From ab363b9732a2e6fb77442622dbdca3df40d9d822 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Wed, 9 Oct 2024 14:26:53 -0700
Subject: [PATCH 01/20] this works, need to fix inject hash now

---
 crypto/fipsmodule/CMakeLists.txt          | 3 +++
 crypto/fipsmodule/bcm.c                   | 4 ++++
 crypto/fipsmodule/ec/p521.c               | 1 +
 util/fipstools/inject_hash/inject_hash.go | 4 ++++
 4 files changed, 12 insertions(+)

diff --git a/crypto/fipsmodule/CMakeLists.txt b/crypto/fipsmodule/CMakeLists.txt
index e2af084285..e29548ba78 100644
--- a/crypto/fipsmodule/CMakeLists.txt
+++ b/crypto/fipsmodule/CMakeLists.txt
@@ -438,6 +438,7 @@ if(FIPS_DELOCATE)
 
     fips_shared_support.c
     cpucap/cpucap.c
+    ec/table_test.c
   )
   target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)
 
@@ -458,6 +459,7 @@ elseif(FIPS_SHARED)
 
     fips_shared_support.c
     cpucap/cpucap.c
+    ec/table_test.c
   )
   target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)
 
@@ -579,6 +581,7 @@ else()
     bcm.c
     fips_shared_support.c
     cpucap/cpucap.c
+    ec/table_test.c
 
     ${BCM_ASM_SOURCES}
     ${BCM_ASM_OBJECTS}
diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 0b0fa81202..4d8df2d579 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -365,6 +365,10 @@ int BORINGSSL_integrity_test(void) {
   BORINGSSL_maybe_set_module_text_permissions(PROT_EXEC);
 #endif
 
+  // EC tables
+  const uint8_t *asd = get_asdasd();
+  HMAC_Update(&hmac_ctx, asd, 4);
+
   if (!HMAC_Final(&hmac_ctx, result, &result_len) ||
       result_len != sizeof(result)) {
     fprintf(stderr, "HMAC failed.\n");
diff --git a/crypto/fipsmodule/ec/p521.c b/crypto/fipsmodule/ec/p521.c
index b1ed65dc7b..511e43ae77 100644
--- a/crypto/fipsmodule/ec/p521.c
+++ b/crypto/fipsmodule/ec/p521.c
@@ -523,6 +523,7 @@ static void ec_GFp_nistp521_point_mul(const EC_GROUP *group, EC_JACOBIAN *r,
 //   4. If the scalar is even subtract G from the accumulator.
 //
 // Note: this function is constant-time.
+#include "table_test.h"
 static void ec_GFp_nistp521_point_mul_base(const EC_GROUP *group,
                                            EC_JACOBIAN *r,
                                            const EC_SCALAR *scalar) {
diff --git a/util/fipstools/inject_hash/inject_hash.go b/util/fipstools/inject_hash/inject_hash.go
index 0d1e15732d..2d5e010980 100644
--- a/util/fipstools/inject_hash/inject_hash.go
+++ b/util/fipstools/inject_hash/inject_hash.go
@@ -390,6 +390,10 @@ func do(outPath, oInput string, arInput string, appleOS bool) error {
 	} else {
 		mac.Write(moduleText)
 	}
+
+    ecTable := []byte{1, 2, 3, 4}
+    mac.Write(ecTable)
+
 	calculated := mac.Sum(nil)
 
 	// Replace the default hash value in the object with the calculated

From 336e9d58f777ce2043c449b3c63bc4fc14dc61cc Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Wed, 9 Oct 2024 14:47:44 -0700
Subject: [PATCH 02/20] removed inject_hash for shared build

---
 crypto/CMakeLists.txt                       | 47 +--------------------
 crypto/fipsmodule/bcm.c                     |  2 +
 util/fipstools/capture_hash/capture_hash.go |  5 ++-
 3 files changed, 6 insertions(+), 48 deletions(-)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 870b2d7293..aec176950d 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -1,4 +1,3 @@
-
 # Function to handle assembly files for ARM64 targets when using MSBuild (the "Visual Studio" generator)
 # This function is necessary because MSBuild ignores ARM64 assembly file dependencies
 include(CMakeParseArguments)
@@ -620,7 +619,6 @@ endfunction()
 if(FIPS_SHARED)
   # Rewrite libcrypto.so, libcrypto.dylib, or crypto.dll to inject the correct module
   # hash value. For now we support the FIPS build only on Linux, macOS, iOS, and Windows.
-  if(MSVC)
     # On Windows we use capture_hash.go to capture the computed integrity value that bcm.o prints to generate the
     # correct value in generated_fips_shared_support.c. See FIPS.md for a full explanation of the process
     build_libcrypto(precrypto $<TARGET_OBJECTS:fipsmodule>)
@@ -642,56 +640,13 @@ if(FIPS_SHARED)
 
       generated_fips_shared_support.c
       ${PROJECT_SOURCE_DIR}/crypto/fipsmodule/cpucap/cpucap.c
+      ${PROJECT_SOURCE_DIR}/crypto/fipsmodule/ec/table_test.c
     )
     add_dependencies(generated_fipsmodule boringssl_prefix_symbols)
     target_include_directories(generated_fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)
     target_include_directories(generated_fipsmodule BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
     build_libcrypto(crypto $<TARGET_OBJECTS:generated_fipsmodule>)
-  else()
-    # On Apple and Linux platforms inject_hash.go can parse libcrypto and inject
-    # the hash directly into the final library.
-    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
-    if (APPLE)
-      set(INJECT_HASH_APPLE_FLAG "-apple")
-    endif()
-
-    add_custom_command(
-      TARGET crypto POST_BUILD
-      COMMAND ${GO_EXECUTABLE} run
-      ${PROJECT_SOURCE_DIR}/util/fipstools/inject_hash/inject_hash.go
-      -o $<TARGET_FILE:crypto> -in-object $<TARGET_FILE:crypto> ${INJECT_HASH_APPLE_FLAG}
-      # The DEPENDS argument to a POST_BUILD rule appears to be ignored. Thus
-      # go_executable isn't used (as it doesn't get built), but we list this
-      # dependency anyway in case it starts working in some CMake version.
-      DEPENDS ../util/fipstools/inject_hash/inject_hash.go
-      WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
-    )
-
-    # On macOS 11 and higher on Apple Silicon, codesigning is mandatory for
-    # binaries to run. This applies to both executables and dylibs. An ad-hoc
-    # signature is sufficient, and the linker will automatically apply one when
-    # a binary is created (see https://github.com/Homebrew/brew/issues/9082).
-    #
-    # When we build libcrypto.dylib the linker automatically signs it. But then
-    # we inject the FIPS integrity hash into libcrypto.dylib which changes the
-    # binary so the signature applied by the linker is obviously not valid
-    # anymore. So when an application, like crypto_test, tries to load
-    # libcrypto.dylib it crashes because the signature is not valid. To work
-    # around this we add an ad-hoc signature to `libcrypto.dylib` after the
-    # FIPS integrity hash is injected.
-    #
-    # Note: we use CMAKE_SYSTEM_PROCESSOR directly instead of the ARCH variable
-    # because if NO_ASM build flag is defined then ARCH is set to "generic".
-    if (APPLE AND CMAKE_SYSTEM_PROCESSOR_LOWER MATCHES "arm64.*|aarch64")
-      add_custom_command(
-        TARGET crypto POST_BUILD
-        COMMAND codesign -s - $<TARGET_FILE:crypto>
-        WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
-      )
-    endif()
-
-  endif()
 else()
   build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
 endif()
diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 4d8df2d579..4ae71cc707 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -40,6 +40,8 @@
 
 #include "../internal.h"
 
+#include "ec/table_test.h"
+
 #include "aes/aes.c"
 #include "aes/aes_nohw.c"
 #include "aes/key_wrap.c"
diff --git a/util/fipstools/capture_hash/capture_hash.go b/util/fipstools/capture_hash/capture_hash.go
index f2eb0250b0..dadc2fd7dd 100644
--- a/util/fipstools/capture_hash/capture_hash.go
+++ b/util/fipstools/capture_hash/capture_hash.go
@@ -30,7 +30,8 @@ func main() {
 		fmt.Fprintf(os.Stderr, string(out))
 		panic("Executable did not fail as expected")
 	}
-	lines := strings.Split(string(out), "\r\n")
+    tmp := strings.ReplaceAll(string(out), "\r\n", "\n")
+	lines := strings.Split(tmp, "\n")
 	if len(lines) != 4 {
 		fmt.Fprintf(os.Stderr, string(out))
 		panic(fmt.Sprintf("Expected 4 lines in output but got %d", len(lines)))
@@ -64,4 +65,4 @@ const uint8_t BORINGSSL_bcm_text_hash[32] = {
 	fmt.Printf(`
 };
 `)
-}
\ No newline at end of file
+}

From 183ca77147752298be9e986fed04107a808d6981 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 10 Oct 2024 11:09:45 -0700
Subject: [PATCH 03/20] inject hash made redundant

---
 crypto/CMakeLists.txt                       |  4 +-
 crypto/fipsmodule/bcm.c                     |  7 +-
 crypto/fipsmodule/ec/p521.c                 |  1 -
 crypto/fipsmodule/fips_shared_support.c     |  6 +-
 util/fipstools/capture_hash/capture_hash.go |  2 +
 util/fipstools/delocate/delocate.go         | 14 +---
 util/fipstools/inject_hash/inject_hash.go   | 85 ++++++++++-----------
 7 files changed, 57 insertions(+), 62 deletions(-)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index aec176950d..5284fd642a 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -616,7 +616,7 @@ function(build_libcrypto name module_source)
           $<INSTALL_INTERFACE:include>)
 endfunction()
 
-if(FIPS_SHARED)
+if(FIPS_SHARED OR FIPS_DELOCATE)
   # Rewrite libcrypto.so, libcrypto.dylib, or crypto.dll to inject the correct module
   # hash value. For now we support the FIPS build only on Linux, macOS, iOS, and Windows.
     # On Windows we use capture_hash.go to capture the computed integrity value that bcm.o prints to generate the
@@ -626,6 +626,7 @@ if(FIPS_SHARED)
     target_link_libraries(fips_empty_main PUBLIC precrypto)
     target_include_directories(fips_empty_main PRIVATE ${PROJECT_SOURCE_DIR}/include)
     target_include_directories(fips_empty_main BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
+
     add_custom_command(OUTPUT generated_fips_shared_support.c
             COMMAND ${GO_EXECUTABLE} run
             ${PROJECT_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
@@ -633,6 +634,7 @@ if(FIPS_SHARED)
             WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
             DEPENDS fips_empty_main ${PROJECT_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
             )
+
     add_library(
       generated_fipsmodule
 
diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 4ae71cc707..93141ea996 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -158,6 +158,8 @@
 #include "sshkdf/sshkdf.c"
 #include "tls/kdf.c"
 
+#include "fips_support.h"
+
 #if defined(BORINGSSL_FIPS)
 
 #if !defined(OPENSSL_ASAN)
@@ -177,7 +179,6 @@ static const void* function_entry_ptr(const void* func_sym) {
 // the location of the integrity hash, respectively.
 extern const uint8_t BORINGSSL_bcm_text_start[];
 extern const uint8_t BORINGSSL_bcm_text_end[];
-extern const uint8_t BORINGSSL_bcm_text_hash[];
 #if defined(BORINGSSL_SHARED_LIBRARY)
 extern const uint8_t BORINGSSL_bcm_rodata_start[];
 extern const uint8_t BORINGSSL_bcm_rodata_end[];
@@ -368,7 +369,7 @@ int BORINGSSL_integrity_test(void) {
 #endif
 
   // EC tables
-  const uint8_t *asd = get_asdasd();
+  const uint8_t *asd = get_qweqwe();
   HMAC_Update(&hmac_ctx, asd, 4);
 
   if (!HMAC_Final(&hmac_ctx, result, &result_len) ||
@@ -378,7 +379,7 @@ int BORINGSSL_integrity_test(void) {
   }
   HMAC_CTX_cleanse(&hmac_ctx); // FIPS 140-3, AS05.10.
 
-  const uint8_t *expected = BORINGSSL_bcm_text_hash;
+  const uint8_t *expected = get_asdasd();
 
   if (!check_test(expected, result, sizeof(result), "FIPS integrity test")) {
 #if !defined(BORINGSSL_FIPS_BREAK_TESTS)
diff --git a/crypto/fipsmodule/ec/p521.c b/crypto/fipsmodule/ec/p521.c
index 511e43ae77..b1ed65dc7b 100644
--- a/crypto/fipsmodule/ec/p521.c
+++ b/crypto/fipsmodule/ec/p521.c
@@ -523,7 +523,6 @@ static void ec_GFp_nistp521_point_mul(const EC_GROUP *group, EC_JACOBIAN *r,
 //   4. If the scalar is even subtract G from the accumulator.
 //
 // Note: this function is constant-time.
-#include "table_test.h"
 static void ec_GFp_nistp521_point_mul_base(const EC_GROUP *group,
                                            EC_JACOBIAN *r,
                                            const EC_SCALAR *scalar) {
diff --git a/crypto/fipsmodule/fips_shared_support.c b/crypto/fipsmodule/fips_shared_support.c
index 54aa34b934..a50c8b7efa 100644
--- a/crypto/fipsmodule/fips_shared_support.c
+++ b/crypto/fipsmodule/fips_shared_support.c
@@ -12,10 +12,10 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
-#include <stdint.h>
 
+#include "fips_support.h"
 
-#if defined(BORINGSSL_FIPS) && defined(BORINGSSL_SHARED_LIBRARY)
+#if defined(BORINGSSL_FIPS)
 // BORINGSSL_bcm_text_hash is is default hash value for the FIPS integrity check
 // that must be replaced with the real value during the build process. This
 // value need only be distinct, i.e. so that we can safely search-and-replace it
@@ -25,4 +25,6 @@ const uint8_t BORINGSSL_bcm_text_hash[32] = {
     0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f,
     0x6b, 0x6f, 0xde, 0x52, 0xcd, 0xe2, 0xcd, 0xff, 0x31, 0x80,
 };
+
+const uint8_t *get_asdasd(void) { return BORINGSSL_bcm_text_hash; }
 #endif  // FIPS && SHARED_LIBRARY
diff --git a/util/fipstools/capture_hash/capture_hash.go b/util/fipstools/capture_hash/capture_hash.go
index dadc2fd7dd..36bec783a4 100644
--- a/util/fipstools/capture_hash/capture_hash.go
+++ b/util/fipstools/capture_hash/capture_hash.go
@@ -64,5 +64,7 @@ const uint8_t BORINGSSL_bcm_text_hash[32] = {
 	}
 	fmt.Printf(`
 };
+const uint8_t *get_asdasd(void);
+const uint8_t *get_asdasd(void) { return BORINGSSL_bcm_text_hash; }
 `)
 }
diff --git a/util/fipstools/delocate/delocate.go b/util/fipstools/delocate/delocate.go
index f3c94573b3..2372fd7e3d 100644
--- a/util/fipstools/delocate/delocate.go
+++ b/util/fipstools/delocate/delocate.go
@@ -29,7 +29,7 @@ import (
 	"strings"
 
 	"boringssl.googlesource.com/boringssl/util/ar"
-	"boringssl.googlesource.com/boringssl/util/fipstools/fipscommon"
+	// "boringssl.googlesource.com/boringssl/util/fipstools/fipscommon"
 )
 
 // inputFile represents a textual assembly file.
@@ -2139,13 +2139,6 @@ func transform(w stringWriter, includes []string, inputs []inputFile, startEndDe
 		}
 	}
 
-	w.WriteString(".type BORINGSSL_bcm_text_hash, @object\n")
-	w.WriteString(".size BORINGSSL_bcm_text_hash, 32\n")
-	w.WriteString("BORINGSSL_bcm_text_hash:\n")
-	for _, b := range fipscommon.UninitHashValue {
-		w.WriteString(".byte 0x" + strconv.FormatUint(uint64(b), 16) + "\n")
-	}
-
 	return nil
 }
 
@@ -2417,13 +2410,12 @@ func localEntryName(name string) string {
 
 func isSynthesized(symbol string, processor processorType) bool {
 	SymbolisSynthesized := strings.HasSuffix(symbol, "_bss_get") ||
-		symbol == "OPENSSL_ia32cap_get" ||
-		symbol == "BORINGSSL_bcm_text_hash"
+		symbol == "OPENSSL_ia32cap_get"
 
 	// While BORINGSSL_bcm_text_[start,end] are known symbols, on aarch64 we go
 	// through the GOT because adr doesn't have adequate reach.
 	if processor != aarch64 {
-		SymbolisSynthesized = SymbolisSynthesized || strings.HasPrefix(symbol, "BORINGSSL_bcm_text_")
+		SymbolisSynthesized = SymbolisSynthesized || symbol == "BORINGSSL_bcm_text_start" || symbol == "BORINGSSL_bcm_text_end"
 	}
 
 	return SymbolisSynthesized
diff --git a/util/fipstools/inject_hash/inject_hash.go b/util/fipstools/inject_hash/inject_hash.go
index 2d5e010980..f9a230be6f 100644
--- a/util/fipstools/inject_hash/inject_hash.go
+++ b/util/fipstools/inject_hash/inject_hash.go
@@ -19,20 +19,20 @@ package main
 
 import (
 	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
+	// "crypto/hmac"
+	// "crypto/sha256"
 	"debug/elf"
 	"debug/macho"
-	"encoding/binary"
+	// "encoding/binary"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"os"
-	"strings"
+	// "strings"
 
 	"boringssl.googlesource.com/boringssl/util/ar"
-	"boringssl.googlesource.com/boringssl/util/fipstools/fipscommon"
+	// "boringssl.googlesource.com/boringssl/util/fipstools/fipscommon"
 )
 
 func doLinux(objectBytes []byte, isStatic bool) ([]byte, []byte, error) {
@@ -310,11 +310,9 @@ func doAppleOS(objectBytes []byte) ([]byte, []byte, error) {
 
 func do(outPath, oInput string, arInput string, appleOS bool) error {
 	var objectBytes []byte
-	var isStatic bool
 	var perm os.FileMode
 
 	if len(arInput) > 0 {
-		isStatic = true
 
 		if len(oInput) > 0 {
 			return fmt.Errorf("-in-archive and -in-object are mutually exclusive")
@@ -358,57 +356,56 @@ func do(outPath, oInput string, arInput string, appleOS bool) error {
 		if objectBytes, err = os.ReadFile(oInput); err != nil {
 			return err
 		}
-		isStatic = strings.HasSuffix(oInput, ".o")
 	} else {
 		return fmt.Errorf("exactly one of -in-archive or -in-object is required")
 	}
 
-	var moduleText, moduleROData []byte
-	var err error
-	if appleOS == true {
-		moduleText, moduleROData, err = doAppleOS(objectBytes)
-	} else {
-		moduleText, moduleROData, err = doLinux(objectBytes, isStatic)
-	}
+	// var moduleText, moduleROData []byte
+	// var err error
+	// if appleOS == true {
+	// 	moduleText, moduleROData, err = doAppleOS(objectBytes)
+	// } else {
+	// 	moduleText, moduleROData, err = doLinux(objectBytes, isStatic)
+	// }
 
-	if err != nil {
-		return err
-	}
+	// if err != nil {
+	// 	return err
+	// }
 
-	var zeroKey [64]byte
-	mac := hmac.New(sha256.New, zeroKey[:])
+	// var zeroKey [64]byte
+	// mac := hmac.New(sha256.New, zeroKey[:])
 
-	if moduleROData != nil {
-		var lengthBytes [8]byte
-		binary.LittleEndian.PutUint64(lengthBytes[:], uint64(len(moduleText)))
-		mac.Write(lengthBytes[:])
-		mac.Write(moduleText)
+	// if moduleROData != nil {
+	// 	var lengthBytes [8]byte
+	// 	binary.LittleEndian.PutUint64(lengthBytes[:], uint64(len(moduleText)))
+	// 	mac.Write(lengthBytes[:])
+	// 	mac.Write(moduleText)
 
-		binary.LittleEndian.PutUint64(lengthBytes[:], uint64(len(moduleROData)))
-		mac.Write(lengthBytes[:])
-		mac.Write(moduleROData)
-	} else {
-		mac.Write(moduleText)
-	}
+	// 	binary.LittleEndian.PutUint64(lengthBytes[:], uint64(len(moduleROData)))
+	// 	mac.Write(lengthBytes[:])
+	// 	mac.Write(moduleROData)
+	// } else {
+	// 	mac.Write(moduleText)
+	// }
 
-    ecTable := []byte{1, 2, 3, 4}
-    mac.Write(ecTable)
+    // ecTable := []byte{1, 2, 3, 4}
+    // mac.Write(ecTable)
 
-	calculated := mac.Sum(nil)
+	// calculated := mac.Sum(nil)
 
-	// Replace the default hash value in the object with the calculated
-	// value and write it out.
+	// // Replace the default hash value in the object with the calculated
+	// // value and write it out.
 
-	offset := bytes.Index(objectBytes, fipscommon.UninitHashValue[:])
-	if offset < 0 {
-		return errors.New("did not find uninitialised hash value in object file")
-	}
+	// offset := bytes.Index(objectBytes, fipscommon.UninitHashValue[:])
+	// if offset < 0 {
+	// 	return errors.New("did not find uninitialised hash value in object file")
+	// }
 
-	if bytes.Index(objectBytes[offset+1:], fipscommon.UninitHashValue[:]) >= 0 {
-		return errors.New("found two occurrences of uninitialised hash value in object file")
-	}
+	// if bytes.Index(objectBytes[offset+1:], fipscommon.UninitHashValue[:]) >= 0 {
+	// 	return errors.New("found two occurrences of uninitialised hash value in object file")
+	// }
 
-	copy(objectBytes[offset:], calculated)
+	// copy(objectBytes[offset:], calculated)
 
 	return os.WriteFile(outPath, objectBytes, perm&0777)
 }

From 274718a733504b1171419195ecc033a332432fb4 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 10 Oct 2024 14:49:44 -0700
Subject: [PATCH 04/20] deleted inject_hash invocation from cmake

---
 crypto/fipsmodule/CMakeLists.txt | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/crypto/fipsmodule/CMakeLists.txt b/crypto/fipsmodule/CMakeLists.txt
index e29548ba78..9e3c9f666f 100644
--- a/crypto/fipsmodule/CMakeLists.txt
+++ b/crypto/fipsmodule/CMakeLists.txt
@@ -403,7 +403,7 @@ if(FIPS_DELOCATE)
   add_library(
     bcm_hashunset
 
-    STATIC
+    OBJECT
 
     bcm-delocated.S
   )
@@ -416,20 +416,19 @@ if(FIPS_DELOCATE)
   set_target_properties(bcm_hashunset PROPERTIES POSITION_INDEPENDENT_CODE ON)
   set_target_properties(bcm_hashunset PROPERTIES LINKER_LANGUAGE C)
 
-  go_executable(inject_hash
-                boringssl.googlesource.com/boringssl/util/fipstools/inject_hash)
+  set(BCM_NAME bcm.o)
   add_custom_command(
-    OUTPUT bcm.o
-    COMMAND ./inject_hash -o bcm.o -in-archive $<TARGET_FILE:bcm_hashunset>
-    DEPENDS bcm_hashunset inject_hash
+    OUTPUT ${BCM_NAME}
+    COMMAND cp $<TARGET_OBJECTS:bcm_hashunset> ${BCM_NAME}
+    DEPENDS bcm_hashunset
     WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
   )
 
   # The outputs of add_custom_command cannot be referenced outside of the
   # CMakeLists.txt that defines it. Thus we have to wrap bcm.o in a custom target
   # so that crypto can depend on it.
-  add_custom_target(bcm_o_target DEPENDS bcm.o)
-  set(BCM_NAME bcm.o PARENT_SCOPE)
+  add_custom_target(bcm_o_target DEPENDS ${BCM_NAME})
+  set(BCM_NAME ${BCM_NAME} PARENT_SCOPE)
 
   add_library(
     fipsmodule

From dc9691133f721b334cd9ea9c0b1f84e1e38b91b6 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 10 Oct 2024 15:05:23 -0700
Subject: [PATCH 05/20] remove remnants of table-test

---
 crypto/CMakeLists.txt            | 1 -
 crypto/fipsmodule/CMakeLists.txt | 3 ---
 crypto/fipsmodule/bcm.c          | 6 ------
 3 files changed, 10 deletions(-)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 5284fd642a..a82747e171 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -642,7 +642,6 @@ if(FIPS_SHARED OR FIPS_DELOCATE)
 
       generated_fips_shared_support.c
       ${PROJECT_SOURCE_DIR}/crypto/fipsmodule/cpucap/cpucap.c
-      ${PROJECT_SOURCE_DIR}/crypto/fipsmodule/ec/table_test.c
     )
     add_dependencies(generated_fipsmodule boringssl_prefix_symbols)
     target_include_directories(generated_fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)
diff --git a/crypto/fipsmodule/CMakeLists.txt b/crypto/fipsmodule/CMakeLists.txt
index 9e3c9f666f..91dcede490 100644
--- a/crypto/fipsmodule/CMakeLists.txt
+++ b/crypto/fipsmodule/CMakeLists.txt
@@ -437,7 +437,6 @@ if(FIPS_DELOCATE)
 
     fips_shared_support.c
     cpucap/cpucap.c
-    ec/table_test.c
   )
   target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)
 
@@ -458,7 +457,6 @@ elseif(FIPS_SHARED)
 
     fips_shared_support.c
     cpucap/cpucap.c
-    ec/table_test.c
   )
   target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)
 
@@ -580,7 +578,6 @@ else()
     bcm.c
     fips_shared_support.c
     cpucap/cpucap.c
-    ec/table_test.c
 
     ${BCM_ASM_SOURCES}
     ${BCM_ASM_OBJECTS}
diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 93141ea996..3198f95850 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -40,8 +40,6 @@
 
 #include "../internal.h"
 
-#include "ec/table_test.h"
-
 #include "aes/aes.c"
 #include "aes/aes_nohw.c"
 #include "aes/key_wrap.c"
@@ -368,10 +366,6 @@ int BORINGSSL_integrity_test(void) {
   BORINGSSL_maybe_set_module_text_permissions(PROT_EXEC);
 #endif
 
-  // EC tables
-  const uint8_t *asd = get_qweqwe();
-  HMAC_Update(&hmac_ctx, asd, 4);
-
   if (!HMAC_Final(&hmac_ctx, result, &result_len) ||
       result_len != sizeof(result)) {
     fprintf(stderr, "HMAC failed.\n");

From 9eb2a206e1fb2110074f0e816e2a88cf053aa201 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 10 Oct 2024 15:22:12 -0700
Subject: [PATCH 06/20] forgot to add file to git

---
 crypto/fipsmodule/fips_support.h | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 crypto/fipsmodule/fips_support.h

diff --git a/crypto/fipsmodule/fips_support.h b/crypto/fipsmodule/fips_support.h
new file mode 100644
index 0000000000..3a6e0d55bb
--- /dev/null
+++ b/crypto/fipsmodule/fips_support.h
@@ -0,0 +1,8 @@
+#ifndef FIPS_SUPPORT_H
+#define FIPS_SUPPORT_H
+
+#include <stdint.h>
+
+const uint8_t *get_asdasd(void);
+
+#endif

From a981f89566e39f25c0c8c5619b78c21b5214e3e9 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 10 Oct 2024 16:03:41 -0700
Subject: [PATCH 07/20] fix delocate_test

---
 .../delocate/testdata/aarch64-Basic/out.s     | 35 -------------------
 .../generic-FileDirectives-no-start-end/out.s | 35 -------------------
 .../testdata/generic-FileDirectives/out.s     | 35 -------------------
 .../delocate/testdata/generic-Includes/out.s  | 35 -------------------
 .../testdata/ppc64le-GlobalEntry/out.s        | 35 -------------------
 .../delocate/testdata/ppc64le-LoadToR0/out.s  | 35 -------------------
 .../delocate/testdata/ppc64le-Sample/out.s    | 35 -------------------
 .../delocate/testdata/ppc64le-Sample2/out.s   | 35 -------------------
 .../testdata/ppc64le-TOCWithOffset/out.s      | 35 -------------------
 .../delocate/testdata/x86_64-BSS/out.s        | 35 -------------------
 .../delocate/testdata/x86_64-Basic/out.s      | 35 -------------------
 .../delocate/testdata/x86_64-FourArg/out.s    | 35 -------------------
 .../delocate/testdata/x86_64-GOTRewrite/out.s | 35 -------------------
 .../testdata/x86_64-LabelRewrite/out.s        | 35 -------------------
 .../testdata/x86_64-LargeMemory/out.s         | 35 -------------------
 .../delocate/testdata/x86_64-Sections/out.s   | 35 -------------------
 .../delocate/testdata/x86_64-ThreeArg/out.s   | 35 -------------------
 17 files changed, 595 deletions(-)

diff --git a/util/fipstools/delocate/testdata/aarch64-Basic/out.s b/util/fipstools/delocate/testdata/aarch64-Basic/out.s
index b4716afdf0..e2bba174b5 100644
--- a/util/fipstools/delocate/testdata/aarch64-Basic/out.s
+++ b/util/fipstools/delocate/testdata/aarch64-Basic/out.s
@@ -261,38 +261,3 @@ bss_symbol_bss_get:
 	ret
 .cfi_endproc
 .size .LOPENSSL_armcap_P_addr, .-.LOPENSSL_armcap_P_addr
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/generic-FileDirectives-no-start-end/out.s b/util/fipstools/delocate/testdata/generic-FileDirectives-no-start-end/out.s
index 5ab8fc7ef1..d3f2b03d4a 100644
--- a/util/fipstools/delocate/testdata/generic-FileDirectives-no-start-end/out.s
+++ b/util/fipstools/delocate/testdata/generic-FileDirectives-no-start-end/out.s
@@ -14,38 +14,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/generic-FileDirectives/out.s b/util/fipstools/delocate/testdata/generic-FileDirectives/out.s
index 80d7d526c2..9f4c7e1985 100644
--- a/util/fipstools/delocate/testdata/generic-FileDirectives/out.s
+++ b/util/fipstools/delocate/testdata/generic-FileDirectives/out.s
@@ -17,38 +17,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/generic-Includes/out.s b/util/fipstools/delocate/testdata/generic-Includes/out.s
index c835dfe734..fee10f1ea6 100644
--- a/util/fipstools/delocate/testdata/generic-Includes/out.s
+++ b/util/fipstools/delocate/testdata/generic-Includes/out.s
@@ -19,38 +19,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s b/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s
index d75e2c7f1d..df6efd5241 100644
--- a/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s
+++ b/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s
@@ -25,38 +25,3 @@ foo:
 BORINGSSL_bcm_text_end:
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s b/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s
index dad7603ab0..4d85d21187 100644
--- a/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s
+++ b/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s
@@ -35,38 +35,3 @@ bcm_loadtoc_bar:
 	blr
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/ppc64le-Sample/out.s b/util/fipstools/delocate/testdata/ppc64le-Sample/out.s
index 71ad6c20b3..b460ea3eae 100644
--- a/util/fipstools/delocate/testdata/ppc64le-Sample/out.s
+++ b/util/fipstools/delocate/testdata/ppc64le-Sample/out.s
@@ -515,38 +515,3 @@ bcm_loadtoc__dot_LkString_local_target:
 	blr
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s b/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s
index e24f53ec45..98bd23fb5c 100644
--- a/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s
+++ b/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s
@@ -640,38 +640,3 @@ bcm_loadtoc__dot_Lfunction_local_target:
 	blr
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s b/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s
index fc55ef2073..23a430ad53 100644
--- a/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s
+++ b/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s
@@ -141,38 +141,3 @@ bcm_loadtoc__dot_Lfoo_local_target__minus_10:
 	blr
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-BSS/out.s b/util/fipstools/delocate/testdata/x86_64-BSS/out.s
index fd64b8f8fc..dad1e70ab8 100644
--- a/util/fipstools/delocate/testdata/x86_64-BSS/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-BSS/out.s
@@ -71,38 +71,3 @@ z_bss_get:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-Basic/out.s b/util/fipstools/delocate/testdata/x86_64-Basic/out.s
index af5eb89ff3..129d98498f 100644
--- a/util/fipstools/delocate/testdata/x86_64-Basic/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-Basic/out.s
@@ -67,38 +67,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-FourArg/out.s b/util/fipstools/delocate/testdata/x86_64-FourArg/out.s
index f1e47fb811..f869b358f7 100644
--- a/util/fipstools/delocate/testdata/x86_64-FourArg/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-FourArg/out.s
@@ -48,38 +48,3 @@ fooExternal_GOTPCREL_external:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s b/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s
index a56f140ef7..c065efea89 100644
--- a/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s
@@ -319,38 +319,3 @@ LOPENSSL_ia32cap_P_rax2:
 LOPENSSL_ia32cap_P_rbx3:
 	leaq OPENSSL_ia32cap_P(%rip), %rbx
 	jmp LOPENSSL_ia32cap_P_rbx3_return
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s b/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s
index 7cc74fb8ab..15da41954e 100644
--- a/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s
@@ -119,38 +119,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s b/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s
index c460c57023..9380d0ddb6 100644
--- a/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s
@@ -53,38 +53,3 @@ OPENSSL_ia32cap_get:
 	.quad h@GOT
 .Lboringssl_gotoff__Z1gv:
 	.quad _Z1gv@GOTOFF
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-Sections/out.s b/util/fipstools/delocate/testdata/x86_64-Sections/out.s
index d107e30ebf..0ae81cee22 100644
--- a/util/fipstools/delocate/testdata/x86_64-Sections/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-Sections/out.s
@@ -53,38 +53,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80
diff --git a/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s b/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s
index 79cdbe60a5..132f49e3ab 100644
--- a/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s
+++ b/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s
@@ -40,38 +40,3 @@ BORINGSSL_bcm_text_end:
 OPENSSL_ia32cap_get:
 	leaq OPENSSL_ia32cap_P(%rip), %rax
 	ret
-.type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 32
-BORINGSSL_bcm_text_hash:
-.byte 0xae
-.byte 0x2c
-.byte 0xea
-.byte 0x2a
-.byte 0xbd
-.byte 0xa6
-.byte 0xf3
-.byte 0xec
-.byte 0x97
-.byte 0x7f
-.byte 0x9b
-.byte 0xf6
-.byte 0x94
-.byte 0x9a
-.byte 0xfc
-.byte 0x83
-.byte 0x68
-.byte 0x27
-.byte 0xcb
-.byte 0xa0
-.byte 0xa0
-.byte 0x9f
-.byte 0x6b
-.byte 0x6f
-.byte 0xde
-.byte 0x52
-.byte 0xcd
-.byte 0xe2
-.byte 0xcd
-.byte 0xff
-.byte 0x31
-.byte 0x80

From bf68218010e97aca63034333508d8b9776f1ab23 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Tue, 15 Oct 2024 14:51:25 -0700
Subject: [PATCH 08/20] qweqwe

---
 crypto/CMakeLists.txt                      |  37 ++++---
 crypto/fipsmodule/CMakeLists.txt           |   6 +-
 util/fipstools/inject_hash/inject_hash.cpp | 113 +++++++++++++++++++++
 3 files changed, 134 insertions(+), 22 deletions(-)
 create mode 100644 util/fipstools/inject_hash/inject_hash.cpp

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index a82747e171..5165e7b2b4 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -614,6 +614,7 @@ function(build_libcrypto name module_source)
   target_include_directories(${name} PUBLIC
           $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>
           $<INSTALL_INTERFACE:include>)
+
 endfunction()
 
 if(FIPS_SHARED OR FIPS_DELOCATE)
@@ -627,27 +628,25 @@ if(FIPS_SHARED OR FIPS_DELOCATE)
     target_include_directories(fips_empty_main PRIVATE ${PROJECT_SOURCE_DIR}/include)
     target_include_directories(fips_empty_main BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
-    add_custom_command(OUTPUT generated_fips_shared_support.c
-            COMMAND ${GO_EXECUTABLE} run
-            ${PROJECT_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
-            -in-executable $<TARGET_FILE:fips_empty_main> > generated_fips_shared_support.c
-            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-            DEPENDS fips_empty_main ${PROJECT_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
-            )
-
-    add_library(
-      generated_fipsmodule
-
-      OBJECT
 
-      generated_fips_shared_support.c
-      ${PROJECT_SOURCE_DIR}/crypto/fipsmodule/cpucap/cpucap.c
-    )
-    add_dependencies(generated_fipsmodule boringssl_prefix_symbols)
-    target_include_directories(generated_fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)
-    target_include_directories(generated_fipsmodule BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
+    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
 
-    build_libcrypto(crypto $<TARGET_OBJECTS:generated_fipsmodule>)
+    add_executable(inject_hash ${PROJECT_SOURCE_DIR}/util/fipstools/inject_hash/inject_hash.cpp)
+    add_custom_command(
+        TARGET crypto POST_BUILD
+        COMMAND ./inject_hash $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
+        WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+        DEPENDS inject_hash fips_empty_main
+        )
+
+    if (APPLE)
+        add_custom_command(
+            TARGET crypto POST_BUILD
+            COMMAND codesign -s - $<TARGET_FILE:crypto>
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+            DEPENDS inject_hash fips_empty_main
+            )
+    endif()
 else()
   build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
 endif()
diff --git a/crypto/fipsmodule/CMakeLists.txt b/crypto/fipsmodule/CMakeLists.txt
index 91dcede490..6b2e56ca27 100644
--- a/crypto/fipsmodule/CMakeLists.txt
+++ b/crypto/fipsmodule/CMakeLists.txt
@@ -546,12 +546,12 @@ elseif(FIPS_SHARED)
   else()
     set(BCM_NAME bcm.o)
     # fips_shared.lds does not have 'clang' prefix because we want to keep merging any changes from upstream.
-    set(FIPS_CUSTOM_LINKER_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/fips_shared.lds")
-    if (GCC)
+    # set(FIPS_CUSTOM_LINKER_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/fips_shared.lds")
+    # if (GCC)
       # gcc puts some code in sections named ".text.unlikely", ".text.exit" and ".text.startup".
       # so we have a separate linker script for gcc.
       set(FIPS_CUSTOM_LINKER_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/gcc_fips_shared.lds")
-    endif()
+    # endif()
 
     add_custom_command(
       OUTPUT ${BCM_NAME}
diff --git a/util/fipstools/inject_hash/inject_hash.cpp b/util/fipstools/inject_hash/inject_hash.cpp
new file mode 100644
index 0000000000..293c99d849
--- /dev/null
+++ b/util/fipstools/inject_hash/inject_hash.cpp
@@ -0,0 +1,113 @@
+#include <algorithm>
+#include <array>
+#include <fstream>
+#include <iostream>
+#include <iterator>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <vector>
+
+// Function to find and replace a byte sequence in a vector of bytes.
+static int findAndReplace(std::vector<unsigned char>& data, const std::vector<unsigned char>& searchSeq, const std::vector<unsigned char>& replaceSeq) {
+    auto it = std::search(data.begin(), data.end(), searchSeq.begin(), searchSeq.end());
+
+    if (it != data.end()) {
+        std::copy(replaceSeq.begin(), replaceSeq.end(), it);
+        return 1;
+    }
+
+    return 0;
+}
+
+static std::vector<unsigned char> hexStringToBytes(const std::string& hex) {
+    std::vector<unsigned char> byteArray;
+
+    // Iterate over the hex string two characters at a time
+    for (size_t i = 0; i < hex.length(); i += 2) {
+        // Convert the two hex characters to a byte
+        std::string byteString = hex.substr(i, 2);
+        unsigned char byte = static_cast<unsigned char>(strtol(byteString.c_str(), nullptr, 16));
+        byteArray.push_back(byte);
+    }
+
+    return byteArray;
+}
+
+int main(int argc, char* argv[]) {
+    if (argc != 3) {
+        std::cerr << "Usage: " << argv[0] << " libcryptoFile fipsEmptyMainFile" << std::endl;
+        return 1;
+    }
+    const std::string libcryptoFile = argv[1];
+    const std::string fipsEmptyMainFile = argv[2];
+
+    // We execute the fipsEmptyMain program to catch its output
+    // which contains the expected and calculated hash value.
+
+    // Make sure stderr is redirected to stdout.
+    std::string command = fipsEmptyMainFile + " 2>&1";
+
+    // Execute the comand and get the output.
+    std::array<char, 1000> buffer;
+    std::string fipsEmptyMainOutput;
+#if defined(_WIN32)
+    std::unique_ptr<FILE, decltype(&_pclose)> pipe(_popen(command, "r"), _pclose);
+#else
+    std::unique_ptr<FILE, decltype(&pclose)> pipe(popen(command.c_str(), "r"), pclose);
+#endif
+    if (!pipe) {
+        std::cerr << "popen() failed!" << std::endl;
+        return 1;
+    }
+    while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) {
+        fipsEmptyMainOutput += buffer.data();
+    }
+
+    // The output should contain three lines:
+    //   FIPS integrity test failed.
+    //   Expected:    xyz...
+    //   Calculated:  asd...
+    if (fipsEmptyMainOutput.find("FIPS integrity test failed.") == std::string::npos ||
+        fipsEmptyMainOutput.find("Expected") == std::string::npos ||
+        fipsEmptyMainOutput.find("Calculated") == std::string::npos) {
+        std::cerr << "fips_empty_main returned unexpected output!" << std::endl;
+        return 1;
+    }
+    std::istringstream iss(fipsEmptyMainOutput);
+    std::string label, expectedHash, calculatedHash;
+    std::getline(iss, label); // skip the first line.
+    iss >> label; iss >> expectedHash;
+    iss >> label; iss >> calculatedHash;
+
+    // Convert the hex strings representing hash values to bytes.
+    std::vector<unsigned char> expectedHashBytes = hexStringToBytes(expectedHash);
+    std::vector<unsigned char> calculatedHashBytes = hexStringToBytes(calculatedHash);
+
+    // Find the expected and replace it with the calculated hash.
+    std::ifstream input(libcryptoFile, std::ios::binary);
+    if (!input) {
+        std::cerr << "Error: Unable to open the binary!" << std::endl;
+        return 1;
+    }
+
+    // Read the input file into a vector of bytes.
+    std::vector<unsigned char> data((std::istreambuf_iterator<char>(input)), std::istreambuf_iterator<char>());
+    input.close();
+
+    if (!findAndReplace(data, expectedHashBytes, calculatedHashBytes)) {
+        std::cerr << "Error: didn't find the expected hash value in the binary!" << std::endl;
+        return 1;
+    }
+
+    // Write the modified data to the output binary file.
+    std::ofstream output(libcryptoFile, std::ios::binary);
+    if (!output) {
+        std::cerr << "Error: Unable to open output file!" << std::endl;
+        return 1;
+    }
+    output.write(reinterpret_cast<const char*>(data.data()), data.size());
+    output.close();
+
+    return 0;
+}

From 4c8b07b954f7af9baaffdf0ab4053053191b4021 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 17 Oct 2024 10:13:12 -0700
Subject: [PATCH 09/20] small fix

---
 CMakeLists.txt        | 2 +-
 crypto/CMakeLists.txt | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 317ee80cb0..9d0ff967be 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -86,7 +86,7 @@ endif()
 
 # Tests and libssl both require the CXX language to be enabled. If a consumer
 # chooses to disable building the tests and libssl, do not enable CXX
-if(BUILD_TESTING OR BUILD_LIBSSL)
+if(BUILD_TESTING OR BUILD_LIBSSL OR FIPS)
   enable_language(CXX)
 endif()
 
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 5165e7b2b4..4579f11878 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -634,9 +634,10 @@ if(FIPS_SHARED OR FIPS_DELOCATE)
     add_executable(inject_hash ${PROJECT_SOURCE_DIR}/util/fipstools/inject_hash/inject_hash.cpp)
     add_custom_command(
         TARGET crypto POST_BUILD
-        COMMAND ./inject_hash $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
+        COMMAND $<TARGET_FILE:inject_hash> $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
         WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
         DEPENDS inject_hash fips_empty_main
+        COMMENT "Injecting FIPS hash"
         )
 
     if (APPLE)

From a1b02cd37950aae8b0b66d04e8c505035af1324a Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 17 Oct 2024 11:19:10 -0700
Subject: [PATCH 10/20] small fix for windows

---
 util/fipstools/inject_hash/inject_hash.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/fipstools/inject_hash/inject_hash.cpp b/util/fipstools/inject_hash/inject_hash.cpp
index 293c99d849..6fa80e6ad4 100644
--- a/util/fipstools/inject_hash/inject_hash.cpp
+++ b/util/fipstools/inject_hash/inject_hash.cpp
@@ -52,7 +52,7 @@ int main(int argc, char* argv[]) {
     std::array<char, 1000> buffer;
     std::string fipsEmptyMainOutput;
 #if defined(_WIN32)
-    std::unique_ptr<FILE, decltype(&_pclose)> pipe(_popen(command, "r"), _pclose);
+    std::unique_ptr<FILE, decltype(&_pclose)> pipe(_popen(command.c_str(), "r"), _pclose);
 #else
     std::unique_ptr<FILE, decltype(&pclose)> pipe(popen(command.c_str(), "r"), pclose);
 #endif

From 6468aa7e149de72b0c8e836b1cd1a5c3fd5358c7 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 17 Oct 2024 11:40:07 -0700
Subject: [PATCH 11/20] debuging help

---
 util/fipstools/inject_hash/inject_hash.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/util/fipstools/inject_hash/inject_hash.cpp b/util/fipstools/inject_hash/inject_hash.cpp
index 6fa80e6ad4..8e2bcbc2d7 100644
--- a/util/fipstools/inject_hash/inject_hash.cpp
+++ b/util/fipstools/inject_hash/inject_hash.cpp
@@ -109,5 +109,10 @@ int main(int argc, char* argv[]) {
     output.write(reinterpret_cast<const char*>(data.data()), data.size());
     output.close();
 
+
+    std::cout << "Successfully injected FIPS hash!" << std::endl;
+    std::cout << expectedHash << std::endl;
+    std::cout << calculatedHash << std::endl;
+
     return 0;
 }

From d34caed8cd1fd10b52f8cc570b8b9fc228db6ccd Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 17 Oct 2024 16:17:10 -0700
Subject: [PATCH 12/20] prevent LTO screwing FIPS hash check

---
 crypto/fipsmodule/fips_shared.lds       | 2 ++
 crypto/fipsmodule/fips_shared_support.c | 2 ++
 crypto/fipsmodule/gcc_fips_shared.lds   | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/crypto/fipsmodule/fips_shared.lds b/crypto/fipsmodule/fips_shared.lds
index ebd3c8962b..734729f9f0 100644
--- a/crypto/fipsmodule/fips_shared.lds
+++ b/crypto/fipsmodule/fips_shared.lds
@@ -1,12 +1,14 @@
 SECTIONS
 {
   .text : {
+    *(.text.bcm_support)
     BORINGSSL_bcm_text_start = .;
     *(.text)
     *(.text.unlikely.*)
     BORINGSSL_bcm_text_end = .;
   }
   .rodata : {
+    *(.rodata.bcm_support)
     BORINGSSL_bcm_rodata_start = .;
     *(.rodata)
     *(.rodata.*)
diff --git a/crypto/fipsmodule/fips_shared_support.c b/crypto/fipsmodule/fips_shared_support.c
index a50c8b7efa..e686c39490 100644
--- a/crypto/fipsmodule/fips_shared_support.c
+++ b/crypto/fipsmodule/fips_shared_support.c
@@ -20,11 +20,13 @@
 // that must be replaced with the real value during the build process. This
 // value need only be distinct, i.e. so that we can safely search-and-replace it
 // in an object file.
+__attribute__((section(".rodata.bcm_support")))
 const uint8_t BORINGSSL_bcm_text_hash[32] = {
     0xae, 0x2c, 0xea, 0x2a, 0xbd, 0xa6, 0xf3, 0xec, 0x97, 0x7f, 0x9b,
     0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f,
     0x6b, 0x6f, 0xde, 0x52, 0xcd, 0xe2, 0xcd, 0xff, 0x31, 0x80,
 };
 
+__attribute__((section(".text.bcm_support")))
 const uint8_t *get_asdasd(void) { return BORINGSSL_bcm_text_hash; }
 #endif  // FIPS && SHARED_LIBRARY
diff --git a/crypto/fipsmodule/gcc_fips_shared.lds b/crypto/fipsmodule/gcc_fips_shared.lds
index ed986c077b..b6f1a89220 100644
--- a/crypto/fipsmodule/gcc_fips_shared.lds
+++ b/crypto/fipsmodule/gcc_fips_shared.lds
@@ -1,6 +1,7 @@
 SECTIONS
 {
   .text : {
+    *(.text.bcm_support)
     BORINGSSL_bcm_text_start = .;
     *(.text)
     /* gcc puts some code in sections named ".text.unlikely", ".text.exit" and ".text.startup". */
@@ -10,6 +11,7 @@ SECTIONS
     BORINGSSL_bcm_text_end = .;
   }
   .rodata : {
+    *(.rodata.bcm_support)
     BORINGSSL_bcm_rodata_start = .;
     *(.rodata)
     *(.rodata.*)

From ec330127dd1f719a4f463c1bdf68132e0d829fa1 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 17 Oct 2024 16:26:55 -0700
Subject: [PATCH 13/20] try to prevent LTO...

---
 crypto/fipsmodule/bcm.c                 | 4 +++-
 crypto/fipsmodule/fips_shared_support.c | 3 ++-
 crypto/fipsmodule/fips_support.h        | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 3198f95850..7924df6877 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -300,6 +300,7 @@ int BORINGSSL_integrity_test(void) {
   assert_within(start, function_entry_ptr(EVP_AEAD_CTX_seal), "EVP_AEAD_CTX_seal", end);
   assert_not_within(start, function_entry_ptr(OPENSSL_cleanse), "OPENSSL_cleanse", end);
   assert_not_within(start, function_entry_ptr(CRYPTO_chacha_20), "CRYPTO_chacha_20", end);
+  assert_not_within(start, function_entry_ptr(get_asdasd), "get_asdasd", end);
 #if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
   assert_not_within(start, OPENSSL_ia32cap_P, "OPENSSL_ia32cap_P", end);
 #elif defined(OPENSSL_AARCH64)
@@ -373,7 +374,8 @@ int BORINGSSL_integrity_test(void) {
   }
   HMAC_CTX_cleanse(&hmac_ctx); // FIPS 140-3, AS05.10.
 
-  const uint8_t *expected = get_asdasd();
+  uint8_t expected[32] = {0};
+  get_asdasd(expected);
 
   if (!check_test(expected, result, sizeof(result), "FIPS integrity test")) {
 #if !defined(BORINGSSL_FIPS_BREAK_TESTS)
diff --git a/crypto/fipsmodule/fips_shared_support.c b/crypto/fipsmodule/fips_shared_support.c
index e686c39490..970f476ed8 100644
--- a/crypto/fipsmodule/fips_shared_support.c
+++ b/crypto/fipsmodule/fips_shared_support.c
@@ -12,6 +12,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
+#include <string.h>
 
 #include "fips_support.h"
 
@@ -28,5 +29,5 @@ const uint8_t BORINGSSL_bcm_text_hash[32] = {
 };
 
 __attribute__((section(".text.bcm_support")))
-const uint8_t *get_asdasd(void) { return BORINGSSL_bcm_text_hash; }
+void get_asdasd(uint8_t *out) { memcpy(out, BORINGSSL_bcm_text_hash, 32); }
 #endif  // FIPS && SHARED_LIBRARY
diff --git a/crypto/fipsmodule/fips_support.h b/crypto/fipsmodule/fips_support.h
index 3a6e0d55bb..cc07409dd5 100644
--- a/crypto/fipsmodule/fips_support.h
+++ b/crypto/fipsmodule/fips_support.h
@@ -3,6 +3,6 @@
 
 #include <stdint.h>
 
-const uint8_t *get_asdasd(void);
+void get_asdasd(uint8_t *out);
 
 #endif

From ef9fc81a45dbfbea1cebf33ceb5277fe3682e136 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Fri, 18 Oct 2024 10:01:43 -0700
Subject: [PATCH 14/20] qweqwe

---
 crypto/fipsmodule/bcm.c                 | 1 -
 crypto/fipsmodule/fips_shared_support.c | 7 ++-----
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 7924df6877..010c7d2dd6 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -300,7 +300,6 @@ int BORINGSSL_integrity_test(void) {
   assert_within(start, function_entry_ptr(EVP_AEAD_CTX_seal), "EVP_AEAD_CTX_seal", end);
   assert_not_within(start, function_entry_ptr(OPENSSL_cleanse), "OPENSSL_cleanse", end);
   assert_not_within(start, function_entry_ptr(CRYPTO_chacha_20), "CRYPTO_chacha_20", end);
-  assert_not_within(start, function_entry_ptr(get_asdasd), "get_asdasd", end);
 #if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
   assert_not_within(start, OPENSSL_ia32cap_P, "OPENSSL_ia32cap_P", end);
 #elif defined(OPENSSL_AARCH64)
diff --git a/crypto/fipsmodule/fips_shared_support.c b/crypto/fipsmodule/fips_shared_support.c
index 970f476ed8..5ba80c3db2 100644
--- a/crypto/fipsmodule/fips_shared_support.c
+++ b/crypto/fipsmodule/fips_shared_support.c
@@ -12,8 +12,6 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
-#include <string.h>
-
 #include "fips_support.h"
 
 #if defined(BORINGSSL_FIPS)
@@ -21,13 +19,12 @@
 // that must be replaced with the real value during the build process. This
 // value need only be distinct, i.e. so that we can safely search-and-replace it
 // in an object file.
-__attribute__((section(".rodata.bcm_support")))
-const uint8_t BORINGSSL_bcm_text_hash[32] = {
+volatile uint8_t asdasd[32] = {
     0xae, 0x2c, 0xea, 0x2a, 0xbd, 0xa6, 0xf3, 0xec, 0x97, 0x7f, 0x9b,
     0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f,
     0x6b, 0x6f, 0xde, 0x52, 0xcd, 0xe2, 0xcd, 0xff, 0x31, 0x80,
 };
 
 __attribute__((section(".text.bcm_support")))
-void get_asdasd(uint8_t *out) { memcpy(out, BORINGSSL_bcm_text_hash, 32); }
+void get_asdasd(uint8_t *out) { for (int i = 0; i < 32; i++) out[i] = asdasd[i]; }
 #endif  // FIPS && SHARED_LIBRARY

From 920796a0c696a94a1a701ba31cf9491b16bf0c2a Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Mon, 21 Oct 2024 07:24:40 -0700
Subject: [PATCH 15/20] asdad

---
 crypto/fipsmodule/CMakeLists.txt        | 6 +++---
 crypto/fipsmodule/bcm.c                 | 4 ++--
 crypto/fipsmodule/fips_shared.lds       | 1 -
 crypto/fipsmodule/fips_shared_support.c | 7 ++++---
 crypto/fipsmodule/fips_support.h        | 1 -
 crypto/fipsmodule/gcc_fips_shared.lds   | 1 -
 6 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/crypto/fipsmodule/CMakeLists.txt b/crypto/fipsmodule/CMakeLists.txt
index 6b2e56ca27..91dcede490 100644
--- a/crypto/fipsmodule/CMakeLists.txt
+++ b/crypto/fipsmodule/CMakeLists.txt
@@ -546,12 +546,12 @@ elseif(FIPS_SHARED)
   else()
     set(BCM_NAME bcm.o)
     # fips_shared.lds does not have 'clang' prefix because we want to keep merging any changes from upstream.
-    # set(FIPS_CUSTOM_LINKER_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/fips_shared.lds")
-    # if (GCC)
+    set(FIPS_CUSTOM_LINKER_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/fips_shared.lds")
+    if (GCC)
       # gcc puts some code in sections named ".text.unlikely", ".text.exit" and ".text.startup".
       # so we have a separate linker script for gcc.
       set(FIPS_CUSTOM_LINKER_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/gcc_fips_shared.lds")
-    # endif()
+    endif()
 
     add_custom_command(
       OUTPUT ${BCM_NAME}
diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 010c7d2dd6..9607edfb6d 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -177,6 +177,7 @@ static const void* function_entry_ptr(const void* func_sym) {
 // the location of the integrity hash, respectively.
 extern const uint8_t BORINGSSL_bcm_text_start[];
 extern const uint8_t BORINGSSL_bcm_text_end[];
+extern const uint8_t BORINGSSL_bcm_text_hash[];
 #if defined(BORINGSSL_SHARED_LIBRARY)
 extern const uint8_t BORINGSSL_bcm_rodata_start[];
 extern const uint8_t BORINGSSL_bcm_rodata_end[];
@@ -373,8 +374,7 @@ int BORINGSSL_integrity_test(void) {
   }
   HMAC_CTX_cleanse(&hmac_ctx); // FIPS 140-3, AS05.10.
 
-  uint8_t expected[32] = {0};
-  get_asdasd(expected);
+  const uint8_t *expected = BORINGSSL_bcm_text_hash;
 
   if (!check_test(expected, result, sizeof(result), "FIPS integrity test")) {
 #if !defined(BORINGSSL_FIPS_BREAK_TESTS)
diff --git a/crypto/fipsmodule/fips_shared.lds b/crypto/fipsmodule/fips_shared.lds
index 734729f9f0..6e2b8f5e13 100644
--- a/crypto/fipsmodule/fips_shared.lds
+++ b/crypto/fipsmodule/fips_shared.lds
@@ -1,7 +1,6 @@
 SECTIONS
 {
   .text : {
-    *(.text.bcm_support)
     BORINGSSL_bcm_text_start = .;
     *(.text)
     *(.text.unlikely.*)
diff --git a/crypto/fipsmodule/fips_shared_support.c b/crypto/fipsmodule/fips_shared_support.c
index 5ba80c3db2..d27ffe3295 100644
--- a/crypto/fipsmodule/fips_shared_support.c
+++ b/crypto/fipsmodule/fips_shared_support.c
@@ -19,12 +19,13 @@
 // that must be replaced with the real value during the build process. This
 // value need only be distinct, i.e. so that we can safely search-and-replace it
 // in an object file.
-volatile uint8_t asdasd[32] = {
+//
+const uint8_t BORINGSSL_bcm_text_hash[32];
+__attribute__((section(".rodata.bcm_support")))
+const uint8_t BORINGSSL_bcm_text_hash[32] = {
     0xae, 0x2c, 0xea, 0x2a, 0xbd, 0xa6, 0xf3, 0xec, 0x97, 0x7f, 0x9b,
     0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f,
     0x6b, 0x6f, 0xde, 0x52, 0xcd, 0xe2, 0xcd, 0xff, 0x31, 0x80,
 };
 
-__attribute__((section(".text.bcm_support")))
-void get_asdasd(uint8_t *out) { for (int i = 0; i < 32; i++) out[i] = asdasd[i]; }
 #endif  // FIPS && SHARED_LIBRARY
diff --git a/crypto/fipsmodule/fips_support.h b/crypto/fipsmodule/fips_support.h
index cc07409dd5..ddb8a62b1c 100644
--- a/crypto/fipsmodule/fips_support.h
+++ b/crypto/fipsmodule/fips_support.h
@@ -3,6 +3,5 @@
 
 #include <stdint.h>
 
-void get_asdasd(uint8_t *out);
 
 #endif
diff --git a/crypto/fipsmodule/gcc_fips_shared.lds b/crypto/fipsmodule/gcc_fips_shared.lds
index b6f1a89220..291c22a947 100644
--- a/crypto/fipsmodule/gcc_fips_shared.lds
+++ b/crypto/fipsmodule/gcc_fips_shared.lds
@@ -1,7 +1,6 @@
 SECTIONS
 {
   .text : {
-    *(.text.bcm_support)
     BORINGSSL_bcm_text_start = .;
     *(.text)
     /* gcc puts some code in sections named ".text.unlikely", ".text.exit" and ".text.startup". */

From 30afa89c480e109e6cc3cf6553915c88566a74d8 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Mon, 21 Oct 2024 07:30:46 -0700
Subject: [PATCH 16/20] only linux

---
 crypto/fipsmodule/fips_shared_support.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/fipsmodule/fips_shared_support.c b/crypto/fipsmodule/fips_shared_support.c
index d27ffe3295..ea2c530ef2 100644
--- a/crypto/fipsmodule/fips_shared_support.c
+++ b/crypto/fipsmodule/fips_shared_support.c
@@ -21,7 +21,9 @@
 // in an object file.
 //
 const uint8_t BORINGSSL_bcm_text_hash[32];
+#if defined(OPENSSL_LINUX)
 __attribute__((section(".rodata.bcm_support")))
+#endif
 const uint8_t BORINGSSL_bcm_text_hash[32] = {
     0xae, 0x2c, 0xea, 0x2a, 0xbd, 0xa6, 0xf3, 0xec, 0x97, 0x7f, 0x9b,
     0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f,

From 7d9176be3b468e4f2bb86ba20b7d6081641bfd3b Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Mon, 21 Oct 2024 09:17:38 -0700
Subject: [PATCH 17/20] last try

---
 crypto/CMakeLists.txt | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 4579f11878..900a6c29f4 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -622,31 +622,33 @@ if(FIPS_SHARED OR FIPS_DELOCATE)
   # hash value. For now we support the FIPS build only on Linux, macOS, iOS, and Windows.
     # On Windows we use capture_hash.go to capture the computed integrity value that bcm.o prints to generate the
     # correct value in generated_fips_shared_support.c. See FIPS.md for a full explanation of the process
-    build_libcrypto(precrypto $<TARGET_OBJECTS:fipsmodule>)
+    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
     add_executable(fips_empty_main fipsmodule/fips_empty_main.c)
-    target_link_libraries(fips_empty_main PUBLIC precrypto)
+    target_link_libraries(fips_empty_main PUBLIC crypto)
     target_include_directories(fips_empty_main PRIVATE ${PROJECT_SOURCE_DIR}/include)
     target_include_directories(fips_empty_main BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
 
-    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
+    #    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
 
     add_executable(inject_hash ${PROJECT_SOURCE_DIR}/util/fipstools/inject_hash/inject_hash.cpp)
+    if (APPLE)
     add_custom_command(
-        TARGET crypto POST_BUILD
+        TARGET fips_empty_main POST_BUILD
+        COMMAND $<TARGET_FILE:inject_hash> $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
+        COMMAND codesign -s - $<TARGET_FILE:crypto>
+        WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+        DEPENDS inject_hash fips_empty_main
+        COMMENT "Injecting FIPS hash"
+        )
+    else()
+    add_custom_command(
+        TARGET fips_empty_main POST_BUILD
         COMMAND $<TARGET_FILE:inject_hash> $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
         WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
         DEPENDS inject_hash fips_empty_main
         COMMENT "Injecting FIPS hash"
         )
-
-    if (APPLE)
-        add_custom_command(
-            TARGET crypto POST_BUILD
-            COMMAND codesign -s - $<TARGET_FILE:crypto>
-            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-            DEPENDS inject_hash fips_empty_main
-            )
     endif()
 else()
   build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)

From 08d2360b227f053844cafefa49b4aac3a54380cd Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Mon, 21 Oct 2024 14:21:53 -0700
Subject: [PATCH 18/20] a new dependency

---
 crypto/CMakeLists.txt | 12 ++++++++++++
 fuzz/CMakeLists.txt   |  3 +++
 ssl/CMakeLists.txt    |  3 +++
 tool/CMakeLists.txt   |  5 +++++
 4 files changed, 23 insertions(+)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 900a6c29f4..24aa203932 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -706,6 +706,9 @@ if(BUILD_TESTING)
   set_test_location(${RANDOM_TEST_EXEC})
 
   add_dependencies(${RANDOM_TEST_EXEC} boringssl_prefix_symbols)
+  if(FIPS)
+    add_dependencies(${RANDOM_TEST_EXEC} fips_empty_main)
+  endif()
   target_link_libraries(${RANDOM_TEST_EXEC} test_support_lib boringssl_gtest crypto)
   target_include_directories(${RANDOM_TEST_EXEC} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
@@ -804,6 +807,9 @@ if(BUILD_TESTING)
   set_test_location(${CRYPTO_TEST_EXEC})
 
   add_dependencies(${CRYPTO_TEST_EXEC} boringssl_prefix_symbols)
+  if(FIPS)
+  add_dependencies(${CRYPTO_TEST_EXEC} fips_empty_main)
+  endif()
   target_link_libraries(${CRYPTO_TEST_EXEC} boringssl_gtest_main)
   target_include_directories(${CRYPTO_TEST_EXEC} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
   if(MSVC)
@@ -817,6 +823,9 @@ if(BUILD_TESTING)
 
   add_executable(${DYNAMIC_LOADING_TEST_EXEC} dynamic_loading_test.c)
   add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} crypto)
+  if(FIPS)
+  add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} fips_empty_main)
+  endif()
   set_test_location(${DYNAMIC_LOADING_TEST_EXEC})
 
   add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} boringssl_prefix_symbols)
@@ -842,6 +851,9 @@ if(BUILD_TESTING)
   message(STATUS "Generating test executable ${RWLOCK_STATIC_INIT_TEST_EXEC}.")
   add_executable(${RWLOCK_STATIC_INIT_TEST_EXEC} rwlock_static_init.cc)
   add_dependencies(${RWLOCK_STATIC_INIT_TEST_EXEC} crypto)
+  if(FIPS)
+  add_dependencies(${RWLOCK_STATIC_INIT_TEST_EXEC} fips_empty_main)
+  endif()
   set_test_location(${RWLOCK_STATIC_INIT_TEST_EXEC})
 
   target_link_libraries(${RWLOCK_STATIC_INIT_TEST_EXEC} crypto)
diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt
index f10022ad78..50bf094032 100644
--- a/fuzz/CMakeLists.txt
+++ b/fuzz/CMakeLists.txt
@@ -5,6 +5,9 @@ macro(fuzzer name)
   add_executable(${name} ${name}.cc)
   target_compile_options(${name} PRIVATE "-Wno-missing-prototypes")
   target_link_libraries(${name} crypto ${ARGN})
+  if(FIPS)
+  add_dependencies(${name} fips_empty_main)
+  endif()
   target_include_directories(${name} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
   if(LIBFUZZER_FROM_DEPS)
     set_target_properties(${name} PROPERTIES LINK_FLAGS "-fsanitize=fuzzer-no-link")
diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt
index 2e90a885fa..d1ce9905f1 100644
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -46,6 +46,9 @@ add_library(
 target_compile_definitions(ssl PRIVATE BORINGSSL_IMPLEMENTATION)
 
 target_link_libraries(ssl crypto)
+if(FIPS)
+add_dependencies(ssl fips_empty_main)
+endif()
 
 target_include_directories(ssl BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
diff --git a/tool/CMakeLists.txt b/tool/CMakeLists.txt
index 547bf6b710..23bcab562b 100644
--- a/tool/CMakeLists.txt
+++ b/tool/CMakeLists.txt
@@ -23,10 +23,15 @@ add_executable(
 target_include_directories(bssl PUBLIC ${PROJECT_SOURCE_DIR}/include)
 target_compile_options(bssl PUBLIC -DINTERNAL_TOOL)
 
+if(FIPS)
+    add_dependencies(bssl fips_empty_main)
+endif()
+
 if(WIN32)
   target_link_libraries(bssl ws2_32)
 endif()
 
+
 if(APPLE OR WIN32 OR ANDROID)
   target_link_libraries(bssl ssl crypto)
   set(LIBRT_FLAG "")

From 5c783ac837cc41f129cb30cbce933d730f11263b Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Mon, 21 Oct 2024 14:46:51 -0700
Subject: [PATCH 19/20] Revert "a new dependency"

This reverts commit 08d2360b227f053844cafefa49b4aac3a54380cd.
---
 crypto/CMakeLists.txt | 12 ------------
 fuzz/CMakeLists.txt   |  3 ---
 ssl/CMakeLists.txt    |  3 ---
 tool/CMakeLists.txt   |  5 -----
 4 files changed, 23 deletions(-)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 24aa203932..900a6c29f4 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -706,9 +706,6 @@ if(BUILD_TESTING)
   set_test_location(${RANDOM_TEST_EXEC})
 
   add_dependencies(${RANDOM_TEST_EXEC} boringssl_prefix_symbols)
-  if(FIPS)
-    add_dependencies(${RANDOM_TEST_EXEC} fips_empty_main)
-  endif()
   target_link_libraries(${RANDOM_TEST_EXEC} test_support_lib boringssl_gtest crypto)
   target_include_directories(${RANDOM_TEST_EXEC} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
@@ -807,9 +804,6 @@ if(BUILD_TESTING)
   set_test_location(${CRYPTO_TEST_EXEC})
 
   add_dependencies(${CRYPTO_TEST_EXEC} boringssl_prefix_symbols)
-  if(FIPS)
-  add_dependencies(${CRYPTO_TEST_EXEC} fips_empty_main)
-  endif()
   target_link_libraries(${CRYPTO_TEST_EXEC} boringssl_gtest_main)
   target_include_directories(${CRYPTO_TEST_EXEC} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
   if(MSVC)
@@ -823,9 +817,6 @@ if(BUILD_TESTING)
 
   add_executable(${DYNAMIC_LOADING_TEST_EXEC} dynamic_loading_test.c)
   add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} crypto)
-  if(FIPS)
-  add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} fips_empty_main)
-  endif()
   set_test_location(${DYNAMIC_LOADING_TEST_EXEC})
 
   add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} boringssl_prefix_symbols)
@@ -851,9 +842,6 @@ if(BUILD_TESTING)
   message(STATUS "Generating test executable ${RWLOCK_STATIC_INIT_TEST_EXEC}.")
   add_executable(${RWLOCK_STATIC_INIT_TEST_EXEC} rwlock_static_init.cc)
   add_dependencies(${RWLOCK_STATIC_INIT_TEST_EXEC} crypto)
-  if(FIPS)
-  add_dependencies(${RWLOCK_STATIC_INIT_TEST_EXEC} fips_empty_main)
-  endif()
   set_test_location(${RWLOCK_STATIC_INIT_TEST_EXEC})
 
   target_link_libraries(${RWLOCK_STATIC_INIT_TEST_EXEC} crypto)
diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt
index 50bf094032..f10022ad78 100644
--- a/fuzz/CMakeLists.txt
+++ b/fuzz/CMakeLists.txt
@@ -5,9 +5,6 @@ macro(fuzzer name)
   add_executable(${name} ${name}.cc)
   target_compile_options(${name} PRIVATE "-Wno-missing-prototypes")
   target_link_libraries(${name} crypto ${ARGN})
-  if(FIPS)
-  add_dependencies(${name} fips_empty_main)
-  endif()
   target_include_directories(${name} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
   if(LIBFUZZER_FROM_DEPS)
     set_target_properties(${name} PROPERTIES LINK_FLAGS "-fsanitize=fuzzer-no-link")
diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt
index d1ce9905f1..2e90a885fa 100644
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -46,9 +46,6 @@ add_library(
 target_compile_definitions(ssl PRIVATE BORINGSSL_IMPLEMENTATION)
 
 target_link_libraries(ssl crypto)
-if(FIPS)
-add_dependencies(ssl fips_empty_main)
-endif()
 
 target_include_directories(ssl BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
diff --git a/tool/CMakeLists.txt b/tool/CMakeLists.txt
index 23bcab562b..547bf6b710 100644
--- a/tool/CMakeLists.txt
+++ b/tool/CMakeLists.txt
@@ -23,15 +23,10 @@ add_executable(
 target_include_directories(bssl PUBLIC ${PROJECT_SOURCE_DIR}/include)
 target_compile_options(bssl PUBLIC -DINTERNAL_TOOL)
 
-if(FIPS)
-    add_dependencies(bssl fips_empty_main)
-endif()
-
 if(WIN32)
   target_link_libraries(bssl ws2_32)
 endif()
 
-
 if(APPLE OR WIN32 OR ANDROID)
   target_link_libraries(bssl ssl crypto)
   set(LIBRT_FLAG "")

From 28844e488d065a5108adb5fd61852f20cb6a7c72 Mon Sep 17 00:00:00 2001
From: dkostic <dkostic@amazon.com>
Date: Thu, 24 Oct 2024 14:44:19 -0700
Subject: [PATCH 20/20] qweqewqwe

---
 crypto/CMakeLists.txt                      | 12 +++++-------
 util/fipstools/inject_hash/inject_hash.cpp |  2 +-
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 900a6c29f4..29bb731e78 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -622,19 +622,17 @@ if(FIPS_SHARED OR FIPS_DELOCATE)
   # hash value. For now we support the FIPS build only on Linux, macOS, iOS, and Windows.
     # On Windows we use capture_hash.go to capture the computed integrity value that bcm.o prints to generate the
     # correct value in generated_fips_shared_support.c. See FIPS.md for a full explanation of the process
-    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
+    build_libcrypto(helpercrypto $<TARGET_OBJECTS:fipsmodule>)
     add_executable(fips_empty_main fipsmodule/fips_empty_main.c)
-    target_link_libraries(fips_empty_main PUBLIC crypto)
+    target_link_libraries(fips_empty_main PUBLIC helpercrypto)
     target_include_directories(fips_empty_main PRIVATE ${PROJECT_SOURCE_DIR}/include)
     target_include_directories(fips_empty_main BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
 
-
-    #    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
-
+    build_libcrypto(crypto $<TARGET_OBJECTS:fipsmodule>)
     add_executable(inject_hash ${PROJECT_SOURCE_DIR}/util/fipstools/inject_hash/inject_hash.cpp)
     if (APPLE)
     add_custom_command(
-        TARGET fips_empty_main POST_BUILD
+        TARGET crypto POST_BUILD
         COMMAND $<TARGET_FILE:inject_hash> $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
         COMMAND codesign -s - $<TARGET_FILE:crypto>
         WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
@@ -643,7 +641,7 @@ if(FIPS_SHARED OR FIPS_DELOCATE)
         )
     else()
     add_custom_command(
-        TARGET fips_empty_main POST_BUILD
+        TARGET crypto POST_BUILD
         COMMAND $<TARGET_FILE:inject_hash> $<TARGET_FILE:crypto> $<TARGET_FILE:fips_empty_main>
         WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
         DEPENDS inject_hash fips_empty_main
diff --git a/util/fipstools/inject_hash/inject_hash.cpp b/util/fipstools/inject_hash/inject_hash.cpp
index 8e2bcbc2d7..eab20e83a6 100644
--- a/util/fipstools/inject_hash/inject_hash.cpp
+++ b/util/fipstools/inject_hash/inject_hash.cpp
@@ -54,7 +54,7 @@ int main(int argc, char* argv[]) {
 #if defined(_WIN32)
     std::unique_ptr<FILE, decltype(&_pclose)> pipe(_popen(command.c_str(), "r"), _pclose);
 #else
-    std::unique_ptr<FILE, decltype(&pclose)> pipe(popen(command.c_str(), "r"), pclose);
+    std::unique_ptr<FILE, int (*)(FILE*)> pipe(popen(command.c_str(), "r"), pclose);
 #endif
     if (!pipe) {
         std::cerr << "popen() failed!" << std::endl;