X-Git-Url: https://git.lttng.org/?a=blobdiff_plain;f=src%2Flttng-syscalls.c;h=e8b72573a42131c95b56e4952a11710e5d2e7957;hb=fad51c94f3e3354e7bcecb58029f25405116eabd;hp=bc8e6e715ff3de73b9348984fc40a89afcdb75ee;hpb=fd70f5a5f72ac11b36f67f3a4bdee03cd9a39648;p=lttng-modules.git

diff --git a/src/lttng-syscalls.c b/src/lttng-syscalls.c
index bc8e6e71..e8b72573 100644
--- a/src/lttng-syscalls.c
+++ b/src/lttng-syscalls.c
@@ -28,6 +28,7 @@
 #include <wrapper/file.h>
 #include <wrapper/rcu.h>
 #include <wrapper/syscall.h>
+#include <wrapper/limits.h>
 #include <lttng/events.h>
 #include <lttng/events-internal.h>
 #include <lttng/utils.h>
@@ -130,10 +131,16 @@ struct lttng_syscall_filter {
 	DECLARE_BITMAP(sc_exit, NR_syscalls);
 	DECLARE_BITMAP(sc_compat_entry, NR_compat_syscalls);
 	DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
-};
 
-static
-int lttng_syscalls_create_matching_event_notifiers(struct lttng_event_enabler_common *event_enabler);
+	/*
+	 * Reference counters keeping track of number of events enabled
+	 * for each bit.
+	 */
+	u32 sc_entry_refcount_map[NR_syscalls];
+	u32 sc_exit_refcount_map[NR_syscalls];
+	u32 sc_compat_entry_refcount_map[NR_compat_syscalls];
+	u32 sc_compat_exit_refcount_map[NR_compat_syscalls];
+};
 
 static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
 	struct pt_regs *regs, long id)
@@ -529,8 +536,7 @@ struct lttng_kernel_syscall_table *get_syscall_table_from_event(struct lttng_ker
 
 static
 void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common *syscall_event_enabler,
-		const struct lttng_kernel_event_desc *desc, struct hlist_head *dispatch_table,
-		enum sc_type type, unsigned int syscall_nr)
+		const struct lttng_kernel_event_desc *desc, enum sc_type type, unsigned int syscall_nr)
 {
 	struct lttng_kernel_event_common *event;
 
@@ -571,14 +577,13 @@ void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common
 		if (!event_recorder_enabler)
 			return;
 		event = _lttng_kernel_event_create(&event_recorder_enabler->parent, desc);
-		WARN_ON_ONCE(!event || IS_ERR(event));
+		WARN_ON_ONCE(IS_ERR(event));
 		lttng_event_enabler_destroy(&event_recorder_enabler->parent);
-		if (!event || IS_ERR(event)) {
+		if (IS_ERR(event)) {
 			printk(KERN_INFO "Unable to create event recorder %s\n", desc->event_name);
 			return;
 		}
-		if (dispatch_table)
-			hlist_add_head_rcu(&event->priv->u.syscall.node, &dispatch_table[syscall_nr]);
+		event->priv->u.syscall.syscall_id = syscall_nr;
 		break;
 	}
 	case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
@@ -620,9 +625,9 @@ void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common
 				&event_notifier_param, syscall_event_notifier_enabler->group);
 		WARN_ON_ONCE(!event_notifier_enabler);
 		event = _lttng_kernel_event_create(&event_notifier_enabler->parent, desc);
-		WARN_ON_ONCE(!event || IS_ERR(event));
+		WARN_ON_ONCE(IS_ERR(event));
 		lttng_event_enabler_destroy(&event_notifier_enabler->parent);
-		if (!event || IS_ERR(event)) {
+		if (IS_ERR(event)) {
 			printk(KERN_INFO "Unable to create event notifier %s\n", desc->event_name);
 			return;
 		}
@@ -634,182 +639,142 @@ void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common
 	}
 }
 
-/*
- * noinline to diminish caller stack size.
- * Should be called with sessions lock held.
- */
 static
-int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *table, size_t table_len,
-	struct hlist_head *dispatch_table, struct lttng_event_recorder_enabler *syscall_event_enabler,
-	enum sc_type type)
+void lttng_syscall_event_enabler_create_matching_syscall_table_events(struct lttng_event_enabler_common *syscall_event_enabler_common,
+		const struct trace_syscall_entry *table, size_t table_len, enum sc_type type)
 {
-	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(&syscall_event_enabler->parent);
+	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(syscall_event_enabler_common);
+	const struct lttng_kernel_event_desc *desc;
 	unsigned int i;
 
-	/* Allocate events for each syscall matching enabler, insert into table */
+#ifndef CONFIG_COMPAT
+	if (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT)
+		return;
+#endif
+	/* iterate over all syscall and create event that match */
 	for (i = 0; i < table_len; i++) {
-		const struct lttng_kernel_event_desc *desc = table[i].desc;
 		struct lttng_kernel_event_common_private *event_priv;
 		struct hlist_head *head;
 		bool found = false;
 
+		desc = table[i].desc;
 		if (!desc) {
 			/* Unknown syscall */
 			continue;
 		}
-		if (!lttng_desc_match_enabler(desc,
-				lttng_event_recorder_enabler_as_enabler(syscall_event_enabler)))
+
+		if (!lttng_desc_match_enabler(desc, syscall_event_enabler_common))
 			continue;
+
 		/*
 		 * Check if already created.
 		 */
 		head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
 		lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
-			if (lttng_event_enabler_desc_match_event(&syscall_event_enabler->parent, desc, event_priv->pub))
+			if (lttng_event_enabler_desc_match_event(syscall_event_enabler_common, desc, event_priv->pub)) {
 				found = true;
+				break;
+			}
 		}
 		if (found)
 			continue;
 
-		lttng_syscall_event_enabler_create_event(&syscall_event_enabler->parent, desc, dispatch_table, type, i);
+		lttng_syscall_event_enabler_create_event(syscall_event_enabler_common, desc, type, i);
 	}
-	return 0;
 }
 
 static
-int lttng_syscalls_populate_events(struct lttng_event_enabler_common *syscall_event_enabler)
+bool lttng_syscall_event_enabler_is_wildcard_all(struct lttng_event_enabler_common *event_enabler)
 {
-	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
-	struct lttng_event_recorder_enabler *event_recorder_enabler;
-	struct lttng_kernel_channel_buffer *chan;
-	struct lttng_kernel_abi_event ev;
-	int ret;
+	if (event_enabler->event_param.instrumentation != LTTNG_KERNEL_ABI_SYSCALL)
+		return false;
+	if (event_enabler->event_param.u.syscall.abi != LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL)
+		return false;
+	if (event_enabler->event_param.u.syscall.match != LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME)
+		return false;
+	if (strcmp(event_enabler->event_param.name, "*"))
+		return false;
+	return true;
+}
 
-	if (syscall_event_enabler->enabler_type != LTTNG_EVENT_ENABLER_TYPE_RECORDER)
-		return 0;
-	event_recorder_enabler = container_of(syscall_event_enabler, struct lttng_event_recorder_enabler, parent);
-	chan = event_recorder_enabler->chan;
+static
+void create_unknown_syscall_event(struct lttng_event_enabler_common *event_enabler, enum sc_type type)
+{
+	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(event_enabler);
+	struct lttng_kernel_event_common_private *event_priv;
+	const struct lttng_kernel_event_desc *desc;
+	bool found = false;
+	struct hlist_head *head;
 
-	if (hlist_empty(&syscall_table->unknown_syscall_dispatch)) {
-		const struct lttng_kernel_event_desc *desc =
-			&__event_desc___syscall_entry_unknown;
-		struct lttng_kernel_event_common *event;
-		struct lttng_event_recorder_enabler *event_enabler;
+#ifndef CONFIG_COMPAT
+	if (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT)
+		return;
+#endif
+	/*
+	 * Considering that currently system calls can only be enabled on a per
+	 * name basis (or wildcard based on a name), unknown syscall events are
+	 * only used when matching *all* system calls, because this is the only
+	 * case which can be associated with an unknown system call.
+	 *
+	 * When enabling system call on a per system call number basis will be
+	 * supported, this will need to be revisited.
+	 */
+	if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
+		return;
 
-		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
-		if (!event_enabler) {
-			return -ENOMEM;
-		}
-		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
-		lttng_event_enabler_destroy(&event_enabler->parent);
-		WARN_ON_ONCE(!event);
-		if (IS_ERR(event)) {
-			return PTR_ERR(event);
-		}
-		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->unknown_syscall_dispatch);
+	switch (type) {
+	case SC_TYPE_ENTRY:
+		desc = &__event_desc___syscall_entry_unknown;
+		break;
+	case SC_TYPE_EXIT:
+		desc = &__event_desc___syscall_exit_unknown;
+		break;
+	case SC_TYPE_COMPAT_ENTRY:
+		desc = &__event_desc___compat_syscall_entry_unknown;
+		break;
+	case SC_TYPE_COMPAT_EXIT:
+		desc = &__event_desc___compat_syscall_exit_unknown;
+		break;
+	default:
+		WARN_ON_ONCE(1);
 	}
 
-	if (hlist_empty(&syscall_table->compat_unknown_syscall_dispatch)) {
-		const struct lttng_kernel_event_desc *desc =
-			&__event_desc___compat_syscall_entry_unknown;
-		struct lttng_kernel_event_common *event;
-		struct lttng_event_recorder_enabler *event_enabler;
-
-		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
-		if (!event_enabler) {
-			return -ENOMEM;
-		}
-		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
-		WARN_ON_ONCE(!event);
-		lttng_event_enabler_destroy(&event_enabler->parent);
-		if (IS_ERR(event)) {
-			return PTR_ERR(event);
+	/*
+	 * Check if already created.
+	 */
+	head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
+	lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
+		if (lttng_event_enabler_desc_match_event(event_enabler, desc, event_priv->pub)) {
+			found = true;
+			break;
 		}
-		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->compat_unknown_syscall_dispatch);
 	}
+	if (!found)
+		lttng_syscall_event_enabler_create_event(event_enabler, desc, type, -1U);
+}
 
-	if (hlist_empty(&syscall_table->compat_unknown_syscall_exit_dispatch)) {
-		const struct lttng_kernel_event_desc *desc =
-			&__event_desc___compat_syscall_exit_unknown;
-		struct lttng_kernel_event_common *event;
-		struct lttng_event_recorder_enabler *event_enabler;
+static
+void lttng_syscall_event_enabler_create_matching_events(struct lttng_event_enabler_common *event_enabler)
+{
+	enum lttng_kernel_abi_syscall_entryexit entryexit = event_enabler->event_param.u.syscall.entryexit;
 
-		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
-		if (!event_enabler) {
-			return -ENOMEM;
-		}
-		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
-		WARN_ON_ONCE(!event);
-		lttng_event_enabler_destroy(&event_enabler->parent);
-		if (IS_ERR(event)) {
-			return PTR_ERR(event);
-		}
-		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->compat_unknown_syscall_exit_dispatch);
+	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
+		lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+			sc_table.table, sc_table.len, SC_TYPE_ENTRY);
+		lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+			compat_sc_table.table, compat_sc_table.len, SC_TYPE_COMPAT_ENTRY);
+		create_unknown_syscall_event(event_enabler, SC_TYPE_ENTRY);
+		create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_ENTRY);
 	}
 
-	if (hlist_empty(&syscall_table->unknown_syscall_exit_dispatch)) {
-		const struct lttng_kernel_event_desc *desc =
-			&__event_desc___syscall_exit_unknown;
-		struct lttng_kernel_event_common *event;
-		struct lttng_event_recorder_enabler *event_enabler;
-
-		memset(&ev, 0, sizeof(ev));
-		strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-		ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-		ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-		ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-		ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-		event_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev, chan);
-		if (!event_enabler) {
-			return -ENOMEM;
-		}
-		event = _lttng_kernel_event_create(&event_enabler->parent, desc);
-		WARN_ON_ONCE(!event);
-		lttng_event_enabler_destroy(&event_enabler->parent);
-		if (IS_ERR(event)) {
-			return PTR_ERR(event);
-		}
-		hlist_add_head(&event->priv->u.syscall.node, &syscall_table->unknown_syscall_exit_dispatch);
+	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
+		lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+			sc_exit_table.table, sc_exit_table.len, SC_TYPE_EXIT);
+		lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+			compat_sc_exit_table.table, compat_sc_exit_table.len, SC_TYPE_COMPAT_EXIT);
+		create_unknown_syscall_event(event_enabler, SC_TYPE_EXIT);
+		create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_EXIT);
 	}
-
-	ret = lttng_create_syscall_event_if_missing(sc_table.table, sc_table.len,
-			syscall_table->syscall_dispatch, event_recorder_enabler, SC_TYPE_ENTRY);
-	if (ret)
-		return ret;
-	ret = lttng_create_syscall_event_if_missing(sc_exit_table.table, sc_exit_table.len,
-			syscall_table->syscall_exit_dispatch, event_recorder_enabler, SC_TYPE_EXIT);
-	if (ret)
-		return ret;
-
-#ifdef CONFIG_COMPAT
-	ret = lttng_create_syscall_event_if_missing(compat_sc_table.table, compat_sc_table.len,
-			syscall_table->compat_syscall_dispatch, event_recorder_enabler, SC_TYPE_COMPAT_ENTRY);
-	if (ret)
-		return ret;
-	ret = lttng_create_syscall_event_if_missing(compat_sc_exit_table.table, compat_sc_exit_table.len,
-			syscall_table->compat_syscall_exit_dispatch, event_recorder_enabler, SC_TYPE_COMPAT_EXIT);
-	if (ret)
-		return ret;
-#endif
-	return ret;
 }
 
 /*
@@ -833,7 +798,6 @@ int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enab
 			return -ENOMEM;
 	}
 
-
 #ifdef CONFIG_COMPAT
 	if (!syscall_table->compat_syscall_dispatch) {
 		/* create syscall table mapping compat syscall to events */
@@ -856,14 +820,6 @@ int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enab
 			return -ENOMEM;
 	}
 
-	ret = lttng_syscalls_populate_events(syscall_event_enabler);
-	if (ret)
-		return ret;
-
-	ret = lttng_syscalls_create_matching_event_notifiers(syscall_event_enabler);
-	if (ret)
-		return ret;
-
 	if (!syscall_table->sys_enter_registered) {
 		ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
 				(void *) syscall_entry_event_probe, syscall_table);
@@ -882,129 +838,9 @@ int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enab
 		syscall_table->sys_exit_registered = 1;
 	}
 
-	return ret;
-}
-
-static
-void create_unknown_event_notifier(
-		struct lttng_event_notifier_enabler *event_notifier_enabler,
-		enum sc_type type)
-{
-	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(&event_notifier_enabler->parent);
-	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(&event_notifier_enabler->parent);
-	struct lttng_kernel_event_common_private *event_priv;
-	const struct lttng_kernel_event_desc *desc;
-	struct hlist_head *unknown_dispatch_list;
-	bool found = false;
-	struct hlist_head *head;
-
-	switch (type) {
-	case SC_TYPE_ENTRY:
-		desc = &__event_desc___syscall_entry_unknown;
-		unknown_dispatch_list = &syscall_table->unknown_syscall_dispatch;
-		break;
-	case SC_TYPE_EXIT:
-		desc = &__event_desc___syscall_exit_unknown;
-		unknown_dispatch_list = &syscall_table->unknown_syscall_exit_dispatch;
-		break;
-	case SC_TYPE_COMPAT_ENTRY:
-		desc = &__event_desc___compat_syscall_entry_unknown;
-		unknown_dispatch_list = &syscall_table->compat_unknown_syscall_dispatch;
-		break;
-	case SC_TYPE_COMPAT_EXIT:
-		desc = &__event_desc___compat_syscall_exit_unknown;
-		unknown_dispatch_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
-		break;
-	default:
-		WARN_ON_ONCE(1);
-	}
+	lttng_syscall_event_enabler_create_matching_events(syscall_event_enabler);
 
-	/*
-	 * Check if already created.
-	 */
-	head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
-	lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
-		if (lttng_event_enabler_desc_match_event(&event_notifier_enabler->parent, desc, event_priv->pub))
-			found = true;
-	}
-	if (!found)
-		lttng_syscall_event_enabler_create_event(&event_notifier_enabler->parent, desc, unknown_dispatch_list, type, -1U);
-}
-
-static
-void create_matching_event_notifiers(
-		struct lttng_event_notifier_enabler *syscall_event_notifier_enabler,
-		const struct trace_syscall_entry *table,
-		size_t table_len, enum sc_type type)
-{
-	struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(&syscall_event_notifier_enabler->parent);
-	const struct lttng_kernel_event_desc *desc;
-	unsigned int i;
-
-	/* iterate over all syscall and create event_notifier that match */
-	for (i = 0; i < table_len; i++) {
-		struct lttng_kernel_event_common_private *event_priv;
-		struct hlist_head *head;
-		int found = 0;
-
-		desc = table[i].desc;
-		if (!desc) {
-			/* Unknown syscall */
-			continue;
-		}
-
-		if (!lttng_desc_match_enabler(desc,
-				lttng_event_notifier_enabler_as_enabler(syscall_event_notifier_enabler)))
-			continue;
-
-		/*
-		 * Check if already created.
-		 */
-		head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
-		lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
-			if (lttng_event_enabler_desc_match_event(&syscall_event_notifier_enabler->parent, desc, event_priv->pub))
-				found = 1;
-		}
-		if (found)
-			continue;
-
-		lttng_syscall_event_enabler_create_event(&syscall_event_notifier_enabler->parent, desc, NULL, type, i);
-	}
-}
-
-static
-int lttng_syscalls_create_matching_event_notifiers(struct lttng_event_enabler_common *event_enabler)
-{
-	int ret;
-	enum lttng_kernel_abi_syscall_entryexit entryexit =
-			event_enabler->event_param.u.syscall.entryexit;
-	struct lttng_event_notifier_enabler *event_notifier_enabler;
-
-	if (event_enabler->enabler_type != LTTNG_EVENT_ENABLER_TYPE_NOTIFIER)
-		return 0;
-	event_notifier_enabler = container_of(event_enabler, struct lttng_event_notifier_enabler, parent);
-
-	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
-		create_matching_event_notifiers(event_notifier_enabler,
-			sc_table.table, sc_table.len, SC_TYPE_ENTRY);
-		create_matching_event_notifiers(event_notifier_enabler,
-			compat_sc_table.table, compat_sc_table.len,
-			SC_TYPE_COMPAT_ENTRY);
-		create_unknown_event_notifier(event_notifier_enabler, SC_TYPE_ENTRY);
-		create_unknown_event_notifier(event_notifier_enabler, SC_TYPE_COMPAT_ENTRY);
-	}
-
-	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
-		create_matching_event_notifiers(event_notifier_enabler,
-			sc_exit_table.table, sc_exit_table.len,
-			SC_TYPE_EXIT);
-		create_matching_event_notifiers(event_notifier_enabler,
-			compat_sc_exit_table.table, compat_sc_exit_table.len,
-			SC_TYPE_COMPAT_EXIT);
-		create_unknown_event_notifier(event_notifier_enabler, SC_TYPE_EXIT);
-		create_unknown_event_notifier(event_notifier_enabler, SC_TYPE_COMPAT_EXIT);
-	}
-	return ret;
+	return 0;
 }
 
 int lttng_syscalls_unregister_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
@@ -1042,52 +878,6 @@ int lttng_syscalls_destroy_syscall_table(struct lttng_kernel_syscall_table *sysc
 	return 0;
 }
 
-static
-int get_syscall_nr(const char *syscall_name)
-{
-	int syscall_nr = -1;
-	int i;
-
-	for (i = 0; i < sc_table.len; i++) {
-		const struct trace_syscall_entry *entry;
-		const char *it_name;
-
-		entry = &sc_table.table[i];
-		if (!entry->desc)
-			continue;
-		it_name = entry->desc->event_name;
-		it_name += strlen(SYSCALL_ENTRY_STR);
-		if (!strcmp(syscall_name, it_name)) {
-			syscall_nr = i;
-			break;
-		}
-	}
-	return syscall_nr;
-}
-
-static
-int get_compat_syscall_nr(const char *syscall_name)
-{
-	int syscall_nr = -1;
-	int i;
-
-	for (i = 0; i < compat_sc_table.len; i++) {
-		const struct trace_syscall_entry *entry;
-		const char *it_name;
-
-		entry = &compat_sc_table.table[i];
-		if (!entry->desc)
-			continue;
-		it_name = entry->desc->event_name;
-		it_name += strlen(COMPAT_SYSCALL_ENTRY_STR);
-		if (!strcmp(syscall_name, it_name)) {
-			syscall_nr = i;
-			break;
-		}
-	}
-	return syscall_nr;
-}
-
 static
 uint32_t get_sc_tables_len(void)
 {
@@ -1132,35 +922,25 @@ static
 int lttng_syscall_filter_enable(
 		struct lttng_syscall_filter *filter,
 		const char *desc_name, enum lttng_syscall_abi abi,
-		enum lttng_syscall_entryexit entryexit)
+		enum lttng_syscall_entryexit entryexit,
+		unsigned int syscall_id)
 {
 	const char *syscall_name;
 	unsigned long *bitmap;
-	int syscall_nr;
+	u32 *refcount_map;
 
 	syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-	switch (abi) {
-	case LTTNG_SYSCALL_ABI_NATIVE:
-		syscall_nr = get_syscall_nr(syscall_name);
-		break;
-	case LTTNG_SYSCALL_ABI_COMPAT:
-		syscall_nr = get_compat_syscall_nr(syscall_name);
-		break;
-	default:
-		return -EINVAL;
-	}
-	if (syscall_nr < 0)
-		return -ENOENT;
-
 	switch (entryexit) {
 	case LTTNG_SYSCALL_ENTRY:
 		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_entry;
+			refcount_map = filter->sc_entry_refcount_map;
 			break;
 		case LTTNG_SYSCALL_ABI_COMPAT:
 			bitmap = filter->sc_compat_entry;
+			refcount_map = filter->sc_compat_entry_refcount_map;
 			break;
 		default:
 			return -EINVAL;
@@ -1170,9 +950,11 @@ int lttng_syscall_filter_enable(
 		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_exit;
+			refcount_map = filter->sc_exit_refcount_map;
 			break;
 		case LTTNG_SYSCALL_ABI_COMPAT:
 			bitmap = filter->sc_compat_exit;
+			refcount_map = filter->sc_compat_exit_refcount_map;
 			break;
 		default:
 			return -EINVAL;
@@ -1181,32 +963,61 @@ int lttng_syscall_filter_enable(
 	default:
 		return -EINVAL;
 	}
-	if (test_bit(syscall_nr, bitmap))
-		return -EEXIST;
-	bitmap_set(bitmap, syscall_nr, 1);
+	if (refcount_map[syscall_id] == U32_MAX)
+		return -EOVERFLOW;
+	if (refcount_map[syscall_id]++ == 0)
+		bitmap_set(bitmap, syscall_id, 1);
 	return 0;
 }
 
 int lttng_syscall_filter_enable_event(struct lttng_kernel_event_common *event)
 {
 	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
-	int ret;
+	unsigned int syscall_id = event->priv->u.syscall.syscall_id;
+	struct hlist_head *dispatch_list;
+	int ret = 0;
 
 	WARN_ON_ONCE(event->priv->instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
 
-	ret = lttng_syscall_filter_enable(syscall_table->sc_filter,
-		event->priv->desc->event_name, event->priv->u.syscall.abi,
-		event->priv->u.syscall.entryexit);
-	if (ret)
-		return ret;
-
-	switch (event->type) {
-	case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
-		break;
-	case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
-	{
-		unsigned int syscall_id = event->priv->u.syscall.syscall_id;
-		struct hlist_head *dispatch_list;
+	/* Unknown syscall */
+	if (syscall_id == -1U) {
+		switch (event->priv->u.syscall.entryexit) {
+		case LTTNG_SYSCALL_ENTRY:
+			switch (event->priv->u.syscall.abi) {
+			case LTTNG_SYSCALL_ABI_NATIVE:
+				dispatch_list = &syscall_table->unknown_syscall_dispatch;
+				break;
+			case LTTNG_SYSCALL_ABI_COMPAT:
+				dispatch_list = &syscall_table->compat_unknown_syscall_dispatch;
+				break;
+			default:
+				ret = -EINVAL;
+				goto end;
+			}
+			break;
+		case LTTNG_SYSCALL_EXIT:
+			switch (event->priv->u.syscall.abi) {
+			case LTTNG_SYSCALL_ABI_NATIVE:
+				dispatch_list = &syscall_table->unknown_syscall_exit_dispatch;
+				break;
+			case LTTNG_SYSCALL_ABI_COMPAT:
+				dispatch_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
+				break;
+			default:
+				ret = -EINVAL;
+				goto end;
+			}
+			break;
+		default:
+			ret = -EINVAL;
+			goto end;
+		}
+	} else {
+		ret = lttng_syscall_filter_enable(syscall_table->sc_filter,
+			event->priv->desc->event_name, event->priv->u.syscall.abi,
+			event->priv->u.syscall.entryexit, syscall_id);
+		if (ret)
+			return ret;
 
 		switch (event->priv->u.syscall.entryexit) {
 		case LTTNG_SYSCALL_ENTRY:
@@ -1239,14 +1050,9 @@ int lttng_syscall_filter_enable_event(struct lttng_kernel_event_common *event)
 			ret = -EINVAL;
 			goto end;
 		}
-
-		hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_list);
-		break;
-	}
-	default:
-		WARN_ON_ONCE(1);
-		return -ENOSYS;
 	}
+
+	hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_list);
 end:
 	return ret;
 }
@@ -1254,35 +1060,25 @@ end:
 static
 int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
 		const char *desc_name, enum lttng_syscall_abi abi,
-		enum lttng_syscall_entryexit entryexit)
+		enum lttng_syscall_entryexit entryexit,
+		unsigned int syscall_id)
 {
 	const char *syscall_name;
 	unsigned long *bitmap;
-	int syscall_nr;
+	u32 *refcount_map;
 
 	syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-	switch (abi) {
-	case LTTNG_SYSCALL_ABI_NATIVE:
-		syscall_nr = get_syscall_nr(syscall_name);
-		break;
-	case LTTNG_SYSCALL_ABI_COMPAT:
-		syscall_nr = get_compat_syscall_nr(syscall_name);
-		break;
-	default:
-		return -EINVAL;
-	}
-	if (syscall_nr < 0)
-		return -ENOENT;
-
 	switch (entryexit) {
 	case LTTNG_SYSCALL_ENTRY:
 		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_entry;
+			refcount_map = filter->sc_entry_refcount_map;
 			break;
 		case LTTNG_SYSCALL_ABI_COMPAT:
 			bitmap = filter->sc_compat_entry;
+			refcount_map = filter->sc_compat_entry_refcount_map;
 			break;
 		default:
 			return -EINVAL;
@@ -1292,9 +1088,11 @@ int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
 		switch (abi) {
 		case LTTNG_SYSCALL_ABI_NATIVE:
 			bitmap = filter->sc_exit;
+			refcount_map = filter->sc_exit_refcount_map;
 			break;
 		case LTTNG_SYSCALL_ABI_COMPAT:
 			bitmap = filter->sc_compat_exit;
+			refcount_map = filter->sc_compat_exit_refcount_map;
 			break;
 		default:
 			return -EINVAL;
@@ -1303,36 +1101,28 @@ int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
 	default:
 		return -EINVAL;
 	}
-	if (!test_bit(syscall_nr, bitmap))
-		return -EEXIST;
-	bitmap_clear(bitmap, syscall_nr, 1);
-
+	if (refcount_map[syscall_id] == 0)
+		return -ENOENT;
+	if (--refcount_map[syscall_id] == 0)
+		bitmap_clear(bitmap, syscall_id, 1);
 	return 0;
 }
 
 int lttng_syscall_filter_disable_event(struct lttng_kernel_event_common *event)
 {
 	struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
+	unsigned int syscall_id = event->priv->u.syscall.syscall_id;
 	int ret;
 
-	ret = lttng_syscall_filter_disable(syscall_table->sc_filter,
-		event->priv->desc->event_name, event->priv->u.syscall.abi,
-		event->priv->u.syscall.entryexit);
-	if (ret)
-		return ret;
-
-	switch (event->type) {
-	case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
-		break;
-	case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
-	{
-		hlist_del_rcu(&event->priv->u.syscall.node);
-		break;
-	}
-	default:
-		WARN_ON_ONCE(1);
-		return -ENOSYS;
+	/* Except for unknown syscall */
+	if (syscall_id != -1U) {
+		ret = lttng_syscall_filter_disable(syscall_table->sc_filter,
+			event->priv->desc->event_name, event->priv->u.syscall.abi,
+			event->priv->u.syscall.entryexit, syscall_id);
+		if (ret)
+			return ret;
 	}
+	hlist_del_rcu(&event->priv->u.syscall.node);
 	return 0;
 }
 
@@ -1342,15 +1132,8 @@ void lttng_syscall_table_set_wildcard_all(struct lttng_event_enabler_common *eve
 	enum lttng_kernel_abi_syscall_entryexit entryexit;
 	int enabled = event_enabler->enabled;
 
-	if (event_enabler->event_param.instrumentation != LTTNG_KERNEL_ABI_SYSCALL)
+	if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
 		return;
-	if (event_enabler->event_param.u.syscall.abi != LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL)
-		return;
-	if (event_enabler->event_param.u.syscall.match != LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME)
-		return;
-	if (strcmp(event_enabler->event_param.name, "*"))
-		return;
-
 	entryexit = event_enabler->event_param.u.syscall.entryexit;
 	if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
 		WRITE_ONCE(syscall_table->syscall_all_entry, enabled);