Merge pull request #12587 from fidencio/topic/runtime-add-configurable-kubelet-root-dir

runtimes: add configurable kubelet root dir

.github/actionlint.yaml

@@ -28,3 +28,9 @@ self-hosted-runner:
     - s390x-large
     - tdx
     - ubuntu-24.04-arm
+
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      # We use if: false to "temporarily" skip jobs with issues
+      - 'constant expression "false" in condition'

.github/workflows/actionlint.yaml

@@ -13,18 +13,13 @@ concurrency:
 jobs:
   run-actionlint:
     name: run-actionlint
-    env:
-      GH_TOKEN: ${{ github.token }}
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout the code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Install actionlint gh extension
-        run: gh extension install https://github.com/cschleiden/gh-actionlint
-
       - name: Run actionlint
-        run:  gh actionlint
+        uses: raven-actions/actionlint@e01d1ea33dd6a5ed517d95b4c0c357560ac6f518  # v2.1.1

Cargo.lock

@@ -3922,6 +3922,7 @@ dependencies = [
  "agent",
  "anyhow",
  "common",
+ "containerd-shim-protos",
  "hyper",
  "hypervisor",
  "kata-sys-util",

src/runtime-rs/crates/runtimes/Cargo.toml

@@ -11,6 +11,7 @@ lazy_static = { workspace = true }
 netns-rs = { workspace = true }
 slog = { workspace = true }
 slog-scope = { workspace = true }
+containerd-shim-protos = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread"] }
 tracing = { workspace = true }
 tracing-opentelemetry = { workspace = true }

src/runtime-rs/crates/runtimes/common/src/message.rs

@@ -6,7 +6,7 @@
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
-use containerd_shim_protos::events::task::{TaskExit, TaskOOM};
+use containerd_shim_protos::events::task::{TaskCreate, TaskDelete, TaskExit, TaskOOM, TaskStart};
 use containerd_shim_protos::protobuf::Message as ProtobufMessage;
 use tokio::sync::mpsc::{channel, Receiver, Sender};
 
@@ -49,9 +49,15 @@ impl Message {
 
 const TASK_OOM_EVENT_TOPIC: &str = "/tasks/oom";
 const TASK_EXIT_EVENT_TOPIC: &str = "/tasks/exit";
+const TASK_START_EVENT_TOPIC: &str = "/tasks/start";
+const TASK_CREATE_EVENT_TOPIC: &str = "/tasks/create";
+const TASK_DELETE_EVENT_TOPIC: &str = "/tasks/delete";
 
 const TASK_OOM_EVENT_URL: &str = "containerd.events.TaskOOM";
 const TASK_EXIT_EVENT_URL: &str = "containerd.events.TaskExit";
+const TASK_START_EVENT_URL: &str = "containerd.events.TaskStart";
+const TASK_CREATE_EVENT_URL: &str = "containerd.events.TaskCreate";
+const TASK_DELETE_EVENT_URL: &str = "containerd.events.TaskDelete";
 
 pub trait Event: std::fmt::Debug + Send {
     fn r#type(&self) -> String;
@@ -86,3 +92,45 @@ impl Event for TaskExit {
         self.write_to_bytes().context("get exit value")
     }
 }
+
+impl Event for TaskStart {
+    fn r#type(&self) -> String {
+        TASK_START_EVENT_TOPIC.to_string()
+    }
+
+    fn type_url(&self) -> String {
+        TASK_START_EVENT_URL.to_string()
+    }
+
+    fn value(&self) -> Result<Vec<u8>> {
+        self.write_to_bytes().context("get start value")
+    }
+}
+
+impl Event for TaskCreate {
+    fn r#type(&self) -> String {
+        TASK_CREATE_EVENT_TOPIC.to_string()
+    }
+
+    fn type_url(&self) -> String {
+        TASK_CREATE_EVENT_URL.to_string()
+    }
+
+    fn value(&self) -> Result<Vec<u8>> {
+        self.write_to_bytes().context("get create value")
+    }
+}
+
+impl Event for TaskDelete {
+    fn r#type(&self) -> String {
+        TASK_DELETE_EVENT_TOPIC.to_string()
+    }
+
+    fn type_url(&self) -> String {
+        TASK_DELETE_EVENT_URL.to_string()
+    }
+
+    fn value(&self) -> Result<Vec<u8>> {
+        self.write_to_bytes().context("get delete value")
+    }
+}

src/runtime-rs/crates/runtimes/src/manager.rs

@@ -6,14 +6,16 @@
 
 use anyhow::{anyhow, Context, Result};
 use common::{
-    message::Message,
+    message::{Action, Message},
     types::{
-        ContainerProcess, PlatformInfo, SandboxConfig, SandboxRequest, SandboxResponse,
-        SandboxStatusInfo, StartSandboxInfo, TaskRequest, TaskResponse, DEFAULT_SHM_SIZE,
+        ContainerProcess, PlatformInfo, ProcessType, SandboxConfig, SandboxRequest,
+        SandboxResponse, SandboxStatusInfo, StartSandboxInfo, TaskRequest, TaskResponse,
+        DEFAULT_SHM_SIZE,
     },
     RuntimeHandler, RuntimeInstance, Sandbox, SandboxNetworkEnv,
 };
 
+use containerd_shim_protos::events::task::{TaskCreate, TaskDelete, TaskStart};
 use hypervisor::{
     utils::{create_dir_all_with_inherit_owner, create_vmm_user, remove_vmm_user},
     Param,
@@ -33,13 +35,13 @@ use netns_rs::{Env, NetNs};
 use nix::{sys::statfs, unistd::User};
 use oci_spec::runtime as oci;
 use persist::sandbox_persist::Persist;
+use protobuf::Message as ProtobufMessage;
 use resource::{
     cpu_mem::initial_size::InitialSizeManager,
     network::{dan_config_path, generate_netns_name},
 };
 use runtime_spec as spec;
 use shim_interface::shim_mgmt::ERR_NO_SHIM_SERVER;
-use protobuf::Message as ProtobufMessage;
 use std::{
     collections::HashMap,
     env,
@@ -480,6 +482,7 @@ impl RuntimeHandlerManager {
                 .await
                 .context("start sandbox in task handler")?;
 
+            let bundle = container_config.bundle.clone();
             let container_id = container_config.container_id.clone();
             let shim_pid = instance
                 .container_manager
@@ -501,6 +504,19 @@ impl RuntimeHandlerManager {
                 }
             });
 
+            let msg_sender = self.inner.read().await.msg_sender.clone();
+            let event = TaskCreate {
+                container_id,
+                bundle,
+                pid,
+                ..Default::default()
+            };
+            let msg = Message::new(Action::Event(Arc::new(event)));
+            msg_sender
+                .send(msg)
+                .await
+                .context("send task create event")?;
+
             Ok(TaskResponse::CreateContainer(shim_pid))
         } else {
             self.handler_task_request(req)
@@ -570,6 +586,7 @@ impl RuntimeHandlerManager {
             .context("get runtime instance")?;
         let sandbox = instance.sandbox.clone();
         let cm = instance.container_manager.clone();
+        let msg_sender = self.inner.read().await.msg_sender.clone();
 
         match req {
             TaskRequest::CreateContainer(req) => Err(anyhow!("Unreachable TaskRequest {:?}", req)),
@@ -579,6 +596,20 @@ impl RuntimeHandlerManager {
             }
             TaskRequest::DeleteProcess(process_id) => {
                 let resp = cm.delete_process(&process_id).await.context("do delete")?;
+                if process_id.process_type == ProcessType::Container {
+                    let event = TaskDelete {
+                        id: process_id.container_id().to_string(),
+                        pid: resp.pid.pid,
+                        exit_status: resp.exit_status as u32,
+                        ..Default::default()
+                    };
+                    let msg = Message::new(Action::Event(Arc::new(event)));
+                    msg_sender
+                        .send(msg)
+                        .await
+                        .context("send task delete event")?;
+                }
+
                 Ok(TaskResponse::DeleteProcess(resp))
             }
             TaskRequest::ExecProcess(req) => {
@@ -614,12 +645,28 @@ impl RuntimeHandlerManager {
                     .context("start process")?;
 
                 let pid = shim_pid.pid;
+                let process_type = process_id.process_type;
+                let container_id = process_id.container_id().to_string();
                 tokio::spawn(async move {
                     let result = sandbox.wait_process(cm, process_id, pid).await;
                     if let Err(e) = result {
                         error!(sl!(), "sandbox wait process error: {:?}", e);
                     }
                 });
+
+                if process_type == ProcessType::Container {
+                    let event = TaskStart {
+                        container_id,
+                        pid,
+                        ..Default::default()
+                    };
+                    let msg = Message::new(Action::Event(Arc::new(event)));
+                    msg_sender
+                        .send(msg)
+                        .await
+                        .context("send task start event")?;
+                }
+
                 Ok(TaskResponse::StartProcess(shim_pid))
             }
 

src/runtime/Makefile

@@ -147,10 +147,14 @@ DEFROOTFSTYPE := $(ROOTFSTYPE_EXT4)
 FIRMWAREPATH :=
 FIRMWAREVOLUMEPATH :=
 
+FIRMWAREPATH_NV = $(FIRMWAREPATH)
+
 FIRMWARETDVFPATH := $(PREFIXDEPS)/share/ovmf/OVMF.inteltdx.fd
+FIRMWARETDVFPATH_NV := $(FIRMWARETDVFPATH)
 FIRMWARETDVFVOLUMEPATH :=
 
 FIRMWARESNPPATH := $(PREFIXDEPS)/share/ovmf/AMDSEV.fd
+FIRMWARESNPPATH_NV := $(FIRMWARESNPPATH)
 
 KERNELVERITYPARAMS ?= ""
 KERNELVERITYPARAMS_NV ?= ""
@@ -301,9 +305,11 @@ DEFDANCONF := /run/kata-containers/dans
 
 DEFFORCEGUESTPULL := false
 
+DEFKUBELETROOTDIR := /var/lib/kubelet
+
 # Device cold plug
 DEFPODRESOURCEAPISOCK := ""
-DEFPODRESOURCEAPISOCK_NV := "/var/lib/kubelet/pod-resources/kubelet.sock"
+DEFPODRESOURCEAPISOCK_NV := "$(DEFKUBELETROOTDIR)/pod-resources/kubelet.sock"
 
 SED = sed
 
@@ -468,8 +474,8 @@ ifneq (,$(QEMUCMD))
     KERNELSEPATH = $(KERNELDIR)/$(KERNELSENAME)
 
     # NVIDIA GPU specific options (all should be suffixed by _NV)
-    # Normal: uncompressed (KERNELTYPE). Confidential: compressed (KERNELCONFIDENTIALTYPE).
-    KERNELNAME_NV = $(call MAKE_KERNEL_NAME_NV,$(KERNELTYPE))
+    KERNELTYPE_NV = compressed
+    KERNELNAME_NV = $(call MAKE_KERNEL_NAME_NV,$(KERNELTYPE_NV))
     KERNELPATH_NV = $(KERNELDIR)/$(KERNELNAME_NV)
     KERNELNAME_CONFIDENTIAL_NV = $(call MAKE_KERNEL_NAME_NV,$(KERNELCONFIDENTIALTYPE))
     KERNELPATH_CONFIDENTIAL_NV = $(KERNELDIR)/$(KERNELNAME_CONFIDENTIAL_NV)
@@ -485,6 +491,9 @@ ifneq (,$(QEMUCMD))
     # using an image and /dev is already mounted.
     KERNELPARAMS_NV = "cgroup_no_v1=all"
     KERNELPARAMS_NV += "devtmpfs.mount=0"
+    KERNELPARAMS_NV += "pci=realloc"
+    KERNELPARAMS_NV += "pci=nocrs"
+    KERNELPARAMS_NV += "pci=assign-busses"
 
     # Setting this to false can lead to cgroup leakages in the host
     # Best practice for production is to set this to true
@@ -681,10 +690,13 @@ USER_VARS += KERNELPATH_FC
 USER_VARS += KERNELPATH_STRATOVIRT
 USER_VARS += KERNELVIRTIOFSPATH
 USER_VARS += FIRMWAREPATH
+USER_VARS += FIRMWAREPATH_NV
 USER_VARS += FIRMWARETDVFPATH
 USER_VARS += FIRMWAREVOLUMEPATH
 USER_VARS += FIRMWARETDVFVOLUMEPATH
 USER_VARS += FIRMWARESNPPATH
+USER_VARS += FIRMWARETDVFPATH_NV
+USER_VARS += FIRMWARESNPPATH_NV
 USER_VARS += MACHINEACCELERATORS
 USER_VARS += CPUFEATURES
 USER_VARS += TDXCPUFEATURES
@@ -785,6 +797,7 @@ USER_VARS += DEFSTATICRESOURCEMGMT_NV
 USER_VARS += DEFBINDMOUNTS
 USER_VARS += DEFCREATECONTAINERTIMEOUT
 USER_VARS += DEFDANCONF
+USER_VARS += DEFKUBELETROOTDIR
 USER_VARS += DEFFORCEGUESTPULL
 USER_VARS += DEFVFIOMODE
 USER_VARS += DEFVFIOMODE_SE

src/runtime/config/configuration-clh.toml.in

@@ -491,6 +491,11 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-fc.toml.in

@@ -382,6 +382,11 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-cca.toml.in

@@ -670,6 +670,12 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
+
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-coco-dev.toml.in

@@ -734,6 +734,11 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-nvidia-gpu-snp.toml.in

@@ -99,7 +99,7 @@ kernel_verity_params = "@KERNELVERITYPARAMS_CONFIDENTIAL_NV@"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWARESNPPATH@"
+firmware = "@FIRMWARESNPPATH_NV@"
 
 # Path to the firmware volume.
 # firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
@@ -750,6 +750,11 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-nvidia-gpu-tdx.toml.in

@@ -76,7 +76,7 @@ kernel_verity_params = "@KERNELVERITYPARAMS_CONFIDENTIAL_NV@"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWARETDVFPATH@"
+firmware = "@FIRMWARETDVFPATH_NV@"
 
 # Path to the firmware volume.
 # firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
@@ -727,6 +727,11 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-nvidia-gpu.toml.in

@@ -58,7 +58,7 @@ kernel_verity_params = "@KERNELVERITYPARAMS_NV@"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWAREPATH@"
+firmware = "@FIRMWAREPATH_NV@"
 
 # Path to the firmware volume.
 # firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
@@ -724,6 +724,11 @@ create_container_timeout = @DEFAULTTIMEOUT_NV@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-se.toml.in

@@ -712,6 +712,11 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-snp.toml.in

@@ -737,6 +737,11 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-tdx.toml.in

@@ -719,6 +719,11 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu.toml.in

@@ -723,6 +723,11 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-remote.toml.in

@@ -290,6 +290,11 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-stratovirt.toml.in

@@ -425,6 +425,11 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
+# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
+# volume paths for propagation. Override for distros that use a different path
+# (e.g. k0s: /var/lib/k0s/kubelet).
+kubelet_root_dir = "@DEFKUBELETROOTDIR@"
+
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-ini/ini v1.67.0
-	github.com/go-openapi/errors v0.22.6
+	github.com/go-openapi/errors v0.22.1
 	github.com/go-openapi/runtime v0.28.0
 	github.com/go-openapi/strfmt v0.23.0
 	github.com/go-openapi/swag v0.23.1
@@ -52,7 +52,6 @@ require (
 	github.com/urfave/cli v1.22.17
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
-	gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965
 	go.opentelemetry.io/otel v1.35.0
 	go.opentelemetry.io/otel/exporters/jaeger v1.0.0
 	go.opentelemetry.io/otel/sdk v1.35.0

src/runtime/go.sum

@@ -107,8 +107,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.6 h1:eDxcf89O8odEnohIXwEjY1IB4ph5vmbUsBMsFNwXWPo=
-github.com/go-openapi/errors v0.22.6/go.mod h1:z9S8ASTUqx7+CP1Q8dD8ewGH/1JWFFLX/2PmAYNQLgk=
+github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
+github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
@@ -123,8 +123,6 @@ github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMg
 github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
-github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
-github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
@@ -311,8 +309,6 @@ github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965 h1:EXE1ZsUqiUWGV5Dw2oTYpXx24ffxj0//yhTB0Ppv+4s=
-gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965/go.mod h1:TBB3sR7/jg4RCThC/cgT4fB8mAbbMO307TycfgeR59w=
 go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80=
 go.mongodb.org/mongo-driver v1.14.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=

src/runtime/pkg/katautils/config.go

@@ -201,6 +201,7 @@ type runtime struct {
 	DanConf                   string   `toml:"dan_conf"`
 	ForceGuestPull            bool     `toml:"experimental_force_guest_pull"`
 	PodResourceAPISock        string   `toml:"pod_resource_api_sock"`
+	KubeletRootDir            string   `toml:"kubelet_root_dir"`
 }
 
 type agent struct {
@@ -1642,6 +1643,7 @@ func LoadConfiguration(configPath string, ignoreLogging bool) (resolvedConfigPat
 
 	config.ForceGuestPull = tomlConf.Runtime.ForceGuestPull
 	config.PodResourceAPISock = tomlConf.Runtime.PodResourceAPISock
+	config.KubeletRootDir = tomlConf.Runtime.KubeletRootDir
 
 	return resolved, config, nil
 }

src/runtime/pkg/oci/utils.go

@@ -193,6 +193,10 @@ type RuntimeConfig struct {
 	//	ColdPlugVFIO != NoPort AND PodResourceAPISock != "" => kubelet
 	//		based cold plug.
 	PodResourceAPISock string
+
+	// KubeletRootDir is the kubelet root directory used to match ConfigMap/Secret
+	// volume paths (e.g. /var/lib/k0s/kubelet for k0s). If empty, default is used.
+	KubeletRootDir string
 }
 
 // AddKernelParam allows the addition of new kernel parameters to an existing
@@ -1216,6 +1220,8 @@ func SandboxConfig(ocispec specs.Spec, runtime RuntimeConfig, bundlePath, cid st
 		CreateContainerTimeout: runtime.CreateContainerTimeout,
 
 		ForceGuestPull: runtime.ForceGuestPull,
+
+		KubeletRootDir: runtime.KubeletRootDir,
 	}
 
 	if err := addAnnotations(ocispec, &sandboxConfig, runtime); err != nil {

src/runtime/vendor/github.com/go-openapi/errors/.cliff.toml

@@ -1,181 +0,0 @@
-# git-cliff ~ configuration file
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-header = """
-"""
-
-footer = """
-
------
-
-**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
-
-[![License][license-badge]][license-url]
-
-[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
-[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-
-body = """
-{%- if version %}
-## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
-{%- else %}
-## [unreleased]
-{%- endif %}
-{%- if message %}
-  {%- raw %}\n{% endraw %}
-{{ message }}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-{%- if version %}
-  {%- if previous.version %}
-
-**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
-  {%- endif %}
-{%- else %}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-
-{%- if statistics %}{% if statistics.commit_count %}
-  {%- raw %}\n{% endraw %}
-{{ statistics.commit_count }} commits in this release.
-  {%- raw %}\n{% endraw %}
-{%- endif %}{% endif %}
------
-
-{%- for group, commits in commits | group_by(attribute="group") %}
-  {%- raw %}\n{% endraw %}
-### {{ group | upper_first }}
-    {%- raw %}\n{% endraw %}
-    {%- for commit in commits %}
-      {%- if commit.remote.pr_title %}
-        {%- set commit_message = commit.remote.pr_title %}
-      {%- else %}
-        {%- set commit_message = commit.message %}
-      {%- endif %}
-* {{ commit_message | split(pat="\n") | first | trim }}
-      {%- if commit.remote.username %}
-{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
-      {%- endif %}
-      {%- if commit.remote.pr_number %}
-{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
-      {%- endif %}
-{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
-  {%- endfor %}
-{%- endfor %}
-
-{%- if github %}
-{%- raw %}\n{% endraw -%}
-  {%- set all_contributors = github.contributors | length %}
-  {%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
------
-
-### People who contributed to this release
-  {% endif %}
-  {%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
-    {%- endif %}
-  {%- endfor %}
-
-  {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
------
-    {%- raw %}\n{% endraw %}
-
-### New Contributors
-  {%- endif %}
-
-  {%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* @{{ contributor.username }} made their first contribution
-      {%- if contributor.pr_number %}
-  in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-      {%- endif %}
-    {%- endif %}
-  {%- endfor %}
-{%- endif %}
-
-{%- raw %}\n{% endraw %}
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-# Remove leading and trailing whitespaces from the changelog's body.
-trim = true
-# Render body even when there are no releases to process.
-render_always = true
-# An array of regex based postprocessors to modify the changelog.
-postprocessors = [
-    # Replace the placeholder <REPO> with a URL.
-    #{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
-]
-# output file path
-# output = "test.md"
-
-[git]
-# Parse commits according to the conventional commits specification.
-# See https://www.conventionalcommits.org
-conventional_commits = false
-# Exclude commits that do not match the conventional commits specification.
-filter_unconventional = false
-# Require all commits to be conventional.
-# Takes precedence over filter_unconventional.
-require_conventional = false
-# Split commits on newlines, treating each line as an individual commit.
-split_commits = false
-# An array of regex based parsers to modify commit messages prior to further processing.
-commit_preprocessors = [
-    # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
-    #{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
-    # Check spelling of the commit message using https://github.com/crate-ci/typos.
-    # If the spelling is incorrect, it will be fixed automatically.
-    #{ pattern = '.*', replace_command = 'typos --write-changes -' }
-]
-# Prevent commits that are breaking from being excluded by commit parsers.
-protect_breaking_commits = false
-# An array of regex based parsers for extracting data from the commit message.
-# Assigns commits to groups.
-# Optionally sets the commit's scope and can decide to exclude commits from further processing.
-commit_parsers = [
-    { message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
-    { message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
-    { field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
-    { message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
-    { message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
-    { message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
-    { message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^test", group = "<!-- 06 -->Testing" },
-    { message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
-    { message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
-    { message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
-    { message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
-    { message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
-    { message = ".*", group = "<!-- 0B -->Other" },
-]
-# Exclude commits that are not matched by any commit parser.
-filter_commits = false
-# An array of link parsers for extracting external references, and turning them into URLs, using regex.
-link_parsers = []
-# Include only the tags that belong to the current branch.
-use_branch_tags = false
-# Order releases topologically instead of chronologically.
-topo_order = false
-# Order releases topologically instead of chronologically.
-topo_order_commits = true
-# Order of commits in each group/release within the changelog.
-# Allowed values: newest, oldest
-sort_commits = "newest"
-# Process submodules commits
-recurse_submodules = false
-
-#[remote.github]
-#owner = "go-openapi"

src/runtime/vendor/github.com/go-openapi/errors/.editorconfig

@@ -1,26 +0,0 @@
-# top-most EditorConfig file
-root = true
-
-# Unix-style newlines with a newline ending every file
-[*]
-end_of_line = lf
-insert_final_newline = true
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-
-# Set default charset
-[*.{js,py,go,scala,rb,java,html,css,less,sass,md}]
-charset = utf-8
-
-# Tab indentation (no size specified)
-[*.go]
-indent_style = tab
-
-[*.md]
-trim_trailing_whitespace = false
-
-# Matches the exact files either package.json or .travis.yml
-[{package.json,.travis.yml}]
-indent_style = space
-indent_size = 2

src/runtime/vendor/github.com/go-openapi/errors/.gitignore

@@ -1,3 +1,2 @@
 secrets.yml
-*.out
-settings.local.json
+coverage.out

src/runtime/vendor/github.com/go-openapi/errors/.golangci.yml

@@ -1,66 +1,55 @@
-version: "2"
+linters-settings:
+  gocyclo:
+    min-complexity: 45
+  dupl:
+    threshold: 200
+  goconst:
+    min-len: 2
+    min-occurrences: 3
+
 linters:
-  default: all
+  enable-all: true
   disable:
-    - depguard
+    - unparam
+    - lll
+    - gochecknoinits
+    - gochecknoglobals
     - funlen
     - godox
-    - exhaustruct
-    - nlreturn
-    - nonamedreturns
-    - noinlineerr
-    - paralleltest
-    - recvcheck
-    - testpackage
-    - tparallel
-    - varnamelen
+    - gocognit
     - whitespace
-    - wrapcheck
     - wsl
-    - wsl_v5
-  settings:
-    dupl:
-      threshold: 200
-    goconst:
-      min-len: 2
-      min-occurrences: 3
-    cyclop:
-      max-complexity: 20
-    gocyclo:
-      min-complexity: 20
-    exhaustive:
-      default-signifies-exhaustive: true
-      default-case-required: true
-    lll:
-      line-length: 180
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-formatters:
-  enable:
-    - gofmt
-    - goimports
+    - wrapcheck
+    - testpackage
+    - nlreturn
+    - errorlint
+    - nestif
+    - godot
     - gofumpt
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-issues:
-  # Maximum issues count per one linter.
-  # Set to 0 to disable.
-  # Default: 50
-  max-issues-per-linter: 0
-  # Maximum count of issues with the same text.
-  # Set to 0 to disable.
-  # Default: 3
-  max-same-issues: 0
+    - paralleltest
+    - tparallel
+    - thelper
+    - exhaustruct
+    - varnamelen
+    - gci
+    - depguard
+    - errchkjson
+    - inamedparam
+    - nonamedreturns
+    - musttag
+    - ireturn
+    - forcetypeassert
+    - cyclop
+    # deprecated linters
+    #- deadcode
+    #- interfacer
+    #- scopelint
+    #- varcheck
+    #- structcheck
+    #- golint
+    #- nosnakecase
+    #- maligned
+    #- goerr113
+    #- ifshort
+    #- gomnd
+    #- exhaustivestruct

src/runtime/vendor/github.com/go-openapi/errors/CONTRIBUTORS.md

@@ -1,24 +0,0 @@
-# Contributors
-
-- Repository: ['go-openapi/errors']
-
-| Total Contributors | Total Contributions |
-| --- | --- |
-| 12  | 105  |
-
-| Username | All Time Contribution Count | All Commits |
-| --- | --- | --- |
-| @casualjim | 58 | https://github.com/go-openapi/errors/commits?author=casualjim |
-| @fredbi | 32 | https://github.com/go-openapi/errors/commits?author=fredbi |
-| @youyuanwu | 5 | https://github.com/go-openapi/errors/commits?author=youyuanwu |
-| @alexandear | 2 | https://github.com/go-openapi/errors/commits?author=alexandear |
-| @fiorix | 1 | https://github.com/go-openapi/errors/commits?author=fiorix |
-| @ligustah | 1 | https://github.com/go-openapi/errors/commits?author=ligustah |
-| @artemseleznev | 1 | https://github.com/go-openapi/errors/commits?author=artemseleznev |
-| @gautierdelorme | 1 | https://github.com/go-openapi/errors/commits?author=gautierdelorme |
-| @guillemj | 1 | https://github.com/go-openapi/errors/commits?author=guillemj |
-| @maxatome | 1 | https://github.com/go-openapi/errors/commits?author=maxatome |
-| @Simon-Li | 1 | https://github.com/go-openapi/errors/commits?author=Simon-Li |
-| @ujjwalsh | 1 | https://github.com/go-openapi/errors/commits?author=ujjwalsh |
-
- _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_

src/runtime/vendor/github.com/go-openapi/errors/README.md

@@ -1,123 +1,8 @@
-# errors
+# OpenAPI errors [![Build Status](https://github.com/go-openapi/errors/actions/workflows/go-test.yml/badge.svg)](https://github.com/go-openapi/errors/actions?query=workflow%3A"go+test") [![codecov](https://codecov.io/gh/go-openapi/errors/branch/master/graph/badge.svg)](https://codecov.io/gh/go-openapi/errors)
 
-<!-- Badges: status  -->
-[![Tests][test-badge]][test-url] [![Coverage][cov-badge]][cov-url] [![CI vuln scan][vuln-scan-badge]][vuln-scan-url] [![CodeQL][codeql-badge]][codeql-url]
-<!-- Badges: release & docker images  -->
-<!-- Badges: code quality  -->
-<!-- Badges: license & compliance -->
-[![Release][release-badge]][release-url] [![Go Report Card][gocard-badge]][gocard-url] [![CodeFactor Grade][codefactor-badge]][codefactor-url] [![License][license-badge]][license-url]
-<!-- Badges: documentation & support -->
-<!-- Badges: others & stats -->
-[![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
-
----
+[![Slack Status](https://slackin.goswagger.io/badge.svg)](https://slackin.goswagger.io)
+[![license](http://img.shields.io/badge/license-Apache%20v2-orange.svg)](https://raw.githubusercontent.com/go-openapi/errors/master/LICENSE)
+[![Go Reference](https://pkg.go.dev/badge/github.com/go-openapi/errors.svg)](https://pkg.go.dev/github.com/go-openapi/errors)
+[![Go Report Card](https://goreportcard.com/badge/github.com/go-openapi/errors)](https://goreportcard.com/report/github.com/go-openapi/errors)
 
 Shared errors and error interface used throughout the various libraries found in the go-openapi toolkit.
-
-## Announcements
-
-* **2025-12-19** : new community chat on discord
-  * a new discord community channel is available to be notified of changes and support users
-  * our venerable Slack channel remains open, and will be eventually discontinued on **2026-03-31**
-
-You may join the discord community by clicking the invite link on the discord badge (also above). [![Discord Channel][discord-badge]][discord-url]
-
-Or join our Slack channel: [![Slack Channel][slack-logo]![slack-badge]][slack-url]
-
-## Status
-
-API is stable.
-
-## Import this library in your project
-
-```cmd
-go get github.com/go-openapi/errors
-```
-
-## Basic usage
-
-```go
-const url = "https://www.example.com/#"
-
-errGeneric := New(401,"onvalid argument: %s", url)
-
-errNotFound := NotFound("resource not found: %s", url)
-
-errNotImplemented := NotImplemented("method: %s", url)
-```
-
-## Change log
-
-See <https://github.com/go-openapi/errors/releases>
-
-<!--
-## References
--->
-
-## Licensing
-
-This library ships under the [SPDX-License-Identifier: Apache-2.0](./LICENSE).
-
-<!--
-See the license [NOTICE](./NOTICE), which recalls the licensing terms of all the pieces of software
-on top of which it has been built.
--->
-
-<!--
-## Limitations
--->
-
-## Other documentation
-
-* [All-time contributors](./CONTRIBUTORS.md)
-* [Contributing guidelines](.github/CONTRIBUTING.md)
-* [Maintainers documentation](docs/MAINTAINERS.md)
-* [Code style](docs/STYLE.md)
-
-## Cutting a new release
-
-Maintainers can cut a new release by either:
-
-* running [this workflow](https://github.com/go-openapi/errors/actions/workflows/bump-release.yml)
-* or pushing a semver tag
-  * signed tags are preferred
-  * The tag message is prepended to release notes
-
-<!-- Badges: status  -->
-[test-badge]: https://github.com/go-openapi/errors/actions/workflows/go-test.yml/badge.svg
-[test-url]: https://github.com/go-openapi/errors/actions/workflows/go-test.yml
-[cov-badge]: https://codecov.io/gh/go-openapi/errors/branch/master/graph/badge.svg
-[cov-url]: https://codecov.io/gh/go-openapi/errors
-[vuln-scan-badge]: https://github.com/go-openapi/errors/actions/workflows/scanner.yml/badge.svg
-[vuln-scan-url]: https://github.com/go-openapi/errors/actions/workflows/scanner.yml
-[codeql-badge]: https://github.com/go-openapi/errors/actions/workflows/codeql.yml/badge.svg
-[codeql-url]: https://github.com/go-openapi/errors/actions/workflows/codeql.yml
-<!-- Badges: release & docker images  -->
-[release-badge]: https://badge.fury.io/gh/go-openapi%2Ferrors.svg
-[release-url]: https://badge.fury.io/gh/go-openapi%2Ferrors
-[gomod-badge]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Ferrors.svg
-[gomod-url]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Ferrors
-<!-- Badges: code quality  -->
-[gocard-badge]: https://goreportcard.com/badge/github.com/go-openapi/errors
-[gocard-url]: https://goreportcard.com/report/github.com/go-openapi/errors
-[codefactor-badge]: https://img.shields.io/codefactor/grade/github/go-openapi/errors
-[codefactor-url]: https://www.codefactor.io/repository/github/go-openapi/errors
-<!-- Badges: documentation & support -->
-[doc-badge]: https://img.shields.io/badge/doc-site-blue?link=https%3A%2F%2Fgoswagger.io%2Fgo-openapi%2F
-[doc-url]: https://goswagger.io/go-openapi
-[godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/errors
-[godoc-url]: http://pkg.go.dev/github.com/go-openapi/errors
-[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
-[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
-[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
-[discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
-[discord-url]: https://discord.gg/DrafRmZx
-
-<!-- Badges: license & compliance -->
-[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
-[license-url]: https://github.com/go-openapi/errors/?tab=Apache-2.0-1-ov-file#readme
-<!-- Badges: others & stats -->
-[goversion-badge]: https://img.shields.io/github/go-mod/go-version/go-openapi/errors
-[goversion-url]: https://github.com/go-openapi/errors/blob/master/go.mod
-[top-badge]: https://img.shields.io/github/languages/top/go-openapi/errors
-[commits-badge]: https://img.shields.io/github/commits-since/go-openapi/errors/latest

src/runtime/vendor/github.com/go-openapi/errors/SECURITY.md

@@ -1,19 +0,0 @@
-# Security Policy
-
-This policy outlines the commitment and practices of the go-openapi maintainers regarding security.
-
-## Supported Versions
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.22.x  | :white_check_mark: |
-
-## Reporting a vulnerability
-
-If you become aware of a security vulnerability that affects the current repository,
-please report it privately to the maintainers.
-
-Please follow the instructions provided by github to
-[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
-
-TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".

src/runtime/vendor/github.com/go-openapi/errors/api.go

@@ -1,11 +1,21 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 package errors
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -13,11 +23,9 @@ import (
 )
 
 // DefaultHTTPCode is used when the error Code cannot be used as an HTTP code.
-//
-//nolint:gochecknoglobals // it should have been a constant in the first place, but now it is mutable so we have to leave it here or introduce a breaking change.
 var DefaultHTTPCode = http.StatusUnprocessableEntity
 
-// Error represents a error interface all swagger framework errors implement.
+// Error represents a error interface all swagger framework errors implement
 type Error interface {
 	error
 	Code() int32
@@ -28,26 +36,24 @@ type apiError struct {
 	message string
 }
 
-// Error implements the standard error interface.
 func (a *apiError) Error() string {
 	return a.message
 }
 
-// Code returns the HTTP status code associated with this error.
 func (a *apiError) Code() int32 {
 	return a.code
 }
 
-// MarshalJSON implements the JSON encoding interface.
+// MarshalJSON implements the JSON encoding interface
 func (a apiError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
+	return json.Marshal(map[string]interface{}{
 		"code":    a.code,
 		"message": a.message,
 	})
 }
 
-// New creates a new API error with a code and a message.
-func New(code int32, message string, args ...any) Error {
+// New creates a new API error with a code and a message
+func New(code int32, message string, args ...interface{}) Error {
 	if len(args) > 0 {
 		return &apiError{
 			code:    code,
@@ -60,39 +66,38 @@ func New(code int32, message string, args ...any) Error {
 	}
 }
 
-// NotFound creates a new not found error.
-func NotFound(message string, args ...any) Error {
+// NotFound creates a new not found error
+func NotFound(message string, args ...interface{}) Error {
 	if message == "" {
 		message = "Not found"
 	}
-	return New(http.StatusNotFound, message, args...)
+	return New(http.StatusNotFound, fmt.Sprintf(message, args...))
 }
 
-// NotImplemented creates a new not implemented error.
+// NotImplemented creates a new not implemented error
 func NotImplemented(message string) Error {
-	return New(http.StatusNotImplemented, "%s", message)
+	return New(http.StatusNotImplemented, message)
 }
 
-// MethodNotAllowedError represents an error for when the path matches but the method doesn't.
+// MethodNotAllowedError represents an error for when the path matches but the method doesn't
 type MethodNotAllowedError struct {
 	code    int32
 	Allowed []string
 	message string
 }
 
-// Error implements the standard error interface.
 func (m *MethodNotAllowedError) Error() string {
 	return m.message
 }
 
-// Code returns 405 (Method Not Allowed) as the HTTP status code.
+// Code the error code
 func (m *MethodNotAllowedError) Code() int32 {
 	return m.code
 }
 
-// MarshalJSON implements the JSON encoding interface.
+// MarshalJSON implements the JSON encoding interface
 func (m MethodNotAllowedError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
+	return json.Marshal(map[string]interface{}{
 		"code":    m.code,
 		"message": m.message,
 		"allowed": m.Allowed,
@@ -110,33 +115,25 @@ func errorAsJSON(err Error) []byte {
 
 func flattenComposite(errs *CompositeError) *CompositeError {
 	var res []error
-
-	for _, err := range errs.Errors {
-		if err == nil {
-			continue
+	for _, er := range errs.Errors {
+		switch e := er.(type) {
+		case *CompositeError:
+			if e != nil && len(e.Errors) > 0 {
+				flat := flattenComposite(e)
+				if len(flat.Errors) > 0 {
+					res = append(res, flat.Errors...)
+				}
+			}
+		default:
+			if e != nil {
+				res = append(res, e)
+			}
 		}
-
-		e := &CompositeError{}
-		if !errors.As(err, &e) {
-			res = append(res, err)
-
-			continue
-		}
-
-		if len(e.Errors) == 0 {
-			res = append(res, e)
-
-			continue
-		}
-
-		flat := flattenComposite(e)
-		res = append(res, flat.Errors...)
 	}
-
 	return CompositeValidationError(res...)
 }
 
-// MethodNotAllowed creates a new method not allowed error.
+// MethodNotAllowed creates a new method not allowed error
 func MethodNotAllowed(requested string, allow []string) Error {
 	msg := fmt.Sprintf("method %s is not allowed, but [%s] are", requested, strings.Join(allow, ","))
 	return &MethodNotAllowedError{
@@ -146,59 +143,43 @@ func MethodNotAllowed(requested string, allow []string) Error {
 	}
 }
 
-// ServeError implements the http error handler interface.
+// ServeError implements the http error handler interface
 func ServeError(rw http.ResponseWriter, r *http.Request, err error) {
 	rw.Header().Set("Content-Type", "application/json")
-
-	if err == nil {
-		rw.WriteHeader(http.StatusInternalServerError)
-		_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "Unknown error")))
-
-		return
-	}
-
-	errComposite := &CompositeError{}
-	errMethodNotAllowed := &MethodNotAllowedError{}
-	var errError Error
-
-	switch {
-	case errors.As(err, &errComposite):
-		er := flattenComposite(errComposite)
+	switch e := err.(type) {
+	case *CompositeError:
+		er := flattenComposite(e)
 		// strips composite errors to first element only
 		if len(er.Errors) > 0 {
 			ServeError(rw, r, er.Errors[0])
-
-			return
+		} else {
+			// guard against empty CompositeError (invalid construct)
+			ServeError(rw, r, nil)
 		}
-
-		// guard against empty CompositeError (invalid construct)
-		ServeError(rw, r, nil)
-
-	case errors.As(err, &errMethodNotAllowed):
-		rw.Header().Add("Allow", strings.Join(errMethodNotAllowed.Allowed, ","))
-		rw.WriteHeader(asHTTPCode(int(errMethodNotAllowed.Code())))
+	case *MethodNotAllowedError:
+		rw.Header().Add("Allow", strings.Join(e.Allowed, ","))
+		rw.WriteHeader(asHTTPCode(int(e.Code())))
 		if r == nil || r.Method != http.MethodHead {
-			_, _ = rw.Write(errorAsJSON(errMethodNotAllowed))
+			_, _ = rw.Write(errorAsJSON(e))
 		}
-
-	case errors.As(err, &errError):
-		value := reflect.ValueOf(errError)
+	case Error:
+		value := reflect.ValueOf(e)
 		if value.Kind() == reflect.Ptr && value.IsNil() {
 			rw.WriteHeader(http.StatusInternalServerError)
 			_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "Unknown error")))
-
 			return
 		}
-
-		rw.WriteHeader(asHTTPCode(int(errError.Code())))
+		rw.WriteHeader(asHTTPCode(int(e.Code())))
 		if r == nil || r.Method != http.MethodHead {
-			_, _ = rw.Write(errorAsJSON(errError))
+			_, _ = rw.Write(errorAsJSON(e))
 		}
-
+	case nil:
+		rw.WriteHeader(http.StatusInternalServerError)
+		_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "Unknown error")))
 	default:
 		rw.WriteHeader(http.StatusInternalServerError)
 		if r == nil || r.Method != http.MethodHead {
-			_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "%v", err)))
+			_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, err.Error())))
 		}
 	}
 }

src/runtime/vendor/github.com/go-openapi/errors/auth.go

@@ -1,11 +1,22 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 package errors
 
 import "net/http"
 
-// Unauthenticated returns an unauthenticated error.
+// Unauthenticated returns an unauthenticated error
 func Unauthenticated(scheme string) Error {
 	return New(http.StatusUnauthorized, "unauthenticated for %s", scheme)
 }

src/runtime/vendor/github.com/go-openapi/errors/doc.go

@@ -1,5 +1,16 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 /*
 Package errors provides an Error interface and several concrete types

src/runtime/vendor/github.com/go-openapi/errors/headers.go

@@ -1,5 +1,16 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 package errors
 
@@ -9,30 +20,28 @@ import (
 	"net/http"
 )
 
-// Validation represents a failure of a precondition.
-type Validation struct { //nolint: errname // changing the name to abide by the naming rule would bring a breaking change.
+// Validation represents a failure of a precondition
+type Validation struct { //nolint: errname
 	code    int32
 	Name    string
 	In      string
-	Value   any
+	Value   interface{}
 	message string
-	Values  []any
+	Values  []interface{}
 }
 
-// Error implements the standard error interface.
 func (e *Validation) Error() string {
 	return e.message
 }
 
-// Code returns the HTTP status code for this validation error.
-// Returns 422 (Unprocessable Entity) by default.
+// Code the error code
 func (e *Validation) Code() int32 {
 	return e.code
 }
 
-// MarshalJSON implements the JSON encoding interface.
+// MarshalJSON implements the JSON encoding interface
 func (e Validation) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
+	return json.Marshal(map[string]interface{}{
 		"code":    e.code,
 		"message": e.message,
 		"in":      e.In,
@@ -42,7 +51,7 @@ func (e Validation) MarshalJSON() ([]byte, error) {
 	})
 }
 
-// ValidateName sets the name for a validation or updates it for a nested property.
+// ValidateName sets the name for a validation or updates it for a nested property
 func (e *Validation) ValidateName(name string) *Validation {
 	if name != "" {
 		if e.Name == "" {
@@ -61,9 +70,9 @@ const (
 	responseFormatFail = `unsupported media type requested, only %v are available`
 )
 
-// InvalidContentType error for an invalid content type.
+// InvalidContentType error for an invalid content type
 func InvalidContentType(value string, allowed []string) *Validation {
-	values := make([]any, 0, len(allowed))
+	values := make([]interface{}, 0, len(allowed))
 	for _, v := range allowed {
 		values = append(values, v)
 	}
@@ -77,9 +86,9 @@ func InvalidContentType(value string, allowed []string) *Validation {
 	}
 }
 
-// InvalidResponseFormat error for an unacceptable response format request.
+// InvalidResponseFormat error for an unacceptable response format request
 func InvalidResponseFormat(value string, allowed []string) *Validation {
-	values := make([]any, 0, len(allowed))
+	values := make([]interface{}, 0, len(allowed))
 	for _, v := range allowed {
 		values = append(values, v)
 	}

src/runtime/vendor/github.com/go-openapi/errors/middleware.go

@@ -1,5 +1,16 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 package errors
 
@@ -10,14 +21,13 @@ import (
 )
 
 // APIVerificationFailed is an error that contains all the missing info for a mismatched section
-// between the api registrations and the api spec.
+// between the api registrations and the api spec
 type APIVerificationFailed struct { //nolint: errname
 	Section              string   `json:"section,omitempty"`
 	MissingSpecification []string `json:"missingSpecification,omitempty"`
 	MissingRegistration  []string `json:"missingRegistration,omitempty"`
 }
 
-// Error implements the standard error interface.
 func (v *APIVerificationFailed) Error() string {
 	buf := bytes.NewBuffer(nil)
 
@@ -25,7 +35,7 @@ func (v *APIVerificationFailed) Error() string {
 	hasSpecMissing := len(v.MissingSpecification) > 0
 
 	if hasRegMissing {
-		fmt.Fprintf(buf, "missing [%s] %s registrations", strings.Join(v.MissingRegistration, ", "), v.Section)
+		buf.WriteString(fmt.Sprintf("missing [%s] %s registrations", strings.Join(v.MissingRegistration, ", "), v.Section))
 	}
 
 	if hasRegMissing && hasSpecMissing {
@@ -33,7 +43,7 @@ func (v *APIVerificationFailed) Error() string {
 	}
 
 	if hasSpecMissing {
-		fmt.Fprintf(buf, "missing from spec file [%s] %s", strings.Join(v.MissingSpecification, ", "), v.Section)
+		buf.WriteString(fmt.Sprintf("missing from spec file [%s] %s", strings.Join(v.MissingSpecification, ", "), v.Section))
 	}
 
 	return buf.String()

src/runtime/vendor/github.com/go-openapi/errors/parsing.go

@@ -1,5 +1,16 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 package errors
 
@@ -9,7 +20,7 @@ import (
 	"net/http"
 )
 
-// ParseError represents a parsing error.
+// ParseError represents a parsing error
 type ParseError struct {
 	code    int32
 	Name    string
@@ -19,7 +30,37 @@ type ParseError struct {
 	message string
 }
 
-// NewParseError creates a new parse error.
+func (e *ParseError) Error() string {
+	return e.message
+}
+
+// Code returns the http status code for this error
+func (e *ParseError) Code() int32 {
+	return e.code
+}
+
+// MarshalJSON implements the JSON encoding interface
+func (e ParseError) MarshalJSON() ([]byte, error) {
+	var reason string
+	if e.Reason != nil {
+		reason = e.Reason.Error()
+	}
+	return json.Marshal(map[string]interface{}{
+		"code":    e.code,
+		"message": e.message,
+		"in":      e.In,
+		"name":    e.Name,
+		"value":   e.Value,
+		"reason":  reason,
+	})
+}
+
+const (
+	parseErrorTemplContent     = `parsing %s %s from %q failed, because %s`
+	parseErrorTemplContentNoIn = `parsing %s from %q failed, because %s`
+)
+
+// NewParseError creates a new parse error
 func NewParseError(name, in, value string, reason error) *ParseError {
 	var msg string
 	if in == "" {
@@ -36,34 +77,3 @@ func NewParseError(name, in, value string, reason error) *ParseError {
 		message: msg,
 	}
 }
-
-// Error implements the standard error interface.
-func (e *ParseError) Error() string {
-	return e.message
-}
-
-// Code returns 400 (Bad Request) as the HTTP status code for parsing errors.
-func (e *ParseError) Code() int32 {
-	return e.code
-}
-
-// MarshalJSON implements the JSON encoding interface.
-func (e ParseError) MarshalJSON() ([]byte, error) {
-	var reason string
-	if e.Reason != nil {
-		reason = e.Reason.Error()
-	}
-	return json.Marshal(map[string]any{
-		"code":    e.code,
-		"message": e.message,
-		"in":      e.In,
-		"name":    e.Name,
-		"value":   e.Value,
-		"reason":  reason,
-	})
-}
-
-const (
-	parseErrorTemplContent     = `parsing %s %s from %q failed, because %s`
-	parseErrorTemplContentNoIn = `parsing %s from %q failed, because %s`
-)

src/runtime/vendor/github.com/go-openapi/errors/schema.go

@@ -1,11 +1,21 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
+// Copyright 2015 go-swagger maintainers
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 package errors
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -63,15 +73,14 @@ const (
 const maximumValidHTTPCode = 600
 
 // All code responses can be used to differentiate errors for different handling
-// by the consuming program.
+// by the consuming program
 const (
 	// CompositeErrorCode remains 422 for backwards-compatibility
-	// and to separate it from validation errors with cause.
+	// and to separate it from validation errors with cause
 	CompositeErrorCode = http.StatusUnprocessableEntity
 
-	// InvalidTypeCode is used for any subclass of invalid types.
+	// InvalidTypeCode is used for any subclass of invalid types
 	InvalidTypeCode = maximumValidHTTPCode + iota
-	// RequiredFailCode indicates a required field is missing.
 	RequiredFailCode
 	TooLongFailCode
 	TooShortFailCode
@@ -92,26 +101,22 @@ const (
 	ReadOnlyFailCode
 )
 
-// CompositeError is an error that groups several errors together.
+// CompositeError is an error that groups several errors together
 type CompositeError struct {
 	Errors  []error
 	code    int32
 	message string
 }
 
-// Code returns the HTTP status code for this composite error.
+// Code for this error
 func (c *CompositeError) Code() int32 {
 	return c.code
 }
 
-// Error implements the standard error interface.
 func (c *CompositeError) Error() string {
 	if len(c.Errors) > 0 {
 		msgs := []string{c.message + ":"}
 		for _, e := range c.Errors {
-			if e == nil {
-				continue
-			}
 			msgs = append(msgs, e.Error())
 		}
 		return strings.Join(msgs, "\n")
@@ -119,21 +124,20 @@ func (c *CompositeError) Error() string {
 	return c.message
 }
 
-// Unwrap implements the [errors.Unwrap] interface.
 func (c *CompositeError) Unwrap() []error {
 	return c.Errors
 }
 
-// MarshalJSON implements the JSON encoding interface.
+// MarshalJSON implements the JSON encoding interface
 func (c CompositeError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
+	return json.Marshal(map[string]interface{}{
 		"code":    c.code,
 		"message": c.message,
 		"errors":  c.Errors,
 	})
 }
 
-// CompositeValidationError an error to wrap a bunch of other errors.
+// CompositeValidationError an error to wrap a bunch of other errors
 func CompositeValidationError(errors ...error) *CompositeError {
 	return &CompositeError{
 		code:    CompositeErrorCode,
@@ -142,33 +146,20 @@ func CompositeValidationError(errors ...error) *CompositeError {
 	}
 }
 
-// ValidateName recursively sets the name for all validations or updates them for nested properties.
+// ValidateName recursively sets the name for all validations or updates them for nested properties
 func (c *CompositeError) ValidateName(name string) *CompositeError {
 	for i, e := range c.Errors {
-		if e == nil {
-			continue
-		}
-
-		ce := &CompositeError{}
-		if errors.As(e, &ce) {
-			c.Errors[i] = ce.ValidateName(name)
-
-			continue
-		}
-
-		ve := &Validation{}
-		if errors.As(e, &ve) {
+		if ve, ok := e.(*Validation); ok {
 			c.Errors[i] = ve.ValidateName(name)
-
-			continue
+		} else if ce, ok := e.(*CompositeError); ok {
+			c.Errors[i] = ce.ValidateName(name)
 		}
-
 	}
 
 	return c
 }
 
-// FailedAllPatternProperties an error for when the property doesn't match a pattern.
+// FailedAllPatternProperties an error for when the property doesn't match a pattern
 func FailedAllPatternProperties(name, in, key string) *Validation {
 	msg := fmt.Sprintf(failedAllPatternProps, name, key, in)
 	if in == "" {
@@ -183,7 +174,7 @@ func FailedAllPatternProperties(name, in, key string) *Validation {
 	}
 }
 
-// PropertyNotAllowed an error for when the property doesn't match a pattern.
+// PropertyNotAllowed an error for when the property doesn't match a pattern
 func PropertyNotAllowed(name, in, key string) *Validation {
 	msg := fmt.Sprintf(unallowedProperty, name, key, in)
 	if in == "" {
@@ -198,7 +189,7 @@ func PropertyNotAllowed(name, in, key string) *Validation {
 	}
 }
 
-// TooFewProperties an error for an object with too few properties.
+// TooFewProperties an error for an object with too few properties
 func TooFewProperties(name, in string, n int64) *Validation {
 	msg := fmt.Sprintf(tooFewProperties, name, in, n)
 	if in == "" {
@@ -213,7 +204,7 @@ func TooFewProperties(name, in string, n int64) *Validation {
 	}
 }
 
-// TooManyProperties an error for an object with too many properties.
+// TooManyProperties an error for an object with too many properties
 func TooManyProperties(name, in string, n int64) *Validation {
 	msg := fmt.Sprintf(tooManyProperties, name, in, n)
 	if in == "" {
@@ -228,7 +219,7 @@ func TooManyProperties(name, in string, n int64) *Validation {
 	}
 }
 
-// AdditionalItemsNotAllowed an error for invalid additional items.
+// AdditionalItemsNotAllowed an error for invalid additional items
 func AdditionalItemsNotAllowed(name, in string) *Validation {
 	msg := fmt.Sprintf(noAdditionalItems, name, in)
 	if in == "" {
@@ -242,7 +233,7 @@ func AdditionalItemsNotAllowed(name, in string) *Validation {
 	}
 }
 
-// InvalidCollectionFormat another flavor of invalid type error.
+// InvalidCollectionFormat another flavor of invalid type error
 func InvalidCollectionFormat(name, in, format string) *Validation {
 	return &Validation{
 		code:    InvalidTypeCode,
@@ -253,7 +244,7 @@ func InvalidCollectionFormat(name, in, format string) *Validation {
 	}
 }
 
-// InvalidTypeName an error for when the type is invalid.
+// InvalidTypeName an error for when the type is invalid
 func InvalidTypeName(typeName string) *Validation {
 	return &Validation{
 		code:    InvalidTypeCode,
@@ -262,8 +253,8 @@ func InvalidTypeName(typeName string) *Validation {
 	}
 }
 
-// InvalidType creates an error for when the type is invalid.
-func InvalidType(name, in, typeName string, value any) *Validation {
+// InvalidType creates an error for when the type is invalid
+func InvalidType(name, in, typeName string, value interface{}) *Validation {
 	var message string
 
 	if in != "" {
@@ -293,9 +284,10 @@ func InvalidType(name, in, typeName string, value any) *Validation {
 		Value:   value,
 		message: message,
 	}
+
 }
 
-// DuplicateItems error for when an array contains duplicates.
+// DuplicateItems error for when an array contains duplicates
 func DuplicateItems(name, in string) *Validation {
 	msg := fmt.Sprintf(uniqueFail, name, in)
 	if in == "" {
@@ -309,8 +301,8 @@ func DuplicateItems(name, in string) *Validation {
 	}
 }
 
-// TooManyItems error for when an array contains too many items.
-func TooManyItems(name, in string, maximum int64, value any) *Validation {
+// TooManyItems error for when an array contains too many items
+func TooManyItems(name, in string, maximum int64, value interface{}) *Validation {
 	msg := fmt.Sprintf(maximumItemsFail, name, in, maximum)
 	if in == "" {
 		msg = fmt.Sprintf(maximumItemsFailNoIn, name, maximum)
@@ -325,8 +317,8 @@ func TooManyItems(name, in string, maximum int64, value any) *Validation {
 	}
 }
 
-// TooFewItems error for when an array contains too few items.
-func TooFewItems(name, in string, minimum int64, value any) *Validation {
+// TooFewItems error for when an array contains too few items
+func TooFewItems(name, in string, minimum int64, value interface{}) *Validation {
 	msg := fmt.Sprintf(minItemsFail, name, in, minimum)
 	if in == "" {
 		msg = fmt.Sprintf(minItemsFailNoIn, name, minimum)
@@ -340,8 +332,8 @@ func TooFewItems(name, in string, minimum int64, value any) *Validation {
 	}
 }
 
-// ExceedsMaximumInt error for when maximum validation fails.
-func ExceedsMaximumInt(name, in string, maximum int64, exclusive bool, value any) *Validation {
+// ExceedsMaximumInt error for when maximumimum validation fails
+func ExceedsMaximumInt(name, in string, maximum int64, exclusive bool, value interface{}) *Validation {
 	var message string
 	if in == "" {
 		m := maximumIncFailNoIn
@@ -365,8 +357,8 @@ func ExceedsMaximumInt(name, in string, maximum int64, exclusive bool, value any
 	}
 }
 
-// ExceedsMaximumUint error for when maximum validation fails.
-func ExceedsMaximumUint(name, in string, maximum uint64, exclusive bool, value any) *Validation {
+// ExceedsMaximumUint error for when maximumimum validation fails
+func ExceedsMaximumUint(name, in string, maximum uint64, exclusive bool, value interface{}) *Validation {
 	var message string
 	if in == "" {
 		m := maximumIncFailNoIn
@@ -390,8 +382,8 @@ func ExceedsMaximumUint(name, in string, maximum uint64, exclusive bool, value a
 	}
 }
 
-// ExceedsMaximum error for when maximum validation fails.
-func ExceedsMaximum(name, in string, maximum float64, exclusive bool, value any) *Validation {
+// ExceedsMaximum error for when maximumimum validation fails
+func ExceedsMaximum(name, in string, maximum float64, exclusive bool, value interface{}) *Validation {
 	var message string
 	if in == "" {
 		m := maximumIncFailNoIn
@@ -415,8 +407,8 @@ func ExceedsMaximum(name, in string, maximum float64, exclusive bool, value any)
 	}
 }
 
-// ExceedsMinimumInt error for when minimum validation fails.
-func ExceedsMinimumInt(name, in string, minimum int64, exclusive bool, value any) *Validation {
+// ExceedsMinimumInt error for when minimum validation fails
+func ExceedsMinimumInt(name, in string, minimum int64, exclusive bool, value interface{}) *Validation {
 	var message string
 	if in == "" {
 		m := minIncFailNoIn
@@ -440,8 +432,8 @@ func ExceedsMinimumInt(name, in string, minimum int64, exclusive bool, value any
 	}
 }
 
-// ExceedsMinimumUint error for when minimum validation fails.
-func ExceedsMinimumUint(name, in string, minimum uint64, exclusive bool, value any) *Validation {
+// ExceedsMinimumUint error for when minimum validation fails
+func ExceedsMinimumUint(name, in string, minimum uint64, exclusive bool, value interface{}) *Validation {
 	var message string
 	if in == "" {
 		m := minIncFailNoIn
@@ -465,8 +457,8 @@ func ExceedsMinimumUint(name, in string, minimum uint64, exclusive bool, value a
 	}
 }
 
-// ExceedsMinimum error for when minimum validation fails.
-func ExceedsMinimum(name, in string, minimum float64, exclusive bool, value any) *Validation {
+// ExceedsMinimum error for when minimum validation fails
+func ExceedsMinimum(name, in string, minimum float64, exclusive bool, value interface{}) *Validation {
 	var message string
 	if in == "" {
 		m := minIncFailNoIn
@@ -490,8 +482,8 @@ func ExceedsMinimum(name, in string, minimum float64, exclusive bool, value any)
 	}
 }
 
-// NotMultipleOf error for when multiple of validation fails.
-func NotMultipleOf(name, in string, multiple, value any) *Validation {
+// NotMultipleOf error for when multiple of validation fails
+func NotMultipleOf(name, in string, multiple, value interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(multipleOfFailNoIn, name, multiple)
@@ -507,8 +499,8 @@ func NotMultipleOf(name, in string, multiple, value any) *Validation {
 	}
 }
 
-// EnumFail error for when an enum validation fails.
-func EnumFail(name, in string, value any, values []any) *Validation {
+// EnumFail error for when an enum validation fails
+func EnumFail(name, in string, value interface{}, values []interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(enumFailNoIn, name, values)
@@ -526,8 +518,8 @@ func EnumFail(name, in string, value any, values []any) *Validation {
 	}
 }
 
-// Required error for when a value is missing.
-func Required(name, in string, value any) *Validation {
+// Required error for when a value is missing
+func Required(name, in string, value interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(requiredFailNoIn, name)
@@ -543,8 +535,8 @@ func Required(name, in string, value any) *Validation {
 	}
 }
 
-// ReadOnly error for when a value is present in request.
-func ReadOnly(name, in string, value any) *Validation {
+// ReadOnly error for when a value is present in request
+func ReadOnly(name, in string, value interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(readOnlyFailNoIn, name)
@@ -560,8 +552,8 @@ func ReadOnly(name, in string, value any) *Validation {
 	}
 }
 
-// TooLong error for when a string is too long.
-func TooLong(name, in string, maximum int64, value any) *Validation {
+// TooLong error for when a string is too long
+func TooLong(name, in string, maximum int64, value interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(tooLongMessageNoIn, name, maximum)
@@ -577,8 +569,8 @@ func TooLong(name, in string, maximum int64, value any) *Validation {
 	}
 }
 
-// TooShort error for when a string is too short.
-func TooShort(name, in string, minimum int64, value any) *Validation {
+// TooShort error for when a string is too short
+func TooShort(name, in string, minimum int64, value interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(tooShortMessageNoIn, name, minimum)
@@ -597,7 +589,7 @@ func TooShort(name, in string, minimum int64, value any) *Validation {
 
 // FailedPattern error for when a string fails a regex pattern match
 // the pattern that is returned is the ECMA syntax version of the pattern not the golang version.
-func FailedPattern(name, in, pattern string, value any) *Validation {
+func FailedPattern(name, in, pattern string, value interface{}) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(patternFailNoIn, name, pattern)
@@ -615,8 +607,8 @@ func FailedPattern(name, in, pattern string, value any) *Validation {
 }
 
 // MultipleOfMustBePositive error for when a
-// multipleOf factor is negative.
-func MultipleOfMustBePositive(name, in string, factor any) *Validation {
+// multipleOf factor is negative
+func MultipleOfMustBePositive(name, in string, factor interface{}) *Validation {
 	return &Validation{
 		code:    MultipleOfMustBePositiveCode,
 		Name:    name,

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/LICENSE

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes/bytes.go

@@ -1,94 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package bytes
-
-import (
-	"encoding/binary"
-	"unsafe"
-)
-
-// Raw returns just the bytes without any assumptions about layout
-type Raw interface {
-	Raw() *[]byte
-}
-
-// Reader used to read various data sizes in the byte array
-type Reader interface {
-	Read8(pos int) uint8
-	Read16(pos int) uint16
-	Read32(pos int) uint32
-	Read64(pos int) uint64
-	Len() int
-}
-
-// Writer used to write various sizes of data in the byte array
-type Writer interface {
-	Write8(pos int, value uint8)
-	Write16(pos int, value uint16)
-	Write32(pos int, value uint32)
-	Write64(pos int, value uint64)
-	Len() int
-}
-
-// Bytes object for manipulating arbitrary byte arrays
-type Bytes interface {
-	Raw
-	Reader
-	Writer
-	Slice(offset int, size int) Bytes
-	LittleEndian() Bytes
-	BigEndian() Bytes
-}
-
-var nativeByteOrder binary.ByteOrder
-
-func init() {
-	buf := [2]byte{}
-	*(*uint16)(unsafe.Pointer(&buf[0])) = uint16(0x00FF)
-
-	switch buf {
-	case [2]byte{0xFF, 0x00}:
-		nativeByteOrder = binary.LittleEndian
-	case [2]byte{0x00, 0xFF}:
-		nativeByteOrder = binary.BigEndian
-	default:
-		panic("Unable to infer byte order")
-	}
-}
-
-// New raw bytearray
-func New(data *[]byte) Bytes {
-	return (*native)(data)
-}
-
-// NewLittleEndian little endian ordering of bytes
-func NewLittleEndian(data *[]byte) Bytes {
-	if nativeByteOrder == binary.LittleEndian {
-		return (*native)(data)
-	}
-
-	return (*swapbo)(data)
-}
-
-// NewBigEndian big endian ordering of bytes
-func NewBigEndian(data *[]byte) Bytes {
-	if nativeByteOrder == binary.BigEndian {
-		return (*native)(data)
-	}
-
-	return (*swapbo)(data)
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes/native.go

@@ -1,78 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package bytes
-
-import (
-	"unsafe"
-)
-
-type native []byte
-
-var _ Bytes = (*native)(nil)
-
-func (b *native) Read8(pos int) uint8 {
-	return (*b)[pos]
-}
-
-func (b *native) Read16(pos int) uint16 {
-	return *(*uint16)(unsafe.Pointer(&((*b)[pos])))
-}
-
-func (b *native) Read32(pos int) uint32 {
-	return *(*uint32)(unsafe.Pointer(&((*b)[pos])))
-}
-
-func (b *native) Read64(pos int) uint64 {
-	return *(*uint64)(unsafe.Pointer(&((*b)[pos])))
-}
-
-func (b *native) Write8(pos int, value uint8) {
-	(*b)[pos] = value
-}
-
-func (b *native) Write16(pos int, value uint16) {
-	*(*uint16)(unsafe.Pointer(&((*b)[pos]))) = value
-}
-
-func (b *native) Write32(pos int, value uint32) {
-	*(*uint32)(unsafe.Pointer(&((*b)[pos]))) = value
-}
-
-func (b *native) Write64(pos int, value uint64) {
-	*(*uint64)(unsafe.Pointer(&((*b)[pos]))) = value
-}
-
-func (b *native) Slice(offset int, size int) Bytes {
-	nb := (*b)[offset : offset+size]
-	return &nb
-}
-
-func (b *native) LittleEndian() Bytes {
-	return NewLittleEndian((*[]byte)(b))
-}
-
-func (b *native) BigEndian() Bytes {
-	return NewBigEndian((*[]byte)(b))
-}
-
-func (b *native) Raw() *[]byte {
-	return (*[]byte)(b)
-}
-
-func (b *native) Len() int {
-	return len(*b)
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes/swapbo.go

@@ -1,112 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package bytes
-
-import (
-	"unsafe"
-)
-
-type swapbo []byte
-
-var _ Bytes = (*swapbo)(nil)
-
-func (b *swapbo) Read8(pos int) uint8 {
-	return (*b)[pos]
-}
-
-func (b *swapbo) Read16(pos int) uint16 {
-	buf := [2]byte{}
-	buf[0] = (*b)[pos+1]
-	buf[1] = (*b)[pos+0]
-	return *(*uint16)(unsafe.Pointer(&buf[0]))
-}
-
-func (b *swapbo) Read32(pos int) uint32 {
-	buf := [4]byte{}
-	buf[0] = (*b)[pos+3]
-	buf[1] = (*b)[pos+2]
-	buf[2] = (*b)[pos+1]
-	buf[3] = (*b)[pos+0]
-	return *(*uint32)(unsafe.Pointer(&buf[0]))
-}
-
-func (b *swapbo) Read64(pos int) uint64 {
-	buf := [8]byte{}
-	buf[0] = (*b)[pos+7]
-	buf[1] = (*b)[pos+6]
-	buf[2] = (*b)[pos+5]
-	buf[3] = (*b)[pos+4]
-	buf[4] = (*b)[pos+3]
-	buf[5] = (*b)[pos+2]
-	buf[6] = (*b)[pos+1]
-	buf[7] = (*b)[pos+0]
-	return *(*uint64)(unsafe.Pointer(&buf[0]))
-}
-
-func (b *swapbo) Write8(pos int, value uint8) {
-	(*b)[pos] = value
-}
-
-func (b *swapbo) Write16(pos int, value uint16) {
-	buf := [2]byte{}
-	*(*uint16)(unsafe.Pointer(&buf[0])) = value
-	(*b)[pos+0] = buf[1]
-	(*b)[pos+1] = buf[0]
-}
-
-func (b *swapbo) Write32(pos int, value uint32) {
-	buf := [4]byte{}
-	*(*uint32)(unsafe.Pointer(&buf[0])) = value
-	(*b)[pos+0] = buf[3]
-	(*b)[pos+1] = buf[2]
-	(*b)[pos+2] = buf[1]
-	(*b)[pos+3] = buf[0]
-}
-
-func (b *swapbo) Write64(pos int, value uint64) {
-	buf := [8]byte{}
-	*(*uint64)(unsafe.Pointer(&buf[0])) = value
-	(*b)[pos+0] = buf[7]
-	(*b)[pos+1] = buf[6]
-	(*b)[pos+2] = buf[5]
-	(*b)[pos+3] = buf[4]
-	(*b)[pos+4] = buf[3]
-	(*b)[pos+5] = buf[2]
-	(*b)[pos+6] = buf[1]
-	(*b)[pos+7] = buf[0]
-}
-
-func (b *swapbo) Slice(offset int, size int) Bytes {
-	nb := (*b)[offset : offset+size]
-	return &nb
-}
-
-func (b *swapbo) LittleEndian() Bytes {
-	return NewLittleEndian((*[]byte)(b))
-}
-
-func (b *swapbo) BigEndian() Bytes {
-	return NewBigEndian((*[]byte)(b))
-}
-
-func (b *swapbo) Raw() *[]byte {
-	return (*[]byte)(b)
-}
-
-func (b *swapbo) Len() int {
-	return len(*b)
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/config.go

@@ -1,143 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package nvpci
-
-import (
-	"fmt"
-	"io/ioutil"
-
-	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
-)
-
-const (
-	// PCICfgSpaceStandardSize represents the size in bytes of the standard config space
-	PCICfgSpaceStandardSize = 256
-	// PCICfgSpaceExtendedSize represents the size in bytes of the extended config space
-	PCICfgSpaceExtendedSize = 4096
-	// PCICapabilityListPointer represents offset for the capability list pointer
-	PCICapabilityListPointer = 0x34
-	// PCIStatusCapabilityList represents the status register bit which indicates capability list support
-	PCIStatusCapabilityList = 0x10
-	// PCIStatusBytePosition represents the position of the status register
-	PCIStatusBytePosition = 0x06
-)
-
-// ConfigSpace PCI configuration space (standard extended) file path
-type ConfigSpace struct {
-	Path string
-}
-
-// ConfigSpaceIO Interface for reading and writing raw and preconfigured values
-type ConfigSpaceIO interface {
-	bytes.Bytes
-	GetVendorID() uint16
-	GetDeviceID() uint16
-	GetPCICapabilities() (*PCICapabilities, error)
-}
-
-type configSpaceIO struct {
-	bytes.Bytes
-}
-
-// PCIStandardCapability standard PCI config space
-type PCIStandardCapability struct {
-	bytes.Bytes
-}
-
-// PCIExtendedCapability extended PCI config space
-type PCIExtendedCapability struct {
-	bytes.Bytes
-	Version uint8
-}
-
-// PCICapabilities combines the standard and extended config space
-type PCICapabilities struct {
-	Standard map[uint8]*PCIStandardCapability
-	Extended map[uint16]*PCIExtendedCapability
-}
-
-func (cs *ConfigSpace) Read() (ConfigSpaceIO, error) {
-	config, err := ioutil.ReadFile(cs.Path)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open file: %v", err)
-	}
-	return &configSpaceIO{bytes.New(&config)}, nil
-}
-
-func (cs *configSpaceIO) GetVendorID() uint16 {
-	return cs.Read16(0)
-}
-
-func (cs *configSpaceIO) GetDeviceID() uint16 {
-	return cs.Read16(2)
-}
-
-func (cs *configSpaceIO) GetPCICapabilities() (*PCICapabilities, error) {
-	caps := &PCICapabilities{
-		make(map[uint8]*PCIStandardCapability),
-		make(map[uint16]*PCIExtendedCapability),
-	}
-
-	support := cs.Read8(PCIStatusBytePosition) & PCIStatusCapabilityList
-	if support == 0 {
-		return nil, fmt.Errorf("pci device does not support capability list")
-	}
-
-	soffset := cs.Read8(PCICapabilityListPointer)
-	if int(soffset) >= cs.Len() {
-		return nil, fmt.Errorf("capability list pointer out of bounds")
-	}
-
-	for soffset != 0 {
-		if soffset == 0xff {
-			return nil, fmt.Errorf("config space broken")
-		}
-		if int(soffset) >= PCICfgSpaceStandardSize {
-			return nil, fmt.Errorf("standard capability list pointer out of bounds")
-		}
-		data := cs.Read32(int(soffset))
-		id := uint8(data & 0xff)
-		caps.Standard[id] = &PCIStandardCapability{
-			cs.Slice(int(soffset), cs.Len()-int(soffset)),
-		}
-		soffset = uint8((data >> 8) & 0xff)
-	}
-
-	if cs.Len() <= PCICfgSpaceStandardSize {
-		return caps, nil
-	}
-
-	eoffset := uint16(PCICfgSpaceStandardSize)
-	for eoffset != 0 {
-		if eoffset == 0xffff {
-			return nil, fmt.Errorf("config space broken")
-		}
-		if int(eoffset) >= PCICfgSpaceExtendedSize {
-			return nil, fmt.Errorf("extended capability list pointer out of bounds")
-		}
-		data := cs.Read32(int(eoffset))
-		id := uint16(data & 0xffff)
-		version := uint8((data >> 16) & 0xf)
-		caps.Extended[id] = &PCIExtendedCapability{
-			cs.Slice(int(eoffset), cs.Len()-int(eoffset)),
-			version,
-		}
-		eoffset = uint16((data >> 4) & 0xffc)
-	}
-
-	return caps, nil
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio/mmio.go

@@ -1,127 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package mmio
-
-import (
-	"fmt"
-	"os"
-	"syscall"
-	"unsafe"
-
-	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
-)
-
-// Mmio memory map a region
-type Mmio interface {
-	bytes.Raw
-	bytes.Reader
-	bytes.Writer
-	Sync() error
-	Close() error
-	Slice(offset int, size int) Mmio
-	LittleEndian() Mmio
-	BigEndian() Mmio
-}
-
-type mmio struct {
-	bytes.Bytes
-}
-
-func open(path string, offset int, size int, flags int) (Mmio, error) {
-	var mmapFlags int
-	switch flags {
-	case os.O_RDONLY:
-		mmapFlags = syscall.PROT_READ
-	case os.O_RDWR:
-		mmapFlags = syscall.PROT_READ | syscall.PROT_WRITE
-	default:
-		return nil, fmt.Errorf("invalid flags: %v", flags)
-	}
-
-	file, err := os.OpenFile(path, flags, 0)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open file: %v", err)
-	}
-	defer file.Close()
-
-	fi, err := file.Stat()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get file info: %v", err)
-	}
-
-	if size > int(fi.Size()) {
-		return nil, fmt.Errorf("requested size larger than file size")
-	}
-
-	if size < 0 {
-		size = int(fi.Size())
-	}
-
-	mmap, err := syscall.Mmap(
-		int(file.Fd()),
-		int64(offset),
-		size,
-		mmapFlags,
-		syscall.MAP_SHARED)
-	if err != nil {
-		return nil, fmt.Errorf("failed to mmap file: %v", err)
-	}
-
-	return &mmio{bytes.New(&mmap)}, nil
-}
-
-// OpenRO open region readonly
-func OpenRO(path string, offset int, size int) (Mmio, error) {
-	return open(path, offset, size, os.O_RDONLY)
-}
-
-// OpenRW open region read write
-func OpenRW(path string, offset int, size int) (Mmio, error) {
-	return open(path, offset, size, os.O_RDWR)
-}
-
-func (m *mmio) Slice(offset int, size int) Mmio {
-	return &mmio{m.Bytes.Slice(offset, size)}
-}
-
-func (m *mmio) LittleEndian() Mmio {
-	return &mmio{m.Bytes.LittleEndian()}
-}
-
-func (m *mmio) BigEndian() Mmio {
-	return &mmio{m.Bytes.BigEndian()}
-}
-
-func (m *mmio) Close() error {
-	err := syscall.Munmap(*m.Bytes.Raw())
-	if err != nil {
-		return fmt.Errorf("failed to munmap file: %v", err)
-	}
-	return nil
-}
-
-func (m *mmio) Sync() error {
-	_, _, errno := syscall.Syscall(
-		syscall.SYS_MSYNC,
-		uintptr(unsafe.Pointer(&(*m.Bytes.Raw())[0])),
-		uintptr(m.Len()),
-		uintptr(syscall.MS_SYNC|syscall.MS_INVALIDATE))
-	if errno != 0 {
-		return fmt.Errorf("failed to msync file: %v", errno)
-	}
-	return nil
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio/mock.go

@@ -1,74 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package mmio
-
-import (
-	"fmt"
-
-	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
-)
-
-type mockMmio struct {
-	mmio
-	source *[]byte
-	offset int
-	rw     bool
-}
-
-func mockOpen(source *[]byte, offset int, size int, rw bool) (Mmio, error) {
-	if size < 0 {
-		size = len(*source) - offset
-	}
-	if (offset + size) > len(*source) {
-		return nil, fmt.Errorf("offset+size out of range")
-	}
-
-	data := append([]byte{}, (*source)[offset:offset+size]...)
-
-	m := &mockMmio{}
-	m.Bytes = bytes.New(&data).LittleEndian()
-	m.source = source
-	m.offset = offset
-	m.rw = rw
-
-	return m, nil
-}
-
-// MockOpenRO open read only
-func MockOpenRO(source *[]byte, offset int, size int) (Mmio, error) {
-	return mockOpen(source, offset, size, false)
-}
-
-// MockOpenRW open read write
-func MockOpenRW(source *[]byte, offset int, size int) (Mmio, error) {
-	return mockOpen(source, offset, size, true)
-}
-
-func (m *mockMmio) Close() error {
-	m = &mockMmio{}
-	return nil
-}
-
-func (m *mockMmio) Sync() error {
-	if !m.rw {
-		return fmt.Errorf("opened read-only")
-	}
-	for i := range *m.Bytes.Raw() {
-		(*m.source)[m.offset+i] = (*m.Bytes.Raw())[i]
-	}
-	return nil
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mock.go

@@ -1,141 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package nvpci
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
-)
-
-// MockNvpci mock pci device
-type MockNvpci struct {
-	*nvpci
-}
-
-var _ Interface = (*MockNvpci)(nil)
-
-// NewMockNvpci create new mock PCI and remove old devices
-func NewMockNvpci() (mock *MockNvpci, rerr error) {
-	rootDir, err := ioutil.TempDir("", "")
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if rerr != nil {
-			os.RemoveAll(rootDir)
-		}
-	}()
-
-	mock = &MockNvpci{
-		NewFrom(rootDir).(*nvpci),
-	}
-
-	return mock, nil
-}
-
-// Cleanup remove the mocked PCI devices root folder
-func (m *MockNvpci) Cleanup() {
-	os.RemoveAll(m.pciDevicesRoot)
-}
-
-// AddMockA100 Create an A100 like GPU mock device
-func (m *MockNvpci) AddMockA100(address string, numaNode int) error {
-	deviceDir := filepath.Join(m.pciDevicesRoot, address)
-	err := os.MkdirAll(deviceDir, 0755)
-	if err != nil {
-		return err
-	}
-
-	vendor, err := os.Create(filepath.Join(deviceDir, "vendor"))
-	if err != nil {
-		return err
-	}
-	_, err = vendor.WriteString(fmt.Sprintf("0x%x", PCINvidiaVendorID))
-	if err != nil {
-		return err
-	}
-
-	class, err := os.Create(filepath.Join(deviceDir, "class"))
-	if err != nil {
-		return err
-	}
-	_, err = class.WriteString(fmt.Sprintf("0x%x", PCI3dControllerClass))
-	if err != nil {
-		return err
-	}
-
-	device, err := os.Create(filepath.Join(deviceDir, "device"))
-	if err != nil {
-		return err
-	}
-	_, err = device.WriteString("0x20bf")
-	if err != nil {
-		return err
-	}
-
-	numa, err := os.Create(filepath.Join(deviceDir, "numa_node"))
-	if err != nil {
-		return err
-	}
-	_, err = numa.WriteString(fmt.Sprintf("%v", numaNode))
-	if err != nil {
-		return err
-	}
-
-	config, err := os.Create(filepath.Join(deviceDir, "config"))
-	if err != nil {
-		return err
-	}
-	_data := make([]byte, PCICfgSpaceStandardSize)
-	data := bytes.New(&_data)
-	data.Write16(0, PCINvidiaVendorID)
-	data.Write16(2, uint16(0x20bf))
-	data.Write8(PCIStatusBytePosition, PCIStatusCapabilityList)
-	_, err = config.Write(*data.Raw())
-	if err != nil {
-		return err
-	}
-
-	bar0 := []uint64{0x00000000c2000000, 0x00000000c2ffffff, 0x0000000000040200}
-	resource, err := os.Create(filepath.Join(deviceDir, "resource"))
-	if err != nil {
-		return err
-	}
-	_, err = resource.WriteString(fmt.Sprintf("0x%x 0x%x 0x%x", bar0[0], bar0[1], bar0[2]))
-	if err != nil {
-		return err
-	}
-
-	pmcID := uint32(0x170000a1)
-	resource0, err := os.Create(filepath.Join(deviceDir, "resource0"))
-	if err != nil {
-		return err
-	}
-	_data = make([]byte, bar0[1]-bar0[0]+1)
-	data = bytes.New(&_data).LittleEndian()
-	data.Write32(0, pmcID)
-	_, err = resource0.Write(*data.Raw())
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/nvpci.go

@@ -1,316 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package nvpci
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path"
-	"sort"
-	"strconv"
-	"strings"
-)
-
-const (
-	// PCIDevicesRoot represents base path for all pci devices under sysfs
-	PCIDevicesRoot = "/sys/bus/pci/devices"
-	// PCINvidiaVendorID represents PCI vendor id for NVIDIA
-	PCINvidiaVendorID uint16 = 0x10de
-	// PCIVgaControllerClass represents the PCI class for VGA Controllers
-	PCIVgaControllerClass uint32 = 0x030000
-	// PCI3dControllerClass represents the PCI class for 3D Graphics accellerators
-	PCI3dControllerClass uint32 = 0x030200
-	// PCINvSwitchClass represents the PCI class for NVSwitches
-	PCINvSwitchClass uint32 = 0x068000
-)
-
-// Interface allows us to get a list of all NVIDIA PCI devices
-type Interface interface {
-	GetAllDevices() ([]*NvidiaPCIDevice, error)
-	Get3DControllers() ([]*NvidiaPCIDevice, error)
-	GetVGAControllers() ([]*NvidiaPCIDevice, error)
-	GetNVSwitches() ([]*NvidiaPCIDevice, error)
-	GetGPUs() ([]*NvidiaPCIDevice, error)
-}
-
-// MemoryResources a more human readable handle
-type MemoryResources map[int]*MemoryResource
-
-// ResourceInterface exposes some higher level functions of resources
-type ResourceInterface interface {
-	GetTotalAddressableMemory(bool) (uint64, uint64)
-}
-
-type nvpci struct {
-	pciDevicesRoot string
-}
-
-var _ Interface = (*nvpci)(nil)
-var _ ResourceInterface = (*MemoryResources)(nil)
-
-// NvidiaPCIDevice represents a PCI device for an NVIDIA product
-type NvidiaPCIDevice struct {
-	Path      string
-	Address   string
-	Vendor    uint16
-	Class     uint32
-	Device    uint16
-	NumaNode  int
-	Config    *ConfigSpace
-	Resources MemoryResources
-}
-
-// IsVGAController if class == 0x300
-func (d *NvidiaPCIDevice) IsVGAController() bool {
-	return d.Class == PCIVgaControllerClass
-}
-
-// Is3DController if class == 0x302
-func (d *NvidiaPCIDevice) Is3DController() bool {
-	return d.Class == PCI3dControllerClass
-}
-
-// IsNVSwitch if classe == 0x068
-func (d *NvidiaPCIDevice) IsNVSwitch() bool {
-	return d.Class == PCINvSwitchClass
-}
-
-// IsGPU either VGA for older cards or 3D for newer
-func (d *NvidiaPCIDevice) IsGPU() bool {
-	return d.IsVGAController() || d.Is3DController()
-}
-
-// IsResetAvailable some devices can be reset without rebooting,
-// check if applicable
-func (d *NvidiaPCIDevice) IsResetAvailable() bool {
-	_, err := os.Stat(path.Join(d.Path, "reset"))
-	return err == nil
-}
-
-// Reset perform a reset to apply a new configuration at HW level
-func (d *NvidiaPCIDevice) Reset() error {
-	err := ioutil.WriteFile(path.Join(d.Path, "reset"), []byte("1"), 0)
-	if err != nil {
-		return fmt.Errorf("unable to write to reset file: %v", err)
-	}
-	return nil
-}
-
-// New interface that allows us to get a list of all NVIDIA PCI devices
-func New() Interface {
-	return &nvpci{PCIDevicesRoot}
-}
-
-// NewFrom interface allows us to get a list of all NVIDIA PCI devices at a specific root directory
-func NewFrom(root string) Interface {
-	return &nvpci{root}
-}
-
-// GetAllDevices returns all Nvidia PCI devices on the system
-func (p *nvpci) GetAllDevices() ([]*NvidiaPCIDevice, error) {
-	deviceDirs, err := ioutil.ReadDir(p.pciDevicesRoot)
-	if err != nil {
-		return nil, fmt.Errorf("unable to read PCI bus devices: %v", err)
-	}
-
-	var nvdevices []*NvidiaPCIDevice
-	for _, deviceDir := range deviceDirs {
-		devicePath := path.Join(p.pciDevicesRoot, deviceDir.Name())
-		nvdevice, err := NewDevice(devicePath)
-		if err != nil {
-			return nil, fmt.Errorf("error constructing NVIDIA PCI device %s: %v", deviceDir.Name(), err)
-		}
-		if nvdevice == nil {
-			continue
-		}
-		nvdevices = append(nvdevices, nvdevice)
-	}
-
-	addressToID := func(address string) uint64 {
-		address = strings.ReplaceAll(address, ":", "")
-		address = strings.ReplaceAll(address, ".", "")
-		id, _ := strconv.ParseUint(address, 16, 64)
-		return id
-	}
-
-	sort.Slice(nvdevices, func(i, j int) bool {
-		return addressToID(nvdevices[i].Address) < addressToID(nvdevices[j].Address)
-	})
-
-	return nvdevices, nil
-}
-
-// NewDevice constructs an NvidiaPCIDevice
-func NewDevice(devicePath string) (*NvidiaPCIDevice, error) {
-	address := path.Base(devicePath)
-
-	vendor, err := ioutil.ReadFile(path.Join(devicePath, "vendor"))
-	if err != nil {
-		return nil, fmt.Errorf("unable to read PCI device vendor id for %s: %v", address, err)
-	}
-	vendorStr := strings.TrimSpace(string(vendor))
-	vendorID, err := strconv.ParseUint(vendorStr, 0, 16)
-	if err != nil {
-		return nil, fmt.Errorf("unable to convert vendor string to uint16: %v", vendorStr)
-	}
-
-	if uint16(vendorID) != PCINvidiaVendorID {
-		return nil, nil
-	}
-
-	class, err := ioutil.ReadFile(path.Join(devicePath, "class"))
-	if err != nil {
-		return nil, fmt.Errorf("unable to read PCI device class for %s: %v", address, err)
-	}
-	classStr := strings.TrimSpace(string(class))
-	classID, err := strconv.ParseUint(classStr, 0, 32)
-	if err != nil {
-		return nil, fmt.Errorf("unable to convert class string to uint32: %v", classStr)
-	}
-
-	device, err := ioutil.ReadFile(path.Join(devicePath, "device"))
-	if err != nil {
-		return nil, fmt.Errorf("unable to read PCI device id for %s: %v", address, err)
-	}
-	deviceStr := strings.TrimSpace(string(device))
-	deviceID, err := strconv.ParseUint(deviceStr, 0, 16)
-	if err != nil {
-		return nil, fmt.Errorf("unable to convert device string to uint16: %v", deviceStr)
-	}
-
-	numa, err := ioutil.ReadFile(path.Join(devicePath, "numa_node"))
-	if err != nil {
-		return nil, fmt.Errorf("unable to read PCI NUMA node for %s: %v", address, err)
-	}
-	numaStr := strings.TrimSpace(string(numa))
-	numaNode, err := strconv.ParseInt(numaStr, 0, 64)
-	if err != nil {
-		return nil, fmt.Errorf("unable to convert NUMA node string to int64: %v", numaNode)
-	}
-
-	config := &ConfigSpace{
-		Path: path.Join(devicePath, "config"),
-	}
-
-	resource, err := ioutil.ReadFile(path.Join(devicePath, "resource"))
-	if err != nil {
-		return nil, fmt.Errorf("unable to read PCI resource file for %s: %v", address, err)
-	}
-
-	resources := make(map[int]*MemoryResource)
-	for i, line := range strings.Split(strings.TrimSpace(string(resource)), "\n") {
-		values := strings.Split(line, " ")
-		if len(values) != 3 {
-			return nil, fmt.Errorf("more than 3 entries in line '%d' of resource file", i)
-		}
-
-		start, _ := strconv.ParseUint(values[0], 0, 64)
-		end, _ := strconv.ParseUint(values[1], 0, 64)
-		flags, _ := strconv.ParseUint(values[2], 0, 64)
-
-		if (end - start) != 0 {
-			resources[i] = &MemoryResource{
-				uintptr(start),
-				uintptr(end),
-				flags,
-				fmt.Sprintf("%s/resource%d", devicePath, i),
-			}
-		}
-	}
-
-	nvdevice := &NvidiaPCIDevice{
-		Path:      devicePath,
-		Address:   address,
-		Vendor:    uint16(vendorID),
-		Class:     uint32(classID),
-		Device:    uint16(deviceID),
-		NumaNode:  int(numaNode),
-		Config:    config,
-		Resources: resources,
-	}
-
-	return nvdevice, nil
-}
-
-// Get3DControllers returns all NVIDIA 3D Controller PCI devices on the system
-func (p *nvpci) Get3DControllers() ([]*NvidiaPCIDevice, error) {
-	devices, err := p.GetAllDevices()
-	if err != nil {
-		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
-	}
-
-	var filtered []*NvidiaPCIDevice
-	for _, d := range devices {
-		if d.Is3DController() {
-			filtered = append(filtered, d)
-		}
-	}
-
-	return filtered, nil
-}
-
-// GetVGAControllers returns all NVIDIA VGA Controller PCI devices on the system
-func (p *nvpci) GetVGAControllers() ([]*NvidiaPCIDevice, error) {
-	devices, err := p.GetAllDevices()
-	if err != nil {
-		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
-	}
-
-	var filtered []*NvidiaPCIDevice
-	for _, d := range devices {
-		if d.IsVGAController() {
-			filtered = append(filtered, d)
-		}
-	}
-
-	return filtered, nil
-}
-
-// GetNVSwitches returns all NVIDIA NVSwitch PCI devices on the system
-func (p *nvpci) GetNVSwitches() ([]*NvidiaPCIDevice, error) {
-	devices, err := p.GetAllDevices()
-	if err != nil {
-		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
-	}
-
-	var filtered []*NvidiaPCIDevice
-	for _, d := range devices {
-		if d.IsNVSwitch() {
-			filtered = append(filtered, d)
-		}
-	}
-
-	return filtered, nil
-}
-
-// GetGPUs returns all NVIDIA GPU devices on the system
-func (p *nvpci) GetGPUs() ([]*NvidiaPCIDevice, error) {
-	devices, err := p.GetAllDevices()
-	if err != nil {
-		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
-	}
-
-	var filtered []*NvidiaPCIDevice
-	for _, d := range devices {
-		if d.IsGPU() {
-			filtered = append(filtered, d)
-		}
-	}
-
-	return filtered, nil
-}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/resources.go

@@ -1,140 +0,0 @@
-/*
- * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package nvpci
-
-import (
-	"fmt"
-	"sort"
-
-	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio"
-)
-
-const (
-	pmcEndianRegister = 0x4
-	pmcLittleEndian   = 0x0
-	pmcBigEndian      = 0x01000001
-)
-
-// MemoryResource represents a mmio region
-type MemoryResource struct {
-	Start uintptr
-	End   uintptr
-	Flags uint64
-	Path  string
-}
-
-// OpenRW read write mmio region
-func (mr *MemoryResource) OpenRW() (mmio.Mmio, error) {
-	rw, err := mmio.OpenRW(mr.Path, 0, int(mr.End-mr.Start+1))
-	if err != nil {
-		return nil, fmt.Errorf("failed to open file for mmio: %v", err)
-	}
-	switch rw.Read32(pmcEndianRegister) {
-	case pmcBigEndian:
-		return rw.BigEndian(), nil
-	case pmcLittleEndian:
-		return rw.LittleEndian(), nil
-	}
-	return nil, fmt.Errorf("unknown endianness for mmio: %v", err)
-}
-
-// OpenRO read only mmio region
-func (mr *MemoryResource) OpenRO() (mmio.Mmio, error) {
-	ro, err := mmio.OpenRO(mr.Path, 0, int(mr.End-mr.Start+1))
-	if err != nil {
-		return nil, fmt.Errorf("failed to open file for mmio: %v", err)
-	}
-	switch ro.Read32(pmcEndianRegister) {
-	case pmcBigEndian:
-		return ro.BigEndian(), nil
-	case pmcLittleEndian:
-		return ro.LittleEndian(), nil
-	}
-	return nil, fmt.Errorf("unknown endianness for mmio: %v", err)
-}
-
-// From Bit Twiddling Hacks, great resource for all low level bit manipulations
-func calcNextPowerOf2(n uint64) uint64 {
-	n--
-	n |= n >> 1
-	n |= n >> 2
-	n |= n >> 4
-	n |= n >> 8
-	n |= n >> 16
-	n |= n >> 32
-	n++
-
-	return n
-}
-
-// GetTotalAddressableMemory will accumulate the 32bit and 64bit memory windows
-// of each BAR and round the value if needed to the next power of 2; first
-// return value is the accumulated 32bit addresable memory size the second one
-// is the accumulated 64bit addressable memory size in bytes. These values are
-// needed to configure virtualized environments.
-func (mrs MemoryResources) GetTotalAddressableMemory(roundUp bool) (uint64, uint64) {
-	const pciIOVNumBAR = 6
-	const pciBaseAddressMemTypeMask = 0x06
-	const pciBaseAddressMemType32 = 0x00 /* 32 bit address */
-	const pciBaseAddressMemType64 = 0x04 /* 64 bit address */
-
-	// We need to sort the resources so the first 6 entries are the BARs
-	// How a map is represented in memory is not guaranteed, it is not an
-	// array. Keys do not have an order.
-	keys := make([]int, 0, len(mrs))
-	for k := range mrs {
-		keys = append(keys, k)
-	}
-	sort.Ints(keys)
-
-	numBAR := 0
-	memSize32bit := uint64(0)
-	memSize64bit := uint64(0)
-
-	for _, key := range keys {
-		// The PCIe spec only defines 5 BARs per device, we're
-		// discarding everything after the 5th entry of the resources
-		// file, see lspci.c
-		if key >= pciIOVNumBAR || numBAR == pciIOVNumBAR {
-			break
-		}
-		numBAR = numBAR + 1
-
-		region := mrs[key]
-
-		flags := region.Flags & pciBaseAddressMemTypeMask
-		memType32bit := flags == pciBaseAddressMemType32
-		memType64bit := flags == pciBaseAddressMemType64
-
-		memSize := (region.End - region.Start) + 1
-
-		if memType32bit {
-			memSize32bit = memSize32bit + uint64(memSize)
-		}
-		if memType64bit {
-			memSize64bit = memSize64bit + uint64(memSize)
-		}
-
-	}
-
-	if roundUp {
-		memSize32bit = calcNextPowerOf2(memSize32bit)
-		memSize64bit = calcNextPowerOf2(memSize64bit)
-	}
-
-	return memSize32bit, memSize64bit
-}

src/runtime/vendor/modules.txt

@@ -318,8 +318,8 @@ github.com/go-openapi/analysis/internal/flatten/operations
 github.com/go-openapi/analysis/internal/flatten/replace
 github.com/go-openapi/analysis/internal/flatten/schutils
 github.com/go-openapi/analysis/internal/flatten/sortref
-# github.com/go-openapi/errors v0.22.6
-## explicit; go 1.24.0
+# github.com/go-openapi/errors v0.22.1
+## explicit; go 1.20
 github.com/go-openapi/errors
 # github.com/go-openapi/jsonpointer v0.21.0
 ## explicit; go 1.20
@@ -539,11 +539,6 @@ github.com/vishvananda/netns
 # github.com/x448/float16 v0.8.4
 ## explicit; go 1.11
 github.com/x448/float16
-# gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965
-## explicit; go 1.16
-gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci
-gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes
-gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio
 # go.mongodb.org/mongo-driver v1.14.0
 ## explicit; go 1.18
 go.mongodb.org/mongo-driver/bson

src/runtime/virtcontainers/fs_share_linux.go

@@ -58,19 +58,20 @@ func unmountNoFollow(path string) error {
 	return syscall.Unmount(path, syscall.MNT_DETACH|UmountNoFollow)
 }
 
-// Resolve the K8S root dir if it is a symbolic link
-func resolveRootDir() string {
-	rootDir, err := os.Readlink(defaultKubernetesRootDir)
-	if err != nil {
-		// Use the default root dir in case of any errors resolving the root dir symlink
-		return defaultKubernetesRootDir
+// resolveRootDirWithBase returns the resolved (followed symlink) kubelet root path.
+// If base is non-empty it is used as the root; otherwise defaultKubernetesRootDir is used.
+func resolveRootDirWithBase(base string) string {
+	if base == "" {
+		base = defaultKubernetesRootDir
+	}
+	rootDir, err := os.Readlink(base)
+	if err != nil {
+		return base
 	}
-	// Make root dir an absolute path if needed
 	if !filepath.IsAbs(rootDir) {
-		rootDir, err = filepath.Abs(filepath.Join(filepath.Dir(defaultKubernetesRootDir), rootDir))
+		rootDir, err = filepath.Abs(filepath.Join(filepath.Dir(base), rootDir))
 		if err != nil {
-			// Use the default root dir in case of any errors resolving the root dir symlink
-			return defaultKubernetesRootDir
+			return base
 		}
 	}
 	return rootDir
@@ -99,9 +100,14 @@ func NewFilesystemShare(s *Sandbox) (*FilesystemShare, error) {
 		return nil, fmt.Errorf("Creating watcher returned error %w", err)
 	}
 
-	kubernetesRootDir := resolveRootDir()
-	configVolRegex := regexp.MustCompile("^" + kubernetesRootDir + configVolRegexString)
-	timestampDirRegex := regexp.MustCompile("^" + kubernetesRootDir + configVolRegexString + timestampDirRegexString)
+	baseRoot := ""
+	if s.config != nil {
+		baseRoot = s.config.KubeletRootDir
+	}
+	kubernetesRootDir := resolveRootDirWithBase(baseRoot)
+	quotedRoot := regexp.QuoteMeta(kubernetesRootDir)
+	configVolRegex := regexp.MustCompile("^" + quotedRoot + configVolRegexString)
+	timestampDirRegex := regexp.MustCompile("^" + quotedRoot + configVolRegexString + timestampDirRegexString)
 
 	return &FilesystemShare{
 		prepared:           false,

src/runtime/virtcontainers/qemu.go

@@ -812,21 +812,6 @@ func (q *qemu) createPCIeTopology(qemuConfig *govmmQemu.Config, hypervisorConfig
 	// into a PCIe Root Port or PCIe Switch.
 	// For more details, please see https://github.com/qemu/qemu/blob/master/docs/pcie.txt
 
-	// Deduce the right values for mem-reserve and pref-64-reserve memory regions
-	memSize32bit, memSize64bit := q.arch.getBARsMaxAddressableMemory()
-
-	// The default OVMF MMIO aperture is too small for some PCIe devices
-	// with huge BARs so we need to increase it.
-	// memSize64bit is in bytes, convert to MB, OVMF expects MB as a string
-	if strings.Contains(strings.ToLower(hypervisorConfig.FirmwarePath), "ovmf") {
-		pciMmio64Mb := fmt.Sprintf("%d", (memSize64bit / 1024 / 1024))
-		fwCfg := govmmQemu.FwCfg{
-			Name: "opt/ovmf/X-PciMmio64Mb",
-			Str:  pciMmio64Mb,
-		}
-		qemuConfig.FwCfg = append(qemuConfig.FwCfg, fwCfg)
-	}
-
 	// Get the number of hot(cold)-pluggable ports needed from the provided
 	// VFIO devices
 	var numOfPluggablePorts uint32 = 0
@@ -897,7 +882,7 @@ func (q *qemu) createPCIeTopology(qemuConfig *govmmQemu.Config, hypervisorConfig
 		if numOfPluggablePorts > maxPCIeRootPort {
 			return fmt.Errorf("Number of PCIe Root Ports exceeed allowed max of %d", maxPCIeRootPort)
 		}
-		qemuConfig.Devices = q.arch.appendPCIeRootPortDevice(qemuConfig.Devices, numOfPluggablePorts, memSize32bit, memSize64bit)
+		qemuConfig.Devices = q.arch.appendPCIeRootPortDevice(qemuConfig.Devices, numOfPluggablePorts)
 		return nil
 	}
 	if vfioOnSwitchPort {
@@ -907,12 +892,12 @@ func (q *qemu) createPCIeTopology(qemuConfig *govmmQemu.Config, hypervisorConfig
 		if numOfPluggablePorts > maxPCIeSwitchPort {
 			return fmt.Errorf("Number of PCIe Switch Ports exceeed allowed max of %d", maxPCIeSwitchPort)
 		}
-		qemuConfig.Devices = q.arch.appendPCIeSwitchPortDevice(qemuConfig.Devices, numOfPluggablePorts, memSize32bit, memSize64bit)
+		qemuConfig.Devices = q.arch.appendPCIeSwitchPortDevice(qemuConfig.Devices, numOfPluggablePorts)
 		return nil
 	}
 	// If both Root Port and Switch Port are not enabled, check if QemuVirt need add pcie root port.
 	if machineType == QemuVirt {
-		qemuConfig.Devices = q.arch.appendPCIeRootPortDevice(qemuConfig.Devices, numOfPluggablePorts, memSize32bit, memSize64bit)
+		qemuConfig.Devices = q.arch.appendPCIeRootPortDevice(qemuConfig.Devices, numOfPluggablePorts)
 	}
 	return nil
 }
@@ -2677,7 +2662,7 @@ func genericMemoryTopology(memoryMb, hostMemoryMb uint64, slots uint8, memoryOff
 }
 
 // genericAppendPCIeRootPort appends to devices the given pcie-root-port
-func genericAppendPCIeRootPort(devices []govmmQemu.Device, number uint32, machineType string, memSize32bit uint64, memSize64bit uint64) []govmmQemu.Device {
+func genericAppendPCIeRootPort(devices []govmmQemu.Device, number uint32, machineType string) []govmmQemu.Device {
 	var (
 		bus           string
 		chassis       string
@@ -2703,8 +2688,6 @@ func genericAppendPCIeRootPort(devices []govmmQemu.Device, number uint32, machin
 				Slot:          strconv.FormatUint(uint64(i), 10),
 				Multifunction: multiFunction,
 				Addr:          addr,
-				MemReserve:    fmt.Sprintf("%dB", memSize32bit),
-				Pref64Reserve: fmt.Sprintf("%dB", memSize64bit),
 			},
 		)
 	}
@@ -2733,7 +2716,7 @@ func genericAppendPCIeRootPort(devices []govmmQemu.Device, number uint32, machin
 //          -------------           --------------
 */
 // genericAppendPCIeSwitch adds a PCIe Swtich
-func genericAppendPCIeSwitchPort(devices []govmmQemu.Device, number uint32, machineType string, memSize32bit uint64, memSize64bit uint64) []govmmQemu.Device {
+func genericAppendPCIeSwitchPort(devices []govmmQemu.Device, number uint32, machineType string) []govmmQemu.Device {
 
 	// Q35, Virt have the correct PCIe support,
 	// hence ignore all other machines
@@ -2750,8 +2733,6 @@ func genericAppendPCIeSwitchPort(devices []govmmQemu.Device, number uint32, mach
 		Slot:          strconv.FormatUint(uint64(0), 10),
 		Multifunction: false,
 		Addr:          "0",
-		MemReserve:    fmt.Sprintf("%dB", memSize32bit),
-		Pref64Reserve: fmt.Sprintf("%dB", memSize64bit),
 	}
 
 	devices = append(devices, pcieRootPort)
@@ -2775,8 +2756,6 @@ func genericAppendPCIeSwitchPort(devices []govmmQemu.Device, number uint32, mach
 			Bus:     pcieSwitchUpstreamPort.ID,
 			Chassis: fmt.Sprintf("%d", nextChassis),
 			Slot:    strconv.FormatUint(uint64(i), 10),
-			// TODO: MemReserve:    fmt.Sprintf("%dB", memSize32bit),
-			// TODO: Pref64Reserve: fmt.Sprintf("%dB", memSize64bit),
 		}
 		devices = append(devices, pcieSwitchDownstreamPort)
 	}

src/runtime/virtcontainers/qemu_arch_base.go

@@ -18,7 +18,6 @@ import (
 	"strings"
 
 	govmmQemu "github.com/kata-containers/kata-containers/src/runtime/pkg/govmm/qemu"
-	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci"
 
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/device/config"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/types"
@@ -153,10 +152,10 @@ type qemuArch interface {
 	setIgnoreSharedMemoryMigrationCaps(context.Context, *govmmQemu.QMP) error
 
 	// appendPCIeRootPortDevice appends a pcie-root-port device to pcie.0 bus
-	appendPCIeRootPortDevice(devices []govmmQemu.Device, number uint32, memSize32bit uint64, memSize64bit uint64) []govmmQemu.Device
+	appendPCIeRootPortDevice(devices []govmmQemu.Device, number uint32) []govmmQemu.Device
 
 	// appendPCIeSwitch appends a ioh3420 device to a pcie-root-port
-	appendPCIeSwitchPortDevice(devices []govmmQemu.Device, number uint32, memSize32bit uint64, memSize64bit uint64) []govmmQemu.Device
+	appendPCIeSwitchPortDevice(devices []govmmQemu.Device, number uint32) []govmmQemu.Device
 
 	// append vIOMMU device
 	appendIOMMU(devices []govmmQemu.Device) ([]govmmQemu.Device, error)
@@ -170,10 +169,6 @@ type qemuArch interface {
 	// be used with the -bios option, ommit -bios option if the path is empty.
 	appendProtectionDevice(devices []govmmQemu.Device, firmware, firmwareVolume string, initdataDigest []byte) ([]govmmQemu.Device, string, error)
 
-	// scans the PCIe space and returns the biggest BAR sizes for 32-bit
-	// and 64-bit addressable memory
-	getBARsMaxAddressableMemory() (uint64, uint64)
-
 	// Query QMP to find a device's PCI path given its QOM path or ID
 	qomGetPciPath(qemuID string, qmpCh *qmpChannel) (types.PciPath, error)
 
@@ -875,46 +870,13 @@ func (q *qemuArchBase) addBridge(b types.Bridge) {
 }
 
 // appendPCIeRootPortDevice appends to devices the given pcie-root-port
-func (q *qemuArchBase) appendPCIeRootPortDevice(devices []govmmQemu.Device, number uint32, memSize32bit uint64, memSize64bit uint64) []govmmQemu.Device {
-	return genericAppendPCIeRootPort(devices, number, q.qemuMachine.Type, memSize32bit, memSize64bit)
+func (q *qemuArchBase) appendPCIeRootPortDevice(devices []govmmQemu.Device, number uint32) []govmmQemu.Device {
+	return genericAppendPCIeRootPort(devices, number, q.qemuMachine.Type)
 }
 
 // appendPCIeSwitchPortDevice appends a PCIe Switch with <number> ports
-func (q *qemuArchBase) appendPCIeSwitchPortDevice(devices []govmmQemu.Device, number uint32, memSize32bit uint64, memSize64bit uint64) []govmmQemu.Device {
-	return genericAppendPCIeSwitchPort(devices, number, q.qemuMachine.Type, memSize32bit, memSize64bit)
-}
-
-// getBARsMaxAddressableMemory we need to know the BAR sizes to configure the
-// PCIe Root Port or PCIe Downstream Port attaching a device with huge BARs.
-func (q *qemuArchBase) getBARsMaxAddressableMemory() (uint64, uint64) {
-
-	pci := nvpci.New()
-	devs, _ := pci.GetAllDevices()
-
-	// Since we do not know which devices are going to be hotplugged,
-	// we're going to use the GPU with the biggest BARs to initialize the
-	// root port, this should work for all other devices as well.
-	// defaults are 2MB for both, if no suitable devices found
-	max32bit := uint64(2 * 1024 * 1024)
-	max64bit := uint64(2 * 1024 * 1024)
-
-	for _, dev := range devs {
-		if !dev.IsGPU() {
-			continue
-		}
-		memSize32bit, memSize64bit := dev.Resources.GetTotalAddressableMemory(true)
-		if max32bit < memSize32bit {
-			max32bit = memSize32bit
-		}
-		if max64bit < memSize64bit {
-			max64bit = memSize64bit
-		}
-	}
-	// The actual 32bit is most of the time a power of 2 but we need some
-	// buffer so double that to leave space for other IO functions.
-	// The 64bit size is not a power of 2 and hence is already rounded up
-	// to the higher value.
-	return max32bit * 2, max64bit
+func (q *qemuArchBase) appendPCIeSwitchPortDevice(devices []govmmQemu.Device, number uint32) []govmmQemu.Device {
+	return genericAppendPCIeSwitchPort(devices, number, q.qemuMachine.Type)
 }
 
 // appendIOMMU appends a virtual IOMMU device

src/runtime/virtcontainers/sandbox.go

@@ -189,6 +189,11 @@ type SandboxConfig struct {
 
 	// ForceGuestPull enforces guest pull independent of snapshotter annotations.
 	ForceGuestPull bool
+
+	// KubeletRootDir is the kubelet root directory (e.g. /var/lib/kubelet or
+	// /var/lib/k0s/kubelet for k0s). If empty, the runtime uses the default
+	// /var/lib/kubelet for matching ConfigMap/Secret volume paths.
+	KubeletRootDir string
 }
 
 // valid checks that the sandbox configuration is valid.

tools/packaging/kata-deploy/binary/src/artifacts/install.rs

@@ -71,7 +71,7 @@ fn get_hypervisor_name(shim: &str) -> Result<&str> {
     }
 }
 
-pub async fn install_artifacts(config: &Config) -> Result<()> {
+pub async fn install_artifacts(config: &Config, container_runtime: &str) -> Result<()> {
     info!("copying kata artifacts onto host");
 
     // Create the installation directory if it doesn't exist
@@ -99,12 +99,12 @@ pub async fn install_artifacts(config: &Config) -> Result<()> {
     set_executable_permissions(&config.host_install_dir)?;
 
     for shim in &config.shims_for_arch {
-        configure_shim_config(config, shim).await?;
+        configure_shim_config(config, shim, container_runtime).await?;
     }
 
     // Install custom runtime configuration files if enabled
     if config.custom_runtimes_enabled && !config.custom_runtimes.is_empty() {
-        install_custom_runtime_configs(config)?;
+        install_custom_runtime_configs(config, container_runtime)?;
     }
 
     if std::env::var("HOST_OS").unwrap_or_default() == "cbl-mariner" {
@@ -146,7 +146,12 @@ pub async fn remove_artifacts(config: &Config) -> Result<()> {
 
 /// Write the common drop-in configuration files for a shim.
 /// This is shared between standard runtimes and custom runtimes.
-fn write_common_drop_ins(config: &Config, shim: &str, config_d_dir: &str) -> Result<()> {
+fn write_common_drop_ins(
+    config: &Config,
+    shim: &str,
+    config_d_dir: &str,
+    container_runtime: &str,
+) -> Result<()> {
     info!("Generating drop-in configuration files for shim: {}", shim);
 
     // 1. Installation prefix adjustments (if not default)
@@ -163,6 +168,15 @@ fn write_common_drop_ins(config: &Config, shim: &str, config_d_dir: &str) -> Res
         write_drop_in_file(config_d_dir, "20-debug.toml", &debug_content)?;
     }
 
+    // 2b. k0s: set kubelet root dir so ConfigMap/Secret volume propagation works (non-Rust shims only)
+    if (container_runtime == "k0s-worker" || container_runtime == "k0s-controller")
+        && !utils::is_rust_shim(shim)
+    {
+        info!("  - k0s: setting kubelet_root_dir for ConfigMap/Secret propagation");
+        let k0s_content = generate_k0s_kubelet_root_drop_in();
+        write_drop_in_file(config_d_dir, "22-k0s-kubelet-root.toml", &k0s_content)?;
+    }
+
     // 3. Combined kernel_params (proxy, debug, etc.)
     // Reads base kernel_params from original config and combines with new params
     let kernel_params_content = generate_kernel_params_drop_in(config, shim)?;
@@ -176,8 +190,8 @@ fn write_common_drop_ins(config: &Config, shim: &str, config_d_dir: &str) -> Res
 
 /// Each custom runtime gets an isolated directory under custom-runtimes/{handler}/
 /// Custom runtimes inherit the same drop-in configurations as standard runtimes
-/// (installation prefix, debug, kernel_params) plus any user-provided overrides.
-fn install_custom_runtime_configs(config: &Config) -> Result<()> {
+/// (installation prefix, debug, kernel_params, and for k0s on Go/remote runtime: kubelet root) plus any user-provided overrides.
+fn install_custom_runtime_configs(config: &Config, container_runtime: &str) -> Result<()> {
     info!("Installing custom runtime configuration files");
 
     for runtime in &config.custom_runtimes {
@@ -225,7 +239,7 @@ fn install_custom_runtime_configs(config: &Config) -> Result<()> {
         }
 
         // Generate the common drop-in files (shared with standard runtimes)
-        write_common_drop_ins(config, &runtime.base_config, &config_d_dir)?;
+        write_common_drop_ins(config, &runtime.base_config, &config_d_dir, container_runtime)?;
 
         // Copy user-provided drop-in file if provided (at 50-overrides.toml)
         if let Some(ref drop_in_src) = runtime.drop_in_file {
@@ -490,7 +504,7 @@ fn remove_runtime_directory(config: &Config, shim: &str) -> Result<()> {
     Ok(())
 }
 
-async fn configure_shim_config(config: &Config, shim: &str) -> Result<()> {
+async fn configure_shim_config(config: &Config, shim: &str, container_runtime: &str) -> Result<()> {
     // Set up the runtime directory structure with symlink to original config
     setup_runtime_directory(config, shim)?;
 
@@ -513,7 +527,7 @@ async fn configure_shim_config(config: &Config, shim: &str) -> Result<()> {
     }
 
     // Generate common drop-in files (shared with custom runtimes)
-    write_common_drop_ins(config, shim, &config_d_dir)?;
+    write_common_drop_ins(config, shim, &config_d_dir, container_runtime)?;
 
     configure_hypervisor_annotations(config, shim, &kata_config_file).await?;
 
@@ -678,6 +692,19 @@ fn generate_installation_prefix_drop_in(config: &Config, shim: &str) -> Result<S
     Ok(content)
 }
 
+/// Generate drop-in content for k0s kubelet root directory.
+/// k0s uses /var/lib/k0s/kubelet instead of /var/lib/kubelet; setting this
+/// allows the runtime to match ConfigMap/Secret volume paths for propagation.
+fn generate_k0s_kubelet_root_drop_in() -> String {
+    r#"# k0s kubelet root directory
+# Generated by kata-deploy for k0s (ConfigMap/Secret volume propagation)
+
+[runtime]
+kubelet_root_dir = "/var/lib/k0s/kubelet"
+"#
+    .to_string()
+}
+
 /// Generate drop-in content for debug configuration.
 /// Enables debug settings for the hypervisor, runtime, and agent.
 /// Note: kernel_params for debug are handled separately in generate_kernel_params_drop_in

tools/packaging/kata-deploy/binary/src/artifacts/snapshotters.rs

@@ -4,6 +4,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::config::Config;
+use crate::runtime::containerd;
 use crate::utils;
 use crate::utils::toml as toml_utils;
 use anyhow::Result;
@@ -88,15 +89,12 @@ pub async fn configure_snapshotter(
     // Get all paths and drop-in capability in one call
     let paths = config.get_containerd_paths(runtime).await?;
 
-    // Read containerd version from config_file to determine pluginid
-    let pluginid = if fs::read_to_string(&paths.config_file)
-        .unwrap_or_default()
-        .contains("version = 3")
-    {
-        "\"io.containerd.cri.v1.images\""
-    } else {
-        "\"io.containerd.grpc.v1.cri\".containerd"
+    // Runtime plugin id (from paths or by reading config), then map to table where disable_snapshot_annotations lives.
+    let runtime_plugin_id = match &paths.plugin_id {
+        Some(id) => id.as_str(),
+        None => containerd::get_containerd_pluginid(&paths.config_file)?,
     };
+    let pluginid = containerd::pluginid_for_snapshotter_annotations(runtime_plugin_id, &paths.config_file)?;
 
     let configuration_file: std::path::PathBuf = if paths.use_drop_in {
         // Only add /host prefix if path is not in /etc/containerd (which is mounted from host)

tools/packaging/kata-deploy/binary/src/main.rs

@@ -189,7 +189,7 @@ async fn install(config: &config::Config, runtime: &str) -> Result<()> {
 
     runtime::containerd::setup_containerd_config_files(runtime, config).await?;
 
-    artifacts::install_artifacts(config).await?;
+    artifacts::install_artifacts(config, runtime).await?;
 
     runtime::configure_cri_runtime(config, runtime).await?;
 

tools/packaging/kata-deploy/binary/src/runtime/containerd.rs

@@ -33,8 +33,11 @@ const CONTAINERD_V2_CRI_PLUGIN_ID: &str = "\"io.containerd.grpc.v1.cri\"";
 const CONTAINERD_LEGACY_CRI_PLUGIN_ID: &str = "cri";
 /// Plugin ID for CRI images in containerd config v3 (version = 3).
 const CONTAINERD_CRI_IMAGES_PLUGIN_ID: &str = "\"io.containerd.cri.v1.images\"";
+/// Plugin table for CRI containerd in v2 (disable_snapshot_annotations lives here).
+const CONTAINERD_CRI_CONTAINERD_TABLE_V2: &str = "\"io.containerd.grpc.v1.cri\".containerd";
 
-fn get_containerd_pluginid(config_file: &str) -> Result<&'static str> {
+/// Reads config and returns the CRI plugin ID used for *runtime* config (runtimes, snapshotter-per-runtime).
+pub(crate) fn get_containerd_pluginid(config_file: &str) -> Result<&'static str> {
     let content = fs::read_to_string(config_file)
         .with_context(|| format!("Failed to read containerd config file: {}", config_file))?;
 
@@ -52,6 +55,24 @@ fn is_containerd_v3_config(pluginid: &str) -> bool {
     pluginid == CONTAINERD_V3_RUNTIME_PLUGIN_ID
 }
 
+/// Maps the runtime plugin ID (from get_containerd_pluginid) to the plugin table where
+/// disable_snapshot_annotations lives. In v3 that's the *images* plugin; in v2 the CRI .containerd subtable.
+pub(crate) fn pluginid_for_snapshotter_annotations(
+    runtime_plugin_id: &str,
+    config_file: &str,
+) -> Result<&'static str> {
+    if runtime_plugin_id == CONTAINERD_V3_RUNTIME_PLUGIN_ID {
+        Ok(CONTAINERD_CRI_IMAGES_PLUGIN_ID)
+    } else if runtime_plugin_id == CONTAINERD_V2_CRI_PLUGIN_ID {
+        Ok(CONTAINERD_CRI_CONTAINERD_TABLE_V2)
+    } else {
+        anyhow::bail!(
+            "Containerd config {} has no \"version = 2\" or \"version = 3\"; cannot determine CRI plugin for snapshotter config",
+            config_file
+        )
+    }
+}
+
 fn get_containerd_output_path(paths: &ContainerdPaths) -> PathBuf {
     if paths.use_drop_in {
         if paths.drop_in_file.starts_with("/etc/containerd/") {
@@ -636,6 +657,40 @@ mod tests {
         }
     }
 
+    /// pluginid_for_snapshotter_annotations maps runtime plugin id to the table where disable_snapshot_annotations lives.
+    #[rstest]
+    #[case(CONTAINERD_V3_RUNTIME_PLUGIN_ID, CONTAINERD_CRI_IMAGES_PLUGIN_ID, false)]
+    #[case(CONTAINERD_V2_CRI_PLUGIN_ID, CONTAINERD_CRI_CONTAINERD_TABLE_V2, false)]
+    #[case(CONTAINERD_LEGACY_CRI_PLUGIN_ID, "", true)]
+    fn test_pluginid_for_snapshotter_annotations(
+        #[case] runtime_plugin_id: &str,
+        #[case] expected_plugin_id: &str,
+        #[case] expect_err: bool,
+    ) {
+        let config_file = "/etc/containerd/config.toml";
+        let result = pluginid_for_snapshotter_annotations(runtime_plugin_id, config_file);
+        if expect_err {
+            let err = result.unwrap_err();
+            assert!(
+                err.to_string().contains(config_file),
+                "error should mention config file: {}",
+                err
+            );
+            assert!(
+                err.to_string().contains("version = 2") || err.to_string().contains("version = 3"),
+                "error should mention version: {}",
+                err
+            );
+        } else {
+            assert_eq!(
+                result.unwrap(),
+                expected_plugin_id,
+                "runtime_plugin_id={}",
+                runtime_plugin_id
+            );
+        }
+    }
+
     /// Written containerd config (e.g. drop-in) must not start with blank lines when written to an initially empty file.
     #[rstest]
     #[case(CONTAINERD_V3_RUNTIME_PLUGIN_ID)]