Kernel panic on Intel NUC8 hardware after 9.7→9.8 upgrade — TPM/tpm_crb regression

Support
1

Hi,

We are running AlmaLinux 9 (CyaraOS, OSTree-based) on Intel NUC8 hardware
(NUC8v5PNH, NUC8v5PNK, NUC8i3BEH, NUC8i3BEK) and hit a kernel panic
when upgrading from 9.7 to 9.8.

Failing kernel: 5.14.0-687.26.1.el9_8.x86_64
Working kernel: 5.14.0-611.54.3.el9_7.x86_64

Error at boot (~1.74 seconds):
[Firmware Bug]: TPM interrupt not working, polling instead
VFS: Unable to mount root fs on unknown-block(0,0)

System rolls back to 9.7 automatically. LUKS root never mounts.
Same hardware boots fine on 9.7 kernel.

Intel NUC8 uses Intel PTT (firmware TPM via tpm_crb driver, MSFT0101 device).
Intel froze NUC8 firmware updates ~2020.

This looks like a recurrence of bugs.almalinux.org #0000440
(TPM2 regression in 9.3, fixed in 9.4).

Also filed as Red Hat Jira: RHEL-222707

Has anyone else seen this on NUC8 hardware? Any workaround or patch available?

2

The TPM warning may not be the direct cause of the panic.

[Firmware Bug]: TPM interrupt not working, polling instead

This means the TPM TIS driver failed to use interrupts and fell back to polling. The fatal error is:

VFS: Unable to mount root fs on unknown-block(0,0)

That usually indicates that the 9.8 kernel could not find the root device, for example because of an invalid or incomplete initramfs, missing NVMe/dm-crypt drivers, or incorrect OSTree boot arguments.

As a test, try booting once with:

tpm_tis.interrupts=0

If it still fails with unknown-block(0,0), I would check the 9.8 OSTree initramfs and BLS entry first.

Primary references:

3

Thank you for the suggestions. I have checked all three areas:

dm-crypt.ko.xz — present in 9.8.4 initramfs (30824 bytes)
NVMe drivers — nvme.ko.xz and nvme-core.ko.xz both present
BLS entries — boot arguments are identical between the working 9.7.12 (5.14.0-611) and failing 9.8.4 (5.14.0-687) entries — same rd.luks.uuid, rd.luks.key, and root= values
The only difference between the two deployments is the kernel version. This confirms the issue is a regression in 5.14.0-687.26.1.el9_8 on Intel NUC8 (NUC8v5PNH) hardware.

4

Thank you for confirming.

Since dm-crypt and NVMe drivers are present and the BLS arguments are identical, this strongly suggests a regression in kernel 5.14.0-687.26.1.el9_8 on Intel NUC8 hardware rather than an initramfs configuration issue.

The issue is already tracked in Red Hat Jira:

https://redhat.atlassian.net/browse/RHEL-222707