[gck] Make various objects pretty much immutable.

 * Except for certain flags used during destruction, which we
   use atomically internally.

10 files changed, 265 insertions, 434 deletions

diff --git a/gck/gck-module.c b/gck/gck-module.c
index ef33b857..7e066837 100644
--- a/gck/gck-module.c
+++ b/gck/gck-module.c
@@ -86,23 +86,17 @@ enum {
 	LAST_SIGNAL
 };
 
-typedef struct _GckModuleData {
+struct _GckModulePrivate {
 	GModule *module;
 	gchar *path;
 	gboolean initialized;
 	CK_FUNCTION_LIST_PTR funcs;
 	CK_C_INITIALIZE_ARGS init_args;
-} GckModuleData;
-
-typedef struct _GckModulePrivate {
-	GckModuleData data;
-	GStaticMutex mutex;
-	gboolean finalized;
 	guint options;
-} GckModulePrivate;
 
-#define gck_module_GET_DATA(o) \
-      (G_TYPE_INSTANCE_GET_PRIVATE((o), GCK_TYPE_MODULE, GckModuleData))
+	/* Modified atomically */
+	gint finalized;
+};
 
 G_DEFINE_TYPE (GckModule, gck_module, G_TYPE_OBJECT);
 
@@ -159,39 +153,6 @@ unlock_mutex (void *mutex)
  * INTERNAL
  */
 
-static GckModulePrivate*
-lock_private (gpointer obj)
-{
-	GckModulePrivate *pv;
-	GckModule *self;
-
-	g_assert (GCK_IS_MODULE (obj));
-	self = GCK_MODULE (obj);
-
-	g_object_ref (self);
-
-	pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_MODULE, GckModulePrivate);
-	g_static_mutex_lock (&pv->mutex);
-
-	return pv;
-}
-
-static void
-unlock_private (gpointer obj, GckModulePrivate *pv)
-{
-	GckModule *self;
-
-	g_assert (pv);
-	g_assert (GCK_IS_MODULE (obj));
-
-	self = GCK_MODULE (obj);
-
-	g_assert (G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_MODULE, GckModulePrivate) == pv);
-
-	g_static_mutex_unlock (&pv->mutex);
-	g_object_unref (self);
-}
-
 gboolean
 _gck_module_fire_authenticate_slot (GckModule *self, GckSlot *slot, gchar *label, gchar **password)
 {
@@ -277,8 +238,7 @@ gck_module_real_authenticate_object (GckModule *module, GckObject *object, gchar
 static void
 gck_module_init (GckModule *self)
 {
-	GckModulePrivate *pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_MODULE, GckModulePrivate);
-	g_static_mutex_init (&pv->mutex);
+	self->pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_MODULE, GckModulePrivate);
 }
 
 static void
@@ -305,20 +265,20 @@ gck_module_set_property (GObject *obj, guint prop_id, const GValue *value,
                           GParamSpec *pspec)
 {
 	GckModule *self = GCK_MODULE (obj);
-	GckModuleData *data = gck_module_GET_DATA (obj);
 
 	/* Only allowed during initialization */
 	switch (prop_id) {
 	case PROP_PATH:
-		g_return_if_fail (!data->path);
-		data->path = g_value_dup_string (value);
+		g_return_if_fail (!self->pv->path);
+		self->pv->path = g_value_dup_string (value);
 		break;
 	case PROP_FUNCTIONS:
-		g_return_if_fail (!data->funcs);
-		data->funcs = g_value_get_pointer (value);
+		g_return_if_fail (!self->pv->funcs);
+		self->pv->funcs = g_value_get_pointer (value);
 		break;
 	case PROP_OPTIONS:
-		gck_module_set_options (self, g_value_get_uint (value));
+		g_return_if_fail (!self->pv->options);
+		self->pv->options = g_value_get_uint (value);
 		break;
 	}
 }
@@ -326,26 +286,21 @@ gck_module_set_property (GObject *obj, guint prop_id, const GValue *value,
 static void
 gck_module_dispose (GObject *obj)
 {
-	GckModuleData *data = gck_module_GET_DATA (obj);
-	GckModulePrivate *pv = lock_private (obj);
+	GckModule *self = GCK_MODULE (obj);
 	gboolean finalize = FALSE;
 	CK_RV rv;
 
-	{
-		if (!pv->finalized && data->initialized && data->funcs) {
+	if (self->pv->initialized && self->pv->funcs) {
+		if (g_atomic_int_compare_and_exchange (&self->pv->finalized, 0, 1))
 			finalize = TRUE;
-			pv->finalized = TRUE;
-		}
 	}
 
-	unlock_private (obj, pv);
-
 	/* Must be careful when accessing funcs */
 	if (finalize) {
-		rv = (data->funcs->C_Finalize) (NULL);
+		rv = (self->pv->funcs->C_Finalize) (NULL);
 		if (rv != CKR_OK) {
 			g_warning ("C_Finalize on module '%s' failed: %s",
-			           data->path, gck_message_from_rv (rv));
+			           self->pv->path, gck_message_from_rv (rv));
 		}
 	}
 
@@ -355,22 +310,19 @@ gck_module_dispose (GObject *obj)
 static void
 gck_module_finalize (GObject *obj)
 {
-	GckModulePrivate *pv = G_TYPE_INSTANCE_GET_PRIVATE (obj, GCK_TYPE_MODULE, GckModulePrivate);
-	GckModuleData *data = gck_module_GET_DATA (obj);
+	GckModule *self = GCK_MODULE (obj);
 
-	data->funcs = NULL;
+	self->pv->funcs = NULL;
 
-	if (data->module) {
-		if (!g_module_close (data->module))
+	if (self->pv->module) {
+		if (!g_module_close (self->pv->module))
 			g_warning ("failed to close the pkcs11 module: %s",
 			           g_module_error ());
-		data->module = NULL;
+		self->pv->module = NULL;
 	}
 
-	g_free (data->path);
-	data->path = NULL;
-
-	g_static_mutex_free (&pv->mutex);
+	g_free (self->pv->path);
+	self->pv->path = NULL;
 
 	G_OBJECT_CLASS (gck_module_parent_class)->finalize (obj);
 }
@@ -423,7 +375,7 @@ gck_module_class_init (GckModuleClass *klass)
 	 */
 	g_object_class_install_property (gobject_class, PROP_OPTIONS,
 		g_param_spec_uint ("options", "Options", "Module options",
-		                  0, G_MAXUINT, 0, G_PARAM_READWRITE));
+		                  0, G_MAXUINT, 0, G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
 
 	/**
 	 * GckModule::authenticate-slot:
@@ -488,6 +440,7 @@ gck_module_info_free (GckModuleInfo *module_info)
  * gck_module_initialize:
  * @path: The file system path to the PKCS#11 module to load.
  * @reserved: Extra arguments for the PKCS#11 module, should usually be NULL.
+ * @options: Options which control the authentication behavior etc.
  * @err: A location to store an error resulting from a failed load.
  *
  * Load and initialize a PKCS#11 module represented by a GckModule object.
@@ -495,13 +448,12 @@ gck_module_info_free (GckModuleInfo *module_info)
  * Return value: The loaded PKCS#11 module or NULL if failed.
  **/
 GckModule*
-gck_module_initialize (const gchar *path, gpointer reserved, GError **err)
+gck_module_initialize (const gchar *path, gpointer reserved, guint options, GError **err)
 {
 	CK_C_GetFunctionList get_function_list;
 	CK_FUNCTION_LIST_PTR funcs;
-	GckModuleData *data;
 	GModule *module;
-	GckModule *mod;
+	GckModule *self;
 	CK_RV rv;
 
 	g_return_val_if_fail (path != NULL, NULL);
@@ -532,29 +484,28 @@ gck_module_initialize (const gchar *path, gpointer reserved, GError **err)
 		return NULL;
 	}
 
-	mod = g_object_new (GCK_TYPE_MODULE, "functions", funcs, "path", path, NULL);
-	data = gck_module_GET_DATA (mod);
-	data->module = module;
+	self = g_object_new (GCK_TYPE_MODULE, "functions", funcs, "path", path, "options", options, NULL);
+	self->pv->module = module;
 
-	memset (&data->init_args, 0, sizeof (data->init_args));
-	data->init_args.flags = CKF_OS_LOCKING_OK;
-	data->init_args.CreateMutex = create_mutex;
-	data->init_args.DestroyMutex = destroy_mutex;
-	data->init_args.LockMutex = lock_mutex;
-	data->init_args.UnlockMutex = unlock_mutex;
-	data->init_args.pReserved = reserved;
+	memset (&self->pv->init_args, 0, sizeof (self->pv->init_args));
+	self->pv->init_args.flags = CKF_OS_LOCKING_OK;
+	self->pv->init_args.CreateMutex = create_mutex;
+	self->pv->init_args.DestroyMutex = destroy_mutex;
+	self->pv->init_args.LockMutex = lock_mutex;
+	self->pv->init_args.UnlockMutex = unlock_mutex;
+	self->pv->init_args.pReserved = reserved;
 
 	/* Now initialize the module */
-	rv = (data->funcs->C_Initialize) (&data->init_args);
+	rv = (self->pv->funcs->C_Initialize) (&self->pv->init_args);
 	if (rv != CKR_OK) {
 		g_set_error (err, GCK_ERROR, rv, "Couldn't initialize module: %s",
 		             gck_message_from_rv (rv));
-		g_object_unref (mod);
+		g_object_unref (self);
 		return NULL;
 	}
 
-	data->initialized = TRUE;
-	return mod;
+	self->pv->initialized = TRUE;
+	return self;
 }
 
 /**
@@ -568,10 +519,10 @@ gck_module_initialize (const gchar *path, gpointer reserved, GError **err)
  * Return value: The new PKCS#11 module.
  **/
 GckModule*
-gck_module_new (CK_FUNCTION_LIST_PTR funcs)
+gck_module_new (CK_FUNCTION_LIST_PTR funcs, guint options)
 {
 	g_return_val_if_fail (funcs, NULL);
-	return g_object_new (GCK_TYPE_MODULE, "functions", funcs, NULL);
+	return g_object_new (GCK_TYPE_MODULE, "functions", funcs, "options", options, NULL);
 }
 
 /**
@@ -587,17 +538,17 @@ gck_module_new (CK_FUNCTION_LIST_PTR funcs)
 gboolean
 gck_module_equal (gconstpointer module1, gconstpointer module2)
 {
-	GckModuleData *data1, *data2;
+	GckModule *mod1, *mod2;
 
 	if (module1 == module2)
 		return TRUE;
 	if (!GCK_IS_MODULE (module1) || !GCK_IS_MODULE (module2))
 		return FALSE;
 
-	data1 = gck_module_GET_DATA (module1);
-	data2 = gck_module_GET_DATA (module2);
+	mod1 = GCK_MODULE (module1);
+	mod2 = GCK_MODULE (module2);
 
-	return data1->funcs == data2->funcs;
+	return mod1->pv->funcs == mod2->pv->funcs;
 }
 
 /**
@@ -614,13 +565,11 @@ gck_module_equal (gconstpointer module1, gconstpointer module2)
 guint
 gck_module_hash (gconstpointer module)
 {
-	GckModuleData *data;
+	GckModule *self;
 
 	g_return_val_if_fail (GCK_IS_MODULE (module), 0);
-
-	data = gck_module_GET_DATA (module);
-
-	return g_direct_hash (data->funcs);
+	self = GCK_MODULE (module);
+	return g_direct_hash (self->pv->funcs);
 }
 
 /**
@@ -634,16 +583,15 @@ gck_module_hash (gconstpointer module)
 GckModuleInfo*
 gck_module_get_info (GckModule *self)
 {
-	GckModuleData *data = gck_module_GET_DATA (self);
 	GckModuleInfo *modinfo;
 	CK_INFO info;
 	CK_RV rv;
 
 	g_return_val_if_fail (GCK_IS_MODULE (self), NULL);
-	g_return_val_if_fail (data->funcs, NULL);
+	g_return_val_if_fail (self->pv->funcs, NULL);
 
 	memset (&info, 0, sizeof (info));
-	rv = (data->funcs->C_GetInfo (&info));
+	rv = (self->pv->funcs->C_GetInfo (&info));
 	if (rv != CKR_OK) {
 		g_warning ("couldn't get module info: %s", gck_message_from_rv (rv));
 		return NULL;
@@ -675,16 +623,15 @@ gck_module_get_info (GckModule *self)
 GList*
 gck_module_get_slots (GckModule *self, gboolean token_present)
 {
-	GckModuleData *data = gck_module_GET_DATA (self);
 	CK_SLOT_ID_PTR slot_list;
 	CK_ULONG count, i;
 	GList *result;
 	CK_RV rv;
 
 	g_return_val_if_fail (GCK_IS_MODULE (self), NULL);
-	g_return_val_if_fail (data->funcs, NULL);
+	g_return_val_if_fail (self->pv->funcs, NULL);
 
-	rv = (data->funcs->C_GetSlotList) (token_present ? CK_TRUE : CK_FALSE, NULL, &count);
+	rv = (self->pv->funcs->C_GetSlotList) (token_present ? CK_TRUE : CK_FALSE, NULL, &count);
 	if (rv != CKR_OK) {
 		g_warning ("couldn't get slot count: %s", gck_message_from_rv (rv));
 		return NULL;
@@ -694,7 +641,7 @@ gck_module_get_slots (GckModule *self, gboolean token_present)
 		return NULL;
 
 	slot_list = g_new (CK_SLOT_ID, count);
-	rv = (data->funcs->C_GetSlotList) (token_present ? CK_TRUE : CK_FALSE, slot_list, &count);
+	rv = (self->pv->funcs->C_GetSlotList) (token_present ? CK_TRUE : CK_FALSE, slot_list, &count);
 	if (rv != CKR_OK) {
 		g_warning ("couldn't get slot list: %s", gck_message_from_rv (rv));
 		g_free (slot_list);
@@ -724,9 +671,8 @@ gck_module_get_slots (GckModule *self, gboolean token_present)
 const gchar*
 gck_module_get_path (GckModule *self)
 {
-	GckModuleData *data = gck_module_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_MODULE (self), NULL);
-	return data->path;
+	return self->pv->path;
 }
 
 /**
@@ -740,9 +686,8 @@ gck_module_get_path (GckModule *self)
 CK_FUNCTION_LIST_PTR
 gck_module_get_functions (GckModule *self)
 {
-	GckModuleData *data = gck_module_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_MODULE (self), NULL);
-	return data->funcs;
+	return self->pv->funcs;
 }
 
 
@@ -757,56 +702,6 @@ gck_module_get_functions (GckModule *self)
 guint
 gck_module_get_options (GckModule *self)
 {
-	GckModulePrivate *pv = lock_private (self);
-	guint ret;
-
-	g_return_val_if_fail (pv, FALSE);
-
-	{
-		ret = pv->options;
-	}
-
-	unlock_private (self, pv);
-
-	return ret;
-}
-
-/**
- * gck_module_set_options:
- * @self: The module to set the setting on.
- * @options: Authentication and other options..
- **/
-void
-gck_module_set_options (GckModule *self, guint options)
-{
-	GckModulePrivate *pv = lock_private (self);
-
-	g_return_if_fail (pv);
-
-	{
-		pv->options = options;
-	}
-
-	unlock_private (self, pv);
-	g_object_notify (G_OBJECT (self), "options");
-}
-
-/**
- * gck_module_add_options:
- * @self: The module to add the option on.
- * @options: Authentication and other options..
- **/
-void
-gck_module_add_options (GckModule *self, guint options)
-{
-	GckModulePrivate *pv = lock_private (self);
-
-	g_return_if_fail (pv);
-
-	{
-		pv->options |= options;
-	}
-
-	unlock_private (self, pv);
-	g_object_notify (G_OBJECT (self), "options");
+	g_return_val_if_fail (GCK_IS_MODULE (self), 0);
+	return self->pv->options;
 }
diff --git a/gck/gck-object.c b/gck/gck-object.c
index ce9cb201..2cea15d4 100644
--- a/gck/gck-object.c
+++ b/gck/gck-object.c
@@ -56,18 +56,11 @@ enum {
 	PROP_HANDLE
 };
 
-typedef struct _GckObjectData {
+struct _GckObjectPrivate {
 	GckModule *module;
 	GckSession *session;
 	CK_OBJECT_HANDLE handle;
-} GckObjectData;
-
-typedef struct _GckObjectPrivate {
-	GckObjectData data;
-} GckObjectPrivate;
-
-#define GCK_OBJECT_GET_DATA(o) \
-      (G_TYPE_INSTANCE_GET_PRIVATE((o), GCK_TYPE_OBJECT, GckObjectData))
+};
 
 G_DEFINE_TYPE (GckObject, gck_object, G_TYPE_OBJECT);
 
@@ -78,7 +71,7 @@ G_DEFINE_TYPE (GckObject, gck_object, G_TYPE_OBJECT);
 static void
 gck_object_init (GckObject *self)
 {
-
+	self->pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_OBJECT, GckObjectPrivate);
 }
 
 static void
@@ -102,28 +95,28 @@ gck_object_get_property (GObject *obj, guint prop_id, GValue *value,
 
 static void
 gck_object_set_property (GObject *obj, guint prop_id, const GValue *value,
-                          GParamSpec *pspec)
+                         GParamSpec *pspec)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (obj);
+	GckObject *self = GCK_OBJECT (obj);
 
 	/* The sets to data below are only allowed during construction */
 
 	switch (prop_id) {
 	case PROP_MODULE:
-		g_return_if_fail (!data->module);
-		data->module = g_value_get_object (value);
-		g_return_if_fail (data->module);
-		g_object_ref (data->module);
+		g_return_if_fail (!self->pv->module);
+		self->pv->module = g_value_get_object (value);
+		g_return_if_fail (self->pv->module);
+		g_object_ref (self->pv->module);
 		break;
 	case PROP_SESSION:
-		g_return_if_fail (!data->session);
-		data->session = g_value_get_object (value);
-		g_return_if_fail (data->session);
-		g_object_ref (data->session);
+		g_return_if_fail (!self->pv->session);
+		self->pv->session = g_value_get_object (value);
+		g_return_if_fail (self->pv->session);
+		g_object_ref (self->pv->session);
 		break;
 	case PROP_HANDLE:
-		g_return_if_fail (!data->handle);
-		data->handle = g_value_get_ulong (value);
+		g_return_if_fail (!self->pv->handle);
+		self->pv->handle = g_value_get_ulong (value);
 		break;
 	}
 }
@@ -131,17 +124,17 @@ gck_object_set_property (GObject *obj, guint prop_id, const GValue *value,
 static void
 gck_object_finalize (GObject *obj)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (obj);
+	GckObject *self = GCK_OBJECT (obj);
 
-	if (data->session)
-		g_object_unref (data->session);
-	data->session = NULL;
+	if (self->pv->session)
+		g_object_unref (self->pv->session);
+	self->pv->session = NULL;
 
-	if (data->module)
-		g_object_unref (data->module);
-	data->module = NULL;
+	if (self->pv->module)
+		g_object_unref (self->pv->module);
+	self->pv->module = NULL;
 
-	data->handle = 0;
+	self->pv->handle = 0;
 
 	G_OBJECT_CLASS (gck_object_parent_class)->finalize (obj);
 }
@@ -259,7 +252,7 @@ gck_objects_from_handle_array (GckSession *session, CK_OBJECT_HANDLE_PTR handles
 gboolean
 gck_object_equal (gconstpointer object1, gconstpointer object2)
 {
-	GckObjectData *data1, *data2;
+	GckObject *obj1, *obj2;
 	GckSlot *slot1, *slot2;
 	gboolean ret;
 
@@ -268,13 +261,13 @@ gck_object_equal (gconstpointer object1, gconstpointer object2)
 	if (!GCK_IS_OBJECT (object1) || !GCK_IS_OBJECT (object2))
 		return FALSE;
 
-	data1 = GCK_OBJECT_GET_DATA (object1);
-	data2 = GCK_OBJECT_GET_DATA (object2);
+	obj1 = GCK_OBJECT (object1);
+	obj2 = GCK_OBJECT (object2);
 
-	slot1 = gck_session_get_slot (data1->session);
-	slot2 = gck_session_get_slot (data2->session);
+	slot1 = gck_session_get_slot (obj1->pv->session);
+	slot2 = gck_session_get_slot (obj2->pv->session);
 
-	ret = data1->handle == data2->handle &&
+	ret = obj1->pv->handle == obj2->pv->handle &&
 	      gck_slot_equal (slot1, slot2);
 
 	g_object_unref (slot1);
@@ -297,16 +290,16 @@ gck_object_equal (gconstpointer object1, gconstpointer object2)
 guint
 gck_object_hash (gconstpointer object)
 {
-	GckObjectData *data;
+	GckObject *self;
 	GckSlot *slot;
 	guint hash;
 
 	g_return_val_if_fail (GCK_IS_OBJECT (object), 0);
 
-	data = GCK_OBJECT_GET_DATA (object);
-	slot = gck_session_get_slot (data->session);
+	self = GCK_OBJECT (object);
+	slot = gck_session_get_slot (self->pv->session);
 
-	hash = _gck_ulong_hash (&data->handle) ^
+	hash = _gck_ulong_hash (&self->pv->handle) ^
 	       gck_slot_hash (slot);
 
 	g_object_unref (slot);
@@ -326,9 +319,8 @@ gck_object_hash (gconstpointer object)
 CK_OBJECT_HANDLE
 gck_object_get_handle (GckObject *self)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_OBJECT (self), (CK_OBJECT_HANDLE)-1);
-	return data->handle;
+	return self->pv->handle;
 }
 
 /**
@@ -342,10 +334,9 @@ gck_object_get_handle (GckObject *self)
 GckModule*
 gck_object_get_module (GckObject *self)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_OBJECT (self), NULL);
-	g_return_val_if_fail (GCK_IS_MODULE (data->module), NULL);
-	return g_object_ref (data->module);
+	g_return_val_if_fail (GCK_IS_MODULE (self->pv->module), NULL);
+	return g_object_ref (self->pv->module);
 }
 
 
@@ -365,10 +356,9 @@ gck_object_get_module (GckObject *self)
 GckSession*
 gck_object_get_session (GckObject *self)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_OBJECT (self), NULL);
-	g_return_val_if_fail (GCK_IS_SESSION (data->session), NULL);
-	return g_object_ref (data->session);
+	g_return_val_if_fail (GCK_IS_SESSION (self->pv->session), NULL);
+	return g_object_ref (self->pv->session);
 }
 
 /* --------------------------------------------------------------------------------------
@@ -419,15 +409,14 @@ gck_object_destroy (GckObject *self, GError **err)
 gboolean
 gck_object_destroy_full (GckObject *self, GCancellable *cancellable, GError **err)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	Destroy args = { GCK_ARGUMENTS_INIT, 0 };
 
 	g_return_val_if_fail (GCK_IS_OBJECT (self), FALSE);
-	g_return_val_if_fail (GCK_IS_SESSION (data->session), FALSE);
+	g_return_val_if_fail (GCK_IS_SESSION (self->pv->session), FALSE);
 	g_return_val_if_fail (!err || !*err, FALSE);
 
-	args.object = data->handle;
-	return _gck_call_sync (data->session, perform_destroy, NULL, &args, cancellable, err);
+	args.object = self->pv->handle;
+	return _gck_call_sync (self->pv->session, perform_destroy, NULL, &args, cancellable, err);
 }
 
 /**
@@ -444,14 +433,13 @@ void
 gck_object_destroy_async (GckObject *self, GCancellable *cancellable,
                            GAsyncReadyCallback callback, gpointer user_data)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	Destroy* args;
 
 	g_return_if_fail (GCK_IS_OBJECT (self));
-	g_return_if_fail (GCK_IS_SESSION (data->session));
+	g_return_if_fail (GCK_IS_SESSION (self->pv->session));
 
-	args = _gck_call_async_prep (data->session, self, perform_destroy, NULL, sizeof (*args), NULL);
-	args->object = data->handle;
+	args = _gck_call_async_prep (self->pv->session, self, perform_destroy, NULL, sizeof (*args), NULL);
+	args->object = self->pv->handle;
 
 	_gck_call_async_ready_go (args, cancellable, callback, user_data);
 }
@@ -521,7 +509,6 @@ gboolean
 gck_object_set (GckObject *self, GckAttributes *attrs,
                 GCancellable *cancellable, GError **err)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	SetAttributes args;
 	gboolean ret = FALSE;
 
@@ -533,9 +520,9 @@ gck_object_set (GckObject *self, GckAttributes *attrs,
 
 	memset (&args, 0, sizeof (args));
 	args.attrs = attrs;
-	args.object = data->handle;
+	args.object = self->pv->handle;
 
-	ret = _gck_call_sync (data->session, perform_set_attributes, NULL, &args, cancellable, err);
+	ret = _gck_call_sync (self->pv->session, perform_set_attributes, NULL, &args, cancellable, err);
 
 	_gck_attributes_unlock (attrs);
 	return ret;
@@ -556,18 +543,17 @@ void
 gck_object_set_async (GckObject *self, GckAttributes *attrs, GCancellable *cancellable,
                        GAsyncReadyCallback callback, gpointer user_data)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	SetAttributes *args;
 
 	g_return_if_fail (GCK_IS_OBJECT (self));
 	g_return_if_fail (attrs);
 
-	args = _gck_call_async_prep (data->session, self, perform_set_attributes,
+	args = _gck_call_async_prep (self->pv->session, self, perform_set_attributes,
 	                             NULL, sizeof (*args), free_set_attributes);
 
 	_gck_attributes_lock (attrs);
 	args->attrs = gck_attributes_ref (attrs);
-	args->object = data->handle;
+	args->object = self->pv->handle;
 
 	_gck_call_async_ready_go (args, cancellable, callback, user_data);
 }
@@ -730,7 +716,6 @@ GckAttributes*
 gck_object_get_full (GckObject *self, GckAttributes *attrs,
                       GCancellable *cancellable, GError **err)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	GetAttributes args;
 	gboolean ret;
 
@@ -742,9 +727,9 @@ gck_object_get_full (GckObject *self, GckAttributes *attrs,
 
 	memset (&args, 0, sizeof (args));
 	args.attrs = attrs;
-	args.object = data->handle;
+	args.object = self->pv->handle;
 
-	ret = _gck_call_sync (data->session, perform_get_attributes, NULL, &args, cancellable, err);
+	ret = _gck_call_sync (self->pv->session, perform_get_attributes, NULL, &args, cancellable, err);
 	_gck_attributes_unlock (attrs);
 
 	return ret ? attrs : NULL;
@@ -769,18 +754,17 @@ void
 gck_object_get_async (GckObject *self, GckAttributes *attrs, GCancellable *cancellable,
                        GAsyncReadyCallback callback, gpointer user_data)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	GetAttributes *args;
 
 	g_return_if_fail (GCK_IS_OBJECT (self));
 	g_return_if_fail (attrs);
 
-	args = _gck_call_async_prep (data->session, self, perform_get_attributes,
+	args = _gck_call_async_prep (self->pv->session, self, perform_get_attributes,
 	                             NULL, sizeof (*args), free_get_attributes);
 
 	_gck_attributes_lock (attrs);
 	args->attrs = gck_attributes_ref (attrs);
-	args->object = data->handle;
+	args->object = self->pv->handle;
 
 	_gck_call_async_ready_go (args, cancellable, callback, user_data);
 }
@@ -918,7 +902,6 @@ gpointer
 gck_object_get_data_full (GckObject *self, gulong attr_type, GckAllocator allocator,
                            GCancellable *cancellable, gsize *n_data, GError **err)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	GetAttributeData args;
 	gboolean ret;
 
@@ -931,10 +914,10 @@ gck_object_get_data_full (GckObject *self, gulong attr_type, GckAllocator alloca
 
 	memset (&args, 0, sizeof (args));
 	args.allocator = allocator;
-	args.object = data->handle;
+	args.object = self->pv->handle;
 	args.type = attr_type;
 
-	ret = _gck_call_sync (data->session, perform_get_attribute_data, NULL, &args, cancellable, err);
+	ret = _gck_call_sync (self->pv->session, perform_get_attribute_data, NULL, &args, cancellable, err);
 
 	/* Free any value if failed */
 	if (!ret) {
@@ -965,7 +948,6 @@ gck_object_get_data_async (GckObject *self, gulong attr_type, GckAllocator alloc
                             GCancellable *cancellable, GAsyncReadyCallback callback,
                             gpointer user_data)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	GetAttributeData *args;
 
 	g_return_if_fail (GCK_IS_OBJECT (self));
@@ -973,11 +955,11 @@ gck_object_get_data_async (GckObject *self, gulong attr_type, GckAllocator alloc
 	if (!allocator)
 		allocator = g_realloc;
 
-	args = _gck_call_async_prep (data->session, self, perform_get_attribute_data,
+	args = _gck_call_async_prep (self->pv->session, self, perform_get_attribute_data,
 	                             NULL, sizeof (*args), free_get_attribute_data);
 
 	args->allocator = allocator;
-	args->object = data->handle;
+	args->object = self->pv->handle;
 	args->type = attr_type;
 
 	_gck_call_async_ready_go (args, cancellable, callback, user_data);
@@ -1097,7 +1079,6 @@ gboolean
 gck_object_set_template_full (GckObject *self, gulong attr_type, GckAttributes *attrs,
                                GCancellable *cancellable, GError **err)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	set_template_args args;
 	gboolean ret = FALSE;
 
@@ -1110,9 +1091,9 @@ gck_object_set_template_full (GckObject *self, gulong attr_type, GckAttributes *
 	memset (&args, 0, sizeof (args));
 	args.attrs = attrs;
 	args.type = attr_type;
-	args.object = data->handle;
+	args.object = self->pv->handle;
 
-	ret = _gck_call_sync (data->session, perform_set_template, NULL, &args, cancellable, err);
+	ret = _gck_call_sync (self->pv->session, perform_set_template, NULL, &args, cancellable, err);
 
 	_gck_attributes_unlock (attrs);
 	return ret;
@@ -1137,19 +1118,18 @@ gck_object_set_template_async (GckObject *self, gulong attr_type, GckAttributes
                                 GCancellable *cancellable, GAsyncReadyCallback callback,
                                 gpointer user_data)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	set_template_args *args;
 
 	g_return_if_fail (GCK_IS_OBJECT (self));
 	g_return_if_fail (attrs);
 
-	args = _gck_call_async_prep (data->session, self, perform_set_template,
+	args = _gck_call_async_prep (self->pv->session, self, perform_set_template,
 	                             NULL, sizeof (*args), free_set_template);
 
 	_gck_attributes_lock (attrs);
 	args->attrs = gck_attributes_ref (attrs);
 	args->type = attr_type;
-	args->object = data->handle;
+	args->object = self->pv->handle;
 
 	_gck_call_async_ready_go (args, cancellable, callback, user_data);
 }
@@ -1282,7 +1262,6 @@ GckAttributes*
 gck_object_get_template_full (GckObject *self, gulong attr_type,
                                GCancellable *cancellable, GError **err)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	get_template_args args;
 	gboolean ret;
 
@@ -1290,10 +1269,10 @@ gck_object_get_template_full (GckObject *self, gulong attr_type,
 	g_return_val_if_fail (!err || !*err, NULL);
 
 	memset (&args, 0, sizeof (args));
-	args.object = data->handle;
+	args.object = self->pv->handle;
 	args.type = attr_type;
 
-	ret = _gck_call_sync (data->session, perform_get_template, NULL, &args, cancellable, err);
+	ret = _gck_call_sync (self->pv->session, perform_get_template, NULL, &args, cancellable, err);
 
 	_gck_attributes_unlock (args.attrs);
 
@@ -1324,15 +1303,14 @@ gck_object_get_template_async (GckObject *self, gulong attr_type,
                                 GCancellable *cancellable, GAsyncReadyCallback callback,
                                 gpointer user_data)
 {
-	GckObjectData *data = GCK_OBJECT_GET_DATA (self);
 	get_template_args *args;
 
 	g_return_if_fail (GCK_IS_OBJECT (self));
 
-	args = _gck_call_async_prep (data->session, self, perform_get_template,
+	args = _gck_call_async_prep (self->pv->session, self, perform_get_template,
 	                             NULL, sizeof (*args), free_get_template);
 
-	args->object = data->handle;
+	args->object = self->pv->handle;
 	args->type = attr_type;
 
 	_gck_call_async_ready_go (args, cancellable, callback, user_data);
diff --git a/gck/gck-session.c b/gck/gck-session.c
index 7d331ecd..9813a319 100644
--- a/gck/gck-session.c
+++ b/gck/gck-session.c
@@ -67,84 +67,35 @@ enum {
 	PROP_SLOT
 };
 
-typedef struct _GckSessionData {
+struct _GckSessionPrivate {
 	GckSlot *slot;
 	GckModule *module;
 	CK_SESSION_HANDLE handle;
-} GckSessionData;
-
-typedef struct _GckSessionPrivate {
-
-	/* Remain same from init to finalize */
-	GckSessionData data;
 
 	/* Modified atomically */
 	gint discarded;
-	gint auto_login;
-
-} GckSessionPrivate;
-
-#define GCK_SESSION_GET_DATA(o) \
-      (G_TYPE_INSTANCE_GET_PRIVATE((o), GCK_TYPE_SESSION, GckSessionData))
+};
 
 G_DEFINE_TYPE (GckSession, gck_session, G_TYPE_OBJECT);
 
 static guint signals[LAST_SIGNAL] = { 0 };
 
 /* ----------------------------------------------------------------------------
- * HELPERS
- */
-
-static GckSessionPrivate*
-lock_private (gpointer obj)
-{
-	GckSessionPrivate *pv;
-	GckSession *self;
-
-	g_return_val_if_fail (GCK_IS_SESSION (obj), NULL);
-	self = GCK_SESSION (obj);
-
-	g_object_ref (self);
-
-	pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_SESSION, GckSessionPrivate);
-	/* g_static_mutex_lock (&pv->mutex); */
-
-	return pv;
-}
-
-static void
-unlock_private (gpointer obj, GckSessionPrivate *pv)
-{
-	GckSession *self;
-
-	g_assert (pv);
-	g_assert (GCK_IS_SESSION (obj));
-
-	self = GCK_SESSION (obj);
-
-	g_assert (G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_SESSION, GckSessionPrivate) == pv);
-
-	/* g_static_mutex_unlock (&pv->mutex); */
-	g_object_unref (self);
-}
-
-/* ----------------------------------------------------------------------------
  * OBJECT
  */
 
 static gboolean
 gck_session_real_discard_handle (GckSession *self, CK_OBJECT_HANDLE handle)
 {
-	GckSessionData *data = GCK_SESSION_GET_DATA (self);
 	CK_FUNCTION_LIST_PTR funcs;
 	CK_RV rv;
 
 	/* The default functionality, close the handle */
 
-	g_return_val_if_fail (data->module, FALSE);
-	g_object_ref (data->module);
+	g_return_val_if_fail (self->pv->module, FALSE);
+	g_object_ref (self->pv->module);
 
-	funcs = gck_module_get_functions (data->module);
+	funcs = gck_module_get_functions (self->pv->module);
 	g_return_val_if_fail (funcs, FALSE);
 
 	rv = (funcs->C_CloseSession) (handle);
@@ -153,14 +104,14 @@ gck_session_real_discard_handle (GckSession *self, CK_OBJECT_HANDLE handle)
 		           gck_message_from_rv (rv));
 	}
 
-	g_object_unref (data->module);
+	g_object_unref (self->pv->module);
 	return TRUE;
 }
 
 static void
 gck_session_init (GckSession *self)
 {
-
+	self->pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_SESSION, GckSessionPrivate);
 }
 
 static void
@@ -186,24 +137,24 @@ static void
 gck_session_set_property (GObject *obj, guint prop_id, const GValue *value,
                            GParamSpec *pspec)
 {
-	GckSessionData *data = GCK_SESSION_GET_DATA (obj);
+	GckSession *self = GCK_SESSION (obj);
 
 	/* Only valid calls are from constructor */
 
 	switch (prop_id) {
 	case PROP_MODULE:
-		g_return_if_fail (!data->module);
-		data->module = g_value_dup_object (value);
-		g_return_if_fail (data->module);
+		g_return_if_fail (!self->pv->module);
+		self->pv->module = g_value_dup_object (value);
+		g_return_if_fail (self->pv->module);
 		break;
 	case PROP_HANDLE:
-		g_return_if_fail (!data->handle);
-		data->handle = g_value_get_ulong (value);
+		g_return_if_fail (!self->pv->handle);
+		self->pv->handle = g_value_get_ulong (value);
 		break;
 	case PROP_SLOT:
-		g_return_if_fail (!data->slot);
-		data->slot = g_value_dup_object (value);
-		g_return_if_fail (data->slot);
+		g_return_if_fail (!self->pv->slot);
+		self->pv->slot = g_value_dup_object (value);
+		g_return_if_fail (self->pv->slot);
 		break;
 	}
 }
@@ -211,50 +162,39 @@ gck_session_set_property (GObject *obj, guint prop_id, const GValue *value,
 static void
 gck_session_dispose (GObject *obj)
 {
-	GckSessionPrivate *pv;
 	GckSession *self = GCK_SESSION (obj);
 	gboolean handled;
-	gint discarded;
 
 	g_return_if_fail (GCK_IS_SESSION (self));
 
-	pv = lock_private (obj);
-
-	{
-		discarded = g_atomic_int_get (&pv->discarded);
-		if (!discarded && g_atomic_int_compare_and_exchange (&pv->discarded, discarded, 1)) {
+	if (g_atomic_int_compare_and_exchange (&self->pv->discarded, 0, 1)) {
 
-			/*
-			 * Let the world know that we're discarding the session
-			 * handle. This allows session reuse to work.
-			 */
-
-			g_signal_emit_by_name (self, "discard-handle", pv->data.handle, &handled);
-			g_return_if_fail (handled);
-		}
+		/*
+		 * Let the world know that we're discarding the session
+		 * handle. This allows any necessary session reuse to work.
+		 */
 
+		g_signal_emit_by_name (self, "discard-handle", self->pv->handle, &handled);
+		g_return_if_fail (handled);
 	}
 
-	unlock_private (obj, pv);
-
 	G_OBJECT_CLASS (gck_session_parent_class)->dispose (obj);
 }
 
 static void
 gck_session_finalize (GObject *obj)
 {
-	GckSessionPrivate *pv = G_TYPE_INSTANCE_GET_PRIVATE (obj, GCK_TYPE_SESSION, GckSessionPrivate);
-	GckSessionData *data = GCK_SESSION_GET_DATA (obj);
+	GckSession *self = GCK_SESSION (obj);
 
-	g_assert (pv->discarded != 0);
+	g_assert (g_atomic_int_get (&self->pv->discarded) != 0);
 
-	if (data->slot)
-		g_object_unref (data->slot);
-	data->slot = NULL;
+	if (self->pv->slot)
+		g_object_unref (self->pv->slot);
+	self->pv->slot = NULL;
 
-	if (data->module)
-		g_object_unref (data->module);
-	data->module = NULL;
+	if (self->pv->module)
+		g_object_unref (self->pv->module);
+	self->pv->module = NULL;
 
 	G_OBJECT_CLASS (gck_session_parent_class)->finalize (obj);
 }
@@ -388,9 +328,8 @@ gck_session_from_handle (GckSlot *slot, CK_SESSION_HANDLE handle)
 CK_SESSION_HANDLE
 gck_session_get_handle (GckSession *self)
 {
-	GckSessionData *data = GCK_SESSION_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_SESSION (self), (CK_SESSION_HANDLE)-1);
-	return data->handle;
+	return self->pv->handle;
 }
 
 /**
@@ -404,10 +343,9 @@ gck_session_get_handle (GckSession *self)
 GckModule*
 gck_session_get_module (GckSession *self)
 {
-	GckSessionData *data = GCK_SESSION_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_SESSION (self), NULL);
-	g_return_val_if_fail (GCK_IS_MODULE (data->module), NULL);
-	return g_object_ref (data->module);
+	g_return_val_if_fail (GCK_IS_MODULE (self->pv->module), NULL);
+	return g_object_ref (self->pv->module);
 }
 
 /**
@@ -421,10 +359,9 @@ gck_session_get_module (GckSession *self)
 GckSlot*
 gck_session_get_slot (GckSession *self)
 {
-	GckSessionData *data = GCK_SESSION_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_SESSION (self), NULL);
-	g_return_val_if_fail (GCK_IS_SLOT (data->slot), NULL);
-	return g_object_ref (data->slot);
+	g_return_val_if_fail (GCK_IS_SLOT (self->pv->slot), NULL);
+	return g_object_ref (self->pv->slot);
 }
 
 /**
@@ -439,24 +376,23 @@ gck_session_get_slot (GckSession *self)
 GckSessionInfo*
 gck_session_get_info (GckSession *self)
 {
-	GckSessionData *data = GCK_SESSION_GET_DATA (self);
 	GckSessionInfo *sessioninfo;
 	CK_FUNCTION_LIST_PTR funcs;
 	CK_SESSION_INFO info;
 	CK_RV rv;
 
 	g_return_val_if_fail (GCK_IS_SESSION (self), NULL);
-	g_return_val_if_fail (GCK_IS_MODULE (data->module), NULL);
+	g_return_val_if_fail (GCK_IS_MODULE (self->pv->module), NULL);
 
-	g_object_ref (data->module);
+	g_object_ref (self->pv->module);
 
-	funcs = gck_module_get_functions (data->module);
+	funcs = gck_module_get_functions (self->pv->module);
 	g_return_val_if_fail (funcs, NULL);
 
 	memset (&info, 0, sizeof (info));
-	rv = (funcs->C_GetSessionInfo) (data->handle, &info);
+	rv = (funcs->C_GetSessionInfo) (self->pv->handle, &info);
 
-	g_object_unref (data->module);
+	g_object_unref (self->pv->module);
 
 	if (rv != CKR_OK) {
 		g_warning ("couldn't get session info: %s", gck_message_from_rv (rv));
diff --git a/gck/gck-slot.c b/gck/gck-slot.c
index 6afe3f3b..2b0aec93 100644
--- a/gck/gck-slot.c
+++ b/gck/gck-slot.c
@@ -49,20 +49,13 @@ enum {
 	PROP_HANDLE
 };
 
-typedef struct _GckSlotData {
+struct _GckSlotPrivate {
 	GckModule *module;
 	CK_SLOT_ID handle;
-} GckSlotData;
-
-typedef struct _GckSlotPrivate {
-	GckSlotData data;
-} GckSlotPrivate;
+};
 
 G_DEFINE_TYPE (GckSlot, gck_slot, G_TYPE_OBJECT);
 
-#define GCK_SLOT_GET_DATA(o) \
-      (G_TYPE_INSTANCE_GET_PRIVATE((o), GCK_TYPE_SLOT, GckSlotData))
-
 #ifndef HAVE_TIMEGM
 
 time_t
@@ -125,12 +118,12 @@ make_session_object (GckSlot *self, gulong flags, CK_SESSION_HANDLE handle)
 static void
 gck_slot_init (GckSlot *self)
 {
-
+	self->pv = G_TYPE_INSTANCE_GET_PRIVATE (self, GCK_TYPE_SLOT, GckSlotPrivate);
 }
 
 static void
 gck_slot_get_property (GObject *obj, guint prop_id, GValue *value,
-                        GParamSpec *pspec)
+                       GParamSpec *pspec)
 {
 	GckSlot *self = GCK_SLOT (obj);
 
@@ -148,20 +141,20 @@ static void
 gck_slot_set_property (GObject *obj, guint prop_id, const GValue *value,
                         GParamSpec *pspec)
 {
-	GckSlotData *data = GCK_SLOT_GET_DATA (obj);
+	GckSlot *self = GCK_SLOT (obj);
 
 	/* All writes to data members below, happen only during construct phase */
 
 	switch (prop_id) {
 	case PROP_MODULE:
-		g_assert (!data->module);
-		data->module = g_value_get_object (value);
-		g_assert (data->module);
-		g_object_ref (data->module);
+		g_assert (!self->pv->module);
+		self->pv->module = g_value_get_object (value);
+		g_assert (self->pv->module);
+		g_object_ref (self->pv->module);
 		break;
 	case PROP_HANDLE:
-		g_assert (!data->handle);
-		data->handle = g_value_get_ulong (value);
+		g_assert (!self->pv->handle);
+		self->pv->handle = g_value_get_ulong (value);
 		break;
 	}
 }
@@ -175,13 +168,12 @@ gck_slot_dispose (GObject *obj)
 static void
 gck_slot_finalize (GObject *obj)
 {
-	GckSlotData *data = GCK_SLOT_GET_DATA (obj);
-
-	data->handle = 0;
+	GckSlot *self = GCK_SLOT (obj);
+	self->pv->handle = 0;
 
-	if (data->module)
-		g_object_unref (data->module);
-	data->module = NULL;
+	if (self->pv->module)
+		g_object_unref (self->pv->module);
+	self->pv->module = NULL;
 
 	G_OBJECT_CLASS (gck_slot_parent_class)->finalize (obj);
 }
@@ -426,18 +418,18 @@ gck_mechanisms_check (GckMechanisms *mechanisms, ...)
 gboolean
 gck_slot_equal (gconstpointer slot1, gconstpointer slot2)
 {
-	GckSlotData *data1, *data2;
+	GckSlot *s1, *s2;
 
 	if (slot1 == slot2)
 		return TRUE;
 	if (!GCK_IS_SLOT (slot1) || !GCK_IS_SLOT (slot2))
 		return FALSE;
 
-	data1 = GCK_SLOT_GET_DATA (slot1);
-	data2 = GCK_SLOT_GET_DATA (slot2);
+	s1 = GCK_SLOT (slot1);
+	s2 = GCK_SLOT (slot2);
 
-	return data1->handle == data2->handle &&
-	       gck_module_equal (data1->module, data2->module);
+	return s1->pv->handle == s2->pv->handle &&
+	       gck_module_equal (s1->pv->module, s2->pv->module);
 }
 
 /**
@@ -454,14 +446,29 @@ gck_slot_equal (gconstpointer slot1, gconstpointer slot2)
 guint
 gck_slot_hash (gconstpointer slot)
 {
-	GckSlotData *data;
+	GckSlot *self;
 
 	g_return_val_if_fail (GCK_IS_SLOT (slot), 0);
 
-	data = GCK_SLOT_GET_DATA (slot);
+	self = GCK_SLOT (slot);
 
-	return _gck_ulong_hash (&data->handle) ^
-	       gck_module_hash (data->module);
+	return _gck_ulong_hash (&self->pv->handle) ^
+	       gck_module_hash (self->pv->module);
+}
+
+/**
+ * gck_slot_from_handle:
+ * @module: The module that this slot is on.
+ * @slot_id: The raw PKCS#11 handle or slot id of this slot.
+ *
+ * Create a new GckSlot object for a raw PKCS#11 handle.
+ *
+ * Return value: The new GckSlot object.
+ **/
+GckSlot*
+gck_slot_from_handle (GckModule *module, CK_SLOT_ID slot_id)
+{
+	return g_object_new (GCK_TYPE_SLOT, "module", module, "handle", slot_id, NULL);
 }
 
 /**
@@ -475,9 +482,8 @@ gck_slot_hash (gconstpointer slot)
 CK_SLOT_ID
 gck_slot_get_handle (GckSlot *self)
 {
-	GckSlotData *data = GCK_SLOT_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_SLOT (self), (CK_SLOT_ID)-1);
-	return data->handle;
+	return self->pv->handle;
 }
 
 /**
@@ -491,10 +497,9 @@ gck_slot_get_handle (GckSlot *self)
 GckModule*
 gck_slot_get_module (GckSlot *self)
 {
-	GckSlotData *data = GCK_SLOT_GET_DATA (self);
 	g_return_val_if_fail (GCK_IS_SLOT (self), NULL);
-	g_return_val_if_fail (GCK_IS_MODULE (data->module), NULL);
-	return g_object_ref (data->module);
+	g_return_val_if_fail (GCK_IS_MODULE (self->pv->module), NULL);
+	return g_object_ref (self->pv->module);
 }
 
 /**
diff --git a/gck/gck.h b/gck/gck.h
index cd4f9ca4..f4a2fc41 100644
--- a/gck/gck.h
+++ b/gck/gck.h
@@ -255,9 +255,11 @@ void                gck_module_info_free                   (GckModuleInfo *modul
 #define GCK_MODULE_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj), GCK_TYPE_MODULE, GckModuleClass))
 
 typedef struct _GckModuleClass GckModuleClass;
+typedef struct _GckModulePrivate GckModulePrivate;
 
 struct _GckModule {
 	GObject parent;
+	GckModulePrivate *pv;
 	gpointer reserved[4];
 };
 
@@ -273,10 +275,12 @@ struct _GckModuleClass {
 
 GType                 gck_module_get_type                     (void) G_GNUC_CONST;
 
-GckModule*            gck_module_new                          (CK_FUNCTION_LIST_PTR funcs);
+GckModule*            gck_module_new                          (CK_FUNCTION_LIST_PTR funcs,
+                                                               guint options);
 
 GckModule*            gck_module_initialize                   (const gchar *path,
                                                                gpointer reserved,
+                                                               guint options,
                                                                GError **err);
 
 gboolean              gck_module_equal                        (gconstpointer module1,
@@ -295,12 +299,6 @@ GList*                gck_module_get_slots                    (GckModule *self,
 
 guint                 gck_module_get_options                  (GckModule *self);
 
-void                  gck_module_set_options                  (GckModule *self,
-                                                               guint options);
-
-void                  gck_module_add_options                  (GckModule *self,
-                                                               guint options);
-
 GList*                gck_modules_get_slots                   (GList *modules,
                                                                gboolean token_present);
 
@@ -398,9 +396,11 @@ gboolean            gck_mechanisms_check                    (GckMechanisms *mech
 #define GCK_SLOT_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj), GCK_TYPE_SLOT, GckSlotClass))
 
 typedef struct _GckSlotClass GckSlotClass;
+typedef struct _GckSlotPrivate GckSlotPrivate;
 
 struct _GckSlot {
 	GObject parent;
+	GckSlotPrivate *pv;
 	gpointer reserved[4];
 };
 
@@ -416,13 +416,16 @@ gboolean            gck_slot_equal                          (gconstpointer slot1
 
 guint               gck_slot_hash                           (gconstpointer slot);
 
+GckSlot*            gck_slot_from_handle                    (GckModule *module,
+                                                             CK_SLOT_ID slot_id);
+
 GckModule*          gck_slot_get_module                     (GckSlot *self);
 
 CK_SLOT_ID          gck_slot_get_handle                     (GckSlot *self);
 
 GckSlotInfo*        gck_slot_get_info                       (GckSlot *self);
 
-GckTokenInfo*       gck_slot_get_token_info                  (GckSlot *self);
+GckTokenInfo*       gck_slot_get_token_info                 (GckSlot *self);
 
 GckMechanisms*      gck_slot_get_mechanisms                 (GckSlot *self);
 
@@ -498,9 +501,11 @@ void                gck_session_info_free                  (GckSessionInfo *sess
 #define GCK_SESSION_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj), GCK_TYPE_SESSION, GckSessionClass))
 
 typedef struct _GckSessionClass GckSessionClass;
+typedef struct _GckSessionPrivate GckSessionPrivate;
 
 struct _GckSession {
 	GObject parent;
+	GckSessionPrivate *pv;
 	gpointer reserved[4];
 };
 
@@ -1000,9 +1005,11 @@ GckObject*          gck_session_derive_key_finish            (GckSession *self,
 #define GCK_OBJECT_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj), GCK_TYPE_OBJECT, GckObjectClass))
 
 typedef struct _GckObjectClass GckObjectClass;
+typedef struct _GckObjectPrivate GckObjectPrivate;
 
 struct _GckObject {
 	GObject parent;
+	GckObjectPrivate *pv;
 	gpointer reserved[4];
 };
 
diff --git a/gck/tests/test-gck-crypto.c b/gck/tests/test-gck-crypto.c
index e0232d2b..315f629b 100644
--- a/gck/tests/test-gck-crypto.c
+++ b/gck/tests/test-gck-crypto.c
@@ -9,33 +9,42 @@
 #include "gck-test.h"
 
 static GckModule *module = NULL;
-static GckSlot *slot = NULL;
+static GckModule *module_with_auth = NULL;
 static GckSession *session = NULL;
+static GckSession *session_with_auth = NULL;
 
 DEFINE_SETUP(crypto_session)
 {
 	GError *err = NULL;
 	GList *slots;
+	GckSlot *slot;
 
 	/* Successful load */
-	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, &err);
+	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, 0, &err);
 	SUCCESS_RES (module, err);
 
 	slots = gck_module_get_slots (module, TRUE);
 	g_assert (slots != NULL);
 
-	slot = GCK_SLOT (slots->data);
-	g_object_ref (slot);
-	gck_list_unref_free (slots);
-
-	session = gck_slot_open_session (slot, 0, &err);
+	session = gck_slot_open_session (slots->data, 0, &err);
 	SUCCESS_RES(session, err);
+
+	module_with_auth = gck_module_new (gck_module_get_functions (module), GCK_AUTHENTICATE_OBJECTS);
+	g_assert (module_with_auth);
+
+	slot = gck_slot_from_handle (module_with_auth, gck_slot_get_handle (slots->data));
+	g_assert (slot);
+
+	session_with_auth = gck_session_from_handle (slot, gck_session_get_handle (session));
+	g_assert (session_with_auth);
+
+	g_object_unref (slot);
+	gck_list_unref_free (slots);
 }
 
 DEFINE_TEARDOWN(crypto_session)
 {
 	g_object_unref (session);
-	g_object_unref (slot);
 	g_object_unref (module);
 }
 
@@ -261,7 +270,6 @@ DEFINE_TEST(sign)
 	mech = gck_mechanism_new_with_param (CKM_PREFIX, "my-prefix:", 10);
 
 	/* Enable auto-login on this session, see previous test */
-	gck_module_set_options (module, GCK_AUTHENTICATE_OBJECTS);
 	g_signal_connect (module, "authenticate-object", G_CALLBACK (authenticate_object), NULL);
 
 	/* Find the right key */
@@ -311,7 +319,6 @@ DEFINE_TEST(verify)
 	mech = gck_mechanism_new_with_param (CKM_PREFIX, "my-prefix:", 10);
 
 	/* Enable auto-login on this session, shouldn't be needed */
-	gck_module_set_options (module, GCK_AUTHENTICATE_OBJECTS);
 	g_signal_connect (module, "authenticate-object", G_CALLBACK (authenticate_object), NULL);
 
 	/* Find the right key */
diff --git a/gck/tests/test-gck-module.c b/gck/tests/test-gck-module.c
index 955ae49e..67b2be33 100644
--- a/gck/tests/test-gck-module.c
+++ b/gck/tests/test-gck-module.c
@@ -12,7 +12,7 @@ DEFINE_SETUP(load_module)
 	GError *err = NULL;
 
 	/* Successful load */
-	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, &err);
+	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, 0, &err);
 	SUCCESS_RES (module, err);
 }
 
@@ -27,11 +27,11 @@ DEFINE_TEST(invalid_modules)
 	GError *err = NULL;
 
 	/* Shouldn't be able to load modules */
-	invalid = gck_module_initialize ("blah-blah-non-existant", NULL, &err);
+	invalid = gck_module_initialize ("blah-blah-non-existant", NULL, 0, &err);
 	FAIL_RES (invalid, err);
 
 	/* Shouldn't be able to load any file successfully */
-	invalid = gck_module_initialize ("/usr/lib/libm.so", NULL, &err);
+	invalid = gck_module_initialize ("/usr/lib/libm.so", NULL, 0, &err);
 	FAIL_RES (invalid, err);
 }
 
@@ -46,7 +46,7 @@ DEFINE_TEST(module_equals_hash)
 
 	g_assert (gck_module_equal (module, module));
 
-	other = gck_module_new (gck_module_get_functions (module));
+	other = gck_module_new (gck_module_get_functions (module), 0);
 	obj = g_object_new (G_TYPE_OBJECT, NULL);
 
 	g_assert (gck_module_equal (module, other));
diff --git a/gck/tests/test-gck-object.c b/gck/tests/test-gck-object.c
index c6e5da46..10f4ef02 100644
--- a/gck/tests/test-gck-object.c
+++ b/gck/tests/test-gck-object.c
@@ -19,7 +19,7 @@ DEFINE_SETUP(prep_object)
 	GList *slots;
 
 	/* Successful load */
-	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, &err);
+	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, 0, &err);
 	SUCCESS_RES (module, err);
 
 	slots = gck_module_get_slots (module, TRUE);
diff --git a/gck/tests/test-gck-session.c b/gck/tests/test-gck-session.c
index d60931d0..3cf535d3 100644
--- a/gck/tests/test-gck-session.c
+++ b/gck/tests/test-gck-session.c
@@ -18,7 +18,7 @@ DEFINE_SETUP(load_session)
 	GList *slots;
 
 	/* Successful load */
-	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, &err);
+	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, 0, &err);
 	SUCCESS_RES (module, err);
 
 	slots = gck_module_get_slots (module, TRUE);
@@ -195,6 +195,8 @@ authenticate_token (GckModule *module, GckSlot *slot, gchar *label, gchar **pass
 DEFINE_TEST(auto_login)
 {
 	GckObject *object;
+	GckModule *module_with_auth;
+	GckSlot *slot_with_auth;
 	GckSession *new_session;
 	GAsyncResult *result = NULL;
 	GError *err = NULL;
@@ -208,56 +210,57 @@ DEFINE_TEST(auto_login)
 	gck_attributes_add_boolean (attrs, CKA_PRIVATE, CK_TRUE);
 
 	/* Try to do something that requires a login */
+	g_assert_cmpuint (gck_module_get_options (module), ==, 0);
 	object = gck_session_create_object (session, attrs, NULL, &err);
 	g_assert (!object);
 	g_assert (err && err->code == CKR_USER_NOT_LOGGED_IN);
 	g_clear_error (&err);
 
 	/* Setup for auto login */
-	g_assert (gck_module_get_options (module) == 0);
-	gck_module_set_options (module, GCK_AUTHENTICATE_TOKENS | GCK_AUTHENTICATE_OBJECTS);
-	g_assert (gck_module_get_options (module) == (GCK_AUTHENTICATE_TOKENS | GCK_AUTHENTICATE_OBJECTS));
-	g_object_get (module, "options", &value, NULL);
-	g_assert (value == (GCK_AUTHENTICATE_TOKENS | GCK_AUTHENTICATE_OBJECTS));
+	module_with_auth = gck_module_new (gck_module_get_functions (module), GCK_AUTHENTICATE_TOKENS | GCK_AUTHENTICATE_OBJECTS);
+	g_assert (gck_module_get_options (module_with_auth) == (GCK_AUTHENTICATE_TOKENS | GCK_AUTHENTICATE_OBJECTS));
+	g_object_get (module_with_auth, "options", &value, NULL);
+	g_assert_cmpuint (value, ==, (GCK_AUTHENTICATE_TOKENS | GCK_AUTHENTICATE_OBJECTS));
 
-	g_signal_connect (module, "authenticate-slot", G_CALLBACK (authenticate_token), GUINT_TO_POINTER (35));
+	g_signal_connect (module_with_auth, "authenticate-slot", G_CALLBACK (authenticate_token), GUINT_TO_POINTER (35));
 
 	/* Create a new session */
-	new_session = gck_slot_open_session (slot, CKF_RW_SESSION, &err);
+	slot_with_auth = g_object_new (GCK_TYPE_SLOT, "module", module_with_auth, "handle", gck_slot_get_handle (slot), NULL);
+	new_session = gck_slot_open_session (slot_with_auth, CKF_RW_SESSION, &err);
 	SUCCESS_RES (new_session, err);
 	g_object_unref (new_session);
 
 	/* Try again to do something that requires a login */
-	object = gck_session_create_object (session, attrs, NULL, &err);
+	object = gck_session_create_object (new_session, attrs, NULL, &err);
 	SUCCESS_RES (object, err);
 	g_object_unref (object);
 
 	/* We should now be logged in, try to log out */
-	ret = gck_session_logout (session, &err);
+	ret = gck_session_logout (new_session, &err);
 	SUCCESS_RES (ret, err);
 
 	/* Now try the same thing, but asyncronously */
-	gck_slot_open_session_async (slot, CKF_RW_SESSION, NULL, NULL, NULL, fetch_async_result, &result);
+	gck_slot_open_session_async (slot_with_auth, CKF_RW_SESSION, NULL, NULL, NULL, fetch_async_result, &result);
 	testing_wait_until (500);
 	g_assert (result != NULL);
-	new_session = gck_slot_open_session_finish (slot, result, &err);
+	new_session = gck_slot_open_session_finish (slot_with_auth, result, &err);
 	SUCCESS_RES (new_session, err);
 	g_object_unref (result);
 	g_object_unref (new_session);
 
 	result = NULL;
-	gck_session_create_object_async (session, attrs, NULL, fetch_async_result, &result);
+	gck_session_create_object_async (new_session, attrs, NULL, fetch_async_result, &result);
 	testing_wait_until (500);
 	g_assert (result != NULL);
-	object = gck_session_create_object_finish (session, result, &err);
+	object = gck_session_create_object_finish (new_session, result, &err);
 	SUCCESS_RES (object, err);
 	g_object_unref (result);
 	g_object_unref (object);
 
 	/* We should now be logged in, try to log out */
-	ret = gck_session_logout (session, &err);
+	ret = gck_session_logout (new_session, &err);
 	SUCCESS_RES (ret, err);
 
-	g_object_set (module, "options", 0, NULL);
-	g_assert_cmpuint (gck_module_get_options (module), ==, 0);
+	g_object_unref (slot_with_auth);
+	g_object_unref (module_with_auth);
 }
diff --git a/gck/tests/test-gck-slot.c b/gck/tests/test-gck-slot.c
index 6743508a..3e4bd647 100644
--- a/gck/tests/test-gck-slot.c
+++ b/gck/tests/test-gck-slot.c
@@ -14,7 +14,7 @@ DEFINE_SETUP(load_slots)
 	GList *slots;
 
 	/* Successful load */
-	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, &err);
+	module = gck_module_initialize (".libs/libgck-test-module.so", NULL, 0, &err);
 	SUCCESS_RES (module, err);
 
 	slots = gck_module_get_slots (module, TRUE);
@@ -111,7 +111,7 @@ DEFINE_TEST(slot_equals_hash)
 
 	g_assert (gck_slot_equal (slot, slot));
 
-	other_mod = gck_module_new (gck_module_get_functions (module));
+	other_mod = gck_module_new (gck_module_get_functions (module), 0);
 	other_slot = g_object_new (GCK_TYPE_SLOT, "module", other_mod, "handle", gck_slot_get_handle (slot), NULL);
 	g_assert (gck_slot_equal (slot, other_slot));
 	g_object_unref (other_mod);