Speeding Up eBPF File Opens by 54% (Not AI Gen)

The author describes three small changes to an open-source eBPF agent (between commits 9c521bd and cfc7538): skipping the LPM cache lookup when a path tail is shorter than 128 bytes, checking the inode cache before building the file path in lsm_file_open, and loading only lsm_inode_permission, tp_exit_openat and tp_exit_openat2 when ptrace blocking is enabled. In a benchmark opening one file 200,000 times and 20,000 new files, repeated opens dropped from 4.68 µs to 2.15 µs (about 54%) and cold opens from 6.33 µs to 5.36 µs (about 15%), with repeated-open p99 falling from 8.3 µs to 3.46 µs. The author notes he runs the perf test after each commit and gives the results to an LLM to find inefficiencies to fix.