← richliu.com / Post
中文 EN

[Gentoo] 2025 Upgrade Notes

2025-12-20 Gentoo Linux kernel 6.18 nftables

This upgrade was triggered by three issues hitting simultaneously. Kernel jumped from 6.12 to 6.18, and each problem landed its own pitfall. Notes below for anyone who stumbles into the same situations.

Issue 1: Genkernel dmraid Compilation Failure

Using genkernel with dmraid enabled caused the build to fail outright. The root cause: dmraid hasn't had a release since 2010, and modern GCC now treats incompatible function pointer types as hard errors rather than warnings.

Fix: Disable dmraid in /etc/genkernel.conf:

DMRAID="no"

Modern systems use mdadm instead anyway — dmraid is a legacy dependency at this point.

Issue 2: Init Respawning Error (f0)

After boot, the system kept logging: Id 'f0' respawning too fast: disabled for 5 minutes

Traced to /etc/inittab. The ttyAMA0 serial console entry (common on ARM systems) had disappeared, causing getty to fail and retry endlessly.

Fix: Comment out the offending line in /etc/inittab, then reload init:

telinit q

Issue 3: Kernel 6.18 Drops iptables Support

This was the biggest surprise. Linux 6.18 removed in-kernel iptables support entirely — only nftables (nft) remains. Simple rules can use iptables-nft as a compatibility shim, but anything involving TCPMSS or more complex constructs requires a full migration to nft syntax.

Used DeepSeek and Gemini to assist with ruleset conversion, though manual adjustments were still necessary.

Basic iptables → nft translation example:

# Old iptables rule
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# Equivalent nft rule
table ip filter {
  chain FORWARD {
    type filter hook forward priority 0;
    tcp flags syn tcp option maxseg size set rt mtu
  }
}

Having used iptables for close to two decades, this felt like a proper farewell. nft syntax is cleaner once you get used to it — but the migration itself takes time.