ftrace_graph_get_ret_stack(9)

💅 ftrace_graph_get_ret_stack — a Kernel API Manual moment

okay so bestie, gather round, because we're diving into the Kernel API Manual and this one is genuinely iconic if you're into shadow stacks (and honestly? who isn't). It's ftrace_graph_get_ret_stack(9) and it's giving "small function, big responsibility" energy.

✨ NAME ✨

ftrace_graph_get_ret_stack — return the entry of the shadow stack 🫶

✨ SYNOPSIS ✨

struct ftrace_ret_stack * ftrace_graph_get_ret_stack (struct task_struct
*task , int idx );

✨ ARGUMENTS ✨

• task — the task you wanna read the shadow stack from. like, which one of your little guys are we snooping on 💖
• idx — index down the shadow stack. it's the "how far back are we going" number, no cap.

✨ DESCRIPTION ✨

So here's the tea ☕: this returns the ret_struct on the task's shadow stack, at the call graph position idx, and idx starts at zero. Simple as that.

• if idx is zero, you get the last saved ret_stack entry. the freshest one. the most recent vibe. ✨
• if idx is greater than zero, you get the corresponding ret_stack for the depth of saved return addresses. like going down the stack of history, one level at a time 🦋

that's literally the whole thing. zero = most recent, bigger = deeper. iykyk 💅

🌈 SEE ALSO 🌈

• Kernel file ./kernel/trace/fgraph.c
• fgraph_reserve_data(9)
• fgraph_retrieve_data(9)
• fgraph_get_task_var(9)
• fgraph_retrieve_parent_data(9)
• ftrace_graph_stop(9)
• ftrace_graph_top_ret_addr(9)
• ftrace_graph_ret_addr(9)

and that's the whole page, bestie, go forth and read those shadow stacks 👑

sign-off vibes only: this little icon lives in ./kernel/trace and it's stamped October 2026 — periodt, that's the version and date, mwah 🎀💜