eBPF Program Lifecycle

eBPF Program Lifecycle A workflow diagram generated by Archify. 01 / Program lifecycle EX / Verification failure Load · bpf() syscall · Program lifecycle Load bpf() syscall Verify · Verifier · Program lifecycle Verify Verifier Attach · event hook · Program lifecycle Attach event hook Run · repeats per event · Program lifecycle Run repeats per event Detach · explicit teardown · Program lifecycle Detach explicit teardown Unload · when refs drop · Program lifecycle Unload when refs drop Load rejected · Verification failure Load rejected explicit detach pass fail Legend Kernel processing Verify Teardown

Event driven

  • • Runs every time the attached hook fires
  • • State persists in eBPF maps between runs

Cleanup

  • • Detaching from the hook stops execution
  • • The kernel unloads the program when references drop