events:
-			evj, err := json.Marshal(ev)
+		case r := <-records:
+			if r.Error != nil {
+				fmt.Printf("ERROR: %v\n", r.Error)
+				continue
+			}
+
+			evj, err := json.Marshal(r.Event)
 			if err != nil {
 				log.Fatal(err)
 			}
 			fmt.Printf("%v\n", string(evj))
+
 			continue
 		case <-stop:
 			return

loader.go

@@ -261,43 +261,44 @@ func (l *Loader) attachBpfProgs() error {
 	return err
 }
 
-func (l *Loader) EventLoop(ctx context.Context, out chan<- Event, errs chan<- error) {
-	in := make(chan ringbuf.Record, l.objs.bpfMaps.Ringbuf.MaxEntries())
-
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			default:
-				record, err := l.reader.Read()
-				if errors.Is(err, ringbuf.ErrClosed) {
-					break
-				}
-				if err != nil {
-					errs <- err
-					continue
-				}
-				in <- record
-			}
-		}
-	}()
+type Record struct {
+	Event *Event
+	Error error
+}
 
+func (l *Loader) EventLoop(ctx context.Context, out chan<- Record) {
 	for {
 		select {
 		case <-ctx.Done():
 			return
-		case record := <-in:
-			event, err := NewEvent(record.RawSample)
+		default:
+			var r Record
+
+			record, err := l.reader.Read()
+			if errors.Is(err, ringbuf.ErrClosed) {
+				break
+			}
 			if err != nil {
-				errs <- err
+				r.Error = err
+				out <- r
 				continue
 			}
-			out <- *event
+
+			event, err := NewEvent(record.RawSample)
+			if err != nil {
+				r.Error = err
+			}
+			r.Event = event
+
+			out <- r
 		}
 	}
 }
 
+func (l *Loader) BufferLen() uint32 {
+	return l.objs.bpfMaps.Ringbuf.MaxEntries()
+}
+
 func (l *Loader) Close() error {
 	if l.reader != nil {
 		l.reader.Close()
@@ -370,5 +371,15 @@ func (l *Loader) fillIndexes() error {
 	err = errors.Join(err, l.fillArgIndex("do_truncate", "filp"))
 	err = errors.Join(err, l.fillRetIndex("do_truncate"))
 
+	if kernel.FieldExists(l.kbtf, "inode", "__i_atime") {
+		err = errors.Join(err, l.fillFieldOffset("inode", "__i_atime"))
+	}
+	if kernel.FieldExists(l.kbtf, "inode", "__i_mtime") {
+		err = errors.Join(err, l.fillFieldOffset("inode", "__i_mtime"))
+	}
+	if kernel.FieldExists(l.kbtf, "inode", "__i_ctime") {
+		err = errors.Join(err, l.fillFieldOffset("inode", "__i_ctime"))
+	}
+
 	return err
 }

loader_test.go

@@ -30,21 +30,22 @@ import (
 
 func TestNewLoader(t *testing.T) {
 	l, err := ebpfevents.NewLoader()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	defer l.Close()
 
-	events := make(chan ebpfevents.Event, 3)
-	errors := make(chan error, 3)
-	go l.EventLoop(context.Background(), events, errors)
+	records := make(chan ebpfevents.Record, 3)
+	go l.EventLoop(context.Background(), records)
 
 	// trigger an event
 	fname := "testloader"
 	_, err = os.Create(fname)
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	defer os.Remove(fname)
 
 	time.Sleep(time.Second)
 
-	assert.NotEmpty(t, events)
-	assert.Empty(t, errors)
+	assert.Equal(t, 3, len(records))
+	assert.NoError(t, (<-records).Error) // 1
+	assert.NoError(t, (<-records).Error) // 2
+	assert.NoError(t, (<-records).Error) // 3
 }