This structure is architecture dependent so I will just assume you are on x86.
On entry:
orig_eax = syscall_nr;
ebx = 1st argument of the function;
ecx = 2nd arg...
edx = 3rd arg...
esi = 4th arg...
edi = 5th arg... (you are lucky, on other arch this can be on the stack...)
On exit:
orig_eax = return value of the function
You cannot assume that the value inside ebx,ecx,edx... still points to the argument of the function on exit (i.e. when your post_handler is called) so here you would need to register two handlers, one on entry, from which you can can save a pointer to the struct socket, and one on exit, from which you will actually inspect the content of the struct socket now that it's been filled. To pass data between the two handlers, you can use the filed data
of the kretprobe_instance
structure. Don't forget to increase the data_size
filed of the struct kretprobe
when you register your kretprobe.
This might seem a little complex but it should be alright once you are a bit more familiar with it.
Please also remember that if the only thing you need to do is trace those events, you might just use the ftrace infrastructure in sysfs and with minimum efforts get the trace that you want.