From a2903d2a18bbbd9e9b63d0ce58f817d0f3a474d8 Mon Sep 17 00:00:00 2001 From: Shreyansh Sancheti Date: Thu, 11 Jun 2026 15:20:36 +0530 Subject: [PATCH 1/3] Revert "Enable checksum validation in HCS Live Migration" This reverts commit c4ac8439fe4b827aa29231bc8212364e3345df93. --- internal/hcs/system.go | 7 ++----- internal/taskserver/migration.go | 25 ------------------------- internal/vm2/vm.go | 2 -- 3 files changed, 2 insertions(+), 32 deletions(-) diff --git a/internal/hcs/system.go b/internal/hcs/system.go index bc16325603..421bf03a76 100644 --- a/internal/hcs/system.go +++ b/internal/hcs/system.go @@ -986,13 +986,10 @@ func (computeSystem *System) HcsInitializeLiveMigrationOnSource(ctx context.Cont options.MemoryTransport = hcsschema.MigrationMemoryTransportTCP } options.CancelIfBlackoutThresholdExceeds = opt.CancelIfBlackoutThresholdExceeds - //options.PerfTracingEnabled = opt.PerfTracingEnabled - //options.ChecksumVerification = opt.ChecksumVerification + options.PerfTracingEnabled = opt.PerfTracingEnabled + options.ChecksumVerification = opt.ChecksumVerification options.PrepareMemoryTransferMode = opt.PrepareMemoryTransferMode } - //knagendra Hardcoding these values to enable checksum verification in canary - options.PerfTracingEnabled = true - options.ChecksumVerification = true optionsRaw, err := json.Marshal(options) if err != nil { diff --git a/internal/taskserver/migration.go b/internal/taskserver/migration.go index 1b733d15c7..2d2c60d6f2 100644 --- a/internal/taskserver/migration.go +++ b/internal/taskserver/migration.go @@ -14,8 +14,6 @@ import ( "time" "unsafe" - "golang.org/x/sys/windows/registry" - runhcsopts "github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options" "github.com/Microsoft/hcsshim/internal/cmd" "github.com/Microsoft/hcsshim/internal/core" @@ -59,9 +57,6 @@ type migrationState struct { var _ lmproto.MigrationService = (*service)(nil) func (s *service) PrepareSandbox(ctx context.Context, req *lmproto.PrepareSandboxRequest) (*lmproto.PrepareSandboxResponse, error) { - if err := enableChecksumValidationRegKeys(); err != nil { - logrus.WithError(err).Warn("failed to set checksum validation registry keys") - } sandboxState, resources, err := s.sandbox.Sandbox.(core.Migratable).LMPrepare(ctx, req.InitializeOptions) if err != nil { return nil, fmt.Errorf("prepare sandbox for migration: %w", err) @@ -547,23 +542,3 @@ func (s *service) CreateDuplicateSocket(ctx context.Context, req *lmproto.Create SessionId: req.SessionId, }, nil } - -func enableChecksumValidationRegKeys() error { - k, _, err := registry.CreateKey( - registry.LOCAL_MACHINE, - `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Migration`, - registry.SET_VALUE, - ) - if err != nil { - return fmt.Errorf("open migration registry key: %w", err) - } - defer k.Close() - - if err := k.SetDWordValue("Test_UseSkippedForProtectionBitmapsInCrcCheck", 0); err != nil { - return fmt.Errorf("set Test_UseSkippedForProtectionBitmapsInCrcCheck: %w", err) - } - if err := k.SetDWordValue("Test_TransferMemoryAfterVdevPowerOff", 1); err != nil { - return fmt.Errorf("set Test_TransferMemoryAfterVdevPowerOff: %w", err) - } - return nil -} diff --git a/internal/vm2/vm.go b/internal/vm2/vm.go index e3b999495a..68fa9d81e6 100644 --- a/internal/vm2/vm.go +++ b/internal/vm2/vm.go @@ -172,8 +172,6 @@ func NewVM(ctx context.Context, id string, config *Config, opts ...Opt) (_ *VM, CompatibilityData: &hcsschema.CompatibilityInfo{ Data: oc.compatData, }, - ChecksumVerification: true, - PerfTracingEnabled: true, } } From d856315bae67c6efe2533bcca45ba4f8ce680ba0 Mon Sep 17 00:00:00 2001 From: Shreyansh Sancheti Date: Thu, 11 Jun 2026 17:20:08 +0530 Subject: [PATCH 2/3] version: fall back to embedded VCS revision for commit id The shim's -v showed an empty Revision because the build populated neither the embedded internal/version/data files nor -ldflags -X overrides. Fall back to the git revision that 'go build' embeds automatically (debug.ReadBuildInfo vcs.*), so the runhcs-v1 shim reports the commit it was built from. --- internal/version/version.go | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/internal/version/version.go b/internal/version/version.go index 3883a51b84..ea3cf13038 100644 --- a/internal/version/version.go +++ b/internal/version/version.go @@ -2,6 +2,7 @@ package version import ( "embed" + "runtime/debug" "strings" ) @@ -39,3 +40,36 @@ func readDataFile(f string) string { b, _ := data.ReadFile("data/" + f) return strings.TrimSpace(string(b)) } + +// When the build did not populate the embedded data files (e.g. a plain +// `go build` that did not run scripts/Set-VersionInfo.ps1 and passed no +// `-ldflags -X` overrides), fall back to the VCS revision that the Go +// toolchain embeds automatically (`go build -buildvcs`, default since Go 1.18). +// This ensures binaries report the git commit they were built from. +func init() { + if Commit != "" { + return + } + bi, ok := debug.ReadBuildInfo() + if !ok { + return + } + var revision string + var modified bool + for _, s := range bi.Settings { + switch s.Key { + case "vcs.revision": + revision = s.Value + case "vcs.modified": + modified = s.Value == "true" + } + } + if revision == "" { + return + } + if modified { + revision += "-dirty" + } + Commit = revision +} + From f37716340201fe5694912e8804db332fb53755e3 Mon Sep 17 00:00:00 2001 From: Shreyansh Sancheti Date: Thu, 11 Jun 2026 10:44:43 -0700 Subject: [PATCH 3/3] hcs: never propagate ChecksumVerification to HCS Comment out options.ChecksumVerification = opt.ChecksumVerification so no caller can activate memory-page checksum validation during live migration, even if the proto request sets it. With the omitempty tag the field is omitted from the HCS payload entirely. Signed-off-by: Shreyansh Sancheti --- internal/hcs/system.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/internal/hcs/system.go b/internal/hcs/system.go index 421bf03a76..9141e07836 100644 --- a/internal/hcs/system.go +++ b/internal/hcs/system.go @@ -987,7 +987,11 @@ func (computeSystem *System) HcsInitializeLiveMigrationOnSource(ctx context.Cont } options.CancelIfBlackoutThresholdExceeds = opt.CancelIfBlackoutThresholdExceeds options.PerfTracingEnabled = opt.PerfTracingEnabled - options.ChecksumVerification = opt.ChecksumVerification + // Checksum verification is intentionally never propagated to HCS: we do not + // want any instance of memory-page checksum validation active during live + // migration. Leaving options.ChecksumVerification at its zero value combined + // with the omitempty JSON tag omits it from the HCS payload entirely. + // options.ChecksumVerification = opt.ChecksumVerification options.PrepareMemoryTransferMode = opt.PrepareMemoryTransferMode }