@@ -1,6 +1,6 @@

 github.com/Azure/go-ansiterm                        d6e3b3328b783f23731bc4d058875b0371ff8109

 github.com/Microsoft/hcsshim                        64a2b71405dacf76c95600f4c756a991ad09cf7c # moby branch

-github.com/Microsoft/go-winio                       5b44b70ab3ab4d291a7c1d28afe7b4afeced0ed4 # v0.4.15

+github.com/Microsoft/go-winio                       7e149e8c70409f36773c1b2cf3447a7ab7697368 # v0.4.20

 github.com/docker/libtrust                          9cbd2a1374f46905c68a4eb3694a130610adc62a

 github.com/golang/gddo                              72a348e765d293ed6d1ded7b699591f14d6cd921

 github.com/google/uuid                              0cd6bf5da1e1c83f8b45653022c74f71af0538a4 # v1.1.1

@@ -1,4 +1,4 @@

-# go-winio

+# go-winio [![Build Status](https://github.com/microsoft/go-winio/actions/workflows/ci.yml/badge.svg)](https://github.com/microsoft/go-winio/actions/workflows/ci.yml)

 This repository contains utilities for efficiently performing Win32 IO operations in

 Go. Currently, this is focused on accessing named pipes and other file handles, and

@@ -5,7 +5,6 @@ package backuptar

 import (

 	"archive/tar"

 	"encoding/base64"

-	"errors"

 	"fmt"

 	"io"

 	"io/ioutil"

@@ -41,19 +40,14 @@ const (

 	hdrCreationTime = "LIBARCHIVE.creationtime"

 )

-func writeZeroes(w io.Writer, count int64) error {

-	buf := make([]byte, 8192)

-	c := len(buf)

-	for i := int64(0); i < count; i += int64(c) {

-		if int64(c) > count-i {

-			c = int(count - i)

-		}

-		_, err := w.Write(buf[:c])

-		if err != nil {

-			return err

-		}

+// zeroReader is an io.Reader that always returns 0s.

+type zeroReader struct{}

+

+func (zr zeroReader) Read(b []byte) (int, error) {

+	for i := range b {

+		b[i] = 0

 	}

-	return nil

+	return len(b), nil

 }

 func copySparse(t *tar.Writer, br *winio.BackupStreamReader) error {

@@ -70,16 +64,26 @@ func copySparse(t *tar.Writer, br *winio.BackupStreamReader) error {

 			return fmt.Errorf("unexpected stream %d", bhdr.Id)

 		}

+		// We can't seek backwards, since we have already written that data to the tar.Writer.

+		if bhdr.Offset < curOffset {

+			return fmt.Errorf("cannot seek back from %d to %d", curOffset, bhdr.Offset)

+		}

 		// archive/tar does not support writing sparse files

 		// so just write zeroes to catch up to the current offset.

-		err = writeZeroes(t, bhdr.Offset-curOffset)

+		if _, err := io.CopyN(t, zeroReader{}, bhdr.Offset-curOffset); err != nil {

+			return fmt.Errorf("seek to offset %d: %s", bhdr.Offset, err)

+		}

 		if bhdr.Size == 0 {

+			// A sparse block with size = 0 is used to mark the end of the sparse blocks.

 			break

 		}

 		n, err := io.Copy(t, br)

 		if err != nil {

 			return err

 		}

+		if n != bhdr.Size {

+			return fmt.Errorf("copied %d bytes instead of %d at offset %d", n, bhdr.Size, bhdr.Offset)

+		}

 		curOffset = bhdr.Offset + n

 	}

 	return nil

@@ -220,20 +224,44 @@ func WriteTarFileFromBackupStream(t *tar.Writer, r io.Reader, name string, size

 		}

 	}

+	// The logic for copying file contents is fairly complicated due to the need for handling sparse files,

+	// and the weird ways they are represented by BackupRead. A normal file will always either have a data stream

+	// with size and content, or no data stream at all (if empty). However, for a sparse file, the content can also

+	// be represented using a series of sparse block streams following the data stream. Additionally, the way sparse

+	// files are handled by BackupRead has changed in the OS recently. The specifics of the representation are described

+	// in the list at the bottom of this block comment.

+	//

+	// Sparse files can be represented in four different ways, based on the specifics of the file.

+	// - Size = 0:

+	//     Previously: BackupRead yields no data stream and no sparse block streams.

+	//     Recently: BackupRead yields a data stream with size = 0. There are no following sparse block streams.

+	// - Size > 0, no allocated ranges:

+	//     BackupRead yields a data stream with size = 0. Following is a single sparse block stream with

+	//     size = 0 and offset = <file size>.

+	// - Size > 0, one allocated range:

+	//     BackupRead yields a data stream with size = <file size> containing the file contents. There are no

+	//     sparse block streams. This is the case if you take a normal file with contents and simply set the

+	//     sparse flag on it.

+	// - Size > 0, multiple allocated ranges:

+	//     BackupRead yields a data stream with size = 0. Following are sparse block streams for each allocated

+	//     range of the file containing the range contents. Finally there is a sparse block stream with

+	//     size = 0 and offset = <file size>.

+

 	if dataHdr != nil {

 		// A data stream was found. Copy the data.

-		if (dataHdr.Attributes & winio.StreamSparseAttributes) == 0 {

+		// We assume that we will either have a data stream size > 0 XOR have sparse block streams.

+		if dataHdr.Size > 0 || (dataHdr.Attributes&winio.StreamSparseAttributes) == 0 {

 			if size != dataHdr.Size {

 				return fmt.Errorf("%s: mismatch between file size %d and header size %d", name, size, dataHdr.Size)

 			}

-			_, err = io.Copy(t, br)

-			if err != nil {

-				return err

+			if _, err = io.Copy(t, br); err != nil {

+				return fmt.Errorf("%s: copying contents from data stream: %s", name, err)

 			}

-		} else {

-			err = copySparse(t, br)

-			if err != nil {

-				return err

+		} else if size > 0 {

+			// As of a recent OS change, BackupRead now returns a data stream for empty sparse files.

+			// These files have no sparse block streams, so skip the copySparse call if file size = 0.

+			if err = copySparse(t, br); err != nil {

+				return fmt.Errorf("%s: copying contents from sparse block stream: %s", name, err)

 			}

 		}

 	}

@@ -278,7 +306,7 @@ func WriteTarFileFromBackupStream(t *tar.Writer, r io.Reader, name string, size

 			} else {

 				// Unsupported for now, since the size of the alternate stream is not present

 				// in the backup stream until after the data has been read.

-				return errors.New("tar of sparse alternate data streams is unsupported")

+				return fmt.Errorf("%s: tar of sparse alternate data streams is unsupported", name)

 			}

 		case winio.BackupEaData, winio.BackupLink, winio.BackupPropertyData, winio.BackupObjectId, winio.BackupTxfsData:

 			// ignore these streams

@@ -3,7 +3,7 @@ module github.com/Microsoft/go-winio

 go 1.12

 require (

-	github.com/pkg/errors v0.8.1

-	github.com/sirupsen/logrus v1.4.1

-	golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3

+	github.com/pkg/errors v0.9.1

+	github.com/sirupsen/logrus v1.7.0

+	golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c

 )

@@ -1,3 +1,5 @@

+// +build windows

+

 package winio

 import (

@@ -429,10 +429,10 @@ type PipeConfig struct {

 	// when the pipe is in message mode.

 	MessageMode bool

-	// InputBufferSize specifies the size the input buffer, in bytes.

+	// InputBufferSize specifies the size of the input buffer, in bytes.

 	InputBufferSize int32

-	// OutputBufferSize specifies the size the input buffer, in bytes.

+	// OutputBufferSize specifies the size of the output buffer, in bytes.

 	OutputBufferSize int32

 }

@@ -1,3 +1,5 @@

+// +build windows

+

 package etw

 import (

@@ -1,3 +1,5 @@

+// +build windows

+

 package etw

 import (

@@ -1,3 +1,5 @@

+// +build windows

+

 package etw

 import (

@@ -1,3 +1,4 @@

+// +build windows

 // +build amd64 arm64 386

 package etw

@@ -11,11 +12,20 @@ import (

 	"golang.org/x/sys/windows"

 )

-// NewProviderWithID creates and registers a new ETW provider, allowing the

-// provider ID to be manually specified. This is most useful when there is an

-// existing provider ID that must be used to conform to existing diagnostic

-// infrastructure.

-func NewProviderWithID(name string, id guid.GUID, callback EnableCallback) (provider *Provider, err error) {

+// NewProviderWithOptions creates and registers a new ETW provider, allowing

+// the provider ID and Group to be manually specified. This is most useful when

+// there is an existing provider ID that must be used to conform to existing

+// diagnostic infrastructure.

+func NewProviderWithOptions(name string, options ...ProviderOpt) (provider *Provider, err error) {

+	var opts providerOpts

+	for _, opt := range options {

+		opt(&opts)

+	}

+

+	if opts.id == (guid.GUID{}) {

+		opts.id = providerIDFromName(name)

+	}

+

 	providerCallbackOnce.Do(func() {

 		globalProviderCallback = windows.NewCallback(providerCallbackAdapter)

 	})

@@ -26,17 +36,27 @@ func NewProviderWithID(name string, id guid.GUID, callback EnableCallback) (prov

 			providers.removeProvider(provider)

 		}

 	}(provider)

-	provider.ID = id

-	provider.callback = callback

+	provider.ID = opts.id

+	provider.callback = opts.callback

 	if err := eventRegister((*windows.GUID)(&provider.ID), globalProviderCallback, uintptr(provider.index), &provider.handle); err != nil {

 		return nil, err

 	}

+	trait := &bytes.Buffer{}

+	if opts.group != (guid.GUID{}) {

+		binary.Write(trait, binary.LittleEndian, uint16(0)) // Write empty size for buffer (update later)

+		binary.Write(trait, binary.LittleEndian, uint8(1))  // EtwProviderTraitTypeGroup

+		traitArray := opts.group.ToWindowsArray()           // Append group guid

+		trait.Write(traitArray[:])

+		binary.LittleEndian.PutUint16(trait.Bytes(), uint16(trait.Len())) // Update size

+	}

+

 	metadata := &bytes.Buffer{}

 	binary.Write(metadata, binary.LittleEndian, uint16(0)) // Write empty size for buffer (to update later)

 	metadata.WriteString(name)

 	metadata.WriteByte(0)                                                   // Null terminator for name

+	trait.WriteTo(metadata)                                                 // Add traits if applicable

 	binary.LittleEndian.PutUint16(metadata.Bytes(), uint16(metadata.Len())) // Update the size at the beginning of the buffer

 	provider.metadata = metadata.Bytes()

@@ -1,12 +1,9 @@

+// +build windows

 // +build arm

 package etw

-import (

-	"github.com/Microsoft/go-winio/pkg/guid"

-)

-

 // NewProviderWithID returns a nil provider on unsupported platforms.

-func NewProviderWithID(name string, id guid.GUID, callback EnableCallback) (provider *Provider, err error) {

+func NewProviderWithOptions(name string, options ...ProviderOpt) (provider *Provider, err error) {

 	return nil, nil

 }

@@ -1,3 +1,5 @@

+// +build windows

+

 package etw

 import (

@@ -81,15 +83,6 @@ func providerCallback(sourceID guid.GUID, state ProviderState, level Level, matc

 	}

 }

-// providerCallbackAdapter acts as the first-level callback from the C/ETW side

-// for provider notifications. Because Go has trouble with callback arguments of

-// different size, it has only pointer-sized arguments, which are then cast to

-// the appropriate types when calling providerCallback.

-func providerCallbackAdapter(sourceID *guid.GUID, state uintptr, level uintptr, matchAnyKeyword uintptr, matchAllKeyword uintptr, filterData uintptr, i uintptr) uintptr {

-	providerCallback(*sourceID, ProviderState(state), Level(level), uint64(matchAnyKeyword), uint64(matchAllKeyword), filterData, i)

-	return 0

-}

-

 // providerIDFromName generates a provider ID based on the provider name. It

 // uses the same algorithm as used by .NET's EventSource class, which is based

 // on RFC 4122. More information on the algorithm can be found here:

@@ -117,10 +110,50 @@ func providerIDFromName(name string) guid.GUID {

 	return guid.FromWindowsArray(a)

 }

+type providerOpts struct {

+	callback EnableCallback

+	id       guid.GUID

+	group    guid.GUID

+}

+

+// ProviderOpt allows the caller to specify provider options to

+// NewProviderWithOptions

+type ProviderOpt func(*providerOpts)

+

+// WithCallback is used to provide a callback option to NewProviderWithOptions

+func WithCallback(callback EnableCallback) ProviderOpt {

+	return func(opts *providerOpts) {

+		opts.callback = callback

+	}

+}

+

+// WithID is used to provide a provider ID option to NewProviderWithOptions

+func WithID(id guid.GUID) ProviderOpt {

+	return func(opts *providerOpts) {

+		opts.id = id

+	}

+}

+

+// WithGroup is used to provide a provider group option to

+// NewProviderWithOptions

+func WithGroup(group guid.GUID) ProviderOpt {

+	return func(opts *providerOpts) {

+		opts.group = group

+	}

+}

+

+// NewProviderWithID creates and registers a new ETW provider, allowing the

+// provider ID to be manually specified. This is most useful when there is an

+// existing provider ID that must be used to conform to existing diagnostic

+// infrastructure.

+func NewProviderWithID(name string, id guid.GUID, callback EnableCallback) (provider *Provider, err error) {

+	return NewProviderWithOptions(name, WithID(id), WithCallback(callback))

+}

+

 // NewProvider creates and registers a new ETW provider. The provider ID is

 // generated based on the provider name.

 func NewProvider(name string, callback EnableCallback) (provider *Provider, err error) {

-	return NewProviderWithID(name, providerIDFromName(name), callback)

+	return NewProviderWithOptions(name, WithCallback(callback))

 }

 // Close unregisters the provider.

@@ -1,3 +1,5 @@

+// +build windows

+

 package etw

 import (

@@ -1,8 +1,10 @@

+// +build windows

 // +build 386 arm

 package etw

 import (

+	"github.com/Microsoft/go-winio/pkg/guid"

 	"golang.org/x/sys/windows"

 )

@@ -49,3 +51,17 @@ func eventSetInformation(

 		information,

 		length)

 }

+

+// providerCallbackAdapter acts as the first-level callback from the C/ETW side

+// for provider notifications. Because Go has trouble with callback arguments of

+// different size, it has only pointer-sized arguments, which are then cast to

+// the appropriate types when calling providerCallback.

+// For x86, the matchAny and matchAll keywords need to be assembled from two

+// 32-bit integers, because the max size of an argument is uintptr, but those

+// two arguments are actually 64-bit integers.

+func providerCallbackAdapter(sourceID *guid.GUID, state uint32, level uint32, matchAnyKeyword_low uint32, matchAnyKeyword_high uint32, matchAllKeyword_low uint32, matchAllKeyword_high uint32, filterData uintptr, i uintptr) uintptr {

+	matchAnyKeyword := uint64(matchAnyKeyword_high)<<32 | uint64(matchAnyKeyword_low)

+	matchAllKeyword := uint64(matchAllKeyword_high)<<32 | uint64(matchAllKeyword_low)

+	providerCallback(*sourceID, ProviderState(state), Level(level), uint64(matchAnyKeyword), uint64(matchAllKeyword), filterData, i)

+	return 0

+}

@@ -1,8 +1,10 @@

+// +build windows

 // +build amd64 arm64

 package etw

 import (

+	"github.com/Microsoft/go-winio/pkg/guid"

 	"golang.org/x/sys/windows"

 )

@@ -39,3 +41,12 @@ func eventSetInformation(

 		information,

 		length)

 }

+

+// providerCallbackAdapter acts as the first-level callback from the C/ETW side

+// for provider notifications. Because Go has trouble with callback arguments of

+// different size, it has only pointer-sized arguments, which are then cast to

+// the appropriate types when calling providerCallback.

+func providerCallbackAdapter(sourceID *guid.GUID, state uintptr, level uintptr, matchAnyKeyword uintptr, matchAllKeyword uintptr, filterData uintptr, i uintptr) uintptr {

+	providerCallback(*sourceID, ProviderState(state), Level(level), uint64(matchAnyKeyword), uint64(matchAllKeyword), filterData, i)

+	return 0

+}

@@ -19,6 +19,7 @@ const (

 var (

 	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)

+	errERROR_EINVAL     error = syscall.EINVAL

 )

 // errnoErr returns common boxed Errno values, to prevent

@@ -26,7 +27,7 @@ var (

 func errnoErr(e syscall.Errno) error {

 	switch e {

 	case 0:

-		return nil

+		return errERROR_EINVAL

 	case errnoERROR_IO_PENDING:

 		return errERROR_IO_PENDING

 	}

@@ -40,9 +41,9 @@ var (

 	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")

 	procEventRegister       = modadvapi32.NewProc("EventRegister")

+	procEventSetInformation = modadvapi32.NewProc("EventSetInformation")

 	procEventUnregister     = modadvapi32.NewProc("EventUnregister")

 	procEventWriteTransfer  = modadvapi32.NewProc("EventWriteTransfer")

-	procEventSetInformation = modadvapi32.NewProc("EventSetInformation")

 )

 func eventRegister(providerId *windows.GUID, callback uintptr, callbackContext uintptr, providerHandle *providerHandle) (win32err error) {

@@ -53,24 +54,24 @@ func eventRegister(providerId *windows.GUID, callback uintptr, callbackContext u

 	return

 }

-func eventUnregister_64(providerHandle providerHandle) (win32err error) {

-	r0, _, _ := syscall.Syscall(procEventUnregister.Addr(), 1, uintptr(providerHandle), 0, 0)

+func eventSetInformation_64(providerHandle providerHandle, class eventInfoClass, information uintptr, length uint32) (win32err error) {

+	r0, _, _ := syscall.Syscall6(procEventSetInformation.Addr(), 4, uintptr(providerHandle), uintptr(class), uintptr(information), uintptr(length), 0, 0)

 	if r0 != 0 {

 		win32err = syscall.Errno(r0)

 	}

 	return

 }

-func eventWriteTransfer_64(providerHandle providerHandle, descriptor *eventDescriptor, activityID *windows.GUID, relatedActivityID *windows.GUID, dataDescriptorCount uint32, dataDescriptors *eventDataDescriptor) (win32err error) {

-	r0, _, _ := syscall.Syscall6(procEventWriteTransfer.Addr(), 6, uintptr(providerHandle), uintptr(unsafe.Pointer(descriptor)), uintptr(unsafe.Pointer(activityID)), uintptr(unsafe.Pointer(relatedActivityID)), uintptr(dataDescriptorCount), uintptr(unsafe.Pointer(dataDescriptors)))

+func eventSetInformation_32(providerHandle_low uint32, providerHandle_high uint32, class eventInfoClass, information uintptr, length uint32) (win32err error) {

+	r0, _, _ := syscall.Syscall6(procEventSetInformation.Addr(), 5, uintptr(providerHandle_low), uintptr(providerHandle_high), uintptr(class), uintptr(information), uintptr(length), 0)

 	if r0 != 0 {

 		win32err = syscall.Errno(r0)

 	}

 	return

 }

-func eventSetInformation_64(providerHandle providerHandle, class eventInfoClass, information uintptr, length uint32) (win32err error) {

-	r0, _, _ := syscall.Syscall6(procEventSetInformation.Addr(), 4, uintptr(providerHandle), uintptr(class), uintptr(information), uintptr(length), 0, 0)

+func eventUnregister_64(providerHandle providerHandle) (win32err error) {

+	r0, _, _ := syscall.Syscall(procEventUnregister.Addr(), 1, uintptr(providerHandle), 0, 0)

 	if r0 != 0 {

 		win32err = syscall.Errno(r0)

 	}

@@ -85,16 +86,16 @@ func eventUnregister_32(providerHandle_low uint32, providerHandle_high uint32) (

 	return

 }

-func eventWriteTransfer_32(providerHandle_low uint32, providerHandle_high uint32, descriptor *eventDescriptor, activityID *windows.GUID, relatedActivityID *windows.GUID, dataDescriptorCount uint32, dataDescriptors *eventDataDescriptor) (win32err error) {

-	r0, _, _ := syscall.Syscall9(procEventWriteTransfer.Addr(), 7, uintptr(providerHandle_low), uintptr(providerHandle_high), uintptr(unsafe.Pointer(descriptor)), uintptr(unsafe.Pointer(activityID)), uintptr(unsafe.Pointer(relatedActivityID)), uintptr(dataDescriptorCount), uintptr(unsafe.Pointer(dataDescriptors)), 0, 0)

+func eventWriteTransfer_64(providerHandle providerHandle, descriptor *eventDescriptor, activityID *windows.GUID, relatedActivityID *windows.GUID, dataDescriptorCount uint32, dataDescriptors *eventDataDescriptor) (win32err error) {

+	r0, _, _ := syscall.Syscall6(procEventWriteTransfer.Addr(), 6, uintptr(providerHandle), uintptr(unsafe.Pointer(descriptor)), uintptr(unsafe.Pointer(activityID)), uintptr(unsafe.Pointer(relatedActivityID)), uintptr(dataDescriptorCount), uintptr(unsafe.Pointer(dataDescriptors)))

 	if r0 != 0 {

 		win32err = syscall.Errno(r0)

 	}

 	return

 }

-func eventSetInformation_32(providerHandle_low uint32, providerHandle_high uint32, class eventInfoClass, information uintptr, length uint32) (win32err error) {

-	r0, _, _ := syscall.Syscall6(procEventSetInformation.Addr(), 5, uintptr(providerHandle_low), uintptr(providerHandle_high), uintptr(class), uintptr(information), uintptr(length), 0)

+func eventWriteTransfer_32(providerHandle_low uint32, providerHandle_high uint32, descriptor *eventDescriptor, activityID *windows.GUID, relatedActivityID *windows.GUID, dataDescriptorCount uint32, dataDescriptors *eventDataDescriptor) (win32err error) {

+	r0, _, _ := syscall.Syscall9(procEventWriteTransfer.Addr(), 7, uintptr(providerHandle_low), uintptr(providerHandle_high), uintptr(unsafe.Pointer(descriptor)), uintptr(unsafe.Pointer(activityID)), uintptr(unsafe.Pointer(relatedActivityID)), uintptr(dataDescriptorCount), uintptr(unsafe.Pointer(dataDescriptors)), 0, 0)

 	if r0 != 0 {

 		win32err = syscall.Errno(r0)

 	}

@@ -1,3 +1,5 @@

+// +build windows

+

 package etwlogrus

 import (

@@ -1,3 +1,5 @@

+// +build windows

+

 // Package guid provides a GUID type. The backing structure for a GUID is

 // identical to that used by the golang.org/x/sys/windows GUID type.

 // There are two main binary encodings used for a GUID, the big-endian encoding,

@@ -1,3 +1,5 @@

+// +build windows

+

 package security

 import (

@@ -2,6 +2,6 @@ package security

 //go:generate go run mksyscall_windows.go -output zsyscall_windows.go syscall_windows.go

-//sys getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (err error) [failretval!=0] = advapi32.GetSecurityInfo

-//sys setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (err error) [failretval!=0] = advapi32.SetSecurityInfo

-//sys setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (err error) [failretval!=0] = advapi32.SetEntriesInAclW

+//sys getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) = advapi32.GetSecurityInfo

+//sys setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) = advapi32.SetSecurityInfo

+//sys setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (win32err error) = advapi32.SetEntriesInAclW

@@ -1,4 +1,4 @@

-// Code generated mksyscall_windows.exe DO NOT EDIT

+// Code generated by 'go generate'; DO NOT EDIT.

 package security

@@ -19,6 +19,7 @@ const (

 var (

 	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)

+	errERROR_EINVAL     error = syscall.EINVAL

 )

 // errnoErr returns common boxed Errno values, to prevent

@@ -26,7 +27,7 @@ var (

 func errnoErr(e syscall.Errno) error {

 	switch e {

 	case 0:

-		return nil

+		return errERROR_EINVAL

 	case errnoERROR_IO_PENDING:

 		return errERROR_IO_PENDING

 	}

@@ -40,42 +41,30 @@ var (

 	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")

 	procGetSecurityInfo  = modadvapi32.NewProc("GetSecurityInfo")

-	procSetSecurityInfo  = modadvapi32.NewProc("SetSecurityInfo")

 	procSetEntriesInAclW = modadvapi32.NewProc("SetEntriesInAclW")

+	procSetSecurityInfo  = modadvapi32.NewProc("SetSecurityInfo")

 )

-func getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (err error) {

-	r1, _, e1 := syscall.Syscall9(procGetSecurityInfo.Addr(), 8, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(unsafe.Pointer(ppsidOwner)), uintptr(unsafe.Pointer(ppsidGroup)), uintptr(unsafe.Pointer(ppDacl)), uintptr(unsafe.Pointer(ppSacl)), uintptr(unsafe.Pointer(ppSecurityDescriptor)), 0)

-	if r1 != 0 {

-		if e1 != 0 {

-			err = errnoErr(e1)

-		} else {

-			err = syscall.EINVAL

-		}

+func getSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, ppsidOwner **uintptr, ppsidGroup **uintptr, ppDacl *uintptr, ppSacl *uintptr, ppSecurityDescriptor *uintptr) (win32err error) {

+	r0, _, _ := syscall.Syscall9(procGetSecurityInfo.Addr(), 8, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(unsafe.Pointer(ppsidOwner)), uintptr(unsafe.Pointer(ppsidGroup)), uintptr(unsafe.Pointer(ppDacl)), uintptr(unsafe.Pointer(ppSacl)), uintptr(unsafe.Pointer(ppSecurityDescriptor)), 0)

+	if r0 != 0 {

+		win32err = syscall.Errno(r0)

 	}

 	return

 }

-func setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (err error) {

-	r1, _, e1 := syscall.Syscall9(procSetSecurityInfo.Addr(), 7, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(psidOwner), uintptr(psidGroup), uintptr(pDacl), uintptr(pSacl), 0, 0)

-	if r1 != 0 {

-		if e1 != 0 {

-			err = errnoErr(e1)

-		} else {

-			err = syscall.EINVAL

-		}

+func setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (win32err error) {

+	r0, _, _ := syscall.Syscall6(procSetEntriesInAclW.Addr(), 4, uintptr(count), uintptr(pListOfEEs), uintptr(oldAcl), uintptr(unsafe.Pointer(newAcl)), 0, 0)

+	if r0 != 0 {

+		win32err = syscall.Errno(r0)

 	}

 	return

 }

-func setEntriesInAcl(count uintptr, pListOfEEs uintptr, oldAcl uintptr, newAcl *uintptr) (err error) {

-	r1, _, e1 := syscall.Syscall6(procSetEntriesInAclW.Addr(), 4, uintptr(count), uintptr(pListOfEEs), uintptr(oldAcl), uintptr(unsafe.Pointer(newAcl)), 0, 0)

-	if r1 != 0 {

-		if e1 != 0 {

-			err = errnoErr(e1)

-		} else {

-			err = syscall.EINVAL

-		}

+func setSecurityInfo(handle syscall.Handle, objectType uint32, si uint32, psidOwner uintptr, psidGroup uintptr, pDacl uintptr, pSacl uintptr) (win32err error) {

+	r0, _, _ := syscall.Syscall9(procSetSecurityInfo.Addr(), 7, uintptr(handle), uintptr(objectType), uintptr(si), uintptr(psidOwner), uintptr(psidGroup), uintptr(pDacl), uintptr(pSacl), 0, 0)

+	if r0 != 0 {

+		win32err = syscall.Errno(r0)

 	}

 	return

 }

@@ -28,8 +28,9 @@ const (

 	ERROR_NOT_ALL_ASSIGNED syscall.Errno = 1300

-	SeBackupPrivilege  = "SeBackupPrivilege"

-	SeRestorePrivilege = "SeRestorePrivilege"

+	SeBackupPrivilege   = "SeBackupPrivilege"

+	SeRestorePrivilege  = "SeRestorePrivilege"

+	SeSecurityPrivilege = "SeSecurityPrivilege"

 )

 const (

@@ -1,3 +1,3 @@

 package winio

-//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsyscall_windows.go file.go pipe.go sd.go fileinfo.go privilege.go backup.go hvsock.go

+//go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go file.go pipe.go sd.go fileinfo.go privilege.go backup.go hvsock.go

@@ -2,150 +2,322 @@

 package vhd

-import "syscall"

+import (

+	"fmt"

+	"syscall"

-//go:generate go run mksyscall_windows.go -output zvhd.go vhd.go

+	"github.com/Microsoft/go-winio/pkg/guid"

+	"github.com/pkg/errors"

+	"golang.org/x/sys/windows"

+)

-//sys createVirtualDisk(virtualStorageType *virtualStorageType, path string, virtualDiskAccessMask uint32, securityDescriptor *uintptr, flags uint32, providerSpecificFlags uint32, parameters *createVirtualDiskParameters, o *syscall.Overlapped, handle *syscall.Handle) (err error) [failretval != 0] = VirtDisk.CreateVirtualDisk

-//sys openVirtualDisk(virtualStorageType *virtualStorageType, path string, virtualDiskAccessMask uint32, flags uint32, parameters *openVirtualDiskParameters, handle *syscall.Handle) (err error) [failretval != 0] = VirtDisk.OpenVirtualDisk

-//sys detachVirtualDisk(handle syscall.Handle, flags uint32, providerSpecificFlags uint32) (err error) [failretval != 0] = VirtDisk.DetachVirtualDisk

+//go:generate go run mksyscall_windows.go -output zvhd_windows.go vhd.go

-type virtualStorageType struct {

-	DeviceID uint32

-	VendorID [16]byte

-}

+//sys createVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, securityDescriptor *uintptr, createVirtualDiskFlags uint32, providerSpecificFlags uint32, parameters *CreateVirtualDiskParameters, overlapped *syscall.Overlapped, handle *syscall.Handle) (win32err error) = virtdisk.CreateVirtualDisk

+//sys openVirtualDisk(virtualStorageType *VirtualStorageType, path string, virtualDiskAccessMask uint32, openVirtualDiskFlags uint32, parameters *OpenVirtualDiskParameters, handle *syscall.Handle) (win32err error) = virtdisk.OpenVirtualDisk

+//sys attachVirtualDisk(handle syscall.Handle, securityDescriptor *uintptr, attachVirtualDiskFlag uint32, providerSpecificFlags uint32, parameters *AttachVirtualDiskParameters, overlapped *syscall.Overlapped) (win32err error) = virtdisk.AttachVirtualDisk

+//sys detachVirtualDisk(handle syscall.Handle, detachVirtualDiskFlags uint32, providerSpecificFlags uint32) (win32err error) = virtdisk.DetachVirtualDisk

+//sys getVirtualDiskPhysicalPath(handle syscall.Handle, diskPathSizeInBytes *uint32, buffer *uint16) (win32err error) = virtdisk.GetVirtualDiskPhysicalPath

 type (

-	createVirtualDiskFlag uint32

-	VirtualDiskAccessMask uint32

+	CreateVirtualDiskFlag uint32

 	VirtualDiskFlag       uint32

+	AttachVirtualDiskFlag uint32

+	DetachVirtualDiskFlag uint32

+	VirtualDiskAccessMask uint32

 )

-const (

-	// Flags for creating a VHD (not exported)

-	createVirtualDiskFlagNone                        createVirtualDiskFlag = 0

-	createVirtualDiskFlagFullPhysicalAllocation      createVirtualDiskFlag = 1

-	createVirtualDiskFlagPreventWritesToSourceDisk   createVirtualDiskFlag = 2

-	createVirtualDiskFlagDoNotCopyMetadataFromParent createVirtualDiskFlag = 4

-

-	// Access Mask for opening a VHD

-	VirtualDiskAccessNone     VirtualDiskAccessMask = 0

-	VirtualDiskAccessAttachRO VirtualDiskAccessMask = 65536

-	VirtualDiskAccessAttachRW VirtualDiskAccessMask = 131072

-	VirtualDiskAccessDetach   VirtualDiskAccessMask = 262144

-	VirtualDiskAccessGetInfo  VirtualDiskAccessMask = 524288

-	VirtualDiskAccessCreate   VirtualDiskAccessMask = 1048576

-	VirtualDiskAccessMetaOps  VirtualDiskAccessMask = 2097152

-	VirtualDiskAccessRead     VirtualDiskAccessMask = 851968

-	VirtualDiskAccessAll      VirtualDiskAccessMask = 4128768

-	VirtualDiskAccessWritable VirtualDiskAccessMask = 3276800

-

-	// Flags for opening a VHD

-	OpenVirtualDiskFlagNone                        VirtualDiskFlag = 0

-	OpenVirtualDiskFlagNoParents                   VirtualDiskFlag = 0x1

-	OpenVirtualDiskFlagBlankFile                   VirtualDiskFlag = 0x2

-	OpenVirtualDiskFlagBootDrive                   VirtualDiskFlag = 0x4

-	OpenVirtualDiskFlagCachedIO                    VirtualDiskFlag = 0x8

-	OpenVirtualDiskFlagCustomDiffChain             VirtualDiskFlag = 0x10

-	OpenVirtualDiskFlagParentCachedIO              VirtualDiskFlag = 0x20

-	OpenVirtualDiskFlagVhdSetFileOnly              VirtualDiskFlag = 0x40

-	OpenVirtualDiskFlagIgnoreRelativeParentLocator VirtualDiskFlag = 0x80

-	OpenVirtualDiskFlagNoWriteHardening            VirtualDiskFlag = 0x100

-)

+type VirtualStorageType struct {

+	DeviceID uint32

+	VendorID guid.GUID

+}

-type createVersion2 struct {

-	UniqueID                 [16]byte // GUID

+type CreateVersion2 struct {

+	UniqueID                 guid.GUID

 	MaximumSize              uint64

 	BlockSizeInBytes         uint32

 	SectorSizeInBytes        uint32

+	PhysicalSectorSizeInByte uint32

 	ParentPath               *uint16 // string

 	SourcePath               *uint16 // string

 	OpenFlags                uint32

-	ParentVirtualStorageType virtualStorageType

-	SourceVirtualStorageType virtualStorageType

-	ResiliencyGUID           [16]byte // GUID

+	ParentVirtualStorageType VirtualStorageType

+	SourceVirtualStorageType VirtualStorageType

+	ResiliencyGUID           guid.GUID

 }

-type createVirtualDiskParameters struct {

+type CreateVirtualDiskParameters struct {

 	Version  uint32 // Must always be set to 2

-	Version2 createVersion2

+	Version2 CreateVersion2

 }

-type openVersion2 struct {

-	GetInfoOnly    int32    // bool but 4-byte aligned

-	ReadOnly       int32    // bool but 4-byte aligned

-	ResiliencyGUID [16]byte // GUID

+type OpenVersion2 struct {

+	GetInfoOnly    bool

+	ReadOnly       bool

+	ResiliencyGUID guid.GUID

 }

-type openVirtualDiskParameters struct {

+type OpenVirtualDiskParameters struct {

 	Version  uint32 // Must always be set to 2

-	Version2 openVersion2

+	Version2 OpenVersion2

 }

-// CreateVhdx will create a simple vhdx file at the given path using default values.

-func CreateVhdx(path string, maxSizeInGb, blockSizeInMb uint32) error {

-	var (

-		defaultType virtualStorageType

-		handle      syscall.Handle

-	)

+type AttachVersion2 struct {

+	RestrictedOffset uint64

+	RestrictedLength uint64

+}

+

+type AttachVirtualDiskParameters struct {

+	Version  uint32 // Must always be set to 2

+	Version2 AttachVersion2

+}

-	parameters := createVirtualDiskParameters{

+const (

+	VIRTUAL_STORAGE_TYPE_DEVICE_VHDX = 0x3

+

+	// Access Mask for opening a VHD

+	VirtualDiskAccessNone     VirtualDiskAccessMask = 0x00000000

+	VirtualDiskAccessAttachRO VirtualDiskAccessMask = 0x00010000

+	VirtualDiskAccessAttachRW VirtualDiskAccessMask = 0x00020000

+	VirtualDiskAccessDetach   VirtualDiskAccessMask = 0x00040000

+	VirtualDiskAccessGetInfo  VirtualDiskAccessMask = 0x00080000

+	VirtualDiskAccessCreate   VirtualDiskAccessMask = 0x00100000

+	VirtualDiskAccessMetaOps  VirtualDiskAccessMask = 0x00200000

+	VirtualDiskAccessRead     VirtualDiskAccessMask = 0x000d0000

+	VirtualDiskAccessAll      VirtualDiskAccessMask = 0x003f0000

+	VirtualDiskAccessWritable VirtualDiskAccessMask = 0x00320000

+

+	// Flags for creating a VHD

+	CreateVirtualDiskFlagNone                              CreateVirtualDiskFlag = 0x0

+	CreateVirtualDiskFlagFullPhysicalAllocation            CreateVirtualDiskFlag = 0x1

+	CreateVirtualDiskFlagPreventWritesToSourceDisk         CreateVirtualDiskFlag = 0x2

+	CreateVirtualDiskFlagDoNotCopyMetadataFromParent       CreateVirtualDiskFlag = 0x4

+	CreateVirtualDiskFlagCreateBackingStorage              CreateVirtualDiskFlag = 0x8

+	CreateVirtualDiskFlagUseChangeTrackingSourceLimit      CreateVirtualDiskFlag = 0x10

+	CreateVirtualDiskFlagPreserveParentChangeTrackingState CreateVirtualDiskFlag = 0x20

+	CreateVirtualDiskFlagVhdSetUseOriginalBackingStorage   CreateVirtualDiskFlag = 0x40

+	CreateVirtualDiskFlagSparseFile                        CreateVirtualDiskFlag = 0x80

+	CreateVirtualDiskFlagPmemCompatible                    CreateVirtualDiskFlag = 0x100

+	CreateVirtualDiskFlagSupportCompressedVolumes          CreateVirtualDiskFlag = 0x200

+

+	// Flags for opening a VHD

+	OpenVirtualDiskFlagNone                        VirtualDiskFlag = 0x00000000

+	OpenVirtualDiskFlagNoParents                   VirtualDiskFlag = 0x00000001

+	OpenVirtualDiskFlagBlankFile                   VirtualDiskFlag = 0x00000002

+	OpenVirtualDiskFlagBootDrive                   VirtualDiskFlag = 0x00000004

+	OpenVirtualDiskFlagCachedIO                    VirtualDiskFlag = 0x00000008

+	OpenVirtualDiskFlagCustomDiffChain             VirtualDiskFlag = 0x00000010

+	OpenVirtualDiskFlagParentCachedIO              VirtualDiskFlag = 0x00000020

+	OpenVirtualDiskFlagVhdsetFileOnly              VirtualDiskFlag = 0x00000040

+	OpenVirtualDiskFlagIgnoreRelativeParentLocator VirtualDiskFlag = 0x00000080

+	OpenVirtualDiskFlagNoWriteHardening            VirtualDiskFlag = 0x00000100

+	OpenVirtualDiskFlagSupportCompressedVolumes    VirtualDiskFlag = 0x00000200

+

+	// Flags for attaching a VHD

+	AttachVirtualDiskFlagNone                          AttachVirtualDiskFlag = 0x00000000

+	AttachVirtualDiskFlagReadOnly                      AttachVirtualDiskFlag = 0x00000001

+	AttachVirtualDiskFlagNoDriveLetter                 AttachVirtualDiskFlag = 0x00000002

+	AttachVirtualDiskFlagPermanentLifetime             AttachVirtualDiskFlag = 0x00000004

+	AttachVirtualDiskFlagNoLocalHost                   AttachVirtualDiskFlag = 0x00000008

+	AttachVirtualDiskFlagNoSecurityDescriptor          AttachVirtualDiskFlag = 0x00000010

+	AttachVirtualDiskFlagBypassDefaultEncryptionPolicy AttachVirtualDiskFlag = 0x00000020

+	AttachVirtualDiskFlagNonPnp                        AttachVirtualDiskFlag = 0x00000040

+	AttachVirtualDiskFlagRestrictedRange               AttachVirtualDiskFlag = 0x00000080

+	AttachVirtualDiskFlagSinglePartition               AttachVirtualDiskFlag = 0x00000100

+	AttachVirtualDiskFlagRegisterVolume                AttachVirtualDiskFlag = 0x00000200

+

+	// Flags for detaching a VHD

+	DetachVirtualDiskFlagNone DetachVirtualDiskFlag = 0x0

+)

+

+// CreateVhdx is a helper function to create a simple vhdx file at the given path using

+// default values.

+func CreateVhdx(path string, maxSizeInGb, blockSizeInMb uint32) error {

+	params := CreateVirtualDiskParameters{

 		Version: 2,

-		Version2: createVersion2{

+		Version2: CreateVersion2{

 			MaximumSize:      uint64(maxSizeInGb) * 1024 * 1024 * 1024,

 			BlockSizeInBytes: blockSizeInMb * 1024 * 1024,

 		},

 	}

-	if err := createVirtualDisk(

-		&defaultType,

-		path,

-		uint32(VirtualDiskAccessNone),

-		nil,

-		uint32(createVirtualDiskFlagNone),

-		0,

-		&parameters,

-		nil,

-		&handle); err != nil {

+	handle, err := CreateVirtualDisk(path, VirtualDiskAccessNone, CreateVirtualDiskFlagNone, &params)

+	if err != nil {

 		return err

 	}

 	if err := syscall.CloseHandle(handle); err != nil {

 		return err

 	}

+	return nil

+}

+// DetachVirtualDisk detaches a virtual hard disk by handle.

+func DetachVirtualDisk(handle syscall.Handle) (err error) {

+	if err := detachVirtualDisk(handle, 0, 0); err != nil {

+		return errors.Wrap(err, "failed to detach virtual disk")

+	}

 	return nil

 }

-// DetachVhd detaches a mounted container layer vhd found at `path`.

+// DetachVhd detaches a vhd found at `path`.

 func DetachVhd(path string) error {

 	handle, err := OpenVirtualDisk(

 		path,

 		VirtualDiskAccessNone,

-		OpenVirtualDiskFlagCachedIO|OpenVirtualDiskFlagIgnoreRelativeParentLocator)

+		OpenVirtualDiskFlagCachedIO|OpenVirtualDiskFlagIgnoreRelativeParentLocator,

+	)

+	if err != nil {

+		return err

+	}

+	defer syscall.CloseHandle(handle)

+	return DetachVirtualDisk(handle)

+}

+// AttachVirtualDisk attaches a virtual hard disk for use.

+func AttachVirtualDisk(handle syscall.Handle, attachVirtualDiskFlag AttachVirtualDiskFlag, parameters *AttachVirtualDiskParameters) (err error) {