Re: [PATCH v4 5/6] tpm: Increase TPM_BUFSIZE to 8kB for chunking support

[Arun Menon <armenon@redhat.com>]

Hi Jarkko,
Thank you for the review.

On Sun, Oct 25, 2026 at 11:00:42PM +0200, Jarkko Sakkinen wrote:
> On Sun, Oct 25, 2026 at 10:59:09PM +0200, Jarkko Sakkinen wrote:
> > On Mon, Oct 26, 2026 at 01:48:57AM +0530, Arun Menon wrote:
> > > From: Arun Menon <armenon@redhat.com>
> > > 
> > > The size of the command is checked against TPM_BUFSIZE early on before
> > > even sending it to the backend. We therefore need to increase the
> > > TPM_BUFSIZE to allow support for larger commands.
> > > 
> > > For now, 8KB seems sufficient for ML-KEM and ML-DSA algorithms and it is
> > > also order-1 safe.
> > > 
> > > Signed-off-by: Arun Menon <armenon@redhat.com>
> > 
> > In what timeline? Or is it out of spectrum timeline?
> 
> "For now" part concerns me and I'm not educated enough on topic to
> know better.
> 

TPM_BUFSIZE needs to hold the largest command the stack will ever
build. TPM 2.0 Library Part 3: Commands, v185, adds ML-DSA key
objects and the ML-KEM TPM2_Encapsulate()/TPM2_Decapsulate() commands
(sections 14.10, 14.11) [1].

NIST FIPS 204, Table 2, gives the sizes for each ML-DSA parameter
set; the largest, ML-DSA-87, has a 4896-byte private key and a
2592-byte public key [2]. Loading an ML-DSA-87 key pair carries both
(4896 + 2592 bytes); add the command header, a handle and a session,
and this comes to roughly 7.7KB. 8192 covers that with headroom and
keeps the kzalloc(TPM_BUFSIZE, ...) calls in the TPM stack at an
order-1 page allocation - something I figured after sashiko review.

This is sized to the largest parameter set defined today, not a
timeline, and there's no guarantee it stays sufficient. For example,
FIPS 205 (SLH-DSA), Table 2, already defines a 49856-byte signature for
SLH-DSA-SHA2-256f -- six times the current buffer. If a future
algorithm or parameter set needs more than 8192 bytes, this will need
revisiting again [3].

I will add this detail in the commit message.

[1] https://medias.cdn.trustedcomputinggroup.org/production/Trusted_Platform_Module_2_0_Library_Part_3_Commands_Version_185_pub_87a5c10230.pdf
[2] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf
[3] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.pdf


> Br, Jarkko
> 


Regards,
Arun Menon