fix(ebpf): adjust inode struct to kernel v6.11

- Add support for three different ranges of kernel versions.
- For kernel 6.11 and newer, struct inode uses the fields
i_ctime_sec and i_ctime_nsec for time.
- For kernels 6.6 to 6.10, struct inode uses __i_ctime.
- For kernels 6.5 and older, struct inode uses i_ctime.
- Align struct inode to the kernel 6.11 structure and mock
the inode struct for kernels older than 6.11.

pkg/ebpf/c/common/filesystem.h

@@ -57,13 +57,24 @@ statfunc u64 get_time_nanosec_timespec(struct timespec64 *ts)
 
 statfunc u64 get_ctime_nanosec_from_inode(struct inode *inode)
 {
-    struct timespec64 ts;
-    if (bpf_core_field_exists(inode->__i_ctime)) { // Version >= 6.6
-        ts = BPF_CORE_READ(inode, __i_ctime);
-    } else {
-        struct inode___older_v66 *old_inode = (void *) inode;
-        ts = BPF_CORE_READ(old_inode, i_ctime);
+    struct timespec64 ts = {};
+
+    // Kernel >= 6.11
+    if (bpf_core_field_exists(inode->i_ctime_sec) && bpf_core_field_exists(inode->i_ctime_nsec)) {
+        ts.tv_sec = BPF_CORE_READ(inode, i_ctime_sec);
+        ts.tv_nsec = BPF_CORE_READ(inode, i_ctime_nsec);
+    }
+    // Kernel 6.6 - 6.10
+    else if (bpf_core_field_exists(((struct inode___older_v611 *) inode)->__i_ctime)) {
+        struct inode___older_v611 *old_inode_v611 = (void *) inode;
+        ts = BPF_CORE_READ(old_inode_v611, __i_ctime);
     }
+    // Kernel < 6.6
+    else {
+        struct inode___older_v66 *old_inode_v66 = (void *) inode;
+        ts = BPF_CORE_READ(old_inode_v66, i_ctime);
+    }
+
     return get_time_nanosec_timespec(&ts);
 }
 

pkg/ebpf/c/vmlinux.h

@@ -658,7 +658,8 @@ struct inode {
     umode_t i_mode;
     struct super_block *i_sb;
     long unsigned int i_ino;
-    struct timespec64 __i_ctime;
+    time64_t i_ctime_sec;
+    u32 i_ctime_nsec;
     loff_t i_size;
     struct file_operations *i_fop;
 };

pkg/ebpf/c/vmlinux_flavors.h

@@ -100,6 +100,11 @@ struct inode___older_v66 {
     struct timespec64 i_ctime;
 };
 
+// kernel >= v6.11 inode i_ctime field change
+struct inode___older_v611 {
+    struct timespec64 __i_ctime;
+};
+
 ///////////////////
 
 #pragma clang attribute pop