X-Git-Url: https://git.lttng.org/?a=blobdiff_plain;f=src%2Flttng-syscalls.c;h=de4dbacefc5c23e7331081696585e4a278b82a7c;hb=873a97436b75e272560fc164813971c8b5461eaa;hp=fdc8524de6ef9bb0634f6ddfeedccb19d49ef9f4;hpb=0bb716a83d94370708a034f44dfbed4527eecfbe;p=lttng-modules.git

diff --git a/src/lttng-syscalls.c b/src/lttng-syscalls.c
index fdc8524d..de4dbace 100644
--- a/src/lttng-syscalls.c
+++ b/src/lttng-syscalls.c
@@ -132,6 +132,9 @@ struct lttng_syscall_filter {
 	DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
 };
 
+static
+int lttng_syscalls_create_matching_event_notifiers(struct lttng_event_enabler_common *event_enabler);
+
 static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
 	struct pt_regs *regs, long id)
 {
@@ -488,8 +491,8 @@ struct lttng_kernel_syscall_table *get_syscall_table_from_enabler(struct lttng_e
 	switch (event_enabler->enabler_type) {
 	case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
 	{
-		struct lttng_event_enabler *event_recorder_enabler =
-			container_of(event_enabler, struct lttng_event_enabler, parent);
+		struct lttng_event_recorder_enabler *event_recorder_enabler =
+			container_of(event_enabler, struct lttng_event_recorder_enabler, parent);
 		return &event_recorder_enabler->chan->priv->parent.syscall_table;
 	}
 	case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
@@ -530,21 +533,20 @@ struct lttng_kernel_syscall_table *get_syscall_table_from_event(struct lttng_ker
  */
 static
 int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *table, size_t table_len,
-	struct hlist_head *chan_table, struct lttng_event_enabler *syscall_event_enabler,
+	struct hlist_head *chan_table, struct lttng_event_recorder_enabler *syscall_event_enabler,
 	enum sc_type type)
 {
-	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(&syscall_event_enabler->parent);
+	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(&syscall_event_enabler->parent);
 	struct lttng_kernel_channel_buffer *chan = syscall_event_enabler->chan;
-	struct lttng_kernel_session *session = chan->parent.session;
 	unsigned int i;
 
 	/* Allocate events for each syscall matching enabler, insert into table */
 	for (i = 0; i < table_len; i++) {
 		const struct lttng_kernel_event_desc *desc = table[i].desc;
-		struct lttng_event_enabler *event_enabler;
+		struct lttng_event_recorder_enabler *event_enabler;
 		struct lttng_kernel_abi_event ev;
-		struct lttng_kernel_event_recorder_private *event_recorder_priv;
-		struct lttng_kernel_event_recorder *event_recorder;
+		struct lttng_kernel_event_common *event;
+		struct lttng_kernel_event_common_private *event_priv;
 		struct hlist_head *head;
 		bool found = false;
 
@@ -552,18 +554,15 @@ int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *tabl
 			/* Unknown syscall */
 			continue;
 		}
-		if (lttng_desc_match_enabler(desc,
-				lttng_event_enabler_as_enabler(syscall_event_enabler)) <= 0)
+		if (!lttng_desc_match_enabler(desc,
+				lttng_event_recorder_enabler_as_enabler(syscall_event_enabler)))
 			continue;
 		/*
 		 * Check if already created.
 		 */
-		head = utils_borrow_hash_table_bucket(
-			session->priv->events_ht.table, LTTNG_EVENT_HT_SIZE,
-			desc->event_name);
-		lttng_hlist_for_each_entry(event_recorder_priv, head, hlist) {
-			if (event_recorder_priv->parent.desc == desc
-				&& get_syscall_table_from_event(event_recorder_priv->parent.pub) == syscall_table)
+		head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
+		lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
+			if (lttng_event_enabler_desc_match_event(&syscall_event_enabler->parent, desc, event_priv->pub))
 				found = true;
 		}
 		if (found)
@@ -592,72 +591,46 @@ int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *tabl
 		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1);
 		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-		event_enabler = lttng_event_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
+		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
 		if (!event_enabler) {
 			return -ENOMEM;
 		}
-		event_recorder = _lttng_kernel_event_recorder_create(event_enabler, desc);
-		WARN_ON_ONCE(!event_recorder);
-		lttng_event_enabler_destroy(event_enabler);
-		if (IS_ERR(event_recorder)) {
+		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
+		WARN_ON_ONCE(!event);
+		lttng_event_enabler_destroy(&event_enabler->parent);
+		if (IS_ERR(event)) {
 			/*
 			 * If something goes wrong in event registration
 			 * after the first one, we have no choice but to
 			 * leave the previous events in there, until
 			 * deleted by session teardown.
 			 */
-			return PTR_ERR(event_recorder);
+			return PTR_ERR(event);
 		}
-		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan_table[i]);
+		hlist_add_head(&event->priv->u.syscall.node, &chan_table[i]);
 	}
 	return 0;
 }
 
-/*
- * Should be called with sessions lock held.
- */
-int lttng_syscalls_register_event(struct lttng_event_enabler *syscall_event_enabler)
+static
+int lttng_syscalls_populate_events(struct lttng_event_enabler_common *syscall_event_enabler)
 {
-	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(&syscall_event_enabler->parent);
+	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
+	struct lttng_event_recorder_enabler *event_recorder_enabler;
+	struct lttng_kernel_channel_buffer *chan;
 	struct lttng_kernel_abi_event ev;
 	int ret;
 
-	wrapper_vmalloc_sync_mappings();
-
-	if (!syscall_table->syscall_dispatch) {
-		/* create syscall table mapping syscall to events */
-		syscall_table->syscall_dispatch = kzalloc(sizeof(struct hlist_head) * sc_table.len, GFP_KERNEL);
-		if (!syscall_table->syscall_dispatch)
-			return -ENOMEM;
-	}
-	if (!syscall_table->syscall_exit_dispatch) {
-		/* create syscall table mapping syscall to events */
-		syscall_table->syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * sc_exit_table.len, GFP_KERNEL);
-		if (!syscall_table->syscall_exit_dispatch)
-			return -ENOMEM;
-	}
-
-
-#ifdef CONFIG_COMPAT
-	if (!syscall_table->compat_syscall_dispatch) {
-		/* create syscall table mapping compat syscall to events */
-		syscall_table->compat_syscall_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_table.len, GFP_KERNEL);
-		if (!syscall_table->compat_syscall_dispatch)
-			return -ENOMEM;
-	}
+	if (syscall_event_enabler->enabler_type != LTTNG_EVENT_ENABLER_TYPE_RECORDER)
+		return 0;
+	event_recorder_enabler = container_of(syscall_event_enabler, struct lttng_event_recorder_enabler, parent);
+	chan = event_recorder_enabler->chan;
 
-	if (!syscall_table->compat_syscall_exit_dispatch) {
-		/* create syscall table mapping compat syscall to events */
-		syscall_table->compat_syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_exit_table.len, GFP_KERNEL);
-		if (!syscall_table->compat_syscall_exit_dispatch)
-			return -ENOMEM;
-	}
-#endif
 	if (hlist_empty(&syscall_table->unknown_syscall_dispatch)) {
 		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___syscall_entry_unknown;
-		struct lttng_kernel_event_recorder *event_recorder;
-		struct lttng_event_enabler *event_enabler;
+		struct lttng_kernel_event_common *event;
+		struct lttng_event_recorder_enabler *event_enabler;
 
 		memset(&ev, 0, sizeof(ev));
 		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
@@ -665,24 +638,24 @@ int lttng_syscalls_register_event(struct lttng_event_enabler *syscall_event_enab
 		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-		event_enabler = lttng_event_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, syscall_event_enabler->chan);
+		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
 		if (!event_enabler) {
 			return -ENOMEM;
 		}
-		event_recorder = _lttng_kernel_event_recorder_create(event_enabler, desc);
-		lttng_event_enabler_destroy(event_enabler);
-		WARN_ON_ONCE(!event_recorder);
-		if (IS_ERR(event_recorder)) {
-			return PTR_ERR(event_recorder);
+		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
+		lttng_event_enabler_destroy(&event_enabler->parent);
+		WARN_ON_ONCE(!event);
+		if (IS_ERR(event)) {
+			return PTR_ERR(event);
 		}
-		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &syscall_table->unknown_syscall_dispatch);
+		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->unknown_syscall_dispatch);
 	}
 
 	if (hlist_empty(&syscall_table->compat_unknown_syscall_dispatch)) {
 		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___compat_syscall_entry_unknown;
-		struct lttng_kernel_event_recorder *event_recorder;
-		struct lttng_event_enabler *event_enabler;
+		struct lttng_kernel_event_common *event;
+		struct lttng_event_recorder_enabler *event_enabler;
 
 		memset(&ev, 0, sizeof(ev));
 		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
@@ -690,24 +663,24 @@ int lttng_syscalls_register_event(struct lttng_event_enabler *syscall_event_enab
 		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-		event_enabler = lttng_event_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, syscall_event_enabler->chan);
+		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
 		if (!event_enabler) {
 			return -ENOMEM;
 		}
-		event_recorder = _lttng_kernel_event_recorder_create(event_enabler, desc);
-		WARN_ON_ONCE(!event_recorder);
-		lttng_event_enabler_destroy(event_enabler);
-		if (IS_ERR(event_recorder)) {
-			return PTR_ERR(event_recorder);
+		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
+		WARN_ON_ONCE(!event);
+		lttng_event_enabler_destroy(&event_enabler->parent);
+		if (IS_ERR(event)) {
+			return PTR_ERR(event);
 		}
-		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &syscall_table->compat_unknown_syscall_dispatch);
+		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->compat_unknown_syscall_dispatch);
 	}
 
 	if (hlist_empty(&syscall_table->compat_unknown_syscall_exit_dispatch)) {
 		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___compat_syscall_exit_unknown;
-		struct lttng_kernel_event_recorder *event_recorder;
-		struct lttng_event_enabler *event_enabler;
+		struct lttng_kernel_event_common *event;
+		struct lttng_event_recorder_enabler *event_enabler;
 
 		memset(&ev, 0, sizeof(ev));
 		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
@@ -715,24 +688,24 @@ int lttng_syscalls_register_event(struct lttng_event_enabler *syscall_event_enab
 		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-		event_enabler = lttng_event_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, syscall_event_enabler->chan);
+		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
 		if (!event_enabler) {
 			return -ENOMEM;
 		}
-		event_recorder = _lttng_kernel_event_recorder_create(event_enabler, desc);
-		WARN_ON_ONCE(!event_recorder);
-		lttng_event_enabler_destroy(event_enabler);
-		if (IS_ERR(event_recorder)) {
-			return PTR_ERR(event_recorder);
+		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
+		WARN_ON_ONCE(!event);
+		lttng_event_enabler_destroy(&event_enabler->parent);
+		if (IS_ERR(event)) {
+			return PTR_ERR(event);
 		}
-		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &syscall_table->compat_unknown_syscall_exit_dispatch);
+		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->compat_unknown_syscall_exit_dispatch);
 	}
 
 	if (hlist_empty(&syscall_table->unknown_syscall_exit_dispatch)) {
 		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___syscall_exit_unknown;
-		struct lttng_kernel_event_recorder *event_recorder;
-		struct lttng_event_enabler *event_enabler;
+		struct lttng_kernel_event_common *event;
+		struct lttng_event_recorder_enabler *event_enabler;
 
 		memset(&ev, 0, sizeof(ev));
 		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
@@ -740,139 +713,78 @@ int lttng_syscalls_register_event(struct lttng_event_enabler *syscall_event_enab
 		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-		event_enabler = lttng_event_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, syscall_event_enabler->chan);
+		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
 		if (!event_enabler) {
 			return -ENOMEM;
 		}
-		event_recorder = _lttng_kernel_event_recorder_create(event_enabler, desc);
-		WARN_ON_ONCE(!event_recorder);
-		lttng_event_enabler_destroy(event_enabler);
-		if (IS_ERR(event_recorder)) {
-			return PTR_ERR(event_recorder);
+		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
+		WARN_ON_ONCE(!event);
+		lttng_event_enabler_destroy(&event_enabler->parent);
+		if (IS_ERR(event)) {
+			return PTR_ERR(event);
 		}
-		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &syscall_table->unknown_syscall_exit_dispatch);
+		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->unknown_syscall_exit_dispatch);
 	}
 
 	ret = lttng_create_syscall_event_if_missing(sc_table.table, sc_table.len,
-			syscall_table->syscall_dispatch, syscall_event_enabler, SC_TYPE_ENTRY);
+			syscall_table->syscall_dispatch, event_recorder_enabler, SC_TYPE_ENTRY);
 	if (ret)
 		return ret;
 	ret = lttng_create_syscall_event_if_missing(sc_exit_table.table, sc_exit_table.len,
-			syscall_table->syscall_exit_dispatch, syscall_event_enabler, SC_TYPE_EXIT);
+			syscall_table->syscall_exit_dispatch, event_recorder_enabler, SC_TYPE_EXIT);
 	if (ret)
 		return ret;
 
 #ifdef CONFIG_COMPAT
 	ret = lttng_create_syscall_event_if_missing(compat_sc_table.table, compat_sc_table.len,
-			syscall_table->compat_syscall_dispatch, syscall_event_enabler, SC_TYPE_COMPAT_ENTRY);
+			syscall_table->compat_syscall_dispatch, event_recorder_enabler, SC_TYPE_COMPAT_ENTRY);
 	if (ret)
 		return ret;
 	ret = lttng_create_syscall_event_if_missing(compat_sc_exit_table.table, compat_sc_exit_table.len,
-			syscall_table->compat_syscall_exit_dispatch, syscall_event_enabler, SC_TYPE_COMPAT_EXIT);
+			syscall_table->compat_syscall_exit_dispatch, event_recorder_enabler, SC_TYPE_COMPAT_EXIT);
 	if (ret)
 		return ret;
 #endif
-
-	if (!syscall_table->sc_filter) {
-		syscall_table->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
-				GFP_KERNEL);
-		if (!syscall_table->sc_filter)
-			return -ENOMEM;
-	}
-
-	if (!syscall_table->sys_enter_registered) {
-		ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
-				(void *) syscall_entry_event_probe, syscall_table);
-		if (ret)
-			return ret;
-		syscall_table->sys_enter_registered = 1;
-	}
-	/*
-	 * We change the name of sys_exit tracepoint due to namespace
-	 * conflict with sys_exit syscall entry.
-	 */
-	if (!syscall_table->sys_exit_registered) {
-		ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
-				(void *) syscall_exit_event_probe, syscall_table);
-		if (ret) {
-			WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-				(void *) syscall_entry_event_probe, syscall_table));
-			return ret;
-		}
-		syscall_table->sys_exit_registered = 1;
-	}
 	return ret;
 }
 
 /*
  * Should be called with sessions lock held.
  */
-int lttng_syscalls_register_event_notifier(
-		struct lttng_event_notifier_enabler *event_notifier_enabler)
+int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enabler_common *syscall_event_enabler)
 {
-	struct lttng_event_notifier_group *group = event_notifier_enabler->group;
-	struct lttng_kernel_syscall_table *syscall_table = &group->syscall_table;
-	unsigned int i;
-	int ret = 0;
-
-	wrapper_vmalloc_sync_mappings();
+	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
+	int ret;
 
 	if (!syscall_table->syscall_dispatch) {
+		/* create syscall table mapping syscall to events */
 		syscall_table->syscall_dispatch = kzalloc(sizeof(struct hlist_head) * sc_table.len, GFP_KERNEL);
 		if (!syscall_table->syscall_dispatch)
 			return -ENOMEM;
-
-		/* Initialize all list_head */
-		for (i = 0; i < sc_table.len; i++)
-			INIT_HLIST_HEAD(&syscall_table->syscall_dispatch[i]);
-
-		/* Init the unknown syscall notifier list. */
-		INIT_HLIST_HEAD(&syscall_table->unknown_syscall_dispatch);
 	}
-
 	if (!syscall_table->syscall_exit_dispatch) {
-		syscall_table->syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * sc_table.len, GFP_KERNEL);
+		/* create syscall table mapping syscall to events */
+		syscall_table->syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * sc_exit_table.len, GFP_KERNEL);
 		if (!syscall_table->syscall_exit_dispatch)
 			return -ENOMEM;
-
-		/* Initialize all list_head */
-		for (i = 0; i < sc_table.len; i++)
-			INIT_HLIST_HEAD(&syscall_table->syscall_exit_dispatch[i]);
-
-		/* Init the unknown exit syscall notifier list. */
-		INIT_HLIST_HEAD(&syscall_table->unknown_syscall_exit_dispatch);
 	}
 
+
 #ifdef CONFIG_COMPAT
 	if (!syscall_table->compat_syscall_dispatch) {
+		/* create syscall table mapping compat syscall to events */
 		syscall_table->compat_syscall_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_table.len, GFP_KERNEL);
 		if (!syscall_table->compat_syscall_dispatch)
 			return -ENOMEM;
-
-		/* Initialize all list_head */
-		for (i = 0; i < compat_sc_table.len; i++)
-			INIT_HLIST_HEAD(&syscall_table->compat_syscall_dispatch[i]);
-
-		/* Init the unknown syscall notifier list. */
-		INIT_HLIST_HEAD(&syscall_table->compat_unknown_syscall_dispatch);
 	}
 
 	if (!syscall_table->compat_syscall_exit_dispatch) {
-		syscall_table->compat_syscall_exit_dispatch =
-				kzalloc(sizeof(struct hlist_head) * compat_sc_exit_table.len,
-					GFP_KERNEL);
+		/* create syscall table mapping compat syscall to events */
+		syscall_table->compat_syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_exit_table.len, GFP_KERNEL);
 		if (!syscall_table->compat_syscall_exit_dispatch)
 			return -ENOMEM;
-
-		/* Initialize all list_head */
-		for (i = 0; i < compat_sc_exit_table.len; i++)
-			INIT_HLIST_HEAD(&syscall_table->compat_syscall_exit_dispatch[i]);
-
-		/* Init the unknown exit syscall notifier list. */
-		INIT_HLIST_HEAD(&syscall_table->compat_unknown_syscall_exit_dispatch);
 	}
 #endif
-
 	if (!syscall_table->sc_filter) {
 		syscall_table->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
 				GFP_KERNEL);
@@ -880,6 +792,10 @@ int lttng_syscalls_register_event_notifier(
 			return -ENOMEM;
 	}
 
+	ret = lttng_syscalls_populate_events(syscall_event_enabler);
+	if (ret)
+		return ret;
+
 	if (!syscall_table->sys_enter_registered) {
 		ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
 				(void *) syscall_entry_event_probe, syscall_table);
@@ -887,7 +803,6 @@ int lttng_syscalls_register_event_notifier(
 			return ret;
 		syscall_table->sys_enter_registered = 1;
 	}
-
 	if (!syscall_table->sys_exit_registered) {
 		ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
 				(void *) syscall_exit_event_probe, syscall_table);
@@ -899,6 +814,10 @@ int lttng_syscalls_register_event_notifier(
 		syscall_table->sys_exit_registered = 1;
 	}
 
+	ret = lttng_syscalls_create_matching_event_notifiers(syscall_event_enabler);
+	if (ret)
+		return ret;
+
 	return ret;
 }
 
@@ -907,8 +826,9 @@ int create_unknown_event_notifier(
 		struct lttng_event_notifier_enabler *event_notifier_enabler,
 		enum sc_type type)
 {
-	struct lttng_kernel_event_notifier_private *event_notifier_priv;
-	struct lttng_kernel_event_notifier *event_notifier;
+	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(&event_notifier_enabler->parent);
+	struct lttng_kernel_event_common_private *event_priv;
+	struct lttng_kernel_event_common *event;
 	const struct lttng_kernel_event_desc *desc;
 	struct lttng_event_notifier_group *group = event_notifier_enabler->group;
 	struct lttng_kernel_syscall_table *syscall_table = &group->syscall_table;
@@ -956,11 +876,9 @@ int create_unknown_event_notifier(
 	/*
 	 * Check if already created.
 	 */
-	head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
-		LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
-	lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
-		if (event_notifier_priv->parent.desc == desc &&
-				event_notifier_priv->parent.user_token == base_enabler->user_token)
+	head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
+	lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
+		if (lttng_event_enabler_desc_match_event(base_enabler, desc, event_priv->pub))
 			found = true;
 	}
 	if (found)
@@ -973,41 +891,47 @@ int create_unknown_event_notifier(
 	event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 
 	event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+	event_notifier_param.event.token = user_token;
 	event_notifier_param.event.u.syscall.abi = abi;
 	event_notifier_param.event.u.syscall.entryexit = entryexit;
-
-	event_notifier = _lttng_event_notifier_create(desc, user_token,
-		error_counter_index, group, &event_notifier_param,
-		event_notifier_param.event.instrumentation);
-	if (IS_ERR(event_notifier)) {
+	event_notifier_param.error_counter_index = error_counter_index;
+
+	event_notifier_enabler = lttng_event_notifier_enabler_create(LTTNG_ENABLER_FORMAT_NAME,
+			&event_notifier_param, group);
+	WARN_ON_ONCE(!event_notifier_enabler);
+	event = _lttng_kernel_event_create(&event_notifier_enabler->parent, desc);
+	lttng_event_enabler_destroy(&event_notifier_enabler->parent);
+	if (IS_ERR(event)) {
 		printk(KERN_INFO "Unable to create unknown notifier %s\n",
 			desc->event_name);
 		ret = -ENOMEM;
 		goto end;
 	}
 
-	hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, unknown_dispatch_list);
+	hlist_add_head_rcu(&event->priv->u.syscall.node, unknown_dispatch_list);
 
 end:
 	return ret;
 }
 
 static int create_matching_event_notifiers(
-		struct lttng_event_notifier_enabler *event_notifier_enabler,
+		struct lttng_event_notifier_enabler *syscall_event_notifier_enabler,
 		const struct trace_syscall_entry *table,
 		size_t table_len, enum sc_type type)
 {
-	struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(&syscall_event_notifier_enabler->parent);
+	struct lttng_event_notifier_group *group = syscall_event_notifier_enabler->group;
 	const struct lttng_kernel_event_desc *desc;
-	uint64_t user_token = event_notifier_enabler->parent.user_token;
-	uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
+	uint64_t user_token = syscall_event_notifier_enabler->parent.user_token;
+	uint64_t error_counter_index = syscall_event_notifier_enabler->error_counter_index;
 	unsigned int i;
 	int ret = 0;
 
 	/* iterate over all syscall and create event_notifier that match */
 	for (i = 0; i < table_len; i++) {
-		struct lttng_kernel_event_notifier_private *event_notifier_priv;
-		struct lttng_kernel_event_notifier *event_notifier;
+		struct lttng_event_notifier_enabler *event_notifier_enabler;
+		struct lttng_kernel_event_common_private *event_priv;
+		struct lttng_kernel_event_common *event;
 		struct lttng_kernel_abi_event_notifier event_notifier_param;
 		struct hlist_head *head;
 		int found = 0;
@@ -1019,17 +943,15 @@ static int create_matching_event_notifiers(
 		}
 
 		if (!lttng_desc_match_enabler(desc,
-				lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)))
+				lttng_event_notifier_enabler_as_enabler(syscall_event_notifier_enabler)))
 			continue;
 
 		/*
 		 * Check if already created.
 		 */
-		head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
-			LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
-		lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
-			if (event_notifier_priv->parent.desc == desc
-				&& event_notifier_priv->parent.user_token == event_notifier_enabler->parent.user_token)
+		head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
+		lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
+			if (lttng_event_enabler_desc_match_event(&syscall_event_notifier_enabler->parent, desc, event_priv->pub))
 				found = 1;
 		}
 		if (found)
@@ -1058,18 +980,22 @@ static int create_matching_event_notifiers(
 			LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
 		event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 		event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-
-		event_notifier = _lttng_event_notifier_create(desc, user_token,
-			error_counter_index, group, &event_notifier_param,
-			event_notifier_param.event.instrumentation);
-		if (IS_ERR(event_notifier)) {
+		event_notifier_param.event.token = user_token;
+		event_notifier_param.error_counter_index = error_counter_index;
+
+		event_notifier_enabler = lttng_event_notifier_enabler_create(LTTNG_ENABLER_FORMAT_NAME,
+				&event_notifier_param, group);
+		WARN_ON_ONCE(!event_notifier_enabler);
+		event = _lttng_kernel_event_create(&event_notifier_enabler->parent, desc);
+		lttng_event_enabler_destroy(&event_notifier_enabler->parent);
+		if (IS_ERR(event)) {
 			printk(KERN_INFO "Unable to create event_notifier %s\n",
 				desc->event_name);
 			ret = -ENOMEM;
 			goto end;
 		}
 
-		event_notifier->priv->parent.u.syscall.syscall_id = i;
+		event->priv->u.syscall.syscall_id = i;
 	}
 
 end:
@@ -1077,14 +1003,17 @@ end:
 
 }
 
-int lttng_syscalls_create_matching_event_notifiers(
-		struct lttng_event_notifier_enabler *event_notifier_enabler)
+static
+int lttng_syscalls_create_matching_event_notifiers(struct lttng_event_enabler_common *event_enabler)
 {
 	int ret;
-	struct lttng_event_enabler_common *base_enabler =
-			lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
 	enum lttng_kernel_abi_syscall_entryexit entryexit =
-			base_enabler->event_param.u.syscall.entryexit;
+			event_enabler->event_param.u.syscall.entryexit;
+	struct lttng_event_notifier_enabler *event_notifier_enabler;
+
+	if (event_enabler->enabler_type != LTTNG_EVENT_ENABLER_TYPE_NOTIFIER)
+		return 0;
+	event_notifier_enabler = container_of(event_enabler, struct lttng_event_notifier_enabler, parent);
 
 	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
 		ret = create_matching_event_notifiers(event_notifier_enabler,
@@ -1137,47 +1066,8 @@ end:
 	return ret;
 }
 
-/*
- * Unregister the syscall event_notifier probes from the callsites.
- */
-int lttng_syscalls_unregister_event_notifier_group(
-		struct lttng_event_notifier_group *event_notifier_group)
-{
-	struct lttng_kernel_syscall_table *syscall_table = &event_notifier_group->syscall_table;
-	int ret;
-
-	/*
-	 * Only register the event_notifier probe on the `sys_enter` callsite for now.
-	 * At the moment, we don't think it's desirable to have one fired
-	 * event_notifier for the entry and one for the exit of a syscall.
-	 */
-	if (syscall_table->sys_enter_registered) {
-		ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-				(void *) syscall_entry_event_probe, syscall_table);
-		if (ret)
-			return ret;
-		syscall_table->sys_enter_registered = 0;
-	}
-	if (syscall_table->sys_exit_registered) {
-		ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
-				(void *) syscall_exit_event_probe, syscall_table);
-		if (ret)
-			return ret;
-		syscall_table->sys_enter_registered = 0;
-	}
-
-	kfree(syscall_table->syscall_dispatch);
-	kfree(syscall_table->syscall_exit_dispatch);
-#ifdef CONFIG_COMPAT
-	kfree(syscall_table->compat_syscall_dispatch);
-	kfree(syscall_table->compat_syscall_exit_dispatch);
-#endif
-	return 0;
-}
-
-int lttng_syscalls_unregister_channel(struct lttng_kernel_channel_buffer *chan)
+int lttng_syscalls_unregister_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 {
-	struct lttng_kernel_syscall_table *syscall_table = &chan->priv->parent.syscall_table;
 	int ret;
 
 	if (!syscall_table->syscall_dispatch)
@@ -1199,10 +1089,8 @@ int lttng_syscalls_unregister_channel(struct lttng_kernel_channel_buffer *chan)
 	return 0;
 }
 
-int lttng_syscalls_destroy_event(struct lttng_kernel_channel_buffer *chan)
+int lttng_syscalls_destroy_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 {
-	struct lttng_kernel_syscall_table *syscall_table = &chan->priv->parent.syscall_table;
-
 	kfree(syscall_table->syscall_dispatch);
 	kfree(syscall_table->syscall_exit_dispatch);
 #ifdef CONFIG_COMPAT
@@ -1358,80 +1246,72 @@ int lttng_syscall_filter_enable(
 	return 0;
 }
 
-int lttng_syscall_filter_enable_event_notifier(
-		struct lttng_kernel_event_notifier *event_notifier)
+int lttng_syscall_filter_enable_event(struct lttng_kernel_event_common *event)
 {
-	struct lttng_event_notifier_group *group = event_notifier->priv->group;
-	struct lttng_kernel_syscall_table *syscall_table = &group->syscall_table;
-	unsigned int syscall_id = event_notifier->priv->parent.u.syscall.syscall_id;
-	struct hlist_head *dispatch_list;
-	int ret = 0;
+	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
+	int ret;
 
-	WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
+	WARN_ON_ONCE(event->priv->instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
 
 	ret = lttng_syscall_filter_enable(syscall_table->sc_filter,
-		event_notifier->priv->parent.desc->event_name,
-		event_notifier->priv->parent.u.syscall.abi,
-		event_notifier->priv->parent.u.syscall.entryexit);
-	if (ret) {
-		goto end;
-	}
+		event->priv->desc->event_name, event->priv->u.syscall.abi,
+		event->priv->u.syscall.entryexit);
+	if (ret)
+		return ret;
 
-	switch (event_notifier->priv->parent.u.syscall.entryexit) {
-	case LTTNG_SYSCALL_ENTRY:
-		switch (event_notifier->priv->parent.u.syscall.abi) {
-		case LTTNG_SYSCALL_ABI_NATIVE:
-			dispatch_list = &syscall_table->syscall_dispatch[syscall_id];
-			break;
-		case LTTNG_SYSCALL_ABI_COMPAT:
-			dispatch_list = &syscall_table->compat_syscall_dispatch[syscall_id];
-			break;
-		default:
-			ret = -EINVAL;
-			goto end;
-		}
+	switch (event->type) {
+	case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
 		break;
-	case LTTNG_SYSCALL_EXIT:
-		switch (event_notifier->priv->parent.u.syscall.abi) {
-		case LTTNG_SYSCALL_ABI_NATIVE:
-			dispatch_list = &syscall_table->syscall_exit_dispatch[syscall_id];
+	case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
+	{
+		unsigned int syscall_id = event->priv->u.syscall.syscall_id;
+		struct hlist_head *dispatch_list;
+
+		switch (event->priv->u.syscall.entryexit) {
+		case LTTNG_SYSCALL_ENTRY:
+			switch (event->priv->u.syscall.abi) {
+			case LTTNG_SYSCALL_ABI_NATIVE:
+				dispatch_list = &syscall_table->syscall_dispatch[syscall_id];
+				break;
+			case LTTNG_SYSCALL_ABI_COMPAT:
+				dispatch_list = &syscall_table->compat_syscall_dispatch[syscall_id];
+				break;
+			default:
+				ret = -EINVAL;
+				goto end;
+			}
 			break;
-		case LTTNG_SYSCALL_ABI_COMPAT:
-			dispatch_list = &syscall_table->compat_syscall_exit_dispatch[syscall_id];
+		case LTTNG_SYSCALL_EXIT:
+			switch (event->priv->u.syscall.abi) {
+			case LTTNG_SYSCALL_ABI_NATIVE:
+				dispatch_list = &syscall_table->syscall_exit_dispatch[syscall_id];
+				break;
+			case LTTNG_SYSCALL_ABI_COMPAT:
+				dispatch_list = &syscall_table->compat_syscall_exit_dispatch[syscall_id];
+				break;
+			default:
+				ret = -EINVAL;
+				goto end;
+			}
 			break;
 		default:
 			ret = -EINVAL;
 			goto end;
 		}
+
+		hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_list);
 		break;
+	}
 	default:
-		ret = -EINVAL;
-		goto end;
+		WARN_ON_ONCE(1);
+		return -ENOSYS;
 	}
-
-	hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, dispatch_list);
-
 end:
-	return ret ;
-}
-
-int lttng_syscall_filter_enable_event(
-		struct lttng_kernel_channel_buffer *channel,
-		struct lttng_kernel_event_recorder *event_recorder)
-{
-	struct lttng_kernel_syscall_table *syscall_table = &channel->priv->parent.syscall_table;
-
-	WARN_ON_ONCE(event_recorder->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
-
-	return lttng_syscall_filter_enable(syscall_table->sc_filter,
-		event_recorder->priv->parent.desc->event_name,
-		event_recorder->priv->parent.u.syscall.abi,
-		event_recorder->priv->parent.u.syscall.entryexit);
+	return ret;
 }
 
 static
-int lttng_syscall_filter_disable(
-		struct lttng_syscall_filter *filter,
+int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
 		const char *desc_name, enum lttng_syscall_abi abi,
 		enum lttng_syscall_entryexit entryexit)
 {
@@ -1489,35 +1369,53 @@ int lttng_syscall_filter_disable(
 	return 0;
 }
 
-int lttng_syscall_filter_disable_event_notifier(
-		struct lttng_kernel_event_notifier *event_notifier)
+int lttng_syscall_filter_disable_event(struct lttng_kernel_event_common *event)
 {
-	struct lttng_event_notifier_group *group = event_notifier->priv->group;
-	struct lttng_kernel_syscall_table *syscall_table = &group->syscall_table;
+	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
 	int ret;
 
-	WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
-
 	ret = lttng_syscall_filter_disable(syscall_table->sc_filter,
-		event_notifier->priv->parent.desc->event_name,
-		event_notifier->priv->parent.u.syscall.abi,
-		event_notifier->priv->parent.u.syscall.entryexit);
-	WARN_ON_ONCE(ret != 0);
+		event->priv->desc->event_name, event->priv->u.syscall.abi,
+		event->priv->u.syscall.entryexit);
+	if (ret)
+		return ret;
 
-	hlist_del_rcu(&event_notifier->priv->parent.u.syscall.node);
+	switch (event->type) {
+	case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
+		break;
+	case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
+	{
+		hlist_del_rcu(&event->priv->u.syscall.node);
+		break;
+	}
+	default:
+		WARN_ON_ONCE(1);
+		return -ENOSYS;
+	}
 	return 0;
 }
 
-int lttng_syscall_filter_disable_event(
-		struct lttng_kernel_channel_buffer *channel,
-		struct lttng_kernel_event_recorder *event_recorder)
+void lttng_syscall_table_set_wildcard_all(struct lttng_event_enabler_common *event_enabler)
 {
-	struct lttng_kernel_syscall_table *syscall_table = &channel->priv->parent.syscall_table;
+	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(event_enabler);
+	enum lttng_kernel_abi_syscall_entryexit entryexit;
+	int enabled = event_enabler->enabled;
+
+	if (event_enabler->event_param.instrumentation != LTTNG_KERNEL_ABI_SYSCALL)
+		return;
+	if (event_enabler->event_param.u.syscall.abi != LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL)
+		return;
+	if (event_enabler->event_param.u.syscall.match != LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME)
+		return;
+	if (strcmp(event_enabler->event_param.name, "*"))
+		return;
+
+	entryexit = event_enabler->event_param.u.syscall.entryexit;
+	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
+		WRITE_ONCE(syscall_table->syscall_all_entry, enabled);
 
-	return lttng_syscall_filter_disable(syscall_table->sc_filter,
-		event_recorder->priv->parent.desc->event_name,
-		event_recorder->priv->parent.u.syscall.abi,
-		event_recorder->priv->parent.u.syscall.entryexit);
+	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
+		WRITE_ONCE(syscall_table->syscall_all_exit, enabled);
 }
 
 static
@@ -1634,10 +1532,9 @@ const struct file_operations lttng_syscall_list_fops = {
 /*
  * A syscall is enabled if it is traced for either entry or exit.
  */
-long lttng_channel_syscall_mask(struct lttng_kernel_channel_buffer *channel,
+long lttng_syscall_table_get_active_mask(struct lttng_kernel_syscall_table *syscall_table,
 		struct lttng_kernel_abi_syscall_mask __user *usyscall_mask)
 {
-	struct lttng_kernel_syscall_table *syscall_table = &channel->priv->parent.syscall_table;
 	uint32_t len, sc_tables_len, bitmask_len;
 	int ret = 0, bit;
 	char *tmp_mask;