/* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END */ /* * Copyright 2009 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #ifndef _KERNELSESSION_H #define _KERNELSESSION_H #ifdef __cplusplus extern "C" { #endif #include <pthread.h> #include <sys/crypto/common.h> #include <security/pkcs11t.h> #define KERNELTOKEN_SESSION_MAGIC 0xECF00003 typedef struct crypto_active_op { CK_MECHANISM mech; void *context; uint32_t flags; } crypto_active_op_t; #define EDIGEST_LENGTH 1024 /* Used for emulating digest and HMAC mechs */ typedef struct digest_buf { uint8_t *buf; int buf_len; int indata_len; void *soft_sp; } digest_buf_t; /* * Definition for flags in crypto_active_op_t * * CRYPTO_EMULATE flag is set for a digest or sign/verify with a HMAC * mechanism, if the session slot has a CRYPTO_LIMITED_HASH_SUPPORT flag set. * CRYPTO_EMULATE_USING_SW flag is meaningful only when CRYPTO_EMULATE flag * is set. And CRYPTO_EMULATE_UPDATE_DONE flag is meaningful only when * CRYPTO_EMULATE_USING_SW flag is set. */ #define CRYPTO_OPERATION_ACTIVE 0x00000001 /* Cryptoki operation is active */ #define CRYPTO_OPERATION_UPDATE 0x00000002 /* Cryptoki multi-part op active */ #define CRYPTO_EMULATE 0x00000004 /* op needs emulation */ #define CRYPTO_EMULATE_USING_SW 0x00000008 /* ... use software */ #define CRYPTO_EMULATE_UPDATE_DONE 0x00000010 /* did at least one update */ #define CRYPTO_EMULATE_INIT_DONE 0x00000020 /* did init */ #define CRYPTO_OPERATION_INPLACE_OK 0x00000040 /* INPLACE_MECHANISM is true */ typedef struct session { CK_ULONG magic_marker; /* magic # be validated for integrity */ pthread_mutex_t session_mutex; /* session's mutex lock */ pthread_mutex_t ses_free_mutex; /* mutex used during closing session */ pthread_cond_t ses_free_cond; /* cond variable for signal and wait */ uint32_t ses_refcnt; /* session reference count */ uint32_t ses_close_sync; /* session closing flags */ crypto_session_id_t k_session; /* kernel session ID */ boolean_t ses_RO; /* RO or RW session flag */ CK_SLOT_ID ses_slotid; /* slotID saved from C_OpenSession() */ /* Place holder for parameters passed in the C_OpenSession */ CK_FLAGS flags; CK_NOTIFY Notify; CK_VOID_PTR pApplication; /* Pointers to form the global session list */ struct session *next; /* points to next session on the list */ struct session *prev; /* points to prev session on the list */ struct object *object_list; /* points to list of objects */ crypto_active_op_t digest; /* context of active digest operation */ crypto_active_op_t encrypt; /* context of active encrypt op */ crypto_active_op_t decrypt; /* context of active decrypt op */ crypto_active_op_t sign; /* context of active sign op */ crypto_active_op_t verify; /* context of active verify op */ crypto_active_op_t find_objects; } kernel_session_t; /* * The following structure is used to link the to-be-freed sessions * into a linked list. The sessions on this linked list have * not yet been freed via free() after C_CloseSession() call; instead * they are added to this list. The actual free will take place when * the number of sessions queued reaches MAX_SES_TO_BE_FREED, at which * time the first session in the list will be freed. */ #define MAX_SES_TO_BE_FREED 300 typedef struct ses_to_be_freed_list { kernel_session_t *first; /* points to the first session in the list */ kernel_session_t *last; /* points to the last session in the list */ uint32_t count; /* current total sessions in the list */ pthread_mutex_t ses_to_be_free_mutex; } ses_to_be_freed_list_t; extern ses_to_be_freed_list_t ses_delay_freed; /* * Flag definitions for ses_close_sync */ #define SESSION_IS_CLOSING 1 /* Session is in a closing state */ #define SESSION_REFCNT_WAITING 2 /* Waiting for session reference */ /* count to become zero */ /* * This macro is used to decrement the session reference count by one. * * The caller of this macro uses the argument lock_held to indicate that * whether the caller holds the lock on the session or not. * * REFRELE macro does the following: * 1) Get the session lock if the caller does not hold it. * 2) Decrement the session reference count by one. * 3) If the session reference count becomes zero after being decremented, * and there is a closing session thread in the wait state, then * call pthread_cond_signal() to wake up that thread who is blocked * in the session deletion routine due to non-zero reference ount. * 4) Always release the session lock. */ #define REFRELE(s, ses_lock_held) { \ if (!ses_lock_held) \ (void) pthread_mutex_lock(&s->session_mutex); \ if ((--((s)->ses_refcnt) == 0) && \ (s->ses_close_sync & SESSION_REFCNT_WAITING)) { \ (void) pthread_mutex_unlock(&s->session_mutex); \ (void) pthread_cond_signal(&s->ses_free_cond); \ } else { \ (void) pthread_mutex_unlock(&s->session_mutex); \ } \ } /* * Function Prototypes. */ CK_RV handle2session(CK_SESSION_HANDLE hSession, kernel_session_t **session_p); void kernel_delete_all_sessions(CK_SLOT_ID slotID, boolean_t wrapper_only); void kernel_delete_all_objects_in_session(kernel_session_t *sp, boolean_t wrapper_only); CK_RV kernel_add_session(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication, CK_NOTIFY notify, CK_ULONG *phSession); void kernel_delete_session(CK_SLOT_ID slotID, kernel_session_t *sp, boolean_t lock_held, boolean_t wrapper_only); void kernel_session_delay_free(kernel_session_t *sp); void kernel_acquire_all_slots_mutexes(); void kernel_release_all_slots_mutexes(); #ifdef __cplusplus } #endif #endif /* _KERNELSESSION_H */
