Refactoring: event structures
[lttng-modules.git] / src / lttng-syscalls.c
index 1465083556c4ca94657deb621cdb95f58b297962..d4914037392219e38bd5a29be2bace941b7a288c 100644 (file)
@@ -91,7 +91,7 @@ struct timeval;
 struct itimerval;
 struct itimerspec;
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,6,0))
+#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(5,6,0))
 typedef __kernel_old_time_t time_t;
 #endif
 
@@ -294,8 +294,8 @@ typedef __kernel_old_time_t time_t;
 struct trace_syscall_entry {
        void *event_func;
        void *event_notifier_func;
-       const struct lttng_event_desc *desc;
-       const struct lttng_event_field *fields;
+       const struct lttng_kernel_event_desc *desc;
+       const struct lttng_kernel_event_field **fields;
        unsigned int nrargs;
 };
 
@@ -388,16 +388,23 @@ struct lttng_syscall_filter {
        DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
 };
 
-static void syscall_entry_event_unknown(struct lttng_event *event,
+static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
        struct pt_regs *regs, long id)
 {
        unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+       struct lttng_kernel_event_common_private *event_priv;
 
        lttng_syscall_get_arguments(current, regs, args);
-       if (unlikely(in_compat_syscall()))
-               __event_probe__compat_syscall_entry_unknown(event, id, args);
-       else
-               __event_probe__syscall_entry_unknown(event, id, args);
+       lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
+               struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                       container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+               struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+               if (unlikely(in_compat_syscall()))
+                       __event_probe__compat_syscall_entry_unknown(event_recorder, id, args);
+               else
+                       __event_probe__syscall_entry_unknown(event_recorder, id, args);
+       }
 }
 
 static void syscall_entry_event_notifier_unknown(
@@ -405,14 +412,18 @@ static void syscall_entry_event_notifier_unknown(
                struct pt_regs *regs, long id)
 {
        unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-       struct lttng_event_notifier *notifier;
+       struct lttng_kernel_event_common_private *event_priv;
 
        lttng_syscall_get_arguments(current, regs, args);
-       lttng_hlist_for_each_entry_rcu(notifier, unknown_dispatch_list_head, u.syscall.node) {
+       lttng_hlist_for_each_entry_rcu(event_priv, unknown_dispatch_list_head, u.syscall.node) {
+               struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                       container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+               struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
                if (unlikely(in_compat_syscall()))
-                       __event_notifier_probe__compat_syscall_entry_unknown(notifier, id, args);
+                       __event_notifier_probe__compat_syscall_entry_unknown(event_notifier, id, args);
                else
-                       __event_notifier_probe__syscall_entry_unknown(notifier, id, args);
+                       __event_notifier_probe__syscall_entry_unknown(event_notifier, id, args);
        }
 }
 
@@ -421,27 +432,40 @@ static void syscall_exit_event_notifier_unknown(
                struct pt_regs *regs, long id, long ret)
 {
        unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-       struct lttng_event_notifier *notifier;
+       struct lttng_kernel_event_common_private *event_priv;
 
        lttng_syscall_get_arguments(current, regs, args);
-       lttng_hlist_for_each_entry_rcu(notifier, unknown_dispatch_list_head, u.syscall.node) {
+       lttng_hlist_for_each_entry_rcu(event_priv, unknown_dispatch_list_head, u.syscall.node) {
+               struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                       container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+               struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
                if (unlikely(in_compat_syscall()))
-                       __event_notifier_probe__compat_syscall_exit_unknown(notifier, id, ret, args);
+                       __event_notifier_probe__compat_syscall_exit_unknown(event_notifier, id, ret, args);
                else
-                       __event_notifier_probe__syscall_exit_unknown(notifier, id, ret, args);
+                       __event_notifier_probe__syscall_exit_unknown(event_notifier, id, ret, args);
        }
 }
 
 static __always_inline
-void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
+void syscall_entry_call_func(struct hlist_head *action_list,
+               void *func, unsigned int nrargs,
                struct pt_regs *regs)
 {
+       struct lttng_kernel_event_common_private *event_priv;
+
        switch (nrargs) {
        case 0:
        {
                void (*fptr)(void *__data) = func;
 
-               fptr(data);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder);
+               }
                break;
        }
        case 1:
@@ -450,7 +474,13 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(data, args[0]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, args[0]);
+               }
                break;
        }
        case 2:
@@ -461,7 +491,13 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(data, args[0], args[1]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, args[0], args[1]);
+               }
                break;
        }
        case 3:
@@ -473,7 +509,13 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(data, args[0], args[1], args[2]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, args[0], args[1], args[2]);
+               }
                break;
        }
        case 4:
@@ -486,7 +528,13 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(data, args[0], args[1], args[2], args[3]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, args[0], args[1], args[2], args[3]);
+               }
                break;
        }
        case 5:
@@ -500,7 +548,13 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(data, args[0], args[1], args[2], args[3], args[4]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, args[0], args[1], args[2], args[3], args[4]);
+               }
                break;
        }
        case 6:
@@ -515,8 +569,14 @@ void syscall_entry_call_func(void *func, unsigned int nrargs, void *data,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(data, args[0], args[1], args[2],
-                       args[3], args[4], args[5]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, args[0], args[1], args[2],
+                            args[3], args[4], args[5]);
+               }
                break;
        }
        default:
@@ -528,15 +588,20 @@ static __always_inline
 void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                void *func, unsigned int nrargs, struct pt_regs *regs)
 {
-       struct lttng_event_notifier *notifier;
+       struct lttng_kernel_event_common_private *event_priv;
 
        switch (nrargs) {
        case 0:
        {
                void (*fptr)(void *__data) = func;
 
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier);
+               }
                break;
        }
        case 1:
@@ -545,8 +610,13 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, args[0]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, args[0]);
+               }
                break;
        }
        case 2:
@@ -557,8 +627,13 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, args[0], args[1]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, args[0], args[1]);
+               }
                break;
        }
        case 3:
@@ -570,8 +645,13 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, args[0], args[1], args[2]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, args[0], args[1], args[2]);
+               }
                break;
        }
        case 4:
@@ -584,8 +664,13 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, args[0], args[1], args[2], args[3]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, args[0], args[1], args[2], args[3]);
+               }
                break;
        }
        case 5:
@@ -599,8 +684,13 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, args[0], args[1], args[2], args[3], args[4]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, args[0], args[1], args[2], args[3], args[4]);
+               }
                break;
        }
        case 6:
@@ -615,8 +705,13 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, args[0], args[1], args[2], args[3], args[4], args[5]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, args[0], args[1], args[2], args[3], args[4], args[5]);
+               }
                break;
        }
        default:
@@ -627,7 +722,7 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
 {
        struct lttng_channel *chan = __data;
-       struct lttng_event *event, *unknown_event;
+       struct hlist_head *action_list, *unknown_action_list;
        const struct trace_syscall_entry *table, *entry;
        size_t table_len;
 
@@ -635,40 +730,45 @@ void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
                struct lttng_syscall_filter *filter = chan->sc_filter;
 
                if (id < 0 || id >= NR_compat_syscalls
-                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_compat_entry))) {
+                       || (!READ_ONCE(chan->syscall_all_entry) && !test_bit(id, filter->sc_compat_entry))) {
                        /* System call filtered out. */
                        return;
                }
                table = compat_sc_table;
                table_len = ARRAY_SIZE(compat_sc_table);
-               unknown_event = chan->sc_compat_unknown;
+               unknown_action_list = &chan->sc_compat_unknown;
        } else {
                struct lttng_syscall_filter *filter = chan->sc_filter;
 
                if (id < 0 || id >= NR_syscalls
-                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_entry))) {
+                       || (!READ_ONCE(chan->syscall_all_entry) && !test_bit(id, filter->sc_entry))) {
                        /* System call filtered out. */
                        return;
                }
                table = sc_table;
                table_len = ARRAY_SIZE(sc_table);
-               unknown_event = chan->sc_unknown;
+               unknown_action_list = &chan->sc_unknown;
        }
        if (unlikely(id < 0 || id >= table_len)) {
-               syscall_entry_event_unknown(unknown_event, regs, id);
+               syscall_entry_event_unknown(unknown_action_list, regs, id);
                return;
        }
-       if (unlikely(in_compat_syscall()))
-               event = chan->compat_sc_table[id];
-       else
-               event = chan->sc_table[id];
-       if (unlikely(!event)) {
-               syscall_entry_event_unknown(unknown_event, regs, id);
+
+       entry = &table[id];
+       if (!entry->event_func) {
+               syscall_entry_event_unknown(unknown_action_list, regs, id);
                return;
        }
-       entry = &table[id];
-       WARN_ON_ONCE(!entry->event_func);
-       syscall_entry_call_func(entry->event_func, entry->nrargs, event, regs);
+
+       if (unlikely(in_compat_syscall())) {
+               action_list = &chan->compat_sc_table[id];
+       } else {
+               action_list = &chan->sc_table[id];
+       }
+       if (unlikely(hlist_empty(action_list)))
+               return;
+
+       syscall_entry_call_func(action_list, entry->event_func, entry->nrargs, regs);
 }
 
 void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
@@ -730,83 +830,62 @@ void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
                        entry->event_notifier_func, entry->nrargs, regs);
 }
 
-static void syscall_exit_event_unknown(struct lttng_event *event,
+static void syscall_exit_event_unknown(struct hlist_head *unknown_action_list_head,
        struct pt_regs *regs, long id, long ret)
 {
        unsigned long args[LTTNG_SYSCALL_NR_ARGS];
+       struct lttng_kernel_event_common_private *event_priv;
 
        lttng_syscall_get_arguments(current, regs, args);
-       if (unlikely(in_compat_syscall()))
-               __event_probe__compat_syscall_exit_unknown(event, id, ret,
-                       args);
-       else
-               __event_probe__syscall_exit_unknown(event, id, ret, args);
+       lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
+               struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                       container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+               struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+               if (unlikely(in_compat_syscall()))
+                       __event_probe__compat_syscall_exit_unknown(event_recorder, id, ret,
+                               args);
+               else
+                       __event_probe__syscall_exit_unknown(event_recorder, id, ret, args);
+       }
 }
 
-void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
+static __always_inline
+void syscall_exit_call_func(struct hlist_head *action_list,
+               void *func, unsigned int nrargs,
+               struct pt_regs *regs, long ret)
 {
-       struct lttng_channel *chan = __data;
-       struct lttng_event *event, *unknown_event;
-       const struct trace_syscall_entry *table, *entry;
-       size_t table_len;
-       long id;
-
-       id = syscall_get_nr(current, regs);
-       if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter = chan->sc_filter;
-
-               if (id < 0 || id >= NR_compat_syscalls
-                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_compat_exit))) {
-                       /* System call filtered out. */
-                       return;
-               }
-               table = compat_sc_exit_table;
-               table_len = ARRAY_SIZE(compat_sc_exit_table);
-               unknown_event = chan->compat_sc_exit_unknown;
-       } else {
-               struct lttng_syscall_filter *filter = chan->sc_filter;
-
-               if (id < 0 || id >= NR_syscalls
-                       || (!READ_ONCE(chan->syscall_all) && !test_bit(id, filter->sc_exit))) {
-                       /* System call filtered out. */
-                       return;
-               }
-               table = sc_exit_table;
-               table_len = ARRAY_SIZE(sc_exit_table);
-               unknown_event = chan->sc_exit_unknown;
-       }
-       if (unlikely(id < 0 || id >= table_len)) {
-               syscall_exit_event_unknown(unknown_event, regs, id, ret);
-               return;
-       }
-       if (unlikely(in_compat_syscall()))
-               event = chan->compat_sc_exit_table[id];
-       else
-               event = chan->sc_exit_table[id];
-       if (unlikely(!event)) {
-               syscall_exit_event_unknown(unknown_event, regs, id, ret);
-               return;
-       }
-       entry = &table[id];
-       WARN_ON_ONCE(!entry->event_func);
+       struct lttng_kernel_event_common_private *event_priv;
 
-       switch (entry->nrargs) {
+       switch (nrargs) {
        case 0:
        {
-               void (*fptr)(void *__data, long ret) = entry->event_func;
+               void (*fptr)(void *__data, long ret) = func;
 
-               fptr(event, ret);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret);
+               }
                break;
        }
        case 1:
        {
                void (*fptr)(void *__data,
                        long ret,
-                       unsigned long arg0) = entry->event_func;
+                       unsigned long arg0) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, ret, args[0]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret, args[0]);
+               }
                break;
        }
        case 2:
@@ -814,11 +893,17 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
                void (*fptr)(void *__data,
                        long ret,
                        unsigned long arg0,
-                       unsigned long arg1) = entry->event_func;
+                       unsigned long arg1) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, ret, args[0], args[1]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret, args[0], args[1]);
+               }
                break;
        }
        case 3:
@@ -827,11 +912,17 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
                        long ret,
                        unsigned long arg0,
                        unsigned long arg1,
-                       unsigned long arg2) = entry->event_func;
+                       unsigned long arg2) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, ret, args[0], args[1], args[2]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret, args[0], args[1], args[2]);
+               }
                break;
        }
        case 4:
@@ -841,11 +932,17 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
                        unsigned long arg0,
                        unsigned long arg1,
                        unsigned long arg2,
-                       unsigned long arg3) = entry->event_func;
+                       unsigned long arg3) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, ret, args[0], args[1], args[2], args[3]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret, args[0], args[1], args[2], args[3]);
+               }
                break;
        }
        case 5:
@@ -856,11 +953,17 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
                        unsigned long arg1,
                        unsigned long arg2,
                        unsigned long arg3,
-                       unsigned long arg4) = entry->event_func;
+                       unsigned long arg4) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, ret, args[0], args[1], args[2], args[3], args[4]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret, args[0], args[1], args[2], args[3], args[4]);
+               }
                break;
        }
        case 6:
@@ -872,12 +975,18 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
                        unsigned long arg2,
                        unsigned long arg3,
                        unsigned long arg4,
-                       unsigned long arg5) = entry->event_func;
+                       unsigned long arg5) = func;
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               fptr(event, ret, args[0], args[1], args[2],
-                       args[3], args[4], args[5]);
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
+                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
+                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
+                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
+
+                       fptr(event_recorder, ret, args[0], args[1], args[2],
+                            args[3], args[4], args[5]);
+               }
                break;
        }
        default:
@@ -885,19 +994,80 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
        }
 }
 
+void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
+{
+       struct lttng_channel *chan = __data;
+       struct hlist_head *action_list, *unknown_action_list;
+       const struct trace_syscall_entry *table, *entry;
+       size_t table_len;
+       long id;
+
+       id = syscall_get_nr(current, regs);
+
+       if (unlikely(in_compat_syscall())) {
+               struct lttng_syscall_filter *filter = chan->sc_filter;
+
+               if (id < 0 || id >= NR_compat_syscalls
+                       || (!READ_ONCE(chan->syscall_all_exit) && !test_bit(id, filter->sc_compat_exit))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = compat_sc_exit_table;
+               table_len = ARRAY_SIZE(compat_sc_exit_table);
+               unknown_action_list = &chan->compat_sc_exit_unknown;
+       } else {
+               struct lttng_syscall_filter *filter = chan->sc_filter;
+
+               if (id < 0 || id >= NR_syscalls
+                       || (!READ_ONCE(chan->syscall_all_exit) && !test_bit(id, filter->sc_exit))) {
+                       /* System call filtered out. */
+                       return;
+               }
+               table = sc_exit_table;
+               table_len = ARRAY_SIZE(sc_exit_table);
+               unknown_action_list = &chan->sc_exit_unknown;
+       }
+       if (unlikely(id < 0 || id >= table_len)) {
+               syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
+               return;
+       }
+
+       entry = &table[id];
+       if (!entry->event_func) {
+               syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
+               return;
+       }
+
+       if (unlikely(in_compat_syscall())) {
+               action_list = &chan->compat_sc_exit_table[id];
+       } else {
+               action_list = &chan->sc_exit_table[id];
+       }
+       if (unlikely(hlist_empty(action_list)))
+               return;
+
+       syscall_exit_call_func(action_list, entry->event_func, entry->nrargs,
+                              regs, ret);
+}
+
 static __always_inline
 void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                void *func, unsigned int nrargs, struct pt_regs *regs, long ret)
 {
-       struct lttng_event_notifier *notifier;
+       struct lttng_kernel_event_common_private *event_priv;
 
        switch (nrargs) {
        case 0:
        {
                void (*fptr)(void *__data, long ret) = func;
 
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret);
+               }
                break;
        }
        case 1:
@@ -906,8 +1076,13 @@ void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret, args[0]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret, args[0]);
+               }
                break;
        }
        case 2:
@@ -919,8 +1094,13 @@ void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret, args[0], args[1]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret, args[0], args[1]);
+               }
                break;
        }
        case 3:
@@ -933,8 +1113,13 @@ void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret, args[0], args[1], args[2]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret, args[0], args[1], args[2]);
+               }
                break;
        }
        case 4:
@@ -948,8 +1133,13 @@ void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret, args[0], args[1], args[2], args[3]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret, args[0], args[1], args[2], args[3]);
+               }
                break;
        }
        case 5:
@@ -964,8 +1154,13 @@ void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret, args[0], args[1], args[2], args[3], args[4]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret, args[0], args[1], args[2], args[3], args[4]);
+               }
                break;
        }
        case 6:
@@ -981,8 +1176,13 @@ void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(notifier, dispatch_list, u.syscall.node)
-                       fptr(notifier, ret, args[0], args[1], args[2], args[3], args[4], args[5]);
+               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
+                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
+                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
+                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
+
+                       fptr(event_notifier, ret, args[0], args[1], args[2], args[3], args[4], args[5]);
+               }
                break;
        }
        default:
@@ -1057,62 +1257,79 @@ void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
  * Should be called with sessions lock held.
  */
 static
-int fill_event_table(const struct trace_syscall_entry *table, size_t table_len,
-       struct lttng_event **chan_table, struct lttng_channel *chan,
-       void *filter, enum sc_type type)
+int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *table, size_t table_len,
+       struct hlist_head *chan_table, struct lttng_event_enabler *event_enabler,
+       enum sc_type type)
 {
-       const struct lttng_event_desc *desc;
+       struct lttng_channel *chan = event_enabler->chan;
+       struct lttng_session *session = chan->session;
        unsigned int i;
 
-       /* Allocate events for each syscall, insert into table */
+       /* Allocate events for each syscall matching enabler, insert into table */
        for (i = 0; i < table_len; i++) {
-               struct lttng_kernel_event ev;
-               desc = table[i].desc;
+               const struct lttng_kernel_event_desc *desc = table[i].desc;
+               struct lttng_kernel_abi_event ev;
+               struct lttng_kernel_event_recorder_private *event_recorder_priv;
+               struct lttng_kernel_event_recorder *event_recorder;
+               struct hlist_head *head;
+               bool found = false;
 
                if (!desc) {
                        /* Unknown syscall */
                        continue;
                }
+               if (lttng_desc_match_enabler(desc,
+                               lttng_event_enabler_as_enabler(event_enabler)) <= 0)
+                       continue;
                /*
-                * Skip those already populated by previous failed
-                * register for this channel.
+                * Check if already created.
                 */
-               if (chan_table[i])
+               head = utils_borrow_hash_table_bucket(
+                       session->events_ht.table, LTTNG_EVENT_HT_SIZE,
+                       desc->event_name);
+               lttng_hlist_for_each_entry(event_recorder_priv, head, hlist) {
+                       if (event_recorder_priv->parent.desc == desc
+                               && event_recorder_priv->pub->chan == event_enabler->chan)
+                               found = true;
+               }
+               if (found)
                        continue;
+
+               /* We need to create an event for this syscall/enabler. */
                memset(&ev, 0, sizeof(ev));
                switch (type) {
                case SC_TYPE_ENTRY:
-                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+                       ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                        break;
                case SC_TYPE_EXIT:
-                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+                       ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                        break;
                case SC_TYPE_COMPAT_ENTRY:
-                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+                       ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                        break;
                case SC_TYPE_COMPAT_EXIT:
-                       ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-                       ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+                       ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                        break;
                }
-               strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN - 1);
-               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-               chan_table[i] = _lttng_event_create(chan, &ev, filter,
-                                               desc, ev.instrumentation);
-               WARN_ON_ONCE(!chan_table[i]);
-               if (IS_ERR(chan_table[i])) {
+               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1);
+               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc, ev.instrumentation);
+               WARN_ON_ONCE(!event_recorder);
+               if (IS_ERR(event_recorder)) {
                        /*
                         * If something goes wrong in event registration
                         * after the first one, we have no choice but to
                         * leave the previous events in there, until
                         * deleted by session teardown.
                         */
-                       return PTR_ERR(chan_table[i]);
+                       return PTR_ERR(event_recorder);
                }
+               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan_table[i]);
        }
        return 0;
 }
@@ -1120,23 +1337,24 @@ int fill_event_table(const struct trace_syscall_entry *table, size_t table_len,
 /*
  * Should be called with sessions lock held.
  */
-int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
+int lttng_syscalls_register_event(struct lttng_event_enabler *event_enabler)
 {
-       struct lttng_kernel_event ev;
+       struct lttng_channel *chan = event_enabler->chan;
+       struct lttng_kernel_abi_event ev;
        int ret;
 
        wrapper_vmalloc_sync_mappings();
 
        if (!chan->sc_table) {
                /* create syscall table mapping syscall to events */
-               chan->sc_table = kzalloc(sizeof(struct lttng_event *)
+               chan->sc_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
                                        * ARRAY_SIZE(sc_table), GFP_KERNEL);
                if (!chan->sc_table)
                        return -ENOMEM;
        }
        if (!chan->sc_exit_table) {
                /* create syscall table mapping syscall to events */
-               chan->sc_exit_table = kzalloc(sizeof(struct lttng_event *)
+               chan->sc_exit_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
                                        * ARRAY_SIZE(sc_exit_table), GFP_KERNEL);
                if (!chan->sc_exit_table)
                        return -ENOMEM;
@@ -1146,7 +1364,7 @@ int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
 #ifdef CONFIG_COMPAT
        if (!chan->compat_sc_table) {
                /* create syscall table mapping compat syscall to events */
-               chan->compat_sc_table = kzalloc(sizeof(struct lttng_event *)
+               chan->compat_sc_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
                                        * ARRAY_SIZE(compat_sc_table), GFP_KERNEL);
                if (!chan->compat_sc_table)
                        return -ENOMEM;
@@ -1154,105 +1372,108 @@ int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
 
        if (!chan->compat_sc_exit_table) {
                /* create syscall table mapping compat syscall to events */
-               chan->compat_sc_exit_table = kzalloc(sizeof(struct lttng_event *)
+               chan->compat_sc_exit_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
                                        * ARRAY_SIZE(compat_sc_exit_table), GFP_KERNEL);
                if (!chan->compat_sc_exit_table)
                        return -ENOMEM;
        }
 #endif
-       if (!chan->sc_unknown) {
-               const struct lttng_event_desc *desc =
+       if (hlist_empty(&chan->sc_unknown)) {
+               const struct lttng_kernel_event_desc *desc =
                        &__event_desc___syscall_entry_unknown;
+               struct lttng_kernel_event_recorder *event_recorder;
 
                memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
-               chan->sc_unknown = _lttng_event_create(chan, &ev, filter,
-                                               desc,
-                                               ev.instrumentation);
-               WARN_ON_ONCE(!chan->sc_unknown);
-               if (IS_ERR(chan->sc_unknown)) {
-                       return PTR_ERR(chan->sc_unknown);
+               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+                                           ev.instrumentation);
+               WARN_ON_ONCE(!event_recorder);
+               if (IS_ERR(event_recorder)) {
+                       return PTR_ERR(event_recorder);
                }
+               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_unknown);
        }
 
-       if (!chan->sc_compat_unknown) {
-               const struct lttng_event_desc *desc =
+       if (hlist_empty(&chan->sc_compat_unknown)) {
+               const struct lttng_kernel_event_desc *desc =
                        &__event_desc___compat_syscall_entry_unknown;
+               struct lttng_kernel_event_recorder *event_recorder;
 
                memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
-               chan->sc_compat_unknown = _lttng_event_create(chan, &ev, filter,
-                                               desc,
-                                               ev.instrumentation);
-               WARN_ON_ONCE(!chan->sc_unknown);
-               if (IS_ERR(chan->sc_compat_unknown)) {
-                       return PTR_ERR(chan->sc_compat_unknown);
+               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+                                           ev.instrumentation);
+               WARN_ON_ONCE(!event_recorder);
+               if (IS_ERR(event_recorder)) {
+                       return PTR_ERR(event_recorder);
                }
+               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_compat_unknown);
        }
 
-       if (!chan->compat_sc_exit_unknown) {
-               const struct lttng_event_desc *desc =
+       if (hlist_empty(&chan->compat_sc_exit_unknown)) {
+               const struct lttng_kernel_event_desc *desc =
                        &__event_desc___compat_syscall_exit_unknown;
+               struct lttng_kernel_event_recorder *event_recorder;
 
                memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
-               chan->compat_sc_exit_unknown = _lttng_event_create(chan, &ev,
-                                               filter, desc,
-                                               ev.instrumentation);
-               WARN_ON_ONCE(!chan->compat_sc_exit_unknown);
-               if (IS_ERR(chan->compat_sc_exit_unknown)) {
-                       return PTR_ERR(chan->compat_sc_exit_unknown);
+               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+                                           ev.instrumentation);
+               WARN_ON_ONCE(!event_recorder);
+               if (IS_ERR(event_recorder)) {
+                       return PTR_ERR(event_recorder);
                }
+               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->compat_sc_exit_unknown);
        }
 
-       if (!chan->sc_exit_unknown) {
-               const struct lttng_event_desc *desc =
+       if (hlist_empty(&chan->sc_exit_unknown)) {
+               const struct lttng_kernel_event_desc *desc =
                        &__event_desc___syscall_exit_unknown;
+               struct lttng_kernel_event_recorder *event_recorder;
 
                memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->name, LTTNG_KERNEL_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-               ev.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
-               chan->sc_exit_unknown = _lttng_event_create(chan, &ev, filter,
-                                               desc, ev.instrumentation);
-               WARN_ON_ONCE(!chan->sc_exit_unknown);
-               if (IS_ERR(chan->sc_exit_unknown)) {
-                       return PTR_ERR(chan->sc_exit_unknown);
+               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
+               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
+                                           ev.instrumentation);
+               WARN_ON_ONCE(!event_recorder);
+               if (IS_ERR(event_recorder)) {
+                       return PTR_ERR(event_recorder);
                }
+               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_exit_unknown);
        }
 
-       ret = fill_event_table(sc_table, ARRAY_SIZE(sc_table),
-                       chan->sc_table, chan, filter, SC_TYPE_ENTRY);
+       ret = lttng_create_syscall_event_if_missing(sc_table, ARRAY_SIZE(sc_table),
+                       chan->sc_table, event_enabler, SC_TYPE_ENTRY);
        if (ret)
                return ret;
-       ret = fill_event_table(sc_exit_table, ARRAY_SIZE(sc_exit_table),
-                       chan->sc_exit_table, chan, filter, SC_TYPE_EXIT);
+       ret = lttng_create_syscall_event_if_missing(sc_exit_table, ARRAY_SIZE(sc_exit_table),
+                       chan->sc_exit_table, event_enabler, SC_TYPE_EXIT);
        if (ret)
                return ret;
 
 #ifdef CONFIG_COMPAT
-       ret = fill_event_table(compat_sc_table, ARRAY_SIZE(compat_sc_table),
-                       chan->compat_sc_table, chan, filter,
-                       SC_TYPE_COMPAT_ENTRY);
+       ret = lttng_create_syscall_event_if_missing(compat_sc_table, ARRAY_SIZE(compat_sc_table),
+                       chan->compat_sc_table, event_enabler, SC_TYPE_COMPAT_ENTRY);
        if (ret)
                return ret;
-       ret = fill_event_table(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
-                       chan->compat_sc_exit_table, chan, filter,
-                       SC_TYPE_COMPAT_EXIT);
+       ret = lttng_create_syscall_event_if_missing(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
+                       chan->compat_sc_exit_table, event_enabler, SC_TYPE_COMPAT_EXIT);
        if (ret)
                return ret;
 #endif
@@ -1292,8 +1513,7 @@ int lttng_syscalls_register_event(struct lttng_channel *chan, void *filter)
  * Should be called with sessions lock held.
  */
 int lttng_syscalls_register_event_notifier(
-               struct lttng_event_notifier_enabler *event_notifier_enabler,
-               void *filter)
+               struct lttng_event_notifier_enabler *event_notifier_enabler)
 {
        struct lttng_event_notifier_group *group = event_notifier_enabler->group;
        unsigned int i;
@@ -1397,44 +1617,46 @@ int create_unknown_event_notifier(
                struct lttng_event_notifier_enabler *event_notifier_enabler,
                enum sc_type type)
 {
-       struct lttng_event_notifier *notifier;
-       const struct lttng_event_desc *desc;
+       struct lttng_kernel_event_notifier_private *event_notifier_priv;
+       struct lttng_kernel_event_notifier *event_notifier;
+       const struct lttng_kernel_event_desc *desc;
        struct lttng_event_notifier_group *group = event_notifier_enabler->group;
-       struct lttng_kernel_event_notifier event_notifier_param;
+       struct lttng_kernel_abi_event_notifier event_notifier_param;
        uint64_t user_token = event_notifier_enabler->base.user_token;
+       uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
        struct lttng_enabler *base_enabler = lttng_event_notifier_enabler_as_enabler(
                event_notifier_enabler);
        struct hlist_head *unknown_dispatch_list;
        int ret = 0;
        bool found = false;
-       enum lttng_kernel_syscall_abi abi;
-       enum lttng_kernel_syscall_entryexit entryexit;
+       enum lttng_kernel_abi_syscall_abi abi;
+       enum lttng_kernel_abi_syscall_entryexit entryexit;
        struct hlist_head *head;
 
        switch (type) {
        case SC_TYPE_ENTRY:
                desc = &__event_desc___syscall_entry_unknown;
                unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-               abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+               entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                break;
        case SC_TYPE_EXIT:
                desc = &__event_desc___syscall_exit_unknown;
                unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-               abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+               entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                break;
        case SC_TYPE_COMPAT_ENTRY:
                desc = &__event_desc___compat_syscall_entry_unknown;
                unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-               abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+               entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                break;
        case SC_TYPE_COMPAT_EXIT:
                desc = &__event_desc___compat_syscall_exit_unknown;
                unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-               abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+               entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                break;
        default:
                BUG_ON(1);
@@ -1444,36 +1666,36 @@ int create_unknown_event_notifier(
         * Check if already created.
         */
        head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
-               LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->name);
-       lttng_hlist_for_each_entry(notifier, head, hlist) {
-               if (notifier->desc == desc &&
-                               notifier->user_token == base_enabler->user_token)
+               LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
+       lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
+               if (event_notifier_priv->parent.desc == desc &&
+                               event_notifier_priv->parent.user_token == base_enabler->user_token)
                        found = true;
        }
        if (found)
                goto end;
 
        memset(&event_notifier_param, 0, sizeof(event_notifier_param));
-       strncat(event_notifier_param.event.name, desc->name,
-               LTTNG_KERNEL_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+       strncat(event_notifier_param.event.name, desc->event_name,
+               LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
 
-       event_notifier_param.event.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
+       event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 
-       event_notifier_param.event.instrumentation = LTTNG_KERNEL_SYSCALL;
+       event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
        event_notifier_param.event.u.syscall.abi = abi;
        event_notifier_param.event.u.syscall.entryexit = entryexit;
 
-       notifier = _lttng_event_notifier_create(desc, user_token,
-               group, &event_notifier_param, NULL,
+       event_notifier = _lttng_event_notifier_create(desc, user_token,
+               error_counter_index, group, &event_notifier_param,
                event_notifier_param.event.instrumentation);
-       if (IS_ERR(notifier)) {
+       if (IS_ERR(event_notifier)) {
                printk(KERN_INFO "Unable to create unknown notifier %s\n",
-                       desc->name);
+                       desc->event_name);
                ret = -ENOMEM;
                goto end;
        }
 
-       hlist_add_head_rcu(&notifier->u.syscall.node, unknown_dispatch_list);
+       hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, unknown_dispatch_list);
 
 end:
        return ret;
@@ -1481,19 +1703,21 @@ end:
 
 static int create_matching_event_notifiers(
                struct lttng_event_notifier_enabler *event_notifier_enabler,
-               void *filter, const struct trace_syscall_entry *table,
+               const struct trace_syscall_entry *table,
                size_t table_len, enum sc_type type)
 {
        struct lttng_event_notifier_group *group = event_notifier_enabler->group;
-       const struct lttng_event_desc *desc;
+       const struct lttng_kernel_event_desc *desc;
        uint64_t user_token = event_notifier_enabler->base.user_token;
+       uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
        unsigned int i;
        int ret = 0;
 
        /* iterate over all syscall and create event_notifier that match */
        for (i = 0; i < table_len; i++) {
-               struct lttng_event_notifier *event_notifier;
-               struct lttng_kernel_event_notifier event_notifier_param;
+               struct lttng_kernel_event_notifier_private *event_notifier_priv;
+               struct lttng_kernel_event_notifier *event_notifier;
+               struct lttng_kernel_abi_event_notifier event_notifier_param;
                struct hlist_head *head;
                int found = 0;
 
@@ -1511,10 +1735,10 @@ static int create_matching_event_notifiers(
                 * Check if already created.
                 */
                head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
-                       LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->name);
-               lttng_hlist_for_each_entry(event_notifier, head, hlist) {
-                       if (event_notifier->desc == desc
-                               && event_notifier->user_token == event_notifier_enabler->base.user_token)
+                       LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
+               lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
+                       if (event_notifier_priv->parent.desc == desc
+                               && event_notifier_priv->parent.user_token == event_notifier_enabler->base.user_token)
                                found = 1;
                }
                if (found)
@@ -1523,38 +1747,38 @@ static int create_matching_event_notifiers(
                memset(&event_notifier_param, 0, sizeof(event_notifier_param));
                switch (type) {
                case SC_TYPE_ENTRY:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                        break;
                case SC_TYPE_EXIT:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_NATIVE;
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                        break;
                case SC_TYPE_COMPAT_ENTRY:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_ENTRY;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                        break;
                case SC_TYPE_COMPAT_EXIT:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_SYSCALL_EXIT;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_SYSCALL_ABI_COMPAT;
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                        break;
                }
-               strncat(event_notifier_param.event.name, desc->name,
-                       LTTNG_KERNEL_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
-               event_notifier_param.event.name[LTTNG_KERNEL_SYM_NAME_LEN - 1] = '\0';
-               event_notifier_param.event.instrumentation = LTTNG_KERNEL_SYSCALL;
+               strncat(event_notifier_param.event.name, desc->event_name,
+                       LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+               event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 
-               event_notifier = _lttng_event_notifier_create(desc, user_token, group,
-                       &event_notifier_param, filter,
+               event_notifier = _lttng_event_notifier_create(desc, user_token,
+                       error_counter_index, group, &event_notifier_param,
                        event_notifier_param.event.instrumentation);
                if (IS_ERR(event_notifier)) {
                        printk(KERN_INFO "Unable to create event_notifier %s\n",
-                               desc->name);
+                               desc->event_name);
                        ret = -ENOMEM;
                        goto end;
                }
 
-               event_notifier->u.syscall.syscall_id = i;
+               event_notifier->priv->parent.u.syscall.syscall_id = i;
        }
 
 end:
@@ -1562,24 +1786,23 @@ end:
 
 }
 
-int lttng_syscals_create_matching_event_notifiers(
-               struct lttng_event_notifier_enabler *event_notifier_enabler,
-               void *filter)
+int lttng_syscalls_create_matching_event_notifiers(
+               struct lttng_event_notifier_enabler *event_notifier_enabler)
 {
        int ret;
        struct lttng_enabler *base_enabler =
                        lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
-       enum lttng_kernel_syscall_entryexit entryexit =
+       enum lttng_kernel_abi_syscall_entryexit entryexit =
                        base_enabler->event_param.u.syscall.entryexit;
 
-       if (entryexit == LTTNG_KERNEL_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT) {
+       if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
                ret = create_matching_event_notifiers(event_notifier_enabler,
-                       filter, sc_table, ARRAY_SIZE(sc_table), SC_TYPE_ENTRY);
+                       sc_table, ARRAY_SIZE(sc_table), SC_TYPE_ENTRY);
                if (ret)
                        goto end;
 
                ret = create_matching_event_notifiers(event_notifier_enabler,
-                       filter, compat_sc_table, ARRAY_SIZE(compat_sc_table),
+                       compat_sc_table, ARRAY_SIZE(compat_sc_table),
                        SC_TYPE_COMPAT_ENTRY);
                if (ret)
                        goto end;
@@ -1595,9 +1818,9 @@ int lttng_syscals_create_matching_event_notifiers(
                        goto end;
        }
 
-       if (entryexit == LTTNG_KERNEL_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_SYSCALL_ENTRYEXIT) {
+       if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
                ret = create_matching_event_notifiers(event_notifier_enabler,
-                       filter, sc_exit_table, ARRAY_SIZE(sc_exit_table),
+                       sc_exit_table, ARRAY_SIZE(sc_exit_table),
                        SC_TYPE_EXIT);
                if (ret)
                        goto end;
@@ -1608,7 +1831,7 @@ int lttng_syscals_create_matching_event_notifiers(
                        goto end;
 
                ret = create_matching_event_notifiers(event_notifier_enabler,
-                       filter, compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
+                       compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
                        SC_TYPE_COMPAT_EXIT);
                if (ret)
                        goto end;
@@ -1626,7 +1849,7 @@ end:
 /*
  * Unregister the syscall event_notifier probes from the callsites.
  */
-int lttng_syscalls_unregister_event_notifier(
+int lttng_syscalls_unregister_event_notifier_group(
                struct lttng_event_notifier_group *event_notifier_group)
 {
        int ret;
@@ -1660,7 +1883,7 @@ int lttng_syscalls_unregister_event_notifier(
        return 0;
 }
 
-int lttng_syscalls_unregister_event(struct lttng_channel *chan)
+int lttng_syscalls_unregister_channel(struct lttng_channel *chan)
 {
        int ret;
 
@@ -1708,7 +1931,7 @@ int get_syscall_nr(const char *syscall_name)
                entry = &sc_table[i];
                if (!entry->desc)
                        continue;
-               it_name = entry->desc->name;
+               it_name = entry->desc->event_name;
                it_name += strlen(SYSCALL_ENTRY_STR);
                if (!strcmp(syscall_name, it_name)) {
                        syscall_nr = i;
@@ -1731,7 +1954,7 @@ int get_compat_syscall_nr(const char *syscall_name)
                entry = &compat_sc_table[i];
                if (!entry->desc)
                        continue;
-               it_name = entry->desc->name;
+               it_name = entry->desc->event_name;
                it_name += strlen(COMPAT_SYSCALL_ENTRY_STR);
                if (!strcmp(syscall_name, it_name)) {
                        syscall_nr = i;
@@ -1841,46 +2064,56 @@ int lttng_syscall_filter_enable(
 }
 
 int lttng_syscall_filter_enable_event_notifier(
-               struct lttng_event_notifier *notifier)
+               struct lttng_kernel_event_notifier *event_notifier)
 {
-       struct lttng_event_notifier_group *group = notifier->group;
-       unsigned int syscall_id = notifier->u.syscall.syscall_id;
+       struct lttng_event_notifier_group *group = event_notifier->priv->group;
+       unsigned int syscall_id = event_notifier->priv->parent.u.syscall.syscall_id;
        struct hlist_head *dispatch_list;
        int ret = 0;
 
-       WARN_ON_ONCE(notifier->instrumentation != LTTNG_KERNEL_SYSCALL);
+       WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
 
        ret = lttng_syscall_filter_enable(group->sc_filter,
-               notifier->desc->name, notifier->u.syscall.abi,
-               notifier->u.syscall.entryexit);
+               event_notifier->priv->parent.desc->event_name,
+               event_notifier->priv->parent.u.syscall.abi,
+               event_notifier->priv->parent.u.syscall.entryexit);
        if (ret) {
                goto end;
        }
 
-       switch (notifier->u.syscall.entryexit) {
+       switch (event_notifier->priv->parent.u.syscall.entryexit) {
        case LTTNG_SYSCALL_ENTRY:
-               switch (notifier->u.syscall.abi) {
+               switch (event_notifier->priv->parent.u.syscall.abi) {
                case LTTNG_SYSCALL_ABI_NATIVE:
                        dispatch_list = &group->event_notifier_syscall_dispatch[syscall_id];
                        break;
                case LTTNG_SYSCALL_ABI_COMPAT:
                        dispatch_list = &group->event_notifier_compat_syscall_dispatch[syscall_id];
                        break;
+               default:
+                       ret = -EINVAL;
+                       goto end;
                }
                break;
        case LTTNG_SYSCALL_EXIT:
-               switch (notifier->u.syscall.abi) {
+               switch (event_notifier->priv->parent.u.syscall.abi) {
                case LTTNG_SYSCALL_ABI_NATIVE:
                        dispatch_list = &group->event_notifier_exit_syscall_dispatch[syscall_id];
                        break;
                case LTTNG_SYSCALL_ABI_COMPAT:
                        dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[syscall_id];
                        break;
+               default:
+                       ret = -EINVAL;
+                       goto end;
                }
                break;
+       default:
+               ret = -EINVAL;
+               goto end;
        }
 
-       hlist_add_head_rcu(&notifier->u.syscall.node, dispatch_list);
+       hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, dispatch_list);
 
 end:
        return ret ;
@@ -1888,13 +2121,14 @@ end:
 
 int lttng_syscall_filter_enable_event(
                struct lttng_channel *channel,
-               struct lttng_event *event)
+               struct lttng_kernel_event_recorder *event_recorder)
 {
-       WARN_ON_ONCE(event->instrumentation != LTTNG_KERNEL_SYSCALL);
+       WARN_ON_ONCE(event_recorder->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
 
        return lttng_syscall_filter_enable(channel->sc_filter,
-               event->desc->name, event->u.syscall.abi,
-               event->u.syscall.entryexit);
+               event_recorder->priv->parent.desc->event_name,
+               event_recorder->priv->parent.u.syscall.abi,
+               event_recorder->priv->parent.u.syscall.entryexit);
 }
 
 static
@@ -1958,29 +2192,31 @@ int lttng_syscall_filter_disable(
 }
 
 int lttng_syscall_filter_disable_event_notifier(
-               struct lttng_event_notifier *notifier)
+               struct lttng_kernel_event_notifier *event_notifier)
 {
-       struct lttng_event_notifier_group *group = notifier->group;
+       struct lttng_event_notifier_group *group = event_notifier->priv->group;
        int ret;
 
-       WARN_ON_ONCE(notifier->instrumentation != LTTNG_KERNEL_SYSCALL);
+       WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
 
        ret = lttng_syscall_filter_disable(group->sc_filter,
-               notifier->desc->name, notifier->u.syscall.abi,
-               notifier->u.syscall.entryexit);
+               event_notifier->priv->parent.desc->event_name,
+               event_notifier->priv->parent.u.syscall.abi,
+               event_notifier->priv->parent.u.syscall.entryexit);
        WARN_ON_ONCE(ret != 0);
 
-       hlist_del_rcu(&notifier->u.syscall.node);
+       hlist_del_rcu(&event_notifier->priv->parent.u.syscall.node);
        return 0;
 }
 
 int lttng_syscall_filter_disable_event(
                struct lttng_channel *channel,
-               struct lttng_event *event)
+               struct lttng_kernel_event_recorder *event_recorder)
 {
        return lttng_syscall_filter_disable(channel->sc_filter,
-               event->desc->name, event->u.syscall.abi,
-               event->u.syscall.entryexit);
+               event_recorder->priv->parent.desc->event_name,
+               event_recorder->priv->parent.u.syscall.abi,
+               event_recorder->priv->parent.u.syscall.entryexit);
 }
 
 static
@@ -2062,10 +2298,10 @@ int syscall_list_show(struct seq_file *m, void *p)
                return 0;
        if (table == sc_table) {
                index = entry - table;
-               name = &entry->desc->name[strlen(SYSCALL_ENTRY_STR)];
+               name = &entry->desc->event_name[strlen(SYSCALL_ENTRY_STR)];
        } else {
                index = (entry - table) + ARRAY_SIZE(sc_table);
-               name = &entry->desc->name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
+               name = &entry->desc->event_name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
        }
        seq_printf(m,   "syscall { index = %lu; name = %s; bitness = %u; };\n",
                index, name, bitness);
@@ -2098,7 +2334,7 @@ const struct file_operations lttng_syscall_list_fops = {
  * A syscall is enabled if it is traced for either entry or exit.
  */
 long lttng_channel_syscall_mask(struct lttng_channel *channel,
-               struct lttng_kernel_syscall_mask __user *usyscall_mask)
+               struct lttng_kernel_abi_syscall_mask __user *usyscall_mask)
 {
        uint32_t len, sc_tables_len, bitmask_len;
        int ret = 0, bit;
@@ -2123,7 +2359,8 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
                char state;
 
                if (channel->sc_table) {
-                       if (!READ_ONCE(channel->syscall_all) && filter)
+                       if (!(READ_ONCE(channel->syscall_all_entry)
+                                       || READ_ONCE(channel->syscall_all_exit)) && filter)
                                state = test_bit(bit, filter->sc_entry)
                                        || test_bit(bit, filter->sc_exit);
                        else
@@ -2137,7 +2374,8 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
                char state;
 
                if (channel->compat_sc_table) {
-                       if (!READ_ONCE(channel->syscall_all) && filter)
+                       if (!(READ_ONCE(channel->syscall_all_entry)
+                                       || READ_ONCE(channel->syscall_all_exit)) && filter)
                                state = test_bit(bit - ARRAY_SIZE(sc_table),
                                                filter->sc_compat_entry)
                                        || test_bit(bit - ARRAY_SIZE(sc_table),
This page took 0.046672 seconds and 4 git commands to generate.