Description of problem:

When we try to load a large initrd (~1 GiB) on UEFI with TPM disabled grub fails to load and prints a "out of memory" message.

Version-Release number of selected component (if applicable):

grub2-common-2.06-61.el9.noarch

How reproducible:

It always reproduces in the bare metal machine that we are using

  Model: Dell PowerEdge R340
  BIOS Version: 2.3.5
  iDRAC Firmware Version: 4.22.00.53

Steps to Reproduce:

1. Prepare a boot entry like this:

  set timeout=10
  set default=0
  menuentry 'Agent-Based Installer' {
    search --set=root --label agentboot
    load_video
    set gfx_payload=keep
    insmod gzio
    linux /images/pxeboot/vmlinuz random.trust_cpu=on console=tty0 console=ttyS0,115200n8 ignition.firstboot ignition.platform.id=metal ro
    initrd /images/pxeboot/initrd.img /images/ignition.img /images/pxeboot/rootfs.img
  }

What is most relevant of this boot entry is the size of the initrd files, specially the rootfs:

  # ls -lh pxeboot/initrd.img ignition.img pxeboot/rootfs.img 
  -r--r--r--. 1 root root 256K May  2 20:15 ignition.img
  -r--r--r--. 1 root root  81M May  2 20:20 pxeboot/initrd.img
  -r--r--r--. 1 root root 952M May  2 20:20 pxeboot/rootfs.img

Total size is approximately 1 GiB.

2. Ensure that TPM is enabled in the BIOS.

3. Boot the machine.

Actual results:

Grub fails with the following error message:

  error: ../../grub-core/kern/mm.c:552:out of memory.
  Press any key to continue...

After that the kernel is started anyhow, but it fails to locate the root filesystem and panics.

Expected results:

The initrd should be loaded and the machine should boot correctly.

Additional info:

We found that the issue is related to having TPM enabled. We applied the following patch to grub2-common-2.06-61.el9.noarch:

  https://github.com/rhboot/grub2/commit/b09440df05755c665cac9b93dd654e661c655c38

Then we rebuilt the RPM used the resulting grubx64.efi. With that the boot still fails in the same way. But it does work if we also disable TPM.

So the workaround is to disable TPM *and* apply the patch.

We would like to be able to boot with TPM enabled or disabled.