Hacker NewsHacker News
Dropping eBPF CPU Cost by About 90% with Memoization (Not AI Gen)
63 points by nathannaveen 14 hours ago | 17 comments
Allybag 38 minutes ago
Seems like the 90% faster case is opening the same exact file every single time, which seems like a not super standard use case that will benefit the most from this caching. On an example where you never open the same file twice this will presumably be slightly slower than before, as you’re doing the same thing but writing to a cache. So you can make the headline “Drop performance cost by 90%!” or “Modestly increase performance cost” and be correct but I don’t think either is really a reasonable description of the change.
reply
danudey 6 hours ago
Very confused by the article. Is memoization new to the eBPF world? Did the author only just learn about it and wanted to use it?

In reality, the article is about correctly caching a path:policy mapping while working within the limitations of eBPF and Linux filesystem semantics. If you read the article in that context rather than wondering 'what is new and interesting about memoization in eBPF?' it's a lot more interesting.

I probably would have titled this 'Calculating cache keys for filesystem paths in eBPF' or something, since that's the cool and interesting problem that was solved.

reply
debatem1 2 hours ago
Definitely not new in eBPF or LSMs in general.

Edit: link to the SELinux kernel Access Vector Cache (AVC): https://elixir.bootlin.com/linux/v3.4.64/source/security/sel...

reply
ComputerGuru 29 minutes ago
How do your path-only rules handle the many approaches for loading a file but making it appear to have a different path, such as bind mounts for one example?
reply
mrbluecoat 6 hours ago
So you highlight "Not AI Gen" but you call the solution "Agent"? :D
reply
jaggederest 4 hours ago
Agent is an old school way to say "constantly running daemon to accomplish some specific purpose", as someone who wrote a lot of performance monitoring agents. AI is using the term appropriately, but I think assuming it's always AI-first is slightly tragic.
reply
zx8080 3 hours ago
No. The oldschool is "daemon".
reply
cstrahan 3 hours ago
reply
jaggederest 2 hours ago
Appreciate the references, I was the New Relic Ruby agent maintainer in 2010, as an additional reference. And we called it an agent, because it was hosted on the customer's infrastructure, but they didn't maintain or control it, we did. Regrettably no license to kill, and not much in the way of secrecy or gadgetry.
reply
selcuka 53 minutes ago
Agent is an older term, apparently from the 1950s [1]:

> Alan Kay, a longtime proponent of agent technology, provides a thumbnail sketch tracing the more recent roots of software agents: “The idea of an agent originated with John McCarthy in the mid-1950’s, and the term was coined by Oliver G. Selfridge a few years later, when they were both at the Massachusetts Institute of Technology. They had in view a system that, when given a goal, could carry out the details of the appropriate computer operations and could ask for and receive advice, offered in human terms, when it was stuck. An agent would be a ‘soft robot’ living and doing its business within the computer’s world.” (Kay 1984).

[1] https://scispace.com/pdf/an-introduction-to-software-agents-...

reply
Brian_K_White 56 minutes ago
No, the oldschool is agent for those things for which it was agent.

An agent may or may not also be a daemon. It can be a cron job where the only daemon was cron not the agent, and the agent doesn't persist and isn't a daemon.

It can be purely ephemeral where the only daemon was ssh or http or any other other generic communication service that is merely how the agent was delivered.

Countless ordinary "things that run on a host and perform tasks for some other host" were always called agents. Some of those were also daemons, just as they were also programs.

Nagios, crowdstrike, chef, puppet, ansible, vmware/kvm/virtualbox, jenkins... etc all have a slave part that runs (usually in the form of a daemon) which is and always was called the agent.

reply
bawolff 3 hours ago
Umm, wouldn't this break if you moved a directory that is somewhere up the path? Seems like a security issue if you cache what policy applies but the policy could change by user action.
reply
nathannaveen 3 hours ago
Hey, author here, that is a great catch, thanks for pointing it out! If we are protecting a directory, then only people with access will be able to move the dir, so we are assuming that they don’t move (or rename) the directory maliciously. And, if we aren’t trying to protect the directory, then it doesn’t really mater to our protection whether that directory is moved.

Additionally, we are thinking of evicting the inode associated with the directory from the cache if a directory is moved. Doing this would probably catch a ton of edge cases and make it simpler.

reply
nirmeetimthebes 50 minutes ago
[dead]
reply
asdfman123 4 hours ago
I don't know what any of these acronyms mean. With just a little more explanation the article could be accessible to a wider developer audience.
reply
theowaway213456 3 hours ago
Do yourself a favor and look up eBPF - it's incredibly powerful and cool tech. Basically lets you write scripts that run inside the kernel
reply
bawolff 3 hours ago
At some point, i feel like a tech article written to a tech audience has the right to assume certain technical knowledge. eBPF is not an obscure technology in the linux world, and its impossible to make your article target everyone while still being a good article.
reply
acedTrex 2 hours ago
I dont think an article title "dropping ebpf cpu cost with memoization" really needs to be accessible to a broad audience.
reply