foxido

eBPF compilation, part 2: We have compiler at home

Mon, 11 May 2026 00:00:00 +0300

In the previous part we walked through the userspace part of loading an eBPF program and stopped right before the kernel.

What does kernel do with eBPF?

The kernel’s task is to compile eBPF into native instructions. As with any compiler, there are 3 stages:

Front-end: eBPF verifier. It parses the received eBPF code and checks its validity. You can think of it as a borrow checker in Rust or static checks in Clang.

eBPF provides the following guarantees:

eBPF compilation, part 1: Userspace point of view

Wed, 29 Apr 2026 00:00:00 +0300

This is an enhanced transcription of my C++Russia talk. This research was done during my work on a Userspace JIT for eBPF (not opensource yet).

Recap: What is eBPF?

From a user’s perspective, eBPF is a restricted virtual machine inside the Linux kernel. Originally, the idea for eBPF came from the network subsystem, where it was designed for fast and safe packet filtering. Safety is the key part here – it is the main difference between eBPF’s VM approach and the raw binary approach of kernel modules. It is also much simpler to communicate with eBPF than with the kernel or kernel modules, because the “loader” process and the eBPF program can communicate via various types of maps (ring buffers, arrays, hash maps, etc.) instead of using sysfs, procfs, ioctls, and other filesystem-based mechanisms.

Fuzzing

Tue, 15 Jul 2025 20:00:00 +0300

Overview

Fuzzing is a software testing technique that involves feeding a program with random generated data to identify corner-case errors. There are different types of fuzzers:

“Black-box” fuzzers, that runs your program as-is, without any instrumentation and knowledge.
“Grey-box” fuzzers, that instruments your program at compile time or runs it inside QEMU (efficiently), gaining insight about control flow.

Grey-box fuzzers, also known as feedback-driven fuzzers, are superior to black-box ones but require full access to the binary or source code. By leveraging control-flow knowledge, they can employ genetic algorithms for input mutation, save new discovered path and explore your program step-by-step.

Understanding PostgreSQL internals, part 2: Executor (with JIT)

Mon, 09 Jun 2025 20:00:00 +0300

In the previous part, we discussed how PostgreSQL transforms declarative queries into imperative steps. Therefore, it seems logical to discuss the execution part next.

Overview

A basic understanding of how PostgreSQL executes trees can be obtained from the following source code comment:

/*
 *	 NOTES
 *		This used to be three files.  It is now all combined into
 *		one file so that it is easier to keep the dispatch routines
 *		in sync when new nodes are added.
 *
 *	 EXAMPLE
 *		Suppose we want the age of the manager of the shoe department and
 *		the number of employees in that department.  So we have the query:
 *
 *				select DEPT.no_emps, EMP.age
 *				from DEPT, EMP
 *				where EMP.name = DEPT.mgr and
 *					  DEPT.name = "shoe"
 *
 *		Suppose the planner gives us the following plan:
 *
 *						Nest Loop (DEPT.mgr = EMP.name)
 *						/		\
 *					   /		 \
 *				   Seq Scan		Seq Scan
 *					DEPT		  EMP
 *				(name = "shoe")
 *
 *		ExecutorStart() is called first.
 *		It calls InitPlan() which calls ExecInitNode() on
 *		the root of the plan -- the nest loop node.
 *
 *	  * ExecInitNode() notices that it is looking at a nest loop and
 *		as the code below demonstrates, it calls ExecInitNestLoop().
 *		Eventually this calls ExecInitNode() on the right and left subplans
 *		and so forth until the entire plan is initialized.  The result
 *		of ExecInitNode() is a plan state tree built with the same structure
 *		as the underlying plan tree.
 *
 *	  * Then when ExecutorRun() is called, it calls ExecutePlan() which calls
 *		ExecProcNode() repeatedly on the top node of the plan state tree.
 *		Each time this happens, ExecProcNode() will end up calling
 *		ExecNestLoop(), which calls ExecProcNode() on its subplans.
 *		Each of these subplans is a sequential scan so ExecSeqScan() is
 *		called.  The slots returned by ExecSeqScan() may contain
 *		tuples which contain the attributes ExecNestLoop() uses to
 *		form the tuples it returns.
 *
 *	  * Eventually ExecSeqScan() stops returning tuples and the nest
 *		loop join ends.  Lastly, ExecutorEnd() calls ExecEndNode() which
 *		calls ExecEndNestLoop() which in turn calls ExecEndNode() on
 *		its subplans which result in ExecEndSeqScan().
 *
 *		This should show how the executor works by having
 *		ExecInitNode(), ExecProcNode() and ExecEndNode() dispatch
 *		their work to the appropriate node support routines which may
 *		in turn call these routines themselves on their subplans.
 */

In PostgreSQL, trees execute with a ‘pull strategy’: the plan is executed from top to bottom, and each node pulls content row by row from child nodes. As an alternative approach, we could try to execute queries from bottom to top, but among other cons, this approach lacks laziness (in simple implementation). For example, select * from very_big_table limit 1 would scan the whole table and then filter everything out instead of pulling just one row. This problem can’t be easily fixed, because you can’t really push limit operator below any join or filter, so the pull strategy is the simpliest way to implement laziness. Its operator calls overhead can be optimized via batching (pulling multiple rows at once, though this is currently not implemented in PostgreSQL).

Understanding PostgreSQL internals, part 1: Planner

Wed, 04 Jun 2025 20:00:00 +0300

Introduction

This is a small translation of my homework for an MIPT course, where I describe how PostgreSQL internals work with references to the source code.

All source code references are based on the REL_17_5 PostgreSQL git tag. For building PostgreSQL, you can refer to the dockerbuild directory.

During this series, I assume that you have following tables:

CREATE TABLE t1(a int, b1 int);
CREATE TABLE t2(a int, b2 int);
CREATE TABLE t3(a int, b3 int);

INSERT INTO t1 SELECT i, (i * 5) % 7 from generate_series(1, 10) i;
INSERT INTO t2 SELECT i * 2, (i * 5) % 7 from generate_series(1, 10) i;
INSERT INTO t3 SELECT i * 3, (i * 5) % 7 from generate_series(1, 10) i;

VACUUM (ANALYZE, FULL);

Why we need planner at all?

Well, SQL is a declarative (not imperative) language: it specifies what we want from the database but not how to get it. So because we can execute only imperative statements, we need to transform these wishful queries into executable plans — and like any good developer, we want this transformation to be optimal.

Raspberry Pi + Archlinux ARM + btrfs

Sat, 28 May 2022 14:09:13 +0300

Simple instructions for installing arch linux with btrfs root partition instead of default ext4.

$ whoami

Mon, 01 Jan 0001 00:00:00 +0000

I love system programming and have some knowledge of OS, DBMS and compilers, as well as concurrency (low-level [CPU] and high-level [runtimes and distributed systems]).

During my work hours I’ve played with:

Bridging LLVM’s optimizer for eBPF with kernel via custom frontend
Lock-free/RCU B+ trees and algorithms in general
Hazard pointers, folio refcount contention reduction, etc, etc…
PostgreSQL query planner (AQO and in general)
GaussDB distributed planner

During my study and hobby time I’ve:

C++Russia Landing Pad

Mon, 01 Jan 0001 00:00:00 +0000

Obligatory self-promotion: Linkedin / CV

Дополнительные материалы

Попытка в текстовую версию доклада: link. Будет обновлена третьей частью про написанное решение.
Статья про Rex – out-of-tree замену eBPF на Rust (слегка пропатченный userspace компилятор вместо верификатора в ядре). Статья примечательна примерами почему текущий подход с верификатором не работает.
Статья про альтернативный eBPF оптимизатор вне ядра.
Доклад про планируемую модель памяти:
- 2024: video / summary
- 2021: talk at LPC

Исходный код

Заранее стоит отметить, что код не соответствует стандартам автора для open-source, и его стоит воспринимать как попавшую на белый свет корпоративную v1. После косметической обработки будет оформлено RFC в ядро, и данная страница будет обновлена ссылкой.