Steven Rostedt wrote: [...]
We're not doing back traces. We need to modify the return of the function being called. Note, the above functions that end with ";" are leaf functions. Non leaf functions show "{" and end with "}". The trick here is to find a reliable way to modify the return address.
Well that's what I get for chiming in without fully understanding the context.
I think it is fine to search backwards from the ($ra - 8) of the call to _mcount until you encounter the adjustment of $sp. If you encounter a store of $ra, you can assume that the function will use the stored value when returning, otherwise modify the value restored to $ra (passed in $at). That is probably what you were doing to begin with.
David Daney