PH71571: FIX AES-GCM ASSIST CHECK IN IBMJCECCA

APAR status

• Closed as program error.

Error description

• Error Message: Illegal instruction Exception in the
  HIKM_AES_GCM_ASSIST native code
  .
  Stack Trace: ...
  CEEOSIGG+0xe81c0500 (, 0x0000000000000000)
  CELQHROD+0xe845d0e0 (, 0x0000000000000000)
  HIKM_AES_GCM_ASSIST+0x873ffa38 (, 0x0000000000000000)
  KMGCMD_internal+0x873fb658 (, 0x0000000000000000)
  Java_com_ibm_crypto_hdwrCCA_provider_HIKM_KMGCMD+0x873eaf10 (,
  0x0000000000000000)
  FFISYS+0x83bff9f0 (, 0x0000000000000000)
  ffi_call+0x838c1a28 (, 0x0000000000000000)
  ...
  .
  

Local fix

• Use OpenJCEPlus instead to avoid the hardware AES-GCM (KMA)
  execution path.
  

Problem summary

• IBMJCECCA added an AES-GCM fast path that uses direct KMA
  instructions and bypasses ICSF, but relied only on STFLE
  detection and could incorrectly attempt hardware execution on
  systems without CPACF.
  

Problem conclusion

• Added a check to ensure CPACF support is present before using
  the AES-GCM fast path.
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
     21              21.0.12.0
     17              17.0.20.0
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For the z/OS operating system:
    - Java SDK Products on z/OS
      https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels