Hook model

A hook is a point in the running kernel where a verified program can be attached and executed. The hook model is the contract: which hooks exist, what context each provides, and what an attached program is allowed to do.

Supported attach types

The kernel executes attached programs in attachment order for a given attach type. Multiple programs may attach to the same hook.

Attach type	Name	Fires
1	timer	Periodic timer tick
2	gpio	GPIO interrupt
3	pwm	PWM period event
4	iio	Sensor sample ready
5	sys_enter	Syscall dispatcher entry, before execution
6	sys_exit	Syscall dispatcher, after the result is computed
7	sched_switch	Scheduler reschedule(), before the context switch

Execution model

The BPF VM passes a pointer to a BpfContext in register R1. Hook-specific payload is exposed through BpfContext.data, bounded by BpfContext.data_end. Programs load ctx.data first, then read the hook payload from that pointer.

struct BpfContext {
    const u8 *data;
    const u8 *data_end;
    const u8 *data_meta;
    u64 interrupt_latency_ns;
    u64 boot_time_ms;
    u64 kernel_heap_kb;
    u64 kernel_image_mb;
};

Hook payloads

sys_enter — attach type 5

Fires at syscall dispatcher entry, before the syscall executes.

struct SyscallTraceContext {
    u64 syscall_nr;
    u64 arg1; u64 arg2; u64 arg3;
    u64 arg4; u64 arg5; u64 arg6;
};

sys_exit — attach type 6

Fires after the syscall result is computed.

struct SyscallExitContext {
    u64 syscall_nr;
    i64 result;
};

sched_switch — attach type 7

Fires in the live scheduler path during reschedule(), before the low-level context switch.

struct SchedSwitchContext {
    u64 cpu_id;
    u64 prev_pid; u64 prev_tid;
    u64 next_pid; u64 next_tid;
};

Current semantics

• sys_enter, sys_exit, and sched_switch are observe-only.
• Programs may emit trace output, update maps, and write ring-buffer events.
• Programs do not currently modify syscall results, deny syscalls, or override scheduling decisions.
• A program failure is logged and does not change the kernel’s decision path.

This is enough for the current thesis claim:

runtime-loaded verified program → live kernel hook → ring buffer → userspace-visible effect

Policy semantics (deny / modify) are deferred until the dispatch path is stable. See the roadmap for where this is going.