Skip to content

pkg/bpf: Do not load unused maps#39462

Closed
dylandreimerink wants to merge 30 commits intomainfrom
pr/dylandreimerink/unused-map-pruning
Closed

pkg/bpf: Do not load unused maps#39462
dylandreimerink wants to merge 30 commits intomainfrom
pr/dylandreimerink/unused-map-pruning

Conversation

@dylandreimerink
Copy link
Copy Markdown
Member

@dylandreimerink dylandreimerink commented May 9, 2025

At present we use ifdefs to manually determine when a map definition should be emitted into the object file. The object file gets parsed as collection spec, then when loading every map is created and its file descriptor linked into the bytecode before loading.

Given the quest for clang-freedom, we wish to be able to pre-compile our programs and only load maps for features that are enabled at load time via global variables.

This commit introduces this capability. It works by static analysis of the BPF program. By figuring out the basic blocks and finding global data accesses we can find branching instructions which are always or never taken. By excluding the "dead" parts of the program we can see which maps will and will not be in use after the verifier did dead code elimination as part of the loading process.

We then remove the unused maps from the spec before loading.

This technique works for both ifdefs as well as load time variables. Even for the current situation it is an improvement since we only need the ifdefs around code using the map. All maps can now be unconditionally defined, and developers no longer have to think about when maps are or are not loaded.

Fixes: #38375

bpf: Do not load defined but unused maps

@dylandreimerink dylandreimerink added area/loader Impacts the loading of BPF programs into the kernel. area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. dont-merge/preview-only Only for preview or testing, don't merge it. release-note/misc This PR makes changes that have no direct user impact. labels May 9, 2025
@dylandreimerink dylandreimerink mentioned this pull request May 9, 2025
Closed
@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch 3 times, most recently from 790da55 to e97a97e Compare May 9, 2025 14:42
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 9, 2025

/test

@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch 2 times, most recently from 7d10b9c to 282a6ad Compare May 9, 2025 16:01
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 9, 2025

/test

@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch 7 times, most recently from 020a9a9 to fc7e0f3 Compare May 14, 2025 10:18
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 14, 2025

/test

@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 14, 2025

/ci-e2e-upgrade

@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 14, 2025

/test

@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch from 5d95e62 to 0355c81 Compare May 15, 2025 09:12
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 15, 2025

/test

@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch from dc6acc0 to fa262e0 Compare May 16, 2025 08:55
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 16, 2025

/ci-e2e-upgrade

@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch from fa262e0 to 402fd1a Compare May 16, 2025 13:59
@dylandreimerink dylandreimerink removed the dont-merge/preview-only Only for preview or testing, don't merge it. label May 16, 2025
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented May 16, 2025

/test

@dylandreimerink dylandreimerink requested a review from ti-mo May 16, 2025 15:24
@dylandreimerink
bpf: unconditionally define cilium_throttle
37d7df8 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_egress_gw_policy_v6
bc1240f 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_encrypt_state
8ffc2d9 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_ipv{4,6}_frag_datagrams
1faf08b 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_skip_lb{4,6}
2b24fa2 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_reverse_nat
f82d475 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_services_v2
b3595e0 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_backends_v3
79544d4 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_affinity
cb631f8 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_source_range
8f89226 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_health
78528e6 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb{4,6}_maglev
8424dc7 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_lb_affinity_match
e1e5a91 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_mcast_group_outer_v4_map
9b54e87 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_snat_v{4,6}_external
63c2079 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_snat_v{4,6}_alloc_retries
bc86706 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_per_cluster_snat_v{4,6}_external
e9a99ea 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_ipmasq_v{4,6}
1f2c921 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_nodeport_neigh{4,6}
99825cf 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_capture{4,6}_rules
a2e17d7 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_srv6_{vrf,policy,sid}[_v{6,4}]
d9cb14d 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink
bpf: unconditionally define cilium_vtep_map
aa156ce 
Signed-off-by: Dylan Reimerink <dylan.reimerink@isovalent.com>
@dylandreimerink dylandreimerink force-pushed the pr/dylandreimerink/unused-map-pruning branch from 402fd1a to aa156ce Compare June 4, 2025 11:41
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented Jun 4, 2025

/test

@joestringer joestringer added the dont-merge/wait-until-release Freeze window for current release is blocking non-bugfix PRs label Jun 20, 2025
@joestringer joestringer removed the dont-merge/wait-until-release Freeze window for current release is blocking non-bugfix PRs label Jul 1, 2025
@ti-mo ti-mo marked this pull request as draft July 8, 2025 13:38
@ti-mo ti-mo mentioned this pull request Jul 8, 2025
Merged
@dylandreimerink
Copy link
Copy Markdown
Member Author

dylandreimerink commented Jul 11, 2025

Closing in favor of #40416 which significantly improves upon this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@julianwiedmann julianwiedmann julianwiedmann left review comments

@ti-mo ti-mo Awaiting requested review from ti-mo

@gentoo-root gentoo-root Awaiting requested review from gentoo-root gentoo-root is a code owner automatically assigned from cilium/sig-datapath

@ysksuzuki ysksuzuki Awaiting requested review from ysksuzuki ysksuzuki is a code owner automatically assigned from cilium/egress-gateway

Assignees

No one assigned

Labels

area/datapath Impacts bpf/ or low-level forwarding details, including map management and monitor messages. area/loader Impacts the loading of BPF programs into the kernel. release-note/misc This PR makes changes that have no direct user impact.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

bpf: avoid creating maps for disabled features

5 participants

@dylandreimerink @ti-mo @julianwiedmann @joestringer @msune