From f27e78656bc46053fc10f84ca8c90ea72c5acfa1 Mon Sep 17 00:00:00 2001
From: Roumen Petrov <softhsm@roumenpetrov.info>
Date: Sat, 25 Apr 2026 18:08:22 +0300
Subject: [PATCH 1/5] use global flag for initialised state

Resolves https://github.com/softhsm/SoftHSMv2/issues/780 , and closes https://github.com/softhsm/SoftHSMv2/issues/729 .
---
 src/bin/util/test/.gitignore  |   1 +
 src/bin/util/test/Makefile.am |   4 +
 src/bin/util/test/p11prov     | 160 ++++++++++++++++++++++++++++++++++
 src/lib/SoftHSM.cpp           |   2 +
 src/lib/SoftHSM.h             |   2 +-
 5 files changed, 168 insertions(+), 1 deletion(-)
 create mode 100644 src/bin/util/test/.gitignore
 create mode 100755 src/bin/util/test/p11prov

diff --git a/src/bin/util/test/.gitignore b/src/bin/util/test/.gitignore
new file mode 100644
index 000000000..96ecd1af6
--- /dev/null
+++ b/src/bin/util/test/.gitignore
@@ -0,0 +1 @@
+/tokens
diff --git a/src/bin/util/test/Makefile.am b/src/bin/util/test/Makefile.am
index fb7ce2f94..c1b44c337 100644
--- a/src/bin/util/test/Makefile.am
+++ b/src/bin/util/test/Makefile.am
@@ -3,10 +3,14 @@ MAINTAINERCLEANFILES = 		$(srcdir)/Makefile.in
 TESTS_ENVIRONMENT =		top_builddir='$(top_builddir)' top_srcdir='$(top_srcdir)' srcdir='$(srcdir)' builddir='$(builddir)'
 
 TESTS = 			mldsa44-import-key-test.sh mlkem512-import-key-test.sh
+if WITH_OPENSSL
+TESTS +=			p11prov
+endif
 
 check_SCRIPTS =			$(TESTS)
 
 EXTRA_DIST =			$(srcdir)/CMakeLists.txt \
+				$(srcdir)/p11prov \
 				$(srcdir)/import-key-test-common.sh \
 				$(srcdir)/mldsa44-import-key-test.sh \
 				$(srcdir)/mlkem512-import-key-test.sh
diff --git a/src/bin/util/test/p11prov b/src/bin/util/test/p11prov
new file mode 100755
index 000000000..7e960bdd5
--- /dev/null
+++ b/src/bin/util/test/p11prov
@@ -0,0 +1,160 @@
+#! /bin/sh
+# This file is in the public domain
+
+CWD=`pwd`
+
+# binaries
+
+OPENSSL=${OPENSSL-openssl}
+OPENSSL=`command -v "$OPENSSL"`
+if test -z "$OPENSSL" ; then
+  echo "error: openssl utility not found" >&2
+  exit 77
+fi
+
+openssl() {
+"$OPENSSL" ${1+"$@"}
+}
+
+openssl_version=`openssl version` || exit $?
+if test -z "$openssl_version" ; then
+  echo "cannot determine OpenSSL version" >&2
+  exit 99
+fi
+
+case $openssl_version in
+*"OpenSSL 0.9."*|\
+*"OpenSSL 1."*)
+  echo "$openssl_version is not impacted" >&2
+  exit 77
+  ;;
+esac
+# NOTE OpenSSL > 1.*
+
+
+# find a PKCS#11 provider
+p11_find_provider() {
+  if test -z "$PROV_PKCS11" ; then
+
+    # try to extract path ...
+    moduledir=`openssl version -m 2>/dev/null \
+      | sed -e 's/^MODULESDIR: "//' -e 's/"$//'`
+    if test -z "$moduledir" ; then
+      echo "cannot determine OpenSSL MODULESDIR" >&2
+      exit 99
+    fi
+    if test -d "$moduledir" ; then :
+    else
+      echo "does not exist MODULESDIR: $moduledir" >&2
+      exit 99
+    fi
+
+    for N in pkcs11 libpkcs11 ; do
+      for S in so dll ; do
+        test -f "$moduledir"/$N.$S || continue
+        PROV_PKCS11="$moduledir"/$N.$S
+        break
+      done
+      test -n "$PROV_PKCS11" && break
+    done
+    test -n "$PROV_PKCS11"
+  else
+    test -f "$PROV_PKCS11"
+  fi
+}
+
+if p11_find_provider ; then :
+else
+  echo "error: PKCS#11 provider not found" >&2
+  exit 77
+fi
+
+
+D=`cd ../../../lib/.libs/ && pwd`
+if test -z "$D" ; then
+  echo "unexpectedly missing library directory" >&2
+  exit 99
+fi
+P11MODULE=
+for S in so dll ; do
+  for F in "$D"/*softhsm2.$S ; do
+    test -f "$F" || continue
+    P11MODULE="$F"
+    break
+  done
+  test -n "$P11MODULE" && break
+done
+if test -z "$P11MODULE" ; then
+  echo "error: unexpected module suffix" >&2
+  exit 1
+fi
+if command -v realpath > /dev/null ; then
+  P11MODULE=`realpath "$P11MODULE"`
+fi
+
+softhsm2_tool() {
+"$CWD"/../softhsm2-util --module "$P11MODULE" ${1+"$@"}
+}
+
+
+# configurations
+TOKEN_DIR="$CWD"/tokens
+rm -rf "$TOKEN_DIR"
+mkdir "$TOKEN_DIR"
+
+
+OPENSSL_CONF="$TOKEN_DIR"/openssl.conf
+cat > "$OPENSSL_CONF" <<EOF
+openssl_conf = config
+
+[ config ]
+providers = provider_section
+
+[ provider_section ]
+default = default_section
+provider1 = provider1_section
+
+[default_section]
+activate = 1
+
+[provider1_section]
+pkcs11-module-path = $P11MODULE
+module = $PROV_PKCS11
+activate = 1
+EOF
+export OPENSSL_CONF
+
+
+SOFTHSM2_CONF="$TOKEN_DIR"/softhsm2.conf
+cat > "$SOFTHSM2_CONF" <<EOF
+directories.tokendir = $TOKEN_DIR
+objectstore.backend = file
+slots.removable = false
+slots.mechanisms = ALL
+log.level = ERROR
+EOF
+export SOFTHSM2_CONF
+
+
+# execution
+set -e
+
+TOKEN_PIN=4321
+TOKEN_ID=01
+PASS_URI=pass:$TOKEN_PIN
+PASS_FILE=pass:dcba
+KEY_URI=pkcs11:id=%$TOKEN_ID
+KEY_FILE="$TOKEN_DIR"/test_key
+SIGN_FILE="$TOKEN_DIR"/test_sign
+
+softhsm2_tool --init-token --label test0 --slot free --so-pin 12345678 --pin $TOKEN_PIN
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$KEY_FILE" -pass $PASS_FILE
+softhsm2_tool --import "$KEY_FILE" --import-type keypair --id $TOKEN_ID --label test_key --token test0 --pin $TOKEN_PIN
+
+#openssl storeutl -passin $PASS_URI $KEY_URI
+
+# sample command that crash before workaround due to OpenSSL "at_exit" flaw
+openssl pkeyutl -sign -inkey $KEY_URI -passin $PASS_URI -rawin -in ./Makefile -out "$SIGN_FILE"
+
+# just in case
+openssl pkeyutl -verify -inkey "$KEY_FILE" -passin $PASS_FILE -rawin -in ./Makefile -sigfile "$SIGN_FILE"
diff --git a/src/lib/SoftHSM.cpp b/src/lib/SoftHSM.cpp
index e5cd0cab5..2ac39372f 100644
--- a/src/lib/SoftHSM.cpp
+++ b/src/lib/SoftHSM.cpp
@@ -101,6 +101,8 @@
 #include <unistd.h>
 #endif
 
+bool SoftHSM::isInitialised;
+
 // Initialise the one-and-only instance
 
 #ifdef HAVE_CXX11
diff --git a/src/lib/SoftHSM.h b/src/lib/SoftHSM.h
index 724812c91..4bbb39875 100644
--- a/src/lib/SoftHSM.h
+++ b/src/lib/SoftHSM.h
@@ -209,7 +209,7 @@ class SoftHSM
 #endif
 
 	// Is the SoftHSM PKCS #11 library initialised?
-	bool isInitialised;
+	static bool isInitialised;
 	bool isRemovable;
 
 	SessionObjectStore* sessionObjectStore;

From d768d6cabd24ead23dc80feb5a6671eadaecc712 Mon Sep 17 00:00:00 2001
From: Roumen Petrov <softhsm@roumenpetrov.info>
Date: Tue, 21 Jul 2026 21:57:53 +0300
Subject: [PATCH 2/5] p11prov test: restrict tests to OpenSSL 3+

---
 src/bin/util/test/p11prov | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/bin/util/test/p11prov b/src/bin/util/test/p11prov
index 7e960bdd5..c65c21da0 100755
--- a/src/bin/util/test/p11prov
+++ b/src/bin/util/test/p11prov
@@ -28,6 +28,13 @@ case $openssl_version in
   echo "$openssl_version is not impacted" >&2
   exit 77
   ;;
+*"OpenSSL "*)
+  # OpenSSL 3+ - with provider loadable module
+  ;;
+*)
+  echo "unsupported: $openssl_version" >&2
+  exit 77
+  ;;
 esac
 # NOTE OpenSSL > 1.*
 

From a054b304fdf45416a80351b6c77c77f963360913 Mon Sep 17 00:00:00 2001
From: Roumen Petrov <softhsm@roumenpetrov.info>
Date: Tue, 21 Jul 2026 21:58:47 +0300
Subject: [PATCH 3/5] p11prov test: clean-up "token" directory on success

---
 src/bin/util/test/p11prov | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/bin/util/test/p11prov b/src/bin/util/test/p11prov
index c65c21da0..1c9ae5828 100755
--- a/src/bin/util/test/p11prov
+++ b/src/bin/util/test/p11prov
@@ -165,3 +165,6 @@ openssl pkeyutl -sign -inkey $KEY_URI -passin $PASS_URI -rawin -in ./Makefile -o
 
 # just in case
 openssl pkeyutl -verify -inkey "$KEY_FILE" -passin $PASS_FILE -rawin -in ./Makefile -sigfile "$SIGN_FILE"
+
+# clean-up
+rm -rf "$TOKEN_DIR"

From 6cf9971ea9bc41d4224433b7d00cf23cb9ebb313 Mon Sep 17 00:00:00 2001
From: Roumen Petrov <softhsm@roumenpetrov.info>
Date: Tue, 21 Jul 2026 22:00:04 +0300
Subject: [PATCH 4/5] p11prov test: add test to CMake rules

Also adapt the search for the SoftHSM2 module to the CMake build system.
---
 src/bin/util/test/CMakeLists.txt |  9 ++++++++-
 src/bin/util/test/p11prov        | 22 +++++++++++++---------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/src/bin/util/test/CMakeLists.txt b/src/bin/util/test/CMakeLists.txt
index 3b0a78e53..0e9491117 100644
--- a/src/bin/util/test/CMakeLists.txt
+++ b/src/bin/util/test/CMakeLists.txt
@@ -20,6 +20,13 @@ add_test(
 		bash ${CMAKE_CURRENT_SOURCE_DIR}/mlkem512-import-key-test.sh
 )
 
+add_test(
+	NAME ${PROJECT_NAME}-p11prov
+	COMMAND ${CMAKE_COMMAND} -E env
+	bash ${CMAKE_CURRENT_SOURCE_DIR}/p11prov
+)
+
 # Make tests returning code 77 considered as skipped, to avoid marking the test suite as failed when running on an unsupported OpenSSL version or with a Botan-based SoftHSM2.
 set_tests_properties(${PROJECT_NAME}-ml-dsa PROPERTIES SKIP_RETURN_CODE 77)
-set_tests_properties(${PROJECT_NAME}-ml-kem PROPERTIES SKIP_RETURN_CODE 77)
\ No newline at end of file
+set_tests_properties(${PROJECT_NAME}-ml-kem PROPERTIES SKIP_RETURN_CODE 77)
+set_tests_properties(${PROJECT_NAME}-p11prov PROPERTIES SKIP_RETURN_CODE 77)
diff --git a/src/bin/util/test/p11prov b/src/bin/util/test/p11prov
index 1c9ae5828..1b2449d83 100755
--- a/src/bin/util/test/p11prov
+++ b/src/bin/util/test/p11prov
@@ -77,23 +77,27 @@ else
 fi
 
 
-D=`cd ../../../lib/.libs/ && pwd`
+# get absolute path to SoftHSM pkcs#11 module
+# NOTE: Depending on the build model, the module
+# may be located in a subdirectory.
+D=`cd ../../../lib/ && pwd`
 if test -z "$D" ; then
   echo "unexpectedly missing library directory" >&2
   exit 99
 fi
 P11MODULE=
-for S in so dll ; do
-  for F in "$D"/*softhsm2.$S ; do
-    test -f "$F" || continue
-    P11MODULE="$F"
-    break
-  done
-  test -n "$P11MODULE" && break
+for F in `find "$D" -name '*softhsm2.*'` ; do
+  case "$F" in
+  *.so|*.dll);;
+  *) continue;;
+  esac
+  test -f "$F" || continue
+  P11MODULE="$F"
+  break
 done
 if test -z "$P11MODULE" ; then
   echo "error: unexpected module suffix" >&2
-  exit 1
+  exit 99
 fi
 if command -v realpath > /dev/null ; then
   P11MODULE=`realpath "$P11MODULE"`

From 1da44af14efac2fa2e4a64d28dd03fbb68fbba53 Mon Sep 17 00:00:00 2001
From: Roumen Petrov <softhsm@roumenpetrov.info>
Date: Tue, 21 Jul 2026 22:01:05 +0300
Subject: [PATCH 5/5] p11prov test: use "-test.sh" suffix

---
 src/bin/util/test/CMakeLists.txt               | 2 +-
 src/bin/util/test/Makefile.am                  | 4 ++--
 src/bin/util/test/{p11prov => p11prov-test.sh} | 0
 3 files changed, 3 insertions(+), 3 deletions(-)
 rename src/bin/util/test/{p11prov => p11prov-test.sh} (100%)

diff --git a/src/bin/util/test/CMakeLists.txt b/src/bin/util/test/CMakeLists.txt
index 0e9491117..514bcbccb 100644
--- a/src/bin/util/test/CMakeLists.txt
+++ b/src/bin/util/test/CMakeLists.txt
@@ -23,7 +23,7 @@ add_test(
 add_test(
 	NAME ${PROJECT_NAME}-p11prov
 	COMMAND ${CMAKE_COMMAND} -E env
-	bash ${CMAKE_CURRENT_SOURCE_DIR}/p11prov
+	bash ${CMAKE_CURRENT_SOURCE_DIR}/p11prov-test.sh
 )
 
 # Make tests returning code 77 considered as skipped, to avoid marking the test suite as failed when running on an unsupported OpenSSL version or with a Botan-based SoftHSM2.
diff --git a/src/bin/util/test/Makefile.am b/src/bin/util/test/Makefile.am
index c1b44c337..4606a9d47 100644
--- a/src/bin/util/test/Makefile.am
+++ b/src/bin/util/test/Makefile.am
@@ -4,13 +4,13 @@ TESTS_ENVIRONMENT =		top_builddir='$(top_builddir)' top_srcdir='$(top_srcdir)' s
 
 TESTS = 			mldsa44-import-key-test.sh mlkem512-import-key-test.sh
 if WITH_OPENSSL
-TESTS +=			p11prov
+TESTS +=			p11prov-test.sh
 endif
 
 check_SCRIPTS =			$(TESTS)
 
 EXTRA_DIST =			$(srcdir)/CMakeLists.txt \
-				$(srcdir)/p11prov \
+				$(srcdir)/p11prov-test.sh \
 				$(srcdir)/import-key-test-common.sh \
 				$(srcdir)/mldsa44-import-key-test.sh \
 				$(srcdir)/mlkem512-import-key-test.sh
diff --git a/src/bin/util/test/p11prov b/src/bin/util/test/p11prov-test.sh
similarity index 100%
rename from src/bin/util/test/p11prov
rename to src/bin/util/test/p11prov-test.sh