EPSO: A Caching-Based Efficient Superoptimizer for BPF Bytecode

2025-11-19

AI Summary

Existing eBPF program optimization faces challenges including stringent verifier safety constraints, limited optimization capabilities of compilers like Clang, difficulty in manually designing rewrite rules, and prohibitively high computational overhead of superoptimization. Method: This paper proposes the first cache-based eBPF superoptimization framework. Its core innovation is offline equivalence-checking–driven supersearch to automatically generate and cache 795 reusable rewriting rules; at runtime, lightweight pattern matching efficiently applies these rules, ensuring both safety and low overhead. Contribution/Results: Evaluated on real-world projects, the framework achieves an average program size reduction of 24.37% (up to 68.87%), outperforming K2 across all benchmarks and surpassing Merlin in 92.68% of cases. It also reduces average runtime overhead by 6.60%, significantly improving throughput and latency in network applications.

Technology Category

• Search and Optimization: Distributed Search
• Machine Learning: Optimization
• Computer Vision: Learning & Optimization for CV

Application Category

• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines

Abstract

Extended Berkeley Packet Filter (eBPF) allows developers to extend Linux kernel functionality without modifying its source code. To ensure system safety, an in-kernel safety checker, the verifier, enforces strict safety constraints (for example, a limited program size) on eBPF programs loaded into the kernel. These constraints, combined with eBPF's performance-critical use cases, make effective optimization essential. However, existing compilers (such as Clang) offer limited optimization support, and many semantics-preserving transformations are rejected by the verifier, which makes handcrafted optimization rule design both challenging and limited in effectiveness. Superoptimization overcomes the limitations of rule-based methods by automatically discovering optimal transformations, but its high computational cost limits scalability. To address this, we propose EPSO, a caching-based superoptimizer that discovers rewrite rules via offline superoptimization and reuses them to achieve high-quality optimizations with minimal runtime overhead. We evaluate EPSO on benchmarks from the Linux kernel and several eBPF-based projects, including Cilium, Katran, hXDP, Sysdig, Tetragon, and Tracee. EPSO discovers 795 rewrite rules and achieves up to 68.87 percent (average 24.37 percent) reduction in program size compared to Clang's output, outperforming the state-of-the-art BPF optimizer K2 on all benchmarks and Merlin on 92.68 percent of them. Additionally, EPSO reduces program runtime by an average of 6.60 percent, improving throughput and lowering latency in network applications.

Problem

• Optimizing eBPF bytecode under strict kernel verifier constraints
• Overcoming computational limitations of traditional superoptimization methods
• Improving performance of eBPF programs in network applications

Innovation

• Uses offline superoptimization to discover rewrite rules
• Employs caching mechanism for efficient rule reuse
• Reduces program size and runtime with minimal overhead