Update to 4.2.2

.gitignore

@@ -1 +1 @@
-SOURCES/libica-4.1.1.tar.gz
+SOURCES/libica-4.2.2.tar.gz

.libica.metadata

@@ -1 +1 @@
-a826ac86ded4ed96804fe19634b02838ab78ac86 SOURCES/libica-4.1.1.tar.gz
+300e2aa5c7de375a161b2390b178134a46818bdd SOURCES/libica-4.2.2.tar.gz

SOURCES/4.2.2-icastats-summary.patch

@@ -0,0 +1,228 @@
+From f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1 Mon Sep 17 00:00:00 2001
+From: Ingo Franzki <ifranzki@linux.ibm.com>
+Date: Tue, 18 Jul 2023 09:21:54 +0200
+Subject: [PATCH] icastats: Fix summary option to display correct summary
+ information
+
+The '--summary' option of icastats did not display correct statistics since
+the introduction of per key keysize counters with libica version 4.0.0.
+
+To display the correct summary counters, the all-key-size-counter values of an
+algorithm that supports multiple key sizes must be calculated like it is done
+in get_stats_data(). Adjust get_stats_data() function and friends so that it
+now also can be called from get_stats_sum() and can optionally operate on a
+specified statistics segment (i.e. the one where the summary statistics have
+been calculated in), not just the global one.
+
+Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+---
+ src/icastats.c         |   4 +-
+ src/icastats_shared.c  | 102 +++++++++++++++++++++++------------------
+ src/include/icastats.h |   5 +-
+ 3 files changed, 62 insertions(+), 49 deletions(-)
+
+diff --git a/src/icastats.c b/src/icastats.c
+index e98617f..07b0d50 100644
+--- a/src/icastats.c
++++ b/src/icastats.c
+@@ -302,7 +302,7 @@ int main(int argc, char *argv[])
+ 				perror("malloc: ");
+ 				return EXIT_FAILURE;
+ 			}
+-			get_stats_data(entries);
++			get_stats_data(NULL, entries);
+ 			if (json) {
+ 				print_stats_json(entries, usr);
+ 			} else {
+@@ -358,7 +358,7 @@ int main(int argc, char *argv[])
+ 			perror("malloc: ");
+ 			return EXIT_FAILURE;
+ 		}
+-		get_stats_data(stats);
++		get_stats_data(NULL, stats);
+ 		if (json) {
+ 			pswd = getpwuid(user == -1 ? geteuid() : (uid_t)user);
+ 			if (pswd == NULL) {
+diff --git a/src/icastats_shared.c b/src/icastats_shared.c
+index 8290239..f8e8563 100644
+--- a/src/icastats_shared.c
++++ b/src/icastats_shared.c
+@@ -124,39 +124,46 @@ void stats_munmap(int user, int unlink)
+  * @direction - valid values are ENCRYPT and DECRYPT
+  */
+ 
+-uint64_t stats_query(stats_fields_t field, int hardware, int direction)
++uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
++		     int hardware, int direction)
+ {
+-	if (stats == NULL)
++	if (source == NULL)
++		source = stats;
++
++	if (source == NULL)
+ 		return 0;
+ 
+ 	if (direction == ENCRYPT)
+ 		if (hardware == ALGO_HW)
+-			return stats[field].enc.hw;
++			return source[field].enc.hw;
+ 		else
+-			return stats[field].enc.sw;
++			return source[field].enc.sw;
+ 	else
+ 		if (hardware == ALGO_HW)
+-			return stats[field].dec.hw;
++			return source[field].dec.hw;
+ 		else
+-			return stats[field].dec.sw;
++			return source[field].dec.sw;
+ }
+ 
+-static uint64_t calc_summary(stats_fields_t start, unsigned int num,
++static uint64_t calc_summary(stats_entry_t *source,
++		             stats_fields_t start, unsigned int num,
+ 		             int hardware, int direction)
+ {
+ 	unsigned int i;
+ 	uint64_t sum = 0;
+ 
+ 	for (i = 0; i < num; i++)
+-		sum += stats_query(start + i, hardware, direction);
++		sum += stats_query(source, start + i, hardware, direction);
+ 
+ 	return sum;
+ }
+ 
+ /* Returns the statistic data in a stats_entry_t array
++ * @source - source of the statistics data. If NULL, then the global stats
++ *           are used, which must have been mapped via stats_mmap() before.
+  * @entries - Needs to be a array of size ICA_NUM_STATS.
+  */
+-void get_stats_data(stats_entry_t *entries)
++void get_stats_data(stats_entry_t *source, stats_entry_t *entries)
+ {
+ 	unsigned int i;
+ 	for (i = 0; i < ICA_NUM_STATS; i++) {
+@@ -168,58 +175,62 @@ void get_stats_data(stats_entry_t *entries)
+ 		case ICA_STATS_AES_CTR:
+ 		case ICA_STATS_AES_CMAC:
+ 		case ICA_STATS_AES_GCM:
+-			entries[i].enc.hw = calc_summary(i + 1, 3,
+-					                 ALGO_HW, ENCRYPT);
+-			entries[i].enc.sw = calc_summary(i + 1, 3,
+-					                 ALGO_SW, ENCRYPT);
+-			entries[i].dec.hw = calc_summary(i + 1, 3,
+-					                 ALGO_HW, DECRYPT);
+-			entries[i].dec.sw = calc_summary(i + 1, 3,
+-					                 ALGO_SW, DECRYPT);
++			entries[i].enc.hw = calc_summary(source, i + 1, 3,
++							 ALGO_HW, ENCRYPT);
++			entries[i].enc.sw = calc_summary(source, i + 1, 3,
++							 ALGO_SW, ENCRYPT);
++			entries[i].dec.hw = calc_summary(source, i + 1, 3,
++							 ALGO_HW, DECRYPT);
++			entries[i].dec.sw = calc_summary(source, i + 1, 3,
++							 ALGO_SW, DECRYPT);
+ 			break;
+ 
+ 		case ICA_STATS_AES_XTS:
+-			entries[i].enc.hw = calc_summary(i + 1, 2,
+-					                 ALGO_HW, ENCRYPT);
+-			entries[i].enc.sw = calc_summary(i + 1, 2,
+-					                 ALGO_SW, ENCRYPT);
+-			entries[i].dec.hw = calc_summary(i + 1, 2,
+-					                 ALGO_HW, DECRYPT);
+-			entries[i].dec.sw = calc_summary(i + 1, 2,
+-					                 ALGO_SW, DECRYPT);
++			entries[i].enc.hw = calc_summary(source, i + 1, 2,
++							 ALGO_HW, ENCRYPT);
++			entries[i].enc.sw = calc_summary(source, i + 1, 2,
++							 ALGO_SW, ENCRYPT);
++			entries[i].dec.hw = calc_summary(source, i + 1, 2,
++							 ALGO_HW, DECRYPT);
++			entries[i].dec.sw = calc_summary(source, i + 1, 2,
++							 ALGO_SW, DECRYPT);
+ 			break;
+ 
+ 		case ICA_STATS_RSA_ME:
+ 		case ICA_STATS_RSA_CRT:
+-			entries[i].enc.hw = calc_summary(i + 1, 4,
+-					                 ALGO_HW, ENCRYPT);
+-			entries[i].enc.sw = calc_summary(i + 1, 4,
+-					                 ALGO_SW, ENCRYPT);
+-			entries[i].dec.hw = calc_summary(i + 1, 4,
+-					                 ALGO_HW, DECRYPT);
+-			entries[i].dec.sw = calc_summary(i + 1, 4,
+-					                 ALGO_SW, DECRYPT);
++			entries[i].enc.hw = calc_summary(source, i + 1, 4,
++							 ALGO_HW, ENCRYPT);
++			entries[i].enc.sw = calc_summary(source, i + 1, 4,
++							 ALGO_SW, ENCRYPT);
++			entries[i].dec.hw = calc_summary(source, i + 1, 4,
++							 ALGO_HW, DECRYPT);
++			entries[i].dec.sw = calc_summary(source, i + 1, 4,
++							 ALGO_SW, DECRYPT);
+ 			break;
+ 
+ 		case ICA_STATS_ECDH:
+ 		case ICA_STATS_ECDSA_SIGN:
+ 		case ICA_STATS_ECDSA_VERIFY:
+ 		case ICA_STATS_ECKGEN:
+-			entries[i].enc.hw = calc_summary(i + 1, 8,
+-					                 ALGO_HW, ENCRYPT);
+-			entries[i].enc.sw = calc_summary(i + 1, 8,
+-					                 ALGO_SW, ENCRYPT);
+-			entries[i].dec.hw = calc_summary(i + 1, 8,
+-					                 ALGO_HW, DECRYPT);
+-			entries[i].dec.sw = calc_summary(i + 1, 8,
+-					                 ALGO_SW, DECRYPT);
++			entries[i].enc.hw = calc_summary(source, i + 1, 8,
++							 ALGO_HW, ENCRYPT);
++			entries[i].enc.sw = calc_summary(source, i + 1, 8,
++							 ALGO_SW, ENCRYPT);
++			entries[i].dec.hw = calc_summary(source, i + 1, 8,
++							 ALGO_HW, DECRYPT);
++			entries[i].dec.sw = calc_summary(source, i + 1, 8,
++							 ALGO_SW, DECRYPT);
+ 			break;
+ 
+ 		default:
+-			entries[i].enc.hw = stats_query(i, ALGO_HW, ENCRYPT);
+-			entries[i].enc.sw = stats_query(i, ALGO_SW, ENCRYPT);
+-			entries[i].dec.hw = stats_query(i, ALGO_HW, DECRYPT);
+-			entries[i].dec.sw = stats_query(i, ALGO_SW, DECRYPT);
++			entries[i].enc.hw = stats_query(source, i,
++							ALGO_HW, ENCRYPT);
++			entries[i].enc.sw = stats_query(source, i,
++							ALGO_SW, ENCRYPT);
++			entries[i].dec.hw = stats_query(source, i,
++							ALGO_HW, DECRYPT);
++			entries[i].dec.sw = stats_query(source, i,
++							ALGO_SW, DECRYPT);
+ 			break;
+ 		}
+ 	}
+@@ -280,6 +291,7 @@ int get_stats_sum(stats_entry_t *sum)
+ 		}
+ 	}
+ 	closedir(shmDir);
++	get_stats_data(sum, sum);
+ 	return 1;
+ }
+ 
+diff --git a/src/include/icastats.h b/src/include/icastats.h
+index f1d70ba..136ac0f 100644
+--- a/src/include/icastats.h
++++ b/src/include/icastats.h
+@@ -286,8 +286,9 @@ typedef enum stats_fields {
+ 
+ int stats_mmap(int user);
+ void stats_munmap(int user, int unlink);
+-uint64_t stats_query(stats_fields_t field, int hardware, int direction);
+-void get_stats_data(stats_entry_t *entries);
++uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
++		     int hardware, int direction);
++void get_stats_data(stats_entry_t *source, stats_entry_t *entries);
+ void stats_increment(stats_fields_t field, int hardware, int direction);
+ int get_stats_sum(stats_entry_t *sum);
+ char *get_next_usr();

SOURCES/libica-4.1.1-revert-abi.patch

@@ -26,7 +26,7 @@ diff --git a/include/ica_api.h b/include/ica_api.h
 index 0263d2f..8f7bbdb 100644
 --- a/include/ica_api.h
 +++ b/include/ica_api.h
-@@ -1447,6 +1447,227 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle,
+@@ -1480,6 +1480,227 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle,
  ICA_EXPORT
  unsigned int ica_rsa_crt_key_check(ica_rsa_key_crt_t *rsa_key);
  
@@ -254,7 +254,7 @@ index 0263d2f..8f7bbdb 100644
  /**
   * Encrypt or decrypt data with an DES key using Electronic Cook Book (ECB)
   * mode as described in NIST Special Publication 800-38A Chapter 6.1.
-@@ -3485,6 +3706,15 @@ void ica_aes_gcm_kma_ctx_free(kma_ctx* ctx);
+@@ -3599,6 +3820,15 @@ int ica_get_hw_info(libica_hw_info *hw_info);
  ICA_EXPORT
  unsigned int ica_get_version(libica_version_info *version_info);
  
@@ -268,8 +268,8 @@ index 0263d2f..8f7bbdb 100644
 +			  unsigned int *pmech_list_len);
 +
  /**
-  * Function that returns a list of crypto mechanisms supported by libica.
+  * Return libica build information.
-  * @param pmech_list
+  *
 diff --git a/libica.map b/libica.map
 index 0a64d4c..0a71832 100644
 --- a/libica.map
@@ -312,7 +312,7 @@ diff --git a/src/ica_api.c b/src/ica_api.c
 index 42d9baf..3e13a29 100644
 --- a/src/ica_api.c
 +++ b/src/ica_api.c
-@@ -2436,6 +2436,264 @@ int ica_ed448_key_gen(ICA_ED448_CTX *ctx)
+@@ -2452,6 +2452,264 @@ int ica_ed448_key_gen(ICA_ED448_CTX *ctx)
   *
   ******************************************************************************/
  
@@ -581,9 +581,9 @@ diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
 index 49cbb09..76f530f 100644
 --- a/src/include/s390_crypto.h
 +++ b/src/include/s390_crypto.h
-@@ -25,11 +25,6 @@
+@@ -30,11 +30,6 @@ int s390_get_fips_indicator(libica_fips_indicator_element *fips_list,
- 
+ 				unsigned int *fips_list_len);
- #include <openssl/opensslv.h>
+ #endif
  
 -/* major 4.0: no more exported, now internal */
 -int s390_initialize_functionlist(void);
@@ -619,7 +619,7 @@ index f220205..f756597 100644
  aes_ecb_test \
  aes_cbc_test \
  aes_ctr_test \
-@@ -71,10 +76,10 @@ get_functionlist_cex_test_SOURCES = get_functionlist_cex_test.c
+@@ -72,10 +77,10 @@ get_functionlist_cex_test_SOURCES = get_functionlist_cex_test.c
  get_functionlist_cex_test_LDADD = @LIBS@ ${top_builddir}/src/.libs/libica-cex.so -lcrypto -lpthread
  
  check_PROGRAMS = fips_test icastats_test get_functionlist_test \
@@ -1596,7 +1596,7 @@ diff --git a/src/ica_api.c b/src/ica_api.c
 index 3e13a29..1bd81bb 100644
 --- a/src/ica_api.c
 +++ b/src/ica_api.c
-@@ -91,6 +91,16 @@ void ica_set_stats_mode(int stats_mode)
+@@ -93,6 +93,16 @@ void ica_set_stats_mode(int stats_mode)
  }
  
  #ifndef NO_CPACF

SOURCES/libica-4.1.1-shmem.patch

@@ -1,35 +0,0 @@
-From cd5b2b75554875111bf375b555ebd3b185cff1a0 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 1 Feb 2023 10:54:33 +0100
-Subject: [libica PATCH] bugfix: permission denied on shared memory segments
-
-A change to the Linux kernel in 4.19 for added security is
-changing the behavior when opening shared memory segments.
-The O_CREAT flag must not be used for existing segments.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/icastats_shared.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/src/icastats_shared.c b/src/icastats_shared.c
-index bbc8d0e..8290239 100644
---- a/src/icastats_shared.c
-+++ b/src/icastats_shared.c
-@@ -54,9 +54,10 @@ int stats_mmap(int user)
- 	sprintf(shm_id, "icastats_%d",
- 		user == -1 ? geteuid() : (uid_t)user);
- 
--	stats_shm_handle = shm_open(shm_id,
--				    O_CREAT | O_RDWR,
--				    S_IRUSR | S_IWUSR);
-+	stats_shm_handle = shm_open(shm_id, O_RDWR,  S_IRUSR | S_IWUSR);
-+
-+	if (stats_shm_handle == -1)
-+		stats_shm_handle = shm_open(shm_id, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
- 
- 	if (stats_shm_handle == -1)
- 		return rc;
--- 
-2.39.1
-

SPECS/libica.spec

@@ -4,8 +4,8 @@
 
 Summary: Library for accessing ICA hardware crypto on IBM z Systems
 Name: libica
-Version: 4.1.1
+Version: 4.2.2
-Release: 2%{?dist}
+Release: 2%{?dist}.alma.1
 License: CPL
 Group: System Environment/Libraries
 URL: https://github.com/opencryptoki/
@@ -17,9 +17,11 @@ Patch0: %{name}-4.0.1-annotate.patch
 # - reverted commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048
 # - partial revert of commit 56b9ac0669e4d204ecb3f23e5404c2351cca96a2
 Patch1: %{name}-4.1.1-revert-abi.patch
-# fix permissions for shared memory segments
+
-# https://bugzilla.redhat.com/show_bug.cgi?id=2167363
+# Patches were taken from:
-Patch2: %{name}-4.1.1-shmem.patch
+# https://github.com/opencryptoki/libica/commit/f09f1d0b48f3bf541f1300716fa
+Patch2: 4.2.2-icastats-summary.patch
+
 BuildRequires: gcc
 BuildRequires: openssl
 BuildRequires: openssl-devel
@@ -110,6 +112,9 @@ fi
 
 
 %changelog
+* Wed Nov 01 2023 Eduard Abdullin <eabdullin@almalinux.org> - 4.2.2-1.alma.1
+- fix permissions for shared memory segments (#2167363)
+
 * Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
 - fix permissions for shared memory segments (#2167363)
 - Resolves: #2167363