Merlin - Multi-tier Optimization of eBPF Code for Performance and Compactness

Aug 20, 2026

Upload by Skyler

eBPF (extended Berkeley Packet Filter) improves observability, performance, and security in the Linux kernel by executing safe, sandboxed bytecode through a register-based virtual machine with a customized ISA and strict verifier constraints. These limits, such as a restricted instruction budget, make efficient optimization essential, yet existing tools often miss key opportunities. Merlin introduces an optimization framework using customized LLVM passes and bytecode rewriting before verification, applying instruction merging and strength reduction. Evaluation on 19 XDP programs and three eBPF-based systems shows successful verification, 73% fewer instructions, 60% lower runtime overhead, and improved throughput/latency versus K2, with higher scalability.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages15

Reading Time38 min

AccessFree to download

Abstract

Introduction

Merlin: Multi-tier Optimization of eBPF Code for Performance and Compactness Jinsong Mao [jinsongmao@umass.edu](jinsongmao@umass.edu)[ ](jinsongmao@umass.edu)University of Massachusetts Amherst USA Juan Zhai [juanzhai@umass.edu](juanzhai@umass.edu)[ ](juanzhai@umass.edu)University of Massachusetts Amherst USA Hailun Ding [hailun.ding@rutgers.edu](hailun.ding@rutgers.edu)[ ](hailun.ding@rutgers.edu)Rutgers University USA Shiqing Ma [shiqingma@umass.edu](shiqingma@umass.edu)[ ](shiqingma@umass.edu)University of Massachusetts Amherst USA Abstract eBPF (extended Berkeley Packet Filter) significantly enhancesobservability, performance, and security within the Linux kernel, playing a pivotal role in various real-world applications. Implemented as a register-based kernel virtual machine, eBPF features a customized Instruction Set Architecture (ISA) with stringent kernel safety requirements, e.g., a limited number of instructions. This constraint necessitates substantial optimization efforts for eBPF programs to meet performance objectives. Despite the availability of compilers supporting eBPF program compilation, existing tools often overlook key optimization opportunities, resulting in suboptimal performance. In response, this paper introduces Merlin, an optimization framework leveraging customized LLVM passes and bytecode rewriting for Instruction Representation (IR) transformation and bytecode refinement. Merlin employs two primary optimization strategies, i.e., instruction merging and strength reduction. These optimizations are deployed before eBPF verification. We evaluate Merlin across 19 XDP programs (drawn from the Linux kernel, Meta, hXDP, and Cilium) and three eBPF-based systems (Sysdig, Tetragon, and Tracee, each comprising several hundred eBPF programs) . The results show that all optimized programs pass the kernel verification. Meanwhile, Merlin can reduce number of instructions by 73% and runtime overhead by 60% compared with the original programs. Merlin can also improve the throughput by 0.59% and reduce the latency by 5.31%, compared to state-of-the-art technique K2 , while being 106 times faster and more scalable to larger and more complex programs without additional manual efforts. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for thirdparty components of this work must be honored. For all other uses, contact the owner/author(s) . ASPLOS’24, April 27-May 1, 2024, La Jolla, CA, USA © 2024 Copyright held by the owner/author(s) . ACM ISBN 979-8-4007-0386-7/24/04 . [https://doi.org/10.1145/3620666.3651387](https://doi.org/10.1145/3620666.3651387) CCS Concepts: • Hardware → Emerging languages and compilers; • Software and its engineering → Software performance. Keywords: eBPF Optimization, LLVM ACM Reference Format: Jinsong Mao, HailunDing, Juan Zhai, and Shiqing Ma. 2024. Merlin: Multi-tier Optimization ofeBPF Code for Performance and Compactness. In 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3 (ASPLOS’24), April 27-May 1, 2024, La Jolla, CA, USA. ACM, New York, NY, USA, 15 pages. [https://doi.org/10.1145/3620666.3651387](https://doi.org/10.1145/3620666.3651387) 1 Introduction Extended Berkeley Packet Filter (eBPF) is a Linux kernel technology that allows safe, sandboxed execution of userprovided programs to efficiently observe and trace various kernel objects like networking stacks, system calls, and filesystems [8] . eBPF provides a programmable interface for users to customize monitoring and performance analysis without having to modify kernel source code. Since its introduction in Linux kernel 4.4, eBPF has been widely adopted in major cloud providers and companie

FAQs

What problem does Merlin address in eBPF program deployment?

eBPF bytecode is limited in length and instruction count and must satisfy strict verifier checks, so many useful programs need heavy optimization to both pass verification and achieve good performance.

How does Merlin optimize eBPF code before verification?

Merlin uses customized LLVM passes and bytecode rewriting to transform instruction representation, then applies two main strategies: instruction merging and strength reduction.

What performance and compactness gains does Merlin achieve?

Across 19 XDP programs and three systems, Merlin reduces instruction count by 73% and runtime overhead by 60%, and improves throughput and latency compared with the K2 state-of-the-art technique.

Aug 20, 2026

Upload by Skyler