Skip to content

Commit 46ae6eb

Browse files
Lars Silvénlarssilven
Lars Silvén
authored and
larssilven
committed
Do not refresh object store before fetching object.
Before this commit the object store for a file token was always refreshed by reading the file of the token every time an object of the token was fetched. Now the HSM may be configured not to refresh when fetching an object. But the refresh will still be done after an application gets a handle for an object. The reason for this change is that the CPU time consumed by the reading may not be negligible for some HW. It is only the objects store on file that are affected by this feature. If DB is used refreshing will always be done since the is then no difference in CPU usage.
1 parent 6d75f15 commit 46ae6eb

23 files changed

+410
-124
lines changed

‎compile_commands.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
[
2+
{
3+
"arguments": [
4+
"/usr/bin/g++",
5+
"-DHAVE_CONFIG_H",
6+
"-I.",
7+
"-I../../..",
8+
"-I./..",
9+
"-I./../common",
10+
"-I./../crypto",
11+
"-I./../data_mgr",
12+
"-I./../pkcs11",
13+
"-g",
14+
"-O2",
15+
"-Wall",
16+
"-Wextra",
17+
"-fvisibility=hidden",
18+
"-c",
19+
"-fPIC",
20+
"-DPIC",
21+
"-o",
22+
".libs/OSToken.o",
23+
"OSToken.cpp"
24+
],
25+
"directory": "/home/lars/work/PWE/SoftHSMv2/git/src/lib/object_store",
26+
"file": "/home/lars/work/PWE/SoftHSMv2/git/src/lib/object_store/OSToken.cpp",
27+
"output": "/home/lars/work/PWE/SoftHSMv2/git/src/lib/object_store/.libs/OSToken.o"
28+
}
29+
]

‎src/lib/SoftHSM.cpp‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -610,6 +610,8 @@ CK_RV SoftHSM::C_Initialize(CK_VOID_PTR pInitArgs)
610610
// Load the handle manager
611611
handleManager = new HandleManager();
612612

613+
doRefresh = Configuration::i()->getBool("objectstore.readrefresh", true);
614+
613615
// Set the state to initialised
614616
isInitialised = true;
615617

@@ -1608,7 +1610,7 @@ CK_RV SoftHSM::C_CopyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject
16081610

16091611
// Check the object handle.
16101612
OSObject *object = (OSObject *)handleManager->getObject(hObject);
1611-
if (object == NULL_PTR || !object->isValid()) return CKR_OBJECT_HANDLE_INVALID;
1613+
if (object == NULL_PTR || !object->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
16121614

16131615
CK_BBOOL wasOnToken = object->getBooleanValue(CKA_TOKEN, false);
16141616
CK_BBOOL wasPrivate = object->getBooleanValue(CKA_PRIVATE, true);
@@ -1777,7 +1779,7 @@ CK_RV SoftHSM::C_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObj
17771779

17781780
// Check the object handle.
17791781
OSObject *object = (OSObject *)handleManager->getObject(hObject);
1780-
if (object == NULL_PTR || !object->isValid()) return CKR_OBJECT_HANDLE_INVALID;
1782+
if (object == NULL_PTR || !object->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
17811783

17821784
CK_BBOOL isOnToken = object->getBooleanValue(CKA_TOKEN, false);
17831785
CK_BBOOL isPrivate = object->getBooleanValue(CKA_PRIVATE, true);
@@ -1825,7 +1827,7 @@ CK_RV SoftHSM::C_GetObjectSize(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObj
18251827

18261828
// Check the object handle.
18271829
OSObject *object = (OSObject *)handleManager->getObject(hObject);
1828-
if (object == NULL_PTR || !object->isValid()) return CKR_OBJECT_HANDLE_INVALID;
1830+
if (object == NULL_PTR || !object->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
18291831

18301832
*pulSize = CK_UNAVAILABLE_INFORMATION;
18311833

@@ -1849,7 +1851,7 @@ CK_RV SoftHSM::C_GetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE
18491851

18501852
// Check the object handle.
18511853
OSObject *object = (OSObject *)handleManager->getObject(hObject);
1852-
if (object == NULL_PTR || !object->isValid()) return CKR_OBJECT_HANDLE_INVALID;
1854+
if (object == NULL_PTR || !object->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
18531855

18541856
CK_BBOOL isOnToken = object->getBooleanValue(CKA_TOKEN, false);
18551857
CK_BBOOL isPrivate = object->getBooleanValue(CKA_PRIVATE, true);
@@ -1896,7 +1898,7 @@ CK_RV SoftHSM::C_SetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE
18961898

18971899
// Check the object handle.
18981900
OSObject *object = (OSObject *)handleManager->getObject(hObject);
1899-
if (object == NULL_PTR || !object->isValid()) return CKR_OBJECT_HANDLE_INVALID;
1901+
if (object == NULL_PTR || !object->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
19001902

19011903
CK_BBOOL isOnToken = object->getBooleanValue(CKA_TOKEN, false);
19021904
CK_BBOOL isPrivate = object->getBooleanValue(CKA_PRIVATE, true);
@@ -2166,7 +2168,7 @@ CK_RV SoftHSM::SymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
21662168

21672169
// Check the key handle.
21682170
OSObject *key = (OSObject *)handleManager->getObject(hKey);
2169-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
2171+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
21702172

21712173
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
21722174
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -2414,7 +2416,7 @@ CK_RV SoftHSM::AsymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMec
24142416

24152417
// Check the key handle.
24162418
OSObject *key = (OSObject *)handleManager->getObject(hKey);
2417-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
2419+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
24182420

24192421
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
24202422
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -2895,7 +2897,7 @@ CK_RV SoftHSM::SymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
28952897

28962898
// Check the key handle.
28972899
OSObject *key = (OSObject *)handleManager->getObject(hKey);
2898-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
2900+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
28992901

29002902
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
29012903
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -3144,7 +3146,7 @@ CK_RV SoftHSM::AsymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMec
31443146

31453147
// Check the key handle.
31463148
OSObject *key = (OSObject *)handleManager->getObject(hKey);
3147-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
3149+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
31483150

31493151
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
31503152
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -3795,7 +3797,7 @@ CK_RV SoftHSM::C_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject)
37953797

37963798
// Check the key handle.
37973799
OSObject *key = (OSObject *)handleManager->getObject(hObject);
3798-
if (key == NULL_PTR || !key->isValid()) return CKR_KEY_HANDLE_INVALID;
3800+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_KEY_HANDLE_INVALID;
37993801

38003802
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
38013803
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -3946,7 +3948,7 @@ CK_RV SoftHSM::MacSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechani
39463948

39473949
// Check the key handle.
39483950
OSObject *key = (OSObject *)handleManager->getObject(hKey);
3949-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
3951+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
39503952

39513953
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
39523954
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -4098,7 +4100,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan
40984100

40994101
// Check the key handle.
41004102
OSObject *key = (OSObject *)handleManager->getObject(hKey);
4101-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
4103+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
41024104

41034105
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
41044106
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -4924,7 +4926,7 @@ CK_RV SoftHSM::MacVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMecha
49244926

49254927
// Check the key handle.
49264928
OSObject *key = (OSObject *)handleManager->getObject(hKey);
4927-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
4929+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
49284930

49294931
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
49304932
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -5076,7 +5078,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
50765078

50775079
// Check the key handle.
50785080
OSObject *key = (OSObject *)handleManager->getObject(hKey);
5079-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
5081+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
50805082

50815083
CK_BBOOL isOnToken = key->getBooleanValue(CKA_TOKEN, false);
50825084
CK_BBOOL isPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -6512,7 +6514,7 @@ CK_RV SoftHSM::C_WrapKey
65126514

65136515
// Check the wrapping key handle.
65146516
OSObject *wrapKey = (OSObject *)handleManager->getObject(hWrappingKey);
6515-
if (wrapKey == NULL_PTR || !wrapKey->isValid()) return CKR_WRAPPING_KEY_HANDLE_INVALID;
6517+
if (wrapKey == NULL_PTR || !wrapKey->isValid(doRefresh)) return CKR_WRAPPING_KEY_HANDLE_INVALID;
65166518

65176519
CK_BBOOL isWrapKeyOnToken = wrapKey->getBooleanValue(CKA_TOKEN, false);
65186520
CK_BBOOL isWrapKeyPrivate = wrapKey->getBooleanValue(CKA_PRIVATE, true);
@@ -6554,7 +6556,7 @@ CK_RV SoftHSM::C_WrapKey
65546556

65556557
// Check the to be wrapped key handle.
65566558
OSObject *key = (OSObject *)handleManager->getObject(hKey);
6557-
if (key == NULL_PTR || !key->isValid()) return CKR_KEY_HANDLE_INVALID;
6559+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_KEY_HANDLE_INVALID;
65586560

65596561
CK_BBOOL isKeyOnToken = key->getBooleanValue(CKA_TOKEN, false);
65606562
CK_BBOOL isKeyPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -6980,7 +6982,7 @@ CK_RV SoftHSM::C_UnwrapKey
69806982

69816983
// Check the unwrapping key handle.
69826984
OSObject *unwrapKey = (OSObject *)handleManager->getObject(hUnwrappingKey);
6983-
if (unwrapKey == NULL_PTR || !unwrapKey->isValid()) return CKR_UNWRAPPING_KEY_HANDLE_INVALID;
6985+
if (unwrapKey == NULL_PTR || !unwrapKey->isValid(doRefresh)) return CKR_UNWRAPPING_KEY_HANDLE_INVALID;
69846986

69856987
CK_BBOOL isUnwrapKeyOnToken = unwrapKey->getBooleanValue(CKA_TOKEN, false);
69866988
CK_BBOOL isUnwrapKeyPrivate = unwrapKey->getBooleanValue(CKA_PRIVATE, true);
@@ -7280,7 +7282,7 @@ CK_RV SoftHSM::C_DeriveKey
72807282

72817283
// Check the key handle.
72827284
OSObject *key = (OSObject *)handleManager->getObject(hBaseKey);
7283-
if (key == NULL_PTR || !key->isValid()) return CKR_OBJECT_HANDLE_INVALID;
7285+
if (key == NULL_PTR || !key->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
72847286

72857287
CK_BBOOL isKeyOnToken = key->getBooleanValue(CKA_TOKEN, false);
72867288
CK_BBOOL isKeyPrivate = key->getBooleanValue(CKA_PRIVATE, true);
@@ -10386,7 +10388,7 @@ CK_RV SoftHSM::deriveDH
1038610388

1038710389
// Get the base key handle
1038810390
OSObject *baseKey = (OSObject *)handleManager->getObject(hBaseKey);
10389-
if (baseKey == NULL || !baseKey->isValid())
10391+
if (baseKey == NULL || !baseKey->isValid(doRefresh))
1039010392
return CKR_KEY_HANDLE_INVALID;
1039110393

1039210394
// Get the DH algorithm handler
@@ -10718,7 +10720,7 @@ CK_RV SoftHSM::deriveECDH
1071810720

1071910721
// Get the base key handle
1072010722
OSObject *baseKey = (OSObject *)handleManager->getObject(hBaseKey);
10721-
if (baseKey == NULL || !baseKey->isValid())
10723+
if (baseKey == NULL || !baseKey->isValid(doRefresh))
1072210724
return CKR_KEY_HANDLE_INVALID;
1072310725

1072410726
// Get the ECDH algorithm handler
@@ -11072,7 +11074,7 @@ CK_RV SoftHSM::deriveEDDSA
1107211074

1107311075
// Get the base key handle
1107411076
OSObject *baseKey = (OSObject *)handleManager->getObject(hBaseKey);
11075-
if (baseKey == NULL || !baseKey->isValid())
11077+
if (baseKey == NULL || !baseKey->isValid(doRefresh))
1107611078
return CKR_KEY_HANDLE_INVALID;
1107711079

1107811080
// Get the EDDSA algorithm handler
@@ -11598,7 +11600,7 @@ CK_RV SoftHSM::deriveSymmetric
1159811600

1159911601
// Check the key handle
1160011602
OSObject *baseKey = (OSObject *)handleManager->getObject(hBaseKey);
11601-
if (baseKey == NULL_PTR || !baseKey->isValid()) return CKR_OBJECT_HANDLE_INVALID;
11603+
if (baseKey == NULL_PTR || !baseKey->isValid(doRefresh)) return CKR_OBJECT_HANDLE_INVALID;
1160211604

1160311605
// Get the data
1160411606
ByteString secretValue;

‎src/lib/SoftHSM.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,8 @@ class SoftHSM
186186
// Is the SoftHSM PKCS #11 library initialised?
187187
bool isInitialised;
188188
bool isRemovable;
189+
// Do refresh of all objects from storage before validating.
190+
bool doRefresh;
189191

190192
SessionObjectStore* sessionObjectStore;
191193
ObjectStore* objectStore;

‎src/lib/common/Configuration.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ const struct config Configuration::valid_config[] = {
5151
{ "slots.removable", CONFIG_TYPE_BOOL },
5252
{ "slots.mechanisms", CONFIG_TYPE_STRING },
5353
{ "library.reset_on_fork", CONFIG_TYPE_BOOL },
54+
{ "objectstore.readrefresh", CONFIG_TYPE_BOOL },
5455
{ "", CONFIG_TYPE_UNSUPPORTED }
5556
};
5657

‎src/lib/common/softhsm2.conf.5.in‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,31 @@ library.reset_on_fork = true
102102
.fi
103103
.RE
104104
.LP
105+
.SH OBJECTSTORE.READREFRESH
106+
If set to false and if 'objectstore.backend = file', then this will affect
107+
the refreshing of the object store.
108+
Before using an object that is not changed, no files will be read.
109+
.LP
110+
Depending of what kind of HW that is used setting 'false' may improve the
111+
performance of the HSM.
112+
.LP
113+
But the drawback is that if one processes is using an object handle from a
114+
token for multiple function calls then this process may still use the old
115+
unmodified or deleted object even if it is changed or deleted. Another
116+
process may have called C_DestroyObject or C_SetAttributeValue. But every
117+
time a process gets a new handle for an object the objectstore of this
118+
process is updated for all objects even if this property is false.
119+
.LP
120+
If 'objectstore.backend = db' then the value of this property is ignored.
121+
.LP
122+
Default is true.
123+
.LP
124+
.RS
125+
.nf
126+
objectstore.readrefresh = false
127+
.fi
128+
.RE
129+
.LP
105130
.SH ENVIRONMENT
106131
.TP
107132
SOFTHSM2_CONF

‎src/lib/common/softhsm2.conf.in‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,6 @@ slots.mechanisms = ALL
1515

1616
# If the library should reset the state on fork
1717
library.reset_on_fork = false
18+
19+
# Set to false if there should be no update of a token objects each time it is used.
20+
objectstore.readrefresh = true

‎src/lib/object_store/DBObject.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1364,7 +1364,7 @@ bool DBObject::deleteAttribute(CK_ATTRIBUTE_TYPE type)
13641364
}
13651365

13661366
// The validity state of the object
1367-
bool DBObject::isValid()
1367+
bool DBObject::isValid(const bool doRefresh __attribute__((unused)))
13681368
{
13691369
MutexLocker lock(_mutex);
13701370

‎src/lib/object_store/DBObject.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ class DBObject : public OSObject
9696
virtual bool deleteAttribute(CK_ATTRIBUTE_TYPE type);
9797

9898
// The validity state of the object
99-
virtual bool isValid();
99+
virtual bool isValid(bool doRefresh);
100100

101101
// Start an attribute set transaction; this method is used when - for
102102
// example - a key is generated and all its attributes need to be

‎src/lib/object_store/DBToken.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -684,7 +684,7 @@ OSObject *DBToken::createObject()
684684
return NULL;
685685
}
686686

687-
if (!newObject->isValid())
687+
if (!newObject->isValid(true))
688688
{
689689
newObject->abortTransaction();
690690
delete newObject;

‎src/lib/object_store/OSObject.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,8 @@ class OSObject
6464
virtual bool deleteAttribute(CK_ATTRIBUTE_TYPE type) = 0;
6565

6666
// The validity state of the object
67-
virtual bool isValid() = 0;
67+
// If doRefresh==true then update the object from the storage before validating.
68+
virtual bool isValid(bool doRefresh=true) = 0;
6869

6970
// Start an attribute set transaction; this method is used when - for
7071
// example - a key is generated and all its attributes need to be

0 commit comments

Comments
 (0)