Lock API against concurrent use from other threads

Backported version of the original opencryptoki commit

    commit 3756138fc3427e1d53010780d0af1c44bd05b9e2
    Author: Ingo Franzki <ifranzki@linux.ibm.com>
    Date:   Tue Oct 8 10:26:21 2019 +0200

    API: Lock API against concurrent use from other threads
    
    Use a recursive mutex in the API-slot to lock the API calls
    against concurrent use by other threads of the same process.
    
    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Index: opencryptoki/usr/include/pkcs11/apictl.h
===================================================================
--- opencryptoki.orig/usr/include/pkcs11/apictl.h
+++ opencryptoki/usr/include/pkcs11/apictl.h
@@ -300,6 +300,7 @@
 #include <local_types.h>
 #include <stdll.h>
 #include <slotmgr.h>
+#include <pthread.h>
 
 #ifndef _APILOCAL_H
 #define _APILOCAL_H
Index: opencryptoki/usr/lib/pkcs11/api/api_interface.c
===================================================================
--- opencryptoki.orig/usr/lib/pkcs11/api/api_interface.c
+++ opencryptoki/usr/lib/pkcs11/api/api_interface.c
@@ -394,10 +394,10 @@ CK_RV C_CloseAllSessions(CK_SLOT_ID slot
 
 	/* for every node in the API-level session tree, if the session's slot matches slotID,
 	 * close it */
-	CloseAllSessions(slotID);
+	rv = CloseAllSessions(slotID);
 
 	OCK_LOG_DEBUG("CloseAllSessions OK\n");
-	return CKR_OK;
+	return rv;
 
 }				// end of C_CloseAllSessions
 
@@ -438,6 +438,8 @@ CK_RV C_CloseSession(CK_SESSION_HANDLE h
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_CloseSession) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_CloseSession(&rSession);
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
@@ -453,6 +455,8 @@ CK_RV C_CloseSession(CK_SESSION_HANDLE h
 			// other applications have the token active. 
 			decr_sess_counts(rSession.slotID);
 		}
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
 		rv = CKR_FUNCTION_NOT_SUPPORTED;
@@ -517,9 +521,13 @@ C_CopyObject(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_CopyObject) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_CopyObject(&rSession, hObject, pTemplate, ulCount,
 					phNewObject);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -589,9 +597,13 @@ C_CreateObject(CK_SESSION_HANDLE hSessio
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_CreateObject) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_CreateObject(&rSession, pTemplate, ulCount,
 					  phObject);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -649,9 +661,13 @@ C_Decrypt(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Decrypt) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Decrypt(&rSession, pEncryptedData,
 				     ulEncryptedDataLen, pData, pulDataLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -706,10 +722,14 @@ C_DecryptDigestUpdate(CK_SESSION_HANDLE
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DecryptDigestUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DecryptDigestUpdate(&rSession, pEncryptedPart,
 						 ulEncryptedPartLen, pPart,
 						 pulPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -770,8 +790,12 @@ C_DecryptFinal(CK_SESSION_HANDLE hSessio
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DecryptFinal) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DecryptFinal(&rSession, pLastPart, pulLastPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -825,8 +849,12 @@ C_DecryptInit(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DecryptInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DecryptInit(&rSession, pMechanism, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -882,10 +910,14 @@ C_DecryptUpdate(CK_SESSION_HANDLE hSessi
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DecryptUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DecryptUpdate(&rSession, pEncryptedPart,
 					   ulEncryptedPartLen, pPart,
 					   pulPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -937,10 +969,14 @@ C_DecryptVerifyUpdate(CK_SESSION_HANDLE
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DecryptVerifyUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DecryptVerifyUpdate(&rSession, pEncryptedPart,
 						 ulEncryptedPartLen, pPart,
 						 pulPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1005,9 +1041,13 @@ C_DeriveKey(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DeriveKey) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DeriveKey(&rSession, pMechanism, hBaseKey,
 				       pTemplate, ulAttributeCount, phKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1057,8 +1097,12 @@ CK_RV C_DestroyObject(CK_SESSION_HANDLE
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DestroyObject) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DestroyObject(&rSession, hObject);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1108,9 +1152,13 @@ C_Digest(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Digest) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Digest(&rSession, pData, ulDataLen, pDigest,
 				    pulDigestLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1164,10 +1212,14 @@ C_DigestEncryptUpdate(CK_SESSION_HANDLE
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DigestEncryptUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DigestEncryptUpdate(&rSession, pPart, ulPartLen,
 						 pEncryptedPart,
 						 pulEncryptedPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1216,8 +1268,12 @@ C_DigestFinal(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DigestFinal) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DigestFinal(&rSession, pDigest, pulDigestLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1266,8 +1322,12 @@ CK_RV C_DigestInit(CK_SESSION_HANDLE hSe
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DigestInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DigestInit(&rSession, pMechanism);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1310,8 +1370,12 @@ CK_RV C_DigestKey(CK_SESSION_HANDLE hSes
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DigestKey) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DigestKey(&rSession, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1360,8 +1424,12 @@ C_DigestUpdate(CK_SESSION_HANDLE hSessio
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_DigestUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_DigestUpdate(&rSession, pPart, ulPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1413,9 +1481,13 @@ C_Encrypt(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Encrypt) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Encrypt(&rSession, pData, ulDataLen,
 				     pEncryptedData, pulEncryptedDataLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1465,9 +1537,13 @@ C_EncryptFinal(CK_SESSION_HANDLE hSessio
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_EncryptFinal) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_EncryptFinal(&rSession, pLastEncryptedPart,
 					  pulLastEncryptedPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1517,8 +1593,12 @@ C_EncryptInit(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_EncryptInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_EncryptInit(&rSession, pMechanism, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1571,9 +1651,13 @@ C_EncryptUpdate(CK_SESSION_HANDLE hSessi
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_EncryptUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_EncryptUpdate(&rSession, pPart, ulPartLen,
 					   pEncryptedPart, pulEncryptedPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1647,6 +1731,8 @@ CK_RV C_Finalize(CK_VOID_PTR pReserved)
 	// Unlock 
 	pthread_mutex_unlock(&GlobMutex);
 
+	DestroyAPILock();
+
 	return CKR_OK;
 }				// end of C_Finalize
 
@@ -1695,9 +1781,13 @@ C_FindObjects(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_FindObjects) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_FindObjects(&rSession, phObject, ulMaxObjectCount,
 					 pulObjectCount);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1746,8 +1836,12 @@ CK_RV C_FindObjectsFinal(CK_SESSION_HAND
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_FindObjectsFinal) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_FindObjectsFinal(&rSession);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1800,8 +1894,12 @@ C_FindObjectsInit(CK_SESSION_HANDLE hSes
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_FindObjectsInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_FindObjectsInit(&rSession, pTemplate, ulCount);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1857,9 +1955,13 @@ C_GenerateKey(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GenerateKey) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GenerateKey(&rSession, pMechanism, pTemplate,
 					 ulCount, phKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1923,6 +2025,8 @@ C_GenerateKeyPair(CK_SESSION_HANDLE hSes
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GenerateKeyPair) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GenerateKeyPair(&rSession, pMechanism,
 					     pPublicKeyTemplate,
@@ -1930,6 +2034,8 @@ C_GenerateKeyPair(CK_SESSION_HANDLE hSes
 					     pPrivateKeyTemplate,
 					     ulPrivateKeyAttributeCount,
 					     phPublicKey, phPrivateKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -1978,8 +2084,12 @@ C_GenerateRandom(CK_SESSION_HANDLE hSess
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GenerateRandom) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GenerateRandom(&rSession, RandomData, ulRandomLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -2039,9 +2149,13 @@ C_GetAttributeValue(CK_SESSION_HANDLE hS
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GetAttributeValue) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GetAttributeValue(&rSession, hObject, pTemplate,
 					       ulCount);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -2227,7 +2341,11 @@ C_GetMechanismInfo(CK_SLOT_ID slotID,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GetMechanismInfo) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		rv = fcn->ST_GetMechanismInfo(slotID, type, pInfo);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -2284,7 +2402,11 @@ C_GetMechanismList(CK_SLOT_ID slotID,
 	}
 	if (fcn->ST_GetMechanismList) {
 		OCK_LOG_DEBUG("Calling STDLL\n");
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		rv = fcn->ST_GetMechanismList(slotID, pMechanismList, pulCount);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -2351,8 +2473,12 @@ C_GetObjectSize(CK_SESSION_HANDLE hSessi
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GetObjectSize) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GetObjectSize(&rSession, hObject, pulSize);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -2404,9 +2530,13 @@ C_GetOperationState(CK_SESSION_HANDLE hS
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GetOperationState) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GetOperationState(&rSession, pOperationState,
 					       pulOperationStateLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -2459,8 +2589,13 @@ CK_RV C_GetSessionInfo(CK_SESSION_HANDLE
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_GetSessionInfo) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_GetSessionInfo(&rSession, pInfo);
+		
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 		OCK_LOG_DEBUG("Slot %d  State %x  Flags %x DevErr %x\n",
@@ -2792,10 +2927,14 @@ CK_RV C_GetTokenInfo(CK_SLOT_ID slotID,
 	}
 	if (fcn->ST_GetTokenInfo) {
 		OCK_LOG_DEBUG("Calling STDLL \n");
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		rv = fcn->ST_GetTokenInfo(slotID, pInfo);
 		if (rv == CKR_OK) {
 			get_sess_count(slotID, &(pInfo->ulSessionCount));
 		}
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("rv %d  CK_TOKEN_INFO Flags %x\n", rv,
 			      pInfo->flags);
 	} else {
@@ -2948,6 +3087,14 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
 		;
 	}
 
+	/* Create the API lock. */
+	if (CreateAPILock()  != CKR_OK) {
+		free((void *)Anchor);
+		Anchor = NULL;
+		OCK_LOG_ERR(ERR_PROCESS_LOCK);
+		return CKR_FUNCTION_FAILED;
+	}
+	
 	// Create the shared memory lock.
 	if (CreateXProcLock() != CKR_OK) {
 		free((void *)Anchor);
@@ -3078,8 +3225,12 @@ CK_RV C_InitPIN(CK_SESSION_HANDLE hSessi
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_InitPIN) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_InitPIN(&rSession, pPin, ulPinLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3148,7 +3299,11 @@ C_InitToken(CK_SLOT_ID slotID,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_InitToken) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		rv = fcn->ST_InitToken(slotID, pPin, ulPinLen, pLabel);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3206,8 +3361,12 @@ C_Login(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Login) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Login(&rSession, userType, pPin, ulPinLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3255,8 +3414,12 @@ CK_RV C_Logout(CK_SESSION_HANDLE hSessio
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Logout) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Logout(&rSession);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3328,6 +3491,10 @@ C_OpenSession(CK_SLOT_ID slotID,
 	}
 
 	if (fcn->ST_OpenSession) {
+		if (APILock() != CKR_OK) {
+			free(apiSessp);
+			return CKR_CANT_LOCK;
+		}
 		rv = fcn->ST_OpenSession(slotID, flags, &(apiSessp->sessionh));
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 
@@ -3344,6 +3511,7 @@ C_OpenSession(CK_SLOT_ID slotID,
 				 * and return failure */
 				fcn->ST_CloseSession(apiSessp);
 				free(apiSessp);
+				APIUnLock();
 				rv = CKR_HOST_MEMORY;
 				goto done;
 			}
@@ -3362,6 +3530,10 @@ C_OpenSession(CK_SLOT_ID slotID,
 		} else {
 			free(apiSessp);
 		}
+		if (APIUnLock() != CKR_OK) {
+			free(apiSessp);
+			return CKR_CANT_LOCK;
+		}
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
 		rv = CKR_FUNCTION_NOT_SUPPORTED;
@@ -3409,8 +3581,12 @@ C_SeedRandom(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SeedRandom) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SeedRandom(&rSession, pSeed, ulSeedLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3472,9 +3648,13 @@ C_SetAttributeValue(CK_SESSION_HANDLE hS
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SetAttributeValue) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SetAttributeValue(&rSession, hObject, pTemplate,
 					       ulCount);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3527,11 +3707,15 @@ C_SetOperationState(CK_SESSION_HANDLE hS
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SetOperationState) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SetOperationState(&rSession, pOperationState,
 					       ulOperationStateLen,
 					       hEncryptionKey,
 					       hAuthenticationKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3588,9 +3772,13 @@ C_SetPIN(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SetPIN) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SetPIN(&rSession, pOldPin, ulOldLen, pNewPin,
 				    ulNewLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3645,9 +3833,13 @@ C_Sign(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Sign) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Sign(&rSession, pData, ulDataLen, pSignature,
 				  pulSignatureLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3699,10 +3891,14 @@ C_SignEncryptUpdate(CK_SESSION_HANDLE hS
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SignEncryptUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SignEncryptUpdate(&rSession, pPart, ulPartLen,
 					       pEncryptedPart,
 					       pulEncryptedPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3758,8 +3954,12 @@ C_SignFinal(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SignFinal) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SignFinal(&rSession, pSignature, pulSignatureLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3814,8 +4014,12 @@ C_SignInit(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SignInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SignInit(&rSession, pMechanism, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3866,9 +4070,13 @@ C_SignRecover(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SignRecover) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SignRecover(&rSession, pData, ulDataLen,
 					 pSignature, pulSignatureLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3920,8 +4128,12 @@ C_SignRecoverInit(CK_SESSION_HANDLE hSes
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SignRecoverInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SignRecoverInit(&rSession, pMechanism, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -3975,8 +4187,12 @@ C_SignUpdate(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_SignUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_SignUpdate(&rSession, pPart, ulPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4040,10 +4256,14 @@ C_UnwrapKey(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_UnwrapKey) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_UnwrapKey(&rSession, pMechanism, hUnwrappingKey,
 				       pWrappedKey, ulWrappedKeyLen, pTemplate,
 				       ulAttributeCount, phKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4097,9 +4317,13 @@ C_Verify(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_Verify) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_Verify(&rSession, pData, ulDataLen, pSignature,
 				    ulSignatureLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4148,8 +4372,12 @@ C_VerifyFinal(CK_SESSION_HANDLE hSession
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_VerifyFinal) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_VerifyFinal(&rSession, pSignature, ulSignatureLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4200,8 +4428,12 @@ C_VerifyInit(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_VerifyInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_VerifyInit(&rSession, pMechanism, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4253,9 +4485,13 @@ C_VerifyRecover(CK_SESSION_HANDLE hSessi
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_VerifyRecover) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_VerifyRecover(&rSession, pSignature,
 					   ulSignatureLen, pData, pulDataLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4304,8 +4540,12 @@ C_VerifyRecoverInit(CK_SESSION_HANDLE hS
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_VerifyRecoverInit) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_VerifyRecoverInit(&rSession, pMechanism, hKey);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4354,8 +4594,12 @@ C_VerifyUpdate(CK_SESSION_HANDLE hSessio
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_VerifyUpdate) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_VerifyUpdate(&rSession, pPart, ulPartLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
@@ -4546,9 +4790,13 @@ C_WrapKey(CK_SESSION_HANDLE hSession,
 		return CKR_TOKEN_NOT_PRESENT;
 	}
 	if (fcn->ST_WrapKey) {
+		if (APILock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		// Map the Session to the slot session
 		rv = fcn->ST_WrapKey(&rSession, pMechanism, hWrappingKey, hKey,
 				     pWrappedKey, pulWrappedKeyLen);
+		if (APIUnLock() != CKR_OK)
+			return CKR_CANT_LOCK;
 		OCK_LOG_DEBUG("Called STDLL rv = 0x%x\n", rv);
 	} else {
 		OCK_LOG_ERR(ERR_FUNCTION_NOT_SUPPORTED);
Index: opencryptoki/usr/lib/pkcs11/api/apiproto.h
===================================================================
--- opencryptoki.orig/usr/lib/pkcs11/api/apiproto.h
+++ opencryptoki/usr/lib/pkcs11/api/apiproto.h
@@ -322,6 +322,11 @@ CK_RV CreateXProcLock(void);
 CK_RV XProcLock(void);
 CK_RV XProcUnLock(void);
 
+CK_RV CreateAPILock();
+CK_RV DestroyAPILock();
+CK_RV APILock();
+CK_RV APIUnLock();
+
 void _init(void);
 void get_sess_count(CK_SLOT_ID, CK_ULONG *);
 void incr_sess_counts(CK_SLOT_ID);
Index: opencryptoki/usr/lib/pkcs11/api/apiutil.c
===================================================================
--- opencryptoki.orig/usr/lib/pkcs11/api/apiutil.c
+++ opencryptoki/usr/lib/pkcs11/api/apiutil.c
@@ -318,6 +318,8 @@
 
 static int xplfd = -1;
 
+static pthread_mutex_t api_mutex; /* lock API calls against other threads */
+
 #include <libgen.h>
 
 #define LIBLOCATION  LIB_PATH
@@ -368,26 +370,66 @@ CK_RV XProcUnLock(void)
 	return CKR_OK;
 }
 
+CK_RV CreateAPILock()
+{
+	pthread_mutexattr_t attr;
+	
+	if (pthread_mutexattr_init(&attr)) {
+		OCK_LOG_DEBUG("Mutex attribute init failed.\n");
+		return CKR_FUNCTION_FAILED;
+	}
+	if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE)) {
+		OCK_LOG_DEBUG("Mutex attribute set failed.\n");
+		return CKR_FUNCTION_FAILED;
+	}
+	if (pthread_mutex_init(&api_mutex, &attr)) {
+		OCK_LOG_DEBUG("Mutex init failed.\n");
+		return CKR_FUNCTION_FAILED;
+	}
+
+	return CKR_OK;
+}
+
+CK_RV DestroyAPILock()
+{
+	if (pthread_mutex_destroy(&api_mutex))
+		return CKR_FUNCTION_FAILED;
+
+	return CKR_OK;
+}
+
+CK_RV APILock()
+{
+	if (pthread_mutex_lock(&api_mutex)) {
+		OCK_LOG_DEBUG("APILock failed.\n");
+		return CKR_CANT_LOCK;
+	}
+
+	return CKR_OK;
+}
+
+CK_RV APIUnLock()
+{
+	if (pthread_mutex_unlock(&api_mutex)) {
+		OCK_LOG_DEBUG("APIUnLock failed.\n");
+		return CKR_CANT_LOCK;
+	}
+
+	return CKR_OK;
+}
+
 unsigned long AddToSessionList(ST_SESSION_T * pSess)
 {
 	unsigned long handle;
 
-	pthread_mutex_lock(&(Anchor->SessListMutex));
-
 	handle = bt_node_add(&(Anchor->sess_btree), pSess);
 
-	pthread_mutex_unlock(&(Anchor->SessListMutex));
-
 	return handle;
 }
 
 void RemoveFromSessionList(CK_SESSION_HANDLE handle)
 {
-	pthread_mutex_lock(&(Anchor->SessListMutex));
-
 	bt_node_free(&(Anchor->sess_btree), handle, free);
-
-	pthread_mutex_unlock(&(Anchor->SessListMutex));
 }
 
 /* CloseMe
@@ -422,9 +464,10 @@ void CloseMe(void *node_value, unsigned
  * @slot_id and if it matches, will close the session. Once all the nodes are closed, we check
  * to see if the tree is empty and if so, destroy it
  */
-void CloseAllSessions(CK_SLOT_ID slot_id)
+CK_RV CloseAllSessions(CK_SLOT_ID slot_id)
 {
-	pthread_mutex_lock(&(Anchor->SessListMutex));
+	if (APILock() != CKR_OK)
+		return CKR_CANT_LOCK;
 
 	/* for every node in the API-level session tree, call CloseMe on it */
 	bt_for_each_node(&(Anchor->sess_btree), CloseMe, (void *)&slot_id);
@@ -432,23 +475,28 @@ void CloseAllSessions(CK_SLOT_ID slot_id
 	if (bt_is_empty(&(Anchor->sess_btree)))
 		bt_destroy(&(Anchor->sess_btree), NULL);
 
-	pthread_mutex_unlock(&(Anchor->SessListMutex));
+	if (APIUnLock() != CKR_OK)
+		return CKR_CANT_LOCK;
+
+	return CKR_OK;
 }
 
 int Valid_Session(CK_SESSION_HANDLE handle, ST_SESSION_T * rSession)
 {
 	ST_SESSION_T *tmp;
 
-	pthread_mutex_lock(&(Anchor->SessListMutex));
-
+	if (APILock() != CKR_OK)
+		return CKR_CANT_LOCK;
+	
 	tmp = bt_get_node_value(&(Anchor->sess_btree), handle);
 	if (tmp) {
 		rSession->slotID = tmp->slotID;
 		rSession->sessionh = tmp->sessionh;
 	}
 
-	pthread_mutex_unlock(&(Anchor->SessListMutex));
-
+	if (APIUnLock() != CKR_OK)
+		return CKR_CANT_LOCK;
+	
 	return (tmp ? TRUE : FALSE);
 }
 
@@ -841,7 +889,6 @@ API_Slot_t *sltp;
 	sltp->dlop_p = NULL;
 	sltp->pSTfini = NULL;
 	sltp->pSTcloseall = NULL;
-
 }
 
 int DL_Load_and_Init(API_Slot_t *sltp, CK_SLOT_ID slotID, const char *conf_name)
@@ -898,6 +945,7 @@ int DL_Load_and_Init(API_Slot_t *sltp, C
 		DL_Unload(sltp);
 		return FALSE;
 	}
+
 	// Returns true or false
 	rv = pSTinit(&(sltp->FcnList), slotID, conf_name);
 	OCK_LOG_DEBUG("return from STDDLL Init = %x\n", rv);
