一句话：提出 Merlin，利用定制 LLVM pass 与字节码重写对 eBPF 程序做指令合并与强度削减，显著减少指令数并降低运行时开销。
eBPF 是基于寄存器的内核虚拟机，其定制 ISA 对指令数量有严格限制并需通过内核安全验证，因此 eBPF 程序必须经过大量优化才能达到性能目标。然而现有编译器往往忽略关键优化机会，生成代码性能次优。本文提出 Merlin，一个结合定制 LLVM pass 与字节码重写的优化框架，用于中间表示（IR）变换与字节码精化，并采用指令合并与强度削减两种主要优化策略；这些优化均在 eBPF 验证之前实施。作者在 19 个 XDP 程序（来自 Linux 内核、Meta、hXDP 和 Cilium）以及三个基于 eBPF 的系统（Sysdig、Tetragon、Tracee，各包含数百个 eBPF 程序）上评估 Merlin。结果表明，所有优化后程序均通过内核验证，指令数减少 73%、运行时开销降低 60%；与当前最优技术 K2 相比，吞吐量提升 0.59%、延迟降低 5.31%，同时速度快 106 倍，并能更好地扩展到更大更复杂的程序，且无需额外人工介入。
eBPF (extended Berkeley Packet Filter) significantly enhances observability, performance, and security within the Linux kernel, playing a pivotal role in various real-world applications. Implemented as a register-based kernel virtual machine, eBPF features a customized Instruction Set Architecture (ISA) with stringent kernel safety requirements, e.g., a limited number of instructions. This constraint necessitates substantial optimization efforts for eBPF programs to meet performance objectives. Despite the availability of compilers supporting eBPF program compilation, existing tools often overlook key optimization opportunities, resulting in suboptimal performance. In response, this paper introduces Merlin, an optimization framework leveraging customized LLVM passes and bytecode rewriting for Instruction Representation (IR) transformation and bytecode refinement. Merlin employs two primary optimization strategies, i.e., instruction merging and strength reduction. These optimizations are deployed before eBPF verification. We evaluate Merlin across 19 XDP programs (drawn from the Linux kernel, Meta, hXDP, and Cilium) and three eBPF-based systems (Sysdig, Tetragon, and Tracee, each comprising several hundred eBPF programs). The results show that all optimized programs pass the kernel verification. Meanwhile, Merlin can reduce number of instructions by 73% and runtime overhead by 60% compared with the original programs. Merlin can also improve the throughput by 0.59% and reduce the latency by 5.31%, compared to state-of-the-art technique K2, while being 106 times faster and more scalable to larger and more complex programs without additional manual efforts.