Add a guarded .note.GNU-stack section to crypto assembly files.

Add a .note.GNU-stack section to avoid ending up with an executable stack
on toolchains that believe we should have an executable stack by default.

Reported by ruuda on Github.

Discussed with tb@

9 files changed, 45 insertions, 9 deletions

diff --git a/src/lib/libcrypto/md5/md5_amd64_generic.S b/src/lib/libcrypto/md5/md5_amd64_generic.S
index 35e6fcdada..02f6ebdbcc 100644
--- a/src/lib/libcrypto/md5/md5_amd64_generic.S
+++ b/src/lib/libcrypto/md5/md5_amd64_generic.S
@@ -1,4 +1,4 @@
-/*      $OpenBSD: md5_amd64_generic.S,v 1.2 2026/03/28 13:11:28 jsing Exp $ */
+/*      $OpenBSD: md5_amd64_generic.S,v 1.3 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2025 Joel Sing <jsing@openbsd.org>
  *
@@ -231,3 +231,7 @@ md5_block_data_order:
         popq    %rbx
 
         ret
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
index 9f786960c2..913a7b8fc1 100644
--- a/src/lib/libcrypto/sha/sha1_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_aarch64_ce.S,v 1.9 2026/05/09 07:02:29 jsing Exp $ */
+/* $OpenBSD: sha1_aarch64_ce.S,v 1.10 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -215,3 +215,7 @@ CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha1_block_ce):
         str     hc1s, [ctx, #(4*4)]
 
         ret
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha1_amd64_generic.S b/src/lib/libcrypto/sha/sha1_amd64_generic.S
index a0473bdd00..c890d0d7fe 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_generic.S,v 1.7 2026/05/07 15:50:47 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_generic.S,v 1.8 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -308,3 +308,7 @@ CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha1_block_generic):
         popq    %rbx
 
         ret
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha1_amd64_shani.S b/src/lib/libcrypto/sha/sha1_amd64_shani.S
index c397fa41c9..afba0b9f14 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_shani.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_shani.S,v 1.8 2026/05/09 07:02:29 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_shani.S,v 1.9 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -163,3 +163,7 @@ CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha1_block_shani):
 CRYPTO_ASSEMBLY_OBJECT_START(shufmask):
 .octa   0x000102030405060708090a0b0c0d0e0f
 CRYPTO_ASSEMBLY_OBJECT_END(shufmask)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha256_aarch64_ce.S b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
index 991f1316c0..75352b4f7a 100644
--- a/src/lib/libcrypto/sha/sha256_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_aarch64_ce.S,v 1.10 2026/05/07 15:50:47 jsing Exp $ */
+/* $OpenBSD: sha256_aarch64_ce.S,v 1.11 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -196,3 +196,7 @@ CRYPTO_ASSEMBLY_OBJECT_START(K256):
 .long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
 .long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
 CRYPTO_ASSEMBLY_OBJECT_END(K256)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha256_amd64_generic.S b/src/lib/libcrypto/sha/sha256_amd64_generic.S
index 0d0e2b75d2..0d18e95d04 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_amd64_generic.S,v 1.9 2026/05/07 15:50:47 jsing Exp $ */
+/* $OpenBSD: sha256_amd64_generic.S,v 1.10 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -296,3 +296,7 @@ CRYPTO_ASSEMBLY_OBJECT_START(K256):
 .long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
 .long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
 CRYPTO_ASSEMBLY_OBJECT_END(K256)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha256_amd64_shani.S b/src/lib/libcrypto/sha/sha256_amd64_shani.S
index 91f22e44d6..e51a168062 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_shani.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_amd64_shani.S,v 1.7 2026/05/07 15:50:47 jsing Exp $ */
+/* $OpenBSD: sha256_amd64_shani.S,v 1.8 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -201,3 +201,7 @@ CRYPTO_ASSEMBLY_OBJECT_START(K256):
 .long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
 .long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
 CRYPTO_ASSEMBLY_OBJECT_END(K256)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha512_aarch64_ce.S b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
index 77bd44593d..8c88696e4a 100644
--- a/src/lib/libcrypto/sha/sha512_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha512_aarch64_ce.S,v 1.8 2026/05/07 15:50:47 jsing Exp $ */
+/* $OpenBSD: sha512_aarch64_ce.S,v 1.9 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -322,3 +322,7 @@ CRYPTO_ASSEMBLY_OBJECT_START(K512):
 .quad   0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
 .quad   0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817
 CRYPTO_ASSEMBLY_OBJECT_END(K512)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha512_amd64_generic.S b/src/lib/libcrypto/sha/sha512_amd64_generic.S
index 61028c0a0b..2e862df5ef 100644
--- a/src/lib/libcrypto/sha/sha512_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha512_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha512_amd64_generic.S,v 1.7 2026/05/07 15:50:47 jsing Exp $ */
+/* $OpenBSD: sha512_amd64_generic.S,v 1.8 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -301,3 +301,7 @@ CRYPTO_ASSEMBLY_OBJECT_START(K512):
 .quad   0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
 .quad   0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817
 CRYPTO_ASSEMBLY_OBJECT_END(K512)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif