请问编译是必须要从deconfig开始吗

[CKopoer]

请问大佬，编译是必须从deconfig开始吗，deconfig里貌似有很多iptables的包仍然勾选上了。
我按照自己之前在ImmortalWrt-23.05下的config，然后在make menuconfig的时候把mtk properties下的driver手动勾上，结果编译失败了

[CKopoer]

make[4]: Entering directory '/workdir/openwrt/target/linux/mediatek'
rm -f /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/localversion
/workdir/openwrt/scripts/kconfig.pl  + /workdir/openwrt/target/linux/generic/config-5.4 /workdir/openwrt/target/linux/mediatek/mt7981/config-5.4 > /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.target
awk '/^(#[[:space:]]+)?CONFIG_KERNEL/{sub("CONFIG_KERNEL_","CONFIG_");print}' /workdir/openwrt/.config >> /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.target
echo "# CONFIG_KALLSYMS_EXTRA_PASS is not set" >> /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.target
echo "# CONFIG_KALLSYMS_ALL is not set" >> /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.target
echo "CONFIG_KALLSYMS_UNCOMPRESSED=y" >> /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.target
/workdir/openwrt/scripts/package-metadata.pl kconfig /workdir/openwrt/tmp/.packageinfo /workdir/openwrt/.config 5.4 > /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.override
/workdir/openwrt/scripts/kconfig.pl 'm+' '+' /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.target /dev/null /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.override > /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set
mv /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.old
grep -v INITRAMFS /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.old > /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set
echo 'CONFIG_INITRAMFS_SOURCE=""' >> /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set
echo '# CONFIG_INITRAMFS_FORCE is not set' >> /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set
rm -rf /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/modules
cmp -s /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.prev || { cp /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config; cp /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.prev; }
export MAKEFLAGS= ; [ -d /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/user_headers ] || make -C /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255 KCFLAGS="-fmacro-prefix-map=/workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl=target-aarch64_cortex-a53_musl -fno-caller-saves " HOSTCFLAGS="-O2 -I/workdir/openwrt/staging_dir/host/include  -Wall -Wmissing-prototypes -Wstrict-prototypes" CROSS_COMPILE="aarch64-openwrt-linux-musl-" ARCH="arm64" KBUILD_HAVE_NLS=no KBUILD_BUILD_USER="" KBUILD_BUILD_HOST="" KBUILD_BUILD_TIMESTAMP="Wed Oct 16 09:34:25 2024" KBUILD_BUILD_VERSION="0" KBUILD_HOSTLDFLAGS="-L/workdir/openwrt/staging_dir/host/lib" CONFIG_SHELL="bash" V=''  cmd_syscalls=  KERNELRELEASE=5.4.255 CC="aarch64-openwrt-linux-musl-gcc"  INSTALL_HDR_PATH=/workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/user_headers headers_install
grep '=[ym]' /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.config.set | LC_ALL=C sort | /workdir/openwrt/staging_dir/host/bin/mkhash md5 > /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.vermagic
touch /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.configured
rm -f /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/vmlinux /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/System.map
make -C /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255 KCFLAGS="-fmacro-prefix-map=/workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl=target-aarch64_cortex-a53_musl -fno-caller-saves " HOSTCFLAGS="-O2 -I/workdir/openwrt/staging_dir/host/include  -Wall -Wmissing-prototypes -Wstrict-prototypes" CROSS_COMPILE="aarch64-openwrt-linux-musl-" ARCH="arm64" KBUILD_HAVE_NLS=no KBUILD_BUILD_USER="" KBUILD_BUILD_HOST="" KBUILD_BUILD_TIMESTAMP="Wed Oct 16 09:34:25 2024" KBUILD_BUILD_VERSION="0" KBUILD_HOSTLDFLAGS="-L/workdir/openwrt/staging_dir/host/lib" CONFIG_SHELL="bash" V=''  cmd_syscalls=  KERNELRELEASE=5.4.255 CC="aarch64-openwrt-linux-musl-gcc" Image dtbs modules
make[5]: Entering directory '/workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255'
  CALL    scripts/checksyscalls.sh
  CALL    scripts/atomic/check-atomics.sh
  CHK     include/generated/compile.h
  CC [M]  net/bridge/netfilter/nft_reject_bridge.o
net/bridge/netfilter/nft_reject_bridge.c: In function 'nft_reject_br_send_v4_unreach':
net/bridge/netfilter/nft_reject_bridge.c:134:35: warning: passing argument 1 of 'nf_reject_verify_csum' makes pointer from integer without a cast [-Wint-conversion]
  134 |             nf_reject_verify_csum(proto) &&
      |                                   ^~~~~
      |                                   |
      |                                   u8 {aka unsigned char}
In file included from ./include/net/netfilter/ipv4/nf_reject.h:8,
                 from net/bridge/netfilter/nft_reject_bridge.c:14:
./include/net/netfilter/nf_reject.h:8:58: note: expected 'struct sk_buff *' but argument is of type 'u8' {aka 'unsigned char'}
    8 | static inline bool nf_reject_verify_csum(struct sk_buff *skb, int dataoff,
      |                                          ~~~~~~~~~~~~~~~~^~~
net/bridge/netfilter/nft_reject_bridge.c:134:13: error: too few arguments to function 'nf_reject_verify_csum'
  134 |             nf_reject_verify_csum(proto) &&
      |             ^~~~~~~~~~~~~~~~~~~~~
./include/net/netfilter/nf_reject.h:8:20: note: declared here
    8 | static inline bool nf_reject_verify_csum(struct sk_buff *skb, int dataoff,
      |                    ^~~~~~~~~~~~~~~~~~~~~
net/bridge/netfilter/nft_reject_bridge.c: In function 'reject6_br_csum_ok':
net/bridge/netfilter/nft_reject_bridge.c:237:36: warning: passing argument 1 of 'nf_reject_verify_csum' makes pointer from integer without a cast [-Wint-conversion]
  237 |         if (!nf_reject_verify_csum(proto))
      |                                    ^~~~~
      |                                    |
      |                                    u8 {aka unsigned char}
./include/net/netfilter/nf_reject.h:8:58: note: expected 'struct sk_buff *' but argument is of type 'u8' {aka 'unsigned char'}
    8 | static inline bool nf_reject_verify_csum(struct sk_buff *skb, int dataoff,
      |                                          ~~~~~~~~~~~~~~~~^~~
net/bridge/netfilter/nft_reject_bridge.c:237:14: error: too few arguments to function 'nf_reject_verify_csum'
  237 |         if (!nf_reject_verify_csum(proto))
      |              ^~~~~~~~~~~~~~~~~~~~~
./include/net/netfilter/nf_reject.h:8:20: note: declared here
    8 | static inline bool nf_reject_verify_csum(struct sk_buff *skb, int dataoff,
      |                    ^~~~~~~~~~~~~~~~~~~~~
make[8]: *** [scripts/Makefile.build:262: net/bridge/netfilter/nft_reject_bridge.o] Error 1
make[7]: *** [scripts/Makefile.build:497: net/bridge/netfilter] Error 2
make[6]: *** [scripts/Makefile.build:497: net/bridge] Error 2
make[5]: *** [Makefile:[175](https://github.com/CKopoer/Actions-OpenWrt/actions/runs/11362904575/job/31605721959#step:12:176)0: net] Error 2
make[5]: Leaving directory '/workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255'
make[4]: *** [Makefile:20: /workdir/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_mt7981/linux-5.4.255/.modules] Error 2
make[3]: *** [Makefile:11: compile] Error 2
make[4]: Leaving directory '/workdir/openwrt/target/linux/mediatek'
make[3]: Leaving directory '/workdir/openwrt/target/linux'
time: target/linux/compile#6.48#4.29#10.57
    ERROR: target/linux failed to build.
make[2]: *** [target/Makefile:25: target/linux/compile] Error 1
make[2]: Leaving directory '/workdir/openwrt'
make[1]: *** [target/Makefile:18: /workdir/openwrt/staging_dir/target-aarch64_cortex-a53_musl/stamp/.target_compile] Error 2
make[1]: Leaving directory '/workdir/openwrt'
make: *** [/workdir/openwrt/include/toplevel.mk:232: world] Error 2

[ATang007ZH]

README 里步骤说的很详细了。

[DoveKi]

肯定要用deconfig，mtk加速那些还是基于iptables，不过23.05软件包除了依赖nft的其他基本都没什么问题，不行就装iptables-nft

[CKopoer]

感谢解答，原来是这个原因

[CKopoer]

难怪编译出来后用firewall4的ipv6端口转发会出问题，可以转发但是连接很容易中断，必须把IPV6 HNAT关掉才能正常使用

[microka]

难怪编译出来后用firewall4的ipv6端口转发会出问题，可以转发但是连接很容易中断，必须把IPV6 HNAT关掉才能正常使用

请问 IPv6 连接容易中断是怎样观察到的？

[CKopoer]

难怪编译出来后用firewall4的ipv6端口转发会出问题，可以转发但是连接很容易中断，必须把IPV6 HNAT关掉才能正常使用

请问 IPv6 连接容易中断是怎样观察到的？

我开启了IPV6端口转发后，把wan口的某些端口转发到下游NAS上的Jellyfin等服务的端口上，启用IPV6 Hnat后这些端口能正常连通，但对应服务无法正常使用（加载非常慢，登录页面都要加载1分钟以上）
我用tcpdump抓包看了下，这种情况下会发生大量tcp重传

[long45343]

肯定要用deconfig，mtk加速那些还是基于iptables，不过23.05软件包除了依赖nft的其他基本都没什么问题，不行就装iptables-nft

deconfig里面好像选择的也是nft，补充一下这样同时也会导致没法访问桥接模式的docker容器，疑似是dockerd还没适配firewall4