feat!: drop access enter evts gen, testing and parsing code

As the `access` exit events contain all the information needed, drop
`access` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `access` enter evts gen and parsing

Signed-off-by: Leonardo Di Giovanna <[email protected]>

Author: ekoops

driver/bpf/fillers.h

@@ -1198,12 +1198,6 @@ FILLER(sys_fcntl_x, true) {
 	return bpf_push_u8_to_ring(data, fcntl_cmd_to_scap(cmd));
 }
 
-FILLER(sys_access_e, true) {
-	/* Parameter 1: mode (type: PT_UINT32) */
-	int mode = (int)bpf_syscall_get_argument(data, 1);
-	return bpf_push_u32_to_ring(data, (uint32_t)access_flags_to_scap(mode));
-}
-
 FILLER(sys_access_x, true) {
 	/* Parameter 1: res (type: PT_ERRNO) */
 	long retval = bpf_syscall_get_retval(data->ctx);

driver/fillers_table.c

@@ -246,7 +246,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
                                   {{AF_ID_RETVAL}, {0}, {1}, {2}}},
         [PPME_SYSCALL_SEMGET_E] = {FILLER_DISABLED},
         [PPME_SYSCALL_SEMGET_X] = {FILLER_REF(sys_semget_x)},
-        [PPME_SYSCALL_ACCESS_E] = {FILLER_REF(sys_access_e)},
+        [PPME_SYSCALL_ACCESS_E] = {FILLER_DISABLED},
         [PPME_SYSCALL_ACCESS_X] = {FILLER_REF(sys_access_x)},
         [PPME_SYSCALL_CHROOT_E] = {FILLER_REF(sys_empty)},
         [PPME_SYSCALL_CHROOT_X] = {FILLER_REF(sys_autofill), 2, APT_REG, {{AF_ID_RETVAL}, {0}}},

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/access.bpf.c

@@ -9,32 +9,6 @@
 #include <helpers/interfaces/fixed_size_event.h>
 #include <helpers/interfaces/variable_size_event.h>
 
-/*=============================== ENTER EVENT ===========================*/
-
-SEC("tp_btf/sys_enter")
-int BPF_PROG(access_e, struct pt_regs *regs, long id) {
-	struct ringbuf_struct ringbuf;
-	if(!ringbuf__reserve_space(&ringbuf, ACCESS_E_SIZE, PPME_SYSCALL_ACCESS_E)) {
-		return 0;
-	}
-
-	ringbuf__store_event_header(&ringbuf);
-
-	/*=============================== COLLECT PARAMETERS  ===========================*/
-
-	/* Parameter 1: mode (type: PT_UINT32) */
-	int mode = (int)extract__syscall_argument(regs, 1);
-	ringbuf__store_u32(&ringbuf, (uint32_t)access_flags_to_scap(mode));
-
-	/*=============================== COLLECT PARAMETERS  ===========================*/
-
-	ringbuf__submit_event(&ringbuf);
-
-	return 0;
-}
-
-/*=============================== ENTER EVENT ===========================*/
-
 /*=============================== EXIT EVENT ===========================*/
 
 SEC("tp_btf/sys_exit")

driver/ppm_fillers.c

@@ -8057,18 +8057,6 @@ int f_sys_semctl_x(struct event_filler_arguments *args) {
 	return add_sentinel(args);
 }
 
-int f_sys_access_e(struct event_filler_arguments *args) {
-	unsigned long val;
-	int res;
-
-	/* Parameter 1: mode (type: PT_UINT32) */
-	syscall_get_arguments_deprecated(args, 1, 1, &val);
-	res = val_to_ring(args, access_flags_to_scap(val), 0, true, 0);
-	CHECK_RES(res);
-
-	return add_sentinel(args);
-}
-
 int f_sys_access_x(struct event_filler_arguments *args) {
 	int64_t retval;
 	int res;

driver/ppm_fillers.h

@@ -111,7 +111,6 @@ or GPL2.txt for full copies of the license.
 	FN(sys_ppoll_x)                      \
 	FN(sys_mount_e)                      \
 	FN(sys_mount_x)                      \
-	FN(sys_access_e)                     \
 	FN(sys_access_x)                     \
 	FN(sys_socket_x)                     \
 	FN(sys_bpf_x)                        \

test/drivers/test_suites/syscall_enter_suite/access_e.cpp

@@ -203,7 +203,7 @@ event_prog_t event_prog_table[PPM_EVENT_MAX][MAX_FEATURE_CHECKS] = {
         [PPME_SYSCALL_EPOLL_CREATE_X] = {{false, "epoll_create_x", 0}},
         [PPME_SYSCALL_EPOLL_CREATE1_E] = {{false, "epoll_create1_e", 0}},
         [PPME_SYSCALL_EPOLL_CREATE1_X] = {{false, "epoll_create1_x", 0}},
-        [PPME_SYSCALL_ACCESS_E] = {{false, "access_e", 0}},
+        [PPME_SYSCALL_ACCESS_E] = {{true, NULL}},
         [PPME_SYSCALL_ACCESS_X] = {{false, "access_x", 0}},
         [PPME_SOCKET_GETSOCKOPT_E] = {{true, NULL}},
         [PPME_SOCKET_GETSOCKOPT_X] = {{false, "getsockopt_x", 0}},