On Sun, Oct 04, 2026 at 11:27:11PM +0800, Xiaoyi Suo wrote: > The key schedule arrays in sha1_hmac() are locals, and they are cleared > right before the function returns. Nothing reads them again, so GCC > removes the stores from -O1 up and the caller's key is left in the frame > as 0x36 ^ key and 0x5c ^ key. > > The only caller in U-Boot is the TPM 1.2 code, where the key is a TPM > key's usage auth. > > Cc: Tom Rini <[email protected]> > Signed-off-by: Xiaoyi Suo <[email protected]>
Reviewed-by: Tom Rini <[email protected]> -- Tom
signature.asc
Description: PGP signature
