From ccc4eae3de33ef320762657c4be6c9dfd9c2de82 Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Thu, 7 May 2026 15:38:03 +0000
Subject: Use a define based instruction separator in SHA assembly.

Unfortunately, not all assemblers use the same instruction separator.
In particular, LLVM on macOS uses %% as an instruction separator, while
most other assemblers use a semi-colon.

ok kenjiro@ tb@
---
 src/lib/libcrypto/crypto_assembly.h          |   8 ++-
 src/lib/libcrypto/sha/sha1_aarch64_ce.S      |  32 +++++----
 src/lib/libcrypto/sha/sha1_amd64_generic.S   |  70 +++++++++---------
 src/lib/libcrypto/sha/sha1_amd64_shani.S     |  18 ++---
 src/lib/libcrypto/sha/sha256_aarch64_ce.S    |  16 +++--
 src/lib/libcrypto/sha/sha256_amd64_generic.S | 104 ++++++++++++++-------------
 src/lib/libcrypto/sha/sha256_amd64_shani.S   |  28 ++++----
 src/lib/libcrypto/sha/sha512_aarch64_ce.S    |  30 ++++----
 src/lib/libcrypto/sha/sha512_amd64_generic.S | 104 ++++++++++++++-------------
 9 files changed, 219 insertions(+), 191 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libcrypto/crypto_assembly.h b/src/lib/libcrypto/crypto_assembly.h
index 0ae78a81ab..8f53ea51b6 100644
--- a/src/lib/libcrypto/crypto_assembly.h
+++ b/src/lib/libcrypto/crypto_assembly.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: crypto_assembly.h,v 1.1 2026/03/28 13:09:55 jsing Exp $ */
+/*	$OpenBSD: crypto_assembly.h,v 1.2 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
  *
@@ -27,4 +27,10 @@
 #endif
 #endif
 
+#if defined(__APPLE__) && defined(__aarch64__)
+#define CRYPTO_ASSEMBLY_SEPARATOR		%%
+#else
+#define CRYPTO_ASSEMBLY_SEPARATOR		;
+#endif
+
 #endif
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
index 641500a1e5..e6b1a33018 100644
--- a/src/lib/libcrypto/sha/sha1_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_aarch64_ce.S,v 1.5 2026/01/25 08:22:17 jsing Exp $ */
+/* $OpenBSD: sha1_aarch64_ce.S,v 1.6 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -15,6 +15,10 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include "crypto_assembly.h"
+
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-1 implementation using the ARM Cryptographic Extension (CE).
  *
@@ -65,7 +69,7 @@
  * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1).
  */
 #define sha1_message_schedule_update(m0, m1, m2, m3) \
-	sha1su0 m0.4s, m1.4s, m2.4s;					\
+	sha1su0 m0.4s, m1.4s, m2.4s					_SEP \
 	sha1su1 m0.4s, m3.4s
 
 /*
@@ -75,27 +79,27 @@
  */
 
 #define sha1_round1(h0, h1, w, k) \
-	add	tmp0.4s, w.4s, k.4s;		/* Tt = Wt + Kt */	\
-	mov	tmp1, h0.s[0];						\
-	sha1c	h0##q, h1##s, tmp0.4s;					\
+	add	tmp0.4s, w.4s, k.4s		/* Tt = Wt + Kt */	_SEP \
+	mov	tmp1, h0.s[0]						_SEP \
+	sha1c	h0##q, h1##s, tmp0.4s					_SEP \
 	sha1h	h1##s, tmp1
 
 #define sha1_round2(h0, h1, w, k) \
-	add	tmp0.4s, w.4s, k.4s;		/* Tt = Wt + Kt */	\
-	mov	tmp1, h0.s[0];						\
-	sha1p	h0##q, h1##s, tmp0.4s;					\
+	add	tmp0.4s, w.4s, k.4s		/* Tt = Wt + Kt */	_SEP \
+	mov	tmp1, h0.s[0]						_SEP \
+	sha1p	h0##q, h1##s, tmp0.4s					_SEP \
 	sha1h	h1##s, tmp1
 
 #define sha1_round3(h0, h1, w, k) \
-	add	tmp0.4s, w.4s, k.4s;		/* Tt = Wt + Kt */	\
-	mov	tmp1, h0.s[0];						\
-	sha1m	h0##q, h1##s, tmp0.4s;					\
+	add	tmp0.4s, w.4s, k.4s		/* Tt = Wt + Kt */	_SEP \
+	mov	tmp1, h0.s[0]						_SEP \
+	sha1m	h0##q, h1##s, tmp0.4s					_SEP \
 	sha1h	h1##s, tmp1
 
 #define sha1_round4(h0, h1, w, k) \
-	add	tmp0.4s, w.4s, k.4s;		/* Tt = Wt + Kt */	\
-	mov	tmp1, h0.s[0];						\
-	sha1p	h0##q, h1##s, tmp0.4s;					\
+	add	tmp0.4s, w.4s, k.4s		/* Tt = Wt + Kt */	_SEP \
+	mov	tmp1, h0.s[0]						_SEP \
+	sha1p	h0##q, h1##s, tmp0.4s					_SEP \
 	sha1h	h1##s, tmp1
 
 .arch	armv8-a+sha2
diff --git a/src/lib/libcrypto/sha/sha1_amd64_generic.S b/src/lib/libcrypto/sha/sha1_amd64_generic.S
index 57709c0a1f..a44bd2fdec 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_generic.S,v 1.5 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_generic.S,v 1.6 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 #define	ctx		%rdi
 #define	in		%rsi
 #define	num		%rdx
@@ -40,8 +42,8 @@
  *  Wt = Mt
  */
 #define sha1_message_schedule_load(idx, m, w, wt) \
-	movl	((idx&0xf)*4)(m), wt;				\
-	bswapl	wt;						\
+	movl	((idx&0xf)*4)(m), wt				_SEP \
+	bswapl	wt						_SEP \
 	movl	wt, ((idx&0xf)*4)(w)
 
 /*
@@ -50,11 +52,11 @@
  *  W0 = rol(W13 ^ W8 ^ W2 ^ W0, 1)
  */
 #define sha1_message_schedule_update(idx, w, wt) \
-	movl	(((idx-3)&0xf)*4)(w), wt;	/* W13 */	\
-	xorl	(((idx-8)&0xf)*4)(w), wt;	/* W8 */	\
-	xorl	(((idx-14)&0xf)*4)(w), wt;	/* W2 */	\
-	xorl	(((idx)&0xf)*4)(w), wt;		/* W0 */	\
-	roll	$1, wt;						\
+	movl	(((idx-3)&0xf)*4)(w), wt	/* W13 */	_SEP \
+	xorl	(((idx-8)&0xf)*4)(w), wt	/* W8 */	_SEP \
+	xorl	(((idx-14)&0xf)*4)(w), wt	/* W2 */	_SEP \
+	xorl	(((idx)&0xf)*4)(w), wt		/* W0 */	_SEP \
+	roll	$1, wt						_SEP \
 	\
 	movl	wt, ((idx&0xf)*4)(w)
 
@@ -69,13 +71,13 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round(a, b, c, d, e, kt, wt) \
-	leal	kt(wt, e, 1), e;		/* Kt + Wt */	\
+	leal	kt(wt, e, 1), e			/* Kt + Wt */	_SEP \
 	\
-	movl	a, tmp1;			/* rol(a, 5) */	\
-	roll	$5, tmp1;					\
-	addl	tmp1, e;					\
+	movl	a, tmp1				/* rol(a, 5) */	_SEP \
+	roll	$5, tmp1					_SEP \
+	addl	tmp1, e						_SEP \
 	\
-	roll	$30, b;				/* rol(b, 30) */
+	roll	$30, b				/* rol(b, 30) */
 
 /*
  * Compute a SHA-1 round with Ch:
@@ -87,11 +89,11 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round_ch(a, b, c, d, e, kt, wt) \
-	movl	c, tmp2;			/* Ch */	\
-	xorl	d, tmp2;			/* Ch */	\
-	andl	b, tmp2;			/* Ch */	\
-	xorl	d, tmp2;			/* Ch */	\
-	addl	tmp2, e;			/* Ch */	\
+	movl	c, tmp2				/* Ch */	_SEP \
+	xorl	d, tmp2				/* Ch */	_SEP \
+	andl	b, tmp2				/* Ch */	_SEP \
+	xorl	d, tmp2				/* Ch */	_SEP \
+	addl	tmp2, e				/* Ch */	_SEP \
 	\
 	sha1_round(a, b, c, d, e, kt, wt)
 
@@ -105,10 +107,10 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round_parity(a, b, c, d, e, kt, wt) \
-	movl	b, tmp2;			/* Parity */	\
-	xorl	c, tmp2;			/* Parity */	\
-	xorl	d, tmp2;			/* Parity */	\
-	addl	tmp2, e;			/* Parity */	\
+	movl	b, tmp2				/* Parity */	_SEP \
+	xorl	c, tmp2				/* Parity */	_SEP \
+	xorl	d, tmp2				/* Parity */	_SEP \
+	addl	tmp2, e				/* Parity */	_SEP \
 	\
 	sha1_round(a, b, c, d, e, kt, wt)
 
@@ -122,34 +124,34 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round_maj(a, b, c, d, e, kt, wt) \
-	movl	c, tmp2;			/* Maj */	\
-	xorl	d, tmp2;			/* Maj */	\
-	andl	b, tmp2;			/* Maj */	\
-	movl	c, tmp3;			/* Maj */	\
-	andl	d, tmp3;			/* Maj */	\
-	xorl	tmp2, tmp3;			/* Maj */	\
-	addl	tmp3, e;			/* Maj */	\
+	movl	c, tmp2				/* Maj */	_SEP \
+	xorl	d, tmp2				/* Maj */	_SEP \
+	andl	b, tmp2				/* Maj */	_SEP \
+	movl	c, tmp3				/* Maj */	_SEP \
+	andl	d, tmp3				/* Maj */	_SEP \
+	xorl	tmp2, tmp3			/* Maj */	_SEP \
+	addl	tmp3, e				/* Maj */	_SEP \
 	\
 	sha1_round(a, b, c, d, e, kt, wt)
 
 #define sha1_round1_load(idx, a, b, c, d, e) \
-	sha1_message_schedule_load(idx, in, %rsp, tmp0); \
+	sha1_message_schedule_load(idx, in, %rsp, tmp0) 	_SEP \
 	sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0)
 
 #define sha1_round1_update(idx, a, b, c, d, e) \
-	sha1_message_schedule_update(idx, %rsp, tmp0); \
+	sha1_message_schedule_update(idx, %rsp, tmp0)	 	_SEP \
 	sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0)
 
 #define sha1_round2_update(idx, a, b, c, d, e) \
-	sha1_message_schedule_update(idx, %rsp, tmp0); \
+	sha1_message_schedule_update(idx, %rsp, tmp0)		_SEP \
 	sha1_round_parity(a, b, c, d, e, 0x6ed9eba1, tmp0)
 
 #define sha1_round3_update(idx, a, b, c, d, e) \
-	sha1_message_schedule_update(idx, %rsp, tmp0); \
+	sha1_message_schedule_update(idx, %rsp, tmp0)		_SEP \
 	sha1_round_maj(a, b, c, d, e, 0x8f1bbcdc, tmp0)
 
 #define sha1_round4_update(idx, a, b, c, d, e) \
-	sha1_message_schedule_update(idx, %rsp, tmp0); \
+	sha1_message_schedule_update(idx, %rsp, tmp0)		_SEP \
 	sha1_round_parity(a, b, c, d, e, 0xca62c1d6, tmp0)
 
 .section .text
diff --git a/src/lib/libcrypto/sha/sha1_amd64_shani.S b/src/lib/libcrypto/sha/sha1_amd64_shani.S
index 7fc5168907..201688785c 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_shani.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_shani.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_shani.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-1 implementation using the Intel SHA extensions:
  *
@@ -45,25 +47,25 @@
 
 
 #define sha1_message_schedule_load(idx, m, xmsg) \
-	movdqu	(idx*16)(m), xmsg;					\
+	movdqu	(idx*16)(m), xmsg					_SEP \
 	pshufb	xshufmask, xmsg
 
 #define sha1_message_schedule_update(xm0, xm1, xm2, xm3) \
-	sha1msg1 xm1, xm0;						\
-	pxor	xm2, xm0;						\
+	sha1msg1 xm1, xm0						_SEP \
+	pxor	xm2, xm0						_SEP \
 	sha1msg2 xm3, xm0
 
 #define sha1_shani_round(fn, xmsg, xe, xe_next) \
-	sha1nexte xmsg, xe;						\
-	movdqa	xabcd, xe_next;						\
+	sha1nexte xmsg, xe						_SEP \
+	movdqa	xabcd, xe_next						_SEP \
 	sha1rnds4 fn, xe, xabcd
 
 #define sha1_shani_round_load(fn, idx, m, xmsg, xe, xe_next) \
-	sha1_message_schedule_load(idx, m, xmsg);			\
+	sha1_message_schedule_load(idx, m, xmsg)			_SEP \
 	sha1_shani_round(fn, xmsg, xe, xe_next)
 
 #define sha1_shani_round_update(fn, xm0, xm1, xm2, xm3, xe, xe_next) \
-	sha1_message_schedule_update(xm0, xm1, xm2, xm3);		\
+	sha1_message_schedule_update(xm0, xm1, xm2, xm3)		_SEP \
 	sha1_shani_round(fn, xm0, xe, xe_next)
 
 
diff --git a/src/lib/libcrypto/sha/sha256_aarch64_ce.S b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
index 8a26f91b06..d96ee7ebff 100644
--- a/src/lib/libcrypto/sha/sha256_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_aarch64_ce.S,v 1.6 2026/01/25 08:22:17 jsing Exp $ */
+/* $OpenBSD: sha256_aarch64_ce.S,v 1.7 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -15,6 +15,10 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include "crypto_assembly.h"
+
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-256 implementation using the ARM Cryptographic Extension (CE).
  *
@@ -68,7 +72,7 @@
  *   W0:W1:W2:W3 = sigma1(W14:W15:W0:W1) + W9:W10:W12:W13 + W0:W1:W2:W3
  */
 #define sha256_message_schedule_update(m0, m1, m2, m3) \
-	sha256su0 m0.4s, m1.4s;						\
+	sha256su0 m0.4s, m1.4s						_SEP \
 	sha256su1 m0.4s, m2.4s, m3.4s
 
 /*
@@ -77,16 +81,16 @@
  * sha256h/sha256h2.
  */
 #define sha256_round(h0, h1, w, k) \
-	add	tmp0.4s, w.4s, k.4s;		/* Tt = Wt + Kt */	\
-	mov	tmp1.16b, h0.16b;					\
-	sha256h	h0##q, h1##q, tmp0.4s;					\
+	add	tmp0.4s, w.4s, k.4s		/* Tt = Wt + Kt */	_SEP \
+	mov	tmp1.16b, h0.16b					_SEP \
+	sha256h	h0##q, h1##q, tmp0.4s					_SEP \
 	sha256h2 h1##q, tmp1##q, tmp0.4s
 
 #define sha256_round_initial(h0, h1, w, k) \
 	sha256_round(h0, h1, w, k)
 
 #define sha256_round_update(h0, h1, m0, m1, m2, m3, k) \
-	sha256_message_schedule_update(m0, m1, m2, m3);			\
+	sha256_message_schedule_update(m0, m1, m2, m3)			_SEP \
 	sha256_round(h0, h1, m0, k)
 
 .arch	armv8-a+sha2
diff --git a/src/lib/libcrypto/sha/sha256_amd64_generic.S b/src/lib/libcrypto/sha/sha256_amd64_generic.S
index 52ad974eab..f74af0b145 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_amd64_generic.S,v 1.6 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha256_amd64_generic.S,v 1.7 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 #define	ctx		%rdi
 #define	in		%rsi
 #define	num		%rdx
@@ -45,8 +47,8 @@
  *  Wt = Mt
  */
 #define sha256_message_schedule_load(idx, m, w, wt) \
-	movl	(m, round, 4), wt;				\
-	bswapl	wt;						\
+	movl	(m, round, 4), wt				_SEP \
+	bswapl	wt						_SEP \
 	movl	wt, ((idx&0xf)*4)(w)
 
 /*
@@ -58,25 +60,25 @@
  *  sigma1(x) = ror(x, 17) ^ ror(x, 19) ^ (x >> 10)
  */
 #define sha256_message_schedule_update(idx, w, wt) \
-	movl	(((idx-2)&0xf)*4)(w), wt;	/* sigma1 */	\
-	movl	wt, tmp1;			/* sigma1 */	\
-	rorl	$(19-17), tmp1;			/* sigma1 */	\
-	xorl	wt, tmp1;			/* sigma1 */	\
-	rorl	$17, tmp1;			/* sigma1 */	\
-	shrl	$10, wt;			/* sigma1 */	\
-	xorl	tmp1, wt;			/* sigma1 */	\
+	movl	(((idx-2)&0xf)*4)(w), wt	/* sigma1 */	_SEP \
+	movl	wt, tmp1			/* sigma1 */	_SEP \
+	rorl	$(19-17), tmp1			/* sigma1 */	_SEP \
+	xorl	wt, tmp1			/* sigma1 */	_SEP \
+	rorl	$17, tmp1			/* sigma1 */	_SEP \
+	shrl	$10, wt				/* sigma1 */	_SEP \
+	xorl	tmp1, wt			/* sigma1 */	_SEP \
 	\
-	addl	(((idx-7)&0xf)*4)(w), wt;	/* Wt-7 */	\
-	addl	(((idx-16)&0xf)*4)(w), wt;	/* Wt-16 */	\
+	addl	(((idx-7)&0xf)*4)(w), wt	/* Wt-7 */	_SEP \
+	addl	(((idx-16)&0xf)*4)(w), wt	/* Wt-16 */	_SEP \
 	\
-	movl	(((idx-15)&0xf)*4)(w), tmp2;	/* sigma0 */	\
-	movl	tmp2, tmp3;			/* sigma0 */	\
-	rorl	$(18-7), tmp2;			/* sigma0 */	\
-	xorl	tmp3, tmp2;			/* sigma0 */	\
-	rorl	$7, tmp2;			/* sigma0 */	\
-	shrl	$3, tmp3;			/* sigma0 */	\
-	xorl	tmp3, tmp2;			/* sigma0 */	\
-	addl	tmp2, wt;			/* sigma0 */	\
+	movl	(((idx-15)&0xf)*4)(w), tmp2	/* sigma0 */	_SEP \
+	movl	tmp2, tmp3			/* sigma0 */	_SEP \
+	rorl	$(18-7), tmp2			/* sigma0 */	_SEP \
+	xorl	tmp3, tmp2			/* sigma0 */	_SEP \
+	rorl	$7, tmp2			/* sigma0 */	_SEP \
+	shrl	$3, tmp3			/* sigma0 */	_SEP \
+	xorl	tmp3, tmp2			/* sigma0 */	_SEP \
+	addl	tmp2, wt			/* sigma0 */	_SEP \
 	\
 	movl	wt, ((idx&0xf)*4)(w)
 
@@ -94,49 +96,49 @@
  * Upon completion d = d + T1, h = T1 + T2, pending rotation.
  */
 #define sha256_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \
-	addl	wt, h;				/* T1 Wt */	\
-	addl	(k256, round, 4), h;		/* T1 Kt */	\
+	addl	wt, h				/* T1 Wt */	_SEP \
+	addl	(k256, round, 4), h		/* T1 Kt */	_SEP \
 	\
-	movl	e, tmp1;			/* T1 Sigma1 */	\
-	rorl	$(25-11), tmp1;			/* T1 Sigma1 */	\
-	xorl	e, tmp1;			/* T1 Sigma1 */ \
-	rorl	$(11-6), tmp1;			/* T1 Sigma1 */	\
-	xorl	e, tmp1;			/* T1 Sigma1 */ \
-	rorl	$6, tmp1;			/* T1 Sigma1 */	\
-	addl	tmp1, h;			/* T1 Sigma1 */	\
+	movl	e, tmp1				/* T1 Sigma1 */	_SEP \
+	rorl	$(25-11), tmp1			/* T1 Sigma1 */	_SEP \
+	xorl	e, tmp1				/* T1 Sigma1 */ _SEP \
+	rorl	$(11-6), tmp1			/* T1 Sigma1 */	_SEP \
+	xorl	e, tmp1				/* T1 Sigma1 */ _SEP \
+	rorl	$6, tmp1			/* T1 Sigma1 */	_SEP \
+	addl	tmp1, h				/* T1 Sigma1 */	_SEP \
 	\
-	movl	f, tmp2;			/* T1 Ch */	\
-	xorl	g, tmp2;			/* T1 Ch */	\
-	andl	e, tmp2;			/* T1 Ch */	\
-	xorl	g, tmp2;			/* T1 Ch */	\
-	addl	tmp2, h;			/* T1 Ch */	\
+	movl	f, tmp2				/* T1 Ch */	_SEP \
+	xorl	g, tmp2				/* T1 Ch */	_SEP \
+	andl	e, tmp2				/* T1 Ch */	_SEP \
+	xorl	g, tmp2				/* T1 Ch */	_SEP \
+	addl	tmp2, h				/* T1 Ch */	_SEP \
 	\
-	addl	h, d;				/* d += T1 */	\
+	addl	h, d				/* d += T1 */	_SEP \
 	\
-	movl	a, tmp1;			/* T2 Sigma0 */	\
-	rorl	$(22-13), tmp1;			/* T2 Sigma0 */	\
-	xorl	a, tmp1;			/* T2 Sigma0 */	\
-	rorl	$(13-2), tmp1;			/* T2 Sigma0 */	\
-	xorl	a, tmp1;			/* T2 Sigma0 */	\
-	rorl	$2, tmp1;			/* T2 Sigma0 */	\
-	addl	tmp1, h;			/* T2 Sigma0 */	\
+	movl	a, tmp1				/* T2 Sigma0 */	_SEP \
+	rorl	$(22-13), tmp1			/* T2 Sigma0 */	_SEP \
+	xorl	a, tmp1				/* T2 Sigma0 */	_SEP \
+	rorl	$(13-2), tmp1			/* T2 Sigma0 */	_SEP \
+	xorl	a, tmp1				/* T2 Sigma0 */	_SEP \
+	rorl	$2, tmp1			/* T2 Sigma0 */	_SEP \
+	addl	tmp1, h				/* T2 Sigma0 */	_SEP \
 	\
-	movl	b, tmp2;			/* T2 Maj */	\
-	xorl	c, tmp2;			/* T2 Maj */	\
-	andl	a, tmp2;			/* T2 Maj */	\
-	movl	b, tmp3;			/* T2 Maj */	\
-	andl	c, tmp3;			/* T2 Maj */	\
-	xorl	tmp2, tmp3;			/* T2 Maj */	\
-	addl	tmp3, h;			/* T2 Maj */	\
+	movl	b, tmp2				/* T2 Maj */	_SEP \
+	xorl	c, tmp2				/* T2 Maj */	_SEP \
+	andl	a, tmp2				/* T2 Maj */	_SEP \
+	movl	b, tmp3				/* T2 Maj */	_SEP \
+	andl	c, tmp3				/* T2 Maj */	_SEP \
+	xorl	tmp2, tmp3			/* T2 Maj */	_SEP \
+	addl	tmp3, h				/* T2 Maj */	_SEP \
 	\
 	addq	$1, round
 
 #define sha256_round_load(idx, a, b, c, d, e, f, g, h) \
-	sha256_message_schedule_load(idx, in, %rsp, tmp0); \
+	sha256_message_schedule_load(idx, in, %rsp, tmp0)	_SEP \
 	sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0)
 
 #define sha256_round_update(idx, a, b, c, d, e, f, g, h) \
-	sha256_message_schedule_update(idx, %rsp, tmp0); \
+	sha256_message_schedule_update(idx, %rsp, tmp0)		_SEP \
 	sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0)
 
 .section .text
diff --git a/src/lib/libcrypto/sha/sha256_amd64_shani.S b/src/lib/libcrypto/sha/sha256_amd64_shani.S
index d86be5be68..2684c809ba 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_shani.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_amd64_shani.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha256_amd64_shani.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-256 implementation using the Intel SHA extensions:
  *
@@ -50,30 +52,30 @@
 #define	xtmp0		%xmm12
 
 #define sha256_message_schedule_load(idx, m, xmsgtmp) \
-	movdqu	(idx*16)(m), xmsg;					\
-	pshufb	xshufmask, xmsg;					\
+	movdqu	(idx*16)(m), xmsg					_SEP \
+	pshufb	xshufmask, xmsg						_SEP \
 	movdqa	xmsg, xmsgtmp
 
 #define sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3) \
-	sha256msg1 xmt1, xmt0;						\
-	movdqa	xmt3, xmsgtmp4;						\
-	palignr	$4, xmt2, xmsgtmp4;					\
-	paddd	xmsgtmp4, xmt0;						\
+	sha256msg1 xmt1, xmt0						_SEP \
+	movdqa	xmt3, xmsgtmp4						_SEP \
+	palignr	$4, xmt2, xmsgtmp4					_SEP \
+	paddd	xmsgtmp4, xmt0						_SEP \
 	sha256msg2 xmt3, xmt0
 
 #define sha256_shani_round(idx) \
-	paddd	(idx*16)(k256), xmsg;					\
-	sha256rnds2 xmsg, xhs0, xhs1;					\
-	pshufd	$0x0e, xmsg, xmsg;					\
+	paddd	(idx*16)(k256), xmsg					_SEP \
+	sha256rnds2 xmsg, xhs0, xhs1					_SEP \
+	pshufd	$0x0e, xmsg, xmsg					_SEP \
 	sha256rnds2 xmsg, xhs1, xhs0
 
 #define sha256_shani_round_load(idx, m, xmsgtmp) \
-	sha256_message_schedule_load(idx, m, xmsgtmp);			\
+	sha256_message_schedule_load(idx, m, xmsgtmp)			_SEP \
 	sha256_shani_round(idx)
 
 #define sha256_shani_round_update(idx, xmt0, xmt1, xmt2, xmt3) \
-	sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3);		\
-	movdqa	xmt0, xmsg;						\
+	sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3)		_SEP \
+	movdqa	xmt0, xmsg						_SEP \
 	sha256_shani_round(idx)
 
 .section .text
diff --git a/src/lib/libcrypto/sha/sha512_aarch64_ce.S b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
index 6efe775ff5..71d18fbcd4 100644
--- a/src/lib/libcrypto/sha/sha512_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha512_aarch64_ce.S,v 1.4 2026/01/25 08:22:17 jsing Exp $ */
+/* $OpenBSD: sha512_aarch64_ce.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -15,6 +15,10 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include "crypto_assembly.h"
+
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-512 implementation using the ARM Cryptographic Extension (CE).
  *
@@ -103,9 +107,9 @@
  *   W0 = sigma1(W14) + W9 + sigma0(W1) + W0
  */
 #define sha512_message_schedule_update(m0, m1, m4, m5, m7) \
-	sha512su0 m0.2d, m1.2d;			/* W0 += sigma0(W1) */	\
-	ext	tmp2.16b, m4.16b, m5.16b, #8;	/* W9:W10 */		\
-	sha512su1 m0.2d, m7.2d, tmp2.2d;	/* W0 += sigma1(W14) + W9 */
+	sha512su0 m0.2d, m1.2d			/* W0 += sigma0(W1) */	_SEP \
+	ext	tmp2.16b, m4.16b, m5.16b, #8	/* W9:W10 */		_SEP \
+	sha512su1 m0.2d, m7.2d, tmp2.2d		/* W0 += sigma1(W14) + W9 */
 
 /*
  * Compute two SHA-512 rounds by adding W0:W1 + K0:K1, then computing T1 for two
@@ -142,20 +146,20 @@
  * These values are then rotated by the caller to perform the next two rounds.
  */
 #define sha512_round(h0, h1, h2, h3, h4, h5, w, k) \
-	add	h4.2d, w.2d, k.2d;			/* W0:W1 += K0:K1 */	\
-	ext	h4.16b, h4.16b, h4.16b, #8;		/* W1:W0 (swap) */	\
-	add	h4.2d, h4.2d, h3.2d;			/* W1:W0 += g:h */	\
-	ext	tmp0.16b, h2.16b, h3.16b, #8;		/* f:g */		\
-	ext	tmp1.16b, h1.16b, h2.16b, #8;		/* d:e */		\
-	sha512h	h4##q, tmp0##q, tmp1.2d;		/* T1 */		\
-	add	h5.2d, h1.2d, h4.2d;			/* c:d + T1 */		\
-	sha512h2 h4##q, h1##q, h0.2d;			/* T1 + T2 */
+	add	h4.2d, w.2d, k.2d			/* W0:W1 += K0:K1 */	_SEP \
+	ext	h4.16b, h4.16b, h4.16b, #8		/* W1:W0 (swap) */	_SEP \
+	add	h4.2d, h4.2d, h3.2d			/* W1:W0 += g:h */	_SEP \
+	ext	tmp0.16b, h2.16b, h3.16b, #8		/* f:g */		_SEP \
+	ext	tmp1.16b, h1.16b, h2.16b, #8		/* d:e */		_SEP \
+	sha512h	h4##q, tmp0##q, tmp1.2d			/* T1 */		_SEP \
+	add	h5.2d, h1.2d, h4.2d			/* c:d + T1 */		_SEP \
+	sha512h2 h4##q, h1##q, h0.2d			/* T1 + T2 */
 
 #define sha512_round_initial(h0, h1, h2, h3, h4, h5, w, k) \
 	sha512_round(h0, h1, h2, h3, h4, h5, w, k)
 
 #define sha512_round_update(h0, h1, h2, h3, h4, h5, m0, m1, m2, m3, m4, k) \
-	sha512_message_schedule_update(m0, m1, m2, m3, m4) \
+	sha512_message_schedule_update(m0, m1, m2, m3, m4)			_SEP \
 	sha512_round(h0, h1, h2, h3, h4, h5, m0, k)
 
 .arch	armv8-a+sha3
diff --git a/src/lib/libcrypto/sha/sha512_amd64_generic.S b/src/lib/libcrypto/sha/sha512_amd64_generic.S
index de759875f4..fac9d95655 100644
--- a/src/lib/libcrypto/sha/sha512_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha512_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha512_amd64_generic.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha512_amd64_generic.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define	_SEP	CRYPTO_ASSEMBLY_SEPARATOR
+
 #define	ctx		%rdi
 #define	in		%rsi
 #define	num		%rdx
@@ -45,8 +47,8 @@
  *  Wt = Mt
  */
 #define sha512_message_schedule_load(idx, m, w, wt) \
-	movq	(m, round, 8), wt;				\
-	bswapq	wt;						\
+	movq	(m, round, 8), wt				_SEP \
+	bswapq	wt						_SEP \
 	movq	wt, ((idx&0xf)*8)(w)
 
 /*
@@ -59,25 +61,25 @@
  *
  */
 #define sha512_message_schedule_update(idx, w, wt) \
-	movq	(((idx-2)&0xf)*8)(w), wt;	/* sigma1 */	\
-	movq	wt, tmp1;			/* sigma1 */	\
-	rorq	$(61-19), tmp1;			/* sigma1 */	\
-	xorq	wt, tmp1;			/* sigma1 */	\
-	rorq	$19, tmp1;			/* sigma1 */	\
-	shrq	$6, wt;				/* sigma1 */	\
-	xorq	tmp1, wt;			/* sigma1 */	\
+	movq	(((idx-2)&0xf)*8)(w), wt	/* sigma1 */	_SEP \
+	movq	wt, tmp1			/* sigma1 */	_SEP \
+	rorq	$(61-19), tmp1			/* sigma1 */	_SEP \
+	xorq	wt, tmp1			/* sigma1 */	_SEP \
+	rorq	$19, tmp1			/* sigma1 */	_SEP \
+	shrq	$6, wt				/* sigma1 */	_SEP \
+	xorq	tmp1, wt			/* sigma1 */	_SEP \
 	\
-	addq	(((idx-7)&0xf)*8)(w), wt;	/* Wt-7 */	\
-	addq	(((idx-16)&0xf)*8)(w), wt;	/* Wt-16 */	\
+	addq	(((idx-7)&0xf)*8)(w), wt	/* Wt-7 */	_SEP \
+	addq	(((idx-16)&0xf)*8)(w), wt	/* Wt-16 */	_SEP \
 	\
-	movq	(((idx-15)&0xf)*8)(w), tmp2;	/* sigma0 */	\
-	movq	tmp2, tmp3;			/* sigma0 */	\
-	rorq	$(8-1), tmp2;			/* sigma0 */	\
-	xorq	tmp3, tmp2;			/* sigma0 */	\
-	rorq	$1, tmp2;			/* sigma0 */	\
-	shrq	$7, tmp3;			/* sigma0 */	\
-	xorq	tmp3, tmp2;			/* sigma0 */	\
-	addq	tmp2, wt;			/* sigma0 */	\
+	movq	(((idx-15)&0xf)*8)(w), tmp2	/* sigma0 */	_SEP \
+	movq	tmp2, tmp3			/* sigma0 */	_SEP \
+	rorq	$(8-1), tmp2			/* sigma0 */	_SEP \
+	xorq	tmp3, tmp2			/* sigma0 */	_SEP \
+	rorq	$1, tmp2			/* sigma0 */	_SEP \
+	shrq	$7, tmp3			/* sigma0 */	_SEP \
+	xorq	tmp3, tmp2			/* sigma0 */	_SEP \
+	addq	tmp2, wt			/* sigma0 */	_SEP \
 	\
 	movq	wt, ((idx&0xf)*8)(w)
 
@@ -95,49 +97,49 @@
  * Upon completion d = d + T1, h = T1 + T2, pending rotation.
  */
 #define sha512_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \
-	addq	wt, h;				/* T1 Wt */	\
-	addq	(k512, round, 8), h;		/* T1 Kt */	\
+	addq	wt, h				/* T1 Wt */	_SEP \
+	addq	(k512, round, 8), h		/* T1 Kt */	_SEP \
 	\
-	movq	e, tmp1;			/* T1 Sigma1 */	\
-	rorq	$(41-18), tmp1;			/* T1 Sigma1 */	\
-	xorq	e, tmp1;			/* T1 Sigma1 */ \
-	rorq	$(18-14), tmp1;			/* T1 Sigma1 */	\
-	xorq	e, tmp1;			/* T1 Sigma1 */ \
-	rorq	$14, tmp1;			/* T1 Sigma1 */	\
-	addq	tmp1, h;			/* T1 Sigma1 */	\
+	movq	e, tmp1				/* T1 Sigma1 */	_SEP \
+	rorq	$(41-18), tmp1			/* T1 Sigma1 */	_SEP \
+	xorq	e, tmp1				/* T1 Sigma1 */ _SEP \
+	rorq	$(18-14), tmp1			/* T1 Sigma1 */	_SEP \
+	xorq	e, tmp1				/* T1 Sigma1 */ _SEP \
+	rorq	$14, tmp1			/* T1 Sigma1 */	_SEP \
+	addq	tmp1, h				/* T1 Sigma1 */	_SEP \
 	\
-	movq	f, tmp2;			/* T1 Ch */	\
-	xorq	g, tmp2;			/* T1 Ch */	\
-	andq	e, tmp2;			/* T1 Ch */	\
-	xorq	g, tmp2;			/* T1 Ch */	\
-	addq	tmp2, h;			/* T1 Ch */	\
+	movq	f, tmp2				/* T1 Ch */	_SEP \
+	xorq	g, tmp2				/* T1 Ch */	_SEP \
+	andq	e, tmp2				/* T1 Ch */	_SEP \
+	xorq	g, tmp2				/* T1 Ch */	_SEP \
+	addq	tmp2, h				/* T1 Ch */	_SEP \
 	\
-	addq	h, d;				/* d += T1 */	\
+	addq	h, d				/* d += T1 */	_SEP \
 	\
-	movq	a, tmp1;			/* T2 Sigma0 */	\
-	rorq	$(39-34), tmp1;			/* T2 Sigma0 */	\
-	xorq	a, tmp1;			/* T2 Sigma0 */	\
-	rorq	$(34-28), tmp1;			/* T2 Sigma0 */	\
-	xorq	a, tmp1;			/* T2 Sigma0 */	\
-	rorq	$28, tmp1;			/* T2 Sigma0 */	\
-	addq	tmp1, h;			/* T2 Sigma0 */	\
+	movq	a, tmp1				/* T2 Sigma0 */	_SEP \
+	rorq	$(39-34), tmp1			/* T2 Sigma0 */	_SEP \
+	xorq	a, tmp1				/* T2 Sigma0 */	_SEP \
+	rorq	$(34-28), tmp1			/* T2 Sigma0 */	_SEP \
+	xorq	a, tmp1				/* T2 Sigma0 */	_SEP \
+	rorq	$28, tmp1			/* T2 Sigma0 */	_SEP \
+	addq	tmp1, h				/* T2 Sigma0 */	_SEP \
 	\
-	movq	b, tmp2;			/* T2 Maj */	\
-	xorq	c, tmp2;			/* T2 Maj */	\
-	andq	a, tmp2;			/* T2 Maj */	\
-	movq	b, tmp3;			/* T2 Maj */	\
-	andq	c, tmp3;			/* T2 Maj */	\
-	xorq	tmp2, tmp3;			/* T2 Maj */	\
-	addq	tmp3, h;			/* T2 Maj */	\
+	movq	b, tmp2				/* T2 Maj */	_SEP \
+	xorq	c, tmp2				/* T2 Maj */	_SEP \
+	andq	a, tmp2				/* T2 Maj */	_SEP \
+	movq	b, tmp3				/* T2 Maj */	_SEP \
+	andq	c, tmp3				/* T2 Maj */	_SEP \
+	xorq	tmp2, tmp3			/* T2 Maj */	_SEP \
+	addq	tmp3, h				/* T2 Maj */	_SEP \
 	\
 	addq	$1, round
 
 #define sha512_round_load(idx, a, b, c, d, e, f, g, h) \
-	sha512_message_schedule_load(idx, in, %rsp, tmp0); \
+	sha512_message_schedule_load(idx, in, %rsp, tmp0) 	_SEP \
 	sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0)
 
 #define sha512_round_update(idx, a, b, c, d, e, f, g, h) \
-	sha512_message_schedule_update(idx, %rsp, tmp0); \
+	sha512_message_schedule_update(idx, %rsp, tmp0) 	_SEP \
 	sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0)
 
 .section .text
-- 
cgit v1.2.3-55-g6feb