Hi Jarkko, Thank you for the review. On Sun, Oct 25, 2026 at 11:00:42PM +0200, Jarkko Sakkinen wrote: > On Sun, Oct 25, 2026 at 10:59:09PM +0200, Jarkko Sakkinen wrote: > > On Mon, Oct 26, 2026 at 01:48:57AM +0530, Arun Menon wrote: > > > From: Arun Menon <[email protected]> > > > > > > The size of the command is checked against TPM_BUFSIZE early on before > > > even sending it to the backend. We therefore need to increase the > > > TPM_BUFSIZE to allow support for larger commands. > > > > > > For now, 8KB seems sufficient for ML-KEM and ML-DSA algorithms and it is > > > also order-1 safe. > > > > > > Signed-off-by: Arun Menon <[email protected]> > > > > In what timeline? Or is it out of spectrum timeline? > > "For now" part concerns me and I'm not educated enough on topic to > know better. >
TPM_BUFSIZE needs to hold the largest command the stack will ever build. TPM 2.0 Library Part 3: Commands, v185, adds ML-DSA key objects and the ML-KEM TPM2_Encapsulate()/TPM2_Decapsulate() commands (sections 14.10, 14.11) [1]. NIST FIPS 204, Table 2, gives the sizes for each ML-DSA parameter set; the largest, ML-DSA-87, has a 4896-byte private key and a 2592-byte public key [2]. Loading an ML-DSA-87 key pair carries both (4896 + 2592 bytes); add the command header, a handle and a session, and this comes to roughly 7.7KB. 8192 covers that with headroom and keeps the kzalloc(TPM_BUFSIZE, ...) calls in the TPM stack at an order-1 page allocation - something I figured after sashiko review. This is sized to the largest parameter set defined today, not a timeline, and there's no guarantee it stays sufficient. For example, FIPS 205 (SLH-DSA), Table 2, already defines a 49856-byte signature for SLH-DSA-SHA2-256f -- six times the current buffer. If a future algorithm or parameter set needs more than 8192 bytes, this will need revisiting again [3]. I will add this detail in the commit message. [1] https://medias.cdn.trustedcomputinggroup.org/production/Trusted_Platform_Module_2_0_Library_Part_3_Commands_Version_185_pub_87a5c10230.pdf [2] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf [3] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.pdf > Br, Jarkko > Regards, Arun Menon
