- updated to 4.3.1 (RHEL-50087)

- Resolves: RHEL-50087

libica-4.3.0-fixes.patch

@@ -1,130 +0,0 @@
-From 49d619ea05743a3df6b9bf8160aaa0b4306118db Mon Sep 17 00:00:00 2001
-From: Holger Dengler <dengler@linux.ibm.com>
-Date: Tue, 16 Apr 2024 14:18:23 +0200
-Subject: [PATCH 1/2] test: disable CEX usage in OpenSSL for all tests
-
-OpenSSL supports CEX exploitation since version v3.2.x. Libica and its
-testcases use OpenSSL as helper and fallback, so disable the CEX
-acceleration for all tests.
-
-If the environment variable is already set, use it as is without
-modifying it. In this case, it is up to the user to choose the right
-settings.
-
-Fixes: Issue #126
-Link: https://github.com/opencryptoki/libica/issues/126
-Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
----
- test/Makefile.am | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/test/Makefile.am b/test/Makefile.am
-index 76d4f15..e56b256 100644
---- a/test/Makefile.am
-+++ b/test/Makefile.am
-@@ -61,10 +61,14 @@ TESTS += \
- ${top_builddir}/src/internal_tests/ec_internal_test
- endif
- 
-+# disable OpenSSL CEX usage for all tests
-+OPENSSL_s390xcap ?= nocex
-+
- TEST_EXTENSIONS = .sh .pl
- TESTS_ENVIRONMENT = export LD_LIBRARY_PATH=${builddir}/../src/.libs/:$$LD_LIBRARY_PATH \
- 			   PATH=${builddir}/../src/:$$PATH \
--			   LIBICA_TESTDATA=${srcdir}/testdata/;
-+			   LIBICA_TESTDATA=${srcdir}/testdata/ \
-+			   OPENSSL_s390xcap=${OPENSSL_s390xcap};
- AM_CFLAGS = @FLAGS@ -DNO_SW_FALLBACKS -I${srcdir}/../include/ -I${srcdir}/../src/include/
- LDADD = @LIBS@ ${top_builddir}/src/.libs/libica.so -lcrypto -lpthread
- 
--- 
-2.45.1
-
-
-From d3a7542e7eb45c22066ecb1be62480dde41fd544 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 24 Apr 2024 10:44:26 +0200
-Subject: [PATCH 2/2] Bugfix: correct rc handling with s390_pcc function
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/include/s390_aes.h    |  2 +-
- src/include/s390_cmac.h   |  2 +-
- src/include/s390_crypto.h | 23 +++++++++++++----------
- 3 files changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/src/include/s390_aes.h b/src/include/s390_aes.h
-index 6252dde..a6ff27b 100644
---- a/src/include/s390_aes.h
-+++ b/src/include/s390_aes.h
-@@ -674,7 +674,7 @@ static inline int s390_aes_xts_parm(unsigned long function_code,
- 
- 	memset(&parm_block.keys, 0, key_size);
- 
--	if (rc >= 0) {
-+	if (rc == 0) {
- 		memcpy(xts_parm, parm_block.xts_parameter,
- 		       sizeof(ica_aes_vector_t));
- 		return 0;
-diff --git a/src/include/s390_cmac.h b/src/include/s390_cmac.h
-index 76b9cca..f19c069 100644
---- a/src/include/s390_cmac.h
-+++ b/src/include/s390_cmac.h
-@@ -161,7 +161,7 @@ static inline int s390_cmac_hw(unsigned long fc,
- 		/* calculate final block (last/full) */
- 		rc = s390_pcc(fc, pb_lookup.base);
- 		memset(pb_lookup.keys, 0, key_size);
--		if (rc < 0)
-+		if (rc != 0)
- 			return EIO;
- 
- 		_stats_increment(fc, ALGO_HW, ENCRYPT);
-diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
-index f34241f..f11eacb 100644
---- a/src/include/s390_crypto.h
-+++ b/src/include/s390_crypto.h
-@@ -244,27 +244,30 @@ void s390_crypto_switches_init(void);
- 
- /**
-  * s390_pcc:
-- * @func: the function code passed to KM; see s390_pcc_functions
-+ * @func: the function code passed to PCC; see s390_pcc_functions
-  * @param: address of parameter block; see POP for details on each func
-  *
-  * Executes the PCC operation of the CPU.
-  *
-- * Returns -1 for failure, 0 for the query func, number of processed
-- * bytes for encryption/decryption funcs
-+ * Returns condition code of the PCC instruction
-  */
- static inline int s390_pcc(unsigned long func, void *param)
- {
- 	register unsigned long r0 asm("0") = (unsigned long)func;
- 	register unsigned long r1 asm("1") = (unsigned long)param;
-+	char cc;
- 
--	asm volatile (
--		"0:	.long	%[opc] << 16\n"
--		"	brc	1,0b\n"
--		:
--		: [fc] "d" (r0), [param] "a" (r1), [opc] "i" (0xb92c)
--		: "cc", "memory");
-+	asm volatile(
-+		"0:     .insn   rre,%[opc] << 16,0,0\n" /* PCC opcode */
-+		"       brc     1,0b\n" /* handle partial completion */
-+		"       ipm     %[cc]\n"
-+		"       srl     %[cc],28\n"
-+		: [cc] "=d" (cc)
-+		: [func] "d" (r0), [param] "a" (r1), [opc] "i" (0xb92c)
-+		: "cc", "memory"
-+	);
- 
--	return 0;
-+	return cc;
- }
- 
- /**
--- 
-2.45.1
-

libica.spec

@@ -2,7 +2,7 @@
 
 Summary: Library for accessing ICA hardware crypto on IBM z Systems
 Name: libica
-Version: 4.3.0
+Version: 4.3.1
 Release: 1%{?dist}
 License: CPL
 URL: https://github.com/opencryptoki/
@@ -11,8 +11,6 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
 # https://bugzilla.redhat.com/show_bug.cgi?id=1630582
 # https://github.com/opencryptoki/libica/pull/24
 Patch0: %{name}-4.0.0-annotate.patch
-# post GA fixes
-Patch1: %{name}-%{version}-fixes.patch
 BuildRequires: gcc
 BuildRequires: openssl-devel
 BuildRequires: openssl
@@ -109,6 +107,10 @@ fi
 
 
 %changelog
+* Thu Nov 07 2024 Dan Horák <dhorak@redhat.com> - 4.3.1-1
+- updated to 4.3.1 (RHEL-50087)
+- Resolves: RHEL-50087
+
 * Mon May 27 2024 Dan Horák <dhorak@redhat.com> - 4.3.0-1
 - updated to 4.3.0 (RHEL-23703)
 - Resolves: RHEL-23703

sources

@@ -1 +1 @@
-SHA512 (libica-4.3.0.tar.gz) = 0952e0c7005756faf90cccf824cf5d3c22a45076008edb0622030ca148dbacb8752e6ece5b22b06b877ca7038ecca3e1c26ab66bc19328ed36784320ec27071d
+SHA512 (libica-4.3.1.tar.gz) = 3298b188bb29a98a436de0f15b669a56d00edb6418b8b4f370598569702815dac50ebb6ef5bafefe00dbc31067aa5b43bbb27d2e7a2ef82900b1f357b1acfc69