From 90ddedc383b50ce64eec01301d83681ebf1a560c Mon Sep 17 00:00:00 2001
From: Raphael Campos <raphaelcampos.rp@gmail.com>
Date: Wed, 18 Dec 2024 06:30:52 -0600
Subject: [PATCH] WIP: fix inode time field

temp commit
---
 .github/workflows/pr.yaml      |  2 +-
 pkg/ebpf/c/common/filesystem.h | 19 +++++++++++++++----
 pkg/ebpf/c/vmlinux.h           |  3 ++-
 pkg/ebpf/c/vmlinux_flavors.h   |  5 +++++
 4 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index b30a0c0063fe..b180b2d6abc3 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -287,7 +287,7 @@ jobs:
               ["Noble 6.10 aarch64"]="01ce0f71400b5ff38 aarch64"
               ["Noble 6.11 x86_64"]="0ce1f88aa63091921 x86_64"
               ["Noble 6.11 aarch64"]="0123508488affb578 aarch64"
-              ["Noble 6.12 x86_64"]="0f039e123e781e989 x86_64"
+              ["Noble 6.12 x86_64"]="0e38f3caba1b4234d x86_64"
               ["Noble 6.12 aarch64"]="0547f429681dc1f2a aarch64"
               # expand as needed
           )
diff --git a/pkg/ebpf/c/common/filesystem.h b/pkg/ebpf/c/common/filesystem.h
index 9f084b3778a9..b5b6b3138a4f 100644
--- a/pkg/ebpf/c/common/filesystem.h
+++ b/pkg/ebpf/c/common/filesystem.h
@@ -57,13 +57,24 @@ statfunc u64 get_time_nanosec_timespec(struct timespec64 *ts)
 
 statfunc u64 get_ctime_nanosec_from_inode(struct inode *inode)
 {
-    struct timespec64 ts;
-    if (bpf_core_field_exists(inode->__i_ctime)) { // Version >= 6.6
-        ts = BPF_CORE_READ(inode, __i_ctime);
-    } else {
+    struct timespec64 ts = {};
+
+    // Kernel >= 6.11
+    if (bpf_core_field_exists(inode->i_ctime_sec) && bpf_core_field_exists(inode->i_ctime_nsec)) {
+        ts.tv_sec = BPF_CORE_READ(inode, i_ctime_sec);
+        ts.tv_nsec = BPF_CORE_READ(inode, i_ctime_nsec);
+    }
+    // Kernel 6.6 - 6.10
+    else if (bpf_core_field_exists(((struct inode___older_v611 *) inode)->__i_ctime)) {
+        struct inode___older_v611 *new_inode = (void *) inode;
+        ts = BPF_CORE_READ(new_inode, __i_ctime);
+    }
+    // Kernel < 6.6
+    else {
         struct inode___older_v66 *old_inode = (void *) inode;
         ts = BPF_CORE_READ(old_inode, i_ctime);
     }
+
     return get_time_nanosec_timespec(&ts);
 }
 
diff --git a/pkg/ebpf/c/vmlinux.h b/pkg/ebpf/c/vmlinux.h
index c8939f60a274..41cbfd596728 100644
--- a/pkg/ebpf/c/vmlinux.h
+++ b/pkg/ebpf/c/vmlinux.h
@@ -658,7 +658,8 @@ struct inode {
     umode_t i_mode;
     struct super_block *i_sb;
     long unsigned int i_ino;
-    struct timespec64 __i_ctime;
+    time64_t i_ctime_sec;
+    u32 i_ctime_nsec;
     loff_t i_size;
     struct file_operations *i_fop;
 };
diff --git a/pkg/ebpf/c/vmlinux_flavors.h b/pkg/ebpf/c/vmlinux_flavors.h
index 783aa96d5fa3..71b40ebd9b01 100644
--- a/pkg/ebpf/c/vmlinux_flavors.h
+++ b/pkg/ebpf/c/vmlinux_flavors.h
@@ -100,6 +100,11 @@ struct inode___older_v66 {
     struct timespec64 i_ctime;
 };
 
+// kernel >= v6.11 inode i_ctime field change
+struct inode___older_v611 {
+    struct timespec64 __i_ctime;
+};
+
 ///////////////////
 
 #pragma clang attribute pop