vendor: github.com/Microsoft/hcsshim v0.15.0-rc.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c
 	github.com/Graylog2/go-gelf v0.0.0-20191017102106-1550ee647df0 // head of v2 branch
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // see https://github.com/microsoft/hcsshim/pull/2545
-	github.com/Microsoft/hcsshim v0.14.1
+	github.com/Microsoft/hcsshim v0.15.0-rc.1
 	github.com/RackSec/srslog v0.0.0-20180709174129-a4725f04ec91
 	github.com/aws/aws-sdk-go-v2 v1.42.0
 	github.com/aws/aws-sdk-go-v2/config v1.32.25

go.sum

@@ -59,8 +59,8 @@ github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAw
 github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 h1:0kQAzHq8vLs7Pptv+7TxjdETLf/nIqJpIB4oC6Ba4vY=
 github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
-github.com/Microsoft/hcsshim v0.14.1 h1:CMuB3fqQVfPdhyXhUqYdUmPUIOhJkmghCx3dJet8Cqs=
-github.com/Microsoft/hcsshim v0.14.1/go.mod h1:VnzvPLyWUhxiPVsJ31P6XadxCcTogTguBFDy/1GR/OM=
+github.com/Microsoft/hcsshim v0.15.0-rc.1 h1:FbbwtQmiD+BVHynGkx5S65JkLyhkEiiTP8nrpmg2SZw=
+github.com/Microsoft/hcsshim v0.15.0-rc.1/go.mod h1:HWvvUPIy9HF6LotILj1G4VyS065rcLQ6tqj6tMUdOfI=
 github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
 github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
 github.com/RackSec/srslog v0.0.0-20180709174129-a4725f04ec91 h1:vX+gnvBc56EbWYrmlhYbFYRaeikAke1GL84N4BEYOFE=

vendor/github.com/Microsoft/hcsshim/Makefile

@@ -1,9 +1,8 @@
 include Makefile.bootfiles
 
-GO:=go
-GO_FLAGS:=-ldflags "-s -w" # strip Go binaries
-CGO_ENABLED:=0
-GOMODVENDOR:=
+# C settings
+
+# enable loading kernel modules in init
 KMOD:=0
 
 CFLAGS:=-O2 -Wall
@@ -11,20 +10,46 @@ LDFLAGS:=-static -s #strip C binaries
 LDLIBS:=
 PREPROCESSORFLAGS:=
 ifeq "$(KMOD)" "1"
-LDFLAGS:= -s
-LDLIBS:= -lkmod
+LDFLAGS:=-s
+LDLIBS:=-lkmod
 PREPROCESSORFLAGS:=-DMODULES=1
 endif
 
-GO_FLAGS_EXTRA:=
-ifeq "$(GOMODVENDOR)" "1"
-GO_FLAGS_EXTRA += -mod=vendor
-endif
+# Go settings
+
+# if Go is from the Microsoft Go fork
+MSGO:=0
+# explicitly use vendored modules when building
+GOMODVENDOR:=
+# Go tags to enable
 GO_BUILD_TAGS:=
-ifneq ($(strip $(GO_BUILD_TAGS)),)
-GO_FLAGS_EXTRA += -tags="$(GO_BUILD_TAGS)"
+# additional Go build flags
+GO_FLAGS_EXTRA:=
+# use CGO
+CGO_ENABLED:=0
+
+GO:=go
+GO_FLAGS:=-ldflags "-s -w" # strip Go binaries
+ifeq "$(GOMODVENDOR)" "1"
+GO_FLAGS+=-mod=vendor
 endif
-GO_BUILD:=CGO_ENABLED=$(CGO_ENABLED) $(GO) build $(GO_FLAGS) $(GO_FLAGS_EXTRA)
+ifneq ($(strip $(GO_BUILD_TAGS)),)
+GO_FLAGS+=-tags="$(GO_BUILD_TAGS)"
+endif
+GO_BUILD_ENV:=CGO_ENABLED=$(CGO_ENABLED)
+# starting with ms-go1.25, systemcrypto (for FIPS compliance) is enabled by default, which
+# requires CGo.
+# disable it for non-CGo builds.
+#
+# https://github.com/microsoft/go/blob/microsoft/main/eng/doc/MigrationGuide.md#cgo-is-not-enabled
+# https://github.com/microsoft/go/blob/microsoft/main/eng/doc/MigrationGuide.md#disabling-systemcrypto
+ifeq "$(MSGO)" "1"
+ifneq "$(CGO_ENABLED)" "1"
+# MS_GO_NOSYSTEMCRYPTO only works for >=ms-go1.25.2
+GO_BUILD_ENV+=MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT=nosystemcrypto
+endif
+endif
+GO_BUILD:= $(GO_BUILD_ENV) $(GO) build $(GO_FLAGS) $(GO_FLAGS_EXTRA)
 
 SRCROOT=$(dir $(abspath $(firstword $(MAKEFILE_LIST))))
 # additional directories to search for rule prerequisites and targets
@@ -81,10 +106,17 @@ out/delta.tar.gz: bin/init bin/vsockexec bin/cmd/gcs bin/cmd/gcstools bin/cmd/ho
 	tar -zcf $@ -C rootfs .
 	rm -rf rootfs
 
-bin/cmd/gcs bin/cmd/gcstools bin/cmd/hooks/wait-paths bin/cmd/tar2ext4 bin/internal/tools/snp-report:
+# Use force target to always call `go build` per make invocation and rely on Go's build cache
+# to decide if binaries should be (re)built.
+# Note: don't use `.PHONY` since the targets are actual files.
+#
+# www.gnu.org/software/make/manual/html_node/Force-Targets.html
+bin/cmd/gcs bin/cmd/gcstools bin/cmd/hooks/wait-paths bin/cmd/tar2ext4 bin/internal/tools/snp-report: FORCE
 	@mkdir -p $(dir $@)
 	GOOS=linux $(GO_BUILD) -o $@ $(SRCROOT)/$(@:bin/%=%)
 
+FORCE:
+
 bin/vsockexec: vsockexec/vsockexec.o vsockexec/vsock.o
 	@mkdir -p bin
 	$(CC) $(LDFLAGS) -o $@ $^

vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
+// 	protoc-gen-go v1.36.10
 // 	protoc        v5.26.0
 // source: github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto
 

vendor/github.com/Microsoft/hcsshim/computestorage/storage.go

@@ -7,7 +7,7 @@ import (
 	hcsschema "github.com/Microsoft/hcsshim/internal/hcs/schema2"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go storage.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go storage.go
 
 //sys hcsImportLayer(layerPath string, sourceFolderPath string, layerData string) (hr error) = computestorage.HcsImportLayer?
 //sys hcsExportLayer(layerPath string, exportFolderPath string, layerData string, options string) (hr error) = computestorage.HcsExportLayer?

vendor/github.com/Microsoft/hcsshim/hcn/hcn.go

@@ -10,7 +10,7 @@ import (
 	"github.com/Microsoft/go-winio/pkg/guid"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcn.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcn.go
 
 /// HNS V1 API
 

vendor/github.com/Microsoft/hcsshim/hcn/hcnnetwork.go

@@ -11,6 +11,15 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
+// SubnetFlags represents the flags that can be set on a subnet
+type SubnetFlags uint32
+
+// SubnetFlags constants (based on HNS API documentation)
+const (
+	SubnetFlagsNone                       SubnetFlags = 0
+	SubnetFlagsDoNotReserveGatewayAddress SubnetFlags = 1 // This flag is needed to support scenario  GatewayAddress == ManagementIP
+)
+
 // Route is associated with a subnet.
 type Route struct {
 	NextHop           string `json:",omitempty"`
@@ -23,6 +32,7 @@ type Subnet struct {
 	IpAddressPrefix string            `json:",omitempty"`
 	Policies        []json.RawMessage `json:",omitempty"`
 	Routes          []Route           `json:",omitempty"`
+	Flags           SubnetFlags       `json:",omitempty"`
 }
 
 // Ipam (Internet Protocol Address Management) is associated with a network

vendor/github.com/Microsoft/hcsshim/hcsshim.go

@@ -11,7 +11,7 @@ import (
 	"github.com/Microsoft/hcsshim/internal/hcserror"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcsshim.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hcsshim.go
 
 //sys SetCurrentThreadCompartmentId(compartmentId uint32) (hr error) = iphlpapi.SetCurrentThreadCompartmentId
 

vendor/github.com/Microsoft/hcsshim/internal/hcs/schema1/schema1.go

@@ -221,6 +221,7 @@ type GuestDefinedCapabilities struct {
 	DumpStacksSupported           bool `json:",omitempty"`
 	DeleteContainerStateSupported bool `json:",omitempty"`
 	UpdateContainerSupported      bool `json:",omitempty"`
+	LogForwardingSupported        bool `json:",omitempty"`
 }
 
 // GuestConnectionInfo is the structure of an iterm return by a GuestConnection call on a utility VM

vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go

@@ -37,6 +37,7 @@ type System struct {
 	exitError      error
 	os, typ, owner string
 	startTime      time.Time
+	stopTime       time.Time
 }
 
 var _ cow.Container = &System{}
@@ -292,6 +293,7 @@ func (computeSystem *System) waitBackground() {
 	}
 	computeSystem.closedWaitOnce.Do(func() {
 		computeSystem.waitError = err
+		computeSystem.stopTime = time.Now()
 		close(computeSystem.waitBlock)
 	})
 	oc.SetSpanStatus(span, err)
@@ -871,3 +873,11 @@ func (computeSystem *System) Modify(ctx context.Context, config interface{}) err
 
 	return nil
 }
+
+func (computeSystem *System) StoppedTime() time.Time {
+	return computeSystem.stopTime
+}
+
+func (computeSystem *System) StartedTime() time.Time {
+	return computeSystem.startTime
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hns.go

@@ -2,7 +2,7 @@ package hns
 
 import "fmt"
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hns.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go hns.go
 
 //sys _hnsCall(method string, path string, object string, response **uint16) (hr error) = vmcompute.HNSCall?
 

vendor/github.com/Microsoft/hcsshim/internal/interop/interop.go

@@ -7,7 +7,7 @@ import (
 	"unsafe"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go interop.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go interop.go
 
 //sys coTaskMemFree(buffer unsafe.Pointer) = api_ms_win_core_com_l1_1_0.CoTaskMemFree
 

vendor/github.com/Microsoft/hcsshim/internal/jobobject/jobobject.go

@@ -32,6 +32,7 @@ type JobObject struct {
 type JobLimits struct {
 	CPULimit           uint32
 	CPUWeight          uint32
+	CPUAffinity        uint64
 	MemoryLimitInBytes uint64
 	MaxIOPS            int64
 	MaxBandwidth       int64

vendor/github.com/Microsoft/hcsshim/internal/jobobject/limits.go

@@ -38,6 +38,12 @@ func (job *JobObject) SetResourceLimits(limits *JobLimits) error {
 		}
 	}
 
+	if limits.CPUAffinity != 0 {
+		if err := job.SetCPUAffinity(limits.CPUAffinity); err != nil {
+			return fmt.Errorf("failed to set job object cpu affinity: %w", err)
+		}
+	}
+
 	if limits.MaxBandwidth != 0 || limits.MaxIOPS != 0 {
 		if err := job.SetIOLimit(limits.MaxBandwidth, limits.MaxIOPS); err != nil {
 			return fmt.Errorf("failed to set io limit on job object: %w", err)

vendor/github.com/Microsoft/hcsshim/internal/log/scrub.go

@@ -11,7 +11,7 @@ import (
 
 // This package scrubs objects of potentially sensitive information to pass to logging
 
-type genMap = map[string]interface{}
+type genMap = map[string]any
 type scrubberFunc func(genMap) error
 
 const _scrubbedReplacement = "<scrubbed>"
@@ -20,7 +20,11 @@ var (
 	ErrUnknownType = errors.New("encoded object is of unknown type")
 
 	// case sensitive keywords, so "env" is not a substring on "Environment"
-	_scrubKeywords = [][]byte{[]byte("env"), []byte("Environment")}
+	_scrubKeywords = [][]byte{
+		[]byte("env"),
+		[]byte("Environment"),
+		[]byte("annotations"),
+	}
 
 	_scrub atomic.Bool
 )
@@ -32,7 +36,7 @@ func SetScrubbing(enable bool) { _scrub.Store(enable) }
 func IsScrubbingEnabled() bool { return _scrub.Load() }
 
 // ScrubProcessParameters scrubs HCS Create Process requests with config parameters of
-// type internal/hcs/schema2.ScrubProcessParameters (aka hcsshema.ScrubProcessParameters)
+// type [hcsschema.ProcessParameters].
 func ScrubProcessParameters(s string) (string, error) {
 	// todo: deal with v1 ProcessConfig
 	b := []byte(s)
@@ -81,19 +85,34 @@ func scrubBridgeCreate(m genMap) error {
 
 func scrubLinuxHostedSystem(m genMap) error {
 	if m, ok := index(m, "OciSpecification"); ok { //nolint:govet // shadow
-		if _, ok := m["annotations"]; ok {
-			m["annotations"] = map[string]string{_scrubbedReplacement: _scrubbedReplacement}
-		}
-		if m, ok := index(m, "process"); ok { //nolint:govet // shadow
-			if _, ok := m["env"]; ok {
-				m["env"] = []string{_scrubbedReplacement}
-				return nil
-			}
-		}
+		return scrubOCISpec(m)
 	}
 	return ErrUnknownType
 }
 
+// ScrubOCISpec scrubs a JSON encoded [github.com/opencontainers/runtime-spec/specs-go.Spec].
+//
+// Ideally the spec struct would be scrubbed directly, but that would need a deep clone to
+// prevent modifying the original, and, absent one implemented on the Spec
+// (e.g., [google.golang.org/protobuf/proto.CloneOf]), unmarshalling a marshalled struct
+// functions as a deep clone.
+func ScrubOCISpec(b []byte) ([]byte, error) {
+	return scrubBytes(b, scrubOCISpec)
+}
+
+func scrubOCISpec(m genMap) error {
+	if _, ok := m["annotations"]; ok {
+		m["annotations"] = map[string]string{_scrubbedReplacement: _scrubbedReplacement}
+	}
+	if m, ok := index(m, "process"); ok { //nolint:govet // shadow
+		if _, ok := m["env"]; ok {
+			m["env"] = []string{_scrubbedReplacement}
+		}
+	}
+
+	return nil
+}
+
 // ScrubBridgeExecProcess scrubs requests sent over the bridge of type
 // internal/gcs/protocol.containerExecuteProcess
 func ScrubBridgeExecProcess(b []byte) ([]byte, error) {

vendor/github.com/Microsoft/hcsshim/internal/logfields/fields.go

@@ -8,12 +8,12 @@ const (
 	Operation = "operation"
 
 	ID          = "id"
-	SandboxID   = "sid"
 	ContainerID = "cid"
 	ExecID      = "eid"
 	ProcessID   = "pid"
 	TaskID      = "tid"
 	UVMID       = "uvm-id"
+	SandboxID   = "sandbox-id"
 
 	// networking and IO
 
@@ -50,6 +50,40 @@ const (
 	Uint32       = "uint32"
 	Uint64       = "uint64"
 
+	// task / process lifecycle
+
+	Bundle           = "bundle"
+	Terminal         = "terminal"
+	Stdin            = "stdin"
+	Stdout           = "stdout"
+	Stderr           = "stderr"
+	Checkpoint       = "checkpoint"
+	ParentCheckpoint = "parent-checkpoint"
+	Status           = "status"
+	ExitStatus       = "exit-status"
+	ExitedAt         = "exited-at"
+	Signal           = "signal"
+	All              = "all"
+	Width            = "width"
+	Height           = "height"
+	Version          = "version"
+	ShimPid          = "shim-pid"
+	TaskPid          = "task-pid"
+
+	// sandbox
+
+	NetNsPath = "net-ns-path"
+	Verbose   = "verbose"
+
+	// shimdiag
+
+	Args     = "args"
+	Workdir  = "workdir"
+	HostPath = "host-path"
+	UVMPath  = "uvm-path"
+	ReadOnly = "readonly"
+	Execs    = "execs"
+
 	// runhcs
 
 	VMShimOperation = "vmshim-op"

vendor/github.com/Microsoft/hcsshim/internal/oc/exporter.go

@@ -9,7 +9,7 @@ import (
 	"github.com/Microsoft/hcsshim/internal/logfields"
 )
 
-const spanMessage = "Span"
+const spanMessage = "Span %s"
 
 var _errorCodeKey = logrus.ErrorKey + "Code"
 
@@ -82,5 +82,5 @@ func (le *LogrusExporter) ExportSpan(s *trace.SpanData) {
 
 	entry.Data = data
 	entry.Time = s.StartTime
-	entry.Log(level, spanMessage)
+	entry.Logf(level, spanMessage, s.Name)
 }

vendor/github.com/Microsoft/hcsshim/internal/protocol/guestrequest/types.go

@@ -74,3 +74,17 @@ const (
 	STDErrHandle STDIOHandle = "StdErr"
 	AllHandles   STDIOHandle = "All"
 )
+
+type LogForwardServiceRPCRequest struct {
+	RPCType  RPCType `json:"RPCType,omitempty"` // "LogForwardService"
+	Settings string  `json:"Settings,omitempty"`
+}
+
+type RPCType string
+
+const (
+	// LogForwardServiceRPC is the RPC type for the log forward service.
+	RPCModifyServiceSettings RPCType = "ModifyServiceSettings"
+	RPCStartLogForwarding    RPCType = "StartLogForwarding"
+	RPCStopLogForwarding     RPCType = "StopLogForwarding"
+)

vendor/github.com/Microsoft/hcsshim/internal/regstate/regstate.go

@@ -16,7 +16,7 @@ import (
 	"golang.org/x/sys/windows/registry"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go regstate.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go regstate.go
 
 //sys	regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) = advapi32.RegCreateKeyExW
 

vendor/github.com/Microsoft/hcsshim/internal/security/syscall_windows.go

@@ -1,6 +1,6 @@
 package security
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go syscall_windows.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go syscall_windows.go
 
 //sys getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) = advapi32.GetSecurityInfo
 //sys setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) = advapi32.SetSecurityInfo

vendor/github.com/Microsoft/hcsshim/internal/timeout/timeout.go

@@ -47,6 +47,11 @@ var (
 
 	// TestDRetryLoop is the timeout for testd retry loop when onlining a SCSI disk in LCOW
 	TestDRetryLoop = defaultTimeoutTestdRetry
+
+	// This timeout is used for GCS connection after uvm boot as well as the entropy
+	// and log connection setup during uvm boot. This is different than the
+	// SystemStart timeout defined above.
+	GCSConnectionTimeout = 2 * time.Minute
 )
 
 func init() {
@@ -60,6 +65,7 @@ func init() {
 	ExternalCommandToStart = durationFromEnvironment("HCSSHIM_TIMEOUT_EXTERNALCOMMANDSTART", ExternalCommandToStart)
 	ExternalCommandToComplete = durationFromEnvironment("HCSSHIM_TIMEOUT_EXTERNALCOMMANDCOMPLETE", ExternalCommandToComplete)
 	TestDRetryLoop = durationFromEnvironment("HCSSHIM_TIMEOUT_TESTDRETRYLOOP", TestDRetryLoop)
+	GCSConnectionTimeout = durationFromEnvironment("HCSSHIM_TIMEOUT_GCSCONNECTION", GCSConnectionTimeout)
 }
 
 func durationFromEnvironment(env string, defaultValue time.Duration) time.Duration {

vendor/github.com/Microsoft/hcsshim/internal/vmcompute/vmcompute.go

@@ -17,7 +17,7 @@ import (
 	"github.com/Microsoft/hcsshim/internal/timeout"
 )
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go vmcompute.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go vmcompute.go
 
 //sys hcsEnumerateComputeSystems(query string, computeSystems **uint16, result **uint16) (hr error) = vmcompute.HcsEnumerateComputeSystems?
 //sys hcsCreateComputeSystem(id string, configuration string, identity syscall.Handle, computeSystem *HcsSystem, result **uint16) (hr error) = vmcompute.HcsCreateComputeSystem?

vendor/github.com/Microsoft/hcsshim/internal/wclayer/wclayer.go

@@ -4,7 +4,7 @@ package wclayer
 
 import "github.com/Microsoft/go-winio/pkg/guid"
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go wclayer.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go wclayer.go
 
 //sys activateLayer(info *driverInfo, id string) (hr error) = vmcompute.ActivateLayer?
 //sys copyLayer(info *driverInfo, srcId string, dstId string, descriptors []WC_LAYER_DESCRIPTOR) (hr error) = vmcompute.CopyLayer?

vendor/github.com/Microsoft/hcsshim/internal/winapi/amdsnp.go

@@ -0,0 +1,11 @@
+//go:build windows
+
+package winapi
+
+type SNPPSPGuestRequestResult struct {
+	DriverStatus uint32
+	PspStatus    uint64
+}
+
+//sys SnpPspIsSnpMode(snpMode *uint8) (ret uint32, err error) [failretval>0] = amdsnppspapi.SnpPspIsSnpMode?
+//sys SnpPspFetchAttestationReport(reportData *uint8, guestRequestResult *SNPPSPGuestRequestResult, report *uint8) (ret uint32, err error) [failretval>0] = amdsnppspapi.SnpPspFetchAttestationReport?

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimfs.go

@@ -3,59 +3,161 @@
 package winapi
 
 import (
-	"unsafe"
-
 	"github.com/Microsoft/go-winio/pkg/guid"
-	"golang.org/x/sys/windows"
+	"github.com/sirupsen/logrus"
+
+	"github.com/Microsoft/hcsshim/internal/winapi/cimfs"
+	"github.com/Microsoft/hcsshim/internal/winapi/cimwriter"
+	"github.com/Microsoft/hcsshim/internal/winapi/types"
 )
 
-type g = guid.GUID
-type FsHandle uintptr
-type StreamHandle uintptr
-
-type CimFsFileMetadata struct {
-	Attributes uint32
-	FileSize   int64
-
-	CreationTime   windows.Filetime
-	LastWriteTime  windows.Filetime
-	ChangeTime     windows.Filetime
-	LastAccessTime windows.Filetime
-
-	SecurityDescriptorBuffer unsafe.Pointer
-	SecurityDescriptorSize   uint32
-
-	ReparseDataBuffer unsafe.Pointer
-	ReparseDataSize   uint32
-
-	ExtendedAttributes unsafe.Pointer
-	EACount            uint32
+// LogCimDLLSupport logs which DLL is being used for CIM write operations.
+func LogCimDLLSupport() {
+	if cimwriter.Supported() {
+		logrus.Info("using cimwriter.dll for CIM write operations")
+	} else if cimfs.Supported() {
+		logrus.Info("using cimfs.dll for CIM write operations")
+	} else {
+		logrus.Warn("no CIM DLL available for write operations")
+	}
 }
 
-type CimFsImagePath struct {
-	ImageDir  *uint16
-	ImageName *uint16
+// pickSupported makes sure we use appropriate syscalls depending on which DLLs are present.
+func pickSupported[F any](cimWriterFunc, cimfsFunc F) F {
+	if cimwriter.Supported() {
+		return cimWriterFunc
+	}
+	return cimfsFunc
 }
 
-//sys CimMountImage(imagePath string, fsName string, flags uint32, volumeID *g) (hr error) = cimfs.CimMountImage?
-//sys CimDismountImage(volumeID *g) (hr error) = cimfs.CimDismountImage?
+func CimMountImage(imagePath string, fsName string, flags uint32, volumeID *guid.GUID) error {
+	return cimfs.CimMountImage(imagePath, fsName, flags, volumeID)
+}
 
-//sys CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) = cimfs.CimCreateImage?
-//sys CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) = cimfs.CimCreateImage2?
-//sys CimCloseImage(cimFSHandle FsHandle) = cimfs.CimCloseImage?
-//sys CimCommitImage(cimFSHandle FsHandle) (hr error) = cimfs.CimCommitImage?
+func CimDismountImage(volumeID *guid.GUID) error {
+	return cimfs.CimDismountImage(volumeID)
+}
 
-//sys CimCreateFile(cimFSHandle FsHandle, path string, file *CimFsFileMetadata, cimStreamHandle *StreamHandle) (hr error) = cimfs.CimCreateFile?
-//sys CimCloseStream(cimStreamHandle StreamHandle) (hr error) = cimfs.CimCloseStream?
-//sys CimWriteStream(cimStreamHandle StreamHandle, buffer uintptr, bufferSize uint32) (hr error) = cimfs.CimWriteStream?
-//sys CimDeletePath(cimFSHandle FsHandle, path string) (hr error) = cimfs.CimDeletePath?
-//sys CimCreateHardLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) = cimfs.CimCreateHardLink?
-//sys CimCreateAlternateStream(cimFSHandle FsHandle, path string, size uint64, cimStreamHandle *StreamHandle) (hr error) = cimfs.CimCreateAlternateStream?
-//sys CimAddFsToMergedImage(cimFSHandle FsHandle, path string) (hr error) = cimfs.CimAddFsToMergedImage?
-//sys CimAddFsToMergedImage2(cimFSHandle FsHandle, path string, flags uint32) (hr error) = cimfs.CimAddFsToMergedImage2?
-//sys CimMergeMountImage(numCimPaths uint32, backingImagePaths *CimFsImagePath, flags uint32, volumeID *g) (hr error) = cimfs.CimMergeMountImage?
-//sys CimTombstoneFile(cimFSHandle FsHandle, path string) (hr error) = cimfs.CimTombstoneFile?
-//sys CimCreateMergeLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) = cimfs.CimCreateMergeLink?
-//sys CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) = cimfs.CimSealImage?
-//sys CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) = cimfs.CimGetVerificationInformation?
-//sys CimMountVerifiedImage(imagePath string, fsName string, flags uint32, volumeID *g, hashSize uint16, hash *byte) (hr error) = cimfs.CimMountVerifiedImage?
+func CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *types.FsHandle) error {
+	return pickSupported(
+		cimwriter.CimCreateImage,
+		cimfs.CimCreateImage,
+	)(imagePath, oldFSName, newFSName, cimFSHandle)
+}
+
+func CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *types.FsHandle) error {
+	return pickSupported(
+		cimwriter.CimCreateImage2,
+		cimfs.CimCreateImage2,
+	)(imagePath, flags, oldFSName, newFSName, cimFSHandle)
+}
+
+func CimCloseImage(cimFSHandle types.FsHandle) error {
+	return pickSupported(
+		cimwriter.CimCloseImage,
+		cimfs.CimCloseImage,
+	)(cimFSHandle)
+}
+
+func CimCommitImage(cimFSHandle types.FsHandle) error {
+	return pickSupported(
+		cimwriter.CimCommitImage,
+		cimfs.CimCommitImage,
+	)(cimFSHandle)
+}
+
+func CimCreateFile(cimFSHandle types.FsHandle, path string, file *types.CimFsFileMetadata, cimStreamHandle *types.StreamHandle) error {
+	return pickSupported(
+		cimwriter.CimCreateFile,
+		cimfs.CimCreateFile,
+	)(cimFSHandle, path, file, cimStreamHandle)
+}
+
+func CimCloseStream(cimStreamHandle types.StreamHandle) error {
+	return pickSupported(
+		cimwriter.CimCloseStream,
+		cimfs.CimCloseStream,
+	)(cimStreamHandle)
+}
+
+func CimWriteStream(cimStreamHandle types.StreamHandle, buffer uintptr, bufferSize uint32) error {
+	return pickSupported(
+		cimwriter.CimWriteStream,
+		cimfs.CimWriteStream,
+	)(cimStreamHandle, buffer, bufferSize)
+}
+
+func CimDeletePath(cimFSHandle types.FsHandle, path string) error {
+	return pickSupported(
+		cimwriter.CimDeletePath,
+		cimfs.CimDeletePath,
+	)(cimFSHandle, path)
+}
+
+func CimCreateHardLink(cimFSHandle types.FsHandle, newPath string, oldPath string) error {
+	return pickSupported(
+		cimwriter.CimCreateHardLink,
+		cimfs.CimCreateHardLink,
+	)(cimFSHandle, newPath, oldPath)
+}
+
+func CimCreateAlternateStream(cimFSHandle types.FsHandle, path string, size uint64, cimStreamHandle *types.StreamHandle) error {
+	return pickSupported(
+		cimwriter.CimCreateAlternateStream,
+		cimfs.CimCreateAlternateStream,
+	)(cimFSHandle, path, size, cimStreamHandle)
+}
+
+func CimAddFsToMergedImage(cimFSHandle types.FsHandle, path string) error {
+	return pickSupported(
+		cimwriter.CimAddFsToMergedImage,
+		cimfs.CimAddFsToMergedImage,
+	)(cimFSHandle, path)
+}
+
+func CimAddFsToMergedImage2(cimFSHandle types.FsHandle, path string, flags uint32) error {
+	return pickSupported(
+		cimwriter.CimAddFsToMergedImage2,
+		cimfs.CimAddFsToMergedImage2,
+	)(cimFSHandle, path, flags)
+}
+
+func CimMergeMountImage(numCimPaths uint32, backingImagePaths *types.CimFsImagePath, flags uint32, volumeID *guid.GUID) error {
+	return cimfs.CimMergeMountImage(numCimPaths, backingImagePaths, flags, volumeID)
+}
+
+func CimTombstoneFile(cimFSHandle types.FsHandle, path string) error {
+	return pickSupported(
+		cimwriter.CimTombstoneFile,
+		cimfs.CimTombstoneFile,
+	)(cimFSHandle, path)
+}
+
+func CimCreateMergeLink(cimFSHandle types.FsHandle, newPath string, oldPath string) (hr error) {
+	return pickSupported(
+		cimwriter.CimCreateMergeLink,
+		cimfs.CimCreateMergeLink,
+	)(cimFSHandle, newPath, oldPath)
+}
+
+func CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
+	return pickSupported(
+		cimwriter.CimSealImage,
+		cimfs.CimSealImage,
+	)(blockCimPath, hashSize, fixedHeaderSize, hash)
+}
+
+func CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
+	return pickSupported(
+		cimwriter.CimGetVerificationInformation,
+		cimfs.CimGetVerificationInformation,
+	)(blockCimPath, isSealed, hashSize, signatureSize, fixedHeaderSize, hash, signature)
+}
+
+func CimMountVerifiedImage(imagePath string, fsName string, flags uint32, volumeID *guid.GUID, hashSize uint16, hash *byte) error {
+	return cimfs.CimMountVerifiedImage(imagePath, fsName, flags, volumeID, hashSize, hash)
+}
+
+func CimMergeMountVerifiedImage(numCimPaths uint32, backingImagePaths *types.CimFsImagePath, flags uint32, volumeID *guid.GUID, hashSize uint16, hash *byte) error {
+	return cimfs.CimMergeMountVerifiedImage(numCimPaths, backingImagePaths, flags, volumeID, hashSize, hash)
+}

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimfs/cimfs.go

@@ -0,0 +1,62 @@
+//go:build windows
+
+package cimfs
+
+import (
+	"sync"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+
+	"github.com/Microsoft/hcsshim/internal/winapi/types"
+)
+
+// Type aliases
+
+type GUID = guid.GUID
+type FsHandle = types.FsHandle
+type StreamHandle = types.StreamHandle
+type FileMetadata = types.CimFsFileMetadata
+type ImagePath = types.CimFsImagePath
+
+//sys CimMountImage(imagePath string, fsName string, flags uint32, volumeID *GUID) (hr error) = cimfs.CimMountImage?
+//sys CimDismountImage(volumeID *GUID) (hr error) = cimfs.CimDismountImage?
+
+//sys CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) = cimfs.CimCreateImage?
+//sys CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) = cimfs.CimCreateImage2?
+//sys CimCloseImage(cimFSHandle FsHandle) = cimfs.CimCloseImage?
+//sys CimCommitImage(cimFSHandle FsHandle) (hr error) = cimfs.CimCommitImage?
+
+//sys CimCreateFile(cimFSHandle FsHandle, path string, file *FileMetadata, cimStreamHandle *StreamHandle) (hr error) = cimfs.CimCreateFile?
+//sys CimCloseStream(cimStreamHandle StreamHandle) (hr error) = cimfs.CimCloseStream?
+//sys CimWriteStream(cimStreamHandle StreamHandle, buffer uintptr, bufferSize uint32) (hr error) = cimfs.CimWriteStream?
+//sys CimDeletePath(cimFSHandle FsHandle, path string) (hr error) = cimfs.CimDeletePath?
+//sys CimCreateHardLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) = cimfs.CimCreateHardLink?
+//sys CimCreateAlternateStream(cimFSHandle FsHandle, path string, size uint64, cimStreamHandle *StreamHandle) (hr error) = cimfs.CimCreateAlternateStream?
+//sys CimAddFsToMergedImage(cimFSHandle FsHandle, path string) (hr error) = cimfs.CimAddFsToMergedImage?
+//sys CimAddFsToMergedImage2(cimFSHandle FsHandle, path string, flags uint32) (hr error) = cimfs.CimAddFsToMergedImage2?
+//sys CimMergeMountImage(numCimPaths uint32, backingImagePaths *ImagePath, flags uint32, volumeID *GUID) (hr error) = cimfs.CimMergeMountImage?
+//sys CimTombstoneFile(cimFSHandle FsHandle, path string) (hr error) = cimfs.CimTombstoneFile?
+//sys CimCreateMergeLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) = cimfs.CimCreateMergeLink?
+//sys CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) = cimfs.CimSealImage?
+//sys CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) = cimfs.CimGetVerificationInformation?
+//sys CimMountVerifiedImage(imagePath string, fsName string, flags uint32, volumeID *GUID, hashSize uint16, hash *byte) (hr error) = cimfs.CimMountVerifiedImage?
+//sys CimMergeMountVerifiedImage(numCimPaths uint32, backingImagePaths *ImagePath, flags uint32, volumeID *GUID, hashSize uint16, hash *byte) (hr error) = cimfs.CimMergeMountVerifiedImage?
+
+var load = sync.OnceValue(func() error {
+	if err := modcimfs.Load(); err != nil {
+		return err
+	}
+	var buf [windows.MAX_PATH]uint16
+	n, _ := windows.GetModuleFileName(windows.Handle(modcimfs.Handle()), &buf[0], uint32(len(buf)))
+	if n > 0 {
+		logrus.WithField("path", windows.UTF16ToString(buf[:n])).Info("loaded cimfs.dll")
+	}
+	return nil
+})
+
+// Supported checks if cimfs.dll is present on the system.
+func Supported() bool {
+	return load() == nil
+}

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimfs/syscall.go

@@ -0,0 +1,3 @@
+package cimfs
+
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go ./*.go

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimfs/zsyscall_windows.go

@@ -0,0 +1,518 @@
+//go:build windows
+
+// Code generated by 'go generate' using "github.com/Microsoft/go-winio/tools/mkwinsyscall"; DO NOT EDIT.
+
+package cimfs
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	return e
+}
+
+var (
+	modcimfs = windows.NewLazySystemDLL("cimfs.dll")
+
+	procCimAddFsToMergedImage         = modcimfs.NewProc("CimAddFsToMergedImage")
+	procCimAddFsToMergedImage2        = modcimfs.NewProc("CimAddFsToMergedImage2")
+	procCimCloseImage                 = modcimfs.NewProc("CimCloseImage")
+	procCimCloseStream                = modcimfs.NewProc("CimCloseStream")
+	procCimCommitImage                = modcimfs.NewProc("CimCommitImage")
+	procCimCreateAlternateStream      = modcimfs.NewProc("CimCreateAlternateStream")
+	procCimCreateFile                 = modcimfs.NewProc("CimCreateFile")
+	procCimCreateHardLink             = modcimfs.NewProc("CimCreateHardLink")
+	procCimCreateImage                = modcimfs.NewProc("CimCreateImage")
+	procCimCreateImage2               = modcimfs.NewProc("CimCreateImage2")
+	procCimCreateMergeLink            = modcimfs.NewProc("CimCreateMergeLink")
+	procCimDeletePath                 = modcimfs.NewProc("CimDeletePath")
+	procCimDismountImage              = modcimfs.NewProc("CimDismountImage")
+	procCimGetVerificationInformation = modcimfs.NewProc("CimGetVerificationInformation")
+	procCimMergeMountImage            = modcimfs.NewProc("CimMergeMountImage")
+	procCimMergeMountVerifiedImage    = modcimfs.NewProc("CimMergeMountVerifiedImage")
+	procCimMountImage                 = modcimfs.NewProc("CimMountImage")
+	procCimMountVerifiedImage         = modcimfs.NewProc("CimMountVerifiedImage")
+	procCimSealImage                  = modcimfs.NewProc("CimSealImage")
+	procCimTombstoneFile              = modcimfs.NewProc("CimTombstoneFile")
+	procCimWriteStream                = modcimfs.NewProc("CimWriteStream")
+)
+
+func CimAddFsToMergedImage(cimFSHandle FsHandle, path string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimAddFsToMergedImage(cimFSHandle, _p0)
+}
+
+func _CimAddFsToMergedImage(cimFSHandle FsHandle, path *uint16) (hr error) {
+	hr = procCimAddFsToMergedImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimAddFsToMergedImage.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimAddFsToMergedImage2(cimFSHandle FsHandle, path string, flags uint32) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimAddFsToMergedImage2(cimFSHandle, _p0, flags)
+}
+
+func _CimAddFsToMergedImage2(cimFSHandle FsHandle, path *uint16, flags uint32) (hr error) {
+	hr = procCimAddFsToMergedImage2.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimAddFsToMergedImage2.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(flags))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCloseImage(cimFSHandle FsHandle) (err error) {
+	err = procCimCloseImage.Find()
+	if err != nil {
+		return
+	}
+	syscall.SyscallN(procCimCloseImage.Addr(), uintptr(cimFSHandle))
+	return
+}
+
+func CimCloseStream(cimStreamHandle StreamHandle) (hr error) {
+	hr = procCimCloseStream.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCloseStream.Addr(), uintptr(cimStreamHandle))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCommitImage(cimFSHandle FsHandle) (hr error) {
+	hr = procCimCommitImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCommitImage.Addr(), uintptr(cimFSHandle))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateAlternateStream(cimFSHandle FsHandle, path string, size uint64, cimStreamHandle *StreamHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimCreateAlternateStream(cimFSHandle, _p0, size, cimStreamHandle)
+}
+
+func _CimCreateAlternateStream(cimFSHandle FsHandle, path *uint16, size uint64, cimStreamHandle *StreamHandle) (hr error) {
+	hr = procCimCreateAlternateStream.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateAlternateStream.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(size), uintptr(unsafe.Pointer(cimStreamHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateFile(cimFSHandle FsHandle, path string, file *FileMetadata, cimStreamHandle *StreamHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimCreateFile(cimFSHandle, _p0, file, cimStreamHandle)
+}
+
+func _CimCreateFile(cimFSHandle FsHandle, path *uint16, file *FileMetadata, cimStreamHandle *StreamHandle) (hr error) {
+	hr = procCimCreateFile.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateFile.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(file)), uintptr(unsafe.Pointer(cimStreamHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateHardLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(newPath)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(oldPath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateHardLink(cimFSHandle, _p0, _p1)
+}
+
+func _CimCreateHardLink(cimFSHandle FsHandle, newPath *uint16, oldPath *uint16) (hr error) {
+	hr = procCimCreateHardLink.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateHardLink.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(newPath)), uintptr(unsafe.Pointer(oldPath)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(imagePath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateImage(_p0, oldFSName, newFSName, cimFSHandle)
+}
+
+func _CimCreateImage(imagePath *uint16, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	hr = procCimCreateImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(oldFSName)), uintptr(unsafe.Pointer(newFSName)), uintptr(unsafe.Pointer(cimFSHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(imagePath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateImage2(_p0, flags, oldFSName, newFSName, cimFSHandle)
+}
+
+func _CimCreateImage2(imagePath *uint16, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	hr = procCimCreateImage2.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateImage2.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(flags), uintptr(unsafe.Pointer(oldFSName)), uintptr(unsafe.Pointer(newFSName)), uintptr(unsafe.Pointer(cimFSHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateMergeLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(newPath)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(oldPath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateMergeLink(cimFSHandle, _p0, _p1)
+}
+
+func _CimCreateMergeLink(cimFSHandle FsHandle, newPath *uint16, oldPath *uint16) (hr error) {
+	hr = procCimCreateMergeLink.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateMergeLink.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(newPath)), uintptr(unsafe.Pointer(oldPath)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimDeletePath(cimFSHandle FsHandle, path string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimDeletePath(cimFSHandle, _p0)
+}
+
+func _CimDeletePath(cimFSHandle FsHandle, path *uint16) (hr error) {
+	hr = procCimDeletePath.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimDeletePath.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimDismountImage(volumeID *GUID) (hr error) {
+	hr = procCimDismountImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimDismountImage.Addr(), uintptr(unsafe.Pointer(volumeID)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(blockCimPath)
+	if hr != nil {
+		return
+	}
+	return _CimGetVerificationInformation(_p0, isSealed, hashSize, signatureSize, fixedHeaderSize, hash, signature)
+}
+
+func _CimGetVerificationInformation(blockCimPath *uint16, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
+	hr = procCimGetVerificationInformation.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimGetVerificationInformation.Addr(), uintptr(unsafe.Pointer(blockCimPath)), uintptr(unsafe.Pointer(isSealed)), uintptr(unsafe.Pointer(hashSize)), uintptr(unsafe.Pointer(signatureSize)), uintptr(unsafe.Pointer(fixedHeaderSize)), uintptr(unsafe.Pointer(hash)), uintptr(unsafe.Pointer(signature)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimMergeMountImage(numCimPaths uint32, backingImagePaths *ImagePath, flags uint32, volumeID *GUID) (hr error) {
+	hr = procCimMergeMountImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimMergeMountImage.Addr(), uintptr(numCimPaths), uintptr(unsafe.Pointer(backingImagePaths)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimMergeMountVerifiedImage(numCimPaths uint32, backingImagePaths *ImagePath, flags uint32, volumeID *GUID, hashSize uint16, hash *byte) (hr error) {
+	hr = procCimMergeMountVerifiedImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimMergeMountVerifiedImage.Addr(), uintptr(numCimPaths), uintptr(unsafe.Pointer(backingImagePaths)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)), uintptr(hashSize), uintptr(unsafe.Pointer(hash)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimMountImage(imagePath string, fsName string, flags uint32, volumeID *GUID) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(imagePath)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(fsName)
+	if hr != nil {
+		return
+	}
+	return _CimMountImage(_p0, _p1, flags, volumeID)
+}
+
+func _CimMountImage(imagePath *uint16, fsName *uint16, flags uint32, volumeID *GUID) (hr error) {
+	hr = procCimMountImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimMountImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(fsName)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimMountVerifiedImage(imagePath string, fsName string, flags uint32, volumeID *GUID, hashSize uint16, hash *byte) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(imagePath)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(fsName)
+	if hr != nil {
+		return
+	}
+	return _CimMountVerifiedImage(_p0, _p1, flags, volumeID, hashSize, hash)
+}
+
+func _CimMountVerifiedImage(imagePath *uint16, fsName *uint16, flags uint32, volumeID *GUID, hashSize uint16, hash *byte) (hr error) {
+	hr = procCimMountVerifiedImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimMountVerifiedImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(fsName)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)), uintptr(hashSize), uintptr(unsafe.Pointer(hash)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(blockCimPath)
+	if hr != nil {
+		return
+	}
+	return _CimSealImage(_p0, hashSize, fixedHeaderSize, hash)
+}
+
+func _CimSealImage(blockCimPath *uint16, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
+	hr = procCimSealImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimSealImage.Addr(), uintptr(unsafe.Pointer(blockCimPath)), uintptr(unsafe.Pointer(hashSize)), uintptr(unsafe.Pointer(fixedHeaderSize)), uintptr(unsafe.Pointer(hash)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimTombstoneFile(cimFSHandle FsHandle, path string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimTombstoneFile(cimFSHandle, _p0)
+}
+
+func _CimTombstoneFile(cimFSHandle FsHandle, path *uint16) (hr error) {
+	hr = procCimTombstoneFile.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimTombstoneFile.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimWriteStream(cimStreamHandle StreamHandle, buffer uintptr, bufferSize uint32) (hr error) {
+	hr = procCimWriteStream.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimWriteStream.Addr(), uintptr(cimStreamHandle), uintptr(buffer), uintptr(bufferSize))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimwriter/cimwriter.go

@@ -0,0 +1,64 @@
+//go:build windows
+
+package cimwriter
+
+import (
+	"sync"
+
+	"github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+
+	"github.com/Microsoft/hcsshim/internal/winapi/types"
+)
+
+type FsHandle = types.FsHandle
+type StreamHandle = types.StreamHandle
+type FileMetadata = types.CimFsFileMetadata
+type ImagePath = types.CimFsImagePath
+
+//sys CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) = cimwriter.CimCreateImage?
+//sys CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) = cimwriter.CimCreateImage2?
+//sys CimCloseImage(cimFSHandle FsHandle) = cimwriter.CimCloseImage?
+//sys CimCommitImage(cimFSHandle FsHandle) (hr error) = cimwriter.CimCommitImage?
+
+//sys CimCreateFile(cimFSHandle FsHandle, path string, file *FileMetadata, cimStreamHandle *StreamHandle) (hr error) = cimwriter.CimCreateFile?
+//sys CimCloseStream(cimStreamHandle StreamHandle) (hr error) = cimwriter.CimCloseStream?
+//sys CimWriteStream(cimStreamHandle StreamHandle, buffer uintptr, bufferSize uint32) (hr error) = cimwriter.CimWriteStream?
+//sys CimDeletePath(cimFSHandle FsHandle, path string) (hr error) = cimwriter.CimDeletePath?
+//sys CimCreateHardLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) = cimwriter.CimCreateHardLink?
+//sys CimCreateAlternateStream(cimFSHandle FsHandle, path string, size uint64, cimStreamHandle *StreamHandle) (hr error) = cimwriter.CimCreateAlternateStream?
+//sys CimAddFsToMergedImage(cimFSHandle FsHandle, path string) (hr error) = cimwriter.CimAddFsToMergedImage?
+//sys CimAddFsToMergedImage2(cimFSHandle FsHandle, path string, flags uint32) (hr error) = cimwriter.CimAddFsToMergedImage2?
+
+//sys CimTombstoneFile(cimFSHandle FsHandle, path string) (hr error) = cimwriter.CimTombstoneFile?
+//sys CimCreateMergeLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) = cimwriter.CimCreateMergeLink?
+//sys CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) = cimwriter.CimSealImage?
+
+//sys CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) = cimwriter.CimGetVerificationInformation?
+
+var load = sync.OnceValue(func() error {
+	// Pre-load the DLL with a restricted search path (System32 + application directory only)
+	// to prevent loading from untrusted locations (e.g., CWD or arbitrary PATH entries).
+	// The subsequent modcimwriter.Load() will reuse the already-loaded module.
+	h, err := windows.LoadLibraryEx("cimwriter.dll", 0, windows.LOAD_LIBRARY_SEARCH_SYSTEM32|windows.LOAD_LIBRARY_SEARCH_APPLICATION_DIR)
+	if err != nil {
+		return err
+	}
+	if err := modcimwriter.Load(); err != nil {
+		if freeErr := windows.FreeLibrary(h); freeErr != nil {
+			logrus.WithError(freeErr).Warn("failed to free cimwriter.dll after load failure")
+		}
+		return err
+	}
+	var buf [windows.MAX_PATH]uint16
+	n, _ := windows.GetModuleFileName(windows.Handle(modcimwriter.Handle()), &buf[0], uint32(len(buf)))
+	if n > 0 {
+		logrus.WithField("path", windows.UTF16ToString(buf[:n])).Info("loaded cimwriter.dll")
+	}
+	return nil
+})
+
+// Supported checks if cimwriter.dll is present on the system.
+func Supported() bool {
+	return load() == nil
+}

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimwriter/syscall.go

@@ -0,0 +1,3 @@
+package cimwriter
+
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go -systemdll=false ./*.go

vendor/github.com/Microsoft/hcsshim/internal/winapi/cimwriter/zsyscall_windows.go

@@ -0,0 +1,408 @@
+//go:build windows
+
+// Code generated by 'go generate' using "github.com/Microsoft/go-winio/tools/mkwinsyscall"; DO NOT EDIT.
+
+package cimwriter
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	return e
+}
+
+var (
+	modcimwriter = syscall.NewLazyDLL("cimwriter.dll")
+
+	procCimAddFsToMergedImage         = modcimwriter.NewProc("CimAddFsToMergedImage")
+	procCimAddFsToMergedImage2        = modcimwriter.NewProc("CimAddFsToMergedImage2")
+	procCimCloseImage                 = modcimwriter.NewProc("CimCloseImage")
+	procCimCloseStream                = modcimwriter.NewProc("CimCloseStream")
+	procCimCommitImage                = modcimwriter.NewProc("CimCommitImage")
+	procCimCreateAlternateStream      = modcimwriter.NewProc("CimCreateAlternateStream")
+	procCimCreateFile                 = modcimwriter.NewProc("CimCreateFile")
+	procCimCreateHardLink             = modcimwriter.NewProc("CimCreateHardLink")
+	procCimCreateImage                = modcimwriter.NewProc("CimCreateImage")
+	procCimCreateImage2               = modcimwriter.NewProc("CimCreateImage2")
+	procCimCreateMergeLink            = modcimwriter.NewProc("CimCreateMergeLink")
+	procCimDeletePath                 = modcimwriter.NewProc("CimDeletePath")
+	procCimGetVerificationInformation = modcimwriter.NewProc("CimGetVerificationInformation")
+	procCimSealImage                  = modcimwriter.NewProc("CimSealImage")
+	procCimTombstoneFile              = modcimwriter.NewProc("CimTombstoneFile")
+	procCimWriteStream                = modcimwriter.NewProc("CimWriteStream")
+)
+
+func CimAddFsToMergedImage(cimFSHandle FsHandle, path string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimAddFsToMergedImage(cimFSHandle, _p0)
+}
+
+func _CimAddFsToMergedImage(cimFSHandle FsHandle, path *uint16) (hr error) {
+	hr = procCimAddFsToMergedImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimAddFsToMergedImage.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimAddFsToMergedImage2(cimFSHandle FsHandle, path string, flags uint32) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimAddFsToMergedImage2(cimFSHandle, _p0, flags)
+}
+
+func _CimAddFsToMergedImage2(cimFSHandle FsHandle, path *uint16, flags uint32) (hr error) {
+	hr = procCimAddFsToMergedImage2.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimAddFsToMergedImage2.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(flags))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCloseImage(cimFSHandle FsHandle) (err error) {
+	err = procCimCloseImage.Find()
+	if err != nil {
+		return
+	}
+	syscall.SyscallN(procCimCloseImage.Addr(), uintptr(cimFSHandle))
+	return
+}
+
+func CimCloseStream(cimStreamHandle StreamHandle) (hr error) {
+	hr = procCimCloseStream.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCloseStream.Addr(), uintptr(cimStreamHandle))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCommitImage(cimFSHandle FsHandle) (hr error) {
+	hr = procCimCommitImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCommitImage.Addr(), uintptr(cimFSHandle))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateAlternateStream(cimFSHandle FsHandle, path string, size uint64, cimStreamHandle *StreamHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimCreateAlternateStream(cimFSHandle, _p0, size, cimStreamHandle)
+}
+
+func _CimCreateAlternateStream(cimFSHandle FsHandle, path *uint16, size uint64, cimStreamHandle *StreamHandle) (hr error) {
+	hr = procCimCreateAlternateStream.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateAlternateStream.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(size), uintptr(unsafe.Pointer(cimStreamHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateFile(cimFSHandle FsHandle, path string, file *FileMetadata, cimStreamHandle *StreamHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimCreateFile(cimFSHandle, _p0, file, cimStreamHandle)
+}
+
+func _CimCreateFile(cimFSHandle FsHandle, path *uint16, file *FileMetadata, cimStreamHandle *StreamHandle) (hr error) {
+	hr = procCimCreateFile.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateFile.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(file)), uintptr(unsafe.Pointer(cimStreamHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateHardLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(newPath)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(oldPath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateHardLink(cimFSHandle, _p0, _p1)
+}
+
+func _CimCreateHardLink(cimFSHandle FsHandle, newPath *uint16, oldPath *uint16) (hr error) {
+	hr = procCimCreateHardLink.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateHardLink.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(newPath)), uintptr(unsafe.Pointer(oldPath)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(imagePath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateImage(_p0, oldFSName, newFSName, cimFSHandle)
+}
+
+func _CimCreateImage(imagePath *uint16, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	hr = procCimCreateImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(oldFSName)), uintptr(unsafe.Pointer(newFSName)), uintptr(unsafe.Pointer(cimFSHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(imagePath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateImage2(_p0, flags, oldFSName, newFSName, cimFSHandle)
+}
+
+func _CimCreateImage2(imagePath *uint16, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
+	hr = procCimCreateImage2.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateImage2.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(flags), uintptr(unsafe.Pointer(oldFSName)), uintptr(unsafe.Pointer(newFSName)), uintptr(unsafe.Pointer(cimFSHandle)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimCreateMergeLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(newPath)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(oldPath)
+	if hr != nil {
+		return
+	}
+	return _CimCreateMergeLink(cimFSHandle, _p0, _p1)
+}
+
+func _CimCreateMergeLink(cimFSHandle FsHandle, newPath *uint16, oldPath *uint16) (hr error) {
+	hr = procCimCreateMergeLink.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimCreateMergeLink.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(newPath)), uintptr(unsafe.Pointer(oldPath)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimDeletePath(cimFSHandle FsHandle, path string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimDeletePath(cimFSHandle, _p0)
+}
+
+func _CimDeletePath(cimFSHandle FsHandle, path *uint16) (hr error) {
+	hr = procCimDeletePath.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimDeletePath.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(blockCimPath)
+	if hr != nil {
+		return
+	}
+	return _CimGetVerificationInformation(_p0, isSealed, hashSize, signatureSize, fixedHeaderSize, hash, signature)
+}
+
+func _CimGetVerificationInformation(blockCimPath *uint16, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
+	hr = procCimGetVerificationInformation.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimGetVerificationInformation.Addr(), uintptr(unsafe.Pointer(blockCimPath)), uintptr(unsafe.Pointer(isSealed)), uintptr(unsafe.Pointer(hashSize)), uintptr(unsafe.Pointer(signatureSize)), uintptr(unsafe.Pointer(fixedHeaderSize)), uintptr(unsafe.Pointer(hash)), uintptr(unsafe.Pointer(signature)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(blockCimPath)
+	if hr != nil {
+		return
+	}
+	return _CimSealImage(_p0, hashSize, fixedHeaderSize, hash)
+}
+
+func _CimSealImage(blockCimPath *uint16, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
+	hr = procCimSealImage.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimSealImage.Addr(), uintptr(unsafe.Pointer(blockCimPath)), uintptr(unsafe.Pointer(hashSize)), uintptr(unsafe.Pointer(fixedHeaderSize)), uintptr(unsafe.Pointer(hash)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimTombstoneFile(cimFSHandle FsHandle, path string) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	return _CimTombstoneFile(cimFSHandle, _p0)
+}
+
+func _CimTombstoneFile(cimFSHandle FsHandle, path *uint16) (hr error) {
+	hr = procCimTombstoneFile.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimTombstoneFile.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func CimWriteStream(cimStreamHandle StreamHandle, buffer uintptr, bufferSize uint32) (hr error) {
+	hr = procCimWriteStream.Find()
+	if hr != nil {
+		return
+	}
+	r0, _, _ := syscall.SyscallN(procCimWriteStream.Addr(), uintptr(cimStreamHandle), uintptr(buffer), uintptr(bufferSize))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/winapi/devices.go

@@ -4,13 +4,15 @@ package winapi
 
 import "github.com/Microsoft/go-winio/pkg/guid"
 
-//sys CMGetDeviceInterfaceListSize(listlen *uint32, classGUID *g, deviceID *uint16, ulFlags uint32) (hr error) = cfgmgr32.CM_Get_Device_Interface_List_SizeW
-//sys CMGetDeviceInterfaceList(classGUID *g, deviceID *uint16, buffer *uint16, bufLen uint32, ulFlags uint32) (hr error) = cfgmgr32.CM_Get_Device_Interface_ListW
+//sys CMGetDeviceInterfaceListSize(listlen *uint32, classGUID *GUID, deviceID *uint16, ulFlags uint32) (hr error) = cfgmgr32.CM_Get_Device_Interface_List_SizeW
+//sys CMGetDeviceInterfaceList(classGUID *GUID, deviceID *uint16, buffer *uint16, bufLen uint32, ulFlags uint32) (hr error) = cfgmgr32.CM_Get_Device_Interface_ListW
 //sys CMGetDeviceIDListSize(pulLen *uint32, pszFilter *byte, uFlags uint32) (hr error) = cfgmgr32.CM_Get_Device_ID_List_SizeA
 //sys CMGetDeviceIDList(pszFilter *byte, buffer *byte, bufferLen uint32, uFlags uint32) (hr error)= cfgmgr32.CM_Get_Device_ID_ListA
 //sys CMLocateDevNode(pdnDevInst *uint32, pDeviceID string, uFlags uint32) (hr error) = cfgmgr32.CM_Locate_DevNodeW
 //sys CMGetDevNodeProperty(dnDevInst uint32, propertyKey *DevPropKey, propertyType *uint32, propertyBuffer *uint16, propertyBufferSize *uint32, uFlags uint32) (hr error) = cfgmgr32.CM_Get_DevNode_PropertyW
 
+type GUID = guid.GUID
+
 type DevPropKey struct {
 	Fmtid guid.GUID
 	Pid   uint32

vendor/github.com/Microsoft/hcsshim/internal/winapi/filesystem.go

@@ -8,6 +8,7 @@ package winapi
 
 //sys NtOpenDirectoryObject(handle *uintptr, accessMask uint32, oa *ObjectAttributes) (status uint32) = ntdll.NtOpenDirectoryObject
 //sys NtQueryDirectoryObject(handle uintptr, buffer *byte, length uint32, singleEntry bool, restartScan bool, context *uint32, returnLength *uint32)(status uint32) = ntdll.NtQueryDirectoryObject
+//sys NtFsControlFile(file windows.Handle, event windows.Handle, apcRoutine uintptr, apcCtx uintptr, iosb *IOStatusBlock, fsControlCode uint32, in []byte, out []byte) (status uint32) = ntdll.NtFsControlFile
 
 const (
 	FileLinkInformationClass          = 11

vendor/github.com/Microsoft/hcsshim/internal/winapi/types/cimfs.go

@@ -0,0 +1,36 @@
+//go:build windows
+
+package types
+
+import (
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+type FsHandle uintptr
+type StreamHandle uintptr
+
+type CimFsFileMetadata struct {
+	Attributes uint32
+	FileSize   int64
+
+	CreationTime   windows.Filetime
+	LastWriteTime  windows.Filetime
+	ChangeTime     windows.Filetime
+	LastAccessTime windows.Filetime
+
+	SecurityDescriptorBuffer unsafe.Pointer
+	SecurityDescriptorSize   uint32
+
+	ReparseDataBuffer unsafe.Pointer
+	ReparseDataSize   uint32
+
+	ExtendedAttributes unsafe.Pointer
+	EACount            uint32
+}
+
+type CimFsImagePath struct {
+	ImageDir  *uint16
+	ImageName *uint16
+}

vendor/github.com/Microsoft/hcsshim/internal/winapi/winapi.go

@@ -1,3 +1,3 @@
 package winapi
 
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go ./*.go
+//go:generate go tool github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go ./*.go

vendor/github.com/Microsoft/hcsshim/internal/winapi/zsyscall_windows.go

@@ -37,17 +37,19 @@ func errnoErr(e syscall.Errno) error {
 }
 
 var (
-	modadvapi32   = windows.NewLazySystemDLL("advapi32.dll")
-	modbindfltapi = windows.NewLazySystemDLL("bindfltapi.dll")
-	modcfgmgr32   = windows.NewLazySystemDLL("cfgmgr32.dll")
-	modcimfs      = windows.NewLazySystemDLL("cimfs.dll")
-	modiphlpapi   = windows.NewLazySystemDLL("iphlpapi.dll")
-	modkernel32   = windows.NewLazySystemDLL("kernel32.dll")
-	modnetapi32   = windows.NewLazySystemDLL("netapi32.dll")
-	modntdll      = windows.NewLazySystemDLL("ntdll.dll")
-	modoffreg     = windows.NewLazySystemDLL("offreg.dll")
+	modadvapi32     = windows.NewLazySystemDLL("advapi32.dll")
+	modamdsnppspapi = windows.NewLazySystemDLL("amdsnppspapi.dll")
+	modbindfltapi   = windows.NewLazySystemDLL("bindfltapi.dll")
+	modcfgmgr32     = windows.NewLazySystemDLL("cfgmgr32.dll")
+	modiphlpapi     = windows.NewLazySystemDLL("iphlpapi.dll")
+	modkernel32     = windows.NewLazySystemDLL("kernel32.dll")
+	modnetapi32     = windows.NewLazySystemDLL("netapi32.dll")
+	modntdll        = windows.NewLazySystemDLL("ntdll.dll")
+	modoffreg       = windows.NewLazySystemDLL("offreg.dll")
 
 	procLogonUserW                             = modadvapi32.NewProc("LogonUserW")
+	procSnpPspFetchAttestationReport           = modamdsnppspapi.NewProc("SnpPspFetchAttestationReport")
+	procSnpPspIsSnpMode                        = modamdsnppspapi.NewProc("SnpPspIsSnpMode")
 	procBfSetupFilter                          = modbindfltapi.NewProc("BfSetupFilter")
 	procCM_Get_DevNode_PropertyW               = modcfgmgr32.NewProc("CM_Get_DevNode_PropertyW")
 	procCM_Get_Device_ID_ListA                 = modcfgmgr32.NewProc("CM_Get_Device_ID_ListA")
@@ -55,26 +57,6 @@ var (
 	procCM_Get_Device_Interface_ListW          = modcfgmgr32.NewProc("CM_Get_Device_Interface_ListW")
 	procCM_Get_Device_Interface_List_SizeW     = modcfgmgr32.NewProc("CM_Get_Device_Interface_List_SizeW")
 	procCM_Locate_DevNodeW                     = modcfgmgr32.NewProc("CM_Locate_DevNodeW")
-	procCimAddFsToMergedImage                  = modcimfs.NewProc("CimAddFsToMergedImage")
-	procCimAddFsToMergedImage2                 = modcimfs.NewProc("CimAddFsToMergedImage2")
-	procCimCloseImage                          = modcimfs.NewProc("CimCloseImage")
-	procCimCloseStream                         = modcimfs.NewProc("CimCloseStream")
-	procCimCommitImage                         = modcimfs.NewProc("CimCommitImage")
-	procCimCreateAlternateStream               = modcimfs.NewProc("CimCreateAlternateStream")
-	procCimCreateFile                          = modcimfs.NewProc("CimCreateFile")
-	procCimCreateHardLink                      = modcimfs.NewProc("CimCreateHardLink")
-	procCimCreateImage                         = modcimfs.NewProc("CimCreateImage")
-	procCimCreateImage2                        = modcimfs.NewProc("CimCreateImage2")
-	procCimCreateMergeLink                     = modcimfs.NewProc("CimCreateMergeLink")
-	procCimDeletePath                          = modcimfs.NewProc("CimDeletePath")
-	procCimDismountImage                       = modcimfs.NewProc("CimDismountImage")
-	procCimGetVerificationInformation          = modcimfs.NewProc("CimGetVerificationInformation")
-	procCimMergeMountImage                     = modcimfs.NewProc("CimMergeMountImage")
-	procCimMountImage                          = modcimfs.NewProc("CimMountImage")
-	procCimMountVerifiedImage                  = modcimfs.NewProc("CimMountVerifiedImage")
-	procCimSealImage                           = modcimfs.NewProc("CimSealImage")
-	procCimTombstoneFile                       = modcimfs.NewProc("CimTombstoneFile")
-	procCimWriteStream                         = modcimfs.NewProc("CimWriteStream")
 	procSetJobCompartmentId                    = modiphlpapi.NewProc("SetJobCompartmentId")
 	procClosePseudoConsole                     = modkernel32.NewProc("ClosePseudoConsole")
 	procCopyFileW                              = modkernel32.NewProc("CopyFileW")
@@ -96,6 +78,7 @@ var (
 	procNetUserDel                             = modnetapi32.NewProc("NetUserDel")
 	procNtCreateFile                           = modntdll.NewProc("NtCreateFile")
 	procNtCreateJobObject                      = modntdll.NewProc("NtCreateJobObject")
+	procNtFsControlFile                        = modntdll.NewProc("NtFsControlFile")
 	procNtOpenDirectoryObject                  = modntdll.NewProc("NtOpenDirectoryObject")
 	procNtOpenJobObject                        = modntdll.NewProc("NtOpenJobObject")
 	procNtQueryDirectoryObject                 = modntdll.NewProc("NtQueryDirectoryObject")
@@ -124,6 +107,32 @@ func LogonUser(username *uint16, domain *uint16, password *uint16, logonType uin
 	return
 }
 
+func SnpPspFetchAttestationReport(reportData *uint8, guestRequestResult *SNPPSPGuestRequestResult, report *uint8) (ret uint32, err error) {
+	err = procSnpPspFetchAttestationReport.Find()
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall.SyscallN(procSnpPspFetchAttestationReport.Addr(), uintptr(unsafe.Pointer(reportData)), uintptr(unsafe.Pointer(guestRequestResult)), uintptr(unsafe.Pointer(report)))
+	ret = uint32(r0)
+	if ret > 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SnpPspIsSnpMode(snpMode *uint8) (ret uint32, err error) {
+	err = procSnpPspIsSnpMode.Find()
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall.SyscallN(procSnpPspIsSnpMode.Addr(), uintptr(unsafe.Pointer(snpMode)))
+	ret = uint32(r0)
+	if ret > 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func BfSetupFilter(jobHandle windows.Handle, flags uint32, virtRootPath *uint16, virtTargetPath *uint16, virtExceptions **uint16, virtExceptionPathCount uint32) (hr error) {
 	hr = procBfSetupFilter.Find()
 	if hr != nil {
@@ -172,7 +181,7 @@ func CMGetDeviceIDListSize(pulLen *uint32, pszFilter *byte, uFlags uint32) (hr e
 	return
 }
 
-func CMGetDeviceInterfaceList(classGUID *g, deviceID *uint16, buffer *uint16, bufLen uint32, ulFlags uint32) (hr error) {
+func CMGetDeviceInterfaceList(classGUID *GUID, deviceID *uint16, buffer *uint16, bufLen uint32, ulFlags uint32) (hr error) {
 	r0, _, _ := syscall.SyscallN(procCM_Get_Device_Interface_ListW.Addr(), uintptr(unsafe.Pointer(classGUID)), uintptr(unsafe.Pointer(deviceID)), uintptr(unsafe.Pointer(buffer)), uintptr(bufLen), uintptr(ulFlags))
 	if int32(r0) < 0 {
 		if r0&0x1fff0000 == 0x00070000 {
@@ -183,7 +192,7 @@ func CMGetDeviceInterfaceList(classGUID *g, deviceID *uint16, buffer *uint16, bu
 	return
 }
 
-func CMGetDeviceInterfaceListSize(listlen *uint32, classGUID *g, deviceID *uint16, ulFlags uint32) (hr error) {
+func CMGetDeviceInterfaceListSize(listlen *uint32, classGUID *GUID, deviceID *uint16, ulFlags uint32) (hr error) {
 	r0, _, _ := syscall.SyscallN(procCM_Get_Device_Interface_List_SizeW.Addr(), uintptr(unsafe.Pointer(listlen)), uintptr(unsafe.Pointer(classGUID)), uintptr(unsafe.Pointer(deviceID)), uintptr(ulFlags))
 	if int32(r0) < 0 {
 		if r0&0x1fff0000 == 0x00070000 {
@@ -214,446 +223,6 @@ func _CMLocateDevNode(pdnDevInst *uint32, pDeviceID *uint16, uFlags uint32) (hr
 	return
 }
 
-func CimAddFsToMergedImage(cimFSHandle FsHandle, path string) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(path)
-	if hr != nil {
-		return
-	}
-	return _CimAddFsToMergedImage(cimFSHandle, _p0)
-}
-
-func _CimAddFsToMergedImage(cimFSHandle FsHandle, path *uint16) (hr error) {
-	hr = procCimAddFsToMergedImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimAddFsToMergedImage.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimAddFsToMergedImage2(cimFSHandle FsHandle, path string, flags uint32) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(path)
-	if hr != nil {
-		return
-	}
-	return _CimAddFsToMergedImage2(cimFSHandle, _p0, flags)
-}
-
-func _CimAddFsToMergedImage2(cimFSHandle FsHandle, path *uint16, flags uint32) (hr error) {
-	hr = procCimAddFsToMergedImage2.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimAddFsToMergedImage2.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(flags))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCloseImage(cimFSHandle FsHandle) (err error) {
-	err = procCimCloseImage.Find()
-	if err != nil {
-		return
-	}
-	syscall.SyscallN(procCimCloseImage.Addr(), uintptr(cimFSHandle))
-	return
-}
-
-func CimCloseStream(cimStreamHandle StreamHandle) (hr error) {
-	hr = procCimCloseStream.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCloseStream.Addr(), uintptr(cimStreamHandle))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCommitImage(cimFSHandle FsHandle) (hr error) {
-	hr = procCimCommitImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCommitImage.Addr(), uintptr(cimFSHandle))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCreateAlternateStream(cimFSHandle FsHandle, path string, size uint64, cimStreamHandle *StreamHandle) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(path)
-	if hr != nil {
-		return
-	}
-	return _CimCreateAlternateStream(cimFSHandle, _p0, size, cimStreamHandle)
-}
-
-func _CimCreateAlternateStream(cimFSHandle FsHandle, path *uint16, size uint64, cimStreamHandle *StreamHandle) (hr error) {
-	hr = procCimCreateAlternateStream.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCreateAlternateStream.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(size), uintptr(unsafe.Pointer(cimStreamHandle)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCreateFile(cimFSHandle FsHandle, path string, file *CimFsFileMetadata, cimStreamHandle *StreamHandle) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(path)
-	if hr != nil {
-		return
-	}
-	return _CimCreateFile(cimFSHandle, _p0, file, cimStreamHandle)
-}
-
-func _CimCreateFile(cimFSHandle FsHandle, path *uint16, file *CimFsFileMetadata, cimStreamHandle *StreamHandle) (hr error) {
-	hr = procCimCreateFile.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCreateFile.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(file)), uintptr(unsafe.Pointer(cimStreamHandle)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCreateHardLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(newPath)
-	if hr != nil {
-		return
-	}
-	var _p1 *uint16
-	_p1, hr = syscall.UTF16PtrFromString(oldPath)
-	if hr != nil {
-		return
-	}
-	return _CimCreateHardLink(cimFSHandle, _p0, _p1)
-}
-
-func _CimCreateHardLink(cimFSHandle FsHandle, newPath *uint16, oldPath *uint16) (hr error) {
-	hr = procCimCreateHardLink.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCreateHardLink.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(newPath)), uintptr(unsafe.Pointer(oldPath)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCreateImage(imagePath string, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(imagePath)
-	if hr != nil {
-		return
-	}
-	return _CimCreateImage(_p0, oldFSName, newFSName, cimFSHandle)
-}
-
-func _CimCreateImage(imagePath *uint16, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
-	hr = procCimCreateImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCreateImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(oldFSName)), uintptr(unsafe.Pointer(newFSName)), uintptr(unsafe.Pointer(cimFSHandle)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCreateImage2(imagePath string, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(imagePath)
-	if hr != nil {
-		return
-	}
-	return _CimCreateImage2(_p0, flags, oldFSName, newFSName, cimFSHandle)
-}
-
-func _CimCreateImage2(imagePath *uint16, flags uint32, oldFSName *uint16, newFSName *uint16, cimFSHandle *FsHandle) (hr error) {
-	hr = procCimCreateImage2.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCreateImage2.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(flags), uintptr(unsafe.Pointer(oldFSName)), uintptr(unsafe.Pointer(newFSName)), uintptr(unsafe.Pointer(cimFSHandle)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimCreateMergeLink(cimFSHandle FsHandle, newPath string, oldPath string) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(newPath)
-	if hr != nil {
-		return
-	}
-	var _p1 *uint16
-	_p1, hr = syscall.UTF16PtrFromString(oldPath)
-	if hr != nil {
-		return
-	}
-	return _CimCreateMergeLink(cimFSHandle, _p0, _p1)
-}
-
-func _CimCreateMergeLink(cimFSHandle FsHandle, newPath *uint16, oldPath *uint16) (hr error) {
-	hr = procCimCreateMergeLink.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimCreateMergeLink.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(newPath)), uintptr(unsafe.Pointer(oldPath)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimDeletePath(cimFSHandle FsHandle, path string) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(path)
-	if hr != nil {
-		return
-	}
-	return _CimDeletePath(cimFSHandle, _p0)
-}
-
-func _CimDeletePath(cimFSHandle FsHandle, path *uint16) (hr error) {
-	hr = procCimDeletePath.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimDeletePath.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimDismountImage(volumeID *g) (hr error) {
-	hr = procCimDismountImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimDismountImage.Addr(), uintptr(unsafe.Pointer(volumeID)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimGetVerificationInformation(blockCimPath string, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(blockCimPath)
-	if hr != nil {
-		return
-	}
-	return _CimGetVerificationInformation(_p0, isSealed, hashSize, signatureSize, fixedHeaderSize, hash, signature)
-}
-
-func _CimGetVerificationInformation(blockCimPath *uint16, isSealed *uint32, hashSize *uint64, signatureSize *uint64, fixedHeaderSize *uint64, hash *byte, signature *byte) (hr error) {
-	hr = procCimGetVerificationInformation.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimGetVerificationInformation.Addr(), uintptr(unsafe.Pointer(blockCimPath)), uintptr(unsafe.Pointer(isSealed)), uintptr(unsafe.Pointer(hashSize)), uintptr(unsafe.Pointer(signatureSize)), uintptr(unsafe.Pointer(fixedHeaderSize)), uintptr(unsafe.Pointer(hash)), uintptr(unsafe.Pointer(signature)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimMergeMountImage(numCimPaths uint32, backingImagePaths *CimFsImagePath, flags uint32, volumeID *g) (hr error) {
-	hr = procCimMergeMountImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimMergeMountImage.Addr(), uintptr(numCimPaths), uintptr(unsafe.Pointer(backingImagePaths)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimMountImage(imagePath string, fsName string, flags uint32, volumeID *g) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(imagePath)
-	if hr != nil {
-		return
-	}
-	var _p1 *uint16
-	_p1, hr = syscall.UTF16PtrFromString(fsName)
-	if hr != nil {
-		return
-	}
-	return _CimMountImage(_p0, _p1, flags, volumeID)
-}
-
-func _CimMountImage(imagePath *uint16, fsName *uint16, flags uint32, volumeID *g) (hr error) {
-	hr = procCimMountImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimMountImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(fsName)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimMountVerifiedImage(imagePath string, fsName string, flags uint32, volumeID *g, hashSize uint16, hash *byte) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(imagePath)
-	if hr != nil {
-		return
-	}
-	var _p1 *uint16
-	_p1, hr = syscall.UTF16PtrFromString(fsName)
-	if hr != nil {
-		return
-	}
-	return _CimMountVerifiedImage(_p0, _p1, flags, volumeID, hashSize, hash)
-}
-
-func _CimMountVerifiedImage(imagePath *uint16, fsName *uint16, flags uint32, volumeID *g, hashSize uint16, hash *byte) (hr error) {
-	hr = procCimMountVerifiedImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimMountVerifiedImage.Addr(), uintptr(unsafe.Pointer(imagePath)), uintptr(unsafe.Pointer(fsName)), uintptr(flags), uintptr(unsafe.Pointer(volumeID)), uintptr(hashSize), uintptr(unsafe.Pointer(hash)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimSealImage(blockCimPath string, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(blockCimPath)
-	if hr != nil {
-		return
-	}
-	return _CimSealImage(_p0, hashSize, fixedHeaderSize, hash)
-}
-
-func _CimSealImage(blockCimPath *uint16, hashSize *uint64, fixedHeaderSize *uint64, hash *byte) (hr error) {
-	hr = procCimSealImage.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimSealImage.Addr(), uintptr(unsafe.Pointer(blockCimPath)), uintptr(unsafe.Pointer(hashSize)), uintptr(unsafe.Pointer(fixedHeaderSize)), uintptr(unsafe.Pointer(hash)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimTombstoneFile(cimFSHandle FsHandle, path string) (hr error) {
-	var _p0 *uint16
-	_p0, hr = syscall.UTF16PtrFromString(path)
-	if hr != nil {
-		return
-	}
-	return _CimTombstoneFile(cimFSHandle, _p0)
-}
-
-func _CimTombstoneFile(cimFSHandle FsHandle, path *uint16) (hr error) {
-	hr = procCimTombstoneFile.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimTombstoneFile.Addr(), uintptr(cimFSHandle), uintptr(unsafe.Pointer(path)))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
-func CimWriteStream(cimStreamHandle StreamHandle, buffer uintptr, bufferSize uint32) (hr error) {
-	hr = procCimWriteStream.Find()
-	if hr != nil {
-		return
-	}
-	r0, _, _ := syscall.SyscallN(procCimWriteStream.Addr(), uintptr(cimStreamHandle), uintptr(buffer), uintptr(bufferSize))
-	if int32(r0) < 0 {
-		if r0&0x1fff0000 == 0x00070000 {
-			r0 &= 0xffff
-		}
-		hr = syscall.Errno(r0)
-	}
-	return
-}
-
 func SetJobCompartmentId(handle windows.Handle, compartmentId uint32) (win32Err error) {
 	r0, _, _ := syscall.SyscallN(procSetJobCompartmentId.Addr(), uintptr(handle), uintptr(compartmentId))
 	if r0 != 0 {
@@ -823,6 +392,20 @@ func NtCreateJobObject(jobHandle *windows.Handle, desiredAccess uint32, objAttri
 	return
 }
 
+func NtFsControlFile(file windows.Handle, event windows.Handle, apcRoutine uintptr, apcCtx uintptr, iosb *IOStatusBlock, fsControlCode uint32, in []byte, out []byte) (status uint32) {
+	var _p0 *byte
+	if len(in) > 0 {
+		_p0 = &in[0]
+	}
+	var _p1 *byte
+	if len(out) > 0 {
+		_p1 = &out[0]
+	}
+	r0, _, _ := syscall.SyscallN(procNtFsControlFile.Addr(), uintptr(file), uintptr(event), uintptr(apcRoutine), uintptr(apcCtx), uintptr(unsafe.Pointer(iosb)), uintptr(fsControlCode), uintptr(unsafe.Pointer(_p0)), uintptr(len(in)), uintptr(unsafe.Pointer(_p1)), uintptr(len(out)))
+	status = uint32(r0)
+	return
+}
+
 func NtOpenDirectoryObject(handle *uintptr, accessMask uint32, oa *ObjectAttributes) (status uint32) {
 	r0, _, _ := syscall.SyscallN(procNtOpenDirectoryObject.Addr(), uintptr(unsafe.Pointer(handle)), uintptr(accessMask), uintptr(unsafe.Pointer(oa)))
 	status = uint32(r0)

vendor/modules.txt

@@ -110,8 +110,8 @@ github.com/Microsoft/go-winio/pkg/etwlogrus
 github.com/Microsoft/go-winio/pkg/fs
 github.com/Microsoft/go-winio/pkg/guid
 github.com/Microsoft/go-winio/vhd
-# github.com/Microsoft/hcsshim v0.14.1
-## explicit; go 1.23.0
+# github.com/Microsoft/hcsshim v0.15.0-rc.1
+## explicit; go 1.24.0
 github.com/Microsoft/hcsshim
 github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options
 github.com/Microsoft/hcsshim/computestorage
@@ -141,6 +141,9 @@ github.com/Microsoft/hcsshim/internal/timeout
 github.com/Microsoft/hcsshim/internal/vmcompute
 github.com/Microsoft/hcsshim/internal/wclayer
 github.com/Microsoft/hcsshim/internal/winapi
+github.com/Microsoft/hcsshim/internal/winapi/cimfs
+github.com/Microsoft/hcsshim/internal/winapi/cimwriter
+github.com/Microsoft/hcsshim/internal/winapi/types
 github.com/Microsoft/hcsshim/osversion
 github.com/Microsoft/hcsshim/pkg/ociwclayer
 # github.com/ProtonMail/go-crypto v1.3.0