commit 1fdd0e4497b0078e73e0004e3492db647c7c458b

Author: Ingo Franzki <ifranzki@linux.ibm.com>

Date:   Wed Feb 24 15:47:05 2021 +0100

    EP11: Handle APQN events to update APQN version, CP infos and target

    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c

index 52f95d7a..728fedd5 100644

--- a/usr/lib/ep11_stdll/ep11_specific.c

+++ b/usr/lib/ep11_stdll/ep11_specific.c

@@ -38,6 +38,7 @@

 #include "ock_syslog.h"

 #include "ec_defs.h"

 #include "p11util.h"

+#include "events.h"

 #include <sys/types.h>

 #include <sys/stat.h>

@@ -197,19 +198,27 @@ typedef struct {

 #define MAX_RETRY_COUNT 100

-#define RETRY_START             do {                                     \

+#define RETRY_START(rc, tokdata)                                         \

+                                do {                                     \

                                     int retry_count;                     \

+                                    ep11_target_info_t* target_info =    \

+                                             get_target_info((tokdata)); \

+                                    if (target_info == NULL)             \

+                                        (rc) = CKR_FUNCTION_FAILED;      \

                                     for(retry_count = 0;                 \

+                                        target_info != NULL &&           \

                                         retry_count < MAX_RETRY_COUNT;   \

                                         retry_count ++) {

 #define RETRY_END(rc, tokdata, session)  if ((rc) != CKR_SESSION_CLOSED) \

                                              break;                      \

                                          (rc) = ep11tok_relogin_session( \

-                                                      tokdata, session); \

+                                                  (tokdata), (session)); \

                                          if ((rc) != CKR_OK)             \

                                              break;                      \

                                     }                                    \

+                                    put_target_info((tokdata),           \

+                                                    target_info);        \

                                 } while (0);

 #define CKF_EP11_HELPER_SESSION      0x80000000

@@ -248,7 +257,6 @@ typedef struct ep11_card_version {

 } ep11_card_version_t;

 static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version);

-static CK_RV ep11tok_get_ep11_version(STDLL_TokData_t *tokdata);

 static void free_card_versions(ep11_card_version_t *card_version);

 static int check_card_version(STDLL_TokData_t *tokdata, CK_ULONG card_type,

                               const CK_VERSION *ep11_lib_version,

@@ -476,16 +484,23 @@ static CK_RV handle_all_ep11_cards(ep11_target_t * ep11_targets,

 #define PKEY_MODE_ENABLE4NONEXTR    2

 typedef struct {

+    volatile unsigned long ref_count;

     target_t target;

+    ep11_card_version_t *card_versions;

+    CK_ULONG used_firmware_API_version;

+    unsigned char control_points[XCP_CP_BYTES];

+    size_t control_points_len;

+    size_t max_control_point_index;

+    CK_CHAR serialNumber[16];

+} ep11_target_info_t;

+

+typedef struct {

     ep11_target_t target_list;

     CK_BYTE raw2key_wrap_blob[MAX_BLOBSIZE];

     size_t raw2key_wrap_blob_l;

     int cka_sensitive_default_true;

     char cp_filter_config_filename[PATH_MAX];

     cp_config_t *cp_config;

-    unsigned char control_points[XCP_CP_BYTES];

-    size_t control_points_len;

-    size_t max_control_point_index;

     int strict_mode;

     int vhsm_mode;

     int optimize_single_ops;

@@ -497,12 +512,14 @@ typedef struct {

     char digest_libica_path[PATH_MAX];

     libica_t libica;

     CK_VERSION ep11_lib_version;

-    ep11_card_version_t *card_versions;

-    CK_ULONG used_firmware_API_version;

-    CK_CHAR serialNumber[16];

+    volatile ep11_target_info_t *target_info;

+    pthread_rwlock_t target_rwlock;

 } ep11_private_data_t;

-static CK_RV ep11tok_setup_target(STDLL_TokData_t *tokdata);

+static ep11_target_info_t *get_target_info(STDLL_TokData_t *tokdata);

+static void put_target_info(STDLL_TokData_t *tokdata,

+                            ep11_target_info_t *target_info);

+static CK_RV refresh_target_info(STDLL_TokData_t *tokdata);

 static CK_RV get_ep11_target_for_apqn(uint_32 adapter, uint_32 domain,

                                       target_t *target, uint64_t flags);

@@ -704,8 +721,13 @@ static CK_RV ep11tok_pkey_get_firmware_mk_vp(STDLL_TokData_t *tokdata)

     CK_BYTE blob[MAX_BLOBSIZE];

     size_t blobsize = sizeof(blob);

     CK_ATTRIBUTE *pkey_attr = NULL, *blob_attr=NULL;

+    ep11_target_info_t* target_info;

     CK_RV ret;

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

+

     /* Check if CPACF_WRAP mech supported */

     if (ep11tok_is_mechanism_supported(tokdata, CKM_IBM_CPACF_WRAP) != CKR_OK) {

         TRACE_INFO("CKM_IBM_CPACF_WRAP not supported on this system.\n");

@@ -717,7 +739,7 @@ static CK_RV ep11tok_pkey_get_firmware_mk_vp(STDLL_TokData_t *tokdata)

     /* Create an AES testkey with CKA_IBM_PROTKEY_EXTRACTABLE */

     ret = dll_m_GenerateKey(&mech, tmpl, tmpl_len, NULL, 0,

-                            blob, &blobsize, csum, &csum_l, ep11_data->target);

+                            blob, &blobsize, csum, &csum_l, target_info->target);

     if (ret != CKR_OK) {

         TRACE_ERROR("dll_m_GenerateKey failed with rc=0x%lx\n",ret);

         goto done;

@@ -749,6 +771,8 @@ done:

     if (blob_attr)

         free(blob_attr);

+    put_target_info(tokdata, target_info);

+

     return ret;

 }

@@ -1337,7 +1361,7 @@ static CK_RV ab_unwrap_update_template(STDLL_TokData_t * tokdata,

                                        OBJECT *obj,

                                        CK_KEY_TYPE keytype)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

+    ep11_target_info_t* target_info;

     CK_RV rc;

     CK_BBOOL trusted, encrypt, decrypt, wrap, unwrap, sign, sign_recover,

              verify, verify_recover, derive, extractable, local,

@@ -1367,9 +1391,16 @@ static CK_RV ab_unwrap_update_template(STDLL_TokData_t * tokdata,

     CK_ATTRIBUTE *attr;

     CK_BBOOL cktrue = TRUE;

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

+

     rc = dll_m_GetAttributeValue(blob, blob_len, attrs,

                                  sizeof(attrs) / sizeof(CK_ATTRIBUTE),

-                                 ep11_data->target);

+                                 target_info->target);

+

+    put_target_info(tokdata, target_info);

+

     if (rc != CKR_OK) {

         TRACE_ERROR("Retrieving attributes from AB unwrapped key failed, rc=0x%lx\n",

                     rc);

@@ -2117,10 +2148,10 @@ static CK_RV rawkey_2_blob(STDLL_TokData_t * tokdata, SESSION * sess,

      * calls the ep11 lib (which in turns sends the request to the card),

      * all m_ function are ep11 functions

      */

-    RETRY_START

+    RETRY_START(rc, tokdata)

         rc = dll_m_EncryptSingle(ep11_data->raw2key_wrap_blob,

                                  ep11_data->raw2key_wrap_blob_l, &mech, key,

-                                 ksize, cipher, &clen, ep11_data->target);

+                                 ksize, cipher, &clen, target_info->target);

     RETRY_END(rc, tokdata, sess)

     if (rc != CKR_OK) {

@@ -2146,12 +2177,12 @@ static CK_RV rawkey_2_blob(STDLL_TokData_t * tokdata, SESSION * sess,

     /* the encrypted key is decrypted and a blob is build,

      * card accepts only blobs as keys

      */

-    RETRY_START

+    RETRY_START(rc, tokdata)

         rc = dll_m_UnwrapKey(cipher, clen, ep11_data->raw2key_wrap_blob,

                              ep11_data->raw2key_wrap_blob_l, NULL, ~0,

                              ep11_pin_blob, ep11_pin_blob_len, &mech,

                              new_p_attrs, new_attrs_len, blob, blen, csum,

-                             &cslen, ep11_data->target);

+                             &cslen, target_info->target);

     RETRY_END(rc, tokdata, sess)

     if (rc != CKR_OK) {

@@ -2194,14 +2225,20 @@ rawkey_2_blob_end:

 CK_RV token_specific_rng(STDLL_TokData_t * tokdata, CK_BYTE * output,

                          CK_ULONG bytes)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

+    ep11_target_info_t* target_info;

+

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

-    CK_RV rc = dll_m_GenerateRandom(output, bytes, ep11_data->target);

+    CK_RV rc = dll_m_GenerateRandom(output, bytes, target_info->target);

     if (rc != CKR_OK) {

         rc = ep11_error_to_pkcs11_error(rc, NULL);

         TRACE_ERROR("%s output=%p bytes=%lu rc=0x%lx\n",

                     __func__, (void *)output, bytes, rc);

     }

+

+    put_target_info(tokdata, target_info);

     return rc;

 }

@@ -2215,6 +2252,7 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in,

 {

     ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_MECHANISM mech = { CKM_AES_KEY_GEN, NULL_PTR, 0 };

+    ep11_target_info_t* target_info;

     CK_BYTE csum[MAX_CSUMSIZE];

     size_t csum_l = sizeof(csum);

     CK_RV rc;

@@ -2225,11 +2263,15 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in,

         return CKR_OK;

     }

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

+

     ep11_data->raw2key_wrap_blob_l = sizeof(ep11_data->raw2key_wrap_blob);

     rc = dll_m_GenerateKey(&mech, tmpl_in, tmpl_len, NULL, 0,

                            ep11_data->raw2key_wrap_blob,

                            &ep11_data->raw2key_wrap_blob_l, csum, &csum_l,

-                           ep11_data->target);

+                           target_info->target);

     if (rc != CKR_OK) {

@@ -2240,6 +2282,7 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in,

                    __func__, ep11_data->raw2key_wrap_blob_l, rc);

     }

+    put_target_info(tokdata, target_info);

     return rc;

 }

@@ -2479,6 +2522,14 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber,

     if (ep11_data == NULL)

         return CKR_HOST_MEMORY;

+    if (pthread_rwlock_init(&ep11_data->target_rwlock, NULL) != 0) {

+        TRACE_DEVEL("Target Lock init failed.\n");

+        OCK_SYSLOG(LOG_ERR, "%s: Failed to initialize the target lock\n",

+                   __func__);

+        rc = CKR_CANT_LOCK;

+        goto error;

+    }

+

     tokdata->private_data = ep11_data;

     /* read ep11 specific config file with user specified

@@ -2513,13 +2564,28 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber,

     }

 #endif

-    rc = ep11tok_get_ep11_version(tokdata);

-    if (rc != CKR_OK)

+    rc = ep11tok_get_ep11_library_version(&ep11_data->ep11_lib_version);

+    if (rc != CKR_OK) {

+        TRACE_ERROR("%s Failed to get the Ep11 library version "

+                    "(ep11tok_get_ep11_library_version rc=0x%lx)\n", __func__,

+                    rc);

+        OCK_SYSLOG(LOG_ERR, "%s: Failed to get the EP11 library version "

+                   "rc=0x%lx\n", __func__, rc);

         goto error;

+    }

-    rc = ep11tok_setup_target(tokdata);

-    if (rc != CKR_OK)

+    TRACE_INFO("%s Host library version: %d.%d\n", __func__,

+               ep11_data->ep11_lib_version.major,

+               ep11_data->ep11_lib_version.minor);

+

+    rc = refresh_target_info(tokdata);

+    if (rc != CKR_OK) {

+        TRACE_ERROR("%s Failed to get the target info (refresh_target_info "

+                    "rc=0x%lx)\n", __func__, rc);

+        OCK_SYSLOG(LOG_ERR, "%s: Failed to get the target info rc=0x%lx\n",

+                   __func__, rc);

         goto error;

+    }

     if (ep11_data->digest_libica) {

         rc = ep11tok_load_libica(tokdata);

@@ -2530,18 +2596,6 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber,

     ep11_data->msa_level = get_msa_level();

     TRACE_INFO("MSA level = %i\n", ep11_data->msa_level);

-    ep11_data->control_points_len = sizeof(ep11_data->control_points);

-    rc = get_control_points(tokdata, ep11_data->control_points,

-                            &ep11_data->control_points_len,

-                            &ep11_data->max_control_point_index);

-    if (rc != CKR_OK) {

-        TRACE_ERROR("%s Failed to get the control points (get_control_points "

-                    "rc=0x%lx)\n", __func__, rc);

-        OCK_SYSLOG(LOG_ERR, "%s: Failed to get the control points rc=0x%lx\n",

-                   __func__, rc);

-        goto error;

-    }

-

     /* create an AES key needed for importing keys

      * (encrypt by wrap_key and m_UnwrapKey by wrap key)

      */

@@ -2600,10 +2654,14 @@ CK_RV ep11tok_final(STDLL_TokData_t * tokdata)

     TRACE_INFO("ep11 %s running\n", __func__);

     if (ep11_data != NULL) {

-        if (dll_m_rm_module != NULL)

-            dll_m_rm_module(NULL, ep11_data->target);

+        if (ep11_data->target_info != NULL) {

+            if (dll_m_rm_module != NULL)

+                dll_m_rm_module(NULL, ep11_data->target_info->target);

+            free_card_versions(ep11_data->target_info->card_versions);

+            free((void* )ep11_data->target_info);

+        }

+        pthread_rwlock_destroy(&ep11_data->target_rwlock);

         free_cp_config(ep11_data->cp_config);

-        free_card_versions(ep11_data->card_versions);

         free(ep11_data);

         tokdata->private_data = NULL;

     }

@@ -2619,7 +2677,6 @@ static CK_RV make_maced_spki(STDLL_TokData_t *tokdata, SESSION * sess,

                              CK_BYTE *spki, CK_ULONG spki_len,

                              CK_BYTE *maced_spki, CK_ULONG *maced_spki_len)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

     unsigned char *ep11_pin_blob = NULL;

     CK_ULONG ep11_pin_blob_len = 0;

     ep11_session_t *ep11_session = (ep11_session_t *) sess->private_data;

@@ -2712,11 +2769,11 @@ static CK_RV make_maced_spki(STDLL_TokData_t *tokdata, SESSION * sess,

     ep11_get_pin_blob(ep11_session, object_is_session_object(pub_key_obj),

                       &ep11_pin_blob, &ep11_pin_blob_len);

-    RETRY_START

+    RETRY_START(rc, tokdata)

         rc = dll_m_UnwrapKey(spki, spki_len, NULL, 0, NULL, 0,

                              ep11_pin_blob, ep11_pin_blob_len, &mech,

                              p_attrs, attrs_len, maced_spki, maced_spki_len,

-                             csum, &cslen, ep11_data->target);

+                             csum, &cslen, target_info->target);

     RETRY_END(rc, tokdata, sess)

     if (rc != CKR_OK) {

@@ -2870,11 +2927,11 @@ static CK_RV import_RSA_key(STDLL_TokData_t * tokdata, SESSION * sess,

         }

         /* encrypt */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_EncryptSingle(ep11_data->raw2key_wrap_blob,

                                      ep11_data->raw2key_wrap_blob_l, &mech_w,

                                      data, data_len, cipher, &cipher_l,

-                                     ep11_data->target);

+                                     target_info->target);

         RETRY_END(rc, tokdata, sess)

         TRACE_INFO("%s wrapping wrap key rc=0x%lx cipher_l=0x%lx\n",

@@ -2901,12 +2958,12 @@ static CK_RV import_RSA_key(STDLL_TokData_t * tokdata, SESSION * sess,

         /* calls the card, it decrypts the private RSA key,

          * reads its BER format and builds a blob.

          */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_UnwrapKey(cipher, cipher_l, ep11_data->raw2key_wrap_blob,

                                  ep11_data->raw2key_wrap_blob_l, NULL, ~0,

                                  ep11_pin_blob, ep11_pin_blob_len, &mech_w,

                                  new_p_attrs, new_attrs_len, blob, blob_size,

-                                 csum, &cslen, ep11_data->target);

+                                 csum, &cslen, target_info->target);

         RETRY_END(rc, tokdata, sess)

         if (rc != CKR_OK) {

@@ -3101,11 +3158,11 @@ static CK_RV import_EC_key(STDLL_TokData_t * tokdata, SESSION * sess,

         }

         /* encrypt */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_EncryptSingle(ep11_data->raw2key_wrap_blob,

                                      ep11_data->raw2key_wrap_blob_l,

                                      &mech_w, data, data_len,

-                                     cipher, &cipher_l, ep11_data->target);

+                                     cipher, &cipher_l, target_info->target);

         RETRY_END(rc, tokdata, sess)

         TRACE_INFO("%s wrapping wrap key rc=0x%lx cipher_l=0x%lx\n",

@@ -3133,14 +3190,14 @@ static CK_RV import_EC_key(STDLL_TokData_t * tokdata, SESSION * sess,

         /* calls the card, it decrypts the private EC key,

          * reads its BER format and builds a blob.

          */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_UnwrapKey(cipher, cipher_l,

                                  ep11_data->raw2key_wrap_blob,

                                  ep11_data->raw2key_wrap_blob_l, NULL, ~0,

                                  ep11_pin_blob,

                                  ep11_pin_blob_len, &mech_w,

                                  new_p_attrs, new_attrs_len, blob,

-                                 blob_size, csum, &cslen, ep11_data->target);

+                                 blob_size, csum, &cslen, target_info->target);

         RETRY_END(rc, tokdata, sess)

         if (rc != CKR_OK) {

@@ -3295,11 +3352,11 @@ static CK_RV import_DSA_key(STDLL_TokData_t * tokdata, SESSION * sess,

         }

         /* encrypt */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_EncryptSingle(ep11_data->raw2key_wrap_blob,

                                      ep11_data->raw2key_wrap_blob_l,

                                      &mech_w, data, data_len,

-                                     cipher, &cipher_l, ep11_data->target);

+                                     cipher, &cipher_l, target_info->target);

         RETRY_END(rc, tokdata, sess)

@@ -3327,14 +3384,14 @@ static CK_RV import_DSA_key(STDLL_TokData_t * tokdata, SESSION * sess,

         /* calls the card, it decrypts the private EC key,

          * reads its BER format and builds a blob.

          */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_UnwrapKey(cipher, cipher_l,

                                  ep11_data->raw2key_wrap_blob,

                                  ep11_data->raw2key_wrap_blob_l, NULL, ~0,

                                  ep11_pin_blob,

                                  ep11_pin_blob_len, &mech_w,

                                  new_p_attrs, new_attrs_len, blob,

-                                 blob_size, csum, &cslen, ep11_data->target);

+                                 blob_size, csum, &cslen, target_info->target);

         RETRY_END(rc, tokdata, sess)

         if (rc != CKR_OK) {

@@ -3478,11 +3535,11 @@ static CK_RV import_DH_key(STDLL_TokData_t * tokdata, SESSION * sess,

         }

         /* encrypt */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_EncryptSingle(ep11_data->raw2key_wrap_blob,

                                      ep11_data->raw2key_wrap_blob_l,

                                      &mech_w, data, data_len,

-                                     cipher, &cipher_l, ep11_data->target);

+                                     cipher, &cipher_l, target_info->target);

         RETRY_END(rc, tokdata, sess)

         TRACE_INFO("%s wrapping wrap key rc=0x%lx cipher_l=0x%lx\n",

@@ -3509,14 +3566,14 @@ static CK_RV import_DH_key(STDLL_TokData_t * tokdata, SESSION * sess,

         /* calls the card, it decrypts the private EC key,

          * reads its BER format and builds a blob.

          */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_UnwrapKey(cipher, cipher_l,

                                  ep11_data->raw2key_wrap_blob,

                                  ep11_data->raw2key_wrap_blob_l, NULL, ~0,

                                  ep11_pin_blob,

                                  ep11_pin_blob_len, &mech_w,

                                  new_p_attrs, new_attrs_len, blob,

-                                 blob_size, csum, &cslen, ep11_data->target);

+                                 blob_size, csum, &cslen, target_info->target);

         RETRY_END(rc, tokdata, sess)

         if (rc != CKR_OK) {

@@ -3666,11 +3723,11 @@ static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t * tokdata, SESSION * sess,

         }

         /* encrypt */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_EncryptSingle(ep11_data->raw2key_wrap_blob,

                                      ep11_data->raw2key_wrap_blob_l,

                                      &mech_w, data, data_len,

-                                     cipher, &cipher_l, ep11_data->target);

+                                     cipher, &cipher_l, target_info->target);

         RETRY_END(rc, tokdata, sess)

         TRACE_INFO("%s wrapping wrap key rc=0x%lx cipher_l=0x%lx\n",

@@ -3699,14 +3756,14 @@ static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t * tokdata, SESSION * sess,

         /* calls the card, it decrypts the private Dilithium key,

          * reads its BER format and builds a blob.

          */

-        RETRY_START

+        RETRY_START(rc, tokdata)

             rc = dll_m_UnwrapKey(cipher, cipher_l,

                                  ep11_data->raw2key_wrap_blob,

                                  ep11_data->raw2key_wrap_blob_l, NULL, ~0,

                                  ep11_pin_blob,

                                  ep11_pin_blob_len, &mech_w,

                                  new_p_attrs, new_attrs_len, blob,

-                                 blob_size, csum, &cslen, ep11_data->target);

+                                 blob_size, csum, &cslen, target_info->target);

         RETRY_END(rc, tokdata, sess)

         if (rc != CKR_OK) {

@@ -3884,7 +3941,6 @@ CK_RV ep11tok_generate_key(STDLL_TokData_t * tokdata, SESSION * session,

                            CK_MECHANISM_PTR mech, CK_ATTRIBUTE_PTR attrs,

                            CK_ULONG attrs_len, CK_OBJECT_HANDLE_PTR handle)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_BYTE blob[MAX_BLOBSIZE];

     size_t blobsize = sizeof(blob);

     CK_BYTE csum[MAX_CSUMSIZE];

@@ -3936,10 +3992,10 @@ CK_RV ep11tok_generate_key(STDLL_TokData_t * tokdata, SESSION * session,

     ep11_get_pin_blob(ep11_session, ep11_is_session_object(attrs, attrs_len),

                       &ep11_pin_blob, &ep11_pin_blob_len);

-    RETRY_START

+    RETRY_START(rc, tokdata)

         rc = dll_m_GenerateKey(mech, new_attrs2, new_attrs2_len, ep11_pin_blob,

                                ep11_pin_blob_len, blob, &blobsize,

-                               csum, &csum_len, ep11_data->target);

+                               csum, &csum_len, target_info->target);

     RETRY_END(rc, tokdata, session)

     if (rc != CKR_OK) {

         rc = ep11_error_to_pkcs11_error(rc, session);

@@ -4354,6 +4410,7 @@ CK_RV token_specific_sha_init(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

     size_t state_len = MAX(MAX_DIGEST_STATE_BYTES, sizeof(libica_sha_context_t));

     CK_BYTE *state;

     libica_sha_context_t *libica_ctx;

+    ep11_target_info_t* target_info;

     state = calloc(state_len, 1); /* freed by dig_mgr.c */

     if (!state) {

@@ -4361,15 +4418,21 @@ CK_RV token_specific_sha_init(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

         return CKR_HOST_MEMORY;

     }

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

+

     if (ep11tok_libica_digest_available(ep11_data, mech->mechanism)) {

         libica_ctx = (libica_sha_context_t *)state;

         state_len = sizeof(libica_sha_context_t);

         libica_ctx->first = CK_TRUE;

         rc = get_sha_block_size(mech->mechanism, &libica_ctx->block_size);

     } else {

-        rc = dll_m_DigestInit(state, &state_len, mech, ep11_data->target);

+        rc = dll_m_DigestInit(state, &state_len, mech, target_info->target);

     }

+    put_target_info(tokdata, target_info);

+

     if (rc != CKR_OK) {

         rc = ep11_error_to_pkcs11_error(rc, NULL);

         TRACE_ERROR("%s rc=0x%lx\n", __func__, rc);

@@ -4399,6 +4462,11 @@ CK_RV token_specific_sha(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

 {

     ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_RV rc;

+    ep11_target_info_t* target_info;

+

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

     if (ep11tok_libica_digest_available(ep11_data, c->mech.mechanism)) {

         rc = ep11tok_libica_digest(ep11_data, c->mech.mechanism,

@@ -4408,7 +4476,7 @@ CK_RV token_specific_sha(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

                                    SHA_MSG_PART_ONLY);

     } else {

         rc = dll_m_Digest(c->context, c->context_len, in_data, in_data_len,

-                          out_data, out_data_len, ep11_data->target);

+                          out_data, out_data_len, target_info->target);

     }

     if (rc != CKR_OK) {

@@ -4417,6 +4485,8 @@ CK_RV token_specific_sha(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

     } else {

         TRACE_INFO("%s rc=0x%lx\n", __func__, rc);

     }

+

+    put_target_info(tokdata, target_info);

     return rc;

 }

@@ -4430,6 +4500,11 @@ CK_RV token_specific_sha_update(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

     CK_ULONG out_len = sizeof(temp_out);

     CK_ULONG len;

     CK_RV rc = CKR_OK;

+    ep11_target_info_t* target_info;

+

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

     if (ep11tok_libica_digest_available(ep11_data, c->mech.mechanism)) {

         if (libica_ctx->offset > 0 || in_data_len < libica_ctx->block_size) {

@@ -4479,7 +4554,7 @@ CK_RV token_specific_sha_update(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

         }

     } else {

         rc = dll_m_DigestUpdate(c->context, c->context_len,

-                                in_data, in_data_len, ep11_data->target);

+                                in_data, in_data_len, target_info->target);

     }

 out:

@@ -4489,6 +4564,8 @@ out:

     } else {

         TRACE_INFO("%s rc=0x%lx\n", __func__, rc);

     }

+

+    put_target_info(tokdata, target_info);

     return rc;

 }

@@ -4499,6 +4576,11 @@ CK_RV token_specific_sha_final(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

     ep11_private_data_t *ep11_data = tokdata->private_data;

     libica_sha_context_t *libica_ctx = (libica_sha_context_t *)c->context;

     CK_RV rc;

+    ep11_target_info_t* target_info;

+

+    target_info = get_target_info(tokdata);

+    if (target_info == NULL)

+        return CKR_FUNCTION_FAILED;

     if (ep11tok_libica_digest_available(ep11_data, c->mech.mechanism)) {

         rc = ep11tok_libica_digest(ep11_data, c->mech.mechanism,

@@ -4510,7 +4592,7 @@ CK_RV token_specific_sha_final(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

                                         SHA_MSG_PART_FINAL);

     } else {

         rc = dll_m_DigestFinal(c->context, c->context_len,

-                               out_data, out_data_len, ep11_data->target);

+                               out_data, out_data_len, target_info->target);

     }

     if (rc != CKR_OK) {

@@ -4520,6 +4602,7 @@ CK_RV token_specific_sha_final(STDLL_TokData_t * tokdata, DIGEST_CONTEXT * c,

         TRACE_INFO("%s rc=0x%lx\n", __func__, rc);

     }

+    put_target_info(tokdata, target_info);

     return rc;

 }

@@ -4528,7 +4611,6 @@ CK_RV token_specific_rsa_sign(STDLL_TokData_t *tokdata, SESSION *session,

                               CK_BYTE *out_data, CK_ULONG *out_data_len,

                               OBJECT *key_obj)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_RV rc;

     size_t keyblobsize = 0;

     CK_BYTE *keyblob;

@@ -4544,9 +4626,9 @@ CK_RV token_specific_rsa_sign(STDLL_TokData_t *tokdata, SESSION *session,

     mech.pParameter = NULL;

     mech.ulParameterLen = 0;

-    RETRY_START

+    RETRY_START(rc, tokdata)

     rc = dll_m_SignSingle(keyblob, keyblobsize, &mech, in_data, in_data_len,

-                          out_data, out_data_len, ep11_data->target);

+                          out_data, out_data_len, target_info->target);

     RETRY_END(rc, tokdata, session)

     if (rc != CKR_OK) {

         rc = ep11_error_to_pkcs11_error(rc, session);

@@ -4563,7 +4645,6 @@ CK_RV token_specific_rsa_verify(STDLL_TokData_t *tokdata, SESSION *session,

                                 CK_BYTE *signature, CK_ULONG sig_len,

                                 OBJECT *key_obj)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_RV rc;

     CK_BYTE *spki;

     size_t spki_len = 0;

@@ -4579,9 +4660,9 @@ CK_RV token_specific_rsa_verify(STDLL_TokData_t *tokdata, SESSION *session,

     mech.pParameter = NULL;

     mech.ulParameterLen = 0;

-    RETRY_START

+    RETRY_START(rc, tokdata)

     rc = dll_m_VerifySingle(spki, spki_len, &mech, in_data, in_data_len,

-                            signature, sig_len, ep11_data->target);

+                            signature, sig_len, target_info->target);

     RETRY_END(rc, tokdata, session)

     if (rc != CKR_OK) {

         rc = ep11_error_to_pkcs11_error(rc, session);

@@ -4598,7 +4679,6 @@ CK_RV token_specific_rsa_pss_sign(STDLL_TokData_t *tokdata, SESSION *session,

                                   CK_BYTE *in_data, CK_ULONG in_data_len,

                                   CK_BYTE *sig, CK_ULONG *sig_len)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_RV rc;

     size_t keyblobsize = 0;

     CK_BYTE *keyblob;

@@ -4616,9 +4696,9 @@ CK_RV token_specific_rsa_pss_sign(STDLL_TokData_t *tokdata, SESSION *session,

     mech.ulParameterLen = ctx->mech.ulParameterLen;

     mech.pParameter = ctx->mech.pParameter;

-    RETRY_START

+    RETRY_START(rc, tokdata)

     rc = dll_m_SignSingle(keyblob, keyblobsize, &mech, in_data, in_data_len,

-                          sig, sig_len, ep11_data->target);

+                          sig, sig_len, target_info->target);

     RETRY_END(rc, tokdata, session)

     if (rc != CKR_OK) {

         rc = ep11_error_to_pkcs11_error(rc, session);

@@ -4638,7 +4718,6 @@ CK_RV token_specific_rsa_pss_verify(STDLL_TokData_t *tokdata, SESSION *session,

                                     CK_BYTE *in_data, CK_ULONG in_data_len,

                                     CK_BYTE *signature, CK_ULONG sig_len)

 {

-    ep11_private_data_t *ep11_data = tokdata->private_data;

     CK_RV rc;

     CK_BYTE *spki;

     size_t spki_len = 0;

@@ -4656,9 +4735,9 @@ CK_RV token_specific_rsa_pss_verify(STDLL_TokData_t *tokdata, SESSION *session,

     mech.ulParameterLen = ctx->mech.ulParameterLen;

     mech.pParameter = ctx->mech.pParameter;