diff --git a/Makefile.objs b/Makefile.objs
index a8e022452f8f517727d69bb20f7414f2be43ef5a..02fb8e76b8caede64197a9b4cc1ddef071287910 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -142,6 +142,7 @@ trace-events-y += hw/dma/trace-events
 trace-events-y += hw/sparc/trace-events
 trace-events-y += hw/sd/trace-events
 trace-events-y += hw/isa/trace-events
+trace-events-y += hw/mem/trace-events
 trace-events-y += hw/i386/trace-events
 trace-events-y += hw/9pfs/trace-events
 trace-events-y += hw/ppc/trace-events
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 35125b720ff105e6901261107878a6adc7fc27ef..d803d3e10ceda755f95494403e21d975d75e1391 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -1116,7 +1116,6 @@ int main(int argc, char **argv)
         gdbserver_start (gdbstub_port);
         gdb_handlesig(cpu, 0);
     }
-    trace_init_vcpu_events();
     cpu_loop(env);
     /* never exits */
     return 0;
diff --git a/hw/i386/trace-events b/hw/i386/trace-events
index 1938b988d9957af288faf76dd1044c5293dd719b..d2b497327ee9c16f5f17de2140c3574c11624501 100644
--- a/hw/i386/trace-events
+++ b/hw/i386/trace-events
@@ -7,10 +7,6 @@ xen_platform_log(char *s) "xen platform: %s"
 xen_pv_mmio_read(uint64_t addr) "WARNING: read from Xen PV Device MMIO space (address %"PRIx64")"
 xen_pv_mmio_write(uint64_t addr) "WARNING: write to Xen PV Device MMIO space (address %"PRIx64")"
 
-# hw/i386/pc.c
-mhp_pc_dimm_assigned_slot(int slot) "%d"
-mhp_pc_dimm_assigned_address(uint64_t addr) "0x%"PRIx64
-
 # hw/i386/x86-iommu.c
 x86_iommu_iec_notify(bool global, uint32_t index, uint32_t mask) "Notify IEC invalidation: global=%d index=%" PRIu32 " mask=%" PRIu32
 
diff --git a/hw/mem/trace-events b/hw/mem/trace-events
new file mode 100644
index 0000000000000000000000000000000000000000..323c3c10d51f91eecec2394f20b0cfe556c13636
--- /dev/null
+++ b/hw/mem/trace-events
@@ -0,0 +1,5 @@
+# See docs/trace-events.txt for syntax documentation.
+
+# hw/mem/pc-dimm.c
+mhp_pc_dimm_assigned_slot(int slot) "%d"
+mhp_pc_dimm_assigned_address(uint64_t addr) "0x%"PRIx64
diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 55184d33b3e1d784ad2065d13218ac4c0a899355..8756cefa79b7b8ebd25828a73788c3b4d13e57a7 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -14,3 +14,8 @@ virtio_rng_guest_not_ready(void *rng) "rng %p: guest not ready"
 virtio_rng_pushed(void *rng, size_t len) "rng %p: %zd bytes pushed"
 virtio_rng_request(void *rng, size_t size, unsigned quota) "rng %p: %zd bytes requested, %u bytes quota left"
 
+# hw/virtio/virtio-balloon.c
+virtio_balloon_handle_output(const char *name, uint64_t gpa) "section name: %s gpa: %"PRIx64
+virtio_balloon_get_config(uint32_t num_pages, uint32_t actual) "num_pages: %d actual: %d"
+virtio_balloon_set_config(uint32_t actual, uint32_t oldactual) "actual: %d oldactual: %d"
+virtio_balloon_to_target(uint64_t target, uint32_t num_pages) "balloon target: %"PRIx64" num_pages: %d"
diff --git a/io/trace-events b/io/trace-events
index d064665f441ff9f1c6717312ccbe37e81ef2db17..e31b596ca1d2483f52d183c6f2ed129d6ef4cd9a 100644
--- a/io/trace-events
+++ b/io/trace-events
@@ -1,11 +1,5 @@
 # See docs/tracing.txt for syntax documentation.
 
-# io/buffer.c
-buffer_resize(const char *buf, size_t olen, size_t len) "%s: old %zd, new %zd"
-buffer_move_empty(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
-buffer_move(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
-buffer_free(const char *buf, size_t len) "%s: capacity %zd"
-
 # io/task.c
 qio_task_new(void *task, void *source, void *func, void *opaque) "Task new task=%p source=%p func=%p opaque=%p"
 qio_task_complete(void *task) "Task complete task=%p"
diff --git a/linux-user/main.c b/linux-user/main.c
index c8f85736142132c9f6799bf0812d9ebc8c653f0d..9e4b430d66fe9a213f855a5231f4cdd7151fe3f9 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -4748,7 +4748,6 @@ int main(int argc, char **argv, char **envp)
         }
         gdb_handlesig(cpu, 0);
     }
-    trace_init_vcpu_events();
     cpu_loop(env);
     /* never exits */
     return 0;
diff --git a/qom/cpu.c b/qom/cpu.c
index f783b5a6bd68e45d8fd00b5ee437d8b829e3c97a..484c49388d6d0f1c23b07fa613419501ead9c2e0 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -29,6 +29,7 @@
 #include "qemu/error-report.h"
 #include "sysemu/sysemu.h"
 #include "hw/qdev-properties.h"
+#include "trace.h"
 
 bool cpu_exists(int64_t id)
 {
@@ -245,6 +246,8 @@ void cpu_reset(CPUState *cpu)
     if (klass->reset != NULL) {
         (*klass->reset)(cpu);
     }
+
+    trace_guest_cpu_reset(cpu);
 }
 
 static void cpu_common_reset(CPUState *cpu)
@@ -333,6 +336,9 @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
         cpu_synchronize_post_init(cpu);
         cpu_resume(cpu);
     }
+
+    /* NOTE: latest generic point where the cpu is fully realized */
+    trace_init_vcpu(cpu);
 }
 
 static void cpu_common_initfn(Object *obj)
diff --git a/stubs/trace-control.c b/stubs/trace-control.c
index 2dfcd9fb2bd706c07d2c51d89961e6f945675343..f765a02018890c8df5996232ce9b6dcead23fc4c 100644
--- a/stubs/trace-control.c
+++ b/stubs/trace-control.c
@@ -44,3 +44,9 @@ void trace_event_set_vcpu_state_dynamic(CPUState *vcpu,
     /* should never be called on non-target binaries */
     abort();
 }
+
+void trace_init_vcpu(CPUState *vcpu)
+{
+    /* should never be called on non-target binaries */
+    abort();
+}
diff --git a/trace-events b/trace-events
index 1cb9d37ce4b17ececae66c7e1118d428bd17de6c..1a4e092418d06da0549f7287875c00ef297883c6 100644
--- a/trace-events
+++ b/trace-events
@@ -37,10 +37,6 @@ cpu_out(unsigned int addr, char size, unsigned int val) "addr %#x(%c) value %u"
 # balloon.c
 # Since requests are raised via monitor, not many tracepoints are needed.
 balloon_event(void *opaque, unsigned long addr) "opaque %p addr %lu"
-virtio_balloon_handle_output(const char *name, uint64_t gpa) "section name: %s gpa: %"PRIx64
-virtio_balloon_get_config(uint32_t num_pages, uint32_t actual) "num_pages: %d actual: %d"
-virtio_balloon_set_config(uint32_t actual, uint32_t oldactual) "actual: %d oldactual: %d"
-virtio_balloon_to_target(uint64_t target, uint32_t num_pages) "balloon target: %"PRIx64" num_pages: %d"
 
 # vl.c
 vm_state_notify(int running, int reason) "running %d reason %d"
@@ -83,19 +79,6 @@ xen_map_cache(uint64_t phys_addr) "want %#"PRIx64
 xen_remap_bucket(uint64_t index) "index %#"PRIx64
 xen_map_cache_return(void* ptr) "%p"
 
-# qemu-coroutine.c
-qemu_coroutine_enter(void *from, void *to, void *opaque) "from %p to %p opaque %p"
-qemu_coroutine_yield(void *from, void *to) "from %p to %p"
-qemu_coroutine_terminate(void *co) "self %p"
-
-# qemu-coroutine-lock.c
-qemu_co_queue_run_restart(void *co) "co %p"
-qemu_co_queue_next(void *nxt) "next %p"
-qemu_co_mutex_lock_entry(void *mutex, void *self) "mutex %p self %p"
-qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
-qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
-qemu_co_mutex_unlock_return(void *mutex, void *self) "mutex %p self %p"
-
 # monitor.c
 handle_qmp_command(void *mon, const char *cmd_name) "mon %p cmd_name \"%s\""
 monitor_protocol_event_handler(uint32_t event, void *qdict) "event=%d data=%p"
@@ -157,6 +140,19 @@ colo_filter_rewriter_conn_offset(uint32_t offset) ": offset=%u\n"
 
 ### Guest events, keep at bottom
 
+
+## vCPU
+
+# Hot-plug a new virtual (guest) CPU
+#
+# Targets: all
+vcpu guest_cpu_enter(void)
+
+# Reset the state of a virtual (guest) CPU
+#
+# Targets: all
+vcpu guest_cpu_reset(void)
+
 # @vaddr: Access' virtual address.
 # @info : Access' information (see below).
 #
@@ -173,6 +169,7 @@ colo_filter_rewriter_conn_offset(uint32_t offset) ": offset=%u\n"
 #     bool    store      : 1; /* wheter it's a store operation */
 # };
 #
+# Mode: user, softmmu
 # Targets: TCG(all)
 disable vcpu tcg guest_mem_before(TCGv vaddr, uint8_t info) "info=%d", "vaddr=0x%016"PRIx64" info=%d"
 
@@ -181,6 +178,7 @@ disable vcpu tcg guest_mem_before(TCGv vaddr, uint8_t info) "info=%d", "vaddr=0x
 #
 # Start executing a guest system call in syscall emulation mode.
 #
+# Mode: user
 # Targets: TCG(all)
 disable vcpu guest_user_syscall(uint64_t num, uint64_t arg1, uint64_t arg2, uint64_t arg3, uint64_t arg4, uint64_t arg5, uint64_t arg6, uint64_t arg7, uint64_t arg8) "num=0x%016"PRIx64" arg1=0x%016"PRIx64" arg2=0x%016"PRIx64" arg3=0x%016"PRIx64" arg4=0x%016"PRIx64" arg5=0x%016"PRIx64" arg6=0x%016"PRIx64" arg7=0x%016"PRIx64" arg8=0x%016"PRIx64
 
@@ -189,5 +187,6 @@ disable vcpu guest_user_syscall(uint64_t num, uint64_t arg1, uint64_t arg2, uint
 #
 # Finish executing a guest system call in syscall emulation mode.
 #
+# Mode: user
 # Targets: TCG(all)
 disable vcpu guest_user_syscall_ret(uint64_t num, uint64_t ret) "num=0x%016"PRIx64" ret=0x%016"PRIx64
diff --git a/trace/control-target.c b/trace/control-target.c
index 72081e2a34f7df1b5a8e2bba495bba0c1957b831..52fcce5a005d15f870346f11cf2ae1591bb8b082 100644
--- a/trace/control-target.c
+++ b/trace/control-target.c
@@ -9,6 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "trace.h"
 #include "trace/control.h"
 #include "translate-all.h"
 
@@ -81,3 +82,42 @@ void trace_event_set_vcpu_state_dynamic(CPUState *vcpu,
         }
     }
 }
+
+static bool adding_first_cpu(void)
+{
+    CPUState *cpu;
+    size_t count = 0;
+    CPU_FOREACH(cpu) {
+        count++;
+        if (count > 1) {
+            return false;
+        }
+    }
+    return true;
+}
+
+void trace_init_vcpu(CPUState *vcpu)
+{
+    TraceEvent *ev = NULL;
+
+    while ((ev = trace_event_pattern("*", ev)) != NULL) {
+        if (trace_event_is_vcpu(ev) &&
+            trace_event_get_state_static(ev) &&
+            trace_event_get_state_dynamic(ev)) {
+            TraceEventID id = trace_event_get_id(ev);
+            if (adding_first_cpu()) {
+                /* check preconditions */
+                assert(trace_events_dstate[id] == 1);
+                /* disable early-init state ... */
+                trace_events_dstate[id] = 0;
+                trace_events_enabled_count--;
+                /* ... and properly re-enable */
+                trace_event_set_vcpu_state_dynamic(vcpu, ev, true);
+            } else {
+                trace_event_set_vcpu_state_dynamic(vcpu, ev, true);
+            }
+        }
+    }
+
+    trace_guest_cpu_enter(vcpu);
+}
diff --git a/trace/control.c b/trace/control.c
index 05d85accbd7c82b9bae1a638796704600d906857..10b3e9babad6365636c0ec4747a666eaa1ee8a65 100644
--- a/trace/control.c
+++ b/trace/control.c
@@ -269,22 +269,3 @@ char *trace_opt_parse(const char *optarg)
 
     return trace_file;
 }
-
-void trace_init_vcpu_events(void)
-{
-    TraceEvent *ev = NULL;
-    while ((ev = trace_event_pattern("*", ev)) != NULL) {
-        if (trace_event_is_vcpu(ev) &&
-            trace_event_get_state_static(ev) &&
-            trace_event_get_state_dynamic(ev)) {
-            TraceEventID id = trace_event_get_id(ev);
-            /* check preconditions */
-            assert(trace_events_dstate[id] == 1);
-            /* disable early-init state ... */
-            trace_events_dstate[id] = 0;
-            trace_events_enabled_count--;
-            /* ... and properly re-enable */
-            trace_event_set_state_dynamic(ev, true);
-        }
-    }
-}
diff --git a/trace/control.h b/trace/control.h
index 27a16fc955704c6ce91486819b6d9d39418056e6..a22d11242e0fb211c36ac9135b9d66ad77b70391 100644
--- a/trace/control.h
+++ b/trace/control.h
@@ -238,6 +238,14 @@ bool trace_init_backends(void);
  */
 void trace_init_file(const char *file);
 
+/**
+ * trace_init_vcpu:
+ * @vcpu: Added vCPU.
+ *
+ * Set initial dynamic event state for a hot-plugged vCPU.
+ */
+void trace_init_vcpu(CPUState *vcpu);
+
 /**
  * trace_list_events:
  *
@@ -269,17 +277,6 @@ extern QemuOptsList qemu_trace_opts;
  */
 char *trace_opt_parse(const char *optarg);
 
-/**
- * trace_init_vcpu_events:
- *
- * Re-synchronize initial event state with vCPUs (which can be created after
- * trace_init_events()).
- *
- * Precondition: event states won't be changed between trace_enable_events() and
- * trace_init_vcpu_events() (e.g., through QMP).
- */
-void trace_init_vcpu_events(void);
-
 
 #include "trace/control-internal.h"
 
diff --git a/util/trace-events b/util/trace-events
index 747e6baf75efbaa06820e60863fe7de8b6a1c92f..ed06aee2ec76a8d29fcaaada74c1b903d7ed86f7 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -1,5 +1,24 @@
 # See docs/tracing.txt for syntax documentation.
 
+# util/buffer.c
+buffer_resize(const char *buf, size_t olen, size_t len) "%s: old %zd, new %zd"
+buffer_move_empty(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
+buffer_move(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
+buffer_free(const char *buf, size_t len) "%s: capacity %zd"
+
+# util/qemu-coroutine.c
+qemu_coroutine_enter(void *from, void *to, void *opaque) "from %p to %p opaque %p"
+qemu_coroutine_yield(void *from, void *to) "from %p to %p"
+qemu_coroutine_terminate(void *co) "self %p"
+
+# util/qemu-coroutine-lock.c
+qemu_co_queue_run_restart(void *co) "co %p"
+qemu_co_queue_next(void *nxt) "next %p"
+qemu_co_mutex_lock_entry(void *mutex, void *self) "mutex %p self %p"
+qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
+qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
+qemu_co_mutex_unlock_return(void *mutex, void *self) "mutex %p self %p"
+
 # util/oslib-win32.c
 # util/oslib-posix.c
 qemu_memalign(size_t alignment, size_t size, void *ptr) "alignment %zu size %zu ptr %p"
diff --git a/vl.c b/vl.c
index ab0349b0f42699ee5b7f6a1fb9a7fbe3c887eb7d..f3abd99eb2f9b2e7153d06f911d20b5d21cca61b 100644
--- a/vl.c
+++ b/vl.c
@@ -4660,7 +4660,6 @@ int main(int argc, char **argv, char **envp)
 
     os_setup_post();
 
-    trace_init_vcpu_events();
     main_loop();
     replay_disable_events();
     iothread_stop_all();