X-Git-Url: http://git.lttng.org/?p=lttng-modules.git;a=blobdiff_plain;f=src%2Flttng-events.c;h=75a193045b1d381a3bf531542e763d741b095d8a;hp=092cbb887a97899e4a6fd4be4c50ede12c65d97d;hb=99d223adfae9b68800e91bda470c92acb14efae6;hpb=dffef45d53ab388fd08c19e8865b245b40ca9dff

diff --git a/src/lttng-events.c b/src/lttng-events.c
index 092cbb88..75a19304 100644
--- a/src/lttng-events.c
+++ b/src/lttng-events.c
@@ -36,7 +36,9 @@
 #include <wrapper/types.h>
 #include <lttng/kernel-version.h>
 #include <lttng/events.h>
+#include <lttng/lttng-bytecode.h>
 #include <lttng/tracer.h>
+#include <lttng/event-notifier-notification.h>
 #include <lttng/abi-old.h>
 #include <lttng/endian.h>
 #include <lttng/string-utils.h>
@@ -61,6 +63,7 @@ static void lttng_session_lazy_sync_event_enablers(struct lttng_session *session
 static void lttng_session_sync_event_enablers(struct lttng_session *session);
 static void lttng_event_enabler_destroy(struct lttng_event_enabler *event_enabler);
 static void lttng_event_notifier_enabler_destroy(struct lttng_event_notifier_enabler *event_notifier_enabler);
+static void lttng_event_notifier_group_sync_enablers(struct lttng_event_notifier_group *event_notifier_group);
 
 static void _lttng_event_destroy(struct lttng_event *event);
 static void _lttng_event_notifier_destroy(struct lttng_event_notifier *event_notifier);
@@ -278,7 +281,7 @@ void lttng_session_destroy(struct lttng_session *session)
 	mutex_lock(&sessions_mutex);
 	WRITE_ONCE(session->active, 0);
 	list_for_each_entry(chan, &session->chan, list) {
-		ret = lttng_syscalls_unregister(chan);
+		ret = lttng_syscalls_unregister_event(chan);
 		WARN_ON(ret);
 	}
 	list_for_each_entry(event, &session->events, list) {
@@ -287,7 +290,7 @@ void lttng_session_destroy(struct lttng_session *session)
 	}
 	synchronize_trace();	/* Wait for in-flight events to complete */
 	list_for_each_entry(chan, &session->chan, list) {
-		ret = lttng_syscalls_destroy(chan);
+		ret = lttng_syscalls_destroy_event(chan);
 		WARN_ON(ret);
 	}
 	list_for_each_entry_safe(event_enabler, tmp_event_enabler,
@@ -327,12 +330,22 @@ void lttng_event_notifier_group_destroy(
 
 	mutex_lock(&sessions_mutex);
 
+	ret = lttng_syscalls_unregister_event_notifier(event_notifier_group);
+	WARN_ON(ret);
+
 	list_for_each_entry_safe(event_notifier, tmpevent_notifier,
 			&event_notifier_group->event_notifiers_head, list) {
 		ret = _lttng_event_notifier_unregister(event_notifier);
 		WARN_ON(ret);
 	}
 
+	/* Wait for in-flight event notifier to complete */
+	synchronize_trace();
+
+	irq_work_sync(&event_notifier_group->wakeup_pending);
+
+	kfree(event_notifier_group->sc_filter);
+
 	list_for_each_entry_safe(event_notifier_enabler, tmp_event_notifier_enabler,
 			&event_notifier_group->enablers_head, node)
 		lttng_event_notifier_enabler_destroy(event_notifier_enabler);
@@ -606,9 +619,13 @@ int lttng_event_notifier_enable(struct lttng_event_notifier *event_notifier)
 	switch (event_notifier->instrumentation) {
 	case LTTNG_KERNEL_TRACEPOINT:
 	case LTTNG_KERNEL_SYSCALL:
+		ret = -EINVAL;
+		break;
 	case LTTNG_KERNEL_KPROBE:
-	case LTTNG_KERNEL_FUNCTION:
 	case LTTNG_KERNEL_UPROBE:
+		WRITE_ONCE(event_notifier->enabled, 1);
+		break;
+	case LTTNG_KERNEL_FUNCTION:
 	case LTTNG_KERNEL_NOOP:
 	case LTTNG_KERNEL_KRETPROBE:
 	default:
@@ -632,9 +649,13 @@ int lttng_event_notifier_disable(struct lttng_event_notifier *event_notifier)
 	switch (event_notifier->instrumentation) {
 	case LTTNG_KERNEL_TRACEPOINT:
 	case LTTNG_KERNEL_SYSCALL:
+		ret = -EINVAL;
+		break;
 	case LTTNG_KERNEL_KPROBE:
-	case LTTNG_KERNEL_FUNCTION:
 	case LTTNG_KERNEL_UPROBE:
+		WRITE_ONCE(event_notifier->enabled, 0);
+		break;
+	case LTTNG_KERNEL_FUNCTION:
 	case LTTNG_KERNEL_NOOP:
 	case LTTNG_KERNEL_KRETPROBE:
 	default:
@@ -799,7 +820,7 @@ struct lttng_event *_lttng_event_create(struct lttng_channel *chan,
 	event->id = chan->free_event_id++;
 	event->instrumentation = itype;
 	event->evtype = LTTNG_TYPE_EVENT;
-	INIT_LIST_HEAD(&event->bytecode_runtime_head);
+	INIT_LIST_HEAD(&event->filter_bytecode_runtime_head);
 	INIT_LIST_HEAD(&event->enablers_ref_head);
 
 	switch (itype) {
@@ -827,7 +848,7 @@ struct lttng_event *_lttng_event_create(struct lttng_channel *chan,
 		 * registration.
 		 */
 		smp_wmb();
-		ret = lttng_kprobes_register(event_name,
+		ret = lttng_kprobes_register_event(event_name,
 				event_param->u.kprobe.symbol_name,
 				event_param->u.kprobe.offset,
 				event_param->u.kprobe.addr,
@@ -943,7 +964,7 @@ struct lttng_event *_lttng_event_create(struct lttng_channel *chan,
 		 */
 		smp_wmb();
 
-		ret = lttng_uprobes_register(event_param->name,
+		ret = lttng_uprobes_register_event(event_param->name,
 				event_param->u.uprobe.fd,
 				event);
 		if (ret)
@@ -990,12 +1011,16 @@ struct lttng_event_notifier *_lttng_event_notifier_create(
 
 	switch (itype) {
 	case LTTNG_KERNEL_TRACEPOINT:
+		event_name = event_desc->name;
+		break;
 	case LTTNG_KERNEL_KPROBE:
 	case LTTNG_KERNEL_UPROBE:
+	case LTTNG_KERNEL_SYSCALL:
+		event_name = event_notifier_param->event.name;
+		break;
 	case LTTNG_KERNEL_KRETPROBE:
 	case LTTNG_KERNEL_FUNCTION:
 	case LTTNG_KERNEL_NOOP:
-	case LTTNG_KERNEL_SYSCALL:
 	default:
 		WARN_ON_ONCE(1);
 		ret = -EINVAL;
@@ -1020,12 +1045,16 @@ struct lttng_event_notifier *_lttng_event_notifier_create(
 		ret = -ENOMEM;
 		goto cache_error;
 	}
+
 	event_notifier->group = event_notifier_group;
 	event_notifier->user_token = token;
+	event_notifier->num_captures = 0;
 	event_notifier->filter = filter;
 	event_notifier->instrumentation = itype;
 	event_notifier->evtype = LTTNG_TYPE_EVENT;
-	INIT_LIST_HEAD(&event_notifier->bytecode_runtime_head);
+	event_notifier->send_notification = lttng_event_notifier_notification_send;
+	INIT_LIST_HEAD(&event_notifier->filter_bytecode_runtime_head);
+	INIT_LIST_HEAD(&event_notifier->capture_bytecode_runtime_head);
 	INIT_LIST_HEAD(&event_notifier->enablers_ref_head);
 
 	switch (itype) {
@@ -1042,11 +1071,91 @@ struct lttng_event_notifier *_lttng_event_notifier_create(
 		smp_wmb();
 		break;
 	case LTTNG_KERNEL_KPROBE:
+		/*
+		 * Needs to be explicitly enabled after creation, since
+		 * we may want to apply filters.
+		 */
+		event_notifier->enabled = 0;
+		event_notifier->registered = 1;
+		/*
+		 * Populate lttng_event_notifier structure before event
+		 * registration.
+		 */
+		smp_wmb();
+		ret = lttng_kprobes_register_event_notifier(
+				event_notifier_param->event.u.kprobe.symbol_name,
+				event_notifier_param->event.u.kprobe.offset,
+				event_notifier_param->event.u.kprobe.addr,
+				event_notifier);
+		if (ret) {
+			ret = -EINVAL;
+			goto register_error;
+		}
+		ret = try_module_get(event_notifier->desc->owner);
+		WARN_ON_ONCE(!ret);
+		break;
+	case LTTNG_KERNEL_NOOP:
+	case LTTNG_KERNEL_SYSCALL:
+		/*
+		 * Needs to be explicitly enabled after creation, since
+		 * we may want to apply filters.
+		 */
+		event_notifier->enabled = 0;
+		event_notifier->registered = 0;
+		event_notifier->desc = event_desc;
+		switch (event_notifier_param->event.u.syscall.entryexit) {
+		case LTTNG_KERNEL_SYSCALL_ENTRYEXIT:
+			ret = -EINVAL;
+			goto register_error;
+		case LTTNG_KERNEL_SYSCALL_ENTRY:
+			event_notifier->u.syscall.entryexit = LTTNG_SYSCALL_ENTRY;
+			break;
+		case LTTNG_KERNEL_SYSCALL_EXIT:
+			event_notifier->u.syscall.entryexit = LTTNG_SYSCALL_EXIT;
+			break;
+		}
+		switch (event_notifier_param->event.u.syscall.abi) {
+		case LTTNG_KERNEL_SYSCALL_ABI_ALL:
+			ret = -EINVAL;
+			goto register_error;
+		case LTTNG_KERNEL_SYSCALL_ABI_NATIVE:
+			event_notifier->u.syscall.abi = LTTNG_SYSCALL_ABI_NATIVE;
+			break;
+		case LTTNG_KERNEL_SYSCALL_ABI_COMPAT:
+			event_notifier->u.syscall.abi = LTTNG_SYSCALL_ABI_COMPAT;
+			break;
+		}
+
+		if (!event_notifier->desc) {
+			ret = -EINVAL;
+			goto register_error;
+		}
+		break;
 	case LTTNG_KERNEL_UPROBE:
+		/*
+		 * Needs to be explicitly enabled after creation, since
+		 * we may want to apply filters.
+		 */
+		event_notifier->enabled = 0;
+		event_notifier->registered = 1;
+
+		/*
+		 * Populate lttng_event_notifier structure before
+		 * event_notifier registration.
+		 */
+		smp_wmb();
+
+		ret = lttng_uprobes_register_event_notifier(
+				event_notifier_param->event.name,
+				event_notifier_param->event.u.uprobe.fd,
+				event_notifier);
+		if (ret)
+			goto register_error;
+		ret = try_module_get(event_notifier->desc->owner);
+		WARN_ON_ONCE(!ret);
+		break;
 	case LTTNG_KERNEL_KRETPROBE:
 	case LTTNG_KERNEL_FUNCTION:
-	case LTTNG_KERNEL_NOOP:
-	case LTTNG_KERNEL_SYSCALL:
 	default:
 		WARN_ON_ONCE(1);
 		ret = -EINVAL;
@@ -1113,7 +1222,7 @@ void register_event(struct lttng_event *event)
 						  event);
 		break;
 	case LTTNG_KERNEL_SYSCALL:
-		ret = lttng_syscall_filter_enable(event->chan, event);
+		ret = lttng_syscall_filter_enable_event(event->chan, event);
 		break;
 	case LTTNG_KERNEL_KPROBE:
 	case LTTNG_KERNEL_UPROBE:
@@ -1148,7 +1257,7 @@ int _lttng_event_unregister(struct lttng_event *event)
 						  event);
 		break;
 	case LTTNG_KERNEL_KPROBE:
-		lttng_kprobes_unregister(event);
+		lttng_kprobes_unregister_event(event);
 		ret = 0;
 		break;
 	case LTTNG_KERNEL_KRETPROBE:
@@ -1156,13 +1265,13 @@ int _lttng_event_unregister(struct lttng_event *event)
 		ret = 0;
 		break;
 	case LTTNG_KERNEL_SYSCALL:
-		ret = lttng_syscall_filter_disable(event->chan, event);
+		ret = lttng_syscall_filter_disable_event(event->chan, event);
 		break;
 	case LTTNG_KERNEL_NOOP:
 		ret = 0;
 		break;
 	case LTTNG_KERNEL_UPROBE:
-		lttng_uprobes_unregister(event);
+		lttng_uprobes_unregister_event(event);
 		ret = 0;
 		break;
 	case LTTNG_KERNEL_FUNCTION:	/* Fall-through */
@@ -1176,8 +1285,7 @@ int _lttng_event_unregister(struct lttng_event *event)
 
 /* Only used for tracepoints for now. */
 static
-void __always_unused register_event_notifier(
-		struct lttng_event_notifier *event_notifier)
+void register_event_notifier(struct lttng_event_notifier *event_notifier)
 {
 	const struct lttng_event_desc *desc;
 	int ret = -EINVAL;
@@ -1188,9 +1296,17 @@ void __always_unused register_event_notifier(
 	desc = event_notifier->desc;
 	switch (event_notifier->instrumentation) {
 	case LTTNG_KERNEL_TRACEPOINT:
+		ret = lttng_wrapper_tracepoint_probe_register(desc->kname,
+						  desc->event_notifier_callback,
+						  event_notifier);
+		break;
 	case LTTNG_KERNEL_SYSCALL:
+		ret = lttng_syscall_filter_enable_event_notifier(event_notifier);
+		break;
 	case LTTNG_KERNEL_KPROBE:
 	case LTTNG_KERNEL_UPROBE:
+		ret = 0;
+		break;
 	case LTTNG_KERNEL_KRETPROBE:
 	case LTTNG_KERNEL_FUNCTION:
 	case LTTNG_KERNEL_NOOP:
@@ -1214,12 +1330,24 @@ int _lttng_event_notifier_unregister(
 	desc = event_notifier->desc;
 	switch (event_notifier->instrumentation) {
 	case LTTNG_KERNEL_TRACEPOINT:
+		ret = lttng_wrapper_tracepoint_probe_unregister(event_notifier->desc->kname,
+						  event_notifier->desc->event_notifier_callback,
+						  event_notifier);
+		break;
 	case LTTNG_KERNEL_KPROBE:
+		lttng_kprobes_unregister_event_notifier(event_notifier);
+		ret = 0;
+		break;
+	case LTTNG_KERNEL_UPROBE:
+		lttng_uprobes_unregister_event_notifier(event_notifier);
+		ret = 0;
+		break;
+	case LTTNG_KERNEL_SYSCALL:
+		ret = lttng_syscall_filter_disable_event_notifier(event_notifier);
+		break;
 	case LTTNG_KERNEL_KRETPROBE:
 	case LTTNG_KERNEL_FUNCTION:
-	case LTTNG_KERNEL_SYSCALL:
 	case LTTNG_KERNEL_NOOP:
-	case LTTNG_KERNEL_UPROBE:
 	default:
 		WARN_ON_ONCE(1);
 	}
@@ -1240,7 +1368,7 @@ void _lttng_event_destroy(struct lttng_event *event)
 		break;
 	case LTTNG_KERNEL_KPROBE:
 		module_put(event->desc->owner);
-		lttng_kprobes_destroy_private(event);
+		lttng_kprobes_destroy_event_private(event);
 		break;
 	case LTTNG_KERNEL_KRETPROBE:
 		module_put(event->desc->owner);
@@ -1251,7 +1379,7 @@ void _lttng_event_destroy(struct lttng_event *event)
 		break;
 	case LTTNG_KERNEL_UPROBE:
 		module_put(event->desc->owner);
-		lttng_uprobes_destroy_private(event);
+		lttng_uprobes_destroy_event_private(event);
 		break;
 	case LTTNG_KERNEL_FUNCTION:	/* Fall-through */
 	default:
@@ -1270,12 +1398,21 @@ void _lttng_event_notifier_destroy(struct lttng_event_notifier *event_notifier)
 {
 	switch (event_notifier->instrumentation) {
 	case LTTNG_KERNEL_TRACEPOINT:
+		lttng_event_desc_put(event_notifier->desc);
+		break;
 	case LTTNG_KERNEL_KPROBE:
-	case LTTNG_KERNEL_KRETPROBE:
-	case LTTNG_KERNEL_FUNCTION:
+		module_put(event_notifier->desc->owner);
+		lttng_kprobes_destroy_event_notifier_private(event_notifier);
+		break;
 	case LTTNG_KERNEL_NOOP:
 	case LTTNG_KERNEL_SYSCALL:
+		break;
 	case LTTNG_KERNEL_UPROBE:
+		module_put(event_notifier->desc->owner);
+		lttng_uprobes_destroy_event_notifier_private(event_notifier);
+		break;
+	case LTTNG_KERNEL_KRETPROBE:
+	case LTTNG_KERNEL_FUNCTION:
 	default:
 		WARN_ON_ONCE(1);
 	}
@@ -1558,7 +1695,6 @@ int lttng_match_enabler_name(const char *desc_name,
 	return 1;
 }
 
-static
 int lttng_desc_match_enabler(const struct lttng_event_desc *desc,
 		struct lttng_enabler *enabler)
 {
@@ -1624,7 +1760,7 @@ int lttng_desc_match_enabler(const struct lttng_event_desc *desc,
 			return -EINVAL;
 		}
 		switch (enabler->event_param.u.syscall.match) {
-		case LTTNG_SYSCALL_MATCH_NAME:
+		case LTTNG_KERNEL_SYSCALL_MATCH_NAME:
 			switch (enabler->format_type) {
 			case LTTNG_ENABLER_FORMAT_STAR_GLOB:
 				return lttng_match_enabler_star_glob(desc_name, enabler_name);
@@ -1634,7 +1770,7 @@ int lttng_desc_match_enabler(const struct lttng_event_desc *desc,
 				return -EINVAL;
 			}
 			break;
-		case LTTNG_SYSCALL_MATCH_NR:
+		case LTTNG_KERNEL_SYSCALL_MATCH_NR:
 			return -EINVAL;	/* Not implemented. */
 		default:
 			return -EINVAL;
@@ -1662,6 +1798,23 @@ int lttng_event_enabler_match_event(struct lttng_event_enabler *event_enabler,
 		return 0;
 }
 
+static
+int lttng_event_notifier_enabler_match_event_notifier(struct lttng_event_notifier_enabler *event_notifier_enabler,
+		struct lttng_event_notifier *event_notifier)
+{
+	struct lttng_enabler *base_enabler = lttng_event_notifier_enabler_as_enabler(
+		event_notifier_enabler);
+
+	if (base_enabler->event_param.instrumentation != event_notifier->instrumentation)
+		return 0;
+	if (lttng_desc_match_enabler(event_notifier->desc, base_enabler)
+			&& event_notifier->group == event_notifier_enabler->group
+			&& event_notifier->user_token == event_notifier_enabler->base.user_token)
+		return 1;
+	else
+		return 0;
+}
+
 static
 struct lttng_enabler_ref *lttng_enabler_ref(
 		struct list_head *enablers_ref_list,
@@ -1731,12 +1884,78 @@ void lttng_create_tracepoint_event_if_missing(struct lttng_event_enabler *event_
 	}
 }
 
+static
+void lttng_create_tracepoint_event_notifier_if_missing(struct lttng_event_notifier_enabler *event_notifier_enabler)
+{
+	struct lttng_event_notifier_group *event_notifier_group = event_notifier_enabler->group;
+	struct lttng_probe_desc *probe_desc;
+	const struct lttng_event_desc *desc;
+	int i;
+	struct list_head *probe_list;
+
+	probe_list = lttng_get_probe_list_head();
+	/*
+	 * For each probe event, if we find that a probe event matches
+	 * our enabler, create an associated lttng_event_notifier if not
+	 * already present.
+	 */
+	list_for_each_entry(probe_desc, probe_list, head) {
+		for (i = 0; i < probe_desc->nr_events; i++) {
+			int found = 0;
+			struct hlist_head *head;
+			struct lttng_event_notifier *event_notifier;
+
+			desc = probe_desc->event_desc[i];
+			if (!lttng_desc_match_enabler(desc,
+					lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)))
+				continue;
+
+			/*
+			 * Check if already created.
+			 */
+			head = utils_borrow_hash_table_bucket(
+				event_notifier_group->event_notifiers_ht.table,
+				LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->name);
+			lttng_hlist_for_each_entry(event_notifier, head, hlist) {
+				if (event_notifier->desc == desc
+						&& event_notifier->user_token == event_notifier_enabler->base.user_token)
+					found = 1;
+			}
+			if (found)
+				continue;
+
+			/*
+			 * We need to create a event_notifier for this event probe.
+			 */
+			event_notifier = _lttng_event_notifier_create(desc,
+				event_notifier_enabler->base.user_token,
+				event_notifier_group, NULL, NULL,
+				LTTNG_KERNEL_TRACEPOINT);
+			if (IS_ERR(event_notifier)) {
+				printk(KERN_INFO "Unable to create event_notifier %s\n",
+					probe_desc->event_desc[i]->name);
+			}
+		}
+	}
+}
+
 static
 void lttng_create_syscall_event_if_missing(struct lttng_event_enabler *event_enabler)
 {
 	int ret;
 
-	ret = lttng_syscalls_register(event_enabler->chan, NULL);
+	ret = lttng_syscalls_register_event(event_enabler->chan, NULL);
+	WARN_ON_ONCE(ret);
+}
+
+static
+void lttng_create_syscall_event_notifier_if_missing(struct lttng_event_notifier_enabler *event_notifier_enabler)
+{
+	int ret;
+
+	ret = lttng_syscalls_register_event_notifier(event_notifier_enabler, NULL);
+	WARN_ON_ONCE(ret);
+	ret = lttng_syscals_create_matching_event_notifiers(event_notifier_enabler, NULL);
 	WARN_ON_ONCE(ret);
 }
 
@@ -1777,7 +1996,7 @@ int lttng_event_enabler_ref_events(struct lttng_event_enabler *event_enabler)
 	if (base_enabler->event_param.instrumentation == LTTNG_KERNEL_SYSCALL &&
 			base_enabler->event_param.u.syscall.entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT &&
 			base_enabler->event_param.u.syscall.abi == LTTNG_KERNEL_SYSCALL_ABI_ALL &&
-			base_enabler->event_param.u.syscall.match == LTTNG_SYSCALL_MATCH_NAME &&
+			base_enabler->event_param.u.syscall.match == LTTNG_KERNEL_SYSCALL_MATCH_NAME &&
 			!strcmp(base_enabler->event_param.name, "*")) {
 		if (base_enabler->enabled)
 			WRITE_ONCE(chan->syscall_all, 1);
@@ -1814,14 +2033,106 @@ int lttng_event_enabler_ref_events(struct lttng_event_enabler *event_enabler)
 		 */
 		lttng_enabler_link_bytecode(event->desc,
 			lttng_static_ctx,
-			&event->bytecode_runtime_head,
-			lttng_event_enabler_as_enabler(event_enabler));
+			&event->filter_bytecode_runtime_head,
+			&lttng_event_enabler_as_enabler(event_enabler)->filter_bytecode_head);
 
 		/* TODO: merge event context. */
 	}
 	return 0;
 }
 
+/*
+ * Create struct lttng_event_notifier if it is missing and present in the list of
+ * tracepoint probes.
+ * Should be called with sessions mutex held.
+ */
+static
+void lttng_create_event_notifier_if_missing(struct lttng_event_notifier_enabler *event_notifier_enabler)
+{
+	switch (event_notifier_enabler->base.event_param.instrumentation) {
+	case LTTNG_KERNEL_TRACEPOINT:
+		lttng_create_tracepoint_event_notifier_if_missing(event_notifier_enabler);
+		break;
+	case LTTNG_KERNEL_SYSCALL:
+		lttng_create_syscall_event_notifier_if_missing(event_notifier_enabler);
+		break;
+	default:
+		WARN_ON_ONCE(1);
+		break;
+	}
+}
+
+/*
+ * Create event_notifiers associated with a event_notifier enabler (if not already present).
+ */
+static
+int lttng_event_notifier_enabler_ref_event_notifiers(
+		struct lttng_event_notifier_enabler *event_notifier_enabler)
+{
+	struct lttng_event_notifier_group *event_notifier_group = event_notifier_enabler->group;
+	struct lttng_enabler *base_enabler = lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
+	struct lttng_event_notifier *event_notifier;
+
+	if (base_enabler->event_param.instrumentation == LTTNG_KERNEL_SYSCALL &&
+			base_enabler->event_param.u.syscall.abi == LTTNG_KERNEL_SYSCALL_ABI_ALL &&
+			base_enabler->event_param.u.syscall.match == LTTNG_KERNEL_SYSCALL_MATCH_NAME &&
+			!strcmp(base_enabler->event_param.name, "*")) {
+
+		int enabled = base_enabler->enabled;
+		enum lttng_kernel_syscall_entryexit entryexit = base_enabler->event_param.u.syscall.entryexit;
+
+		if (entryexit == LTTNG_KERNEL_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT)
+			WRITE_ONCE(event_notifier_group->syscall_all_entry, enabled);
+
+		if (entryexit == LTTNG_KERNEL_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT)
+			WRITE_ONCE(event_notifier_group->syscall_all_exit, enabled);
+
+	}
+
+	/* First ensure that probe event_notifiers are created for this enabler. */
+	lttng_create_event_notifier_if_missing(event_notifier_enabler);
+
+	/* Link the created event_notifier with its associated enabler. */
+	list_for_each_entry(event_notifier, &event_notifier_group->event_notifiers_head, list) {
+		struct lttng_enabler_ref *enabler_ref;
+
+		if (!lttng_event_notifier_enabler_match_event_notifier(event_notifier_enabler, event_notifier))
+			continue;
+
+		enabler_ref = lttng_enabler_ref(&event_notifier->enablers_ref_head,
+			lttng_event_notifier_enabler_as_enabler(event_notifier_enabler));
+		if (!enabler_ref) {
+			/*
+			 * If no backward ref, create it.
+			 * Add backward ref from event_notifier to enabler.
+			 */
+			enabler_ref = kzalloc(sizeof(*enabler_ref), GFP_KERNEL);
+			if (!enabler_ref)
+				return -ENOMEM;
+
+			enabler_ref->ref = lttng_event_notifier_enabler_as_enabler(
+				event_notifier_enabler);
+			list_add(&enabler_ref->node,
+				&event_notifier->enablers_ref_head);
+		}
+
+		/*
+		 * Link filter bytecodes if not linked yet.
+		 */
+		lttng_enabler_link_bytecode(event_notifier->desc,
+			lttng_static_ctx, &event_notifier->filter_bytecode_runtime_head,
+			&lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)->filter_bytecode_head);
+
+		/* Link capture bytecodes if not linked yet. */
+		lttng_enabler_link_bytecode(event_notifier->desc,
+			lttng_static_ctx, &event_notifier->capture_bytecode_runtime_head,
+			&event_notifier_enabler->capture_bytecode_head);
+
+		event_notifier->num_captures = event_notifier_enabler->num_captures;
+	}
+	return 0;
+}
+
 /*
  * Called at module load: connect the probe on all enablers matching
  * this event.
@@ -1836,6 +2147,39 @@ int lttng_fix_pending_events(void)
 	return 0;
 }
 
+static bool lttng_event_notifier_group_has_active_event_notifiers(
+		struct lttng_event_notifier_group *event_notifier_group)
+{
+	struct lttng_event_notifier_enabler *event_notifier_enabler;
+
+	list_for_each_entry(event_notifier_enabler, &event_notifier_group->enablers_head,
+			node) {
+		if (event_notifier_enabler->base.enabled)
+			return true;
+	}
+	return false;
+}
+
+bool lttng_event_notifier_active(void)
+{
+	struct lttng_event_notifier_group *event_notifier_group;
+
+	list_for_each_entry(event_notifier_group, &event_notifier_groups, node) {
+		if (lttng_event_notifier_group_has_active_event_notifiers(event_notifier_group))
+			return true;
+	}
+	return false;
+}
+
+int lttng_fix_pending_event_notifiers(void)
+{
+	struct lttng_event_notifier_group *event_notifier_group;
+
+	list_for_each_entry(event_notifier_group, &event_notifier_groups, node)
+		lttng_event_notifier_group_sync_enablers(event_notifier_group);
+	return 0;
+}
+
 struct lttng_event_enabler *lttng_event_enabler_create(
 		enum lttng_enabler_format_type format_type,
 		struct lttng_kernel_event *event_param,
@@ -1880,17 +2224,17 @@ int lttng_event_enabler_disable(struct lttng_event_enabler *event_enabler)
 }
 
 static
-int lttng_enabler_attach_bytecode(struct lttng_enabler *enabler,
+int lttng_enabler_attach_filter_bytecode(struct lttng_enabler *enabler,
 		struct lttng_kernel_filter_bytecode __user *bytecode)
 {
-	struct lttng_filter_bytecode_node *bytecode_node;
+	struct lttng_bytecode_node *bytecode_node;
 	uint32_t bytecode_len;
 	int ret;
 
 	ret = get_user(bytecode_len, &bytecode->len);
 	if (ret)
 		return ret;
-	bytecode_node = kzalloc(sizeof(*bytecode_node) + bytecode_len,
+	bytecode_node = lttng_kvzalloc(sizeof(*bytecode_node) + bytecode_len,
 			GFP_KERNEL);
 	if (!bytecode_node)
 		return -ENOMEM;
@@ -1899,6 +2243,7 @@ int lttng_enabler_attach_bytecode(struct lttng_enabler *enabler,
 	if (ret)
 		goto error_free;
 
+	bytecode_node->type = LTTNG_BYTECODE_NODE_TYPE_FILTER;
 	bytecode_node->enabler = enabler;
 	/* Enforce length based on allocated size */
 	bytecode_node->bc.len = bytecode_len;
@@ -1907,15 +2252,15 @@ int lttng_enabler_attach_bytecode(struct lttng_enabler *enabler,
 	return 0;
 
 error_free:
-	kfree(bytecode_node);
+	lttng_kvfree(bytecode_node);
 	return ret;
 }
 
-int lttng_event_enabler_attach_bytecode(struct lttng_event_enabler *event_enabler,
+int lttng_event_enabler_attach_filter_bytecode(struct lttng_event_enabler *event_enabler,
 		struct lttng_kernel_filter_bytecode __user *bytecode)
 {
 	int ret;
-	ret = lttng_enabler_attach_bytecode(
+	ret = lttng_enabler_attach_filter_bytecode(
 		lttng_event_enabler_as_enabler(event_enabler), bytecode);
 	if (ret)
 		goto error;
@@ -1933,7 +2278,7 @@ int lttng_event_add_callsite(struct lttng_event *event,
 
 	switch (event->instrumentation) {
 	case LTTNG_KERNEL_UPROBE:
-		return lttng_uprobes_add_callsite(event, callsite);
+		return lttng_uprobes_event_add_callsite(event, callsite);
 	default:
 		return -EINVAL;
 	}
@@ -1948,12 +2293,12 @@ int lttng_event_enabler_attach_context(struct lttng_event_enabler *event_enabler
 static
 void lttng_enabler_destroy(struct lttng_enabler *enabler)
 {
-	struct lttng_filter_bytecode_node *filter_node, *tmp_filter_node;
+	struct lttng_bytecode_node *filter_node, *tmp_filter_node;
 
 	/* Destroy filter bytecode */
 	list_for_each_entry_safe(filter_node, tmp_filter_node,
 			&enabler->filter_bytecode_head, node) {
-		kfree(filter_node);
+		lttng_kvfree(filter_node);
 	}
 }
 
@@ -1982,10 +2327,12 @@ struct lttng_event_notifier_enabler *lttng_event_notifier_enabler_create(
 
 	event_notifier_enabler->base.format_type = format_type;
 	INIT_LIST_HEAD(&event_notifier_enabler->base.filter_bytecode_head);
+	INIT_LIST_HEAD(&event_notifier_enabler->capture_bytecode_head);
+
+	event_notifier_enabler->num_captures = 0;
 
-	memcpy(&event_notifier_enabler->base.event_param.name, event_notifier_param->event.name,
-		sizeof(event_notifier_enabler->base.event_param.name));
-	event_notifier_enabler->base.event_param.instrumentation = event_notifier_param->event.instrumentation;
+	memcpy(&event_notifier_enabler->base.event_param, &event_notifier_param->event,
+		sizeof(event_notifier_enabler->base.event_param));
 	event_notifier_enabler->base.evtype = LTTNG_TYPE_ENABLER;
 
 	event_notifier_enabler->base.enabled = 0;
@@ -1994,6 +2341,7 @@ struct lttng_event_notifier_enabler *lttng_event_notifier_enabler_create(
 
 	mutex_lock(&sessions_mutex);
 	list_add(&event_notifier_enabler->node, &event_notifier_enabler->group->enablers_head);
+	lttng_event_notifier_group_sync_enablers(event_notifier_enabler->group);
 
 	mutex_unlock(&sessions_mutex);
 
@@ -2005,6 +2353,7 @@ int lttng_event_notifier_enabler_enable(
 {
 	mutex_lock(&sessions_mutex);
 	lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)->enabled = 1;
+	lttng_event_notifier_group_sync_enablers(event_notifier_enabler->group);
 	mutex_unlock(&sessions_mutex);
 	return 0;
 }
@@ -2014,28 +2363,85 @@ int lttng_event_notifier_enabler_disable(
 {
 	mutex_lock(&sessions_mutex);
 	lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)->enabled = 0;
+	lttng_event_notifier_group_sync_enablers(event_notifier_enabler->group);
 	mutex_unlock(&sessions_mutex);
 	return 0;
 }
 
-int lttng_event_notifier_enabler_attach_bytecode(
+int lttng_event_notifier_enabler_attach_filter_bytecode(
 		struct lttng_event_notifier_enabler *event_notifier_enabler,
 		struct lttng_kernel_filter_bytecode __user *bytecode)
 {
 	int ret;
 
-	ret = lttng_enabler_attach_bytecode(
+	ret = lttng_enabler_attach_filter_bytecode(
 		lttng_event_notifier_enabler_as_enabler(event_notifier_enabler),
 		bytecode);
 	if (ret)
 		goto error;
 
+	lttng_event_notifier_group_sync_enablers(event_notifier_enabler->group);
 	return 0;
 
 error:
 	return ret;
 }
 
+int lttng_event_notifier_enabler_attach_capture_bytecode(
+		struct lttng_event_notifier_enabler *event_notifier_enabler,
+		struct lttng_kernel_capture_bytecode __user *bytecode)
+{
+	struct lttng_bytecode_node *bytecode_node;
+	struct lttng_enabler *enabler =
+			lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
+	uint32_t bytecode_len;
+	int ret;
+
+	ret = get_user(bytecode_len, &bytecode->len);
+	if (ret)
+		return ret;
+
+	bytecode_node = lttng_kvzalloc(sizeof(*bytecode_node) + bytecode_len,
+			GFP_KERNEL);
+	if (!bytecode_node)
+		return -ENOMEM;
+
+	ret = copy_from_user(&bytecode_node->bc, bytecode,
+		sizeof(*bytecode) + bytecode_len);
+	if (ret)
+		goto error_free;
+
+	bytecode_node->type = LTTNG_BYTECODE_NODE_TYPE_CAPTURE;
+	bytecode_node->enabler = enabler;
+
+	/* Enforce length based on allocated size */
+	bytecode_node->bc.len = bytecode_len;
+	list_add_tail(&bytecode_node->node, &event_notifier_enabler->capture_bytecode_head);
+
+	event_notifier_enabler->num_captures++;
+
+	lttng_event_notifier_group_sync_enablers(event_notifier_enabler->group);
+	goto end;
+
+error_free:
+	lttng_kvfree(bytecode_node);
+end:
+	return ret;
+}
+
+int lttng_event_notifier_add_callsite(struct lttng_event_notifier *event_notifier,
+		struct lttng_kernel_event_callsite __user *callsite)
+{
+
+	switch (event_notifier->instrumentation) {
+	case LTTNG_KERNEL_UPROBE:
+		return lttng_uprobes_event_notifier_add_callsite(event_notifier,
+				callsite);
+	default:
+		return -EINVAL;
+	}
+}
+
 int lttng_event_notifier_enabler_attach_context(
 		struct lttng_event_notifier_enabler *event_notifier_enabler,
 		struct lttng_kernel_context *context_param)
@@ -2128,8 +2534,8 @@ void lttng_session_sync_event_enablers(struct lttng_session *session)
 
 		/* Enable filters */
 		list_for_each_entry(runtime,
-				&event->bytecode_runtime_head, node)
-			lttng_filter_sync_state(runtime);
+				&event->filter_bytecode_runtime_head, node)
+			lttng_bytecode_filter_sync_state(runtime);
 	}
 }
 
@@ -2149,6 +2555,78 @@ void lttng_session_lazy_sync_event_enablers(struct lttng_session *session)
 	lttng_session_sync_event_enablers(session);
 }
 
+static
+void lttng_event_notifier_group_sync_enablers(struct lttng_event_notifier_group *event_notifier_group)
+{
+	struct lttng_event_notifier_enabler *event_notifier_enabler;
+	struct lttng_event_notifier *event_notifier;
+
+	list_for_each_entry(event_notifier_enabler, &event_notifier_group->enablers_head, node)
+		lttng_event_notifier_enabler_ref_event_notifiers(event_notifier_enabler);
+
+	/*
+	 * For each event_notifier, if at least one of its enablers is enabled,
+	 * we enable the event_notifier, else we disable it.
+	 */
+	list_for_each_entry(event_notifier, &event_notifier_group->event_notifiers_head, list) {
+		struct lttng_enabler_ref *enabler_ref;
+		struct lttng_bytecode_runtime *runtime;
+		int enabled = 0, has_enablers_without_bytecode = 0;
+
+		switch (event_notifier->instrumentation) {
+		case LTTNG_KERNEL_TRACEPOINT:
+		case LTTNG_KERNEL_SYSCALL:
+			/* Enable event_notifiers */
+			list_for_each_entry(enabler_ref,
+					&event_notifier->enablers_ref_head, node) {
+				if (enabler_ref->ref->enabled) {
+					enabled = 1;
+					break;
+				}
+			}
+			break;
+		default:
+			/* Not handled with sync. */
+			continue;
+		}
+
+		WRITE_ONCE(event_notifier->enabled, enabled);
+		/*
+		 * Sync tracepoint registration with event_notifier enabled
+		 * state.
+		 */
+		if (enabled) {
+			if (!event_notifier->registered)
+				register_event_notifier(event_notifier);
+		} else {
+			if (event_notifier->registered)
+				_lttng_event_notifier_unregister(event_notifier);
+		}
+
+		/* Check if has enablers without bytecode enabled */
+		list_for_each_entry(enabler_ref,
+				&event_notifier->enablers_ref_head, node) {
+			if (enabler_ref->ref->enabled
+					&& list_empty(&enabler_ref->ref->filter_bytecode_head)) {
+				has_enablers_without_bytecode = 1;
+				break;
+			}
+		}
+		event_notifier->has_enablers_without_bytecode =
+			has_enablers_without_bytecode;
+
+		/* Enable filters */
+		list_for_each_entry(runtime,
+				&event_notifier->filter_bytecode_runtime_head, node)
+			lttng_bytecode_filter_sync_state(runtime);
+
+		/* Enable captures */
+		list_for_each_entry(runtime,
+				&event_notifier->capture_bytecode_runtime_head, node)
+			lttng_bytecode_capture_sync_state(runtime);
+	}
+}
+
 /*
  * Serialize at most one packet worth of metadata into a metadata
  * channel.