SYSTEMD-TPM2-GENERATOR(8)

💖 NAME 💖

okay bestie, so systemd-tpm2-generator — it's the generator that plants a TPM2 synchronization point in your boot process. that's the whole gig. slay. ✨

---

🌸 SYNOPSIS 🌸

/usr/lib/systemd/system-generators/systemd-tpm2-generator

---

🦋 DESCRIPTION 🦋

so here's the tea, systemd-tpm2-generator is a generator (yes, like systemd.generator(7) — we'll get there) and what it does is: it looks around, and if it spots that the firmware found a TPM2 device but the OS kernel hasn't shown one yet? it goes ahead and adds a Wants= dependency from sysinit.target to tpm2.target. literally just drops it in there. 💅

and why do we care? because tpm2.target is the moment in boot that's supposed to act as a synchronization point for every single service that needs to touch the TPM2 device. like, everybody wait up, the TPM isn't ready yet. peek systemd.special(7) for the deets on that. 👑

🎀 the kernel command line overrides 🎀

ngl, these are the fun part. you can boss the generator around from the kernel command line.

• systemd.tpm2_wait= — this one overrides how the generator behaves. it takes a boolean value:
  • if true, then tpm2.target gets added as a synchronization point even if the firmware hasn't detected a TPM2 device at all. like, we're waiting no matter what, bestie.
  • if false, then the target will not be inserted, even if the firmware did report a device but the OS kernel isn't exposing a device for it yet. when is this useful? in environments where a suitable TPM2 driver for the hardware you've got just… isn't available. sad but real. 😭
• systemd.tpm2_software_fallback= — this one takes a boolean argument too, and it defaults to false. turn it on and you get an automatic software TPM fallback in case a hardware TPM isn't detected and swtpm(8) is available. and because it's a package deal, this pulls in the systemd-tpm2-swtpm.service(8) service. obsessed. 🫶

also just so we're clear: systemd-tpm2-generator implements systemd.generator(7). no cap.

---

🌈 SEE ALSO 🌈

• systemd(1)
• systemd.special(7)
• kernel-command-line(7)
• systemd-tpm2-swtpm.service(8)

---

okay that's the whole page, you ate it up fr fr 💖 this little icon was brought to you by systemd 262.1 — the systemd-tpm2-generator manual, page 8, dated whenever this version dropped. go forth and synchronize, bestie 🎀✨