2005-01-07 Sebastien Pouliot <sebastien@ximian.com>

	* driver.c: Added --security option to activate the security manager.
	Right now this will allow code generation for declarative demands and
	is disabled when AOT is specified.
	* mini.c: Add code generation for declarative security demands.
	* mini.h: Add mono_use_security_manager as an extern gboolean.

svn path=/trunk/mono/; revision=38508

diff --git a/mono/mini/ChangeLog b/mono/mini/ChangeLog
index 267c8a19791294ffddd96e24e4ae6b6ee80536d7..534af4e6a06155d2f606a226dd81844f133b5854 100644 (file)
--- a/mono/mini/ChangeLog
+++ b/mono/mini/ChangeLog
@@ -1,3 +1,11 @@
+2005-01-07  Sebastien Pouliot  <sebastien@ximian.com>
+
+       * driver.c: Added --security option to activate the security manager.
+       Right now this will allow code generation for declarative demands and
+       is disabled when AOT is specified.
+       * mini.c: Add code generation for declarative security demands.
+       * mini.h: Add mono_use_security_manager as an extern gboolean.
+
 2005-01-07  Zoltan Varga  <vargaz@freemail.hu>
 
        * aot.c (mono_compile_assembly): Speed up compilation a bit by

diff --git a/mono/mini/driver.c b/mono/mini/driver.c
index 35569313e4e90dad8adf1930cee92b535c1a41e4..d639525388222fa26df3597c598a0e404a0ac2b2 100644 (file)
--- a/mono/mini/driver.c
+++ b/mono/mini/driver.c
@@ -552,6 +552,9 @@ mini_usage (void)
 
        for (i = 0; i < G_N_ELEMENTS (opt_names); ++i)
                fprintf (stdout, "                           %-10s %s\n", opt_names [i].name, opt_names [i].desc);
+
+       fprintf (stdout,
+               "    --security             Turns on the security manager (unsupported, default is off)\n");
 }
 
 static void
@@ -715,6 +718,8 @@ mono_main (int argc, char* argv[])
                        action = DO_DRAW;
                } else if (strcmp (argv [i], "--debug") == 0) {
                        enable_debugging = TRUE;
+               } else if (strcmp (argv [i], "--security") == 0) {
+                       mono_use_security_manager = TRUE;
                } else {
                        fprintf (stderr, "Unknown command line option: '%s'\n", argv [i]);
                        return 1;
@@ -746,6 +751,11 @@ mono_main (int argc, char* argv[])
                        exit (1);
        }
 
+       if (mono_compile_aot && mono_use_security_manager) {
+               mono_use_security_manager = FALSE;
+               g_warning ("Current security manager implementation isn't compatible with AOT - disabling security manager.");
+       }
+
        mono_set_defaults (mini_verbose, opt);
        domain = mini_init (argv [i]);
        

diff --git a/mono/mini/mini.c b/mono/mini/mini.c
index a48a70fd64c0461b7db14a3569bfd700bf83a566..e01fc970ec1047cb3038791b846b26e68d3ab685 100644 (file)
--- a/mono/mini/mini.c
+++ b/mono/mini/mini.c
@@ -47,6 +47,7 @@
 #include <mono/metadata/mono-debug.h>
 #include <mono/metadata/mono-debug-debugger.h>
 #include <mono/metadata/monitor.h>
+#include <mono/metadata/security-manager.h>
 #include <mono/utils/mono-math.h>
 #include <mono/os/gc_wrapper.h>
 
@@ -135,6 +136,7 @@ gboolean mono_break_on_exc = FALSE;
 #ifndef DISABLE_AOT
 gboolean mono_compile_aot = FALSE;
 #endif
+gboolean mono_use_security_manager = FALSE;
 
 static int mini_verbose = 0;
 
@@ -2992,6 +2994,8 @@ mono_method_to_ir (MonoCompile *cfg, MonoMethod *method, MonoBasicBlock *start_b
        int *filter_lengths = NULL;
        int breakpoint_id = 0;
        guint real_offset, num_args;
+       MonoBoolean security;
+       MonoDeclSecurityActions actions;
 
        image = method->klass->image;
        header = mono_method_get_header (method);
@@ -3116,8 +3120,17 @@ mono_method_to_ir (MonoCompile *cfg, MonoMethod *method, MonoBasicBlock *start_b
                        MONO_ADD_INS (bblock, ins);
                }
        }
+
+       security = mono_use_security_manager && mono_method_has_declsec (method);
+       /* at this point having security doesn't mean we have any code to generate */
+       if (security && (cfg->method == method)) {
+               /* Only Demand, NonCasDemand and DemandChoice requires code generation.
+                * And we do not want to enter the next section (with allocation) if we
+                * have nothing to generate */
+               security = mono_declsec_get_demands (method, &actions);
+       }
        
-       if ((header->init_locals || (cfg->method == method && (cfg->opt & MONO_OPT_SHARED))) || cfg->compile_aot) {
+       if ((header->init_locals || (cfg->method == method && (cfg->opt & MONO_OPT_SHARED))) || mono_compile_aot || security) {
                /* we use a separate basic block for the initialization code */
                cfg->bb_init = init_localsbb = NEW_BBLOCK (cfg);
                init_localsbb->real_offset = real_offset;
@@ -3131,6 +3144,35 @@ mono_method_to_ir (MonoCompile *cfg, MonoMethod *method, MonoBasicBlock *start_b
                link_bblock (cfg, start_bblock, bblock);
        }
 
+       /* at this point we know, if security is TRUE, that some code needs to be generated */
+       if (security && (cfg->method == method)) {
+               MonoInst *args [2];
+               MonoSecurityManager* secman = mono_security_manager_get_methods ();
+
+               if (actions.demand.blob) {
+                       /* Add code for SecurityAction.Demand */
+                       NEW_PCONST (cfg, args [0], actions.demand.blob);
+                       NEW_ICONST (cfg, args [1], actions.demand.size);
+                       /* Calls static void SecurityManager.InternalDemand (byte* permissions, int size); */
+                       mono_emit_method_call_spilled (cfg, init_localsbb, secman->demand, secman->demand->signature, args, ip, NULL);
+               }
+               if (actions.noncasdemand.blob) {
+                       /* CLR 1.x uses a .noncasdemand (but 2.x doesn't) */
+                       /* For Mono we re-route non-CAS Demand to Demand (as the managed code must deal with it anyway) */
+                       NEW_PCONST (cfg, args [0], actions.noncasdemand.blob);
+                       NEW_ICONST (cfg, args [1], actions.noncasdemand.size);
+                       /* Calls static void SecurityManager.InternalDemand (byte* permissions, int size); */
+                       mono_emit_method_call_spilled (cfg, init_localsbb, secman->demand, secman->demand->signature, args, ip, NULL);
+               }
+               if (actions.demandchoice.blob) {
+                       /* New in 2.0, Demand must succeed for one of the permissions (i.e. not all) */
+                       NEW_PCONST (cfg, args [0], actions.demandchoice.blob);
+                       NEW_ICONST (cfg, args [1], actions.demandchoice.size);
+                       /* Calls static void SecurityManager.InternalDemandChoice (byte* permissions, int size); */
+                       mono_emit_method_call_spilled (cfg, init_localsbb, secman->demandchoice, secman->demandchoice->signature, args, ip, NULL);
+               }
+       }
+
        if (get_basic_blocks (cfg, bbhash, header, real_offset, ip, end, &err_pos)) {
                ip = err_pos;
                goto unverified;

diff --git a/mono/mini/mini.h b/mono/mini/mini.h
index 767dee8f793ff6a9b27b03a511e1b2a6704a7620..924d8239590fa8f9b2f6e5fb2bd98e96e14f4272 100644 (file)
--- a/mono/mini/mini.h
+++ b/mono/mini/mini.h
@@ -110,6 +110,7 @@ extern int mono_exc_esp_offset;
 #else
 extern gboolean mono_compile_aot;
 #endif
+extern gboolean mono_use_security_manager;
 
 struct MonoEdge {
        MonoEdge *next;