Context information on function return

[Alex Iribarren <Alex dot Iribarren at cern dot ch>]

Hi,

I'm trying to use SystemTap to log network connections at the kernel
level, so I'm trying to hook into connect(), accept() and a couple of
other system calls.

In the case of accept(), the connecting IP address is returned in a
function parameter, so it isn't available at function entry, and its too
late at function return. Is it possible to:

a) Hook into a function right before return, so that the return value is
available but so are the function's variables?
b) Do a) without having to specify a line number withing the kernel
source, which would make the SystemTap files completely kernel dependent.
c) Access the parameters of accept() on return?
d) Positively match a function return to its entry?

Alternatively, is there another way I should be approaching this? Is
SystemTap not the right tool for the job?

Currently, I'm using a rather nasty hack involving storing the
parameters in a global array on function entry and reading and
processing them on function return. It works, but I don't like it and
there must be a better way.

Thanks a lot for your help.

Cheers,
Alex

Attachment: signature.asc
Description: OpenPGP digital signature