X-Git-Url: https://git.lttng.org/?a=blobdiff_plain;f=src%2Flttng-syscalls.c;h=dfb00cbb7043d58ac780abb8cfc4662405d02aba;hb=e2d5dbc7d09c7aa4f7c391fcdd4dfc95ba1ed326;hp=3139a556822e543fcca852a40d96c968c34062d8;hpb=63aa91609c6b8140e5382ecc0f94dc555b62af7b;p=lttng-modules.git

diff --git a/src/lttng-syscalls.c b/src/lttng-syscalls.c
index 3139a556..dfb00cbb 100644
--- a/src/lttng-syscalls.c
+++ b/src/lttng-syscalls.c
@@ -29,6 +29,7 @@
 #include <wrapper/rcu.h>
 #include <wrapper/syscall.h>
 #include <lttng/events.h>
+#include <lttng/utils.h>
 
 #ifndef CONFIG_COMPAT
 # ifndef is_compat_task
@@ -63,6 +64,13 @@ void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id);
 static
 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret);
 
+static
+void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
+		long id);
+static
+void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
+		long ret);
+
 /*
  * Forward declarations for old kernels.
  */
@@ -83,7 +91,7 @@ struct timeval;
 struct itimerval;
 struct itimerspec;
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,6,0))
+#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(5,6,0))
 typedef __kernel_old_time_t time_t;
 #endif
 
@@ -285,8 +293,8 @@ typedef __kernel_old_time_t time_t;
 
 struct trace_syscall_entry {
 	void *event_func;
-	const struct lttng_event_desc *desc;
-	const struct lttng_event_field *fields;
+	const struct lttng_kernel_event_desc *desc;
+	const struct lttng_kernel_event_field **fields;
 	unsigned int nrargs;
 };
 
@@ -375,28 +383,35 @@ struct lttng_syscall_filter {
 	DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
 };
 
-static void syscall_entry_event_unknown(struct lttng_event *event,
-	struct pt_regs *regs, unsigned int id)
+static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
+	struct pt_regs *regs, long id)
 {
 	unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+	struct lttng_kernel_event_common_private *event_priv;
 
 	lttng_syscall_get_arguments(current, regs, args);
-	if (unlikely(in_compat_syscall()))
-		__event_probe__compat_syscall_entry_unknown(event, id, args);
-	else
-		__event_probe__syscall_entry_unknown(event, id, args);
+	lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
+		if (unlikely(in_compat_syscall()))
+			__event_probe__compat_syscall_entry_unknown(event_priv->pub, id, args);
+		else
+			__event_probe__syscall_entry_unknown(event_priv->pub, id, args);
+	}
 }
 
 static __always_inline
-void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
+void syscall_entry_event_call_func(struct hlist_head *action_list,
+		void *func, unsigned int nrargs,
 		struct pt_regs *regs)
 {
+	struct lttng_kernel_event_common_private *event_priv;
+
 	switch (nrargs) {
 	case 0:
 	{
 		void (*fptr)(void *__data) = func;
 
-		fptr(data);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub);
 		break;
 	}
 	case 1:
@@ -405,7 +420,8 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(data, args[0]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, args[0]);
 		break;
 	}
 	case 2:
@@ -416,7 +432,8 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(data, args[0], args[1]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, args[0], args[1]);
 		break;
 	}
 	case 3:
@@ -428,7 +445,8 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(data, args[0], args[1], args[2]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, args[0], args[1], args[2]);
 		break;
 	}
 	case 4:
@@ -441,7 +459,8 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(data, args[0], args[1], args[2], args[3]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, args[0], args[1], args[2], args[3]);
 		break;
 	}
 	case 5:
@@ -455,7 +474,8 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(data, args[0], args[1], args[2], args[3], args[4]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, args[0], args[1], args[2], args[3], args[4]);
 		break;
 	}
 	case 6:
@@ -470,8 +490,9 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(data, args[0], args[1], args[2],
-			args[3], args[4], args[5]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, args[0], args[1], args[2],
+			     args[3], args[4], args[5]);
 		break;
 	}
 	default:
@@ -482,7 +503,7 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
 {
 	struct lttng_channel *chan = __data;
-	struct lttng_event *event, *unknown_event;
+	struct hlist_head *action_list, *unknown_action_list;
 	const struct trace_syscall_entry *table, *entry;
 	size_t table_len;
 
@@ -490,119 +511,148 @@ void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
 		struct lttng_syscall_filter *filter = chan->sc_filter;
 
 		if (id < 0 || id >= NR_compat_syscalls
-			|| (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_compat_entry))) {
+			|| (!READ_ONCE(chan->syscall_all_entry) && !test_bit(id, filter->sc_compat_entry))) {
 			/* System call filtered out. */
 			return;
 		}
 		table = compat_sc_table;
 		table_len = ARRAY_SIZE(compat_sc_table);
-		unknown_event = chan->sc_compat_unknown;
+		unknown_action_list = &chan->sc_compat_unknown;
 	} else {
 		struct lttng_syscall_filter *filter = chan->sc_filter;
 
 		if (id < 0 || id >= NR_syscalls
-			|| (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_entry))) {
+			|| (!READ_ONCE(chan->syscall_all_entry) && !test_bit(id, filter->sc_entry))) {
 			/* System call filtered out. */
 			return;
 		}
 		table = sc_table;
 		table_len = ARRAY_SIZE(sc_table);
-		unknown_event = chan->sc_unknown;
+		unknown_action_list = &chan->sc_unknown;
 	}
 	if (unlikely(id < 0 || id >= table_len)) {
-		syscall_entry_event_unknown(unknown_event, regs, id);
+		syscall_entry_event_unknown(unknown_action_list, regs, id);
 		return;
 	}
-	if (unlikely(in_compat_syscall()))
-		event = chan->compat_sc_table[id];
-	else
-		event = chan->sc_table[id];
-	if (unlikely(!event)) {
-		syscall_entry_event_unknown(unknown_event, regs, id);
+
+	entry = &table[id];
+	if (!entry->event_func) {
+		syscall_entry_event_unknown(unknown_action_list, regs, id);
 		return;
 	}
-	entry = &table[id];
-	WARN_ON_ONCE(!entry);
-	syscall_entry_call_func(entry->event_func, entry->nrargs, event, regs);
-}
 
-static void syscall_exit_event_unknown(struct lttng_event *event,
-	struct pt_regs *regs, int id, long ret)
-{
-	unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+	if (unlikely(in_compat_syscall())) {
+		action_list = &chan->compat_sc_table[id];
+	} else {
+		action_list = &chan->sc_table[id];
+	}
+	if (unlikely(hlist_empty(action_list)))
+		return;
 
-	lttng_syscall_get_arguments(current, regs, args);
-	if (unlikely(in_compat_syscall()))
-		__event_probe__compat_syscall_exit_unknown(event, id, ret,
-			args);
-	else
-		__event_probe__syscall_exit_unknown(event, id, ret, args);
+	syscall_entry_event_call_func(action_list, entry->event_func, entry->nrargs, regs);
 }
 
-void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
+void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
+		long id)
 {
-	struct lttng_channel *chan = __data;
-	struct lttng_event *event, *unknown_event;
+	struct lttng_event_notifier_group *group = __data;
 	const struct trace_syscall_entry *table, *entry;
+	struct hlist_head *dispatch_list, *unknown_dispatch_list;
 	size_t table_len;
-	long id;
 
-	id = syscall_get_nr(current, regs);
 	if (unlikely(in_compat_syscall())) {
-		struct lttng_syscall_filter *filter = chan->sc_filter;
+		struct lttng_syscall_filter *filter = group->sc_filter;
 
 		if (id < 0 || id >= NR_compat_syscalls
-			|| (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_compat_exit))) {
+			|| (!READ_ONCE(group->syscall_all_entry) &&
+				!test_bit(id, filter->sc_compat_entry))) {
 			/* System call filtered out. */
 			return;
 		}
-		table = compat_sc_exit_table;
-		table_len = ARRAY_SIZE(compat_sc_exit_table);
-		unknown_event = chan->compat_sc_exit_unknown;
+		table = compat_sc_table;
+		table_len = ARRAY_SIZE(compat_sc_table);
+		unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
 	} else {
-		struct lttng_syscall_filter *filter = chan->sc_filter;
+		struct lttng_syscall_filter *filter = group->sc_filter;
 
 		if (id < 0 || id >= NR_syscalls
-			|| (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_exit))) {
+			|| (!READ_ONCE(group->syscall_all_entry) &&
+				!test_bit(id, filter->sc_entry))) {
 			/* System call filtered out. */
 			return;
 		}
-		table = sc_exit_table;
-		table_len = ARRAY_SIZE(sc_exit_table);
-		unknown_event = chan->sc_exit_unknown;
+		table = sc_table;
+		table_len = ARRAY_SIZE(sc_table);
+		unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
 	}
+	/* Check if the syscall id is out of bound. */
 	if (unlikely(id < 0 || id >= table_len)) {
-		syscall_exit_event_unknown(unknown_event, regs, id, ret);
+		syscall_entry_event_unknown(unknown_dispatch_list,
+				regs, id);
 		return;
 	}
-	if (unlikely(in_compat_syscall()))
-		event = chan->compat_sc_exit_table[id];
-	else
-		event = chan->sc_exit_table[id];
-	if (unlikely(!event)) {
-		syscall_exit_event_unknown(unknown_event, regs, id, ret);
+
+	entry = &table[id];
+	if (!entry->event_func) {
+		syscall_entry_event_unknown(unknown_dispatch_list,
+				regs, id);
 		return;
 	}
-	entry = &table[id];
-	WARN_ON_ONCE(!entry);
 
-	switch (entry->nrargs) {
+	if (unlikely(in_compat_syscall())) {
+		dispatch_list = &group->event_notifier_compat_syscall_dispatch[id];
+	} else {
+		dispatch_list = &group->event_notifier_syscall_dispatch[id];
+	}
+	if (unlikely(hlist_empty(dispatch_list)))
+		return;
+
+	syscall_entry_event_call_func(dispatch_list,
+			entry->event_func, entry->nrargs, regs);
+}
+
+static void syscall_exit_event_unknown(struct hlist_head *unknown_action_list_head,
+	struct pt_regs *regs, long id, long ret)
+{
+	unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+	struct lttng_kernel_event_common_private *event_priv;
+
+	lttng_syscall_get_arguments(current, regs, args);
+	lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
+		if (unlikely(in_compat_syscall()))
+			__event_probe__compat_syscall_exit_unknown(event_priv->pub, id, ret,
+				args);
+		else
+			__event_probe__syscall_exit_unknown(event_priv->pub, id, ret, args);
+	}
+}
+
+static __always_inline
+void syscall_exit_event_call_func(struct hlist_head *action_list,
+		void *func, unsigned int nrargs,
+		struct pt_regs *regs, long ret)
+{
+	struct lttng_kernel_event_common_private *event_priv;
+
+	switch (nrargs) {
 	case 0:
 	{
-		void (*fptr)(void *__data, long ret) = entry->event_func;
+		void (*fptr)(void *__data, long ret) = func;
 
-		fptr(event, ret);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret);
 		break;
 	}
 	case 1:
 	{
 		void (*fptr)(void *__data,
 			long ret,
-			unsigned long arg0) = entry->event_func;
+			unsigned long arg0) = func;
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(event, ret, args[0]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret, args[0]);
 		break;
 	}
 	case 2:
@@ -610,11 +660,12 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 		void (*fptr)(void *__data,
 			long ret,
 			unsigned long arg0,
-			unsigned long arg1) = entry->event_func;
+			unsigned long arg1) = func;
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(event, ret, args[0], args[1]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret, args[0], args[1]);
 		break;
 	}
 	case 3:
@@ -623,11 +674,12 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 			long ret,
 			unsigned long arg0,
 			unsigned long arg1,
-			unsigned long arg2) = entry->event_func;
+			unsigned long arg2) = func;
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(event, ret, args[0], args[1], args[2]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret, args[0], args[1], args[2]);
 		break;
 	}
 	case 4:
@@ -637,11 +689,12 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 			unsigned long arg0,
 			unsigned long arg1,
 			unsigned long arg2,
-			unsigned long arg3) = entry->event_func;
+			unsigned long arg3) = func;
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(event, ret, args[0], args[1], args[2], args[3]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3]);
 		break;
 	}
 	case 5:
@@ -652,11 +705,12 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 			unsigned long arg1,
 			unsigned long arg2,
 			unsigned long arg3,
-			unsigned long arg4) = entry->event_func;
+			unsigned long arg4) = func;
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(event, ret, args[0], args[1], args[2], args[3], args[4]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3], args[4]);
 		break;
 	}
 	case 6:
@@ -668,12 +722,13 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 			unsigned long arg2,
 			unsigned long arg3,
 			unsigned long arg4,
-			unsigned long arg5) = entry->event_func;
+			unsigned long arg5) = func;
 		unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
 		lttng_syscall_get_arguments(current, regs, args);
-		fptr(event, ret, args[0], args[1], args[2],
-			args[3], args[4], args[5]);
+		lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+			fptr(event_priv->pub, ret, args[0], args[1], args[2],
+			     args[3], args[4], args[5]);
 		break;
 	}
 	default:
@@ -681,67 +736,202 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 	}
 }
 
+void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
+{
+	struct lttng_channel *chan = __data;
+	struct hlist_head *action_list, *unknown_action_list;
+	const struct trace_syscall_entry *table, *entry;
+	size_t table_len;
+	long id;
+
+	id = syscall_get_nr(current, regs);
+
+	if (unlikely(in_compat_syscall())) {
+		struct lttng_syscall_filter *filter = chan->sc_filter;
+
+		if (id < 0 || id >= NR_compat_syscalls
+			|| (!READ_ONCE(chan->syscall_all_exit) && !test_bit(id, filter->sc_compat_exit))) {
+			/* System call filtered out. */
+			return;
+		}
+		table = compat_sc_exit_table;
+		table_len = ARRAY_SIZE(compat_sc_exit_table);
+		unknown_action_list = &chan->compat_sc_exit_unknown;
+	} else {
+		struct lttng_syscall_filter *filter = chan->sc_filter;
+
+		if (id < 0 || id >= NR_syscalls
+			|| (!READ_ONCE(chan->syscall_all_exit) && !test_bit(id, filter->sc_exit))) {
+			/* System call filtered out. */
+			return;
+		}
+		table = sc_exit_table;
+		table_len = ARRAY_SIZE(sc_exit_table);
+		unknown_action_list = &chan->sc_exit_unknown;
+	}
+	if (unlikely(id < 0 || id >= table_len)) {
+		syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
+		return;
+	}
+
+	entry = &table[id];
+	if (!entry->event_func) {
+		syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
+		return;
+	}
+
+	if (unlikely(in_compat_syscall())) {
+		action_list = &chan->compat_sc_exit_table[id];
+	} else {
+		action_list = &chan->sc_exit_table[id];
+	}
+	if (unlikely(hlist_empty(action_list)))
+		return;
+
+	syscall_exit_event_call_func(action_list, entry->event_func, entry->nrargs,
+			       regs, ret);
+}
+
+static
+void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
+		long ret)
+{
+	struct lttng_event_notifier_group *group = __data;
+	const struct trace_syscall_entry *table, *entry;
+	struct hlist_head *dispatch_list, *unknown_dispatch_list;
+	size_t table_len;
+	long id;
+
+	id = syscall_get_nr(current, regs);
+
+	if (unlikely(in_compat_syscall())) {
+		struct lttng_syscall_filter *filter = group->sc_filter;
+
+		if (id < 0 || id >= NR_compat_syscalls
+			|| (!READ_ONCE(group->syscall_all_exit) &&
+				!test_bit(id, filter->sc_compat_exit))) {
+			/* System call filtered out. */
+			return;
+		}
+		table = compat_sc_exit_table;
+		table_len = ARRAY_SIZE(compat_sc_exit_table);
+		unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
+	} else {
+		struct lttng_syscall_filter *filter = group->sc_filter;
+
+		if (id < 0 || id >= NR_syscalls
+			|| (!READ_ONCE(group->syscall_all_exit) &&
+					!test_bit(id, filter->sc_exit))) {
+			/* System call filtered out. */
+			return;
+		}
+		table = sc_exit_table;
+		table_len = ARRAY_SIZE(sc_exit_table);
+		unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
+	}
+	/* Check if the syscall id is out of bound. */
+	if (unlikely(id < 0 || id >= table_len)) {
+		syscall_exit_event_unknown(unknown_dispatch_list,
+				regs, id, ret);
+		return;
+	}
+
+	entry = &table[id];
+	if (!entry->event_func) {
+		syscall_entry_event_unknown(unknown_dispatch_list,
+				regs, id);
+		return;
+	}
+
+	if (unlikely(in_compat_syscall())) {
+		dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[id];
+	} else {
+		dispatch_list = &group->event_notifier_exit_syscall_dispatch[id];
+	}
+	if (unlikely(hlist_empty(dispatch_list)))
+		return;
+
+	syscall_exit_event_call_func(dispatch_list,
+			entry->event_func, entry->nrargs, regs, ret);
+}
 /*
  * noinline to diminish caller stack size.
  * Should be called with sessions lock held.
  */
 static
-int fill_event_table(const struct trace_syscall_entry *table, size_t table_len,
-	struct lttng_event **chan_table, struct lttng_channel *chan,
-	void *filter, enum sc_type type)
+int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *table, size_t table_len,
+	struct hlist_head *chan_table, struct lttng_event_enabler *event_enabler,
+	enum sc_type type)
 {
-	const struct lttng_event_desc *desc;
+	struct lttng_channel *chan = event_enabler->chan;
+	struct lttng_session *session = chan->session;
 	unsigned int i;
 
-	/* Allocate events for each syscall, insert into table */
+	/* Allocate events for each syscall matching enabler, insert into table */
 	for (i = 0; i < table_len; i++) {
-		struct lttng_kernel_event ev;
-		desc = table[i].desc;
+		const struct lttng_kernel_event_desc *desc = table[i].desc;
+		struct lttng_kernel_abi_event ev;
+		struct lttng_kernel_event_recorder_private *event_recorder_priv;
+		struct lttng_kernel_event_recorder *event_recorder;
+		struct hlist_head *head;
+		bool found = false;
 
 		if (!desc) {
 			/* Unknown syscall */
 			continue;
 		}
+		if (lttng_desc_match_enabler(desc,
+				lttng_event_enabler_as_enabler(event_enabler)) <= 0)
+			continue;
 		/*
-		 * Skip those already populated by previous failed
-		 * register for this channel.
+		 * Check if already created.
 		 */
-		if (chan_table[i])
+		head = utils_borrow_hash_table_bucket(
+			session->events_ht.table, LTTNG_EVENT_HT_SIZE,
+			desc->event_name);
+		lttng_hlist_for_each_entry(event_recorder_priv, head, hlist) {
+			if (event_recorder_priv->parent.desc == desc
+				&& event_recorder_priv->pub->chan == event_enabler->chan)
+				found = true;
+		}
+		if (found)
 			continue;
+
+		/* We need to create an event for this syscall/enabler. */
 		memset(&ev, 0, sizeof(ev));
 		switch (type) {
 		case SC_TYPE_ENTRY:
-			ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-			ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+			ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+			ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 			break;
 		case SC_TYPE_EXIT:
-			ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-			ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+			ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+			ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 			break;
 		case SC_TYPE_COMPAT_ENTRY:
-			ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-			ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+			ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+			ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 			break;
 		case SC_TYPE_COMPAT_EXIT:
-			ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-			ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+			ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+			ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 			break;
 		}
-		strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN - 1);
-		ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-		chan_table[i] = _lttng_event_create(chan, &ev, filter,
-						desc, ev.instrumentation);
-		WARN_ON_ONCE(!chan_table[i]);
-		if (IS_ERR(chan_table[i])) {
+		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1);
+		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+		event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc, ev.instrumentation);
+		WARN_ON_ONCE(!event_recorder);
+		if (IS_ERR(event_recorder)) {
 			/*
 			 * If something goes wrong in event registration
 			 * after the first one, we have no choice but to
 			 * leave the previous events in there, until
 			 * deleted by session teardown.
 			 */
-			return PTR_ERR(chan_table[i]);
+			return PTR_ERR(event_recorder);
 		}
+		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan_table[i]);
 	}
 	return 0;
 }
@@ -749,23 +939,24 @@ int fill_event_table(const struct trace_syscall_entry *table, size_t table_len,
 /*
  * Should be called with sessions lock held.
  */
-int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
+int lttng_syscalls_register_event(struct lttng_event_enabler *event_enabler)
 {
-	struct lttng_kernel_event ev;
+	struct lttng_channel *chan = event_enabler->chan;
+	struct lttng_kernel_abi_event ev;
 	int ret;
 
 	wrapper_vmalloc_sync_mappings();
 
 	if (!chan->sc_table) {
 		/* create syscall table mapping syscall to events */
-		chan->sc_table = kzalloc(sizeof(struct lttng_event *)
+		chan->sc_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
 					* ARRAY_SIZE(sc_table), GFP_KERNEL);
 		if (!chan->sc_table)
 			return -ENOMEM;
 	}
 	if (!chan->sc_exit_table) {
 		/* create syscall table mapping syscall to events */
-		chan->sc_exit_table = kzalloc(sizeof(struct lttng_event *)
+		chan->sc_exit_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
 					* ARRAY_SIZE(sc_exit_table), GFP_KERNEL);
 		if (!chan->sc_exit_table)
 			return -ENOMEM;
@@ -775,7 +966,7 @@ int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
 #ifdef CONFIG_COMPAT
 	if (!chan->compat_sc_table) {
 		/* create syscall table mapping compat syscall to events */
-		chan->compat_sc_table = kzalloc(sizeof(struct lttng_event *)
+		chan->compat_sc_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
 					* ARRAY_SIZE(compat_sc_table), GFP_KERNEL);
 		if (!chan->compat_sc_table)
 			return -ENOMEM;
@@ -783,105 +974,108 @@ int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
 
 	if (!chan->compat_sc_exit_table) {
 		/* create syscall table mapping compat syscall to events */
-		chan->compat_sc_exit_table = kzalloc(sizeof(struct lttng_event *)
+		chan->compat_sc_exit_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
 					* ARRAY_SIZE(compat_sc_exit_table), GFP_KERNEL);
 		if (!chan->compat_sc_exit_table)
 			return -ENOMEM;
 	}
 #endif
-	if (!chan->sc_unknown) {
-		const struct lttng_event_desc *desc =
+	if (hlist_empty(&chan->sc_unknown)) {
+		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___syscall_entry_unknown;
+		struct lttng_kernel_event_recorder *event_recorder;
 
 		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-		ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
-		chan->sc_unknown = _lttng_event_create(chan, &ev, filter,
-						desc,
-						ev.instrumentation);
-		WARN_ON_ONCE(!chan->sc_unknown);
-		if (IS_ERR(chan->sc_unknown)) {
-			return PTR_ERR(chan->sc_unknown);
+		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+		event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+					    ev.instrumentation);
+		WARN_ON_ONCE(!event_recorder);
+		if (IS_ERR(event_recorder)) {
+			return PTR_ERR(event_recorder);
 		}
+		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_unknown);
 	}
 
-	if (!chan->sc_compat_unknown) {
-		const struct lttng_event_desc *desc =
+	if (hlist_empty(&chan->sc_compat_unknown)) {
+		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___compat_syscall_entry_unknown;
+		struct lttng_kernel_event_recorder *event_recorder;
 
 		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-		ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
-		chan->sc_compat_unknown = _lttng_event_create(chan, &ev, filter,
-						desc,
-						ev.instrumentation);
-		WARN_ON_ONCE(!chan->sc_unknown);
-		if (IS_ERR(chan->sc_compat_unknown)) {
-			return PTR_ERR(chan->sc_compat_unknown);
+		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+		event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+					    ev.instrumentation);
+		WARN_ON_ONCE(!event_recorder);
+		if (IS_ERR(event_recorder)) {
+			return PTR_ERR(event_recorder);
 		}
+		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_compat_unknown);
 	}
 
-	if (!chan->compat_sc_exit_unknown) {
-		const struct lttng_event_desc *desc =
+	if (hlist_empty(&chan->compat_sc_exit_unknown)) {
+		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___compat_syscall_exit_unknown;
+		struct lttng_kernel_event_recorder *event_recorder;
 
 		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-		ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
-		chan->compat_sc_exit_unknown = _lttng_event_create(chan, &ev,
-						filter, desc,
-						ev.instrumentation);
-		WARN_ON_ONCE(!chan->compat_sc_exit_unknown);
-		if (IS_ERR(chan->compat_sc_exit_unknown)) {
-			return PTR_ERR(chan->compat_sc_exit_unknown);
+		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+		event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+					    ev.instrumentation);
+		WARN_ON_ONCE(!event_recorder);
+		if (IS_ERR(event_recorder)) {
+			return PTR_ERR(event_recorder);
 		}
+		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->compat_sc_exit_unknown);
 	}
 
-	if (!chan->sc_exit_unknown) {
-		const struct lttng_event_desc *desc =
+	if (hlist_empty(&chan->sc_exit_unknown)) {
+		const struct lttng_kernel_event_desc *desc =
 			&__event_desc___syscall_exit_unknown;
+		struct lttng_kernel_event_recorder *event_recorder;
 
 		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-		ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
-		chan->sc_exit_unknown = _lttng_event_create(chan, &ev, filter,
-						desc, ev.instrumentation);
-		WARN_ON_ONCE(!chan->sc_exit_unknown);
-		if (IS_ERR(chan->sc_exit_unknown)) {
-			return PTR_ERR(chan->sc_exit_unknown);
+		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+		event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+					    ev.instrumentation);
+		WARN_ON_ONCE(!event_recorder);
+		if (IS_ERR(event_recorder)) {
+			return PTR_ERR(event_recorder);
 		}
+		hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_exit_unknown);
 	}
 
-	ret = fill_event_table(sc_table, ARRAY_SIZE(sc_table),
-			chan->sc_table, chan, filter, SC_TYPE_ENTRY);
+	ret = lttng_create_syscall_event_if_missing(sc_table, ARRAY_SIZE(sc_table),
+			chan->sc_table, event_enabler, SC_TYPE_ENTRY);
 	if (ret)
 		return ret;
-	ret = fill_event_table(sc_exit_table, ARRAY_SIZE(sc_exit_table),
-			chan->sc_exit_table, chan, filter, SC_TYPE_EXIT);
+	ret = lttng_create_syscall_event_if_missing(sc_exit_table, ARRAY_SIZE(sc_exit_table),
+			chan->sc_exit_table, event_enabler, SC_TYPE_EXIT);
 	if (ret)
 		return ret;
 
 #ifdef CONFIG_COMPAT
-	ret = fill_event_table(compat_sc_table, ARRAY_SIZE(compat_sc_table),
-			chan->compat_sc_table, chan, filter,
-			SC_TYPE_COMPAT_ENTRY);
+	ret = lttng_create_syscall_event_if_missing(compat_sc_table, ARRAY_SIZE(compat_sc_table),
+			chan->compat_sc_table, event_enabler, SC_TYPE_COMPAT_ENTRY);
 	if (ret)
 		return ret;
-	ret = fill_event_table(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
-			chan->compat_sc_exit_table, chan, filter,
-			SC_TYPE_COMPAT_EXIT);
+	ret = lttng_create_syscall_event_if_missing(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
+			chan->compat_sc_exit_table, event_enabler, SC_TYPE_COMPAT_EXIT);
 	if (ret)
 		return ret;
 #endif
@@ -918,9 +1112,380 @@ int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
 }
 
 /*
- * Only called at session destruction.
+ * Should be called with sessions lock held.
  */
-int lttng_syscalls_unregister_event(struct lttng_channel *chan)
+int lttng_syscalls_register_event_notifier(
+		struct lttng_event_notifier_enabler *event_notifier_enabler)
+{
+	struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+	unsigned int i;
+	int ret = 0;
+
+	wrapper_vmalloc_sync_mappings();
+
+	if (!group->event_notifier_syscall_dispatch) {
+		group->event_notifier_syscall_dispatch =
+				kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(sc_table),
+					GFP_KERNEL);
+		if (!group->event_notifier_syscall_dispatch)
+			return -ENOMEM;
+
+		/* Initialize all list_head */
+		for (i = 0; i < ARRAY_SIZE(sc_table); i++)
+			INIT_HLIST_HEAD(&group->event_notifier_syscall_dispatch[i]);
+
+		/* Init the unknown syscall notifier list. */
+		INIT_HLIST_HEAD(&group->event_notifier_unknown_syscall_dispatch);
+	}
+
+	if (!group->event_notifier_exit_syscall_dispatch) {
+		group->event_notifier_exit_syscall_dispatch =
+				kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(sc_table),
+					GFP_KERNEL);
+		if (!group->event_notifier_exit_syscall_dispatch)
+			return -ENOMEM;
+
+		/* Initialize all list_head */
+		for (i = 0; i < ARRAY_SIZE(sc_table); i++)
+			INIT_HLIST_HEAD(&group->event_notifier_exit_syscall_dispatch[i]);
+
+		/* Init the unknown exit syscall notifier list. */
+		INIT_HLIST_HEAD(&group->event_notifier_exit_unknown_syscall_dispatch);
+	}
+
+#ifdef CONFIG_COMPAT
+	if (!group->event_notifier_compat_syscall_dispatch) {
+		group->event_notifier_compat_syscall_dispatch =
+				kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(compat_sc_table),
+					GFP_KERNEL);
+		if (!group->event_notifier_syscall_dispatch)
+			return -ENOMEM;
+
+		/* Initialize all list_head */
+		for (i = 0; i < ARRAY_SIZE(compat_sc_table); i++)
+			INIT_HLIST_HEAD(&group->event_notifier_compat_syscall_dispatch[i]);
+
+		/* Init the unknown syscall notifier list. */
+		INIT_HLIST_HEAD(&group->event_notifier_compat_unknown_syscall_dispatch);
+	}
+
+	if (!group->event_notifier_exit_compat_syscall_dispatch) {
+		group->event_notifier_exit_compat_syscall_dispatch =
+				kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(compat_sc_exit_table),
+					GFP_KERNEL);
+		if (!group->event_notifier_exit_syscall_dispatch)
+			return -ENOMEM;
+
+		/* Initialize all list_head */
+		for (i = 0; i < ARRAY_SIZE(compat_sc_exit_table); i++)
+			INIT_HLIST_HEAD(&group->event_notifier_exit_compat_syscall_dispatch[i]);
+
+		/* Init the unknown exit syscall notifier list. */
+		INIT_HLIST_HEAD(&group->event_notifier_exit_compat_unknown_syscall_dispatch);
+	}
+#endif
+
+	if (!group->sc_filter) {
+		group->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
+				GFP_KERNEL);
+		if (!group->sc_filter)
+			return -ENOMEM;
+	}
+
+	if (!group->sys_enter_registered) {
+		ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
+				(void *) syscall_entry_event_notifier_probe, group);
+		if (ret)
+			return ret;
+		group->sys_enter_registered = 1;
+	}
+
+	if (!group->sys_exit_registered) {
+		ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
+				(void *) syscall_exit_event_notifier_probe, group);
+		if (ret) {
+			WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
+				(void *) syscall_entry_event_notifier_probe, group));
+			return ret;
+		}
+		group->sys_exit_registered = 1;
+	}
+
+	return ret;
+}
+
+static
+int create_unknown_event_notifier(
+		struct lttng_event_notifier_enabler *event_notifier_enabler,
+		enum sc_type type)
+{
+	struct lttng_kernel_event_notifier_private *event_notifier_priv;
+	struct lttng_kernel_event_notifier *event_notifier;
+	const struct lttng_kernel_event_desc *desc;
+	struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+	struct lttng_kernel_abi_event_notifier event_notifier_param;
+	uint64_t user_token = event_notifier_enabler->base.user_token;
+	uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
+	struct lttng_enabler *base_enabler = lttng_event_notifier_enabler_as_enabler(
+		event_notifier_enabler);
+	struct hlist_head *unknown_dispatch_list;
+	int ret = 0;
+	bool found = false;
+	enum lttng_kernel_abi_syscall_abi abi;
+	enum lttng_kernel_abi_syscall_entryexit entryexit;
+	struct hlist_head *head;
+
+	switch (type) {
+	case SC_TYPE_ENTRY:
+		desc = &__event_desc___syscall_entry_unknown;
+		unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
+		entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+		abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+		break;
+	case SC_TYPE_EXIT:
+		desc = &__event_desc___syscall_exit_unknown;
+		unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
+		entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+		abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+		break;
+	case SC_TYPE_COMPAT_ENTRY:
+		desc = &__event_desc___compat_syscall_entry_unknown;
+		unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
+		entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+		abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+		break;
+	case SC_TYPE_COMPAT_EXIT:
+		desc = &__event_desc___compat_syscall_exit_unknown;
+		unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
+		entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+		abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+		break;
+	default:
+		BUG_ON(1);
+	}
+
+	/*
+	 * Check if already created.
+	 */
+	head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
+		LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
+	lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
+		if (event_notifier_priv->parent.desc == desc &&
+				event_notifier_priv->parent.user_token == base_enabler->user_token)
+			found = true;
+	}
+	if (found)
+		goto end;
+
+	memset(&event_notifier_param, 0, sizeof(event_notifier_param));
+	strncat(event_notifier_param.event.name, desc->event_name,
+		LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+
+	event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+
+	event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+	event_notifier_param.event.u.syscall.abi = abi;
+	event_notifier_param.event.u.syscall.entryexit = entryexit;
+
+	event_notifier = _lttng_event_notifier_create(desc, user_token,
+		error_counter_index, group, &event_notifier_param,
+		event_notifier_param.event.instrumentation);
+	if (IS_ERR(event_notifier)) {
+		printk(KERN_INFO "Unable to create unknown notifier %s\n",
+			desc->event_name);
+		ret = -ENOMEM;
+		goto end;
+	}
+
+	hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, unknown_dispatch_list);
+
+end:
+	return ret;
+}
+
+static int create_matching_event_notifiers(
+		struct lttng_event_notifier_enabler *event_notifier_enabler,
+		const struct trace_syscall_entry *table,
+		size_t table_len, enum sc_type type)
+{
+	struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+	const struct lttng_kernel_event_desc *desc;
+	uint64_t user_token = event_notifier_enabler->base.user_token;
+	uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
+	unsigned int i;
+	int ret = 0;
+
+	/* iterate over all syscall and create event_notifier that match */
+	for (i = 0; i < table_len; i++) {
+		struct lttng_kernel_event_notifier_private *event_notifier_priv;
+		struct lttng_kernel_event_notifier *event_notifier;
+		struct lttng_kernel_abi_event_notifier event_notifier_param;
+		struct hlist_head *head;
+		int found = 0;
+
+		desc = table[i].desc;
+		if (!desc) {
+			/* Unknown syscall */
+			continue;
+		}
+
+		if (!lttng_desc_match_enabler(desc,
+				lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)))
+			continue;
+
+		/*
+		 * Check if already created.
+		 */
+		head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
+			LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
+		lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
+			if (event_notifier_priv->parent.desc == desc
+				&& event_notifier_priv->parent.user_token == event_notifier_enabler->base.user_token)
+				found = 1;
+		}
+		if (found)
+			continue;
+
+		memset(&event_notifier_param, 0, sizeof(event_notifier_param));
+		switch (type) {
+		case SC_TYPE_ENTRY:
+			event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+			event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+			break;
+		case SC_TYPE_EXIT:
+			event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+			event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+			break;
+		case SC_TYPE_COMPAT_ENTRY:
+			event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+			event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+			break;
+		case SC_TYPE_COMPAT_EXIT:
+			event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+			event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+			break;
+		}
+		strncat(event_notifier_param.event.name, desc->event_name,
+			LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+		event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+		event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+
+		event_notifier = _lttng_event_notifier_create(desc, user_token,
+			error_counter_index, group, &event_notifier_param,
+			event_notifier_param.event.instrumentation);
+		if (IS_ERR(event_notifier)) {
+			printk(KERN_INFO "Unable to create event_notifier %s\n",
+				desc->event_name);
+			ret = -ENOMEM;
+			goto end;
+		}
+
+		event_notifier->priv->parent.u.syscall.syscall_id = i;
+	}
+
+end:
+	return ret;
+
+}
+
+int lttng_syscalls_create_matching_event_notifiers(
+		struct lttng_event_notifier_enabler *event_notifier_enabler)
+{
+	int ret;
+	struct lttng_enabler *base_enabler =
+			lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
+	enum lttng_kernel_abi_syscall_entryexit entryexit =
+			base_enabler->event_param.u.syscall.entryexit;
+
+	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
+		ret = create_matching_event_notifiers(event_notifier_enabler,
+			sc_table, ARRAY_SIZE(sc_table), SC_TYPE_ENTRY);
+		if (ret)
+			goto end;
+
+		ret = create_matching_event_notifiers(event_notifier_enabler,
+			compat_sc_table, ARRAY_SIZE(compat_sc_table),
+			SC_TYPE_COMPAT_ENTRY);
+		if (ret)
+			goto end;
+
+		ret = create_unknown_event_notifier(event_notifier_enabler,
+				SC_TYPE_ENTRY);
+		if (ret)
+			goto end;
+
+		ret = create_unknown_event_notifier(event_notifier_enabler,
+				SC_TYPE_COMPAT_ENTRY);
+		if (ret)
+			goto end;
+	}
+
+	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
+		ret = create_matching_event_notifiers(event_notifier_enabler,
+			sc_exit_table, ARRAY_SIZE(sc_exit_table),
+			SC_TYPE_EXIT);
+		if (ret)
+			goto end;
+
+		ret = create_unknown_event_notifier(event_notifier_enabler,
+				SC_TYPE_EXIT);
+		if (ret)
+			goto end;
+
+		ret = create_matching_event_notifiers(event_notifier_enabler,
+			compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
+			SC_TYPE_COMPAT_EXIT);
+		if (ret)
+			goto end;
+
+		ret = create_unknown_event_notifier(event_notifier_enabler,
+				SC_TYPE_COMPAT_EXIT);
+		if (ret)
+			goto end;
+	}
+
+end:
+	return ret;
+}
+
+/*
+ * Unregister the syscall event_notifier probes from the callsites.
+ */
+int lttng_syscalls_unregister_event_notifier_group(
+		struct lttng_event_notifier_group *event_notifier_group)
+{
+	int ret;
+
+	/*
+	 * Only register the event_notifier probe on the `sys_enter` callsite for now.
+	 * At the moment, we don't think it's desirable to have one fired
+	 * event_notifier for the entry and one for the exit of a syscall.
+	 */
+	if (event_notifier_group->sys_enter_registered) {
+		ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
+				(void *) syscall_entry_event_notifier_probe, event_notifier_group);
+		if (ret)
+			return ret;
+		event_notifier_group->sys_enter_registered = 0;
+	}
+	if (event_notifier_group->sys_exit_registered) {
+		ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
+				(void *) syscall_exit_event_notifier_probe, event_notifier_group);
+		if (ret)
+			return ret;
+		event_notifier_group->sys_enter_registered = 0;
+	}
+
+	kfree(event_notifier_group->event_notifier_syscall_dispatch);
+	kfree(event_notifier_group->event_notifier_exit_syscall_dispatch);
+#ifdef CONFIG_COMPAT
+	kfree(event_notifier_group->event_notifier_compat_syscall_dispatch);
+	kfree(event_notifier_group->event_notifier_exit_compat_syscall_dispatch);
+#endif
+	return 0;
+}
+
+int lttng_syscalls_unregister_channel(struct lttng_channel *chan)
 {
 	int ret;
 
@@ -968,7 +1533,7 @@ int get_syscall_nr(const char *syscall_name)
 		entry = &sc_table[i];
 		if (!entry->desc)
 			continue;
-		it_name = entry->desc->name;
+		it_name = entry->desc->event_name;
 		it_name += strlen(SYSCALL_ENTRY_STR);
 		if (!strcmp(syscall_name, it_name)) {
 			syscall_nr = i;
@@ -991,7 +1556,7 @@ int get_compat_syscall_nr(const char *syscall_name)
 		entry = &compat_sc_table[i];
 		if (!entry->desc)
 			continue;
-		it_name = entry->desc->name;
+		it_name = entry->desc->event_name;
 		it_name += strlen(COMPAT_SYSCALL_ENTRY_STR);
 		if (!strcmp(syscall_name, it_name)) {
 			syscall_nr = i;
@@ -1008,15 +1573,16 @@ uint32_t get_sc_tables_len(void)
 }
 
 static
-const char *get_syscall_name(struct lttng_event *event)
+const char *get_syscall_name(const char *desc_name,
+		enum lttng_syscall_abi abi,
+		enum lttng_syscall_entryexit entryexit)
 {
 	size_t prefix_len = 0;
 
-	WARN_ON_ONCE(event->instrumentation != LTTNG_KERNEL_SYSCALL);
 
-	switch (event->u.syscall.entryexit) {
+	switch (entryexit) {
 	case LTTNG_SYSCALL_ENTRY:
-		switch (event->u.syscall.abi) {
+		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			prefix_len = strlen(SYSCALL_ENTRY_STR);
 			break;
@@ -1026,7 +1592,7 @@ const char *get_syscall_name(struct lttng_event *event)
 		}
 		break;
 	case LTTNG_SYSCALL_EXIT:
-		switch (event->u.syscall.abi) {
+		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			prefix_len = strlen(SYSCALL_EXIT_STR);
 			break;
@@ -1037,22 +1603,22 @@ const char *get_syscall_name(struct lttng_event *event)
 		break;
 	}
 	WARN_ON_ONCE(prefix_len == 0);
-	return event->desc->name + prefix_len;
+	return desc_name + prefix_len;
 }
 
-int lttng_syscall_filter_enable_event(struct lttng_channel *chan,
-		struct lttng_event *event)
+static
+int lttng_syscall_filter_enable(
+		struct lttng_syscall_filter *filter,
+		const char *desc_name, enum lttng_syscall_abi abi,
+		enum lttng_syscall_entryexit entryexit)
 {
-	struct lttng_syscall_filter *filter = chan->sc_filter;
 	const char *syscall_name;
 	unsigned long *bitmap;
 	int syscall_nr;
 
-	WARN_ON_ONCE(!chan->sc_table);
+	syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-	syscall_name = get_syscall_name(event);
-
-	switch (event->u.syscall.abi) {
+	switch (abi) {
 	case LTTNG_SYSCALL_ABI_NATIVE:
 		syscall_nr = get_syscall_nr(syscall_name);
 		break;
@@ -1065,9 +1631,9 @@ int lttng_syscall_filter_enable_event(struct lttng_channel *chan,
 	if (syscall_nr < 0)
 		return -ENOENT;
 
-	switch (event->u.syscall.entryexit) {
+	switch (entryexit) {
 	case LTTNG_SYSCALL_ENTRY:
-		switch (event->u.syscall.abi) {
+		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_entry;
 			break;
@@ -1079,7 +1645,7 @@ int lttng_syscall_filter_enable_event(struct lttng_channel *chan,
 		}
 		break;
 	case LTTNG_SYSCALL_EXIT:
-		switch (event->u.syscall.abi) {
+		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_exit;
 			break;
@@ -1099,19 +1665,87 @@ int lttng_syscall_filter_enable_event(struct lttng_channel *chan,
 	return 0;
 }
 
-int lttng_syscall_filter_disable_event(struct lttng_channel *chan,
-		struct lttng_event *event)
+int lttng_syscall_filter_enable_event_notifier(
+		struct lttng_kernel_event_notifier *event_notifier)
+{
+	struct lttng_event_notifier_group *group = event_notifier->priv->group;
+	unsigned int syscall_id = event_notifier->priv->parent.u.syscall.syscall_id;
+	struct hlist_head *dispatch_list;
+	int ret = 0;
+
+	WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
+
+	ret = lttng_syscall_filter_enable(group->sc_filter,
+		event_notifier->priv->parent.desc->event_name,
+		event_notifier->priv->parent.u.syscall.abi,
+		event_notifier->priv->parent.u.syscall.entryexit);
+	if (ret) {
+		goto end;
+	}
+
+	switch (event_notifier->priv->parent.u.syscall.entryexit) {
+	case LTTNG_SYSCALL_ENTRY:
+		switch (event_notifier->priv->parent.u.syscall.abi) {
+		case LTTNG_SYSCALL_ABI_NATIVE:
+			dispatch_list = &group->event_notifier_syscall_dispatch[syscall_id];
+			break;
+		case LTTNG_SYSCALL_ABI_COMPAT:
+			dispatch_list = &group->event_notifier_compat_syscall_dispatch[syscall_id];
+			break;
+		default:
+			ret = -EINVAL;
+			goto end;
+		}
+		break;
+	case LTTNG_SYSCALL_EXIT:
+		switch (event_notifier->priv->parent.u.syscall.abi) {
+		case LTTNG_SYSCALL_ABI_NATIVE:
+			dispatch_list = &group->event_notifier_exit_syscall_dispatch[syscall_id];
+			break;
+		case LTTNG_SYSCALL_ABI_COMPAT:
+			dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[syscall_id];
+			break;
+		default:
+			ret = -EINVAL;
+			goto end;
+		}
+		break;
+	default:
+		ret = -EINVAL;
+		goto end;
+	}
+
+	hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, dispatch_list);
+
+end:
+	return ret ;
+}
+
+int lttng_syscall_filter_enable_event(
+		struct lttng_channel *channel,
+		struct lttng_kernel_event_recorder *event_recorder)
+{
+	WARN_ON_ONCE(event_recorder->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
+
+	return lttng_syscall_filter_enable(channel->sc_filter,
+		event_recorder->priv->parent.desc->event_name,
+		event_recorder->priv->parent.u.syscall.abi,
+		event_recorder->priv->parent.u.syscall.entryexit);
+}
+
+static
+int lttng_syscall_filter_disable(
+		struct lttng_syscall_filter *filter,
+		const char *desc_name, enum lttng_syscall_abi abi,
+		enum lttng_syscall_entryexit entryexit)
 {
-	struct lttng_syscall_filter *filter = chan->sc_filter;
 	const char *syscall_name;
 	unsigned long *bitmap;
 	int syscall_nr;
 
-	WARN_ON_ONCE(!chan->sc_table);
+	syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-	syscall_name = get_syscall_name(event);
-
-	switch (event->u.syscall.abi) {
+	switch (abi) {
 	case LTTNG_SYSCALL_ABI_NATIVE:
 		syscall_nr = get_syscall_nr(syscall_name);
 		break;
@@ -1124,9 +1758,9 @@ int lttng_syscall_filter_disable_event(struct lttng_channel *chan,
 	if (syscall_nr < 0)
 		return -ENOENT;
 
-	switch (event->u.syscall.entryexit) {
+	switch (entryexit) {
 	case LTTNG_SYSCALL_ENTRY:
-		switch (event->u.syscall.abi) {
+		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_entry;
 			break;
@@ -1138,7 +1772,7 @@ int lttng_syscall_filter_disable_event(struct lttng_channel *chan,
 		}
 		break;
 	case LTTNG_SYSCALL_EXIT:
-		switch (event->u.syscall.abi) {
+		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_exit;
 			break;
@@ -1159,6 +1793,34 @@ int lttng_syscall_filter_disable_event(struct lttng_channel *chan,
 	return 0;
 }
 
+int lttng_syscall_filter_disable_event_notifier(
+		struct lttng_kernel_event_notifier *event_notifier)
+{
+	struct lttng_event_notifier_group *group = event_notifier->priv->group;
+	int ret;
+
+	WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
+
+	ret = lttng_syscall_filter_disable(group->sc_filter,
+		event_notifier->priv->parent.desc->event_name,
+		event_notifier->priv->parent.u.syscall.abi,
+		event_notifier->priv->parent.u.syscall.entryexit);
+	WARN_ON_ONCE(ret != 0);
+
+	hlist_del_rcu(&event_notifier->priv->parent.u.syscall.node);
+	return 0;
+}
+
+int lttng_syscall_filter_disable_event(
+		struct lttng_channel *channel,
+		struct lttng_kernel_event_recorder *event_recorder)
+{
+	return lttng_syscall_filter_disable(channel->sc_filter,
+		event_recorder->priv->parent.desc->event_name,
+		event_recorder->priv->parent.u.syscall.abi,
+		event_recorder->priv->parent.u.syscall.entryexit);
+}
+
 static
 const struct trace_syscall_entry *syscall_list_get_entry(loff_t *pos)
 {
@@ -1238,10 +1900,10 @@ int syscall_list_show(struct seq_file *m, void *p)
 		return 0;
 	if (table == sc_table) {
 		index = entry - table;
-		name = &entry->desc->name[strlen(SYSCALL_ENTRY_STR)];
+		name = &entry->desc->event_name[strlen(SYSCALL_ENTRY_STR)];
 	} else {
 		index = (entry - table) + ARRAY_SIZE(sc_table);
-		name = &entry->desc->name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
+		name = &entry->desc->event_name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
 	}
 	seq_printf(m,	"syscall { index = %lu; name = %s; bitness = %u; };\n",
 		index, name, bitness);
@@ -1274,7 +1936,7 @@ const struct file_operations lttng_syscall_list_fops = {
  * A syscall is enabled if it is traced for either entry or exit.
  */
 long lttng_channel_syscall_mask(struct lttng_channel *channel,
-		struct lttng_kernel_syscall_mask __user *usyscall_mask)
+		struct lttng_kernel_abi_syscall_mask __user *usyscall_mask)
 {
 	uint32_t len, sc_tables_len, bitmask_len;
 	int ret = 0, bit;
@@ -1299,7 +1961,8 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
 		char state;
 
 		if (channel->sc_table) {
-			if (!READ_ONCE(channel->syscall_all) && filter)
+			if (!(READ_ONCE(channel->syscall_all_entry)
+					|| READ_ONCE(channel->syscall_all_exit)) && filter)
 				state = test_bit(bit, filter->sc_entry)
 					|| test_bit(bit, filter->sc_exit);
 			else
@@ -1313,7 +1976,8 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
 		char state;
 
 		if (channel->compat_sc_table) {
-			if (!READ_ONCE(channel->syscall_all) && filter)
+			if (!(READ_ONCE(channel->syscall_all_entry)
+					|| READ_ONCE(channel->syscall_all_exit)) && filter)
 				state = test_bit(bit - ARRAY_SIZE(sc_table),
 						filter->sc_compat_entry)
 					|| test_bit(bit - ARRAY_SIZE(sc_table),