I just found out about systemd-analyze, and it shows that the 5 slowest devices are all the TPM. Why is that, and can I do anything about it? I do actually use the TPM for disk encryption and Measured Boot, and can't simply disable it.
My host is a ThinkPad T14 Gen 6 AMD, and I run NixOS with this configuration.
The output of
systemd-analyze blame
5.246s sys-devices-platform-NTC0702:00-tpmrm-tpmrm0.device
5.246s dev-tpmrm0.device
4.109s sys-devices-virtual-dmi-id.device
3.661s sys-devices-platform-NTC0702:00-tpm-tpm0.device
3.661s dev-tpm0.device
3.634s dev-ttyS0.device
3.634s sys-devices-platform-serial8250-serial8250:0-serial8250:0.0-tty-ttyS0.device
3.633s sys-devices-platform-serial8250-serial8250:0-serial8250:0.2-tty-ttyS2.device
3.633s dev-ttyS2.device
3.633s dev-ttyS1.device
3.633s sys-devices-platform-serial8250-serial8250:0-serial8250:0.1-tty-ttyS1.device
3.632s dev-ttyS3.device
3.632s sys-devices-platform-serial8250-serial8250:0-serial8250:0.3-tty-ttyS3.device
3.547s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2duuid-77CE\x2dDAD4.device
3.547s sys-devices-pci0000:00-0000:00:02.1-0000:c1:00.0-nvme-nvme0-nvme0n1-nvme0n1p1.device
3.547s dev-disk-by\x2did-nvme\x2dSKHynix_HFS256GEM9X169N_5SE9N446214309B2S\x2dpart1.device
3.547s dev-disk-by\x2did-nvme\x2dSKHynix_HFS256GEM9X169N_5SE9N446214309B2S_1\x2dpart1.device
3.547s dev-disk-by\x2dpartuuid-d934ece7\x2de91d\x2d47e8\x2db93e\x2d5a9523864f89.device
3.547s dev-disk-by\x2dpartlabel-disk\x2dmain\x2dESP.device
3.547s dev-disk-by\x2did-nvme\x2deui.ace42e0055a17b99\x2dpart1.device
3.547s dev-nvme0n1p1.device
3.547s dev-disk-by\x2duuid-77CE\x2dDAD4.device
3.547s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart1.device
3.547s dev-disk-by\x2ddesignator-esp.device
3.547s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2dpartuuid-d934ece7\x2de91d\x2d47e8\x2db93e\x2d5a9523864f89.device
3.547s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2dpartnum-1.device
3.547s dev-disk-by\x2ddiskseq-1\x2dpart1.device
3.547s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2dpartlabel-disk\x2dmain\x2dESP.device
3.536s dev-disk-by\x2dpartlabel-disk\x2dmain\x2dluks.device
3.536s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart2.device
3.536s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2dpartlabel-disk\x2dmain\x2dluks.device
3.536s dev-disk-by\x2dpartuuid-b4d9eb9a\x2d04d8\x2d4a74\x2d9348\x2d0a45c1825f41.device
3.536s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2dpartnum-2.device
3.536s dev-nvme0n1p2.device
3.536s dev-disk-by\x2duuid-cbf7bc59\x2df58d\x2d4bd5\x2d8dac\x2d4fcb5baa8106.device
3.536s sys-devices-pci0000:00-0000:00:02.1-0000:c1:00.0-nvme-nvme0-nvme0n1-nvme0n1p2.device
3.536s dev-disk-by\x2ddiskseq-1\x2dpart2.device
3.536s dev-disk-by\x2did-nvme\x2dSKHynix_HFS256GEM9X169N_5SE9N446214309B2S_1\x2dpart2.device
3.536s dev-disk-by\x2did-nvme\x2deui.ace42e0055a17b99\x2dpart2.device
3.536s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2dpartuuid-b4d9eb9a\x2d04d8\x2d4a74\x2d9348\x2d0a45c1825f41.device
3.536s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1\x2dpart-by\x2duuid-cbf7bc59\x2df58d\x2d4bd5\x2d8dac\x2d4fcb5baa8106.device
3.536s dev-disk-by\x2did-nvme\x2dSKHynix_HFS256GEM9X169N_5SE9N446214309B2S\x2dpart2.device
3.520s dev-disk-by\x2ddiskseq-1.device
3.520s dev-disk-by\x2dpath-pci\x2d0000:c1:00.0\x2dnvme\x2d1.device
3.520s dev-disk-by\x2did-nvme\x2dSKHynix_HFS256GEM9X169N_5SE9N446214309B2S_1.device
3.520s sys-devices-pci0000:00-0000:00:02.1-0000:c1:00.0-nvme-nvme0-nvme0n1.device
3.520s dev-disk-by\x2did-nvme\x2dSKHynix_HFS256GEM9X169N_5SE9N446214309B2S.device
3.520s dev-nvme0n1.device
3.520s dev-disk-by\x2did-nvme\x2deui.ace42e0055a17b99.device
2.164s sys-devices-pci0000:00-0000:00:08.3-0000:c6:00.0-usb3-3\x2d5-3\x2d5.2.device
2.164s dev-bus-usb-003-005.device
1.989s systemd-timesyncd.service
1.949s systemd-tpm2-setup.service
1.791s firewall.service
1.517s systemd-pcrlock-make-policy.service
1.403s home-manager-linus.service
1.261s libvirtd.service
1.171s initrd-switch-root.service
1.073s home-manager-guest.service
757ms fwupd.service
460ms NetworkManager.service
258ms systemd-journal-flush.service
252ms systemd-udev-trigger.service
231ms systemd-modules-load.service
154ms btrbk-btrbk.service
152ms systemd-pstore.service
128ms user@1000.service
106ms cups.service
103ms systemd-random-seed.service
91ms upower.service
90ms fwupd-refresh.service
89ms plymouth-quit.service
86ms systemd-tmpfiles-setup-dev.service
85ms libvirtd-config.service
84ms systemd-udevd.service
73ms suid-sgid-wrappers.service
70ms systemd-pcrlock-secureboot-authority.service
70ms systemd-pcrlock-firmware-code.service
66ms udisks2.service
66ms resolvconf.service
62ms systemd-pcrlogin@1000.service
58ms systemd-pcrlogin@994.service
58ms systemd-tmpfiles-setup.service
57ms systemd-tpm2-setup-early.service
56ms avahi-daemon.service
55ms power-profiles-daemon.service
52ms bluetooth.service
50ms polkit.service
49ms wpa_supplicant.service
49ms systemd-rfkill.service
48ms NetworkManager-ensure-profiles.service
48ms plymouth-quit-wait.service
43ms systemd-logind.service
40ms systemd-journald.service
40ms rtkit-daemon.service
40ms dbus-broker.service
38ms network-local-commands.service
37ms boot.mount
34ms systemd-hostnamed.service
31ms systemd-sysctl.service
31ms logrotate.service
30ms systemd-tmpfiles-clean.service
29ms modprobe@sd_mod.service
28ms systemd-oomd.service
28ms systemd-fsck@dev-disk-by\x2dpartlabel-disk\x2dmain\x2dESP.service
27ms NetworkManager-wait-online.service
26ms fwupd-efi.service
25ms modprobe@fuse.service
25ms systemd-backlight@leds:tpacpi::kbd_backlight.service
24ms systemd-vconsole-setup.service
23ms plymouth-start.service
22ms systemd-pcrlock-secureboot-policy.service
21ms systemd-machined.service
20ms systemd-backlight@backlight:amdgpu_bl1.service
20ms systemd-boot-random-seed.service
20ms user-runtime-dir@1000.service
18ms systemd-journalctl.socket
17ms plymouth-read-write.service
16ms dev-hugepages.mount
15ms systemd-tmpfiles-setup-dev-early.service
15ms dev-mqueue.mount
15ms sys-kernel-debug.mount
14ms systemd-remount-fs.service
14ms logrotate-checkconf.service
14ms sys-kernel-tracing.mount
14ms \x2eswap.mount
13ms nscd.service
13ms systemd-user-sessions.service
13ms post-boot.service
13ms media.mount
12ms modprobe@configfs.service
12ms libvirt-guests.service
11ms run-wrappers.mount
11ms NetworkManager-dispatcher.service
10ms linger-users.service
10ms sleep-actions.service
10ms kmod-static-nodes.service
10ms cups.socket
9ms \x2eswap-swapfile.swap
8ms home.mount
7ms proc-sys-fs-binfmt_misc.mount
7ms sys-fs-fuse-connections.mount
6ms plymouth-tpm2-totp.service
6ms systemd-update-utmp.service
4ms sys-kernel-config.mount
4ms systemd-binfmt.service
3ms pcscd.socket
2ms podman.socket
1ms nix-daemon.socket
902us polkit-agent-helper.socket
686us systemd-repart.socket
625us systemd-bootctl.socket
565us systemd-mute-console.socket
541us systemd-coredump.socket
519us systemd-ask-password.socket
478us systemd-factory-reset.socket
360us systemd-pcrextend.socket
337us systemd-pcrlock.socket
334us systemd-creds.socket
144us systemd-udevd-varlink.socket
42us systemd-importd.socket
26us dbus.socket
23us avahi-daemon.socket
20us systemd-machined.socket
20us systemd-rfkill.socket
18us systemd-journald.socket
16us systemd-oomd.socket
15us libvirtd.socket
13us systemd-journald-dev-log.socket
13us systemd-journald-audit.socket
9us systemd-hostnamed.socket
8us systemd-udevd-control.socket
7us libvirtd-admin.socket
5us virtlogd.socket
5us virtlockd.socket
5us libvirtd-ro.socket
4us systemd-udevd-kernel.socket
this is the first time in my life that i've heard of an individual needing to use tpm since it's almost always a corporate or government institution.
what do you use it for?
It stores one of the keys to my LUKS volume.
That seems like a good idea if you are a corporation.
It also is fixable, you can add other keys to unlock luks.
Personally TPMs can go fuck themselves on all my devices. If someone has physical access to it you have to consider it pwned no matter how many "security chips" microsoft told the industry are absolutely necessary to run their malware of an os.