OpenZFS 2.4.3 Kernel 7.1.x Fix (UKI + Secure Boot on Fedora 43 with Nvidia non-free)

README.md

⚠️ DISCLAIMER

This is an unofficial workaround for compiling OpenZFS on Linux Kernel 7.1.x.

• Use at your own risk: Modifying kernel modules and Secure Boot keys can potentially render your system unbootable if done incorrectly.
• Not affiliated with OpenZFS: This guide is a community contribution and is not endorsed by the OpenZFS project maintainers.
• Backup your data: Always ensure you have a working recovery image before experimenting with kernel modules.

---

Replicable Guide: Root-on-ZFS with Kernel 7.1.x on Fedora 43 (Gregory Lee Setup)

This guide consolidates the successful steps taken to run OpenZFS 2.4.3 on Linux Kernel 7.1.x under Fedora 43 using Gregory Lee’s root-on-ZFS setup, Secure Boot, and UKI.

---

1. Prerequisites

• Fedora 43 with Gregory Lee’s ZFS scripts installed (kernel-update, zfs-update).
• Secure Boot enabled with custom keys enrolled.
• UKI (Unified Kernel Images) configured via systemd-boot.
• DNF5 as the default package manager.

---

2. Enable Experimental ZFS Build Flag

OpenZFS 2.4.3 does not officially support Kernel 7.1.x. You must force the build system to use the experimental flag.

Action: Edit the DKMS framework override file.

sudo nano /etc/dkms/framework.conf.d/override.conf

Add this line:

ZFS_CONFIGURE_ARGS="--enable-linux-experimental"

Note: If your framework version ignores this variable, you may need to edit /var/lib/dkms/zfs/2.4.3/source/dkms.conf directly and add --enable-linux-experimental to the PRE_BUILD configure command string.

---

3. Modify the kernel-update Script

The default script fails on DNF5 due to strict dependency resolution and metadata conflicts between zfs-dkms and new kernels.

Action: Edit /usr/local/bin/kernel-update. Find the dnf command (usually command -p dnf ... update kernel\*) and modify it to:

1. Use install instead of update.
2. Add --allowerasing to bypass the zfs-dkms metadata conflict.
3. Exclude kernel-selftests-internal to avoid missing dependency errors (bpftool, fuse-libs).

New Command Line:

command -p dnf -y --repo=updates install kernel\* --allowerasing --exclude=kernel-selftests-internal || exit 1

Ensure the --allowerasing and --exclude flags are placed after the install command, as required by DNF5 syntax.

---

4. Perform the Kernel Update

Run the modified script. It will install the new kernel (e.g., 7.1.3) despite the zfs-dkms conflict warning.

sudo kernel-update

Note: DNF may temporarily remove zfs userspace packages to satisfy the transaction. This is expected.

---

5. Reinstall and Rebuild ZFS Modules

Since the update transaction may have removed the ZFS packages, reinstall them to trigger the DKMS build for the new kernel.

Action: Force the installation of ZFS 2.4.3 (ignoring the downgrade prompt).

sudo dnf install zfs zfs-dkms zfs-dracut --allowerasing

If DNF attempts to downgrade to 2.4.2 or fails due to conflicts, use rpm to force the install:

# Download RPMs first
sudo dnf download zfs-2.4.3-1.fc43.x86_64 zfs-dkms-2.4.3-1.fc43.noarch zfs-dracut-2.4.3-1.fc43.noarch

# Force install ignoring dependencies
sudo rpm -Uvh --force --nodeps zfs-*.rpm

Action: Manually trigger the DKMS build if it didn't happen automatically.

# Clean previous failed builds
sudo rm -rf /var/lib/dkms/zfs/2.4.3/build

# Build and install
sudo dkms autoinstall -k 7.1.3-100.fc43.x86_64
# If "already installed" error occurs:
sudo dkms install --force -m zfs -v 2.4.3 -k 7.1.3-100.fc43.x86_64

---

6. Regenerate Initramfs and UKI

Because you are using Secure Boot and UKI, you must manually regenerate the boot image to include the newly built ZFS modules.

Action: Generate the initramfs (override the running kernel check).

sudo DRACUT_KMODDIR_OVERRIDE=1 dracut -f \
  --kver 7.1.3-100.fc43.x86_64 \
  --kmoddir /lib/modules/7.1.3-100.fc43.x86_64 \
  /boot/initramfs-7.1.3-100.fc43.x86_64.img

Action: Create and sign the UKI.

sudo kernel-install add 7.1.3-100.fc43.x86_64 /boot/vmlinuz-7.1.3-100.fc43.x86_64

Verification: Ensure ZFS modules are inside the signed UKI.

sudo lsinitrd /boot/EFI/Linux/$(cat /etc/machine-id)-7.1.3-100.fc43.x86_64.efi | grep zfs

You should see zfs.ko.xz and spl.ko.xz.

---

7. Restore NVIDIA Drivers (If Applicable)

If you use proprietary NVIDIA drivers, they will likely be missing after the manual kernel update, causing a fallback to nouveau.

Action: Reinstall NVIDIA akmods.

sudo dnf install akmod-nvidia xorg-x11-drv-nvidia-cuda

Wait for the build to complete (2–5 minutes).

Action: Regenerate Initramfs and UKI again to include NVIDIA modules.

sudo DRACUT_KMODDIR_OVERRIDE=1 dracut -f -k 7.1.3-100.fc43.x86_64 /boot/initramfs-7.1.3-100.fc43.x86_64.img
sudo kernel-install add 7.1.3-100.fc43.x86_64 /boot/vmlinuz-7.1.3-100.fc43.x86_64

---

8. Cleanup Stale Boot Entries

Manual kernel-install runs may create duplicate or debug entries that clutter systemd-boot.

Action: Remove stale UKI files.

# List entries
ls -lht /boot/EFI/Linux/

# Remove debug or stale entries (keep the latest working one)
sudo rm /boot/EFI/Linux/*+debug*.efi
sudo rm /boot/EFI/Linux/*-old.efi

Ensure only one valid entry exists for Kernel 7.1.3.

---

9. Future Updates

For subsequent kernel updates (e.g., 7.2.x):

1. Run sudo kernel-update: Your modified script will handle the DNF transaction.
2. Verify DKMS Build: Ensure dkms status shows the module built for the new kernel.
3. Regenerate UKI: If the script doesn't do it automatically, run the dracut and kernel-install commands from Step 6.
4. NVIDIA: If akmods doesn't trigger automatically, reinstall akmod-nvidia and regenerate the UKI.

Note: This workflow remains necessary until OpenZFS releases a version (e.g., 2.4.4+) that officially supports the new kernel series and updates its RPM metadata.