Dashboard for developing a 64 bit coLinux

Some comments, what we needs to do to run coLinux under a 64 bit Windows, for example Windows 7 64 bit, Windows Vista 64 bit, or Windows Server 2008 r2 on.

General

• The most difference are the size for type int and long

type	32 bit	64 bit(Linux)	64 bit(Win64, MinGW-w64)	used in
sizeof(int)	4 bytes	4 bytes	4 bytes
sizeof(long)	4 bytes	8 bytes	4 bytes	co_rc_t
sizeof(int*) sizeof(long*) sizeof(void*)	4 bytes	8 bytes	8 bytes

• Casts from pointer to int would be problems. coLinux uses such casts.
• Some coLinux structs are not 64 bit safe.
• The size of all structs that are passed from user space to kernel space and to the Linux side need to be checked. Or we would break the compatibility with 32 bit versions.
• Different sizes for long is a problem inside structs, that are shared between Linux kernel and Windows host.

Toolchain

• Need a gcc that builds 64 bit code. Is MinGW-w64 available? Last I have seen, the gcc is usable. → http://mingw-w64.sourceforge.net/
• It is functional & usable, and mingw LD can link imported extern/dllimport functions directly from pre-built PE32+/x64 DLLs (even built with MS' compiler), provided proper prototypes ... std c libs and ms libs are included.
• Release for GCC 4.4.1 is a prebuild binary with gcc 4.4.1 and binutils 2.20.51 for Linux 32 bit, Linux 64 bit and Cygwin. Simple unpack to any directory and use it.

NT-Kernel driver 'linux.sys'

• XP x64 may be an easy first target, as it does not require signed drivers.
• Driver must digital sign for Vista or Windows Server 2008 64bit.
  • 'Testsign' would be usable for developments and home users. The user must enable Test-signing in the boot config. Developers needs the Windwos Driver Kit and description from MS or this here. More Links: [1]
  • Driver install code for "colinux-daemon --install-driver" needs to review. I assume this would no longer work and we need to create a *.inf file. The inf-file needs also included in the driver sign.
• Passage page code needs complete rework. We have more registers with double size.
• Driver signing can also be bypassed in Windows Vista/7, so I wouldn't worry about driver signing

Linux kernel

• The native kernel is ok.
• All the coLinux hacks with memory allocations need review.
• Proxy-Interrupt handler needs rewritten.

TAP Win32

• TAP Win32 won't work on XP64 - you need TAP Win64 (see http://openvpn.se/development.html)
• Rebuild our driver source with target 64 bit should work.
• Driver must digital sign for Vista or Windows Server 2008 64bit. Testsign would be usable.

<HenryNe>: A self compiled TAP-Win64 I have successfully installed on Windows Server 2008 64bit with enabled Test-signing. I can not say about working.

WinPCAP

• WinPcap 4.0.2 now supports x64 WinPcap

TODO list

Here are some steps and ideas how any developer can help us. Pick up a job and send us your ideas and results.

• Use a gcc "MinGW-w64" (see top) and create a simple driver, that does only print a message with "DbgPrint". We need to know the build parameters. Please do not use Windows DDK for building, because we can not use it for coLinux. But you can perhaps find a simple example in the DDK. You can do it under Mingw or Cygwin on Windows or Linux (with w64-mingw32 as target).
• We need any idea to load the driver. In the first way via *.inf file is ok. Please give a step guide how to manage the driver signing.
• We need an example for useing a "share" between driver and user application. This is the driver name "\\.\CoLinuxDriver" in coLinux. Perhaps a down stripped coLinux driver, that supports only one ioctl "versions information" (CO_MONITOR_IOCTL_GET_STATE).
• Changes on memory management (Page tables, reverse page tables and pseudo physical memory)
• Changes on passage page
• Adjust all "long" and "pointer" variables in structs between Linux guest and Windows host to have every time the same size under Windows and Linux, for example with a macro.

Driver Signing Checklist

Here is a walkthrough for the process: Kernel-Mode Code Signing Walkthrough

Basically, you need to do:

• Install the WDK
• Create your own certificate and get it signed by one of the approved vendors; see Cross-Certificate Vendors
• Download the Cross-Certificate for the vendor you used (see above)
• Import your certificate and the cross-certificate into your local certificate store (right click each and click "Install")
• Use the "inf2cat" tool (from the WDK) to create a .cat file for your .inf and related files:

inf2cat.exe /driver:C:\path\to\the\driver\dir\ /os:XP_X86,XP_X64,<all the OS variants you want to support>

• Double click the .cat file to see that it is valid, but not signed
• Use the "signtool" tool (from the WDK) to sign the .cat file with your certificate:

signtool.exe sign /v /ac <Cross-Certificate.cer> /sha1 <sha1 hash of your own certificate> \
     /t <your cross-certificate vendor's timestamp URL> <all the inf and executable files>

• Double click the .cat file to see that it is valid and signed

Example

This example assumes you've set up your PATH to include the tools automatically. Or you can use the full path to the tool.

The hashes and such have been changed to protect the innocent!

First we create the .cat file

C:\> inf2cat /driver:.\my-drivers\ /os:XP_X86,XP_X64,Vista_X86,Vista_X64,7_X86,7_X64
 ..................................................................
 Signability test complete.
 
 Errors:
 None
 
 Warnings:
 None
 
 Catalog generation complete.
 C:\my-drivers\test.cat

Then we sign it using the VeriSign cross-certificate

C:\> cd my-drivers
 C:\> signtool sign /v /ac MSCV-VSClass3.cer /sha1 D1BA2F35B069C02F53A9CE06435842EE5E5254F9 \
               /t http://timestamp.verisign.com/scripts/timstamp.dll *
 The following certificate was selected:
     Issued to: My Special Company
     Issued by: VeriSign Class 3 Code Signing 2009-2 CA
     Expires:   Fri Dec 02 08:01:08 2010
     SHA1 hash: D1BA2F35B069C02F53A9CE06435842EE5E5254F9
 
 Cross certificate chain (using machine store):
     Issued to: Microsoft Code Verification Root
     Issued by: Microsoft Code Verification Root
     Expires:   Sat Nov 01 08:54:03 2025
     SHA1 hash: 8FBE4D070EF8AB1BCCAF2A9D5CCAE7282A2C66B3
 
         Issued to: Class 3 Public Primary Certification Authority
         Issued by: Microsoft Code Verification Root
         Expires:   Mon May 23 12:11:29 2016
         SHA1 hash: 58455389CF1D0CD6A08E3CE216F65ADFF7A86408
 
             Issued to: VeriSign Class 3 Code Signing 2009-2 CA
             Issued by: Class 3 Public Primary Certification Authority
             Expires:   Mon May 20 18:59:59 2019
             SHA1 hash: 12D4872BC3EF019E7E0B6F132480AE29DB5B1CA3
 
                 Issued to: My Special Company
                 Issued by: VeriSign Class 3 Code Signing 2009-2 CA
                 Expires:   Fri Dec 02 08:01:08 2010
                 SHA1 hash: D1BA2F35B069C02F53A9CE06435842EE5E5254F9
 
 Done Adding Additional Store
 Successfully signed and timestamped: DPInst.exe
 Successfully signed and timestamped: test.cat
 SignTool Error: This file format cannot be signed because it is not recognized.
 SignTool Error: An error occurred while attempting to sign: test.inf
 Successfully signed and timestamped: test.dll
 Successfully signed and timestamped: test.sys
 
 Number of files successfully Signed: 4
 Number of warnings: 0
 Number of errors: 1

The errors about not being able to sign non-executable files can be safely ignored. If the exact files were specified instead of just globbing everything with *, you wouldn't see any errors, but simply using * makes scripts simpler.

Or we can even do this step under Linux using Mono's signcode program:

 $ cd my-drivers
 $ signcode -spc my.spc -v my.pvk \
            -t http://timestamp.verisign.com/scripts/timstamp.dll \
            `find . -name '*.cat'` \
            `find . -type f -exec file {} + | grep ':.*PE' | cut -d: -f1`

While the Windows signtool is forgiving of non-signable files, Mono's signcode will abort as soon as it finds one. So we limit the signed list to catalog files (.cat) and PE programs (.dll/.exe/.sys/etc...).