rethook_hook(9)

✨ NAME ✨

rethook_hook — hook the current function return, periodt 💅

okay bestie, welcome to the Kernel API Manual entry for rethook_hook(9) — yes, we're doing kernel tracing lore today 🫶

---

🌈 SYNOPSIS 🌈

void rethook_hook (struct rethook_node *node , struct pt_regs *regs , bool mcount );

---

🦋 ARGUMENTS 🦋

• node — the struct rethook node to hook the function return 🎀
• regs — the struct pt_regs for the function entry ✨
• mcount — true if this is called from mcount(ftrace) context 💖

---

💖 DESCRIPTION 💖

Hook the current running function return. This must be called at the function entry — or at least regs must be the registers of the function entry, bestie, don't play with me 😭

mcount is used for identifying the context. If this is called from an ftrace (mcount) callback, mcount must be set true. If this is called from the real function entry (e.g. kprobes), mcount must be set false. This is because the way to hook the function return depends on the context — different vibes, different hooking path, no cap 🔥

lowkey important: the true/false here is not decor, it tells the function which context it's in 💀

---

⭐ SEE ALSO ⭐

Kernel file ./kernel/trace/rethook.c is the source file to peek at 👑 and the related pages are:

• rethook_stop(9)
• rethook_free(9)
• rethook_alloc(9)
• rethook_recycle(9)
• rethook_try_get(9)
• rethook_find_ret_addr(9)

---

mwah 💋 this cutie came from ./kernel/trace and is dated October 2026 — iconic, honestly 🦋🌸