On Tue, Feb 20, 2024 at 01:11:35PM +0100, Mark Kettenis wrote:
> I probably could have done this by changing CFI_STARTPROC, like on
> arm64.  But that would "over-BTI" and there is a benefit in trying to
> avoid that on amd64.
> 
> Let me know what you think.

Looks ok to me. Hard to tell if that covers everything but I think that's
fine. If anything is missing people will complain and we fix it.

> 
> 
> Index: security/libgcrypt/Makefile
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/Makefile,v
> retrieving revision 1.93
> diff -u -p -r1.93 Makefile
> --- security/libgcrypt/Makefile	20 Nov 2023 16:53:17 -0000	1.93
> +++ security/libgcrypt/Makefile	20 Feb 2024 11:27:18 -0000
> @@ -6,7 +6,7 @@ USE_NOEXECONLY=		Yes
>  COMMENT=		crypto library based on code used in GnuPG
>  
>  DISTNAME=		libgcrypt-1.10.3
> -REVISION=		0
> +REVISION=		1
>  
>  CATEGORIES=		security
>  
> Index: security/libgcrypt/patches/patch-cipher_arcfour-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_arcfour-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_arcfour-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_arcfour-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,11 @@
> +Index: cipher/arcfour-amd64.S
> +--- cipher/arcfour-amd64.S.orig
> ++++ cipher/arcfour-amd64.S
> +@@ -26,6 +26,7 @@
> + ELF(.type _gcry_arcfour_amd64,@function)
> + _gcry_arcfour_amd64:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 	push	%rbp
> + 	CFI_PUSH(%rbp)
> Index: security/libgcrypt/patches/patch-cipher_blake2b-amd64-avx2_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_blake2b-amd64-avx2_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_blake2b-amd64-avx2_S
> --- security/libgcrypt/patches/patch-cipher_blake2b-amd64-avx2_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_blake2b-amd64-avx2_S	20 Feb 2024 11:27:18 -0000
> @@ -17,3 +17,11 @@ Index: cipher/blake2b-amd64-avx2.S
>   .align 64
>   .globl _gcry_blake2b_transform_amd64_avx2
>   ELF(.type _gcry_blake2b_transform_amd64_avx2,@function;)
> +@@ -208,6 +210,7 @@ _gcry_blake2b_transform_amd64_avx2:
> +          *	%rdx: num_blks
> +          */
> +         CFI_STARTPROC();
> ++        endbr64;
> + 
> +         vzeroupper;
> + 
> Index: security/libgcrypt/patches/patch-cipher_blake2s-amd64-avx_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_blake2s-amd64-avx_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_blake2s-amd64-avx_S
> --- security/libgcrypt/patches/patch-cipher_blake2s-amd64-avx_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_blake2s-amd64-avx_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,11 @@ Index: cipher/blake2s-amd64-avx.S
>   .align 64
>   .globl _gcry_blake2s_transform_amd64_avx
>   ELF(.type _gcry_blake2s_transform_amd64_avx,@function;)
> +@@ -192,6 +193,7 @@ _gcry_blake2s_transform_amd64_avx:
> +          *	%rdx: num_blks
> +          */
> +         CFI_STARTPROC();
> ++        endbr64;
> + 
> +         vzeroupper;
> + 
> Index: security/libgcrypt/patches/patch-cipher_blowfish-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_blowfish-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_blowfish-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_blowfish-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,51 @@
> +Index: cipher/blowfish-amd64.S
> +--- cipher/blowfish-amd64.S.orig
> ++++ cipher/blowfish-amd64.S
> +@@ -166,6 +166,7 @@ _gcry_blowfish_amd64_do_encrypt:
> + 	 *	%rdx: u32 *ret_xr
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	movl (%rdx), RX0d;
> +@@ -197,6 +198,7 @@ _gcry_blowfish_amd64_encrypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	movq %rsi, %r10;
> +@@ -225,6 +227,7 @@ _gcry_blowfish_amd64_decrypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	movq %rbp, %r11;
> +@@ -413,6 +416,7 @@ _gcry_blowfish_amd64_ctr_enc:
> + 	 *	%rcx: iv (big endian, 64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -483,6 +487,7 @@ _gcry_blowfish_amd64_cbc_dec:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -544,6 +549,7 @@ _gcry_blowfish_amd64_cfb_dec:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> Index: security/libgcrypt/patches/patch-cipher_camellia-aesni-avx-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_camellia-aesni-avx-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_camellia-aesni-avx-amd64_S
> --- security/libgcrypt/patches/patch-cipher_camellia-aesni-avx-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_camellia-aesni-avx-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,7 +18,55 @@ Index: cipher/camellia-aesni-avx-amd64.S
>   .align 8
>   ELF(.type   __camellia_enc_blk16,@function;)
>   
> -@@ -1720,7 +1721,7 @@ ELF(.size _gcry_camellia_aesni_avx_ocb_auth,.-_gcry_ca
> +@@ -909,6 +910,7 @@ _gcry_camellia_aesni_avx_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1037,6 +1039,7 @@ _gcry_camellia_aesni_avx_cbc_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1110,6 +1113,7 @@ _gcry_camellia_aesni_avx_cfb_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1194,6 +1198,7 @@ _gcry_camellia_aesni_avx_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1346,6 +1351,7 @@ _gcry_camellia_aesni_avx_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1516,6 +1522,7 @@ _gcry_camellia_aesni_avx_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1720,7 +1727,7 @@ ELF(.size _gcry_camellia_aesni_avx_ocb_auth,.-_gcry_ca
>   	vpsllq $(64-(nror)), out, out; \
>   	vpaddd t0, out, out;
>   
> @@ -27,7 +75,7 @@ Index: cipher/camellia-aesni-avx-amd64.S
>   .align 16
>   .Linv_shift_row_and_unpcklbw:
>   	.byte 0x00, 0xff, 0x0d, 0xff, 0x0a, 0xff, 0x07, 0xff
> -@@ -1752,7 +1753,7 @@ ELF(.size _gcry_camellia_aesni_avx_ocb_auth,.-_gcry_ca
> +@@ -1752,7 +1759,7 @@ ELF(.size _gcry_camellia_aesni_avx_ocb_auth,.-_gcry_ca
>   .Lsigma6:
>   	.long 0xB3E6C1FD, 0xB05688C2;
>   
> @@ -36,3 +84,11 @@ Index: cipher/camellia-aesni-avx-amd64.S
>   .align 8
>   ELF(.type  __camellia_avx_setup128,@function;)
>   __camellia_avx_setup128:
> +@@ -2591,6 +2598,7 @@ _gcry_camellia_aesni_avx_keygen:
> + 	 *	%rdx: keylen
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> Index: security/libgcrypt/patches/patch-cipher_camellia-aesni-avx2-amd64_h
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_camellia-aesni-avx2-amd64_h,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_camellia-aesni-avx2-amd64_h
> --- security/libgcrypt/patches/patch-cipher_camellia-aesni-avx2-amd64_h	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_camellia-aesni-avx2-amd64_h	20 Feb 2024 11:27:18 -0000
> @@ -19,3 +19,51 @@ Index: cipher/camellia-aesni-avx2-amd64.
>   .align 8
>   ELF(.type   __camellia_enc_blk32,@function;)
>   
> +@@ -902,6 +902,7 @@ FUNC_NAME(ctr_enc):
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1100,6 +1101,7 @@ FUNC_NAME(cbc_dec):
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1177,6 +1179,7 @@ FUNC_NAME(cfb_dec):
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1263,6 +1266,7 @@ FUNC_NAME(ocb_enc):
> + 	 *	%r9 : L pointers (void *L[32])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1437,6 +1441,7 @@ FUNC_NAME(ocb_dec):
> + 	 *	%r9 : L pointers (void *L[32])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -1633,6 +1638,7 @@ FUNC_NAME(ocb_auth):
> + 	 *	%r8 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> Index: security/libgcrypt/patches/patch-cipher_cast5-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_cast5-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_cast5-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_cast5-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,43 @@
> +Index: cipher/cast5-amd64.S
> +--- cipher/cast5-amd64.S.orig
> ++++ cipher/cast5-amd64.S
> +@@ -184,6 +184,7 @@ _gcry_cast5_amd64_encrypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -234,6 +235,7 @@ _gcry_cast5_amd64_decrypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -446,6 +448,7 @@ _gcry_cast5_amd64_ctr_enc:
> + 	 *	%rcx: iv (big endian, 64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -523,6 +526,7 @@ _gcry_cast5_amd64_cbc_dec:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -597,6 +601,7 @@ _gcry_cast5_amd64_cfb_dec:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> Index: security/libgcrypt/patches/patch-cipher_chacha20-amd64-avx2_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_chacha20-amd64-avx2_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_chacha20-amd64-avx2_S
> --- security/libgcrypt/patches/patch-cipher_chacha20-amd64-avx2_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_chacha20-amd64-avx2_S	20 Feb 2024 11:27:18 -0000
> @@ -17,3 +17,19 @@ Index: cipher/chacha20-amd64-avx2.S
>   
>   .align 8
>   .globl _gcry_chacha20_amd64_avx2_blocks8
> +@@ -180,6 +182,7 @@ _gcry_chacha20_amd64_avx2_blocks8:
> + 	 *	%rcx: nblks (multiple of 8)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -347,6 +350,7 @@ _gcry_chacha20_poly1305_amd64_avx2_blocks8:
> + 	 *	%r8: poly1305-src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> Index: security/libgcrypt/patches/patch-cipher_chacha20-amd64-ssse3_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_chacha20-amd64-ssse3_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_chacha20-amd64-ssse3_S
> --- security/libgcrypt/patches/patch-cipher_chacha20-amd64-ssse3_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_chacha20-amd64-ssse3_S	20 Feb 2024 11:27:18 -0000
> @@ -17,3 +17,35 @@ Index: cipher/chacha20-amd64-ssse3.S
>   .align 8
>   .globl _gcry_chacha20_amd64_ssse3_blocks4
>   ELF(.type _gcry_chacha20_amd64_ssse3_blocks4,@function;)
> +@@ -176,6 +178,7 @@ _gcry_chacha20_amd64_ssse3_blocks4:
> + 	 *	%rcx: nblks (multiple of 4)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -378,6 +381,7 @@ _gcry_chacha20_amd64_ssse3_blocks1:
> + 	 *	%rcx: nblks
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* Load constants */
> + 	movdqa .Lcounter1 rRIP, X4;
> +@@ -527,6 +531,7 @@ _gcry_chacha20_poly1305_amd64_ssse3_blocks4:
> + 	 *	%r8: poly1305-src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> +@@ -795,6 +800,7 @@ _gcry_chacha20_poly1305_amd64_ssse3_blocks1:
> + 	 *	%r8: poly1305-src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	pushq %rbp;
> + 	CFI_PUSH(%rbp);
> Index: security/libgcrypt/patches/patch-cipher_des-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_des-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_des-amd64_S
> --- security/libgcrypt/patches/patch-cipher_des-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_des-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,39 @@
>  Index: cipher/des-amd64.S
>  --- cipher/des-amd64.S.orig
>  +++ cipher/des-amd64.S
> -@@ -841,6 +841,7 @@ _gcry_3des_amd64_cfb_dec:
> +@@ -191,6 +191,7 @@ _gcry_3des_amd64_crypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -559,6 +560,7 @@ _gcry_3des_amd64_cbc_dec:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -657,6 +659,7 @@ _gcry_3des_amd64_ctr_enc:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -755,6 +758,7 @@ _gcry_3des_amd64_cfb_dec:
> + 	 *	%rcx: iv (64bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	pushq %rbp;
> +@@ -841,6 +845,7 @@ _gcry_3des_amd64_cfb_dec:
>   	CFI_ENDPROC();
>   ELF(.size _gcry_3des_amd64_cfb_dec,.-_gcry_3des_amd64_cfb_dec;)
>   
> Index: security/libgcrypt/patches/patch-cipher_rijndael-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_rijndael-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_rijndael-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_rijndael-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,19 @@
> +Index: cipher/rijndael-amd64.S
> +--- cipher/rijndael-amd64.S.orig
> ++++ cipher/rijndael-amd64.S
> +@@ -213,6 +213,7 @@ _gcry_aes_amd64_encrypt_block:
> + 	 *	%r8:  encryption tables
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_5
> + 
> + 	subq $(5 * 8), %rsp;
> +@@ -390,6 +391,7 @@ _gcry_aes_amd64_decrypt_block:
> + 	 *	%r8:  decryption tables
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_5
> + 
> + 	subq $(5 * 8), %rsp;
> Index: security/libgcrypt/patches/patch-cipher_rijndael-ssse3-amd64-asm_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_rijndael-ssse3-amd64-asm_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_rijndael-ssse3-amd64-asm_S
> --- security/libgcrypt/patches/patch-cipher_rijndael-ssse3-amd64-asm_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_rijndael-ssse3-amd64-asm_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,47 @@
>  Index: cipher/rijndael-ssse3-amd64-asm.S
>  --- cipher/rijndael-ssse3-amd64-asm.S.orig
>  +++ cipher/rijndael-ssse3-amd64-asm.S
> -@@ -689,6 +689,7 @@ ELF(.size _gcry_aes_ssse3_schedule_core,.-_gcry_aes_ss
> +@@ -51,6 +51,7 @@ ELF(.type _gcry_aes_ssse3_enc_preload,@function)
> + .globl _gcry_aes_ssse3_enc_preload
> + _gcry_aes_ssse3_enc_preload:
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 	lea	.Laes_consts(%rip), %rax
> + 	movdqa	          (%rax), %xmm9  # 0F
> +@@ -72,6 +73,7 @@ ELF(.type _gcry_aes_ssse3_dec_preload,@function)
> + .globl _gcry_aes_ssse3_dec_preload
> + _gcry_aes_ssse3_dec_preload:
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 	lea	.Laes_consts(%rip), %rax
> + 	movdqa	          (%rax), %xmm9   # 0F
> +@@ -116,6 +118,7 @@ ELF(.type _gcry_aes_ssse3_encrypt_core,@function)
> + _gcry_aes_ssse3_encrypt_core:
> + _aes_encrypt_core:
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 	mov	%rdi,	%rdx
> + 	leaq	-1(%rsi), %rax
> +@@ -209,6 +212,7 @@ ELF(.type _gcry_aes_ssse3_decrypt_core,@function)
> + _gcry_aes_ssse3_decrypt_core:
> + _aes_decrypt_core:
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 	mov	%rdi,	%rdx
> + 	lea	.Laes_consts(%rip), %rcx
> +@@ -324,6 +328,7 @@ _aes_schedule_core:
> + 	# rcx = direction.  0=encrypt, 1=decrypt
> + 	# r8 = rotoffs
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	ENTER_SYSV_FUNC_PARAMS_5
> + 
> + 	# load the tables
> +@@ -689,6 +694,7 @@ ELF(.size _gcry_aes_ssse3_schedule_core,.-_gcry_aes_ss
>   ##                                                    ##
>   ########################################################
>   
> Index: security/libgcrypt/patches/patch-cipher_rijndael-vaes-avx2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_rijndael-vaes-avx2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_rijndael-vaes-avx2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_rijndael-vaes-avx2-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_rijndael-vaes-avx2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,55 @@
>  Index: cipher/rijndael-vaes-avx2-amd64.S
>  --- cipher/rijndael-vaes-avx2-amd64.S.orig
>  +++ cipher/rijndael-vaes-avx2-amd64.S
> -@@ -2926,6 +2926,7 @@ ELF(.size _gcry_vaes_avx2_xts_crypt_amd64,.-_gcry_vaes
> +@@ -96,6 +96,7 @@ _gcry_vaes_avx2_cbc_dec_amd64:
> + 	 *	%r9:  nrounds
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* Load IV. */
> + 	vmovdqu (%rsi), %xmm15;
> +@@ -402,6 +403,7 @@ _gcry_vaes_avx2_cfb_dec_amd64:
> + 	 *	%r9:  nrounds
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* Load IV. */
> + 	vmovdqu (%rsi), %xmm15;
> +@@ -710,6 +712,7 @@ _gcry_vaes_avx2_ctr_enc_amd64:
> + 	 *	%r9:  nrounds
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	movq 8(%rsi), %r10;
> + 	movq 0(%rsi), %r11;
> +@@ -1122,6 +1125,7 @@ _gcry_vaes_avx2_ctr32le_enc_amd64:
> + 	 *	%r9:  nrounds
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vbroadcasti128 (%rsi), %ymm15; // CTR
> + 
> +@@ -1555,6 +1559,7 @@ _gcry_vaes_avx2_ocb_crypt_amd64:
> + 	 *	40(%rbp): encrypt (%r15d)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + #define STACK_REGS_POS (16 * 16 + 4 * 16)
> + #define STACK_ALLOC (STACK_REGS_POS + 6 * 8)
> +@@ -2422,6 +2427,7 @@ _gcry_vaes_avx2_xts_crypt_amd64:
> + 	 *	8(%rsp): encrypt
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	movl 8(%rsp), %eax;
> + 
> +@@ -2926,6 +2932,7 @@ ELF(.size _gcry_vaes_avx2_xts_crypt_amd64,.-_gcry_vaes
>   /**********************************************************************
>     constants
>    **********************************************************************/
> Index: security/libgcrypt/patches/patch-cipher_salsa20-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_salsa20-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_salsa20-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_salsa20-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,27 @@
> +Index: cipher/salsa20-amd64.S
> +--- cipher/salsa20-amd64.S.orig
> ++++ cipher/salsa20-amd64.S
> +@@ -37,6 +37,7 @@
> + ELF(.type  _gcry_salsa20_amd64_keysetup,@function;)
> + _gcry_salsa20_amd64_keysetup:
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	movl   0(%rsi),%r8d
> + 	movl   4(%rsi),%r9d
> + 	movl   8(%rsi),%eax
> +@@ -91,6 +92,7 @@ _gcry_salsa20_amd64_keysetup:
> + ELF(.type  _gcry_salsa20_amd64_ivsetup,@function;)
> + _gcry_salsa20_amd64_ivsetup:
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	movl   0(%rsi),%r8d
> + 	movl   4(%rsi),%esi
> + 	mov  $0,%r9
> +@@ -113,6 +115,7 @@ _gcry_salsa20_amd64_encrypt_blocks:
> + 	 *    (this is done in salsa20.c).
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64
> + 	push %rbx
> + 	CFI_PUSH(%rbx);
> + 	shlq $6, %rcx /* blocks to bytes */
> Index: security/libgcrypt/patches/patch-cipher_serpent-avx2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_serpent-avx2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_serpent-avx2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_serpent-avx2-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_serpent-avx2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,55 @@
>  Index: cipher/serpent-avx2-amd64.S
>  --- cipher/serpent-avx2-amd64.S.orig
>  +++ cipher/serpent-avx2-amd64.S
> -@@ -1150,6 +1150,7 @@ _gcry_serpent_avx2_ocb_auth:
> +@@ -600,6 +600,7 @@ _gcry_serpent_avx2_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	movq 8(%rcx), %rax;
> + 	bswapq %rax;
> +@@ -712,6 +713,7 @@ _gcry_serpent_avx2_cbc_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -765,6 +767,7 @@ _gcry_serpent_avx2_cfb_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -823,6 +826,7 @@ _gcry_serpent_avx2_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -937,6 +941,7 @@ _gcry_serpent_avx2_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -1060,6 +1065,7 @@ _gcry_serpent_avx2_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -1150,6 +1156,7 @@ _gcry_serpent_avx2_ocb_auth:
>   	CFI_ENDPROC();
>   ELF(.size _gcry_serpent_avx2_ocb_auth,.-_gcry_serpent_avx2_ocb_auth;)
>   
> Index: security/libgcrypt/patches/patch-cipher_serpent-sse2-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_serpent-sse2-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_serpent-sse2-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_serpent-sse2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,51 @@
> +Index: cipher/serpent-sse2-amd64.S
> +--- cipher/serpent-sse2-amd64.S.orig
> ++++ cipher/serpent-sse2-amd64.S
> +@@ -616,6 +616,7 @@ _gcry_serpent_sse2_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* load IV and byteswap */
> + 	movdqu (%rcx), RA0;
> +@@ -748,6 +749,7 @@ _gcry_serpent_sse2_cbc_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	movdqu (0 * 16)(%rdx), RA0;
> + 	movdqu (1 * 16)(%rdx), RA1;
> +@@ -811,6 +813,7 @@ _gcry_serpent_sse2_cfb_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* Load input */
> + 	movdqu (%rcx), RA0;
> +@@ -880,6 +883,7 @@ _gcry_serpent_sse2_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[8])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	subq $(4 * 8), %rsp;
> + 	CFI_ADJUST_CFA_OFFSET(4 * 8);
> +@@ -994,6 +998,7 @@ _gcry_serpent_sse2_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[8])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	subq $(4 * 8), %rsp;
> + 	CFI_ADJUST_CFA_OFFSET(4 * 8);
> +@@ -1117,6 +1122,7 @@ _gcry_serpent_sse2_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[8])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	subq $(4 * 8), %rsp;
> + 	CFI_ADJUST_CFA_OFFSET(4 * 8);
> Index: security/libgcrypt/patches/patch-cipher_sha1-avx-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha1-avx-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha1-avx-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha1-avx-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha1-avx-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,11 @@ Index: cipher/sha1-avx-amd64.S
>   .globl _gcry_sha1_transform_amd64_avx
>   ELF(.type _gcry_sha1_transform_amd64_avx,@function)
>   .align 16
> +@@ -213,6 +214,7 @@ _gcry_sha1_transform_amd64_avx:
> +    *	%rdx: nblks
> +    */
> +   CFI_STARTPROC();
> ++  endbr64;
> + 
> +   xorl %eax, %eax;
> +   cmpq $0, %rdx;
> Index: security/libgcrypt/patches/patch-cipher_sha1-avx-bmi2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha1-avx-bmi2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha1-avx-bmi2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha1-avx-bmi2-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha1-avx-bmi2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,11 @@ Index: cipher/sha1-avx-bmi2-amd64.S
>   .globl _gcry_sha1_transform_amd64_avx_bmi2
>   ELF(.type _gcry_sha1_transform_amd64_avx_bmi2,@function)
>   .align 16
> +@@ -212,6 +213,7 @@ _gcry_sha1_transform_amd64_avx_bmi2:
> +    *	%rdx: nblks
> +    */
> +   CFI_STARTPROC();
> ++  endbr64;
> + 
> +   xorl %eax, %eax;
> +   cmpq $0, %rdx;
> Index: security/libgcrypt/patches/patch-cipher_sha1-avx2-bmi2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha1-avx2-bmi2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha1-avx2-bmi2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha1-avx2-bmi2-amd64_S	28 Jan 2023 21:02:08 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha1-avx2-bmi2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -19,3 +19,11 @@ Index: cipher/sha1-avx2-bmi2-amd64.S
>   /*
>    * Transform 2*nblks*64 bytes (2*nblks*16 32-bit words) at DATA.
>    *
> +@@ -218,6 +218,7 @@ _gcry_sha1_transform_amd64_avx2_bmi2:
> +    *	%rdx: nblks (multiple of 2, larger than 0)
> +    */
> +   CFI_STARTPROC();
> ++  endbr64;
> + 
> +   vzeroupper;
> + 
> Index: security/libgcrypt/patches/patch-cipher_sha1-ssse3-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha1-ssse3-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha1-ssse3-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha1-ssse3-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha1-ssse3-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,11 @@ Index: cipher/sha1-ssse3-amd64.S
>   .globl _gcry_sha1_transform_amd64_ssse3
>   ELF(.type _gcry_sha1_transform_amd64_ssse3,@function)
>   .align 16
> +@@ -225,6 +226,7 @@ _gcry_sha1_transform_amd64_ssse3:
> +    *	%rdx: nblks
> +    */
> +   CFI_STARTPROC();
> ++  endbr64;
> + 
> +   xorl %eax, %eax;
> +   cmpq $0, %rdx;
> Index: security/libgcrypt/patches/patch-cipher_sha256-avx-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha256-avx-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha256-avx-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha256-avx-amd64_S	31 Jan 2023 14:53:20 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha256-avx-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,15 @@
>  Index: cipher/sha256-avx-amd64.S
>  --- cipher/sha256-avx-amd64.S.orig
>  +++ cipher/sha256-avx-amd64.S
> -@@ -474,7 +474,7 @@ _gcry_sha256_transform_amd64_avx:
> +@@ -345,6 +345,7 @@ ELF(.type  _gcry_sha256_transform_amd64_avx,@function;
> + .align 16
> + _gcry_sha256_transform_amd64_avx:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	vzeroupper
> + 
> + 	push	rbx
> +@@ -474,7 +475,7 @@ _gcry_sha256_transform_amd64_avx:
>   	ret_spec_stop
>   	CFI_ENDPROC()
>   
> Index: security/libgcrypt/patches/patch-cipher_sha256-avx2-bmi2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha256-avx2-bmi2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha256-avx2-bmi2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha256-avx2-bmi2-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha256-avx2-bmi2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,15 @@
>  Index: cipher/sha256-avx2-bmi2-amd64.S
>  --- cipher/sha256-avx2-bmi2-amd64.S.orig
>  +++ cipher/sha256-avx2-bmi2-amd64.S
> -@@ -477,6 +477,7 @@ _gcry_sha256_transform_amd64_avx2:
> +@@ -250,6 +250,7 @@ ELF(.type _gcry_sha256_transform_amd64_avx2,@function)
> + .align 32
> + _gcry_sha256_transform_amd64_avx2:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	xor eax, eax
> + 
> + 	cmp rdx, 0
> +@@ -477,6 +478,7 @@ _gcry_sha256_transform_amd64_avx2:
>   	ret_spec_stop
>   	CFI_ENDPROC()
>   
> Index: security/libgcrypt/patches/patch-cipher_sha256-ssse3-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha256-ssse3-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha256-ssse3-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha256-ssse3-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha256-ssse3-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,15 @@
>  Index: cipher/sha256-ssse3-amd64.S
>  --- cipher/sha256-ssse3-amd64.S.orig
>  +++ cipher/sha256-ssse3-amd64.S
> -@@ -496,7 +496,7 @@ _gcry_sha256_transform_amd64_ssse3:
> +@@ -352,6 +352,7 @@ ELF(.type  _gcry_sha256_transform_amd64_ssse3,@functio
> + .align 16
> + _gcry_sha256_transform_amd64_ssse3:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	push	rbx
> + 	CFI_PUSH(rbx)
> + 	push	rbp
> +@@ -496,7 +497,7 @@ _gcry_sha256_transform_amd64_ssse3:
>   	ret_spec_stop
>   	CFI_ENDPROC()
>   
> Index: security/libgcrypt/patches/patch-cipher_sha512-avx-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha512-avx-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha512-avx-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha512-avx-amd64_S	31 Jan 2023 14:26:58 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha512-avx-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,15 @@
>  Index: cipher/sha512-avx-amd64.S
>  --- cipher/sha512-avx-amd64.S.orig
>  +++ cipher/sha512-avx-amd64.S
> -@@ -407,7 +407,7 @@ _gcry_sha512_transform_amd64_avx:
> +@@ -249,6 +249,7 @@ ELF(.type _gcry_sha512_transform_amd64_avx,@function;)
> + .align 16
> + _gcry_sha512_transform_amd64_avx:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	xor eax, eax
> + 
> + 	cmp	msglen, 0
> +@@ -407,7 +408,7 @@ _gcry_sha512_transform_amd64_avx:
>   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
>   ;;; Binary Data
>   */
> Index: security/libgcrypt/patches/patch-cipher_sha512-avx2-bmi2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha512-avx2-bmi2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha512-avx2-bmi2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha512-avx2-bmi2-amd64_S	28 Jan 2023 21:02:08 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha512-avx2-bmi2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,15 @@
>  Index: cipher/sha512-avx2-bmi2-amd64.S
>  --- cipher/sha512-avx2-bmi2-amd64.S.orig
>  +++ cipher/sha512-avx2-bmi2-amd64.S
> -@@ -444,7 +444,7 @@ _gcry_sha512_transform_amd64_avx2:
> +@@ -277,6 +277,7 @@ ELF(.type _gcry_sha512_transform_amd64_avx2,@function;
> + .align 16
> + _gcry_sha512_transform_amd64_avx2:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	xor eax, eax
> + 
> + 	cmp rdx, 0
> +@@ -444,7 +445,7 @@ _gcry_sha512_transform_amd64_avx2:
>   
>   /*;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; */
>   /*;; Binary Data */
> Index: security/libgcrypt/patches/patch-cipher_sha512-ssse3-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sha512-ssse3-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sha512-ssse3-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sha512-ssse3-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sha512-ssse3-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,15 @@
>  Index: cipher/sha512-ssse3-amd64.S
>  --- cipher/sha512-ssse3-amd64.S.orig
>  +++ cipher/sha512-ssse3-amd64.S
> -@@ -414,6 +414,7 @@ _gcry_sha512_transform_amd64_ssse3:
> +@@ -252,6 +252,7 @@ ELF(.type _gcry_sha512_transform_amd64_ssse3,@function
> + .align 16
> + _gcry_sha512_transform_amd64_ssse3:
> + 	CFI_STARTPROC()
> ++	endbr64
> + 	xor eax, eax
> + 
> + 	cmp msglen, 0
> +@@ -414,6 +415,7 @@ _gcry_sha512_transform_amd64_ssse3:
>   ;;; Binary Data
>   */
>   
> Index: security/libgcrypt/patches/patch-cipher_sm3-avx-bmi2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sm3-avx-bmi2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sm3-avx-bmi2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sm3-avx-bmi2-amd64_S	28 Jan 2023 21:02:08 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sm3-avx-bmi2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,11 @@ Index: cipher/sm3-avx-bmi2-amd64.S
>   /*
>    * Transform nblks*64 bytes (nblks*16 32-bit words) at DATA.
>    *
> +@@ -351,6 +352,7 @@ _gcry_sm3_transform_amd64_avx_bmi2:
> +    *	%rdx: nblks
> +    */
> +   CFI_STARTPROC();
> ++  endbr64;
> + 
> +   vzeroupper;
> + 
> Index: security/libgcrypt/patches/patch-cipher_sm4-aesni-avx-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sm4-aesni-avx-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sm4-aesni-avx-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sm4-aesni-avx-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sm4-aesni-avx-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,67 @@ Index: cipher/sm4-aesni-avx-amd64.S
>   .align 8
>   .globl _gcry_sm4_aesni_avx_expand_key
>   ELF(.type   _gcry_sm4_aesni_avx_expand_key,@function;)
> +@@ -164,6 +165,7 @@ _gcry_sm4_aesni_avx_expand_key:
> + 	 *	%r8: ck array
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vmovd 0*4(%rdi), RA0;
> + 	vmovd 1*4(%rdi), RA1;
> +@@ -469,6 +471,7 @@ _gcry_sm4_aesni_avx_crypt_blk1_8:
> + 	 *	%rcx: num blocks (1..8)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	cmpq $5, %rcx;
> + 	jb sm4_aesni_avx_crypt_blk1_4;
> +@@ -523,6 +526,7 @@ _gcry_sm4_aesni_avx_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* load IV and byteswap */
> + 	vmovdqu (%rcx), RA0;
> +@@ -597,6 +601,7 @@ _gcry_sm4_aesni_avx_cbc_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vmovdqu (0 * 16)(%rdx), RA0;
> + 	vmovdqu (1 * 16)(%rdx), RA1;
> +@@ -646,6 +651,7 @@ _gcry_sm4_aesni_avx_cfb_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	/* Load input */
> + 	vmovdqu (%rcx), RA0;
> +@@ -701,6 +707,7 @@ _gcry_sm4_aesni_avx_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[8])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	subq $(4 * 8), %rsp;
> + 	CFI_ADJUST_CFA_OFFSET(4 * 8);
> +@@ -800,6 +807,7 @@ _gcry_sm4_aesni_avx_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[8])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	subq $(4 * 8), %rsp;
> + 	CFI_ADJUST_CFA_OFFSET(4 * 8);
> +@@ -908,6 +916,7 @@ _gcry_sm4_aesni_avx_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[8])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	subq $(4 * 8), %rsp;
> + 	CFI_ADJUST_CFA_OFFSET(4 * 8);
> Index: security/libgcrypt/patches/patch-cipher_sm4-aesni-avx2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_sm4-aesni-avx2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_sm4-aesni-avx2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_sm4-aesni-avx2-amd64_S	28 Jan 2023 21:02:08 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_sm4-aesni-avx2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -18,3 +18,51 @@ Index: cipher/sm4-aesni-avx2-amd64.S
>   .align 8
>   ELF(.type   __sm4_crypt_blk16,@function;)
>   __sm4_crypt_blk16:
> +@@ -297,6 +298,7 @@ _gcry_sm4_aesni_avx2_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	movq 8(%rcx), %rax;
> + 	bswapq %rax;
> +@@ -409,6 +411,7 @@ _gcry_sm4_aesni_avx2_cbc_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -462,6 +465,7 @@ _gcry_sm4_aesni_avx2_cfb_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -520,6 +524,7 @@ _gcry_sm4_aesni_avx2_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -634,6 +639,7 @@ _gcry_sm4_aesni_avx2_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -757,6 +763,7 @@ _gcry_sm4_aesni_avx2_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> Index: security/libgcrypt/patches/patch-cipher_twofish-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_twofish-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_twofish-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_twofish-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,67 @@
> +Index: cipher/twofish-amd64.S
> +--- cipher/twofish-amd64.S.orig
> ++++ cipher/twofish-amd64.S
> +@@ -172,6 +172,7 @@ _gcry_twofish_amd64_encrypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	subq $(3 * 8), %rsp;
> +@@ -226,6 +227,7 @@ _gcry_twofish_amd64_decrypt_block:
> + 	 *	%rdx: src
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	subq $(3 * 8), %rsp;
> +@@ -555,6 +557,7 @@ _gcry_twofish_amd64_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	subq $(8 * 8), %rsp;
> +@@ -656,6 +659,7 @@ _gcry_twofish_amd64_cbc_dec:
> + 	 *	%rcx: iv (128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	subq $(9 * 8), %rsp;
> +@@ -741,6 +745,7 @@ _gcry_twofish_amd64_cfb_dec:
> + 	 *	%rcx: iv (128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_0_4
> + 
> + 	subq $(8 * 8), %rsp;
> +@@ -828,6 +833,7 @@ _gcry_twofish_amd64_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[3])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_6
> + 
> + 	subq $(8 * 8), %rsp;
> +@@ -954,6 +960,7 @@ _gcry_twofish_amd64_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[3])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_6
> + 
> + 	subq $(8 * 8), %rsp;
> +@@ -1087,6 +1094,7 @@ _gcry_twofish_amd64_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[3])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	ENTER_SYSV_FUNC_PARAMS_5
> + 
> + 	subq $(8 * 8), %rsp;
> Index: security/libgcrypt/patches/patch-cipher_twofish-avx2-amd64_S
> ===================================================================
> RCS file: /cvs/ports/security/libgcrypt/patches/patch-cipher_twofish-avx2-amd64_S,v
> retrieving revision 1.1
> diff -u -p -r1.1 patch-cipher_twofish-avx2-amd64_S
> --- security/libgcrypt/patches/patch-cipher_twofish-avx2-amd64_S	19 Jan 2023 17:11:02 -0000	1.1
> +++ security/libgcrypt/patches/patch-cipher_twofish-avx2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -1,7 +1,55 @@
>  Index: cipher/twofish-avx2-amd64.S
>  --- cipher/twofish-avx2-amd64.S.orig
>  +++ cipher/twofish-avx2-amd64.S
> -@@ -1036,6 +1036,7 @@ _gcry_twofish_avx2_ocb_auth:
> +@@ -485,6 +485,7 @@ _gcry_twofish_avx2_ctr_enc:
> + 	 *	%rcx: iv (big endian, 128bit)
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	movq 8(%rcx), %rax;
> + 	bswapq %rax;
> +@@ -597,6 +598,7 @@ _gcry_twofish_avx2_cbc_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -650,6 +652,7 @@ _gcry_twofish_avx2_cfb_dec:
> + 	 *	%rcx: iv
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -708,6 +711,7 @@ _gcry_twofish_avx2_ocb_enc:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -822,6 +826,7 @@ _gcry_twofish_avx2_ocb_dec:
> + 	 *	%r9 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -946,6 +951,7 @@ _gcry_twofish_avx2_ocb_auth:
> + 	 *	%r8 : L pointers (void *L[16])
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 
> + 	vzeroupper;
> + 
> +@@ -1036,6 +1042,7 @@ _gcry_twofish_avx2_ocb_auth:
>   	CFI_ENDPROC();
>   ELF(.size _gcry_twofish_avx2_ocb_auth,.-_gcry_twofish_avx2_ocb_auth;)
>   
> Index: security/libgcrypt/patches/patch-cipher_whirlpool-sse2-amd64_S
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-cipher_whirlpool-sse2-amd64_S
> diff -N security/libgcrypt/patches/patch-cipher_whirlpool-sse2-amd64_S
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-cipher_whirlpool-sse2-amd64_S	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,11 @@
> +Index: cipher/whirlpool-sse2-amd64.S
> +--- cipher/whirlpool-sse2-amd64.S.orig
> ++++ cipher/whirlpool-sse2-amd64.S
> +@@ -164,6 +164,7 @@ _gcry_whirlpool_transform_amd64:
> + 	 *      %rcx: look-up tables
> + 	 */
> + 	CFI_STARTPROC();
> ++	endbr64;
> + 	cmp $0, %rdx;
> + 	je .Lskip;
> + 
> Index: security/libgcrypt/patches/patch-mpi_amd64_func_abi_h
> ===================================================================
> RCS file: security/libgcrypt/patches/patch-mpi_amd64_func_abi_h
> diff -N security/libgcrypt/patches/patch-mpi_amd64_func_abi_h
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ security/libgcrypt/patches/patch-mpi_amd64_func_abi_h	20 Feb 2024 11:27:18 -0000
> @@ -0,0 +1,13 @@
> +Index: mpi/amd64/func_abi.h
> +--- mpi/amd64/func_abi.h.orig
> ++++ mpi/amd64/func_abi.h
> +@@ -26,7 +26,8 @@
> + 	CFI_ENDPROC();
> + #else
> +  #define FUNC_ENTRY() \
> +-	CFI_STARTPROC();
> ++	CFI_STARTPROC(); \
> ++	endbr64
> + 
> +  #define FUNC_EXIT() \
> + 	ret_spec_stop; \
> 
>