OpenZFS 2.4.3 Kernel 7.1.x Fix (UKI + Secure Boot on Fedora 43 with Nvidia non-free)

README.md

⚡ Update: Automated Solution Available

An automated, fully tested script is now available that removes all manual steps.
See: https://github.com/TheAlmightyOgreLord/openzfs-kernel-7.1-builder

It is agnostic, meaning it works on systems without Secure Boot as well as those with Secure Boot/UKI enabled.

⚠️ DISCLAIMER

This is an unofficial workaround for compiling OpenZFS on Linux Kernel 7.1.x.

• Use at your own risk: Modifying kernel modules and Secure Boot keys can potentially render your system unbootable if done incorrectly.
• Not affiliated with OpenZFS: This guide is a community contribution and is not endorsed by the OpenZFS project maintainers.
• Backup your data: Always ensure you have a working recovery image before experimenting with kernel modules.

---

Replicable Guide: Root-on-ZFS with Kernel 7.1.x on Fedora 43 (Gregory Lee Setup)

This guide consolidates the successful steps taken to run OpenZFS 2.4.3 on Linux Kernel 7.1.x under Fedora 43 using Gregory Lee’s root-on-ZFS setup, Secure Boot, and UKI.

---

1. Prerequisites

• Fedora 43 with Gregory Lee’s ZFS scripts installed (kernel-update, zfs-update).
• Secure Boot enabled with custom keys enrolled.
• UKI (Unified Kernel Images) configured via systemd-boot.
• DNF5 as the default package manager.

---

2. Enable Experimental ZFS Build Flag

OpenZFS 2.4.3 does not officially support Kernel 7.1.x. You must force the build system to use the experimental flag.

Action: Edit the DKMS framework override file.

sudo nano /etc/dkms/framework.conf.d/override.conf

Add this line:

ZFS_CONFIGURE_ARGS="--enable-linux-experimental"

Note: If your framework version ignores this variable, you may need to edit /var/lib/dkms/zfs/2.4.3/source/dkms.conf directly and add --enable-linux-experimental to the PRE_BUILD configure command string.

---

3. Modify the kernel-update Script

The default script fails on DNF5 due to strict dependency resolution and metadata conflicts between zfs-dkms and new kernels.

Action: Edit /usr/local/bin/kernel-update. Find the dnf command (usually command -p dnf ... update kernel\*) and modify it to:

1. Use install instead of update.
2. Add --allowerasing to bypass the zfs-dkms metadata conflict.
3. Exclude kernel-selftests-internal to avoid missing dependency errors (bpftool, fuse-libs).

New Command Line:

command -p dnf -y --repo=updates install kernel\* --allowerasing --exclude=kernel-selftests-internal || exit 1

Ensure the --allowerasing and --exclude flags are placed after the install command, as required by DNF5 syntax.

---

4. Perform the Kernel Update

Run the modified script. It will install the new kernel (e.g., 7.1.3) despite the zfs-dkms conflict warning.

sudo kernel-update

Note: DNF may temporarily remove zfs userspace packages to satisfy the transaction. This is expected.

---

5. Reinstall and Rebuild ZFS Modules

Since the update transaction may have removed the ZFS packages, reinstall them to trigger the DKMS build for the new kernel.

Action: Force the installation of ZFS 2.4.3 (ignoring the downgrade prompt).

sudo dnf install zfs zfs-dkms zfs-dracut --allowerasing

If DNF attempts to downgrade to 2.4.2 or fails due to conflicts, use rpm to force the install:

# Download RPMs first
sudo dnf download zfs-2.4.3-1.fc43.x86_64 zfs-dkms-2.4.3-1.fc43.noarch zfs-dracut-2.4.3-1.fc43.noarch

# Force install ignoring dependencies
sudo rpm -Uvh --force --nodeps zfs-*.rpm

Action: Manually trigger the DKMS build if it didn't happen automatically.

# Clean previous failed builds
sudo rm -rf /var/lib/dkms/zfs/2.4.3/build

# Build and install
sudo dkms autoinstall -k 7.1.3-100.fc43.x86_64
# If "already installed" error occurs:
sudo dkms install --force -m zfs -v 2.4.3 -k 7.1.3-100.fc43.x86_64

---

6. Regenerate Initramfs and UKI

Because you are using Secure Boot and UKI, you must manually regenerate the boot image to include the newly built ZFS modules.

Action: Generate the initramfs (override the running kernel check).

sudo DRACUT_KMODDIR_OVERRIDE=1 dracut -f \
  --kver 7.1.3-100.fc43.x86_64 \
  --kmoddir /lib/modules/7.1.3-100.fc43.x86_64 \
  /boot/initramfs-7.1.3-100.fc43.x86_64.img

Action: Create and sign the UKI.

sudo kernel-install add 7.1.3-100.fc43.x86_64 /boot/vmlinuz-7.1.3-100.fc43.x86_64

Verification: Ensure ZFS modules are inside the signed UKI.

sudo lsinitrd /boot/EFI/Linux/$(cat /etc/machine-id)-7.1.3-100.fc43.x86_64.efi | grep zfs

You should see zfs.ko.xz and spl.ko.xz.

---

7. Restore NVIDIA Drivers (If Applicable)

If you use proprietary NVIDIA drivers, they will likely be missing after the manual kernel update, causing a fallback to nouveau.

Action: Reinstall NVIDIA akmods.

sudo dnf install akmod-nvidia xorg-x11-drv-nvidia-cuda

Wait for the build to complete (2–5 minutes).

Action: Regenerate Initramfs and UKI again to include NVIDIA modules.

sudo DRACUT_KMODDIR_OVERRIDE=1 dracut -f -k 7.1.3-100.fc43.x86_64 /boot/initramfs-7.1.3-100.fc43.x86_64.img
sudo kernel-install add 7.1.3-100.fc43.x86_64 /boot/vmlinuz-7.1.3-100.fc43.x86_64

---

8. Cleanup Stale Boot Entries

Manual kernel-install runs may create duplicate or debug entries that clutter systemd-boot.

Action: Remove stale UKI files.

# List entries
ls -lht /boot/EFI/Linux/

# Remove debug or stale entries (keep the latest working one)
sudo rm /boot/EFI/Linux/*+debug*.efi
sudo rm /boot/EFI/Linux/*-old.efi

Ensure only one valid entry exists for Kernel 7.1.3.

---

9. Future Updates

For subsequent kernel updates (e.g., 7.1.3-101), the automated script cannot automatically remove "foreign" ZFS packages installed via rpm --force. You must manually remove them first.

1. sudo dnf remove zfs zfs-dkms zfs-dracut

   If DNF fails due to dependency errors, force removal:

   sudo rpm -e --nodeps zfs zfs-dkms zfs-dracut

2. Run sudo kernel-update: Your modified script should handle the DNF transaction and generate the base UKI.

3. Repeat guide above starting at step 5. (Ensuring /var/lib/dkms/zfs/2.4.3/source/dkms.conf has --enable-linux-experimental in the PRE_BUILD configure command string.)

4. Final Safety Check: DO NOT reboot until you verify zfs is installed and working on your current system (ensuring your fallback kernel 7.1.3-100 is still bootable): which zfs & zpool status

If these commands fail, fix them before rebooting. Your fallback depends on them.

Note: This workflow remains necessary until OpenZFS releases a version (e.g., 2.4.4+) that officially supports the new kernel series and updates its RPM metadata.