OpenBMC Development Engineer @ Lenovo · Linux Kernel Contributor
I work on server BMC firmware (OpenBMC / Yocto / Redfish / NCSI) by day, and hunt Linux kernel bugs for fun. I specialize in root-causing and fixing kernel vulnerabilities, with patches verified against real PoCs in QEMU.
9 security fixes merged into mainline Linux (as Yuqi Xu <xuyuqiabc@gmail.com>), with more queued in maintainer trees:
| Subsystem | Highlights |
|---|---|
| Networking | Open vSwitch CT-limit teardown UAF, RDS setup unwind, rxrpc rxkad ticket validation, ipconfig DHCP option bounds, TIPC connection teardown |
| Wireless | mac80211 TX status / FILS / minstrel rate validation, nl80211 EMA RNR lists, cfg80211 cipher suite duplicates |
| BPF | sockmap bpf_msg_push_data tail fragment offset, reserved-field params size checks |
| Bluetooth | hci_sync oversized Broadcast Announcement prepend |
| Security | TPM duplicate PCR banks, KEYS asymmetric payload quota accounting |
📜 Full commit history: git.kernel.org — author: Yuqi Xu
OpenBMC firmware engineer at Lenovo — I own the BMC networking stack (phosphor-networkd, NCSI, Redfish network interfaces) on Intel server platforms, and report upstream issues as I hit them:
- openbmc/phosphor-networkd#80 — Static IPv4 on one interface can affect routing/ARP behavior of another interface in same-subnet multi-NIC setup
- openbmc/phosphor-host-ipmid#217 —
ipmitool lan printshows Default Gateway MAC as 00:00:00:00:00:00 for DHCP gateways
- BMC / OpenBMC: phosphor-networkd, phosphor-dbus-interfaces, entity-manager, dbus-sensors, Yocto, Redfish, NCSI, IPMI, MCTP, PMBus
- Kernel: networking & wireless subsystems, BPF, syzkaller-style PoC reproduction, QEMU/KVM, GDB, KASAN
- Languages: C, C++, Python, Shell
- 🌐 Homepage: xuyq19.github.io · 📝 Blog: kernel bug-fix notes
- ✉️ Work: xuyq21@lenovo.com · Kernel: xuyuqiabc@gmail.com