Libra: Accelerating Socket I/O via Programmable Selective Data Copying

Abstract: Layer-7 (L7) proxies are critical to modern cloud-native systems, yet their performance is increasingly bottlenecked by copying entire payloads across the kernel-user boundary. Existing approaches reduce this overhead but typically sacrifice compatibility with unmodified POSIX applications, introduce new APIs, or require specialized environments. We show that, under conventional OS abstractions, fully eliminating kernel-user copies while preserving standard socket semantics for unmodified proxies is fundamentally impossible. This leads to a practical insight: in common L7 workloads, proxies inspect only small metadata (e.g., HTTP headers) for routing, while forwarding the bulk payload unchanged. Based on this insight, we present Libra, an OS-level selective-copy framework that copies only metadata to the user space and retains the bulk payload in the kernel for forwarding, reducing data movement without breaking compatibility. Libra uses eBPF to identify protocol-specific metadata boundaries and coordinate selective copy and payload reuse across receive and transmit paths, all without modifying the socket API. Implemented in Linux and evaluated with unmodified Nginx and HAProxy, Libra improves plaintext throughput by up to 4.2x and reduces P99 tail latency by over 90%. With hardware-offloaded kTLS, it boosts encrypted throughput by 2.0x and cuts tail latency by 65%.

• The paper introduces Libra, which redefines socket I/O by selectively copying metadata to achieve near zero-copy performance while preserving POSIX compatibility.
• It leverages eBPF state machines at ingress and egress to separate control data from bulk payloads, significantly reducing CPU copy overhead.
• Libra demonstrates up to 4.2× throughput in Nginx and 2.2× in HAProxy, with improvements in encrypted traffic via kTLS integration.

Libra: Accelerating Socket I/O via Programmable Selective Data Copying

Motivation and Theoretical Foundations

Layer-7 proxies are instrumental in cloud-native architectures, yet their performance is intrinsically limited by kernel-user boundary data copying. Profiling demonstrates that cross-boundary copy operations consume up to 55.6% of CPU cycles in real-world proxies, with receive-side copying particularly dominant due to fragmented sk_buff construction (Figure 1).

Figure 1: Proportion of total process CPU cycles spent on cross-boundary copies.

A formal analysis in the paper establishes that zero-copy and strict POSIX compatibility are inherently contradictory given mainstream OS constraints such as page-granular mapping and buffer allocation timing. The impossibility theorem demonstrates that arbitrary user-space buffer allocation precludes direct DMA, and page remapping cannot cover all possible buffer usages (Figure 2).

Figure 2: Virtual memory remapping process showing constraints of zero-copy under POSIX APIs.

While previous attempts—new syscall mechanisms, proxy bypass, virtual memory remapping, kernel-bypass APIs—ameliorate copy overheads, none achieve both zero-copy and transparent compatibility with unmodified POSIX-compliant applications. Page-aligned, pre-registered memory schemes are impractical for general-purpose software.

Libra Architecture

The core insight underpinning Libra is that most Layer-7 proxy workloads require parsing only small metadata (e.g., HTTP headers), while bulk payloads are forwarded unmodified. Libra reframes performance optimization: rather than copying entire payloads, it selectively copies metadata to user space and anchors payloads in the kernel for direct transmission.

Libra leverages eBPF for protocol-aware boundary identification and selective copy orchestration. Two eBPF state machines, RX-Prog and TX-Prog, operate at ingress (receive) and egress (send), respectively, to synchronize metadata extraction and payload forwarding (Figures 4, 5).

Figure 3: The eBPF-driven ingress state machine manages metadata parsing and selective copying.

Figure 4: The eBPF-driven egress state machine orchestrates payload retrieval and metadata assembly.

Anchored payloads are tracked by secure Virtual Payload Identifiers (VPIs), which are opaque 64-bit hashes mapped in a global eBPF map to underlying socket structures. This abstraction prevents exposure of kernel memory layout, complies with KASLR, and facilitates payload transfer across independent connections.

The design ensures that only negligible copy overhead is incurred for small metadata, with the bulk data path operating at near zero-copy efficiency. All workflows preserve standard socket semantics and require no application code modifications.

Performance Evaluation

Throughput and Latency

Extensive benchmarks show that Libra yields strong throughput and tail latency improvements versus the standard stack and kernel-bypass alternatives. For payloads $\geq$32KB, Libra achieves up to 4.2$\times$ throughput increase in Nginx and 2.2$\times$ in HAProxy, with P99 tail latency reductions exceeding 90% for large payloads (Figures 6, 7).

Figure 5: Nginx/HAProxy throughput scaling under increasing payloads.

Figure 6: Throughput comparison indicating acceleration of encrypted and plaintext forwarding.

For small payloads, Libra's fixed parsing costs offset copy savings, and performance converges to baseline. For larger payloads, elimination of per-byte copying benefits dominate and CPU utilization drops significantly.

kTLS Integration

Libra's zero-copy optimizations generalize to encrypted traffic via Kernel TLS (kTLS). With hardware-offloaded kTLS, Libra outperforms the standard stack—encrypted throughput doubles and tail latency falls by 65%. In software kTLS, fragmented payloads degrade AES-NI efficiency, offsetting copy savings. Hardware cryptography is poised to further amplify Libra's practical benefits.

CPU Efficiency and Micro-architectural Gains

Libra minimizes dTLB miss rates by avoiding new page walks during data forwarding (Figure 7), and per 1% stack-specific CPU utilization, Libra processes over 10$\times$ the data compared to standard copying for payloads $\geq$1024KB (Figure 8).

Figure 8: Percentage of CPU cycles spent on data copying across different proxies, highlighting Libra's efficiency.

Figure 7: dTLB miss rate reduction due to anchored payloads and contiguous physical addressing.

Detailed breakdowns (Figures 10, 11) indicate that the dominant Libra overheads are fixed metadata parsing, eBPF runtime, and anchored payload reuse—which remain payload-invariant, while baseline stack overheads scale linearly with payload size.

Figure 9: Analysis of CPU overhead components under software kTLS.

Figure 10: Analysis of CPU overhead components: kTLS HW vs. SW in the standard stack.

Practical and Theoretical Implications

Libra demonstrates that protocol-aware selective-copy mechanisms can bridge the gap between transparent compatibility and near zero-copy performance, providing substantial improvements for widely-used, unmodified L7 proxies. Its eBPF-driven framework is amenable to extension for multiplexed protocols (e.g., HTTP/2 stream demultiplexing) and kernel-bypass architectures, suggesting broader applicability to high-performance network stacks.

With the industry trend toward hardware cryptography and offloading (NIC-hardened kTLS), Libra's selective copy paradigm is well-positioned to maximize hardware acceleration gains while preserving full application transparency.

Conclusion

Libra introduces a principled and practical solution to Layer-7 proxy data-path optimization by formalizing the zero-copy/compatibility conflict and pivoting toward selective-copy that leverages protocol-aware boundaries. Performance results validate significant throughput and latency gains for both plaintext and encrypted forwarding without application changes. These findings underscore the potential for programmable, near zero-copy network IO within standard OS abstractions and provide a basis for future advances in OS-level network stack acceleration.