Index: cackey.c
==================================================================
--- cackey.c
+++ cackey.c
@@ -1116,11 +1116,15 @@
 		SCardDisconnect(slot->pcsc_card, SCARD_LEAVE_CARD);
 	}
 
 	slot->slot_reset = 1;
 	slot->pcsc_card_connected = 0;
-	slot->token_flags = CKF_LOGIN_REQUIRED;
+	if (cackey_pin_command == NULL) {
+		slot->token_flags = CKF_LOGIN_REQUIRED;
+	} else {
+		slot->token_flags = 0;
+	}
 
 	CACKEY_DEBUG_PRINTF("Returning.");
 
 	return;
 }
@@ -2868,15 +2872,14 @@
 			}
 
 			/* End transaction */
 			cackey_end_transaction(slot);
 
-			if (respcode == 0x6982) {
+			if (respcode == 0x6982 || respcode == 0x6e00) {
 				CACKEY_DEBUG_PRINTF("Security status not satisified.  Returning NEEDLOGIN");
 
 				cackey_mark_slot_reset(slot);
-				slot->token_flags = CKF_LOGIN_REQUIRED;
 
 				return(CACKEY_PCSC_E_NEEDLOGIN);
 			}
 
 			if (send_ret == CACKEY_PCSC_E_TOKENABSENT) {
@@ -4420,11 +4423,15 @@
 							cackey_slots[currslot].internal = 0;
 							cackey_slots[currslot].pcsc_reader = strdup(pcsc_readers);
 							cackey_slots[currslot].pcsc_card_connected = 0;
 							cackey_slots[currslot].transaction_depth = 0;
 							cackey_slots[currslot].transaction_need_hw_lock = 0;
-							cackey_slots[currslot].token_flags = CKF_LOGIN_REQUIRED;
+							if (cackey_pin_command == NULL) {
+								cackey_slots[currslot].token_flags = CKF_LOGIN_REQUIRED;
+							} else {
+								cackey_slots[currslot].token_flags = 0;
+							}
 							cackey_slots[currslot].label = NULL;
 
 							cackey_mark_slot_reset(&cackey_slots[currslot]);
 						}
 					} else {
@@ -5165,11 +5172,11 @@
 	CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
 
 	return(CKR_FUNCTION_NOT_SUPPORTED);
 }
 
-CK_DEFINE_FUNCTION(CK_RV, C_Login)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen) {
+CK_DEFINE_FUNCTION(CK_RV, _C_LoginMutexArg)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen, int lock_mutex) {
 	CK_SLOT_ID slotID;
 	FILE *pinfd;
 	char *pincmd, pinbuf[64], *fgets_ret;
 	int mutex_retval;
 	int tries_remaining;
@@ -5194,19 +5201,23 @@
 		CACKEY_DEBUG_PRINTF("Error.  We only support USER mode, asked for %lu mode.", (unsigned long) userType)
 
 		return(CKR_USER_TYPE_INVALID);
 	}
 
-	mutex_retval = cackey_mutex_lock(cackey_biglock);
-	if (mutex_retval != 0) {
-		CACKEY_DEBUG_PRINTF("Error.  Locking failed.");
+	if (lock_mutex) {
+		mutex_retval = cackey_mutex_lock(cackey_biglock);
+		if (mutex_retval != 0) {
+			CACKEY_DEBUG_PRINTF("Error.  Locking failed.");
 
-		return(CKR_GENERAL_ERROR);
+			return(CKR_GENERAL_ERROR);
+		}
 	}
 
 	if (!cackey_sessions[hSession].active) {
-		cackey_mutex_unlock(cackey_biglock);
+		if (lock_mutex) {
+			cackey_mutex_unlock(cackey_biglock);
+		}
 
 		CACKEY_DEBUG_PRINTF("Error.  Session not active.");
 		
 		return(CKR_SESSION_HANDLE_INVALID);
 	}
@@ -5213,18 +5224,24 @@
 
 	slotID = cackey_sessions[hSession].slotID;
 
 	if (slotID < 0 || slotID >= (sizeof(cackey_slots) / sizeof(cackey_slots[0]))) {
 		CACKEY_DEBUG_PRINTF("Error. Invalid slot requested (%lu), outside of valid range", slotID);
+
+		if (lock_mutex) {
+			cackey_mutex_unlock(cackey_biglock);
+		}
 
 		return(CKR_GENERAL_ERROR);
 	}
 
 	if (cackey_slots[slotID].active == 0) {
 		CACKEY_DEBUG_PRINTF("Error. Invalid slot requested (%lu), slot not currently active", slotID);
 
-		cackey_mutex_unlock(cackey_biglock);
+		if (lock_mutex) {
+			cackey_mutex_unlock(cackey_biglock);
+		}
 
 		return(CKR_GENERAL_ERROR);
 	}
 
 	pincmd = cackey_pin_command;
@@ -5237,11 +5254,13 @@
 
 		pinfd = popen(pincmd, "r");
 		if (pinfd == NULL) {
 			CACKEY_DEBUG_PRINTF("Error.  %s: Unable to run", pincmd);
 
-			cackey_mutex_unlock(cackey_biglock);
+			if (lock_mutex) {
+				cackey_mutex_unlock(cackey_biglock);
+			}
 
 			CACKEY_DEBUG_PRINTF("Returning CKR_PIN_INCORRECT (%i)", (int) CKR_PIN_INCORRECT);
 
 			return(CKR_PIN_INCORRECT);
 		}
@@ -5253,21 +5272,25 @@
 
 		pclose_ret = pclose(pinfd);
 		if (pclose_ret != 0) {
 			CACKEY_DEBUG_PRINTF("Error.  %s: exited with non-zero status of %i", pincmd, pclose_ret);
 
-			cackey_mutex_unlock(cackey_biglock);
+			if (lock_mutex) {
+				cackey_mutex_unlock(cackey_biglock);
+			}
 
 			CACKEY_DEBUG_PRINTF("Returning CKR_PIN_INCORRECT (%i)", (int) CKR_PIN_INCORRECT);
 
 			return(CKR_PIN_INCORRECT);
 		}
 
 		if (strlen(pinbuf) < 1) {
 			CACKEY_DEBUG_PRINTF("Error.  %s: returned no data", pincmd);
 
-			cackey_mutex_unlock(cackey_biglock);
+			if (lock_mutex) {
+				cackey_mutex_unlock(cackey_biglock);
+			}
 
 			CACKEY_DEBUG_PRINTF("Returning CKR_PIN_INCORRECT (%i)", (int) CKR_PIN_INCORRECT);
 
 			return(CKR_PIN_INCORRECT);
 		}
@@ -5280,11 +5303,13 @@
 		ulPinLen = strlen(pinbuf);
 	}
 
 	login_ret = cackey_login(&cackey_slots[slotID], pPin, ulPinLen, &tries_remaining);
 	if (login_ret != CACKEY_PCSC_S_OK) {
-		cackey_mutex_unlock(cackey_biglock);
+		if (lock_mutex) {
+			cackey_mutex_unlock(cackey_biglock);
+		}
 
 		if (login_ret == CACKEY_PCSC_E_LOCKED) {
 			CACKEY_DEBUG_PRINTF("Error.  Token is locked.");
 
 			cackey_slots[slotID].token_flags |= CKF_USER_PIN_LOCKED;
@@ -5313,21 +5338,27 @@
 
 	cackey_slots[slotID].token_flags &= ~(CKF_USER_PIN_LOCKED | CKF_USER_PIN_COUNT_LOW | CKF_LOGIN_REQUIRED | CKF_USER_PIN_FINAL_TRY);
 
 	cackey_sessions[hSession].state = CKS_RO_USER_FUNCTIONS;
 
-	mutex_retval = cackey_mutex_unlock(cackey_biglock);
-	if (mutex_retval != 0) {
-		CACKEY_DEBUG_PRINTF("Error.  Unlocking failed.");
+	if (lock_mutex) {
+		mutex_retval = cackey_mutex_unlock(cackey_biglock);
+		if (mutex_retval != 0) {
+			CACKEY_DEBUG_PRINTF("Error.  Unlocking failed.");
 
-		return(CKR_GENERAL_ERROR);
+			return(CKR_GENERAL_ERROR);
+		}
 	}
 
 	CACKEY_DEBUG_PRINTF("Returning CKR_OK (%i)", CKR_OK);
 
 	return(CKR_OK);
 }
+
+CK_DEFINE_FUNCTION(CK_RV, C_Login)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen) {
+	return(_C_LoginMutexArg(hSession, userType, pPin, ulPinLen, 1));
+}
 
 CK_DEFINE_FUNCTION(CK_RV, C_Logout)(CK_SESSION_HANDLE hSession) {
 	CK_SLOT_ID slotID;
 	int mutex_retval;
 
@@ -5375,11 +5406,16 @@
 
 		return(CKR_GENERAL_ERROR);
 	}
 
 	cackey_sessions[hSession].state = CKS_RO_PUBLIC_SESSION;
-	cackey_slots[slotID].token_flags = CKF_LOGIN_REQUIRED;
+
+	if (cackey_pin_command == NULL) {
+		cackey_slots[slotID].token_flags = CKF_LOGIN_REQUIRED;
+	} else {
+		cackey_slots[slotID].token_flags = 0;
+	}
 
 	mutex_retval = cackey_mutex_unlock(cackey_biglock);
 	if (mutex_retval != 0) {
 		CACKEY_DEBUG_PRINTF("Error.  Unlocking failed.");
 
@@ -6299,10 +6335,16 @@
 
 	switch (cackey_sessions[hSession].decrypt_mechanism) {
 		case CKM_RSA_PKCS:
 			/* Ask card to decrypt */
 			buflen = cackey_signdecrypt(&cackey_slots[slotID], cackey_sessions[hSession].decrypt_identity, pEncryptedPart, ulEncryptedPartLen, buf, sizeof(buf), 0, 1);
+
+			if (buflen == CACKEY_PCSC_E_NEEDLOGIN && cackey_pin_command != NULL) {
+				if (_C_LoginMutexArg(hSession, CKU_USER, NULL, 0, 0) == CKR_OK) {
+					buflen = cackey_signdecrypt(&cackey_slots[slotID], cackey_sessions[hSession].decrypt_identity, pEncryptedPart, ulEncryptedPartLen, buf, sizeof(buf), 0, 1);
+				}
+			}
 
 			if (buflen < 0) {
 				/* Decryption failed. */
 				if (buflen == CACKEY_PCSC_E_NEEDLOGIN) {
 					retval = CKR_USER_NOT_LOGGED_IN;
@@ -6810,10 +6852,16 @@
 	switch (cackey_sessions[hSession].sign_mechanism) {
 		case CKM_RSA_PKCS:
 			/* Ask card to sign */
 			CACKEY_DEBUG_PRINTF("Asking to sign from identity %p in session %lu", (void *) cackey_sessions[hSession].sign_identity, (unsigned long) hSession);
 			sigbuflen = cackey_signdecrypt(&cackey_slots[slotID], cackey_sessions[hSession].sign_identity, cackey_sessions[hSession].sign_buf, cackey_sessions[hSession].sign_bufused, sigbuf, sizeof(sigbuf), 1, 0);
+
+			if (sigbuflen == CACKEY_PCSC_E_NEEDLOGIN && cackey_pin_command != NULL) {
+				if (_C_LoginMutexArg(hSession, CKU_USER, NULL, 0, 0) == CKR_OK) {
+					sigbuflen = cackey_signdecrypt(&cackey_slots[slotID], cackey_sessions[hSession].sign_identity, cackey_sessions[hSession].sign_buf, cackey_sessions[hSession].sign_bufused, sigbuf, sizeof(sigbuf), 1, 0);
+				}
+			}
 
 			if (sigbuflen < 0) {
 				/* Signing failed. */
 				if (sigbuflen == CACKEY_PCSC_E_NEEDLOGIN) {
 					retval = CKR_USER_NOT_LOGGED_IN;