Rename "tsc" to "timestamp"
[lttng-modules.git] / src / lttng-syscalls.c
index d4914037392219e38bd5a29be2bace941b7a288c..5ec6be5a498514375a17bd54669096fd37471709 100644 (file)
 
 #include <lttng/bitfield.h>
 #include <wrapper/tracepoint.h>
-#include <wrapper/file.h>
 #include <wrapper/rcu.h>
 #include <wrapper/syscall.h>
+#include <wrapper/limits.h>
 #include <lttng/events.h>
+#include <lttng/events-internal.h>
 #include <lttng/utils.h>
+#include <lttng/kernel-version.h>
+
+#include "lttng-syscalls.h"
 
 #ifndef CONFIG_COMPAT
 # ifndef is_compat_task
 
 /* in_compat_syscall appears in kernel 4.6. */
 #ifndef in_compat_syscall
- #define in_compat_syscall()   is_compat_task()
+# define in_compat_syscall()   is_compat_task()
+#endif
+
+/* in_x32_syscall appears in kernel 4.7. */
+#if (LTTNG_LINUX_VERSION_CODE < LTTNG_KERNEL_VERSION(4,7,0))
+# ifdef CONFIG_X86_X32_ABI
+#  define in_x32_syscall()     is_x32_task()
+# endif
 #endif
 
 enum sc_type {
@@ -59,42 +70,9 @@ enum sc_type {
 #define SYSCALL_EXIT_STR               __stringify(SYSCALL_EXIT_TOK)
 #define COMPAT_SYSCALL_EXIT_STR                __stringify(COMPAT_SYSCALL_EXIT_TOK)
 
-static
 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id);
-static
 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret);
 
-static
-void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
-               long id);
-static
-void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
-               long ret);
-
-/*
- * Forward declarations for old kernels.
- */
-struct mmsghdr;
-struct rlimit64;
-struct oldold_utsname;
-struct old_utsname;
-struct sel_arg_struct;
-struct mmap_arg_struct;
-struct file_handle;
-struct user_msghdr;
-
-/*
- * Forward declaration for kernels >= 5.6
- */
-struct timex;
-struct timeval;
-struct itimerval;
-struct itimerspec;
-
-#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(5,6,0))
-typedef __kernel_old_time_t time_t;
-#endif
-
 #ifdef IA32_NR_syscalls
 #define NR_compat_syscalls IA32_NR_syscalls
 #else
@@ -107,275 +85,25 @@ typedef __kernel_old_time_t time_t;
 #define LTTNG_PACKAGE_BUILD
 #define CREATE_TRACE_POINTS
 #define TP_MODULE_NOINIT
-#define TRACE_INCLUDE_PATH instrumentation/syscalls/headers
+#define TRACE_INCLUDE_PATH instrumentation/syscalls
 
 #define PARAMS(args...)        args
 
 /* Handle unknown syscalls */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM syscalls_unknown
-#include <instrumentation/syscalls/headers/syscalls_unknown.h>
+#include <instrumentation/syscalls/syscalls_unknown.h>
 #undef TRACE_SYSTEM
 
-#define SC_ENTER
-
-#undef sc_exit
-#define sc_exit(...)
-#undef sc_in
-#define sc_in(...)     __VA_ARGS__
-#undef sc_out
-#define sc_out(...)
-#undef sc_inout
-#define sc_inout(...)  __VA_ARGS__
-
-/* Hijack probe callback for system call enter */
-#undef TP_PROBE_CB
-#define TP_PROBE_CB(_template)         &syscall_entry_event_probe
-#define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
-       LTTNG_TRACEPOINT_EVENT(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
-       LTTNG_TRACEPOINT_EVENT_CODE(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_locvar), PARAMS(_code_pre),                             \
-               PARAMS(_fields), PARAMS(_code_post))
-#define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
-       LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_entry_##_name, PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name)            \
-       LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_entry_##_template, syscall_entry_##_name)
-/* Enumerations only defined at first inclusion. */
-#define SC_LTTNG_TRACEPOINT_ENUM(_name, _values) \
-       LTTNG_TRACEPOINT_ENUM(_name, PARAMS(_values))
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM syscall_entry_integers
-#define TRACE_INCLUDE_FILE syscalls_integers
-#include <instrumentation/syscalls/headers/syscalls_integers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM syscall_entry_pointers
-#define TRACE_INCLUDE_FILE syscalls_pointers
-#include <instrumentation/syscalls/headers/syscalls_pointers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#undef SC_LTTNG_TRACEPOINT_ENUM
-#undef SC_LTTNG_TRACEPOINT_EVENT_CODE
-#undef SC_LTTNG_TRACEPOINT_EVENT
-#undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
-#undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
-#undef TP_PROBE_CB
-#undef _TRACE_SYSCALLS_INTEGERS_H
-#undef _TRACE_SYSCALLS_POINTERS_H
-
-/* Hijack probe callback for compat system call enter */
-#define TP_PROBE_CB(_template)         &syscall_entry_event_probe
-#define LTTNG_SC_COMPAT
-#define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
-       LTTNG_TRACEPOINT_EVENT(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
-       LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
-#define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
-       LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_entry_##_name, PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name)            \
-       LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_entry_##_template, \
-               compat_syscall_entry_##_name)
-/* Enumerations only defined at inital inclusion (not here). */
-#define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
-#define TRACE_SYSTEM compat_syscall_entry_integers
-#define TRACE_INCLUDE_FILE compat_syscalls_integers
-#include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM compat_syscall_entry_pointers
-#define TRACE_INCLUDE_FILE compat_syscalls_pointers
-#include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#undef SC_LTTNG_TRACEPOINT_ENUM
-#undef SC_LTTNG_TRACEPOINT_EVENT_CODE
-#undef SC_LTTNG_TRACEPOINT_EVENT
-#undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
-#undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
-#undef TP_PROBE_CB
-#undef _TRACE_SYSCALLS_INTEGERS_H
-#undef _TRACE_SYSCALLS_POINTERS_H
-#undef LTTNG_SC_COMPAT
-
-#undef SC_ENTER
-
-#define SC_EXIT
-
-#undef sc_exit
-#define sc_exit(...)           __VA_ARGS__
-#undef sc_in
-#define sc_in(...)
-#undef sc_out
-#define sc_out(...)            __VA_ARGS__
-#undef sc_inout
-#define sc_inout(...)          __VA_ARGS__
-
-/* Hijack probe callback for system call exit */
-#define TP_PROBE_CB(_template)         &syscall_exit_event_probe
-#define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
-       LTTNG_TRACEPOINT_EVENT(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
-       LTTNG_TRACEPOINT_EVENT_CODE(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
-#define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
-       LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_exit_##_name, PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name)            \
-       LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_exit_##_template,        \
-               syscall_exit_##_name)
-/* Enumerations only defined at inital inclusion (not here). */
-#define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
-#define TRACE_SYSTEM syscall_exit_integers
-#define TRACE_INCLUDE_FILE syscalls_integers
-#include <instrumentation/syscalls/headers/syscalls_integers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM syscall_exit_pointers
-#define TRACE_INCLUDE_FILE syscalls_pointers
-#include <instrumentation/syscalls/headers/syscalls_pointers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#undef SC_LTTNG_TRACEPOINT_ENUM
-#undef SC_LTTNG_TRACEPOINT_EVENT_CODE
-#undef SC_LTTNG_TRACEPOINT_EVENT
-#undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
-#undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
-#undef TP_PROBE_CB
-#undef _TRACE_SYSCALLS_INTEGERS_H
-#undef _TRACE_SYSCALLS_POINTERS_H
-
-
-/* Hijack probe callback for compat system call exit */
-#define TP_PROBE_CB(_template)         &syscall_exit_event_probe
-#define LTTNG_SC_COMPAT
-#define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
-       LTTNG_TRACEPOINT_EVENT(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
-       LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
-               PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
-#define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
-       LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_exit_##_name, PARAMS(_fields))
-#define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name)            \
-       LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_exit_##_template, \
-               compat_syscall_exit_##_name)
-/* Enumerations only defined at inital inclusion (not here). */
-#define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
-#define TRACE_SYSTEM compat_syscall_exit_integers
-#define TRACE_INCLUDE_FILE compat_syscalls_integers
-#include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM compat_syscall_exit_pointers
-#define TRACE_INCLUDE_FILE compat_syscalls_pointers
-#include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
-#undef TRACE_INCLUDE_FILE
-#undef TRACE_SYSTEM
-#undef SC_LTTNG_TRACEPOINT_ENUM
-#undef SC_LTTNG_TRACEPOINT_EVENT_CODE
-#undef SC_LTTNG_TRACEPOINT_EVENT
-#undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
-#undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
 #undef TP_PROBE_CB
-#undef _TRACE_SYSCALLS_INTEGERS_H
-#undef _TRACE_SYSCALLS_POINTERS_H
-#undef LTTNG_SC_COMPAT
 
-#undef SC_EXIT
-
-#undef TP_MODULE_NOINIT
-#undef LTTNG_PACKAGE_BUILD
-#undef CREATE_TRACE_POINTS
-
-struct trace_syscall_entry {
-       void *event_func;
-       void *event_notifier_func;
-       const struct lttng_kernel_event_desc *desc;
-       const struct lttng_kernel_event_field **fields;
-       unsigned int nrargs;
-};
-
-#define CREATE_SYSCALL_TABLE
-
-#define SC_ENTER
-
-#undef sc_exit
-#define sc_exit(...)
-
-#undef TRACE_SYSCALL_TABLE
-#define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
-       [ _nr ] = {                                             \
-               .event_func = __event_probe__syscall_entry_##_template, \
-               .event_notifier_func = __event_notifier_probe__syscall_entry_##_template, \
-               .nrargs = (_nrargs),                            \
-               .fields = __event_fields___syscall_entry_##_template, \
-               .desc = &__event_desc___syscall_entry_##_name,  \
-       },
-
-/* Event syscall enter tracing table */
-static const struct trace_syscall_entry sc_table[] = {
-#include <instrumentation/syscalls/headers/syscalls_integers.h>
-#include <instrumentation/syscalls/headers/syscalls_pointers.h>
-};
-
-#undef TRACE_SYSCALL_TABLE
-#define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
-       [ _nr ] = {                                             \
-               .event_func = __event_probe__compat_syscall_entry_##_template, \
-               .event_notifier_func = __event_notifier_probe__compat_syscall_entry_##_template, \
-               .nrargs = (_nrargs),                            \
-               .fields = __event_fields___compat_syscall_entry_##_template, \
-               .desc = &__event_desc___compat_syscall_entry_##_name, \
-       },
-
-/* Event compat syscall enter table */
-const struct trace_syscall_entry compat_sc_table[] = {
-#include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
-#include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
-};
-
-#undef SC_ENTER
-
-#define SC_EXIT
-
-#undef sc_exit
-#define sc_exit(...)           __VA_ARGS__
-
-#undef TRACE_SYSCALL_TABLE
-#define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
-       [ _nr ] = {                                             \
-               .event_func = __event_probe__syscall_exit_##_template, \
-               .event_notifier_func = __event_notifier_probe__syscall_exit_##_template, \
-               .nrargs = (_nrargs),                            \
-               .fields = __event_fields___syscall_exit_##_template, \
-               .desc = &__event_desc___syscall_exit_##_name, \
-       },
+extern const struct trace_syscall_table sc_table;
+extern const struct trace_syscall_table compat_sc_table;
 
 /* Event syscall exit table */
-static const struct trace_syscall_entry sc_exit_table[] = {
-#include <instrumentation/syscalls/headers/syscalls_integers.h>
-#include <instrumentation/syscalls/headers/syscalls_pointers.h>
-};
+extern const struct trace_syscall_table sc_exit_table;
+extern const struct trace_syscall_table compat_sc_exit_table;
 
-#undef TRACE_SYSCALL_TABLE
-#define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs)    \
-       [ _nr ] = {                                             \
-               .event_func = __event_probe__compat_syscall_exit_##_template, \
-               .event_notifier_func = __event_notifier_probe__compat_syscall_exit_##_template, \
-               .nrargs = (_nrargs),                            \
-               .fields = __event_fields___compat_syscall_exit_##_template, \
-               .desc = &__event_desc___compat_syscall_exit_##_name, \
-       },
-
-/* Event compat syscall exit table */
-const struct trace_syscall_entry compat_sc_exit_table[] = {
-#include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
-#include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
-};
 
 #undef SC_EXIT
 
@@ -386,6 +114,15 @@ struct lttng_syscall_filter {
        DECLARE_BITMAP(sc_exit, NR_syscalls);
        DECLARE_BITMAP(sc_compat_entry, NR_compat_syscalls);
        DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
+
+       /*
+        * Reference counters keeping track of number of events enabled
+        * for each bit.
+        */
+       u32 sc_entry_refcount_map[NR_syscalls];
+       u32 sc_exit_refcount_map[NR_syscalls];
+       u32 sc_compat_entry_refcount_map[NR_compat_syscalls];
+       u32 sc_compat_exit_refcount_map[NR_compat_syscalls];
 };
 
 static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
@@ -396,59 +133,15 @@ static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_h
 
        lttng_syscall_get_arguments(current, regs, args);
        lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
-               struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                       container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-               struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-               if (unlikely(in_compat_syscall()))
-                       __event_probe__compat_syscall_entry_unknown(event_recorder, id, args);
-               else
-                       __event_probe__syscall_entry_unknown(event_recorder, id, args);
-       }
-}
-
-static void syscall_entry_event_notifier_unknown(
-               struct hlist_head *unknown_dispatch_list_head,
-               struct pt_regs *regs, long id)
-{
-       unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-       struct lttng_kernel_event_common_private *event_priv;
-
-       lttng_syscall_get_arguments(current, regs, args);
-       lttng_hlist_for_each_entry_rcu(event_priv, unknown_dispatch_list_head, u.syscall.node) {
-               struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                       container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-               struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-               if (unlikely(in_compat_syscall()))
-                       __event_notifier_probe__compat_syscall_entry_unknown(event_notifier, id, args);
-               else
-                       __event_notifier_probe__syscall_entry_unknown(event_notifier, id, args);
-       }
-}
-
-static void syscall_exit_event_notifier_unknown(
-               struct hlist_head *unknown_dispatch_list_head,
-               struct pt_regs *regs, long id, long ret)
-{
-       unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-       struct lttng_kernel_event_common_private *event_priv;
-
-       lttng_syscall_get_arguments(current, regs, args);
-       lttng_hlist_for_each_entry_rcu(event_priv, unknown_dispatch_list_head, u.syscall.node) {
-               struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                       container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-               struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
                if (unlikely(in_compat_syscall()))
-                       __event_notifier_probe__compat_syscall_exit_unknown(event_notifier, id, ret, args);
+                       __event_probe__compat_syscall_entry_unknown(event_priv->pub, id, args);
                else
-                       __event_notifier_probe__syscall_exit_unknown(event_notifier, id, ret, args);
+                       __event_probe__syscall_entry_unknown(event_priv->pub, id, args);
        }
 }
 
 static __always_inline
-void syscall_entry_call_func(struct hlist_head *action_list,
+void syscall_entry_event_call_func(struct hlist_head *action_list,
                void *func, unsigned int nrargs,
                struct pt_regs *regs)
 {
@@ -459,13 +152,8 @@ void syscall_entry_call_func(struct hlist_head *action_list,
        {
                void (*fptr)(void *__data) = func;
 
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub);
                break;
        }
        case 1:
@@ -474,13 +162,8 @@ void syscall_entry_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, args[0]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, args[0]);
                break;
        }
        case 2:
@@ -491,13 +174,8 @@ void syscall_entry_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, args[0], args[1]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, args[0], args[1]);
                break;
        }
        case 3:
@@ -509,13 +187,8 @@ void syscall_entry_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, args[0], args[1], args[2]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, args[0], args[1], args[2]);
                break;
        }
        case 4:
@@ -528,13 +201,8 @@ void syscall_entry_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, args[0], args[1], args[2], args[3]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, args[0], args[1], args[2], args[3]);
                break;
        }
        case 5:
@@ -548,13 +216,8 @@ void syscall_entry_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, args[0], args[1], args[2], args[3], args[4]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, args[0], args[1], args[2], args[3], args[4]);
                break;
        }
        case 6:
@@ -569,149 +232,9 @@ void syscall_entry_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, args[0], args[1], args[2],
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, args[0], args[1], args[2],
                             args[3], args[4], args[5]);
-               }
-               break;
-       }
-       default:
-               break;
-       }
-}
-
-static __always_inline
-void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
-               void *func, unsigned int nrargs, struct pt_regs *regs)
-{
-       struct lttng_kernel_event_common_private *event_priv;
-
-       switch (nrargs) {
-       case 0:
-       {
-               void (*fptr)(void *__data) = func;
-
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier);
-               }
-               break;
-       }
-       case 1:
-       {
-               void (*fptr)(void *__data, unsigned long arg0) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, args[0]);
-               }
-               break;
-       }
-       case 2:
-       {
-               void (*fptr)(void *__data,
-                       unsigned long arg0,
-                       unsigned long arg1) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, args[0], args[1]);
-               }
-               break;
-       }
-       case 3:
-       {
-               void (*fptr)(void *__data,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, args[0], args[1], args[2]);
-               }
-               break;
-       }
-       case 4:
-       {
-               void (*fptr)(void *__data,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, args[0], args[1], args[2], args[3]);
-               }
-               break;
-       }
-       case 5:
-       {
-               void (*fptr)(void *__data,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3,
-                       unsigned long arg4) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, args[0], args[1], args[2], args[3], args[4]);
-               }
-               break;
-       }
-       case 6:
-       {
-               void (*fptr)(void *__data,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3,
-                       unsigned long arg4,
-                       unsigned long arg5) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, args[0], args[1], args[2], args[3], args[4], args[5]);
-               }
                break;
        }
        default:
@@ -721,33 +244,39 @@ void syscall_entry_event_notifier_call_func(struct hlist_head *dispatch_list,
 
 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
 {
-       struct lttng_channel *chan = __data;
+       struct lttng_kernel_syscall_table *syscall_table = __data;
        struct hlist_head *action_list, *unknown_action_list;
        const struct trace_syscall_entry *table, *entry;
        size_t table_len;
 
+#ifdef CONFIG_X86_X32_ABI
+       if (in_x32_syscall()) {
+               /* x32 system calls are not supported. */
+               return;
+       }
+#endif
        if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter = chan->sc_filter;
+               struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 
                if (id < 0 || id >= NR_compat_syscalls
-                       || (!READ_ONCE(chan->syscall_all_entry) && !test_bit(id, filter->sc_compat_entry))) {
+                       || (!READ_ONCE(syscall_table->syscall_all_entry) && !test_bit(id, filter->sc_compat_entry))) {
                        /* System call filtered out. */
                        return;
                }
-               table = compat_sc_table;
-               table_len = ARRAY_SIZE(compat_sc_table);
-               unknown_action_list = &chan->sc_compat_unknown;
+               table = compat_sc_table.table;
+               table_len = compat_sc_table.len;
+               unknown_action_list = &syscall_table->compat_unknown_syscall_dispatch;
        } else {
-               struct lttng_syscall_filter *filter = chan->sc_filter;
+               struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 
                if (id < 0 || id >= NR_syscalls
-                       || (!READ_ONCE(chan->syscall_all_entry) && !test_bit(id, filter->sc_entry))) {
+                       || (!READ_ONCE(syscall_table->syscall_all_entry) && !test_bit(id, filter->sc_entry))) {
                        /* System call filtered out. */
                        return;
                }
-               table = sc_table;
-               table_len = ARRAY_SIZE(sc_table);
-               unknown_action_list = &chan->sc_unknown;
+               table = sc_table.table;
+               table_len = sc_table.len;
+               unknown_action_list = &syscall_table->unknown_syscall_dispatch;
        }
        if (unlikely(id < 0 || id >= table_len)) {
                syscall_entry_event_unknown(unknown_action_list, regs, id);
@@ -761,73 +290,14 @@ void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
        }
 
        if (unlikely(in_compat_syscall())) {
-               action_list = &chan->compat_sc_table[id];
+               action_list = &syscall_table->compat_syscall_dispatch[id];
        } else {
-               action_list = &chan->sc_table[id];
+               action_list = &syscall_table->syscall_dispatch[id];
        }
        if (unlikely(hlist_empty(action_list)))
                return;
 
-       syscall_entry_call_func(action_list, entry->event_func, entry->nrargs, regs);
-}
-
-void syscall_entry_event_notifier_probe(void *__data, struct pt_regs *regs,
-               long id)
-{
-       struct lttng_event_notifier_group *group = __data;
-       const struct trace_syscall_entry *table, *entry;
-       struct hlist_head *dispatch_list, *unknown_dispatch_list;
-       size_t table_len;
-
-       if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter = group->sc_filter;
-
-               if (id < 0 || id >= NR_compat_syscalls
-                       || (!READ_ONCE(group->syscall_all_entry) &&
-                               !test_bit(id, filter->sc_compat_entry))) {
-                       /* System call filtered out. */
-                       return;
-               }
-               table = compat_sc_table;
-               table_len = ARRAY_SIZE(compat_sc_table);
-               unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
-       } else {
-               struct lttng_syscall_filter *filter = group->sc_filter;
-
-               if (id < 0 || id >= NR_syscalls
-                       || (!READ_ONCE(group->syscall_all_entry) &&
-                               !test_bit(id, filter->sc_entry))) {
-                       /* System call filtered out. */
-                       return;
-               }
-               table = sc_table;
-               table_len = ARRAY_SIZE(sc_table);
-               unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
-       }
-       /* Check if the syscall id is out of bound. */
-       if (unlikely(id < 0 || id >= table_len)) {
-               syscall_entry_event_notifier_unknown(unknown_dispatch_list,
-                               regs, id);
-               return;
-       }
-
-       entry = &table[id];
-       if (!entry->event_notifier_func) {
-               syscall_entry_event_notifier_unknown(unknown_dispatch_list,
-                               regs, id);
-               return;
-       }
-
-       if (unlikely(in_compat_syscall())) {
-               dispatch_list = &group->event_notifier_compat_syscall_dispatch[id];
-       } else {
-               dispatch_list = &group->event_notifier_syscall_dispatch[id];
-       }
-       if (unlikely(hlist_empty(dispatch_list)))
-               return;
-
-       syscall_entry_event_notifier_call_func(dispatch_list,
-                       entry->event_notifier_func, entry->nrargs, regs);
+       syscall_entry_event_call_func(action_list, entry->event_func, entry->nrargs, regs);
 }
 
 static void syscall_exit_event_unknown(struct hlist_head *unknown_action_list_head,
@@ -838,20 +308,16 @@ static void syscall_exit_event_unknown(struct hlist_head *unknown_action_list_he
 
        lttng_syscall_get_arguments(current, regs, args);
        lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
-               struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                       container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-               struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
                if (unlikely(in_compat_syscall()))
-                       __event_probe__compat_syscall_exit_unknown(event_recorder, id, ret,
+                       __event_probe__compat_syscall_exit_unknown(event_priv->pub, id, ret,
                                args);
                else
-                       __event_probe__syscall_exit_unknown(event_recorder, id, ret, args);
+                       __event_probe__syscall_exit_unknown(event_priv->pub, id, ret, args);
        }
 }
 
 static __always_inline
-void syscall_exit_call_func(struct hlist_head *action_list,
+void syscall_exit_event_call_func(struct hlist_head *action_list,
                void *func, unsigned int nrargs,
                struct pt_regs *regs, long ret)
 {
@@ -862,13 +328,8 @@ void syscall_exit_call_func(struct hlist_head *action_list,
        {
                void (*fptr)(void *__data, long ret) = func;
 
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret);
                break;
        }
        case 1:
@@ -879,13 +340,8 @@ void syscall_exit_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret, args[0]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret, args[0]);
                break;
        }
        case 2:
@@ -897,13 +353,8 @@ void syscall_exit_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret, args[0], args[1]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret, args[0], args[1]);
                break;
        }
        case 3:
@@ -916,13 +367,8 @@ void syscall_exit_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret, args[0], args[1], args[2]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret, args[0], args[1], args[2]);
                break;
        }
        case 4:
@@ -936,13 +382,8 @@ void syscall_exit_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret, args[0], args[1], args[2], args[3]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3]);
                break;
        }
        case 5:
@@ -957,13 +398,8 @@ void syscall_exit_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret, args[0], args[1], args[2], args[3], args[4]);
-               }
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3], args[4]);
                break;
        }
        case 6:
@@ -979,14 +415,9 @@ void syscall_exit_call_func(struct hlist_head *action_list,
                unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 
                lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node) {
-                       struct lttng_kernel_event_recorder_private *event_recorder_priv =
-                               container_of(event_priv, struct lttng_kernel_event_recorder_private, parent);
-                       struct lttng_kernel_event_recorder *event_recorder = event_recorder_priv->pub;
-
-                       fptr(event_recorder, ret, args[0], args[1], args[2],
+               lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
+                       fptr(event_priv->pub, ret, args[0], args[1], args[2],
                             args[3], args[4], args[5]);
-               }
                break;
        }
        default:
@@ -996,36 +427,42 @@ void syscall_exit_call_func(struct hlist_head *action_list,
 
 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 {
-       struct lttng_channel *chan = __data;
+       struct lttng_kernel_syscall_table *syscall_table = __data;
        struct hlist_head *action_list, *unknown_action_list;
        const struct trace_syscall_entry *table, *entry;
        size_t table_len;
        long id;
 
+#ifdef CONFIG_X86_X32_ABI
+       if (in_x32_syscall()) {
+               /* x32 system calls are not supported. */
+               return;
+       }
+#endif
        id = syscall_get_nr(current, regs);
 
        if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter = chan->sc_filter;
+               struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 
                if (id < 0 || id >= NR_compat_syscalls
-                       || (!READ_ONCE(chan->syscall_all_exit) && !test_bit(id, filter->sc_compat_exit))) {
+                       || (!READ_ONCE(syscall_table->syscall_all_exit) && !test_bit(id, filter->sc_compat_exit))) {
                        /* System call filtered out. */
                        return;
                }
-               table = compat_sc_exit_table;
-               table_len = ARRAY_SIZE(compat_sc_exit_table);
-               unknown_action_list = &chan->compat_sc_exit_unknown;
+               table = compat_sc_exit_table.table;
+               table_len = compat_sc_exit_table.len;
+               unknown_action_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
        } else {
-               struct lttng_syscall_filter *filter = chan->sc_filter;
+               struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 
                if (id < 0 || id >= NR_syscalls
-                       || (!READ_ONCE(chan->syscall_all_exit) && !test_bit(id, filter->sc_exit))) {
+                       || (!READ_ONCE(syscall_table->syscall_all_exit) && !test_bit(id, filter->sc_exit))) {
                        /* System call filtered out. */
                        return;
                }
-               table = sc_exit_table;
-               table_len = ARRAY_SIZE(sc_exit_table);
-               unknown_action_list = &chan->sc_exit_unknown;
+               table = sc_exit_table.table;
+               table_len = sc_exit_table.len;
+               unknown_action_list = &syscall_table->unknown_syscall_exit_dispatch;
        }
        if (unlikely(id < 0 || id >= table_len)) {
                syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
@@ -1039,261 +476,72 @@ void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
        }
 
        if (unlikely(in_compat_syscall())) {
-               action_list = &chan->compat_sc_exit_table[id];
+               action_list = &syscall_table->compat_syscall_exit_dispatch[id];
        } else {
-               action_list = &chan->sc_exit_table[id];
+               action_list = &syscall_table->syscall_exit_dispatch[id];
        }
        if (unlikely(hlist_empty(action_list)))
                return;
 
-       syscall_exit_call_func(action_list, entry->event_func, entry->nrargs,
+       syscall_exit_event_call_func(action_list, entry->event_func, entry->nrargs,
                               regs, ret);
 }
 
-static __always_inline
-void syscall_exit_event_notifier_call_func(struct hlist_head *dispatch_list,
-               void *func, unsigned int nrargs, struct pt_regs *regs, long ret)
+static
+struct lttng_kernel_syscall_table *get_syscall_table_from_enabler(struct lttng_event_enabler_common *event_enabler)
 {
-       struct lttng_kernel_event_common_private *event_priv;
-
-       switch (nrargs) {
-       case 0:
+       switch (event_enabler->enabler_type) {
+       case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
        {
-               void (*fptr)(void *__data, long ret) = func;
-
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret);
-               }
-               break;
+               struct lttng_event_recorder_enabler *event_recorder_enabler =
+                       container_of(event_enabler, struct lttng_event_recorder_enabler, parent);
+               return &event_recorder_enabler->chan->priv->parent.syscall_table;
        }
-       case 1:
+       case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
        {
-               void (*fptr)(void *__data, long ret, unsigned long arg0) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret, args[0]);
-               }
-               break;
-       }
-       case 2:
-       {
-               void (*fptr)(void *__data,
-                       long ret,
-                       unsigned long arg0,
-                       unsigned long arg1) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret, args[0], args[1]);
-               }
-               break;
-       }
-       case 3:
-       {
-               void (*fptr)(void *__data,
-                       long ret,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret, args[0], args[1], args[2]);
-               }
-               break;
-       }
-       case 4:
-       {
-               void (*fptr)(void *__data,
-                       long ret,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret, args[0], args[1], args[2], args[3]);
-               }
-               break;
-       }
-       case 5:
-       {
-               void (*fptr)(void *__data,
-                       long ret,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3,
-                       unsigned long arg4) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret, args[0], args[1], args[2], args[3], args[4]);
-               }
-               break;
-       }
-       case 6:
-       {
-               void (*fptr)(void *__data,
-                       long ret,
-                       unsigned long arg0,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3,
-                       unsigned long arg4,
-                       unsigned long arg5) = func;
-               unsigned long args[LTTNG_SYSCALL_NR_ARGS];
-
-               lttng_syscall_get_arguments(current, regs, args);
-               lttng_hlist_for_each_entry_rcu(event_priv, dispatch_list, u.syscall.node) {
-                       struct lttng_kernel_event_notifier_private *event_notifier_priv =
-                               container_of(event_priv, struct lttng_kernel_event_notifier_private, parent);
-                       struct lttng_kernel_event_notifier *event_notifier = event_notifier_priv->pub;
-
-                       fptr(event_notifier, ret, args[0], args[1], args[2], args[3], args[4], args[5]);
-               }
-               break;
+               struct lttng_event_notifier_enabler *event_notifier_enabler =
+                       container_of(event_enabler, struct lttng_event_notifier_enabler, parent);
+               return &event_notifier_enabler->group->syscall_table;
        }
        default:
-               break;
+               return NULL;
        }
 }
 
 static
-void syscall_exit_event_notifier_probe(void *__data, struct pt_regs *regs,
-               long ret)
+struct lttng_kernel_syscall_table *get_syscall_table_from_event(struct lttng_kernel_event_common *event)
 {
-       struct lttng_event_notifier_group *group = __data;
-       const struct trace_syscall_entry *table, *entry;
-       struct hlist_head *dispatch_list, *unknown_dispatch_list;
-       size_t table_len;
-       long id;
-
-       id = syscall_get_nr(current, regs);
-
-       if (unlikely(in_compat_syscall())) {
-               struct lttng_syscall_filter *filter = group->sc_filter;
-
-               if (id < 0 || id >= NR_compat_syscalls
-                       || (!READ_ONCE(group->syscall_all_exit) &&
-                               !test_bit(id, filter->sc_compat_exit))) {
-                       /* System call filtered out. */
-                       return;
-               }
-               table = compat_sc_exit_table;
-               table_len = ARRAY_SIZE(compat_sc_exit_table);
-               unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
-       } else {
-               struct lttng_syscall_filter *filter = group->sc_filter;
-
-               if (id < 0 || id >= NR_syscalls
-                       || (!READ_ONCE(group->syscall_all_exit) &&
-                                       !test_bit(id, filter->sc_exit))) {
-                       /* System call filtered out. */
-                       return;
-               }
-               table = sc_exit_table;
-               table_len = ARRAY_SIZE(sc_exit_table);
-               unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
-       }
-       /* Check if the syscall id is out of bound. */
-       if (unlikely(id < 0 || id >= table_len)) {
-               syscall_exit_event_notifier_unknown(unknown_dispatch_list,
-                               regs, id, ret);
-               return;
+       switch (event->type) {
+       case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
+       {
+               struct lttng_kernel_event_recorder *event_recorder =
+                       container_of(event, struct lttng_kernel_event_recorder, parent);
+               return &event_recorder->chan->priv->parent.syscall_table;
        }
-
-       entry = &table[id];
-       if (!entry->event_notifier_func) {
-               syscall_entry_event_notifier_unknown(unknown_dispatch_list,
-                               regs, id);
-               return;
+       case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
+       {
+               struct lttng_kernel_event_notifier *event_notifier =
+                       container_of(event, struct lttng_kernel_event_notifier, parent);
+               return &event_notifier->priv->group->syscall_table;
        }
-
-       if (unlikely(in_compat_syscall())) {
-               dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[id];
-       } else {
-               dispatch_list = &group->event_notifier_exit_syscall_dispatch[id];
+       default:
+               return NULL;
        }
-       if (unlikely(hlist_empty(dispatch_list)))
-               return;
-
-       syscall_exit_event_notifier_call_func(dispatch_list,
-                       entry->event_notifier_func, entry->nrargs, regs, ret);
 }
-/*
- * noinline to diminish caller stack size.
- * Should be called with sessions lock held.
- */
+
 static
-int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *table, size_t table_len,
-       struct hlist_head *chan_table, struct lttng_event_enabler *event_enabler,
-       enum sc_type type)
+void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common *syscall_event_enabler,
+               const struct lttng_kernel_event_desc *desc, enum sc_type type, unsigned int syscall_nr)
 {
-       struct lttng_channel *chan = event_enabler->chan;
-       struct lttng_session *session = chan->session;
-       unsigned int i;
+       struct lttng_kernel_event_common *event;
 
-       /* Allocate events for each syscall matching enabler, insert into table */
-       for (i = 0; i < table_len; i++) {
-               const struct lttng_kernel_event_desc *desc = table[i].desc;
+       switch (syscall_event_enabler->enabler_type) {
+       case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
+       {
+               struct lttng_event_recorder_enabler *syscall_event_recorder_enabler =
+                       container_of(syscall_event_enabler, struct lttng_event_recorder_enabler, parent);
+               struct lttng_event_recorder_enabler *event_recorder_enabler;
                struct lttng_kernel_abi_event ev;
-               struct lttng_kernel_event_recorder_private *event_recorder_priv;
-               struct lttng_kernel_event_recorder *event_recorder;
-               struct hlist_head *head;
-               bool found = false;
-
-               if (!desc) {
-                       /* Unknown syscall */
-                       continue;
-               }
-               if (lttng_desc_match_enabler(desc,
-                               lttng_event_enabler_as_enabler(event_enabler)) <= 0)
-                       continue;
-               /*
-                * Check if already created.
-                */
-               head = utils_borrow_hash_table_bucket(
-                       session->events_ht.table, LTTNG_EVENT_HT_SIZE,
-                       desc->event_name);
-               lttng_hlist_for_each_entry(event_recorder_priv, head, hlist) {
-                       if (event_recorder_priv->parent.desc == desc
-                               && event_recorder_priv->pub->chan == event_enabler->chan)
-                               found = true;
-               }
-               if (found)
-                       continue;
 
                /* We need to create an event for this syscall/enabler. */
                memset(&ev, 0, sizeof(ev));
@@ -1318,656 +566,317 @@ int lttng_create_syscall_event_if_missing(const struct trace_syscall_entry *tabl
                strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1);
                ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
                ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc, ev.instrumentation);
-               WARN_ON_ONCE(!event_recorder);
-               if (IS_ERR(event_recorder)) {
-                       /*
-                        * If something goes wrong in event registration
-                        * after the first one, we have no choice but to
-                        * leave the previous events in there, until
-                        * deleted by session teardown.
-                        */
-                       return PTR_ERR(event_recorder);
-               }
-               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan_table[i]);
-       }
-       return 0;
-}
-
-/*
- * Should be called with sessions lock held.
- */
-int lttng_syscalls_register_event(struct lttng_event_enabler *event_enabler)
-{
-       struct lttng_channel *chan = event_enabler->chan;
-       struct lttng_kernel_abi_event ev;
-       int ret;
-
-       wrapper_vmalloc_sync_mappings();
-
-       if (!chan->sc_table) {
-               /* create syscall table mapping syscall to events */
-               chan->sc_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
-                                       * ARRAY_SIZE(sc_table), GFP_KERNEL);
-               if (!chan->sc_table)
-                       return -ENOMEM;
-       }
-       if (!chan->sc_exit_table) {
-               /* create syscall table mapping syscall to events */
-               chan->sc_exit_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
-                                       * ARRAY_SIZE(sc_exit_table), GFP_KERNEL);
-               if (!chan->sc_exit_table)
-                       return -ENOMEM;
-       }
-
-
-#ifdef CONFIG_COMPAT
-       if (!chan->compat_sc_table) {
-               /* create syscall table mapping compat syscall to events */
-               chan->compat_sc_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
-                                       * ARRAY_SIZE(compat_sc_table), GFP_KERNEL);
-               if (!chan->compat_sc_table)
-                       return -ENOMEM;
-       }
-
-       if (!chan->compat_sc_exit_table) {
-               /* create syscall table mapping compat syscall to events */
-               chan->compat_sc_exit_table = kzalloc(sizeof(struct lttng_kernel_event_recorder *)
-                                       * ARRAY_SIZE(compat_sc_exit_table), GFP_KERNEL);
-               if (!chan->compat_sc_exit_table)
-                       return -ENOMEM;
-       }
-#endif
-       if (hlist_empty(&chan->sc_unknown)) {
-               const struct lttng_kernel_event_desc *desc =
-                       &__event_desc___syscall_entry_unknown;
-               struct lttng_kernel_event_recorder *event_recorder;
-
-               memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
-                                           ev.instrumentation);
-               WARN_ON_ONCE(!event_recorder);
-               if (IS_ERR(event_recorder)) {
-                       return PTR_ERR(event_recorder);
-               }
-               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_unknown);
-       }
-
-       if (hlist_empty(&chan->sc_compat_unknown)) {
-               const struct lttng_kernel_event_desc *desc =
-                       &__event_desc___compat_syscall_entry_unknown;
-               struct lttng_kernel_event_recorder *event_recorder;
-
-               memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
-                                           ev.instrumentation);
-               WARN_ON_ONCE(!event_recorder);
-               if (IS_ERR(event_recorder)) {
-                       return PTR_ERR(event_recorder);
+               event_recorder_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev,
+                               syscall_event_recorder_enabler->chan);
+               WARN_ON_ONCE(!event_recorder_enabler);
+               if (!event_recorder_enabler)
+                       return;
+               event = _lttng_kernel_event_create(&event_recorder_enabler->parent, desc);
+               WARN_ON_ONCE(IS_ERR(event));
+               lttng_event_enabler_destroy(&event_recorder_enabler->parent);
+               if (IS_ERR(event)) {
+                       printk(KERN_INFO "Unable to create event recorder %s\n", desc->event_name);
+                       return;
                }
-               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_compat_unknown);
+               event->priv->u.syscall.syscall_id = syscall_nr;
+               break;
        }
+       case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
+       {
+               struct lttng_event_notifier_enabler *syscall_event_notifier_enabler =
+                       container_of(syscall_event_enabler, struct lttng_event_notifier_enabler, parent);
+               struct lttng_event_notifier_enabler *event_notifier_enabler;
+               struct lttng_kernel_abi_event_notifier event_notifier_param;
+               uint64_t user_token = syscall_event_enabler->user_token;
+               uint64_t error_counter_index = syscall_event_notifier_enabler->error_counter_index;
 
-       if (hlist_empty(&chan->compat_sc_exit_unknown)) {
-               const struct lttng_kernel_event_desc *desc =
-                       &__event_desc___compat_syscall_exit_unknown;
-               struct lttng_kernel_event_recorder *event_recorder;
-
-               memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
-                                           ev.instrumentation);
-               WARN_ON_ONCE(!event_recorder);
-               if (IS_ERR(event_recorder)) {
-                       return PTR_ERR(event_recorder);
+               memset(&event_notifier_param, 0, sizeof(event_notifier_param));
+               switch (type) {
+               case SC_TYPE_ENTRY:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+                       break;
+               case SC_TYPE_EXIT:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
+                       break;
+               case SC_TYPE_COMPAT_ENTRY:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+                       break;
+               case SC_TYPE_COMPAT_EXIT:
+                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
+                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
+                       break;
                }
-               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->compat_sc_exit_unknown);
-       }
-
-       if (hlist_empty(&chan->sc_exit_unknown)) {
-               const struct lttng_kernel_event_desc *desc =
-                       &__event_desc___syscall_exit_unknown;
-               struct lttng_kernel_event_recorder *event_recorder;
-
-               memset(&ev, 0, sizeof(ev));
-               strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
-               ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-               ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-               ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-               ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-               event_recorder = _lttng_kernel_event_recorder_create(chan, &ev, desc,
-                                           ev.instrumentation);
-               WARN_ON_ONCE(!event_recorder);
-               if (IS_ERR(event_recorder)) {
-                       return PTR_ERR(event_recorder);
+               strncat(event_notifier_param.event.name, desc->event_name,
+                       LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
+               event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
+               event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
+               event_notifier_param.event.token = user_token;
+               event_notifier_param.error_counter_index = error_counter_index;
+
+               event_notifier_enabler = lttng_event_notifier_enabler_create(LTTNG_ENABLER_FORMAT_NAME,
+                               &event_notifier_param, syscall_event_notifier_enabler->group);
+               WARN_ON_ONCE(!event_notifier_enabler);
+               event = _lttng_kernel_event_create(&event_notifier_enabler->parent, desc);
+               WARN_ON_ONCE(IS_ERR(event));
+               lttng_event_enabler_destroy(&event_notifier_enabler->parent);
+               if (IS_ERR(event)) {
+                       printk(KERN_INFO "Unable to create event notifier %s\n", desc->event_name);
+                       return;
                }
-               hlist_add_head(&event_recorder->priv->parent.u.syscall.node, &chan->sc_exit_unknown);
-       }
-
-       ret = lttng_create_syscall_event_if_missing(sc_table, ARRAY_SIZE(sc_table),
-                       chan->sc_table, event_enabler, SC_TYPE_ENTRY);
-       if (ret)
-               return ret;
-       ret = lttng_create_syscall_event_if_missing(sc_exit_table, ARRAY_SIZE(sc_exit_table),
-                       chan->sc_exit_table, event_enabler, SC_TYPE_EXIT);
-       if (ret)
-               return ret;
-
-#ifdef CONFIG_COMPAT
-       ret = lttng_create_syscall_event_if_missing(compat_sc_table, ARRAY_SIZE(compat_sc_table),
-                       chan->compat_sc_table, event_enabler, SC_TYPE_COMPAT_ENTRY);
-       if (ret)
-               return ret;
-       ret = lttng_create_syscall_event_if_missing(compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
-                       chan->compat_sc_exit_table, event_enabler, SC_TYPE_COMPAT_EXIT);
-       if (ret)
-               return ret;
-#endif
-
-       if (!chan->sc_filter) {
-               chan->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
-                               GFP_KERNEL);
-               if (!chan->sc_filter)
-                       return -ENOMEM;
-       }
-
-       if (!chan->sys_enter_registered) {
-               ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
-                               (void *) syscall_entry_event_probe, chan);
-               if (ret)
-                       return ret;
-               chan->sys_enter_registered = 1;
+               event->priv->u.syscall.syscall_id = syscall_nr;
+               break;
        }
-       /*
-        * We change the name of sys_exit tracepoint due to namespace
-        * conflict with sys_exit syscall entry.
-        */
-       if (!chan->sys_exit_registered) {
-               ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
-                               (void *) syscall_exit_event_probe, chan);
-               if (ret) {
-                       WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-                               (void *) syscall_entry_event_probe, chan));
-                       return ret;
-               }
-               chan->sys_exit_registered = 1;
+       default:
+               break;
        }
-       return ret;
 }
 
-/*
- * Should be called with sessions lock held.
- */
-int lttng_syscalls_register_event_notifier(
-               struct lttng_event_notifier_enabler *event_notifier_enabler)
+static
+void lttng_syscall_event_enabler_create_matching_syscall_table_events(struct lttng_event_enabler_common *syscall_event_enabler_common,
+               const struct trace_syscall_entry *table, size_t table_len, enum sc_type type)
 {
-       struct lttng_event_notifier_group *group = event_notifier_enabler->group;
+       struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(syscall_event_enabler_common);
+       const struct lttng_kernel_event_desc *desc;
        unsigned int i;
-       int ret = 0;
-
-       wrapper_vmalloc_sync_mappings();
-
-       if (!group->event_notifier_syscall_dispatch) {
-               group->event_notifier_syscall_dispatch =
-                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(sc_table),
-                                       GFP_KERNEL);
-               if (!group->event_notifier_syscall_dispatch)
-                       return -ENOMEM;
 
-               /* Initialize all list_head */
-               for (i = 0; i < ARRAY_SIZE(sc_table); i++)
-                       INIT_HLIST_HEAD(&group->event_notifier_syscall_dispatch[i]);
-
-               /* Init the unknown syscall notifier list. */
-               INIT_HLIST_HEAD(&group->event_notifier_unknown_syscall_dispatch);
-       }
-
-       if (!group->event_notifier_exit_syscall_dispatch) {
-               group->event_notifier_exit_syscall_dispatch =
-                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(sc_table),
-                                       GFP_KERNEL);
-               if (!group->event_notifier_exit_syscall_dispatch)
-                       return -ENOMEM;
-
-               /* Initialize all list_head */
-               for (i = 0; i < ARRAY_SIZE(sc_table); i++)
-                       INIT_HLIST_HEAD(&group->event_notifier_exit_syscall_dispatch[i]);
-
-               /* Init the unknown exit syscall notifier list. */
-               INIT_HLIST_HEAD(&group->event_notifier_exit_unknown_syscall_dispatch);
-       }
-
-#ifdef CONFIG_COMPAT
-       if (!group->event_notifier_compat_syscall_dispatch) {
-               group->event_notifier_compat_syscall_dispatch =
-                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(compat_sc_table),
-                                       GFP_KERNEL);
-               if (!group->event_notifier_syscall_dispatch)
-                       return -ENOMEM;
-
-               /* Initialize all list_head */
-               for (i = 0; i < ARRAY_SIZE(compat_sc_table); i++)
-                       INIT_HLIST_HEAD(&group->event_notifier_compat_syscall_dispatch[i]);
-
-               /* Init the unknown syscall notifier list. */
-               INIT_HLIST_HEAD(&group->event_notifier_compat_unknown_syscall_dispatch);
-       }
-
-       if (!group->event_notifier_exit_compat_syscall_dispatch) {
-               group->event_notifier_exit_compat_syscall_dispatch =
-                               kzalloc(sizeof(struct hlist_head) * ARRAY_SIZE(compat_sc_exit_table),
-                                       GFP_KERNEL);
-               if (!group->event_notifier_exit_syscall_dispatch)
-                       return -ENOMEM;
-
-               /* Initialize all list_head */
-               for (i = 0; i < ARRAY_SIZE(compat_sc_exit_table); i++)
-                       INIT_HLIST_HEAD(&group->event_notifier_exit_compat_syscall_dispatch[i]);
-
-               /* Init the unknown exit syscall notifier list. */
-               INIT_HLIST_HEAD(&group->event_notifier_exit_compat_unknown_syscall_dispatch);
-       }
+#ifndef CONFIG_COMPAT
+       if (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT)
+               return;
 #endif
+       /* iterate over all syscall and create event that match */
+       for (i = 0; i < table_len; i++) {
+               struct lttng_kernel_event_common_private *event_priv;
+               struct hlist_head *head;
+               bool found = false;
 
-       if (!group->sc_filter) {
-               group->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
-                               GFP_KERNEL);
-               if (!group->sc_filter)
-                       return -ENOMEM;
-       }
+               desc = table[i].desc;
+               if (!desc) {
+                       /* Unknown syscall */
+                       continue;
+               }
 
-       if (!group->sys_enter_registered) {
-               ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
-                               (void *) syscall_entry_event_notifier_probe, group);
-               if (ret)
-                       return ret;
-               group->sys_enter_registered = 1;
-       }
+               if (!lttng_desc_match_enabler(desc, syscall_event_enabler_common))
+                       continue;
 
-       if (!group->sys_exit_registered) {
-               ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
-                               (void *) syscall_exit_event_notifier_probe, group);
-               if (ret) {
-                       WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-                               (void *) syscall_entry_event_notifier_probe, group));
-                       return ret;
+               /*
+                * Check if already created.
+                */
+               head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
+               lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
+                       if (lttng_event_enabler_desc_match_event(syscall_event_enabler_common, desc, event_priv->pub)) {
+                               found = true;
+                               break;
+                       }
                }
-               group->sys_exit_registered = 1;
+               if (found)
+                       continue;
+
+               lttng_syscall_event_enabler_create_event(syscall_event_enabler_common, desc, type, i);
        }
+}
 
-       return ret;
+static
+bool lttng_syscall_event_enabler_is_wildcard_all(struct lttng_event_enabler_common *event_enabler)
+{
+       if (event_enabler->event_param.instrumentation != LTTNG_KERNEL_ABI_SYSCALL)
+               return false;
+       if (event_enabler->event_param.u.syscall.abi != LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL)
+               return false;
+       if (event_enabler->event_param.u.syscall.match != LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME)
+               return false;
+       if (strcmp(event_enabler->event_param.name, "*"))
+               return false;
+       return true;
 }
 
 static
-int create_unknown_event_notifier(
-               struct lttng_event_notifier_enabler *event_notifier_enabler,
-               enum sc_type type)
+void create_unknown_syscall_event(struct lttng_event_enabler_common *event_enabler, enum sc_type type)
 {
-       struct lttng_kernel_event_notifier_private *event_notifier_priv;
-       struct lttng_kernel_event_notifier *event_notifier;
+       struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(event_enabler);
+       struct lttng_kernel_event_common_private *event_priv;
        const struct lttng_kernel_event_desc *desc;
-       struct lttng_event_notifier_group *group = event_notifier_enabler->group;
-       struct lttng_kernel_abi_event_notifier event_notifier_param;
-       uint64_t user_token = event_notifier_enabler->base.user_token;
-       uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
-       struct lttng_enabler *base_enabler = lttng_event_notifier_enabler_as_enabler(
-               event_notifier_enabler);
-       struct hlist_head *unknown_dispatch_list;
-       int ret = 0;
        bool found = false;
-       enum lttng_kernel_abi_syscall_abi abi;
-       enum lttng_kernel_abi_syscall_entryexit entryexit;
        struct hlist_head *head;
 
+#ifndef CONFIG_COMPAT
+       if (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT)
+               return;
+#endif
+       /*
+        * Considering that currently system calls can only be enabled on a per
+        * name basis (or wildcard based on a name), unknown syscall events are
+        * only used when matching *all* system calls, because this is the only
+        * case which can be associated with an unknown system call.
+        *
+        * When enabling system call on a per system call number basis will be
+        * supported, this will need to be revisited.
+        */
+       if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
+               return;
+
        switch (type) {
        case SC_TYPE_ENTRY:
                desc = &__event_desc___syscall_entry_unknown;
-               unknown_dispatch_list = &group->event_notifier_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                break;
        case SC_TYPE_EXIT:
                desc = &__event_desc___syscall_exit_unknown;
-               unknown_dispatch_list = &group->event_notifier_exit_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
                break;
        case SC_TYPE_COMPAT_ENTRY:
                desc = &__event_desc___compat_syscall_entry_unknown;
-               unknown_dispatch_list = &group->event_notifier_compat_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                break;
        case SC_TYPE_COMPAT_EXIT:
                desc = &__event_desc___compat_syscall_exit_unknown;
-               unknown_dispatch_list = &group->event_notifier_exit_compat_unknown_syscall_dispatch;
-               entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-               abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                break;
        default:
-               BUG_ON(1);
+               WARN_ON_ONCE(1);
        }
 
        /*
         * Check if already created.
         */
-       head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
-               LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
-       lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
-               if (event_notifier_priv->parent.desc == desc &&
-                               event_notifier_priv->parent.user_token == base_enabler->user_token)
+       head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
+       lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
+               if (lttng_event_enabler_desc_match_event(event_enabler, desc, event_priv->pub)) {
                        found = true;
-       }
-       if (found)
-               goto end;
-
-       memset(&event_notifier_param, 0, sizeof(event_notifier_param));
-       strncat(event_notifier_param.event.name, desc->event_name,
-               LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
-
-       event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-
-       event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-       event_notifier_param.event.u.syscall.abi = abi;
-       event_notifier_param.event.u.syscall.entryexit = entryexit;
-
-       event_notifier = _lttng_event_notifier_create(desc, user_token,
-               error_counter_index, group, &event_notifier_param,
-               event_notifier_param.event.instrumentation);
-       if (IS_ERR(event_notifier)) {
-               printk(KERN_INFO "Unable to create unknown notifier %s\n",
-                       desc->event_name);
-               ret = -ENOMEM;
-               goto end;
-       }
-
-       hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, unknown_dispatch_list);
-
-end:
-       return ret;
-}
-
-static int create_matching_event_notifiers(
-               struct lttng_event_notifier_enabler *event_notifier_enabler,
-               const struct trace_syscall_entry *table,
-               size_t table_len, enum sc_type type)
-{
-       struct lttng_event_notifier_group *group = event_notifier_enabler->group;
-       const struct lttng_kernel_event_desc *desc;
-       uint64_t user_token = event_notifier_enabler->base.user_token;
-       uint64_t error_counter_index = event_notifier_enabler->error_counter_index;
-       unsigned int i;
-       int ret = 0;
-
-       /* iterate over all syscall and create event_notifier that match */
-       for (i = 0; i < table_len; i++) {
-               struct lttng_kernel_event_notifier_private *event_notifier_priv;
-               struct lttng_kernel_event_notifier *event_notifier;
-               struct lttng_kernel_abi_event_notifier event_notifier_param;
-               struct hlist_head *head;
-               int found = 0;
-
-               desc = table[i].desc;
-               if (!desc) {
-                       /* Unknown syscall */
-                       continue;
-               }
-
-               if (!lttng_desc_match_enabler(desc,
-                               lttng_event_notifier_enabler_as_enabler(event_notifier_enabler)))
-                       continue;
-
-               /*
-                * Check if already created.
-                */
-               head = utils_borrow_hash_table_bucket(group->event_notifiers_ht.table,
-                       LTTNG_EVENT_NOTIFIER_HT_SIZE, desc->event_name);
-               lttng_hlist_for_each_entry(event_notifier_priv, head, hlist) {
-                       if (event_notifier_priv->parent.desc == desc
-                               && event_notifier_priv->parent.user_token == event_notifier_enabler->base.user_token)
-                               found = 1;
-               }
-               if (found)
-                       continue;
-
-               memset(&event_notifier_param, 0, sizeof(event_notifier_param));
-               switch (type) {
-               case SC_TYPE_ENTRY:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-                       break;
-               case SC_TYPE_EXIT:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
-                       break;
-               case SC_TYPE_COMPAT_ENTRY:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
                        break;
-               case SC_TYPE_COMPAT_EXIT:
-                       event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
-                       event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
-                       break;
-               }
-               strncat(event_notifier_param.event.name, desc->event_name,
-                       LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
-               event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
-               event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
-
-               event_notifier = _lttng_event_notifier_create(desc, user_token,
-                       error_counter_index, group, &event_notifier_param,
-                       event_notifier_param.event.instrumentation);
-               if (IS_ERR(event_notifier)) {
-                       printk(KERN_INFO "Unable to create event_notifier %s\n",
-                               desc->event_name);
-                       ret = -ENOMEM;
-                       goto end;
                }
-
-               event_notifier->priv->parent.u.syscall.syscall_id = i;
        }
-
-end:
-       return ret;
-
+       if (!found)
+               lttng_syscall_event_enabler_create_event(event_enabler, desc, type, -1U);
 }
 
-int lttng_syscalls_create_matching_event_notifiers(
-               struct lttng_event_notifier_enabler *event_notifier_enabler)
+static
+void lttng_syscall_event_enabler_create_matching_events(struct lttng_event_enabler_common *event_enabler)
 {
-       int ret;
-       struct lttng_enabler *base_enabler =
-                       lttng_event_notifier_enabler_as_enabler(event_notifier_enabler);
-       enum lttng_kernel_abi_syscall_entryexit entryexit =
-                       base_enabler->event_param.u.syscall.entryexit;
+       enum lttng_kernel_abi_syscall_entryexit entryexit = event_enabler->event_param.u.syscall.entryexit;
 
        if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
-               ret = create_matching_event_notifiers(event_notifier_enabler,
-                       sc_table, ARRAY_SIZE(sc_table), SC_TYPE_ENTRY);
-               if (ret)
-                       goto end;
-
-               ret = create_matching_event_notifiers(event_notifier_enabler,
-                       compat_sc_table, ARRAY_SIZE(compat_sc_table),
-                       SC_TYPE_COMPAT_ENTRY);
-               if (ret)
-                       goto end;
-
-               ret = create_unknown_event_notifier(event_notifier_enabler,
-                               SC_TYPE_ENTRY);
-               if (ret)
-                       goto end;
-
-               ret = create_unknown_event_notifier(event_notifier_enabler,
-                               SC_TYPE_COMPAT_ENTRY);
-               if (ret)
-                       goto end;
+               lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+                       sc_table.table, sc_table.len, SC_TYPE_ENTRY);
+               lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+                       compat_sc_table.table, compat_sc_table.len, SC_TYPE_COMPAT_ENTRY);
+               create_unknown_syscall_event(event_enabler, SC_TYPE_ENTRY);
+               create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_ENTRY);
        }
 
        if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
-               ret = create_matching_event_notifiers(event_notifier_enabler,
-                       sc_exit_table, ARRAY_SIZE(sc_exit_table),
-                       SC_TYPE_EXIT);
-               if (ret)
-                       goto end;
-
-               ret = create_unknown_event_notifier(event_notifier_enabler,
-                               SC_TYPE_EXIT);
-               if (ret)
-                       goto end;
-
-               ret = create_matching_event_notifiers(event_notifier_enabler,
-                       compat_sc_exit_table, ARRAY_SIZE(compat_sc_exit_table),
-                       SC_TYPE_COMPAT_EXIT);
-               if (ret)
-                       goto end;
-
-               ret = create_unknown_event_notifier(event_notifier_enabler,
-                               SC_TYPE_COMPAT_EXIT);
-               if (ret)
-                       goto end;
+               lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+                       sc_exit_table.table, sc_exit_table.len, SC_TYPE_EXIT);
+               lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
+                       compat_sc_exit_table.table, compat_sc_exit_table.len, SC_TYPE_COMPAT_EXIT);
+               create_unknown_syscall_event(event_enabler, SC_TYPE_EXIT);
+               create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_EXIT);
        }
-
-end:
-       return ret;
 }
 
 /*
- * Unregister the syscall event_notifier probes from the callsites.
+ * Should be called with sessions lock held.
  */
-int lttng_syscalls_unregister_event_notifier_group(
-               struct lttng_event_notifier_group *event_notifier_group)
+int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enabler_common *syscall_event_enabler)
 {
+       struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
        int ret;
 
-       /*
-        * Only register the event_notifier probe on the `sys_enter` callsite for now.
-        * At the moment, we don't think it's desirable to have one fired
-        * event_notifier for the entry and one for the exit of a syscall.
-        */
-       if (event_notifier_group->sys_enter_registered) {
-               ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-                               (void *) syscall_entry_event_notifier_probe, event_notifier_group);
+       if (!syscall_table->syscall_dispatch) {
+               /* create syscall table mapping syscall to events */
+               syscall_table->syscall_dispatch = kzalloc(sizeof(struct hlist_head) * sc_table.len, GFP_KERNEL);
+               if (!syscall_table->syscall_dispatch)
+                       return -ENOMEM;
+       }
+       if (!syscall_table->syscall_exit_dispatch) {
+               /* create syscall table mapping syscall to events */
+               syscall_table->syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * sc_exit_table.len, GFP_KERNEL);
+               if (!syscall_table->syscall_exit_dispatch)
+                       return -ENOMEM;
+       }
+
+#ifdef CONFIG_COMPAT
+       if (!syscall_table->compat_syscall_dispatch) {
+               /* create syscall table mapping compat syscall to events */
+               syscall_table->compat_syscall_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_table.len, GFP_KERNEL);
+               if (!syscall_table->compat_syscall_dispatch)
+                       return -ENOMEM;
+       }
+
+       if (!syscall_table->compat_syscall_exit_dispatch) {
+               /* create syscall table mapping compat syscall to events */
+               syscall_table->compat_syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_exit_table.len, GFP_KERNEL);
+               if (!syscall_table->compat_syscall_exit_dispatch)
+                       return -ENOMEM;
+       }
+#endif
+       if (!syscall_table->sc_filter) {
+               syscall_table->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
+                               GFP_KERNEL);
+               if (!syscall_table->sc_filter)
+                       return -ENOMEM;
+       }
+
+       if (!syscall_table->sys_enter_registered) {
+               ret = lttng_tracepoint_probe_register("sys_enter",
+                               (void *) syscall_entry_event_probe, syscall_table);
                if (ret)
                        return ret;
-               event_notifier_group->sys_enter_registered = 0;
+               syscall_table->sys_enter_registered = 1;
        }
-       if (event_notifier_group->sys_exit_registered) {
-               ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
-                               (void *) syscall_exit_event_notifier_probe, event_notifier_group);
-               if (ret)
+       if (!syscall_table->sys_exit_registered) {
+               ret = lttng_tracepoint_probe_register("sys_exit",
+                               (void *) syscall_exit_event_probe, syscall_table);
+               if (ret) {
+                       WARN_ON_ONCE(lttng_tracepoint_probe_unregister("sys_enter",
+                               (void *) syscall_entry_event_probe, syscall_table));
                        return ret;
-               event_notifier_group->sys_enter_registered = 0;
+               }
+               syscall_table->sys_exit_registered = 1;
        }
 
-       kfree(event_notifier_group->event_notifier_syscall_dispatch);
-       kfree(event_notifier_group->event_notifier_exit_syscall_dispatch);
-#ifdef CONFIG_COMPAT
-       kfree(event_notifier_group->event_notifier_compat_syscall_dispatch);
-       kfree(event_notifier_group->event_notifier_exit_compat_syscall_dispatch);
-#endif
+       lttng_syscall_event_enabler_create_matching_events(syscall_event_enabler);
+
        return 0;
 }
 
-int lttng_syscalls_unregister_channel(struct lttng_channel *chan)
+int lttng_syscalls_unregister_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 {
        int ret;
 
-       if (!chan->sc_table)
+       if (!syscall_table->syscall_dispatch)
                return 0;
-       if (chan->sys_enter_registered) {
-               ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
-                               (void *) syscall_entry_event_probe, chan);
+       if (syscall_table->sys_enter_registered) {
+               ret = lttng_tracepoint_probe_unregister("sys_enter",
+                               (void *) syscall_entry_event_probe, syscall_table);
                if (ret)
                        return ret;
-               chan->sys_enter_registered = 0;
+               syscall_table->sys_enter_registered = 0;
        }
-       if (chan->sys_exit_registered) {
-               ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
-                               (void *) syscall_exit_event_probe, chan);
+       if (syscall_table->sys_exit_registered) {
+               ret = lttng_tracepoint_probe_unregister("sys_exit",
+                               (void *) syscall_exit_event_probe, syscall_table);
                if (ret)
                        return ret;
-               chan->sys_exit_registered = 0;
+               syscall_table->sys_exit_registered = 0;
        }
        return 0;
 }
 
-int lttng_syscalls_destroy_event(struct lttng_channel *chan)
+int lttng_syscalls_destroy_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 {
-       kfree(chan->sc_table);
-       kfree(chan->sc_exit_table);
+       kfree(syscall_table->syscall_dispatch);
+       kfree(syscall_table->syscall_exit_dispatch);
 #ifdef CONFIG_COMPAT
-       kfree(chan->compat_sc_table);
-       kfree(chan->compat_sc_exit_table);
+       kfree(syscall_table->compat_syscall_dispatch);
+       kfree(syscall_table->compat_syscall_exit_dispatch);
 #endif
-       kfree(chan->sc_filter);
+       kfree(syscall_table->sc_filter);
        return 0;
 }
 
-static
-int get_syscall_nr(const char *syscall_name)
-{
-       int syscall_nr = -1;
-       int i;
-
-       for (i = 0; i < ARRAY_SIZE(sc_table); i++) {
-               const struct trace_syscall_entry *entry;
-               const char *it_name;
-
-               entry = &sc_table[i];
-               if (!entry->desc)
-                       continue;
-               it_name = entry->desc->event_name;
-               it_name += strlen(SYSCALL_ENTRY_STR);
-               if (!strcmp(syscall_name, it_name)) {
-                       syscall_nr = i;
-                       break;
-               }
-       }
-       return syscall_nr;
-}
-
-static
-int get_compat_syscall_nr(const char *syscall_name)
-{
-       int syscall_nr = -1;
-       int i;
-
-       for (i = 0; i < ARRAY_SIZE(compat_sc_table); i++) {
-               const struct trace_syscall_entry *entry;
-               const char *it_name;
-
-               entry = &compat_sc_table[i];
-               if (!entry->desc)
-                       continue;
-               it_name = entry->desc->event_name;
-               it_name += strlen(COMPAT_SYSCALL_ENTRY_STR);
-               if (!strcmp(syscall_name, it_name)) {
-                       syscall_nr = i;
-                       break;
-               }
-       }
-       return syscall_nr;
-}
-
 static
 uint32_t get_sc_tables_len(void)
 {
-       return ARRAY_SIZE(sc_table) + ARRAY_SIZE(compat_sc_table);
+       return sc_table.len + compat_sc_table.len;
 }
 
 static
@@ -2008,35 +917,25 @@ static
 int lttng_syscall_filter_enable(
                struct lttng_syscall_filter *filter,
                const char *desc_name, enum lttng_syscall_abi abi,
-               enum lttng_syscall_entryexit entryexit)
+               enum lttng_syscall_entryexit entryexit,
+               unsigned int syscall_id)
 {
        const char *syscall_name;
        unsigned long *bitmap;
-       int syscall_nr;
+       u32 *refcount_map;
 
        syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-       switch (abi) {
-       case LTTNG_SYSCALL_ABI_NATIVE:
-               syscall_nr = get_syscall_nr(syscall_name);
-               break;
-       case LTTNG_SYSCALL_ABI_COMPAT:
-               syscall_nr = get_compat_syscall_nr(syscall_name);
-               break;
-       default:
-               return -EINVAL;
-       }
-       if (syscall_nr < 0)
-               return -ENOENT;
-
        switch (entryexit) {
        case LTTNG_SYSCALL_ENTRY:
                switch (abi) {
                case LTTNG_SYSCALL_ABI_NATIVE:
                        bitmap = filter->sc_entry;
+                       refcount_map = filter->sc_entry_refcount_map;
                        break;
                case LTTNG_SYSCALL_ABI_COMPAT:
                        bitmap = filter->sc_compat_entry;
+                       refcount_map = filter->sc_compat_entry_refcount_map;
                        break;
                default:
                        return -EINVAL;
@@ -2046,9 +945,11 @@ int lttng_syscall_filter_enable(
                switch (abi) {
                case LTTNG_SYSCALL_ABI_NATIVE:
                        bitmap = filter->sc_exit;
+                       refcount_map = filter->sc_exit_refcount_map;
                        break;
                case LTTNG_SYSCALL_ABI_COMPAT:
                        bitmap = filter->sc_compat_exit;
+                       refcount_map = filter->sc_compat_exit_refcount_map;
                        break;
                default:
                        return -EINVAL;
@@ -2057,113 +958,122 @@ int lttng_syscall_filter_enable(
        default:
                return -EINVAL;
        }
-       if (test_bit(syscall_nr, bitmap))
-               return -EEXIST;
-       bitmap_set(bitmap, syscall_nr, 1);
+       if (refcount_map[syscall_id] == U32_MAX)
+               return -EOVERFLOW;
+       if (refcount_map[syscall_id]++ == 0)
+               bitmap_set(bitmap, syscall_id, 1);
        return 0;
 }
 
-int lttng_syscall_filter_enable_event_notifier(
-               struct lttng_kernel_event_notifier *event_notifier)
+int lttng_syscall_filter_enable_event(struct lttng_kernel_event_common *event)
 {
-       struct lttng_event_notifier_group *group = event_notifier->priv->group;
-       unsigned int syscall_id = event_notifier->priv->parent.u.syscall.syscall_id;
+       struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
+       unsigned int syscall_id = event->priv->u.syscall.syscall_id;
        struct hlist_head *dispatch_list;
        int ret = 0;
 
-       WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
-
-       ret = lttng_syscall_filter_enable(group->sc_filter,
-               event_notifier->priv->parent.desc->event_name,
-               event_notifier->priv->parent.u.syscall.abi,
-               event_notifier->priv->parent.u.syscall.entryexit);
-       if (ret) {
-               goto end;
-       }
-
-       switch (event_notifier->priv->parent.u.syscall.entryexit) {
-       case LTTNG_SYSCALL_ENTRY:
-               switch (event_notifier->priv->parent.u.syscall.abi) {
-               case LTTNG_SYSCALL_ABI_NATIVE:
-                       dispatch_list = &group->event_notifier_syscall_dispatch[syscall_id];
+       WARN_ON_ONCE(event->priv->instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
+
+       /* Unknown syscall */
+       if (syscall_id == -1U) {
+               switch (event->priv->u.syscall.entryexit) {
+               case LTTNG_SYSCALL_ENTRY:
+                       switch (event->priv->u.syscall.abi) {
+                       case LTTNG_SYSCALL_ABI_NATIVE:
+                               dispatch_list = &syscall_table->unknown_syscall_dispatch;
+                               break;
+                       case LTTNG_SYSCALL_ABI_COMPAT:
+                               dispatch_list = &syscall_table->compat_unknown_syscall_dispatch;
+                               break;
+                       default:
+                               ret = -EINVAL;
+                               goto end;
+                       }
                        break;
-               case LTTNG_SYSCALL_ABI_COMPAT:
-                       dispatch_list = &group->event_notifier_compat_syscall_dispatch[syscall_id];
+               case LTTNG_SYSCALL_EXIT:
+                       switch (event->priv->u.syscall.abi) {
+                       case LTTNG_SYSCALL_ABI_NATIVE:
+                               dispatch_list = &syscall_table->unknown_syscall_exit_dispatch;
+                               break;
+                       case LTTNG_SYSCALL_ABI_COMPAT:
+                               dispatch_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
+                               break;
+                       default:
+                               ret = -EINVAL;
+                               goto end;
+                       }
                        break;
                default:
                        ret = -EINVAL;
                        goto end;
                }
-               break;
-       case LTTNG_SYSCALL_EXIT:
-               switch (event_notifier->priv->parent.u.syscall.abi) {
-               case LTTNG_SYSCALL_ABI_NATIVE:
-                       dispatch_list = &group->event_notifier_exit_syscall_dispatch[syscall_id];
+       } else {
+               ret = lttng_syscall_filter_enable(syscall_table->sc_filter,
+                       event->priv->desc->event_name, event->priv->u.syscall.abi,
+                       event->priv->u.syscall.entryexit, syscall_id);
+               if (ret)
+                       return ret;
+
+               switch (event->priv->u.syscall.entryexit) {
+               case LTTNG_SYSCALL_ENTRY:
+                       switch (event->priv->u.syscall.abi) {
+                       case LTTNG_SYSCALL_ABI_NATIVE:
+                               dispatch_list = &syscall_table->syscall_dispatch[syscall_id];
+                               break;
+                       case LTTNG_SYSCALL_ABI_COMPAT:
+                               dispatch_list = &syscall_table->compat_syscall_dispatch[syscall_id];
+                               break;
+                       default:
+                               ret = -EINVAL;
+                               goto end;
+                       }
                        break;
-               case LTTNG_SYSCALL_ABI_COMPAT:
-                       dispatch_list = &group->event_notifier_exit_compat_syscall_dispatch[syscall_id];
+               case LTTNG_SYSCALL_EXIT:
+                       switch (event->priv->u.syscall.abi) {
+                       case LTTNG_SYSCALL_ABI_NATIVE:
+                               dispatch_list = &syscall_table->syscall_exit_dispatch[syscall_id];
+                               break;
+                       case LTTNG_SYSCALL_ABI_COMPAT:
+                               dispatch_list = &syscall_table->compat_syscall_exit_dispatch[syscall_id];
+                               break;
+                       default:
+                               ret = -EINVAL;
+                               goto end;
+                       }
                        break;
                default:
                        ret = -EINVAL;
                        goto end;
                }
-               break;
-       default:
-               ret = -EINVAL;
-               goto end;
        }
 
-       hlist_add_head_rcu(&event_notifier->priv->parent.u.syscall.node, dispatch_list);
-
+       hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_list);
 end:
-       return ret ;
-}
-
-int lttng_syscall_filter_enable_event(
-               struct lttng_channel *channel,
-               struct lttng_kernel_event_recorder *event_recorder)
-{
-       WARN_ON_ONCE(event_recorder->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
-
-       return lttng_syscall_filter_enable(channel->sc_filter,
-               event_recorder->priv->parent.desc->event_name,
-               event_recorder->priv->parent.u.syscall.abi,
-               event_recorder->priv->parent.u.syscall.entryexit);
+       return ret;
 }
 
 static
-int lttng_syscall_filter_disable(
-               struct lttng_syscall_filter *filter,
+int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
                const char *desc_name, enum lttng_syscall_abi abi,
-               enum lttng_syscall_entryexit entryexit)
+               enum lttng_syscall_entryexit entryexit,
+               unsigned int syscall_id)
 {
        const char *syscall_name;
        unsigned long *bitmap;
-       int syscall_nr;
+       u32 *refcount_map;
 
        syscall_name = get_syscall_name(desc_name, abi, entryexit);
 
-       switch (abi) {
-       case LTTNG_SYSCALL_ABI_NATIVE:
-               syscall_nr = get_syscall_nr(syscall_name);
-               break;
-       case LTTNG_SYSCALL_ABI_COMPAT:
-               syscall_nr = get_compat_syscall_nr(syscall_name);
-               break;
-       default:
-               return -EINVAL;
-       }
-       if (syscall_nr < 0)
-               return -ENOENT;
-
        switch (entryexit) {
        case LTTNG_SYSCALL_ENTRY:
                switch (abi) {
                case LTTNG_SYSCALL_ABI_NATIVE:
                        bitmap = filter->sc_entry;
+                       refcount_map = filter->sc_entry_refcount_map;
                        break;
                case LTTNG_SYSCALL_ABI_COMPAT:
                        bitmap = filter->sc_compat_entry;
+                       refcount_map = filter->sc_compat_entry_refcount_map;
                        break;
                default:
                        return -EINVAL;
@@ -2173,9 +1083,11 @@ int lttng_syscall_filter_disable(
                switch (abi) {
                case LTTNG_SYSCALL_ABI_NATIVE:
                        bitmap = filter->sc_exit;
+                       refcount_map = filter->sc_exit_refcount_map;
                        break;
                case LTTNG_SYSCALL_ABI_COMPAT:
                        bitmap = filter->sc_compat_exit;
+                       refcount_map = filter->sc_compat_exit_refcount_map;
                        break;
                default:
                        return -EINVAL;
@@ -2184,39 +1096,45 @@ int lttng_syscall_filter_disable(
        default:
                return -EINVAL;
        }
-       if (!test_bit(syscall_nr, bitmap))
-               return -EEXIST;
-       bitmap_clear(bitmap, syscall_nr, 1);
-
+       if (refcount_map[syscall_id] == 0)
+               return -ENOENT;
+       if (--refcount_map[syscall_id] == 0)
+               bitmap_clear(bitmap, syscall_id, 1);
        return 0;
 }
 
-int lttng_syscall_filter_disable_event_notifier(
-               struct lttng_kernel_event_notifier *event_notifier)
+int lttng_syscall_filter_disable_event(struct lttng_kernel_event_common *event)
 {
-       struct lttng_event_notifier_group *group = event_notifier->priv->group;
+       struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
+       unsigned int syscall_id = event->priv->u.syscall.syscall_id;
        int ret;
 
-       WARN_ON_ONCE(event_notifier->priv->parent.instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
-
-       ret = lttng_syscall_filter_disable(group->sc_filter,
-               event_notifier->priv->parent.desc->event_name,
-               event_notifier->priv->parent.u.syscall.abi,
-               event_notifier->priv->parent.u.syscall.entryexit);
-       WARN_ON_ONCE(ret != 0);
-
-       hlist_del_rcu(&event_notifier->priv->parent.u.syscall.node);
+       /* Except for unknown syscall */
+       if (syscall_id != -1U) {
+               ret = lttng_syscall_filter_disable(syscall_table->sc_filter,
+                       event->priv->desc->event_name, event->priv->u.syscall.abi,
+                       event->priv->u.syscall.entryexit, syscall_id);
+               if (ret)
+                       return ret;
+       }
+       hlist_del_rcu(&event->priv->u.syscall.node);
        return 0;
 }
 
-int lttng_syscall_filter_disable_event(
-               struct lttng_channel *channel,
-               struct lttng_kernel_event_recorder *event_recorder)
+void lttng_syscall_table_set_wildcard_all(struct lttng_event_enabler_common *event_enabler)
 {
-       return lttng_syscall_filter_disable(channel->sc_filter,
-               event_recorder->priv->parent.desc->event_name,
-               event_recorder->priv->parent.u.syscall.abi,
-               event_recorder->priv->parent.u.syscall.entryexit);
+       struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(event_enabler);
+       enum lttng_kernel_abi_syscall_entryexit entryexit;
+       int enabled = event_enabler->enabled;
+
+       if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
+               return;
+       entryexit = event_enabler->event_param.u.syscall.entryexit;
+       if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
+               WRITE_ONCE(syscall_table->syscall_all_entry, enabled);
+
+       if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
+               WRITE_ONCE(syscall_table->syscall_all_exit, enabled);
 }
 
 static
@@ -2225,14 +1143,14 @@ const struct trace_syscall_entry *syscall_list_get_entry(loff_t *pos)
        const struct trace_syscall_entry *entry;
        int iter = 0;
 
-       for (entry = sc_table;
-                       entry < sc_table + ARRAY_SIZE(sc_table);
+       for (entry = sc_table.table;
+                       entry < sc_table.table + sc_table.len;
                         entry++) {
                if (iter++ >= *pos)
                        return entry;
        }
-       for (entry = compat_sc_table;
-                       entry < compat_sc_table + ARRAY_SIZE(compat_sc_table);
+       for (entry = compat_sc_table.table;
+                       entry < compat_sc_table.table + compat_sc_table.len;
                         entry++) {
                if (iter++ >= *pos)
                        return entry;
@@ -2264,21 +1182,21 @@ int get_sc_table(const struct trace_syscall_entry *entry,
                const struct trace_syscall_entry **table,
                unsigned int *bitness)
 {
-       if (entry >= sc_table && entry < sc_table + ARRAY_SIZE(sc_table)) {
+       if (entry >= sc_table.table && entry < sc_table.table + sc_table.len) {
                if (bitness)
                        *bitness = BITS_PER_LONG;
                if (table)
-                       *table = sc_table;
+                       *table = sc_table.table;
                return 0;
        }
-       if (!(entry >= compat_sc_table
-                       && entry < compat_sc_table + ARRAY_SIZE(compat_sc_table))) {
+       if (!(entry >= compat_sc_table.table
+                       && entry < compat_sc_table.table + compat_sc_table.len)) {
                return -EINVAL;
        }
        if (bitness)
                *bitness = 32;
        if (table)
-               *table = compat_sc_table;
+               *table = compat_sc_table.table;
        return 0;
 }
 
@@ -2296,11 +1214,11 @@ int syscall_list_show(struct seq_file *m, void *p)
                return ret;
        if (!entry->desc)
                return 0;
-       if (table == sc_table) {
+       if (table == sc_table.table) {
                index = entry - table;
                name = &entry->desc->event_name[strlen(SYSCALL_ENTRY_STR)];
        } else {
-               index = (entry - table) + ARRAY_SIZE(sc_table);
+               index = (entry - table) + sc_table.len;
                name = &entry->desc->event_name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
        }
        seq_printf(m,   "syscall { index = %lu; name = %s; bitness = %u; };\n",
@@ -2333,7 +1251,7 @@ const struct file_operations lttng_syscall_list_fops = {
 /*
  * A syscall is enabled if it is traced for either entry or exit.
  */
-long lttng_channel_syscall_mask(struct lttng_channel *channel,
+long lttng_syscall_table_get_active_mask(struct lttng_kernel_syscall_table *syscall_table,
                struct lttng_kernel_abi_syscall_mask __user *usyscall_mask)
 {
        uint32_t len, sc_tables_len, bitmask_len;
@@ -2353,14 +1271,14 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
        tmp_mask = kzalloc(bitmask_len, GFP_KERNEL);
        if (!tmp_mask)
                return -ENOMEM;
-       filter = channel->sc_filter;
+       filter = syscall_table->sc_filter;
 
-       for (bit = 0; bit < ARRAY_SIZE(sc_table); bit++) {
+       for (bit = 0; bit < sc_table.len; bit++) {
                char state;
 
-               if (channel->sc_table) {
-                       if (!(READ_ONCE(channel->syscall_all_entry)
-                                       || READ_ONCE(channel->syscall_all_exit)) && filter)
+               if (syscall_table->syscall_dispatch) {
+                       if (!(READ_ONCE(syscall_table->syscall_all_entry)
+                                       || READ_ONCE(syscall_table->syscall_all_exit)) && filter)
                                state = test_bit(bit, filter->sc_entry)
                                        || test_bit(bit, filter->sc_exit);
                        else
@@ -2373,12 +1291,12 @@ long lttng_channel_syscall_mask(struct lttng_channel *channel,
        for (; bit < sc_tables_len; bit++) {
                char state;
 
-               if (channel->compat_sc_table) {
-                       if (!(READ_ONCE(channel->syscall_all_entry)
-                                       || READ_ONCE(channel->syscall_all_exit)) && filter)
-                               state = test_bit(bit - ARRAY_SIZE(sc_table),
+               if (syscall_table->compat_syscall_dispatch) {
+                       if (!(READ_ONCE(syscall_table->syscall_all_entry)
+                                       || READ_ONCE(syscall_table->syscall_all_exit)) && filter)
+                               state = test_bit(bit - sc_table.len,
                                                filter->sc_compat_entry)
-                                       || test_bit(bit - ARRAY_SIZE(sc_table),
+                                       || test_bit(bit - sc_table.len,
                                                filter->sc_compat_exit);
                        else
                                state = 1;
@@ -2398,7 +1316,7 @@ int lttng_abi_syscall_list(void)
        struct file *syscall_list_file;
        int file_fd, ret;
 
-       file_fd = lttng_get_unused_fd();
+       file_fd = get_unused_fd_flags(0);
        if (file_fd < 0) {
                ret = file_fd;
                goto fd_error;
This page took 0.070553 seconds and 4 git commands to generate.