eBPF安全代理通过记忆化缓存实现CPU成本大幅下降

一个eBPF安全代理项目通过实现基于inode的缓存机制，大幅降低了文件策略查询的性能开销。1该优化将内核CPU成本从28亿个周期降低到3.03亿个周期，实现了约90%的性能提升。1

这一成果基于记忆化技术而非AI生成。1项目利用LRU哈希映射缓存已检查过的文件的策略结果，避免重复的路径遍历计算。1缓存键包含挂载命名空间ID、挂载ID和inode号三个字段，缓存大小限制为最多10000条条目。1为了保证安全性，对于硬链接（link count大于1的inode）不使用缓存，改为回退到慢路径处理。1该项目已在GitHub开源。1

An eBPF security proxy project has successfully reduced the kernel CPU overhead of file policy queries by approximately 90% through the implementation of an inode-based caching mechanism 1. The optimization brings the CPU cost down from 28 billion cycles to 3.03 billion cycles 1, demonstrating a significant performance improvement without relying on AI-generated solutions 1.

The efficiency gain is achieved by leveraging memoization and an LRU hash map to cache policy results for previously checked files, thereby eliminating redundant path traversal calculations 1. The caching system uses a composite key containing three fields: mount namespace ID, mount ID, and inode number 1. To prevent memory bloat, the cache is configured with a maximum capacity of 10,000 entries using the BPF_MAP_TYPE_LRU_HASH structure 1. For hardlinked files—those with a link count greater than one—the system deliberately bypasses the cache and reverts to the slower path to maintain correctness 1. The project is available as open source on GitHub 1.