xref: /illumos-gate/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelSession.h (revision 6d2259e1baf8d4ac11c96570f45ecdcd9771a68d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef _KERNELSESSION_H
27 #define	_KERNELSESSION_H
28 
29 #ifdef __cplusplus
30 extern "C" {
31 #endif
32 
33 #include <pthread.h>
34 #include <sys/crypto/common.h>
35 #include <security/pkcs11t.h>
36 
37 
38 #define	KERNELTOKEN_SESSION_MAGIC	0xECF00003
39 
40 typedef struct crypto_active_op {
41 	CK_MECHANISM	mech;
42 	void		*context;
43 	uint32_t	flags;
44 } crypto_active_op_t;
45 
46 #define	EDIGEST_LENGTH  1024
47 
48 /* Used for emulating digest and HMAC mechs */
49 typedef struct digest_buf {
50 	uint8_t		*buf;
51 	int		buf_len;
52 	int		indata_len;
53 	void		*soft_sp;
54 } digest_buf_t;
55 
56 /*
57  * Definition for flags in crypto_active_op_t
58  *
59  * CRYPTO_EMULATE flag is set for a digest or sign/verify with a HMAC
60  * mechanism, if the session slot has a CRYPTO_LIMITED_HASH_SUPPORT flag set.
61  * CRYPTO_EMULATE_USING_SW flag is meaningful only when CRYPTO_EMULATE flag
62  * is set. And CRYPTO_EMULATE_UPDATE_DONE flag is meaningful only when
63  * CRYPTO_EMULATE_USING_SW flag is set.
64  */
65 #define	CRYPTO_OPERATION_ACTIVE	0x00000001 /* Cryptoki operation is active */
66 #define	CRYPTO_OPERATION_UPDATE	0x00000002 /* Cryptoki multi-part op active */
67 #define	CRYPTO_EMULATE		0x00000004 /* op needs emulation */
68 #define	CRYPTO_EMULATE_USING_SW	0x00000008 /* ... use software */
69 #define	CRYPTO_EMULATE_UPDATE_DONE 0x00000010 /* did at least one update */
70 #define	CRYPTO_EMULATE_INIT_DONE 0x00000020 /* did init */
71 #define	CRYPTO_OPERATION_INPLACE_OK 0x00000040 /* INPLACE_MECHANISM is true */
72 
73 typedef struct session {
74 	CK_ULONG	magic_marker;	/* magic # be validated for integrity */
75 	pthread_mutex_t	session_mutex;	/* session's mutex lock */
76 	pthread_mutex_t ses_free_mutex;	/* mutex used during closing session */
77 	pthread_cond_t	ses_free_cond;	/* cond variable for signal and wait */
78 	uint32_t	ses_refcnt;	/* session reference count */
79 	uint32_t	ses_close_sync;	/* session closing flags */
80 	crypto_session_id_t k_session;	/* kernel session ID */
81 	boolean_t	ses_RO;		/* RO or RW session flag */
82 	CK_SLOT_ID	ses_slotid;	/* slotID saved from C_OpenSession() */
83 
84 	/* Place holder for parameters passed in the C_OpenSession */
85 	CK_FLAGS	flags;
86 	CK_NOTIFY	Notify;
87 	CK_VOID_PTR	pApplication;
88 
89 	/* Pointers to form the global session list */
90 	struct session	*next;		/* points to next session on the list */
91 	struct session	*prev;		/* points to prev session on the list */
92 
93 	struct object	*object_list;	/* points to list of objects */
94 
95 	crypto_active_op_t	digest;	/* context of active digest operation */
96 	crypto_active_op_t	encrypt; /* context of active encrypt op */
97 	crypto_active_op_t	decrypt; /* context of active decrypt op */
98 	crypto_active_op_t	sign;	/* context of active sign op */
99 	crypto_active_op_t	verify;	/* context of active verify op */
100 	crypto_active_op_t	find_objects;
101 } kernel_session_t;
102 
103 /*
104  * The following structure is used to link the to-be-freed sessions
105  * into a linked list. The sessions on this linked list have
106  * not yet been freed via free() after C_CloseSession() call; instead
107  * they are added to this list. The actual free will take place when
108  * the number of sessions queued reaches MAX_SES_TO_BE_FREED, at which
109  * time the first session in the list will be freed.
110  */
111 #define	MAX_SES_TO_BE_FREED		300
112 
113 typedef struct ses_to_be_freed_list {
114 	kernel_session_t *first; /* points to the first session in the list */
115 	kernel_session_t *last;  /* points to the last session in the list */
116 	uint32_t	count;   /* current total sessions in the list */
117 	pthread_mutex_t ses_to_be_free_mutex;
118 } ses_to_be_freed_list_t;
119 
120 extern ses_to_be_freed_list_t ses_delay_freed;
121 
122 /*
123  * Flag definitions for ses_close_sync
124  */
125 #define	SESSION_IS_CLOSING	1	/* Session is in a closing state */
126 #define	SESSION_REFCNT_WAITING	2	/* Waiting for session reference */
127 					/* count to become zero */
128 /*
129  * This macro is used to decrement the session reference count by one.
130  *
131  * The caller of this macro uses the argument lock_held to indicate that
132  * whether the caller holds the lock on the session or not.
133  *
134  * REFRELE macro does the following:
135  * 1) Get the session lock if the caller does not hold it.
136  * 2) Decrement the session reference count by one.
137  * 3) If the session reference count becomes zero after being decremented,
138  *    and there is a closing session thread in the wait state, then
139  *    call pthread_cond_signal() to wake up that thread who is blocked
140  *    in the session deletion routine due to non-zero reference ount.
141  * 4) Always release the session lock.
142  */
143 #define	REFRELE(s, ses_lock_held) { \
144 	if (!ses_lock_held) \
145 		(void) pthread_mutex_lock(&s->session_mutex);   \
146 	if ((--((s)->ses_refcnt) == 0) &&    \
147 	    (s->ses_close_sync & SESSION_REFCNT_WAITING)) {     \
148 		(void) pthread_mutex_unlock(&s->session_mutex);   \
149 		(void) pthread_cond_signal(&s->ses_free_cond); \
150 	} else {        \
151 		(void) pthread_mutex_unlock(&s->session_mutex);   \
152 	}       \
153 }
154 
155 
156 /*
157  * Function Prototypes.
158  */
159 CK_RV handle2session(CK_SESSION_HANDLE hSession, kernel_session_t **session_p);
160 
161 void kernel_delete_all_sessions(CK_SLOT_ID slotID, boolean_t wrapper_only);
162 
163 void kernel_delete_all_objects_in_session(kernel_session_t *sp,
164     boolean_t wrapper_only);
165 
166 CK_RV kernel_add_session(CK_SLOT_ID slotID, CK_FLAGS flags,
167     CK_VOID_PTR pApplication, CK_NOTIFY notify, CK_ULONG *phSession);
168 
169 void kernel_delete_session(CK_SLOT_ID slotID, kernel_session_t *sp,
170     boolean_t lock_held, boolean_t wrapper_only);
171 
172 void kernel_session_delay_free(kernel_session_t *sp);
173 
174 void kernel_acquire_all_slots_mutexes();
175 void kernel_release_all_slots_mutexes();
176 
177 #ifdef	__cplusplus
178 }
179 #endif
180 
181 #endif /* _KERNELSESSION_H */
182