tree 1f630e29971bca75f72102eb76f2b2e732832a57
parent 20ae5e6f6cc8925dd9185f23e7835cfe85ed5f6e
author Adam Langley <agl@google.com> 1571413958 -0700
committer Adam Langley <agl@google.com> 1571431074 +0000

Add sanity checks to FIPS module construction.

If -ffunction-sections or -fdata-sections is enabled when doing a FIPS
shared build, the linker script won't do what's expected and will
silently end up including very little (or nothing) in the integrity
check.

This changes alters the linker script to discard any text or data
sections other than the main one, which should make this failure much
more obvious.

Also, add assertions (that are always enabled) in the module to check
that a few obvious things that should be inside the module boundaries
actually are.

Change-Id: I91178e213a28a7c0c4a38155974e452cd9d558d1
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/38324
Reviewed-by: Adam Langley <agl@google.com>