Implement event notifier error counter
[lttng-modules.git] / src / lttng-syscalls.c
index 0c28a467872b27d07bec36ba5ef4dbbed21cc16f..41e10be07ab513f68c397463b29fbb0ba80cf3b0 100644 (file)
@@ -29,6 +29,7 @@
 #include <wrapper/rcu.h>
 #include <wrapper/syscall.h>
 #include <lttng/events.h>
+#include <lttng/utils.h>
 
 #ifndef CONFIG_COMPAT
 # ifndef is_compat_task
@@ -59,9 +60,16 @@ enum sc_type {
 #define COMPAT_SYSCALL_EXIT_STR                __stringify(COMPAT_SYSCALL_EXIT_TOK)
 
 static
-void syscall_entry_probe(void *__data, struct pt_regs *regs, long id);
+void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id);
 static
-void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret);
+void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret);
+
+static
+void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
+               long id);
+static
+void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
+               long ret);
 
 /*
  * Forward declarations for old kernels.
@@ -122,7 +130,7 @@ typedef __kernel_old_time_t time_t;
 
 /* Hijack probe callback for system call enter */
 #undef TP_PROBE_CB
-#define TP_PROBE_CB(_template)         &syscall_entry_probe
+#define TP_PROBE_CB(_template)         &syscall_entry_event_probe
 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
        LTTNG_TRACEPOINT_EVENT(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
                PARAMS(_fields))
@@ -158,7 +166,7 @@ typedef __kernel_old_time_t time_t;
 #undef _TRACE_SYSCALLS_POINTERS_H
 
 /* Hijack probe callback for compat system call enter */
-#define TP_PROBE_CB(_template)         &syscall_entry_probe
+#define TP_PROBE_CB(_template)         &syscall_entry_event_probe
 #define LTTNG_SC_COMPAT
 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
        LTTNG_TRACEPOINT_EVENT(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
@@ -207,7 +215,7 @@ typedef __kernel_old_time_t time_t;
 #define sc_inout(...)          __VA_ARGS__
 
 /* Hijack probe callback for system call exit */
-#define TP_PROBE_CB(_template)         &syscall_exit_probe
+#define TP_PROBE_CB(_template)         &syscall_exit_event_probe
 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
        LTTNG_TRACEPOINT_EVENT(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
                PARAMS(_fields))
@@ -242,7 +250,7 @@ typedef __kernel_old_time_t time_t;
 
 
 /* Hijack probe callback for compat system call exit */
-#define TP_PROBE_CB(_template)         &syscall_exit_probe
+#define TP_PROBE_CB(_template)         &syscall_exit_event_probe
 #define LTTNG_SC_COMPAT
 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
        LTTNG_TRACEPOINT_EVENT(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
@@ -284,7 +292,8 @@ typedef __kernel_old_time_t time_t;
 #undef CREATE_TRACE_POINTS
 
 struct trace_syscall_entry {
-       void *func;
+       void *event_func;
+       void *event_notifier_func;
        const struct lttng_event_desc *desc;
        const struct lttng_event_field *fields;
        unsigned int nrargs;
@@ -300,13 +309,14 @@ struct trace_syscall_entry {
 #undef TRACE_SYSCALL_TABLE
 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
        [ _nr ] = {                                             \
-               .func = __event_probe__syscall_entry_##_template, \
+               .event_func = __event_probe__syscall_entry_##_template, \
+               .event_notifier_func = __event_notifier_probe__syscall_entry_##_template, \
                .nrargs = (_nrargs),                            \
                .fields = __event_fields___syscall_entry_##_template, \
                .desc = &__event_desc___syscall_entry_##_name,  \
        },
 
-/* Syscall enter tracing table */
+/* Event syscall enter tracing table */
 static const struct trace_syscall_entry sc_table[] = {
 #include <instrumentation/syscalls/headers/syscalls_integers.h>
 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
@@ -315,13 +325,14 @@ static const struct trace_syscall_entry sc_table[] = {
 #undef TRACE_SYSCALL_TABLE
 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
        [ _nr ] = {                                             \
-               .func = __event_probe__compat_syscall_entry_##_template, \
+               .event_func = __event_probe__compat_syscall_entry_##_template, \
+               .event_notifier_func = __event_notifier_probe__compat_syscall_entry_##_template, \
                .nrargs = (_nrargs),                            \
                .fields = __event_fields___compat_syscall_entry_##_template, \
                .desc = &__event_desc___compat_syscall_entry_##_name, \
        },
 
-/* Compat syscall enter table */
+/* Event compat syscall enter table */
 const struct trace_syscall_entry compat_sc_table[] = {
 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
@@ -337,13 +348,14 @@ const struct trace_syscall_entry compat_sc_table[] = {
 #undef TRACE_SYSCALL_TABLE
 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
        [ _nr ] = {                                             \
-               .func = __event_probe__syscall_exit_##_template, \
+               .event_func = __event_probe__syscall_exit_##_template, \
+               .event_notifier_func = __event_notifier_probe__syscall_exit_##_template, \
                .nrargs = (_nrargs),                            \
                .fields = __event_fields___syscall_exit_##_template, \
                .desc = &__event_desc___syscall_exit_##_name, \
        },
 
-/* Syscall exit table */
+/* Event syscall exit table */
 static const struct trace_syscall_entry sc_exit_table[] = {
 #include <instrumentation/syscalls/headers/syscalls_integers.h>
 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
@@ -352,13 +364,14 @@ static const struct trace_syscall_entry sc_exit_table[] = {
 #undef TRACE_SYSCALL_TABLE
 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
        [ _nr ] = {                                             \
-               .func = __event_probe__compat_syscall_exit_##_template, \
+               .event_func = __event_probe__compat_syscall_exit_##_template, \
+               .event_notifier_func = __event_notifier_probe__compat_syscall_exit_##_template, \
                .nrargs = (_nrargs),                            \
                .fields = __event_fields___compat_syscall_exit_##_template, \
                .desc = &__event_desc___compat_syscall_exit_##_name, \
        },
 
-/* Compat syscall exit table */
+/* Event compat syscall exit table */
 const struct trace_syscall_entry compat_sc_exit_table[] = {
 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
@@ -369,12 +382,14 @@ const struct trace_syscall_entry compat_sc_exit_table[] = {
 #undef CREATE_SYSCALL_TABLE
 
 struct lttng_syscall_filter {
-       DECLARE_BITMAP(sc, NR_syscalls);
-       DECLARE_BITMAP(sc_compat, NR_compat_syscalls);
+       DECLARE_BITMAP(sc_entry, NR_syscalls);
+       DECLARE_BITMAP(sc_exit, NR_syscalls);
+       DECLARE_BITMAP(sc_compat_entry, NR_compat_syscalls);
+       DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
 };
 
-static void syscall_entry_unknown(struct lttng_event *event,
-       struct pt_regs *regs, unsigned int id)
+static void syscall_entry_event_unknown(struct lttng_event *event,
+       struct pt_regs *regs, long id)
 {
        unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
@@ -385,83 +400,68 @@ static void syscall_entry_unknown(struct lttng_event *event,
                __event_probe__syscall_entry_unknown(event, id, args);
 }
 
-void syscall_entry_probe(void *__data, struct pt_regs *regs, long id)
+static void syscall_entry_event_notifier_unknown(
+               struct hlist_head *unknown_dispatch_list_head,
+               struct pt_regs *regs, long id)
 {
-       struct lttng_channel *chan = __data;
-       struct lttng_event *event, *unknown_event;
-       const struct trace_syscall_entry *table, *entry;
-       size_t table_len;
+       unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+       struct lttng_event_notifier *notifier;
 
-       if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter;
-
-               filter = lttng_rcu_dereference(chan->sc_filter);
-               if (filter) {
-                       if (id < 0 || id >= NR_compat_syscalls
-                               || !test_bit(id, filter->sc_compat)) {
-                               /* System call filtered out. */
-                               return;
-                       }
-               }
-               table = compat_sc_table;
-               table_len = ARRAY_SIZE(compat_sc_table);
-               unknown_event = chan->sc_compat_unknown;
-       } else {
-               struct lttng_syscall_filter *filter;
-
-               filter = lttng_rcu_dereference(chan->sc_filter);
-               if (filter) {
-                       if (id < 0 || id >= NR_syscalls
-                               || !test_bit(id, filter->sc)) {
-                               /* System call filtered out. */
-                               return;
-                       }
-               }
-               table = sc_table;
-               table_len = ARRAY_SIZE(sc_table);
-               unknown_event = chan->sc_unknown;
-       }
-       if (unlikely(id < 0 || id >= table_len)) {
-               syscall_entry_unknown(unknown_event, regs, id);
-               return;
+       lttng_syscall_get_arguments(current, regs, args);
+       lttng_hlist_for_each_entry_rcu(notifier, unknown_dispatch_list_head, u.syscall.node) {
+               if (unlikely(in_compat_syscall()))
+                       __event_notifier_probe__compat_syscall_entry_unknown(notifier, id, args);
+               else
+                       __event_notifier_probe__syscall_entry_unknown(notifier, id, args);
        }
-       if (unlikely(in_compat_syscall()))
-               event = chan->compat_sc_table[id];
-       else
-               event = chan->sc_table[id];
-       if (unlikely(!event)) {
-               syscall_entry_unknown(unknown_event, regs, id);
-               return;
+}
+
+static void syscall_exit_event_notifier_unknown(
+               struct hlist_head *unknown_dispatch_list_head,
+               struct pt_regs *regs, long id, long ret)
+{
+       unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+       struct lttng_event_notifier *notifier;
+
+       lttng_syscall_get_arguments(current, regs, args);
+       lttng_hlist_for_each_entry_rcu(notifier, unknown_dispatch_list_head, u.syscall.node) {
+               if (unlikely(in_compat_syscall()))
+                       __event_notifier_probe__compat_syscall_exit_unknown(notifier, id, ret, args);
+               else
+                       __event_notifier_probe__syscall_exit_unknown(notifier, id, ret, args);
        }
-       entry = &table[id];
-       WARN_ON_ONCE(!entry);
+}
 
-       switch (entry->nrargs) {
+static __always_inline
+void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
+               struct pt_regs *regs)
+{
+       switch (nrargs) {
        case 0:
        {
-               void (*fptr)(void *__data) = entry->func;
+               void (*fptr)(void *__data) = func;
 
-               fptr(event);
+               fptr(data);
                break;
        }
        case 1:
        {
-               void (*fptr)(void *__data, unsigned long arg0) = entry->func;
+               void (*fptr)(void *__data, unsigned long arg0) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, args[0]);
+               fptr(data, args[0]);
                break;
        }
        case 2:
        {
                void (*fptr)(void *__data,
                        unsigned long arg0,
-                       unsigned long arg1) = entry->func;
+                       unsigned long arg1) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, args[0], args[1]);
+               fptr(data, args[0], args[1]);
                break;
        }
        case 3:
@@ -469,11 +469,11 @@ void syscall_entry_probe(void *__data, struct pt_regs *regs, long id)
                void (*fptr)(void *__data,
                        unsigned long arg0,
                        unsigned long arg1,
-                       unsigned long arg2) = entry->func;
+                       unsigned long arg2) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, args[0], args[1], args[2]);
+               fptr(data, args[0], args[1], args[2]);
                break;
        }
        case 4:
@@ -482,11 +482,11 @@ void syscall_entry_probe(void *__data, struct pt_regs *regs, long id)
                        unsigned long arg0,
                        unsigned long arg1,
                        unsigned long arg2,
-                       unsigned long arg3) = entry->func;
+                       unsigned long arg3) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, args[0], args[1], args[2], args[3]);
+               fptr(data, args[0], args[1], args[2], args[3]);
                break;
        }
        case 5:
@@ -496,11 +496,11 @@ void syscall_entry_probe(void *__data, struct pt_regs *regs, long id)
                        unsigned long arg1,
                        unsigned long arg2,
                        unsigned long arg3,
-                       unsigned long arg4) = entry->func;
+                       unsigned long arg4) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, args[0], args[1], args[2], args[3], args[4]);
+               fptr(data, args[0], args[1], args[2], args[3], args[4]);
                break;
        }
        case 6:
@@ -511,11 +511,11 @@ void syscall_entry_probe(void *__data, struct pt_regs *regs, long id)
                        unsigned long arg2,
                        unsigned long arg3,
                        unsigned long arg4,
-                       unsigned long arg5) = entry->func;
+                       unsigned long arg5) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, args[0], args[1], args[2],
+               fptr(data, args[0], args[1], args[2],
                        args[3], args[4], args[5]);
                break;
        }
@@ -524,8 +524,214 @@ void syscall_entry_probe(void *__data, struct pt_regs *regs, long id)
        }
 }
 
-static void syscall_exit_unknown(struct lttng_event *event,
-       struct pt_regs *regs, int id, long ret)
+static __always_inline
+void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
+               void *func, unsigned int nrargs, struct pt_regs *regs)
+{
+       struct lttng_event_notifier *notifier;
+
+       switch (nrargs) {
+       case 0:
+       {
+               void (*fptr)(void *__data) = func;
+
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier);
+               break;
+       }
+       case 1:
+       {
+               void (*fptr)(void *__data, unsigned long arg0) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, args[0]);
+               break;
+       }
+       case 2:
+       {
+               void (*fptr)(void *__data,
+                       unsigned long arg0,
+                       unsigned long arg1) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, args[0], args[1]);
+               break;
+       }
+       case 3:
+       {
+               void (*fptr)(void *__data,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, args[0], args[1], args[2]);
+               break;
+       }
+       case 4:
+       {
+               void (*fptr)(void *__data,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2,
+                       unsigned long arg3) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, args[0], args[1], args[2], args[3]);
+               break;
+       }
+       case 5:
+       {
+               void (*fptr)(void *__data,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2,
+                       unsigned long arg3,
+                       unsigned long arg4) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, args[0], args[1], args[2], args[3], args[4]);
+               break;
+       }
+       case 6:
+       {
+               void (*fptr)(void *__data,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2,
+                       unsigned long arg3,
+                       unsigned long arg4,
+                       unsigned long arg5) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, args[0], args[1], args[2], args[3], args[4], args[5]);
+               break;
+       }
+       default:
+               break;
+       }
+}
+
+void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
+{
+       struct lttng_channel *chan = __data;
+       struct lttng_event *event, *unknown_event;
+       const struct trace_syscall_entry *table, *entry;
+       size_t table_len;
+
+       if (unlikely(in_compat_syscall())) {
+               struct lttng_syscall_filter *filter = chan->sc_filter;
+
+               if (id < 0 || id >= NR_compat_syscalls
+                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_compat_entry))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = compat_sc_table;
+               table_len = ARRAY_SIZE(compat_sc_table);
+               unknown_event = chan->sc_compat_unknown;
+       } else {
+               struct lttng_syscall_filter *filter = chan->sc_filter;
+
+               if (id < 0 || id >= NR_syscalls
+                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_entry))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = sc_table;
+               table_len = ARRAY_SIZE(sc_table);
+               unknown_event = chan->sc_unknown;
+       }
+       if (unlikely(id < 0 || id >= table_len)) {
+               syscall_entry_event_unknown(unknown_event, regs, id);
+               return;
+       }
+       if (unlikely(in_compat_syscall()))
+               event = chan->compat_sc_table[id];
+       else
+               event = chan->sc_table[id];
+       if (unlikely(!event)) {
+               syscall_entry_event_unknown(unknown_event, regs, id);
+               return;
+       }
+       entry = &table[id];
+       WARN_ON_ONCE(!entry->event_func);
+       syscall_entry_call_func(entry->event_func, entry->nrargs, event, regs);
+}
+
+void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
+               long id)
+{
+       struct lttng_event_notifier_group *group = __data;
+       const struct trace_syscall_entry *table, *entry;
+       struct hlist_head *dispatch_list, *unknown_dispatch_list;
+       size_t table_len;
+
+       if (unlikely(in_compat_syscall())) {
+               struct lttng_syscall_filter *filter = group->sc_filter;
+
+               if (id < 0 || id >= NR_compat_syscalls
+                       || (!READ_ONCE(group->syscall_all_entry) &&
+                               !test_bit(id, filter->sc_compat_entry))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = compat_sc_table;
+               table_len = ARRAY_SIZE(compat_sc_table);
+               unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
+       } else {
+               struct lttng_syscall_filter *filter = group->sc_filter;
+
+               if (id < 0 || id >= NR_syscalls
+                       || (!READ_ONCE(group->syscall_all_entry) &&
+                               !test_bit(id, filter->sc_entry))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = sc_table;
+               table_len = ARRAY_SIZE(sc_table);
+               unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
+       }
+       /* Check if the syscall id is out of bound. */
+       if (unlikely(id < 0 || id >= table_len)) {
+               syscall_entry_event_notifier_unknown(unknown_dispatch_list,
+                               regs, id);
+               return;
+       }
+
+       entry = &table[id];
+       if (!entry->event_notifier_func) {
+               syscall_entry_event_notifier_unknown(unknown_dispatch_list,
+                               regs, id);
+               return;
+       }
+
+       if (unlikely(in_compat_syscall())) {
+               dispatch_list = &group->event_notifier_compat_syscall_dispatch[id];
+       } else {
+               dispatch_list = &group->event_notifier_syscall_dispatch[id];
+       }
+       if (unlikely(hlist_empty(dispatch_list)))
+               return;
+
+       syscall_entry_event_notifier_call_func(dispatch_list,
+                       entry->event_notifier_func, entry->nrargs, regs);
+}
+
+static void syscall_exit_event_unknown(struct lttng_event *event,
+       struct pt_regs *regs, long id, long ret)
 {
        unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
@@ -537,7 +743,7 @@ static void syscall_exit_unknown(struct lttng_event *event,
                __event_probe__syscall_exit_unknown(event, id, ret, args);
 }
 
-void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
+void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 {
        struct lttng_channel *chan = __data;
        struct lttng_event *event, *unknown_event;
@@ -547,36 +753,30 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
 
        id = syscall_get_nr(current, regs);
        if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter;
-
-               filter = lttng_rcu_dereference(chan->sc_filter);
-               if (filter) {
-                       if (id < 0 || id >= NR_compat_syscalls
-                               || !test_bit(id, filter->sc_compat)) {
-                               /* System call filtered out. */
-                               return;
-                       }
+               struct lttng_syscall_filter *filter = chan->sc_filter;
+
+               if (id < 0 || id >= NR_compat_syscalls
+                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_compat_exit))) {
+                       /* System call filtered out. */
+                       return;
                }
                table = compat_sc_exit_table;
                table_len = ARRAY_SIZE(compat_sc_exit_table);
                unknown_event = chan->compat_sc_exit_unknown;
        } else {
-               struct lttng_syscall_filter *filter;
-
-               filter = lttng_rcu_dereference(chan->sc_filter);
-               if (filter) {
-                       if (id < 0 || id >= NR_syscalls
-                               || !test_bit(id, filter->sc)) {
-                               /* System call filtered out. */
-                               return;
-                       }
+               struct lttng_syscall_filter *filter = chan->sc_filter;
+
+               if (id < 0 || id >= NR_syscalls
+                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_exit))) {
+                       /* System call filtered out. */
+                       return;
                }
                table = sc_exit_table;
                table_len = ARRAY_SIZE(sc_exit_table);
                unknown_event = chan->sc_exit_unknown;
        }
        if (unlikely(id < 0 || id >= table_len)) {
-               syscall_exit_unknown(unknown_event, regs, id, ret);
+               syscall_exit_event_unknown(unknown_event, regs, id, ret);
                return;
        }
        if (unlikely(in_compat_syscall()))
@@ -584,16 +784,16 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
        else
                event = chan->sc_exit_table[id];
        if (unlikely(!event)) {
-               syscall_exit_unknown(unknown_event, regs, id, ret);
+               syscall_exit_event_unknown(unknown_event, regs, id, ret);
                return;
        }
        entry = &table[id];
-       WARN_ON_ONCE(!entry);
+       WARN_ON_ONCE(!entry->event_func);
 
        switch (entry->nrargs) {
        case 0:
        {
-               void (*fptr)(void *__data, long ret) = entry->func;
+               void (*fptr)(void *__data, long ret) = entry->event_func;
 
                fptr(event, ret);
                break;
@@ -602,7 +802,7 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
        {
                void (*fptr)(void *__data,
                        long ret,
-                       unsigned long arg0) = entry->func;
+                       unsigned long arg0) = entry->event_func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
@@ -614,7 +814,7 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
                void (*fptr)(void *__data,
                        long ret,
                        unsigned long arg0,
-                       unsigned long arg1) = entry->func;
+                       unsigned long arg1) = entry->event_func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
@@ -627,7 +827,7 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
                        long ret,
                        unsigned long arg0,
                        unsigned long arg1,
-                       unsigned long arg2) = entry->func;
+                       unsigned long arg2) = entry->event_func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
@@ -641,7 +841,7 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
                        unsigned long arg0,
                        unsigned long arg1,
                        unsigned long arg2,
-                       unsigned long arg3) = entry->func;
+                       unsigned long arg3) = entry->event_func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
@@ -656,7 +856,7 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
                        unsigned long arg1,
                        unsigned long arg2,
                        unsigned long arg3,
-                       unsigned long arg4) = entry->func;
+                       unsigned long arg4) = entry->event_func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
@@ -672,7 +872,7 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
                        unsigned long arg2,
                        unsigned long arg3,
                        unsigned long arg4,
-                       unsigned long arg5) = entry->func;
+                       unsigned long arg5) = entry->event_func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
@@ -685,97 +885,260 @@ void syscall_exit_probe(void *__data, struct pt_regs *regs, long ret)
        }
 }
 
-/*
- * noinline to diminish caller stack size.
- * Should be called with sessions lock held.
- */
-static
-int fill_table(const struct trace_syscall_entry *table, size_t table_len,
-       struct lttng_event **chan_table, struct lttng_channel *chan,
-       void *filter, enum sc_type type)
+static __always_inline
+void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
+               void *func, unsigned int nrargs, struct pt_regs *regs, long ret)
 {
-       const struct lttng_event_desc *desc;
-       unsigned int i;
+       struct lttng_event_notifier *notifier;
 
-       /* Allocate events for each syscall, insert into table */
-       for (i = 0; i < table_len; i++) {
-               struct lttng_kernel_event ev;
-               desc = table[i].desc;
+       switch (nrargs) {
+       case 0:
+       {
+               void (*fptr)(void *__data, long ret) = func;
 
-               if (!desc) {
-                       /* Unknown syscall */
-                       continue;
-               }
-               /*
-                * Skip those already populated by previous failed
-                * register for this channel.
-                */
-               if (chan_table[i])
-                       continue;
-               memset(&ev, 0, sizeof(ev));
-               switch (type) {
-               case SC_TYPE_ENTRY:
-                       strncpy(ev.name, SYSCALL_ENTRY_STR,
-                               LTTNG_KERNEL_SYM_NAME_LEN);
-                       break;
-               case SC_TYPE_EXIT:
-                       strncpy(ev.name, SYSCALL_EXIT_STR,
-                               LTTNG_KERNEL_SYM_NAME_LEN);
-                       break;
-               case SC_TYPE_COMPAT_ENTRY:
-                       strncpy(ev.name, COMPAT_SYSCALL_ENTRY_STR,
-                               LTTNG_KERNEL_SYM_NAME_LEN);
-                       break;
-               case SC_TYPE_COMPAT_EXIT:
-                       strncpy(ev.name, COMPAT_SYSCALL_EXIT_STR,
-                               LTTNG_KERNEL_SYM_NAME_LEN);
-                       break;
-               default:
-                       BUG_ON(1);
-                       break;
-               }
-               strncat(ev.name, desc->name,
-                       LTTNG_KERNEL_SYM_NAME_LEN - strlen(ev.name) - 1);
-               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-               chan_table[i] = _lttng_event_create(chan, &ev, filter,
-                                               desc, ev.instrumentation);
-               WARN_ON_ONCE(!chan_table[i]);
-               if (IS_ERR(chan_table[i])) {
-                       /*
-                        * If something goes wrong in event registration
-                        * after the first one, we have no choice but to
-                        * leave the previous events in there, until
-                        * deleted by session teardown.
-                        */
-                       return PTR_ERR(chan_table[i]);
-               }
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret);
+               break;
        }
-       return 0;
-}
-
-/*
- * Should be called with sessions lock held.
- */
-int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
-{
-       struct lttng_kernel_event ev;
-       int ret;
-
-       wrapper_vmalloc_sync_mappings();
+       case 1:
+       {
+               void (*fptr)(void *__data, long ret, unsigned long arg0) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
-       if (!chan->sc_table) {
-               /* create syscall table mapping syscall to events */
-               chan->sc_table = kzalloc(sizeof(struct lttng_event *)
-                                       * ARRAY_SIZE(sc_table), GFP_KERNEL);
-               if (!chan->sc_table)
-                       return -ENOMEM;
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret, args[0]);
+               break;
        }
-       if (!chan->sc_exit_table) {
-               /* create syscall table mapping syscall to events */
-               chan->sc_exit_table = kzalloc(sizeof(struct lttng_event *)
-                                       * ARRAY_SIZE(sc_exit_table), GFP_KERNEL);
-               if (!chan->sc_exit_table)
+       case 2:
+       {
+               void (*fptr)(void *__data,
+                       long ret,
+                       unsigned long arg0,
+                       unsigned long arg1) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret, args[0], args[1]);
+               break;
+       }
+       case 3:
+       {
+               void (*fptr)(void *__data,
+                       long ret,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret, args[0], args[1], args[2]);
+               break;
+       }
+       case 4:
+       {
+               void (*fptr)(void *__data,
+                       long ret,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2,
+                       unsigned long arg3) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret, args[0], args[1], args[2], args[3]);
+               break;
+       }
+       case 5:
+       {
+               void (*fptr)(void *__data,
+                       long ret,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2,
+                       unsigned long arg3,
+                       unsigned long arg4) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret, args[0], args[1], args[2], args[3], args[4]);
+               break;
+       }
+       case 6:
+       {
+               void (*fptr)(void *__data,
+                       long ret,
+                       unsigned long arg0,
+                       unsigned long arg1,
+                       unsigned long arg2,
+                       unsigned long arg3,
+                       unsigned long arg4,
+                       unsigned long arg5) = func;
+               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+
+               lttng_syscall_get_arguments(current, regs, args);
+               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
+                       fptr(notifier, ret, args[0], args[1], args[2], args[3], args[4], args[5]);
+               break;
+       }
+       default:
+               break;
+       }
+}
+
+static
+void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
+               long ret)
+{
+       struct lttng_event_notifier_group *group = __data;
+       const struct trace_syscall_entry *table, *entry;
+       struct hlist_head *dispatch_list, *unknown_dispatch_list;
+       size_t table_len;
+       long id;
+
+       id = syscall_get_nr(current, regs);
+
+       if (unlikely(in_compat_syscall())) {
+               struct lttng_syscall_filter *filter = group->sc_filter;
+
+               if (id < 0 || id >= NR_compat_syscalls
+                       || (!READ_ONCE(group->syscall_all_exit) &&
+                               !test_bit(id, filter->sc_compat_exit))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = compat_sc_exit_table;
+               table_len = ARRAY_SIZE(compat_sc_exit_table);
+               unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
+       } else {
+               struct lttng_syscall_filter *filter = group->sc_filter;
+
+               if (id < 0 || id >= NR_syscalls
+                       || (!READ_ONCE(group->syscall_all_exit) &&
+                                       !test_bit(id, filter->sc_exit))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = sc_exit_table;
+               table_len = ARRAY_SIZE(sc_exit_table);
+               unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
+       }
+       /* Check if the syscall id is out of bound. */
+       if (unlikely(id < 0 || id >= table_len)) {
+               syscall_exit_event_notifier_unknown(unknown_dispatch_list,
+                               regs, id, ret);
+               return;
+       }
+
+       entry = &table[id];
+       if (!entry->event_notifier_func) {
+               syscall_entry_event_notifier_unknown(unknown_dispatch_list,
+                               regs, id);
+               return;
+       }
+
+       if (unlikely(in_compat_syscall())) {
+               dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[id];
+       } else {
+               dispatch_list = &group->event_notifier_exit_syscall_dispatch[id];
+       }
+       if (unlikely(hlist_empty(dispatch_list)))
+               return;
+
+       syscall_exit_event_notifier_call_func(dispatch_list,
+                       entry->event_notifier_func, entry->nrargs, regs, ret);
+}
+/*
+ * noinline to diminish caller stack size.
+ * Should be called with sessions lock held.
+ */
+static
+int fill_event_table(const struct trace_syscall_entry *table, size_t table_len,
+       struct lttng_event **chan_table, struct lttng_channel *chan,
+       void *filter, enum sc_type type)
+{
+       const struct lttng_event_desc *desc;
+       unsigned int i;
+
+       /* Allocate events for each syscall, insert into table */
+       for (i = 0; i < table_len; i++) {
+               struct lttng_kernel_event ev;
+               desc = table[i].desc;
+
+               if (!desc) {
+                       /* Unknown syscall */
+                       continue;
+               }
+               /*
+                * Skip those already populated by previous failed
+                * register for this channel.
+                */
+               if (chan_table[i])
+                       continue;
+               memset(&ev, 0, sizeof(ev));
+               switch (type) {
+               case SC_TYPE_ENTRY:
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       break;
+               case SC_TYPE_EXIT:
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       break;
+               case SC_TYPE_COMPAT_ENTRY:
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       break;
+               case SC_TYPE_COMPAT_EXIT:
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       break;
+               }
+               strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN - 1);
+               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
+               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
+               chan_table[i] = _lttng_event_create(chan, &ev, filter,
+                                               desc, ev.instrumentation);
+               WARN_ON_ONCE(!chan_table[i]);
+               if (IS_ERR(chan_table[i])) {
+                       /*
+                        * If something goes wrong in event registration
+                        * after the first one, we have no choice but to
+                        * leave the previous events in there, until
+                        * deleted by session teardown.
+                        */
+                       return PTR_ERR(chan_table[i]);
+               }
+       }
+       return 0;
+}
+
+/*
+ * Should be called with sessions lock held.
+ */
+int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
+{
+       struct lttng_kernel_event ev;
+       int ret;
+
+       wrapper_vmalloc_sync_mappings();
+
+       if (!chan->sc_table) {
+               /* create syscall table mapping syscall to events */
+               chan->sc_table = kzalloc(sizeof(struct lttng_event *)
+                                       * ARRAY_SIZE(sc_table), GFP_KERNEL);
+               if (!chan->sc_table)
+                       return -ENOMEM;
+       }
+       if (!chan->sc_exit_table) {
+               /* create syscall table mapping syscall to events */
+               chan->sc_exit_table = kzalloc(sizeof(struct lttng_event *)
+                                       * ARRAY_SIZE(sc_exit_table), GFP_KERNEL);
+               if (!chan->sc_exit_table)
                        return -ENOMEM;
        }
 
@@ -805,6 +1168,8 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
                strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
                ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
                ev.instrumentation = LTTNG_KERNEL_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
                chan->sc_unknown = _lttng_event_create(chan, &ev, filter,
                                                desc,
                                                ev.instrumentation);
@@ -822,6 +1187,8 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
                strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
                ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
                ev.instrumentation = LTTNG_KERNEL_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
                chan->sc_compat_unknown = _lttng_event_create(chan, &ev, filter,
                                                desc,
                                                ev.instrumentation);
@@ -839,6 +1206,8 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
                strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
                ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
                ev.instrumentation = LTTNG_KERNEL_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
                chan->compat_sc_exit_unknown = _lttng_event_create(chan, &ev,
                                                filter, desc,
                                                ev.instrumentation);
@@ -856,6 +1225,8 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
                strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
                ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
                ev.instrumentation = LTTNG_KERNEL_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
                chan->sc_exit_unknown = _lttng_event_create(chan, &ev, filter,
                                                desc, ev.instrumentation);
                WARN_ON_ONCE(!chan->sc_exit_unknown);
@@ -864,30 +1235,38 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
                }
        }
 
-       ret = fill_table(sc_table, ARRAY_SIZE(sc_table),
+       ret = fill_event_table(sc_table, ARRAY_SIZE(sc_table),
                        chan->sc_table, chan, filter, SC_TYPE_ENTRY);
        if (ret)
                return ret;
-       ret = fill_table(sc_exit_table, ARRAY_SIZE(sc_exit_table),
+       ret = fill_event_table(sc_exit_table, ARRAY_SIZE(sc_exit_table),
                        chan->sc_exit_table, chan, filter, SC_TYPE_EXIT);
        if (ret)
                return ret;
 
 #ifdef CONFIG_COMPAT
-       ret = fill_table(compat_sc_table, ARRAY_SIZE(compat_sc_table),
+       ret = fill_event_table(compat_sc_table, ARRAY_SIZE(compat_sc_table),
                        chan->compat_sc_table, chan, filter,
                        SC_TYPE_COMPAT_ENTRY);
        if (ret)
                return ret;
-       ret = fill_table(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
+       ret = fill_event_table(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
                        chan->compat_sc_exit_table, chan, filter,
                        SC_TYPE_COMPAT_EXIT);
        if (ret)
                return ret;
 #endif
+
+       if (!chan->sc_filter) {
+               chan->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
+                               GFP_KERNEL);
+               if (!chan->sc_filter)
+                       return -ENOMEM;
+       }
+
        if (!chan->sys_enter_registered) {
                ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
-                               (void *) syscall_entry_probe, chan);
+                               (void *) syscall_entry_event_probe, chan);
                if (ret)
                        return ret;
                chan->sys_enter_registered = 1;
@@ -898,10 +1277,10 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
         */
        if (!chan->sys_exit_registered) {
                ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
-                               (void *) syscall_exit_probe, chan);
+                               (void *) syscall_exit_event_probe, chan);
                if (ret) {
                        WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-                               (void *) syscall_entry_probe, chan));
+                               (void *) syscall_entry_event_probe, chan));
                        return ret;
                }
                chan->sys_exit_registered = 1;
@@ -910,9 +1289,380 @@ int lttng_syscalls_register(struct lttng_channel *chan, void *filter)
 }
 
 /*
- * Only called at session destruction.
+ * Should be called with sessions lock held.
  */
-int lttng_syscalls_unregister(struct lttng_channel *chan)
+int lttng_syscalls_register_event_notifier(
+               struct lttng_event_notifier_enabler *event_notifier_enabler,
+               void *filter)
+{
+       struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+       unsigned int i;
+       int ret = 0;
+
+       wrapper_vmalloc_sync_mappings();
+
+       if (!group->event_notifier_syscall_dispatch) {
+               group->event_notifier_syscall_dispatch =
+                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(sc_table),
+                                       GFP_KERNEL);
+               if (!group->event_notifier_syscall_dispatch)
+                       return -ENOMEM;
+
+               /* Initialize all list_head */
+               for (i = 0; i < ARRAY_SIZE(sc_table); i++)
+                       INIT_HLIST_HEAD(&group->event_notifier_syscall_dispatch[i]);
+
+               /* Init the unknown syscall notifier list. */
+               INIT_HLIST_HEAD(&group->event_notifier_unknown_syscall_dispatch);
+       }
+
+       if (!group->event_notifier_exit_syscall_dispatch) {
+               group->event_notifier_exit_syscall_dispatch =
+                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(sc_table),
+                                       GFP_KERNEL);
+               if (!group->event_notifier_exit_syscall_dispatch)
+                       return -ENOMEM;
+
+               /* Initialize all list_head */
+               for (i = 0; i < ARRAY_SIZE(sc_table); i++)
+                       INIT_HLIST_HEAD(&group->event_notifier_exit_syscall_dispatch[i]);
+
+               /* Init the unknown exit syscall notifier list. */
+               INIT_HLIST_HEAD(&group->event_notifier_exit_unknown_syscall_dispatch);
+       }
+
+#ifdef CONFIG_COMPAT
+       if (!group->event_notifier_compat_syscall_dispatch) {
+               group->event_notifier_compat_syscall_dispatch =
+                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(compat_sc_table),
+                                       GFP_KERNEL);
+               if (!group->event_notifier_syscall_dispatch)
+                       return -ENOMEM;
+
+               /* Initialize all list_head */
+               for (i = 0; i < ARRAY_SIZE(compat_sc_table); i++)
+                       INIT_HLIST_HEAD(&group->event_notifier_compat_syscall_dispatch[i]);
+
+               /* Init the unknown syscall notifier list. */
+               INIT_HLIST_HEAD(&group->event_notifier_compat_unknown_syscall_dispatch);
+       }
+
+       if (!group->event_notifier_exit_compat_syscall_dispatch) {
+               group->event_notifier_exit_compat_syscall_dispatch =
+                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(compat_sc_exit_table),
+                                       GFP_KERNEL);
+               if (!group->event_notifier_exit_syscall_dispatch)
+                       return -ENOMEM;
+
+               /* Initialize all list_head */
+               for (i = 0; i < ARRAY_SIZE(compat_sc_exit_table); i++)
+                       INIT_HLIST_HEAD(&group->event_notifier_exit_compat_syscall_dispatch[i]);
+
+               /* Init the unknown exit syscall notifier list. */
+               INIT_HLIST_HEAD(&group->event_notifier_exit_compat_unknown_syscall_dispatch);
+       }
+#endif
+
+       if (!group->sc_filter) {
+               group->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
+                               GFP_KERNEL);
+               if (!group->sc_filter)
+                       return -ENOMEM;
+       }
+
+       if (!group->sys_enter_registered) {
+               ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
+                               (void *) syscall_entry_event_notifier_probe, group);
+               if (ret)
+                       return ret;
+               group->sys_enter_registered = 1;
+       }
+
+       if (!group->sys_exit_registered) {
+               ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
+                               (void *) syscall_exit_event_notifier_probe, group);
+               if (ret) {
+                       WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
+                               (void *) syscall_entry_event_notifier_probe, group));
+                       return ret;
+               }
+               group->sys_exit_registered = 1;
+       }
+
+       return ret;
+}
+
+static
+int create_unknown_event_notifier(
+               struct lttng_event_notifier_enabler *event_notifier_enabler,
+               enum sc_type type)
+{
+       struct lttng_event_notifier *notifier;
+       const struct lttng_event_desc *desc;
+       struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+       struct lttng_kernel_event_notifier event_notifier_param;
+       uint64_t user_token = event_notifier_enabler->base.user_token;
+       uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
+       struct lttng_enabler *base_enabler = lttng_event_notifier_enabler_as_enabler(
+               event_notifier_enabler);
+       struct hlist_head *unknown_dispatch_list;
+       int ret = 0;
+       bool found = false;
+       enum lttng_kernel_syscall_abi abi;
+       enum lttng_kernel_syscall_entryexit entryexit;
+       struct hlist_head *head;
+
+       switch (type) {
+       case SC_TYPE_ENTRY:
+               desc = &__event_desc___syscall_entry_unknown;
+               unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
+               entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+               abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+               break;
+       case SC_TYPE_EXIT:
+               desc = &__event_desc___syscall_exit_unknown;
+               unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
+               entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+               abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+               break;
+       case SC_TYPE_COMPAT_ENTRY:
+               desc = &__event_desc___compat_syscall_entry_unknown;
+               unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
+               entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+               abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+               break;
+       case SC_TYPE_COMPAT_EXIT:
+               desc = &__event_desc___compat_syscall_exit_unknown;
+               unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
+               entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+               abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+               break;
+       default:
+               BUG_ON(1);
+       }
+
+       /*
+        * Check if already created.
+        */
+       head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
+               LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->name);
+       lttng_hlist_for_each_entry(notifier, head, hlist) {
+               if (notifier->desc == desc &&
+                               notifier->user_token == base_enabler->user_token)
+                       found = true;
+       }
+       if (found)
+               goto end;
+
+       memset(&event_notifier_param, 0, sizeof(event_notifier_param));
+       strncat(event_notifier_param.event.name, desc->name,
+               LTTNG_KERNEL_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+
+       event_notifier_param.event.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
+
+       event_notifier_param.event.instrumentation = LTTNG_KERNEL_SYSCALL;
+       event_notifier_param.event.u.syscall.abi = abi;
+       event_notifier_param.event.u.syscall.entryexit = entryexit;
+
+       notifier = _lttng_event_notifier_create(desc, user_token,
+               error_counter_index, group, &event_notifier_param, NULL,
+               event_notifier_param.event.instrumentation);
+       if (IS_ERR(notifier)) {
+               printk(KERN_INFO "Unable to create unknown notifier %s\n",
+                       desc->name);
+               ret = -ENOMEM;
+               goto end;
+       }
+
+       hlist_add_head_rcu(&notifier->u.syscall.node, unknown_dispatch_list);
+
+end:
+       return ret;
+}
+
+static int create_matching_event_notifiers(
+               struct lttng_event_notifier_enabler *event_notifier_enabler,
+               void *filter, const struct trace_syscall_entry *table,
+               size_t table_len, enum sc_type type)
+{
+       struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+       const struct lttng_event_desc *desc;
+       uint64_t user_token = event_notifier_enabler->base.user_token;
+       uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
+       unsigned int i;
+       int ret = 0;
+
+       /* iterate over all syscall and create event_notifier that match */
+       for (i = 0; i < table_len; i++) {
+               struct lttng_event_notifier *event_notifier;
+               struct lttng_kernel_event_notifier event_notifier_param;
+               struct hlist_head *head;
+               int found = 0;
+
+               desc = table[i].desc;
+               if (!desc) {
+                       /* Unknown syscall */
+                       continue;
+               }
+
+               if (!lttng_desc_match_enabler(desc,
+                               lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)))
+                       continue;
+
+               /*
+                * Check if already created.
+                */
+               head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
+                       LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->name);
+               lttng_hlist_for_each_entry(event_notifier, head, hlist) {
+                       if (event_notifier->desc == desc
+                               && event_notifier->user_token == event_notifier_enabler->base.user_token)
+                               found = 1;
+               }
+               if (found)
+                       continue;
+
+               memset(&event_notifier_param, 0, sizeof(event_notifier_param));
+               switch (type) {
+               case SC_TYPE_ENTRY:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       break;
+               case SC_TYPE_EXIT:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       break;
+               case SC_TYPE_COMPAT_ENTRY:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       break;
+               case SC_TYPE_COMPAT_EXIT:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       break;
+               }
+               strncat(event_notifier_param.event.name, desc->name,
+                       LTTNG_KERNEL_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+               event_notifier_param.event.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
+               event_notifier_param.event.instrumentation = LTTNG_KERNEL_SYSCALL;
+
+               event_notifier = _lttng_event_notifier_create(desc, user_token,
+                       error_counter_index, group, &event_notifier_param,
+                       filter, event_notifier_param.event.instrumentation);
+               if (IS_ERR(event_notifier)) {
+                       printk(KERN_INFO "Unable to create event_notifier %s\n",
+                               desc->name);
+                       ret = -ENOMEM;
+                       goto end;
+               }
+
+               event_notifier->u.syscall.syscall_id = i;
+       }
+
+end:
+       return ret;
+
+}
+
+int lttng_syscals_create_matching_event_notifiers(
+               struct lttng_event_notifier_enabler *event_notifier_enabler,
+               void *filter)
+{
+       int ret;
+       struct lttng_enabler *base_enabler =
+                       lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
+       enum lttng_kernel_syscall_entryexit entryexit =
+                       base_enabler->event_param.u.syscall.entryexit;
+
+       if (entryexit == LTTNG_KERNEL_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT) {
+               ret = create_matching_event_notifiers(event_notifier_enabler,
+                       filter, sc_table, ARRAY_SIZE(sc_table), SC_TYPE_ENTRY);
+               if (ret)
+                       goto end;
+
+               ret = create_matching_event_notifiers(event_notifier_enabler,
+                       filter, compat_sc_table, ARRAY_SIZE(compat_sc_table),
+                       SC_TYPE_COMPAT_ENTRY);
+               if (ret)
+                       goto end;
+
+               ret = create_unknown_event_notifier(event_notifier_enabler,
+                               SC_TYPE_ENTRY);
+               if (ret)
+                       goto end;
+
+               ret = create_unknown_event_notifier(event_notifier_enabler,
+                               SC_TYPE_COMPAT_ENTRY);
+               if (ret)
+                       goto end;
+       }
+
+       if (entryexit == LTTNG_KERNEL_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT) {
+               ret = create_matching_event_notifiers(event_notifier_enabler,
+                       filter, sc_exit_table, ARRAY_SIZE(sc_exit_table),
+                       SC_TYPE_EXIT);
+               if (ret)
+                       goto end;
+
+               ret = create_unknown_event_notifier(event_notifier_enabler,
+                               SC_TYPE_EXIT);
+               if (ret)
+                       goto end;
+
+               ret = create_matching_event_notifiers(event_notifier_enabler,
+                       filter, compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
+                       SC_TYPE_COMPAT_EXIT);
+               if (ret)
+                       goto end;
+
+               ret = create_unknown_event_notifier(event_notifier_enabler,
+                               SC_TYPE_COMPAT_EXIT);
+               if (ret)
+                       goto end;
+       }
+
+end:
+       return ret;
+}
+
+/*
+ * Unregister the syscall event_notifier probes from the callsites.
+ */
+int lttng_syscalls_unregister_event_notifier(
+               struct lttng_event_notifier_group *event_notifier_group)
+{
+       int ret;
+
+       /*
+        * Only register the event_notifier probe on the `sys_enter` callsite for now.
+        * At the moment, we don't think it's desirable to have one fired
+        * event_notifier for the entry and one for the exit of a syscall.
+        */
+       if (event_notifier_group->sys_enter_registered) {
+               ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
+                               (void *) syscall_entry_event_notifier_probe, event_notifier_group);
+               if (ret)
+                       return ret;
+               event_notifier_group->sys_enter_registered = 0;
+       }
+       if (event_notifier_group->sys_exit_registered) {
+               ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
+                               (void *) syscall_exit_event_notifier_probe, event_notifier_group);
+               if (ret)
+                       return ret;
+               event_notifier_group->sys_enter_registered = 0;
+       }
+
+       kfree(event_notifier_group->event_notifier_syscall_dispatch);
+       kfree(event_notifier_group->event_notifier_exit_syscall_dispatch);
+#ifdef CONFIG_COMPAT
+       kfree(event_notifier_group->event_notifier_compat_syscall_dispatch);
+       kfree(event_notifier_group->event_notifier_exit_compat_syscall_dispatch);
+#endif
+       return 0;
+}
+
+int lttng_syscalls_unregister_event(struct lttng_channel *chan)
 {
        int ret;
 
@@ -920,19 +1670,23 @@ int lttng_syscalls_unregister(struct lttng_channel *chan)
                return 0;
        if (chan->sys_enter_registered) {
                ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-                               (void *) syscall_entry_probe, chan);
+                               (void *) syscall_entry_event_probe, chan);
                if (ret)
                        return ret;
                chan->sys_enter_registered = 0;
        }
        if (chan->sys_exit_registered) {
                ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
-                               (void *) syscall_exit_probe, chan);
+                               (void *) syscall_exit_event_probe, chan);
                if (ret)
                        return ret;
                chan->sys_exit_registered = 0;
        }
-       /* lttng_event destroy will be performed by lttng_session_destroy() */
+       return 0;
+}
+
+int lttng_syscalls_destroy_event(struct lttng_channel *chan)
+{
        kfree(chan->sc_table);
        kfree(chan->sc_exit_table);
 #ifdef CONFIG_COMPAT
@@ -995,136 +1749,240 @@ uint32_t get_sc_tables_len(void)
        return ARRAY_SIZE(sc_table) + ARRAY_SIZE(compat_sc_table);
 }
 
-int lttng_syscall_filter_enable(struct lttng_channel *chan,
-               const char *name)
+static
+const char *get_syscall_name(const char *desc_name,
+               enum lttng_syscall_abi abi,
+               enum lttng_syscall_entryexit entryexit)
 {
-       int syscall_nr, compat_syscall_nr, ret;
-       struct lttng_syscall_filter *filter;
+       size_t prefix_len = 0;
 
-       WARN_ON_ONCE(!chan->sc_table);
 
-       if (!name) {
-               /* Enable all system calls by removing filter */
-               if (chan->sc_filter) {
-                       filter = chan->sc_filter;
-                       rcu_assign_pointer(chan->sc_filter, NULL);
-                       synchronize_trace();
-                       kfree(filter);
+       switch (entryexit) {
+       case LTTNG_SYSCALL_ENTRY:
+               switch (abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       prefix_len = strlen(SYSCALL_ENTRY_STR);
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       prefix_len = strlen(COMPAT_SYSCALL_ENTRY_STR);
+                       break;
                }
-               chan->syscall_all = 1;
-               return 0;
+               break;
+       case LTTNG_SYSCALL_EXIT:
+               switch (abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       prefix_len = strlen(SYSCALL_EXIT_STR);
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       prefix_len = strlen(COMPAT_SYSCALL_EXIT_STR);
+                       break;
+               }
+               break;
        }
+       WARN_ON_ONCE(prefix_len == 0);
+       return desc_name + prefix_len;
+}
 
-       if (!chan->sc_filter) {
-               if (chan->syscall_all) {
-                       /*
-                        * All syscalls are already enabled.
-                        */
-                       return -EEXIST;
+static
+int lttng_syscall_filter_enable(
+               struct lttng_syscall_filter *filter,
+               const char *desc_name, enum lttng_syscall_abi abi,
+               enum lttng_syscall_entryexit entryexit)
+{
+       const char *syscall_name;
+       unsigned long *bitmap;
+       int syscall_nr;
+
+       syscall_name = get_syscall_name(desc_name, abi, entryexit);
+
+       switch (abi) {
+       case LTTNG_SYSCALL_ABI_NATIVE:
+               syscall_nr = get_syscall_nr(syscall_name);
+               break;
+       case LTTNG_SYSCALL_ABI_COMPAT:
+               syscall_nr = get_compat_syscall_nr(syscall_name);
+               break;
+       default:
+               return -EINVAL;
+       }
+       if (syscall_nr < 0)
+               return -ENOENT;
+
+       switch (entryexit) {
+       case LTTNG_SYSCALL_ENTRY:
+               switch (abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       bitmap = filter->sc_entry;
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       bitmap = filter->sc_compat_entry;
+                       break;
+               default:
+                       return -EINVAL;
                }
-               filter = kzalloc(sizeof(struct lttng_syscall_filter),
-                               GFP_KERNEL);
-               if (!filter)
-                       return -ENOMEM;
-       } else {
-               filter = chan->sc_filter;
-       }
-       syscall_nr = get_syscall_nr(name);
-       compat_syscall_nr = get_compat_syscall_nr(name);
-       if (syscall_nr < 0 && compat_syscall_nr < 0) {
-               ret = -ENOENT;
-               goto error;
-       }
-       if (syscall_nr >= 0) {
-               if (test_bit(syscall_nr, filter->sc)) {
-                       ret = -EEXIST;
-                       goto error;
+               break;
+       case LTTNG_SYSCALL_EXIT:
+               switch (abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       bitmap = filter->sc_exit;
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       bitmap = filter->sc_compat_exit;
+                       break;
+               default:
+                       return -EINVAL;
                }
-               bitmap_set(filter->sc, syscall_nr, 1);
+               break;
+       default:
+               return -EINVAL;
+       }
+       if (test_bit(syscall_nr, bitmap))
+               return -EEXIST;
+       bitmap_set(bitmap, syscall_nr, 1);
+       return 0;
+}
+
+int lttng_syscall_filter_enable_event_notifier(
+               struct lttng_event_notifier *notifier)
+{
+       struct lttng_event_notifier_group *group = notifier->group;
+       unsigned int syscall_id = notifier->u.syscall.syscall_id;
+       struct hlist_head *dispatch_list;
+       int ret = 0;
+
+       WARN_ON_ONCE(notifier->instrumentation != LTTNG_KERNEL_SYSCALL);
+
+       ret = lttng_syscall_filter_enable(group->sc_filter,
+               notifier->desc->name, notifier->u.syscall.abi,
+               notifier->u.syscall.entryexit);
+       if (ret) {
+               goto end;
        }
-       if (compat_syscall_nr >= 0) {
-               if (test_bit(compat_syscall_nr, filter->sc_compat)) {
-                       ret = -EEXIST;
-                       goto error;
+
+       switch (notifier->u.syscall.entryexit) {
+       case LTTNG_SYSCALL_ENTRY:
+               switch (notifier->u.syscall.abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       dispatch_list = &group->event_notifier_syscall_dispatch[syscall_id];
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       dispatch_list = &group->event_notifier_compat_syscall_dispatch[syscall_id];
+                       break;
+               }
+               break;
+       case LTTNG_SYSCALL_EXIT:
+               switch (notifier->u.syscall.abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       dispatch_list = &group->event_notifier_exit_syscall_dispatch[syscall_id];
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[syscall_id];
+                       break;
                }
-               bitmap_set(filter->sc_compat, compat_syscall_nr, 1);
+               break;
        }
-       if (!chan->sc_filter)
-               rcu_assign_pointer(chan->sc_filter, filter);
-       return 0;
 
-error:
-       if (!chan->sc_filter)
-               kfree(filter);
-       return ret;
+       hlist_add_head_rcu(&notifier->u.syscall.node, dispatch_list);
+
+end:
+       return ret ;
 }
 
-int lttng_syscall_filter_disable(struct lttng_channel *chan,
-               const char *name)
+int lttng_syscall_filter_enable_event(
+               struct lttng_channel *channel,
+               struct lttng_event *event)
 {
-       int syscall_nr, compat_syscall_nr, ret;
-       struct lttng_syscall_filter *filter;
+       WARN_ON_ONCE(event->instrumentation != LTTNG_KERNEL_SYSCALL);
 
-       WARN_ON_ONCE(!chan->sc_table);
+       return lttng_syscall_filter_enable(channel->sc_filter,
+               event->desc->name, event->u.syscall.abi,
+               event->u.syscall.entryexit);
+}
 
-       if (!chan->sc_filter) {
-               if (!chan->syscall_all)
-                       return -EEXIST;
-               filter = kzalloc(sizeof(struct lttng_syscall_filter),
-                               GFP_KERNEL);
-               if (!filter)
-                       return -ENOMEM;
-               /* Trace all system calls, then apply disable. */
-               bitmap_set(filter->sc, 0, NR_syscalls);
-               bitmap_set(filter->sc_compat, 0, NR_compat_syscalls);
-       } else {
-               filter = chan->sc_filter;
-       }
+static
+int lttng_syscall_filter_disable(
+               struct lttng_syscall_filter *filter,
+               const char *desc_name, enum lttng_syscall_abi abi,
+               enum lttng_syscall_entryexit entryexit)
+{
+       const char *syscall_name;
+       unsigned long *bitmap;
+       int syscall_nr;
 
-       if (!name) {
-               /* Fail if all syscalls are already disabled. */
-               if (bitmap_empty(filter->sc, NR_syscalls)
-                       && bitmap_empty(filter->sc_compat,
-                               NR_compat_syscalls)) {
-                       ret = -EEXIST;
-                       goto error;
-               }
+       syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-               /* Disable all system calls */
-               bitmap_clear(filter->sc, 0, NR_syscalls);
-               bitmap_clear(filter->sc_compat, 0, NR_compat_syscalls);
-               goto apply_filter;
-       }
-       syscall_nr = get_syscall_nr(name);
-       compat_syscall_nr = get_compat_syscall_nr(name);
-       if (syscall_nr < 0 && compat_syscall_nr < 0) {
-               ret = -ENOENT;
-               goto error;
-       }
-       if (syscall_nr >= 0) {
-               if (!test_bit(syscall_nr, filter->sc)) {
-                       ret = -EEXIST;
-                       goto error;
-               }
-               bitmap_clear(filter->sc, syscall_nr, 1);
+       switch (abi) {
+       case LTTNG_SYSCALL_ABI_NATIVE:
+               syscall_nr = get_syscall_nr(syscall_name);
+               break;
+       case LTTNG_SYSCALL_ABI_COMPAT:
+               syscall_nr = get_compat_syscall_nr(syscall_name);
+               break;
+       default:
+               return -EINVAL;
        }
-       if (compat_syscall_nr >= 0) {
-               if (!test_bit(compat_syscall_nr, filter->sc_compat)) {
-                       ret = -EEXIST;
-                       goto error;
+       if (syscall_nr < 0)
+               return -ENOENT;
+
+       switch (entryexit) {
+       case LTTNG_SYSCALL_ENTRY:
+               switch (abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       bitmap = filter->sc_entry;
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       bitmap = filter->sc_compat_entry;
+                       break;
+               default:
+                       return -EINVAL;
                }
-               bitmap_clear(filter->sc_compat, compat_syscall_nr, 1);
+               break;
+       case LTTNG_SYSCALL_EXIT:
+               switch (abi) {
+               case LTTNG_SYSCALL_ABI_NATIVE:
+                       bitmap = filter->sc_exit;
+                       break;
+               case LTTNG_SYSCALL_ABI_COMPAT:
+                       bitmap = filter->sc_compat_exit;
+                       break;
+               default:
+                       return -EINVAL;
+               }
+               break;
+       default:
+               return -EINVAL;
        }
-apply_filter:
-       if (!chan->sc_filter)
-               rcu_assign_pointer(chan->sc_filter, filter);
-       chan->syscall_all = 0;
+       if (!test_bit(syscall_nr, bitmap))
+               return -EEXIST;
+       bitmap_clear(bitmap, syscall_nr, 1);
+
        return 0;
+}
 
-error:
-       if (!chan->sc_filter)
-               kfree(filter);
-       return ret;
+int lttng_syscall_filter_disable_event_notifier(
+               struct lttng_event_notifier *notifier)
+{
+       struct lttng_event_notifier_group *group = notifier->group;
+       int ret;
+
+       WARN_ON_ONCE(notifier->instrumentation != LTTNG_KERNEL_SYSCALL);
+
+       ret = lttng_syscall_filter_disable(group->sc_filter,
+               notifier->desc->name, notifier->u.syscall.abi,
+               notifier->u.syscall.entryexit);
+       WARN_ON_ONCE(ret != 0);
+
+       hlist_del_rcu(&notifier->u.syscall.node);
+       return 0;
+}
+
+int lttng_syscall_filter_disable_event(
+               struct lttng_channel *channel,
+               struct lttng_event *event)
+{
+       return lttng_syscall_filter_disable(channel->sc_filter,
+               event->desc->name, event->u.syscall.abi,
+               event->u.syscall.entryexit);
 }
 
 static
@@ -1238,6 +2096,9 @@ const struct file_operations lttng_syscall_list_fops = {
        .release = seq_release,
 };
 
+/*
+ * A syscall is enabled if it is traced for either entry or exit.
+ */
 long lttng_channel_syscall_mask(struct lttng_channel *channel,
                struct lttng_kernel_syscall_mask __user *usyscall_mask)
 {
@@ -1264,8 +2125,9 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
                char state;
 
                if (channel->sc_table) {
-                       if (filter)
-                               state = test_bit(bit, filter->sc);
+                       if (!READ_ONCE(channel->syscall_all) && filter)
+                               state = test_bit(bit, filter->sc_entry)
+                                       || test_bit(bit, filter->sc_exit);
                        else
                                state = 1;
                } else {
@@ -1277,9 +2139,11 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
                char state;
 
                if (channel->compat_sc_table) {
-                       if (filter)
+                       if (!READ_ONCE(channel->syscall_all) && filter)
                                state = test_bit(bit - ARRAY_SIZE(sc_table),
-                                               filter->sc_compat);
+                                               filter->sc_compat_entry)
+                                       || test_bit(bit - ARRAY_SIZE(sc_table),
+                                               filter->sc_compat_exit);
                        else
                                state = 1;
                } else {
This page took 0.044443 seconds and 4 git commands to generate.