Optimizing eBPF loading with reachability analysis#

Dylan Reemerink (Isovalent/Cisco; Cilium committer, ebpf-go maintainer)

• Why: Cilium still ships a compiler and builds eBPF on-target — the last major project not on CO-RE. The blocker is a genuine kernel bug class: with load-time config, dead code still creates maps and tail calls because the verifier increments map refcounts before dead-code elimination runs. This is the fix that unlocks Cilium's CO-RE migration.
• What: A userspace reachability analysis (in ebpf-go) that predicts, given a set of global constants, which eBPF instructions are unreachable — so unused maps are never created and unused tail calls never loaded. The analysis has false negatives but no false positives.
• How: Builds a basic-block graph over the program's instructions, evaluates branches on .rodata-backed config variables, and handles the hard cases: backtracking through stack spills, sign extensions (including the new ISAv3 32-bit forms), bitmask/shift patterns, 64-bit immediates beyond branch-imm width, and more. Cilium has 94 datapath settings, so the payoff is large: smaller images, faster loads, less attack surface.
• Where applicable: Cilium first, but the technique applies to any CO-RE project with heavy feature toggles. The speaker also flags that the verifier's map-refcount handling could be improved in-kernel. Watch the Cilium roadmap: this is a direct signal of the project's pre-compiled future.