Re: [PATCH v5 5/7] tpm: Increase TPM_BUFSIZE to 8KB for chunking support

[Jarkko Sakkinen]

On Thu, Oct 29, 2026 at 11:45:39PM +0530, Arun Menon wrote:
> From: Arun Menon <armenon@xxxxxxxxxx>
> 
> TPM_BUFSIZE limits the TPM2 command the kernel builds before handing
> it to a chip driver's send() callback. TPM 2.0 Library Part 3:
> Commands v185 adds ML-DSA key objects and the ML-KEM
> TPM2_Encapsulate()/TPM2_Decapsulate() commands (sections 14.10,
> 14.11) [1]. NIST FIPS 204, Table 2, gives the largest ML-DSA
> parameter set, ML-DSA-87, a 4896-byte private key and a 2592-byte
> public key [2].
> Loading such a key pair with TPM2_Load, plus header, handle and session,
> comes to roughly 7.7KB - more than the current 4096-byte TPM_BUFSIZE.
> 
> Raise TPM_BUFSIZE to 8192 bytes. It covers this command with
> headroom, and keeps every kzalloc(TPM_BUFSIZE, ...) call in the TPM
> stack at an order-1 page allocation rather than a higher order.
> 
> This matches the largest parameter set defined today. NIST has already
> published PQC families with larger keys and signatures than ML-DSA
> (e.g. FIPS 205/SLH-DSA), so a future algorithm could exceed 8192 bytes.
> CRB chunking, added later in this series, does not change that; it only
> lets an already-built command cross a smaller MMIO window in pieces,
> it does not change how large a command the generic stack can build.
> 
> [1] https://medias.cdn.trustedcomputinggroup.org/production/Trusted_Platform_Module_2_0_Library_Part_3_Commands_Version_185_pub_87a5c10230.pdf
> [2] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf
> 
> Signed-off-by: Arun Menon <armenon@xxxxxxxxxx>
> ---
>  include/linux/tpm_command.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/tpm_command.h b/include/linux/tpm_command.h
> index fc446a1282e2..4ad11068b090 100644
> --- a/include/linux/tpm_command.h
> +++ b/include/linux/tpm_command.h
> @@ -434,7 +434,7 @@ struct tpm2_context {
>   */
>  
>  #define TPM_DIGEST_SIZE		20	/* Max TPM v1.2 PCR size */
> -#define TPM_BUFSIZE		4096
> +#define TPM_BUFSIZE		8192
>  
>  /*
>   * SHA-512 is, as of today, the largest digest in the TCG algorithm repository.
> -- 
> 2.56.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>

Br, Jarkko