diff options
| author | Lennart Poettering <lennart@poettering.net> | 2023-11-24 18:01:56 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2024-01-03 13:49:02 +0100 |
| commit | 4e1f0037b85d1b3c272e13862f44eb35844a18b1 (patch) | |
| tree | 4dc975d7a968241a756335a29af76efce12a358f /units/systemd-pcrphase-initrd.service.in | |
| parent | test-64: only look at plugged devices, not all of them (diff) | |
| download | systemd-4e1f0037b85d1b3c272e13862f44eb35844a18b1.tar.xz systemd-4e1f0037b85d1b3c272e13862f44eb35844a18b1.zip | |
units: add a tpm2.target synchronization point and small generator that pulls in
Distributions apparently only compile a subset of TPM2 drivers into the
kernel. For those not compiled it but provided as kmod we need a
synchronization point: we must wait before the first TPM2 interaction
until the driver is available and accessible.
This adds a tpm2.target unit as such a synchronization point. It's
ordered after /dev/tpmrm0, and is pulled in by a generator whenever we
detect that the kernel reported a TPM2 to exist but we have no device
for it yet.
This should solve the issue, but might create problems: if there are TPM
devices supported by firmware that we don't have Linux drivers for we'll
hang for a bit. Hence let's add a kernel cmdline switch to disable (or
alternatively force) this logic.
Fixes: #30164
Diffstat (limited to 'units/systemd-pcrphase-initrd.service.in')
| -rw-r--r-- | units/systemd-pcrphase-initrd.service.in | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/units/systemd-pcrphase-initrd.service.in b/units/systemd-pcrphase-initrd.service.in index b337d602ba..3b18b4f29d 100644 --- a/units/systemd-pcrphase-initrd.service.in +++ b/units/systemd-pcrphase-initrd.service.in @@ -12,6 +12,7 @@ Description=TPM2 PCR Barrier (initrd) Documentation=man:systemd-pcrphase-initrd.service(8) DefaultDependencies=no Conflicts=shutdown.target initrd-switch-root.target +After=tpm2.target Before=sysinit.target cryptsetup-pre.target cryptsetup.target shutdown.target initrd-switch-root.target systemd-sysext.service ConditionPathExists=/etc/initrd-release ConditionSecurity=measured-uki |