The Short Version

LoongFire now runs Linux kernel 7.3.4. This post walks through which changes in that release matter for a LoongArch-based, eBPF-enabled firewall — and which ones don't.

LoongArch: Directly Relevant

BPF / memory ordering (critical for eBPF)

The removal of arch-specific __smp_mb__{before,after}_atomic() is the most important item for LoongFire. These were only compiler barriers, violating LKMM; bpf_timer_cancel() relies on smp_mb__after_atomic() for store-load ordering before lockless dependency checks. On LoongArch this allowed concurrent CPUs to bypass deadlock detection and ABBA-deadlock hrtimer_cancel(), producing soft lockups/panics — exactly the failure mode seen in the BPF timer_lockup selftest.

The fix falls back to the generic __smp_mb() (hardware DBAR), and hundreds of other core-kernel smp_mb__after_atomic() sites on LoongArch also gain proper barriers. This is a must-have for a firewall running BPF-based filtering/XDP.

Hardware breakpoint/watchpoint series

Perf fixes: one-shot limitation, CSR_PRMD_PWE not enabled for perf, unconditional SIGTRAP killing perf users, bitmask corruption clearing PLV/LCL bits. Relevant for on-box profiling/debugging of the firewall, not for packet processing itself.

Networking / Packet Path (firewall-relevant)

• TCP MSS revert — restoring "advertise MSS from learned PMTU" is important for a firewall/router: connections through a relay with a smaller-MTU hop that have ICMP filtered (common in enterprise/carrier networks) stalled after handshake. Directly affects forwarded traffic.
• VLAN untag depth limit — 16-bit header offset wraparound → OOB access; relevant to any firewall handling stacked VLANs.
• IPsec frag reassembly — reject fragments whose secpath differs (partial authentication); relevant if LoongFire terminates/forwards IPsec tunnels.
• GRO frag_list BUG_ON — generic XDP linearized GSO packets + tunnel decap + GRO produced kernel BUG in skb_segment; relevant to XDP-in-SKB-mode setups common on firewalls.
• inet unhashed-socket lookup — lockless ehash lookup could return a reused socket (NULL-deref panic); hardens TCP forwarding under load.

Bottom Line for LoongFire

The only LoongArch change that is operationally critical for an eBPF-enabled firewall is the atomic memory-ordering fix — without it, BPF timer/deadlock-detection paths and many core smp_mb__after_atomic() users are unsafe on LoongArch.

The TCP MSS revert and the VLAN/IPsec/nftables fixes are the most relevant packet-path items. The perf/watchpoint and cpufreq series improve debugging and server-hardware behavior rather than packet processing.

简要版

LoongFire 现已运行 Linux 内核 7.3.4。本文梳理该版本中哪些变更对基于 LoongArch、启用 eBPF 的防火墙有影响——哪些没有。

LoongArch：直接相关

BPF / 内存序（对 eBPF 至关重要）

移除架构特定的 __smp_mb__{before,after}_atomic() 是 LoongFire 最重要的一项。这些原本只是编译器屏障，违反了 LKMM；bpf_timer_cancel() 依赖 smp_mb__after_atomic() 在无锁依赖检查之前提供存储-加载顺序。在 LoongArch 上，这允许并发 CPU 绕过死锁检测并对 hrtimer_cancel() 造成 ABBA 死锁，产生软锁死/内核 panic —— 正是 BPF timer_lockup 自测中所见的故障模式。

该修复回退到通用的 __smp_mb()（硬件 DBAR），并且 LoongArch 上数百个其他核心内核 smp_mb__after_atomic() 调用点也获得了正确的屏障。对于运行基于 BPF 的过滤/XDP 的防火墙，这是必须项。

硬件断点/观察点系列

perf 修复：一次性限制、perf 未启用 CSR_PRMD_PWE、无条件 SIGTRAP 导致 perf 用户被杀、位掩码损坏清除 PLV/LCL 位。与防火墙的本机性能分析/调试相关，而非数据包处理本身。

网络 / 数据包路径（防火墙相关）

• TCP MSS 回退 —— 恢复"从学习到的 PMTU 通告 MSS"对防火墙/路由器很重要：经过具有更小 MTU 跳且 ICMP 被过滤的中继（企业/运营商网络常见）的连接在握手后停顿。直接影响转发流量。
• VLAN 解标签深度限制 —— 16 位头部偏移回绕 → 越界访问；与处理堆叠 VLAN 的任何防火墙相关。
• IPsec 分片重组 —— 拒绝 secpath 不一致的分片（部分认证）；如果 LoongFire 终结/转发 IPsec 隧道则相关。
• GRO frag_list BUG_ON —— 通用 XDP 线性化 GSO 数据包 + 隧道解封装 + GRO 在 skb_segment 中产生内核 BUG；与防火墙上常见的 XDP-in-SKB 模式相关。
• inet 未哈希套接字查找 —— 无锁 ehash 查找可能返回被复用的套接字（NULL 解引用 panic）；在高负载下加固 TCP 转发。

对 LoongFire 的结论

对启用 eBPF 的防火墙而言，唯一具有操作关键性的 LoongArch 变更是原子内存序修复 —— 没有它，BPF 定时器/死锁检测路径以及许多核心 smp_mb__after_atomic() 用户在 LoongArch 上是不安全的。

TCP MSS 回退和 VLAN/IPsec/nftables 修复是最相关的数据包路径项。perf/观察点和 cpufreq 系列改善的是调试和服务器硬件行为，而非数据包处理。