Dropping eBPF CPU Cost by 90% with Memoization

Introduction

In the world of software development, performance optimization is an endless pursuit. For those working with eBPF (extended Berkeley Packet Filter), a technology increasingly popular for system observation and security, efficiency is crucial. Recently, an innovative approach has allowed us to reduce eBPF CPU costs by up to 90%: memoization.

Understanding the Problem

In a security agent using eBPF, the highest cost isn’t applying the policy itself but determining which policy applies to a given file open. Since policies are path-based, each file open required reconstructing the path and checking at each level of the file system—a redundant and costly process when files are repeatedly accessed.

The Power of Memoization

Memoization involves storing the results of costly operations to avoid recalculating them. By applying this technique, the team developed an inode-based cache, allowing them to capture which policies apply to specific files without repeating the verification process. This cache is indexed by a mount namespace ID, a mount ID, and the inode number, ensuring uniqueness and reusability.

Impressive Results

With this optimization, CPU costs associated with enforcing security policies have dropped by about 90%. This represents a significant reduction in resource usage, which is critical in production environments where every CPU cycle counts.

Implementation and Open Source

The implementation of this optimization is now available as open source, allowing other developers to benefit from these improvements. The code is accessible on GitHub and can be integrated into other security projects using eBPF.

Real-World Examples

Consider a PostgreSQL server that needs to restrict access to its data directory: by using defined policies, only PostgreSQL can access /var/lib/postgres. Without memoization, each file access in this directory required traversing the hierarchy—a repetitive and inefficient task. With the cache, this information is instantly available.

Conclusion

Memoization offers an elegant and efficient solution to improve the performance of eBPF agents. If you're looking to optimize your security infrastructure, consider integrating this approach into your project.

Let's discuss your project in 15 minutes.