tests: k8s: coco: Use a var for AUTHENTICATED_IMAGE_PASSWORD

It's a bot password that only has read permissions for that image, no need to use a secret here. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
build: ci: remove KBUILD_SIGN_PIN entirely
2026-02-28 01:32:13 +00:00 · 2026-02-15 23:12:02 +01:00 · 2026-02-15 18:52:18 +01:00 · 2026-02-15 16:24:30 +01:00
215 changed files with 2656 additions and 3570 deletions
--- a/.github/workflows/build-checks.yaml
+++ b/.github/workflows/build-checks.yaml
@@ -94,19 +94,11 @@ jobs:
          ./ci/install_yq.sh
        env:
          INSTALL_IN_GOPATH: false
-      - name: Read properties from versions.yaml
+      - name: Install golang
        if: contains(matrix.component.needs, 'golang')
        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        if: contains(matrix.component.needs, 'golang')
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          # Setup-go doesn't work properly with ppc64le: https://github.com/actions/setup-go/issues/648
-          architecture: ${{ contains(inputs.instance, 'ppc64le') && 'ppc64le' || '' }}
+          ./tests/install_go.sh -f -p
+          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
      - name: Setup rust
        if: contains(matrix.component.needs, 'rust')
        run: |
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -23,8 +23,6 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: false
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -102,7 +100,6 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: Parse OCI image name and digest
        id: parse-oci-segments
@@ -215,7 +212,6 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: store-artifact ${{ matrix.asset }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -23,8 +23,6 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: false
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -90,7 +88,6 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: Parse OCI image name and digest
        id: parse-oci-segments
@@ -197,7 +194,6 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: store-artifact ${{ matrix.asset }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
--- a/.github/workflows/build-kata-static-tarball-s390x.yaml
+++ b/.github/workflows/build-kata-static-tarball-s390x.yaml
@@ -21,8 +21,6 @@ on:
        type: string
        default: ""
    secrets:
-      CI_HKD_PATH:
-        required: true
      QUAY_DEPLOYER_PASSWORD:
        required: true

@@ -197,60 +195,11 @@ jobs:
          retention-days: 15
          if-no-files-found: error

-  build-asset-boot-image-se:
-    name: build-asset-boot-image-se
-    runs-on: s390x
-    needs: [build-asset, build-asset-rootfs]
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Place a host key document
-        run: |
-          mkdir -p "host-key-document"
-          cp "${CI_HKD_PATH}" "host-key-document"
-        env:
-          CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
-
-      - name: Build boot-image-se
-        run: |
-          ./tests/gha-adjust-to-use-prebuilt-components.sh kata-artifacts "boot-image-se"
-          make boot-image-se-tarball
-          build_dir=$(readlink -f build)
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R "$(id -u)":"$(id -g)" "kata-build"
-        env:
-          HKD_PATH: "host-key-document"
-
-      - name: store-artifact boot-image-se
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: kata-artifacts-s390x${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-boot-image-se.tar.zst
-          retention-days: 1
-          if-no-files-found: error
-
  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts:
    name: remove-rootfs-binary-artifacts
    runs-on: ubuntu-22.04
-    needs: [build-asset-rootfs, build-asset-boot-image-se]
+    needs: [build-asset-rootfs]
    strategy:
      matrix:
        asset:
@@ -331,7 +280,6 @@ jobs:
    needs:
      - build-asset
      - build-asset-rootfs
-      - build-asset-boot-image-se
      - build-asset-shim-v2
    permissions:
      contents: read
--- a/.github/workflows/ci-coco-stability.yaml
+++ b/.github/workflows/ci-coco-stability.yaml
@@ -25,9 +25,8 @@ jobs:
      tag: ${{ github.sha }}-weekly
      target-branch: ${{ github.ref_name }}
    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      AZ_APPID: ${{ secrets.AZ_APPID }}
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
--- a/.github/workflows/ci-devel.yaml
+++ b/.github/workflows/ci-devel.yaml
@@ -19,15 +19,13 @@ jobs:
      target-branch: ${{ github.ref_name }}

    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      AZ_APPID: ${{ secrets.AZ_APPID }}
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      ITA_KEY: ${{ secrets.ITA_KEY }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-checks:
    uses: ./.github/workflows/build-checks.yaml
--- a/.github/workflows/ci-nightly.yaml
+++ b/.github/workflows/ci-nightly.yaml
@@ -23,12 +23,10 @@ jobs:
      tag: ${{ github.sha }}-nightly
      target-branch: ${{ github.ref_name }}
    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      AZ_APPID: ${{ secrets.AZ_APPID }}
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      ITA_KEY: ${{ secrets.ITA_KEY }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
--- a/.github/workflows/ci-on-push.yaml
+++ b/.github/workflows/ci-on-push.yaml
@@ -43,12 +43,10 @@ jobs:
      target-branch: ${{ github.event.pull_request.base.ref }}
      skip-test: ${{ needs.skipper.outputs.skip_test }}
    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      AZ_APPID: ${{ secrets.AZ_APPID }}
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      ITA_KEY: ${{ secrets.ITA_KEY }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
--- a/.github/workflows/ci-weekly.yaml
+++ b/.github/workflows/ci-weekly.yaml
@@ -27,8 +27,6 @@ on:
        required: true
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -44,8 +42,6 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  publish-kata-deploy-payload-amd64:
    needs: build-kata-static-tarball-amd64
@@ -119,7 +115,7 @@ jobs:
      target-branch: ${{ inputs.target-branch }}
      tarball-suffix: -${{ inputs.tag }}
    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      AZ_APPID: ${{ secrets.AZ_APPID }}
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -29,16 +29,12 @@ on:
       required: true
      AZ_SUBSCRIPTION_ID:
        required: true
-      CI_HKD_PATH:
-        required: true
      ITA_KEY:
        required: true
      QUAY_DEPLOYER_PASSWORD:
        required: true
      NGC_API_KEY:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -54,8 +50,6 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  publish-kata-deploy-payload-amd64:
    needs: build-kata-static-tarball-amd64
@@ -86,8 +80,6 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  publish-kata-deploy-payload-arm64:
    needs: build-kata-static-tarball-arm64
@@ -119,7 +111,6 @@ jobs:
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
    secrets:
-      CI_HKD_PATH: ${{ secrets.ci_hkd_path }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  build-kata-static-tarball-ppc64le:
@@ -297,21 +288,6 @@ jobs:
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}

-  run-k8s-tests-on-free-runner:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-amd64
-    permissions:
-      contents: read
-    uses: ./.github/workflows/run-k8s-tests-on-free-runner.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
  run-k8s-tests-on-arm64:
    if: ${{ inputs.skip-test != 'yes' }}
    needs: publish-kata-deploy-payload-arm64
@@ -359,7 +335,7 @@ jobs:
      pr-number: ${{ inputs.pr-number }}
      target-branch: ${{ inputs.target-branch }}
    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      AZ_APPID: ${{ secrets.AZ_APPID }}
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
@@ -377,7 +353,7 @@ jobs:
      pr-number: ${{ inputs.pr-number }}
      target-branch: ${{ inputs.target-branch }}
    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}

  run-k8s-tests-on-ppc64le:
    if: ${{ inputs.skip-test != 'yes' }}
--- a/.github/workflows/payload-after-push.yaml
+++ b/.github/workflows/payload-after-push.yaml
@@ -24,7 +24,6 @@ jobs:
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-arm64:
    permissions:
@@ -39,7 +38,6 @@ jobs:
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-s390x:
    permissions:
@@ -53,7 +51,6 @@ jobs:
      push-to-registry: yes
      target-branch: ${{ github.ref_name }}
    secrets:
-      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  build-assets-ppc64le:
--- a/.github/workflows/release-amd64.yaml
+++ b/.github/workflows/release-amd64.yaml
@@ -8,8 +8,6 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -21,7 +19,6 @@ jobs:
      stage: release
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
    permissions:
      contents: read
      packages: write
--- a/.github/workflows/release-arm64.yaml
+++ b/.github/workflows/release-arm64.yaml
@@ -8,8 +8,6 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

 permissions: {}

@@ -21,7 +19,6 @@ jobs:
      stage: release
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
    permissions:
      contents: read
      packages: write
--- a/.github/workflows/release-s390x.yaml
+++ b/.github/workflows/release-s390x.yaml
@@ -6,8 +6,6 @@ on:
        required: true
        type: string
    secrets:
-      CI_HKD_PATH:
-        required: true
      QUAY_DEPLOYER_PASSWORD:
        required: true

@@ -20,7 +18,6 @@ jobs:
      push-to-registry: yes
      stage: release
    secrets:
-      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
    permissions:
      contents: read
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -35,7 +35,6 @@ jobs:
      target-arch: amd64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-and-push-assets-arm64:
    needs: release
@@ -49,7 +48,6 @@ jobs:
      target-arch: arm64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-and-push-assets-s390x:
    needs: release
@@ -62,7 +60,6 @@ jobs:
    with:
      target-arch: s390x
    secrets:
-      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  build-and-push-assets-ppc64le:
--- a/.github/workflows/run-k8s-tests-on-aks.yaml
+++ b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -42,6 +42,17 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
+        host_os:
+          - ubuntu
+        vmm:
+          - clh
+          - dragonball
+          - qemu
+          - qemu-runtime-rs
+          - cloud-hypervisor
+        instance-type:
+          - small
+          - normal
        include:
          - host_os: cbl-mariner
            vmm: clh
@@ -69,7 +80,6 @@ jobs:
      KUBERNETES: "vanilla"
      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
-      RUNS_ON_AKS: "true"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
--- a/.github/workflows/run-k8s-tests-on-free-runner.yaml
+++ b/.github/workflows/run-k8s-tests-on-free-runner.yaml
@@ -1,127 +0,0 @@
-# Run Kubernetes integration tests on free GitHub runners  with a locally
-# deployed cluster (kubeadm).
-name: CI | Run kubernetes tests on free runner
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-permissions: {}
-
-jobs:
-  run-k8s-tests:
-    name: run-k8s-tests
-    strategy:
-      fail-fast: false
-      matrix:
-        environment: [
-          { vmm: clh, containerd_version: lts },
-          { vmm: clh, containerd_version: active },
-          { vmm: dragonball, containerd_version: lts },
-          { vmm: dragonball, containerd_version: active },
-          { vmm: qemu, containerd_version: lts },
-          { vmm: qemu, containerd_version: active },
-          { vmm: qemu-runtime-rs, containerd_version: lts },
-          { vmm: qemu-runtime-rs, containerd_version: active },
-          { vmm: cloud-hypervisor, containerd_version: lts },
-          { vmm: cloud-hypervisor, containerd_version: active },
-        ]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ubuntu
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
-      KUBERNETES: vanilla
-      K8S_TEST_HOST_TYPE: baremetal-no-attestation
-      CONTAINER_ENGINE: containerd
-      CONTAINER_ENGINE_VERSION: ${{ matrix.environment.containerd_version }}
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
-
-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
-
-      - name: Deploy k8s (kubeadm)
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Deploy Kata
-        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
--- a/.github/workflows/run-k8s-tests-on-zvsi.yaml
+++ b/.github/workflows/run-k8s-tests-on-zvsi.yaml
@@ -76,7 +76,7 @@ jobs:
      SNAPSHOTTER: ${{ matrix.snapshotter }}
      TARGET_ARCH: "s390x"
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
--- a/.github/workflows/run-kata-coco-stability-tests.yaml
+++ b/.github/workflows/run-kata-coco-stability-tests.yaml
@@ -69,7 +69,7 @@ jobs:
      KUBERNETES: "vanilla"
      PULL_TYPE: ${{ matrix.pull-type }}
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
--- a/.github/workflows/run-kata-coco-tests.yaml
+++ b/.github/workflows/run-kata-coco-tests.yaml
@@ -63,7 +63,7 @@ jobs:
      SNAPSHOTTER: "nydus"
      PULL_TYPE: "guest-pull"
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
      GH_ITA_KEY: ${{ secrets.ITA_KEY }}
      AUTO_GENERATE_POLICY: "yes"
    steps:
@@ -140,36 +140,42 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        environment: [
-          { vmm: qemu-coco-dev, snapshotter: nydus, pull_type: guest-pull },
-          { vmm: qemu-coco-dev-runtime-rs, snapshotter: nydus, pull_type: guest-pull },
-          { vmm: qemu-coco-dev, snapshotter: "", pull_type: experimental-force-guest-pull },
-        ]
-    runs-on: ubuntu-24.04
+        vmm:
+          - qemu-coco-dev
+          - qemu-coco-dev-runtime-rs
+        snapshotter:
+          - nydus
+        pull-type:
+          - guest-pull
+        include:
+          - pull-type: experimental-force-guest-pull
+            vmm: qemu-coco-dev
+            snapshotter: ""
+    runs-on: ubuntu-22.04
    permissions:
-      contents: read
+      id-token: write # Used for OIDC access to log into Azure
    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
      DOCKER_TAG: ${{ inputs.tag }}
      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
      # Some tests rely on that variable to run (or not)
      KBS: "true"
      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: "nodeport"
+      KBS_INGRESS: "aks"
      KUBERNETES: "vanilla"
-      PULL_TYPE: ${{ matrix.environment.pull_type }}
+      PULL_TYPE: ${{ matrix.pull-type }}
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      SNAPSHOTTER: ${{ matrix.environment.snapshotter }}
-      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.environment.pull_type == 'experimental-force-guest-pull' && matrix.environment.vmm || '' }}
-      AUTO_GENERATE_POLICY: "yes"
+      AUTHENTICATED_IMAGE_PASSWORD: ${{ vars.AUTHENTICATED_IMAGE_PASSWORD }}
+      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.pull-type == 'experimental-force-guest-pull' && matrix.vmm || '' }}
+      # Caution: current ingress controller used to expose the KBS service
+      # requires much vCPUs, lefting only a few for the tests. Depending on the
+      # host type chose it will result on the creation of a cluster with
+      # insufficient resources.
      K8S_TEST_HOST_TYPE: "all"
-      CONTAINER_ENGINE: "containerd"
-      CONTAINER_ENGINE_VERSION: "active"
-      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -192,36 +198,39 @@ jobs:
      - name: Install kata-tools
        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts

-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
+      - name: Log into the Azure account
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+        with:
+          client-id: ${{ secrets.AZ_APPID }}
+          tenant-id: ${{ secrets.AZ_TENANT_ID }}
+          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}

-      - name: Deploy kubernetes
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+      - name: Create AKS cluster
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 15
+          max_attempts: 20
+          retry_on: error
+          retry_wait_seconds: 10
+          command: bash tests/integration/kubernetes/gha-run.sh create-cluster

      - name: Install `bats`
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

+      - name: Install `kubectl`
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'
+
+      - name: Download credentials for the Kubernetes CLI to use them
+        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
+
      - name: Deploy Kata
        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
        env:
-          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ matrix.environment.snapshotter == 'nydus' }}
+          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ env.SNAPSHOTTER == 'nydus' }}
+          AUTO_GENERATE_POLICY: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && 'no' || 'yes' }}

      - name: Deploy CoCo KBS
        timeout-minutes: 10
@@ -243,20 +252,18 @@ jobs:
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh report-tests

-      - name: Delete kata-deploy
+      - name: Refresh OIDC token in case access token expired
+        if: always()
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+        with:
+          client-id: ${{ secrets.AZ_APPID }}
+          tenant-id: ${{ secrets.AZ_TENANT_ID }}
+          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+
+      - name: Delete AKS cluster
        if: always()
        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CoCo KBS
-        if: always()
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-
-      - name: Delete CSI driver
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
+        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

  # Generate jobs for testing CoCo on non-TEE environments with erofs-snapshotter
  run-k8s-tests-coco-nontee-with-erofs-snapshotter:
@@ -284,7 +291,7 @@ jobs:
      KBS_INGRESS: ""
      KUBERNETES: "vanilla"
      CONTAINER_ENGINE: "containerd"
-      CONTAINER_ENGINE_VERSION: "active"
+      CONTAINER_ENGINE_VERSION: "v2.2"
      PULL_TYPE: ${{ matrix.pull-type }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
      USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: "true"
@@ -292,7 +299,6 @@ jobs:
      # We are skipping the auto generated policy tests for now,
      # but those should be enabled as soon as we work on that.
      AUTO_GENERATE_POLICY: "no"
-      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -336,6 +342,8 @@ jobs:
      - name: Deploy kubernetes
        timeout-minutes: 15
        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+        env:
+          GH_TOKEN: ${{ github.token }}

      - name: Install `bats`
        run: bash tests/integration/kubernetes/gha-run.sh install-bats
@@ -355,13 +363,3 @@ jobs:
      - name: Report tests
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CSI driver
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -44,7 +44,9 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "async-trait",
+ "futures 0.1.31",
 "kata-types",
+ "log",
 "logging",
 "nix 0.26.4",
 "oci-spec 0.8.3",
@@ -139,12 +141,23 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
 dependencies = [
- "event-listener",
+ "event-listener 5.4.1",
 "event-listener-strategy",
 "futures-core",
 "pin-project-lite",
 ]

+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener 2.5.3",
+ "futures-core",
+]
+
 [[package]]
 name = "async-channel"
 version = "2.5.0"
@@ -171,6 +184,21 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "async-global-executor"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b1b633a2115cd122d73b955eadd9916c18c8f510ec9cd1686404c60ad1c29c"
+dependencies = [
+ "async-channel 2.5.0",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "blocking",
+ "futures-lite",
+ "once_cell",
+]
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -195,7 +223,7 @@ version = "3.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5fd03604047cee9b6ce9de9f70c6cd540a0520c813cbd49bae61f33ab80ed1dc"
 dependencies = [
- "event-listener",
+ "event-listener 5.4.1",
 "event-listener-strategy",
 "pin-project-lite",
 ]
@@ -206,14 +234,14 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
- "async-channel",
+ "async-channel 2.5.0",
 "async-io",
 "async-lock",
 "async-signal",
 "async-task",
 "blocking",
 "cfg-if 1.0.0",
- "event-listener",
+ "event-listener 5.4.1",
 "futures-lite",
 "rustix 1.1.2",
 ]
@@ -247,6 +275,32 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "async-std"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c8e079a4ab67ae52b7403632e4618815d6db36d2a010cfe41b02c1b1578f93b"
+dependencies = [
+ "async-channel 1.9.0",
+ "async-global-executor",
+ "async-io",
+ "async-lock",
+ "crossbeam-utils",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-lite",
+ "gloo-timers",
+ "kv-log-macro",
+ "log",
+ "memchr",
+ "once_cell",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+ "wasm-bindgen-futures",
+]
+
 [[package]]
 name = "async-task"
 version = "4.7.1"
@@ -393,7 +447,7 @@ version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
 dependencies = [
- "async-channel",
+ "async-channel 2.5.0",
 "async-task",
 "futures-io",
 "futures-lite",
@@ -590,17 +644,29 @@ dependencies = [
 "containerd-shim-protos",
 "kata-sys-util",
 "kata-types",
+ "lazy_static",
 "nix 0.26.4",
 "oci-spec 0.8.3",
+ "persist",
 "protobuf",
 "protocols",
 "resource",
 "runtime-spec",
+ "serde_json",
+ "slog",
+ "slog-scope",
 "strum 0.24.1",
 "thiserror 1.0.48",
 "tokio",
+ "ttrpc",
 ]

+[[package]]
+name = "common-path"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2382f75942f4b3be3690fe4f86365e9c853c1587d6ee58212cebf6e2a9ccd101"
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -645,7 +711,7 @@ dependencies = [
 "async-trait",
 "cgroups-rs 0.3.4",
 "containerd-shim-protos",
- "futures",
+ "futures 0.3.28",
 "go-flag",
 "lazy_static",
 "libc",
@@ -978,6 +1044,7 @@ dependencies = [
 "dbs-interrupt",
 "dbs-utils",
 "dbs-virtio-devices",
+ "downcast-rs",
 "kvm-bindings",
 "kvm-ioctls",
 "libc",
@@ -990,6 +1057,7 @@ dependencies = [
 "vfio-ioctls",
 "virtio-queue",
 "vm-memory",
+ "vmm-sys-util 0.11.1",
 ]

 [[package]]
@@ -1006,6 +1074,7 @@ dependencies = [
 name = "dbs-upcall"
 version = "0.3.0"
 dependencies = [
+ "anyhow",
 "dbs-utils",
 "dbs-virtio-devices",
 "log",
@@ -1200,6 +1269,12 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"

+[[package]]
+name = "downcast-rs"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
+
 [[package]]
 name = "dragonball"
 version = "0.1.0"
@@ -1220,6 +1295,7 @@ dependencies = [
 "dbs-utils",
 "dbs-virtio-devices",
 "derivative",
+ "fuse-backend-rs",
 "kvm-bindings",
 "kvm-ioctls",
 "lazy_static",
@@ -1274,18 +1350,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"

-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1339,6 +1403,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
 [[package]]
 name = "event-listener"
 version = "5.4.1"
@@ -1356,7 +1426,7 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
 dependencies = [
- "event-listener",
+ "event-listener 5.4.1",
 "pin-project-lite",
 ]

@@ -1484,6 +1554,12 @@ dependencies = [
 "vmm-sys-util 0.11.1",
 ]

+[[package]]
+name = "futures"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
+
 [[package]]
 name = "futures"
 version = "0.3.28"
@@ -1643,6 +1719,18 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"

+[[package]]
+name = "gloo-timers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "go-flag"
 version = "0.1.0"
@@ -1878,7 +1966,7 @@ dependencies = [
 "crossbeam-channel",
 "dbs-utils",
 "dragonball",
- "futures",
+ "futures 0.3.28",
 "go-flag",
 "hyper",
 "hyperlocal",
@@ -1889,8 +1977,10 @@ dependencies = [
 "libc",
 "logging",
 "nix 0.26.4",
+ "oci-spec 0.8.3",
 "path-clean",
 "persist",
+ "protobuf",
 "protocols",
 "qapi",
 "qapi-qmp",
@@ -1902,6 +1992,7 @@ dependencies = [
 "serde",
 "serde_json",
 "serial_test 2.0.0",
+ "shim-interface",
 "slog",
 "slog-scope",
 "tempfile",
@@ -2178,6 +2269,8 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "byteorder",
+ "chrono",
+ "common-path",
 "fail",
 "hex",
 "kata-types",
@@ -2186,9 +2279,11 @@ dependencies = [
 "mockall",
 "nix 0.26.4",
 "oci-spec 0.8.3",
+ "once_cell",
 "pci-ids",
 "rand 0.8.5",
 "runtime-spec",
+ "safe-path 0.1.0",
 "serde",
 "serde_json",
 "slog",
@@ -2207,8 +2302,8 @@ dependencies = [
 "byte-unit",
 "flate2",
 "glob",
+ "hex",
 "lazy_static",
- "nix 0.26.4",
 "num_cpus",
 "oci-spec 0.8.3",
 "regex",
@@ -2219,10 +2314,18 @@ dependencies = [
 "sha2 0.10.9",
 "slog",
 "slog-scope",
- "sysctl",
 "sysinfo",
 "thiserror 1.0.48",
- "toml",
+ "toml 0.5.11",
+]
+
+[[package]]
+name = "kv-log-macro"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de8b303297635ad57c9f5059fd9cee7a47f8e8daa09df0fcd07dd39fb22977f"
+dependencies = [
+ "log",
 ]

 [[package]]
@@ -2543,7 +2646,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b65d130ee111430e47eed7896ea43ca693c387f097dd97376bffafbf25812128"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "log",
 "netlink-packet-core",
 "netlink-sys",
@@ -2557,7 +2660,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "416060d346fbaf1f23f9512963e3e878f1a78e707cb699ba9215761754244307"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "libc",
 "log",
 "tokio",
@@ -2714,7 +2817,7 @@ dependencies = [
 "log",
 "serde",
 "serde_json",
- "toml",
+ "toml 0.5.11",
 ]

 [[package]]
@@ -2941,7 +3044,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e785d273968748578931e4dc3b4f5ec86b26e09d9e0d66b55adda7fce742f7a"
 dependencies = [
 "async-trait",
- "futures",
+ "futures 0.3.28",
 "futures-executor",
 "headers",
 "http",
@@ -3109,9 +3212,11 @@ dependencies = [
 "async-trait",
 "kata-sys-util",
 "kata-types",
+ "libc",
 "safe-path 0.1.0",
 "serde",
 "serde_json",
+ "shim-interface",
 ]

 [[package]]
@@ -3521,7 +3626,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b047adab56acc4948d4b9b58693c1f33fd13efef2d6bb5f0f66a47436ceada8"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "log",
 "memchr",
 "qapi-qmp",
@@ -3803,10 +3908,11 @@ dependencies = [
 "agent",
 "anyhow",
 "async-trait",
+ "bitflags 2.10.0",
 "byte-unit",
 "cgroups-rs 0.5.0",
 "flate2",
- "futures",
+ "futures 0.3.28",
 "hex",
 "hypervisor",
 "inotify",
@@ -3816,6 +3922,7 @@ dependencies = [
 "libc",
 "logging",
 "netlink-packet-route",
+ "netlink-sys",
 "netns-rs",
 "nix 0.26.4",
 "oci-spec 0.8.3",
@@ -3900,6 +4007,7 @@ dependencies = [
 "common",
 "containerd-shim-protos",
 "go-flag",
+ "logging",
 "nix 0.26.4",
 "runtimes",
 "shim",
@@ -3910,6 +4018,7 @@ dependencies = [
 name = "runtime-spec"
 version = "0.1.0"
 dependencies = [
+ "libc",
 "serde",
 "serde_derive",
 "serde_json",
@@ -3923,6 +4032,7 @@ dependencies = [
 "anyhow",
 "common",
 "hyper",
+ "hyperlocal",
 "hypervisor",
 "kata-sys-util",
 "kata-types",
@@ -4241,7 +4351,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c789ec87f4687d022a2405cf46e0cd6284889f1839de292cadeb6c6019506f2"
 dependencies = [
 "dashmap",
- "futures",
+ "futures 0.3.28",
 "lazy_static",
 "log",
 "parking_lot",
@@ -4255,7 +4365,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e56dd856803e253c8f298af3f4d7eb0ae5e23a737252cd90bb4f3b435033b2d"
 dependencies = [
 "dashmap",
- "futures",
+ "futures 0.3.28",
 "lazy_static",
 "log",
 "parking_lot",
@@ -4295,10 +4405,12 @@ dependencies = [
 "containerd-shim-protos",
 "kata-types",
 "logging",
+ "persist",
 "runtimes",
 "slog",
 "slog-scope",
 "tokio",
+ "tracing",
 "ttrpc",
 ]

@@ -4362,7 +4474,9 @@ dependencies = [
 "nix 0.26.4",
 "oci-spec 0.8.3",
 "protobuf",
+ "rand 0.8.5",
 "runtime-spec",
+ "runtimes",
 "serial_test 0.10.0",
 "service",
 "sha2 0.10.9",
@@ -4371,8 +4485,11 @@ dependencies = [
 "slog-scope",
 "slog-stdlog",
 "tempfile",
+ "tests_utils",
 "thiserror 1.0.48",
 "tokio",
+ "tracing",
+ "tracing-opentelemetry",
 "unix_socket2",
 ]

@@ -4382,6 +4499,7 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "common",
+ "logging",
 "runtimes",
 "tokio",
 ]
@@ -4675,20 +4793,6 @@ dependencies = [
 "syn 2.0.104",
 ]

-[[package]]
-name = "sysctl"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cca424247104946a59dacd27eaad296223b7feec3d168a6dd04585183091eb0b"
-dependencies = [
- "bitflags 2.10.0",
- "byteorder",
- "enum-as-inner",
- "libc",
- "thiserror 2.0.12",
- "walkdir",
-]
-
 [[package]]
 name = "sysinfo"
 version = "0.34.2"
@@ -4979,12 +5083,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52a15c15b1bc91f90902347eff163b5b682643aff0c8e972912cca79bd9208dd"
 dependencies = [
 "bytes",
- "futures",
+ "futures 0.3.28",
 "libc",
 "tokio",
 "vsock",
 ]

+[[package]]
+name = "toml"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758664fc71a3a69038656bee8b6be6477d2a6c315a6b81f7081f591bffa4111f"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml"
 version = "0.5.11"
@@ -5127,7 +5240,7 @@ dependencies = [
 "async-trait",
 "byteorder",
 "crossbeam",
- "futures",
+ "futures 0.3.28",
 "home",
 "libc",
 "log",
@@ -5329,13 +5442,16 @@ version = "0.1.0"
 dependencies = [
 "agent",
 "anyhow",
+ "async-std",
 "async-trait",
 "awaitgroup",
 "common",
 "containerd-shim-protos",
+ "futures 0.3.28",
 "hypervisor",
 "kata-sys-util",
 "kata-types",
+ "lazy_static",
 "libc",
 "logging",
 "nix 0.26.4",
@@ -5351,6 +5467,7 @@ dependencies = [
 "slog-scope",
 "strum 0.24.1",
 "tokio",
+ "toml 0.4.10",
 "tracing",
 "url",
 "uuid 1.18.1",
@@ -5983,7 +6100,7 @@ dependencies = [
 "async-trait",
 "blocking",
 "enumflags2",
- "event-listener",
+ "event-listener 5.4.1",
 "futures-core",
 "futures-lite",
 "hex",
--- a/2
+++ b/2
@@ -1 +1 @@
-3.27.0
+3.26.0
--- a/docs/Limitations.md
+++ b/docs/Limitations.md
@@ -187,10 +187,9 @@ different compared to `runc` containers:
 into the guest and exposes it directly to the container.

 **Mounting guest devices**: When the source path of a hostPath volume is
-under `/dev` (or `/dev` itself), and the path corresponds to a
-non-regular file (i.e., a device, directory, or any other special file)
-or is not accessible by the Kata shim, the Kata agent bind mounts the
-source path directly from the *guest* filesystem into the container.
+under `/dev`, and the path either corresponds to a host device or is not
+accessible by the Kata shim, the Kata agent bind mounts the source path
+directly from the *guest* filesystem into the container.

 [runtime-config]: /src/runtime/README.md#configuration
 [k8s-hostpath]: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
--- a/docs/how-to/how-to-use-k8s-with-containerd-and-kata.md
+++ b/docs/how-to/how-to-use-k8s-with-containerd-and-kata.md
@@ -49,8 +49,6 @@ In order to allow Kubelet to use containerd (using the CRI interface), configure
  EOF
  ```

-  For Kata Containers (and especially CoCo / Confidential Containers tests), use at least `--runtime-request-timeout=600s` (10m) so CRI CreateContainerRequest does not time out.
-
 - Inform systemd about the new configuration

  ```bash
--- a/src/agent/Cargo.lock
+++ b/src/agent/Cargo.lock
@@ -743,6 +743,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"

+[[package]]
+name = "common-path"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2382f75942f4b3be3690fe4f86365e9c853c1587d6ee58212cebf6e2a9ccd101"
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -1092,18 +1098,6 @@ dependencies = [
 "serde",
 ]

-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.101",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.11"
@@ -2108,6 +2102,8 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "byteorder",
+ "chrono",
+ "common-path",
 "fail",
 "hex",
 "kata-types",
@@ -2116,9 +2112,11 @@ dependencies = [
 "mockall",
 "nix 0.26.4",
 "oci-spec",
+ "once_cell",
 "pci-ids",
 "rand",
 "runtime-spec",
+ "safe-path",
 "serde",
 "serde_json",
 "slog",
@@ -2137,8 +2135,8 @@ dependencies = [
 "byte-unit",
 "flate2",
 "glob",
+ "hex",
 "lazy_static",
- "nix 0.26.4",
 "num_cpus",
 "oci-spec",
 "regex",
@@ -2149,7 +2147,6 @@ dependencies = [
 "sha2 0.10.9",
 "slog",
 "slog-scope",
- "sysctl",
 "sysinfo",
 "thiserror 1.0.69",
 "toml",
@@ -2309,6 +2306,7 @@ name = "mem-agent"
 version = "0.2.0"
 dependencies = [
 "anyhow",
+ "async-trait",
 "chrono",
 "maplit",
 "nix 0.30.1",
@@ -3577,6 +3575,7 @@ dependencies = [
 name = "runtime-spec"
 version = "0.1.0"
 dependencies = [
+ "libc",
 "serde",
 "serde_derive",
 "serde_json",
@@ -4216,20 +4215,6 @@ dependencies = [
 "syn 2.0.101",
 ]

-[[package]]
-name = "sysctl"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cca424247104946a59dacd27eaad296223b7feec3d168a6dd04585183091eb0b"
-dependencies = [
- "bitflags 2.9.0",
- "byteorder",
- "enum-as-inner",
- "libc",
- "thiserror 2.0.12",
- "walkdir",
-]
-
 [[package]]
 name = "sysinfo"
 version = "0.34.2"
--- a/src/agent/rustjail/src/mount.rs
+++ b/src/agent/rustjail/src/mount.rs
@@ -857,7 +857,7 @@ fn mount_from(
        dest.as_str(),
        Some(mount_typ.as_str()),
        flags,
-        Some(d.as_str()).filter(|s| !s.is_empty()),
+        Some(d.as_str()),
    )
    .inspect_err(|e| log_child!(cfd_log, "mount error: {:?}", e))?;

--- a/src/dragonball/Cargo.toml
+++ b/src/dragonball/Cargo.toml
@@ -48,6 +48,7 @@ vmm-sys-util = { workspace = true }
 virtio-queue = { workspace = true, optional = true }
 vm-memory = { workspace = true, features = ["backend-mmap"] }
 crossbeam-channel = "0.5.6"
+fuse-backend-rs = "0.10.5"
 vfio-bindings = { workspace = true, optional = true }
 vfio-ioctls = { workspace = true, optional = true }

@@ -85,6 +86,3 @@ host-device = ["dep:vfio-bindings", "dep:vfio-ioctls", "dep:dbs-pci"]
 unexpected_cfgs = { level = "warn", check-cfg = [
  'cfg(feature, values("test-mock"))',
 ] }
-
-[package.metadata.cargo-machete]
-ignored = ["vfio-bindings"]
--- a/src/dragonball/dbs_pci/Cargo.toml
+++ b/src/dragonball/dbs_pci/Cargo.toml
@@ -23,22 +23,24 @@ dbs-interrupt = { workspace = true, features = [
    "kvm-legacy-irq",
    "kvm-msi-irq",
 ] }
+downcast-rs = "1.2.0"
 byteorder = "1.4.3"
 serde = "1.0.27"

-vm-memory = { workspace = true }
-kvm-ioctls = { workspace = true }
-kvm-bindings = { workspace = true }
-vfio-ioctls = { workspace = true }
-vfio-bindings = { workspace = true }
+vm-memory = {workspace = true}
+kvm-ioctls = {workspace = true}
+kvm-bindings = {workspace = true}
+vfio-ioctls = {workspace = true}
+vfio-bindings = {workspace = true}
 libc = "0.2.39"
-virtio-queue = { workspace = true }
-dbs-utils = { workspace = true }
+vmm-sys-util = {workspace = true}
+virtio-queue = {workspace = true}
+dbs-utils = {workspace = true}


 [dev-dependencies]
 dbs-arch = { workspace = true }
-kvm-ioctls = { workspace = true }
+kvm-ioctls = {workspace = true}
 test-utils = { workspace = true }
 nix = { workspace = true }

--- a/src/dragonball/dbs_upcall/Cargo.toml
+++ b/src/dragonball/dbs_upcall/Cargo.toml
@@ -11,6 +11,7 @@ keywords = ["dragonball", "secure-sandbox", "devices", "upcall", "virtio"]
 readme = "README.md"

 [dependencies]
+anyhow = "1"
 log = "0.4.14"
 thiserror = "1"
 timerfd = "1.2.0"
--- a/src/dragonball/dbs_virtio_devices/Cargo.toml
+++ b/src/dragonball/dbs_virtio_devices/Cargo.toml
@@ -24,8 +24,8 @@ dbs-boot = { workspace = true }
 epoll = ">=4.3.1, <4.3.2"
 io-uring = "0.5.2"
 fuse-backend-rs = { version = "0.10.5", optional = true }
-kvm-bindings = { workspace = true }
-kvm-ioctls = { workspace = true }
+kvm-bindings = { workspace = true}
+kvm-ioctls = {workspace = true}
 libc = "0.2.119"
 log = "0.4.14"
 nix = "0.24.3"
@@ -37,16 +37,19 @@ serde = "1.0.27"
 serde_json = "1.0.9"
 thiserror = "1"
 threadpool = "1"
-virtio-bindings = { workspace = true }
-virtio-queue = { workspace = true }
-vmm-sys-util = { workspace = true }
+virtio-bindings = {workspace = true}
+virtio-queue = {workspace = true}
+vmm-sys-util = {workspace = true}
 vm-memory = { workspace = true, features = ["backend-mmap"] }
 sendfd = "0.4.3"
 vhost-rs = { version = "0.6.1", package = "vhost", optional = true }
 timerfd = "1.0"

 [dev-dependencies]
-vm-memory = { workspace = true, features = ["backend-mmap", "backend-atomic"] }
+vm-memory = { workspace = true, features = [
+    "backend-mmap",
+    "backend-atomic",
+] }
 test-utils = { workspace = true }

 [features]
--- a/src/dragonball/dbs_virtio_devices/src/lib.rs
+++ b/src/dragonball/dbs_virtio_devices/src/lib.rs
@@ -439,19 +439,19 @@ pub mod tests {
            VirtqDesc { desc }
        }

-        pub fn addr(&self) -> VolatileRef<'_, u64> {
+        pub fn addr(&self) -> VolatileRef<u64> {
            self.desc.get_ref(offset_of!(DescriptorTmp, addr)).unwrap()
        }

-        pub fn len(&self) -> VolatileRef<'_, u32> {
+        pub fn len(&self) -> VolatileRef<u32> {
            self.desc.get_ref(offset_of!(DescriptorTmp, len)).unwrap()
        }

-        pub fn flags(&self) -> VolatileRef<'_, u16> {
+        pub fn flags(&self) -> VolatileRef<u16> {
            self.desc.get_ref(offset_of!(DescriptorTmp, flags)).unwrap()
        }

-        pub fn next(&self) -> VolatileRef<'_, u16> {
+        pub fn next(&self) -> VolatileRef<u16> {
            self.desc.get_ref(offset_of!(DescriptorTmp, next)).unwrap()
        }

@@ -513,11 +513,11 @@ pub mod tests {
            self.start.unchecked_add(self.ring.len() as GuestUsize)
        }

-        pub fn flags(&self) -> VolatileRef<'_, u16> {
+        pub fn flags(&self) -> VolatileRef<u16> {
            self.ring.get_ref(0).unwrap()
        }

-        pub fn idx(&self) -> VolatileRef<'_, u16> {
+        pub fn idx(&self) -> VolatileRef<u16> {
            self.ring.get_ref(2).unwrap()
        }

@@ -525,12 +525,12 @@ pub mod tests {
            4 + mem::size_of::<T>() * (i as usize)
        }

-        pub fn ring(&self, i: u16) -> VolatileRef<'_, T> {
+        pub fn ring(&self, i: u16) -> VolatileRef<T> {
            assert!(i < self.qsize);
            self.ring.get_ref(Self::ring_offset(i)).unwrap()
        }

-        pub fn event(&self) -> VolatileRef<'_, u16> {
+        pub fn event(&self) -> VolatileRef<u16> {
            self.ring.get_ref(Self::ring_offset(self.qsize)).unwrap()
        }

@@ -602,7 +602,7 @@ pub mod tests {
            (self.dtable.len() / VirtqDesc::dtable_len(1)) as u16
        }

-        pub fn dtable(&self, i: u16) -> VirtqDesc<'_> {
+        pub fn dtable(&self, i: u16) -> VirtqDesc {
            VirtqDesc::new(&self.dtable, i)
        }

--- a/src/dragonball/dbs_virtio_devices/src/vhost/vhost_user/fs.rs
+++ b/src/dragonball/dbs_virtio_devices/src/vhost/vhost_user/fs.rs
@@ -865,11 +865,11 @@ mod tests {
            0
        );
        let config: [u8; 8] = [0; 8];
-        let _ = VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::write_config(
+        VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::write_config(
            &mut dev, 0, &config,
        );
        let mut data: [u8; 8] = [1; 8];
-        let _ = VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::read_config(
+        VirtioDevice::<Arc<GuestMemoryMmap<()>>, QueueSync, GuestRegionMmap>::read_config(
            &mut dev, 0, &mut data,
        );
        assert_eq!(config, data);
--- a/src/dragonball/dbs_virtio_devices/src/vsock/mod.rs
+++ b/src/dragonball/dbs_virtio_devices/src/vsock/mod.rs
@@ -339,7 +339,7 @@ mod tests {
            }
        }

-        pub fn create_event_handler_context(&self) -> EventHandlerContext<'_> {
+        pub fn create_event_handler_context(&self) -> EventHandlerContext {
            const QSIZE: u16 = 256;

            let guest_rxvq = GuestQ::new(GuestAddress(0x0010_0000), &self.mem, QSIZE);
--- a/src/libs/kata-sys-util/Cargo.toml
+++ b/src/libs/kata-sys-util/Cargo.toml
@@ -13,10 +13,13 @@ edition = "2018"
 [dependencies]
 anyhow = "1.0.31"
 byteorder = "1.4.3"
+chrono = "0.4.0"
+common-path = "=1.0.0"
 fail = "0.5.0"
 lazy_static = "1.4.0"
 libc = "0.2.100"
 nix = "0.26.4"
+once_cell = "1.9.0"
 serde = { version = "1.0.138", features = ["derive"] }
 serde_json = "1.0.73"
 slog = "2.5.2"
@@ -31,7 +34,10 @@ mockall = "0.13.1"
 kata-types = { path = "../kata-types" }
 oci-spec = { version = "0.8.1", features = ["runtime"] }
 runtime-spec = { path = "../runtime-spec" }
+safe-path = { path = "../safe-path" }

 [dev-dependencies]
+num_cpus = "1.13.1"
+serial_test = "0.5.1"
 tempfile = "3.19.1"
 test-utils = { path = "../test-utils" }
--- a/src/libs/kata-types/Cargo.toml
+++ b/src/libs/kata-types/Cargo.toml
@@ -29,14 +29,12 @@ serde-enum-str = "0.4"
 sysinfo = "0.34.2"
 sha2 = "0.10.8"
 flate2 = "1.1"
-nix = "0.26.4"
+hex = "0.4"
+
 oci-spec = { version = "0.8.1", features = ["runtime"] }

 safe-path = { path = "../safe-path", optional = true }

-[target.'cfg(target_os = "macos")'.dependencies]
-sysctl = "0.7.1"
-
 [dev-dependencies]
 tempfile = "3.19.1"
 test-utils = { path = "../test-utils" }
--- a/src/libs/kata-types/src/config/hypervisor/mod.rs
+++ b/src/libs/kata-types/src/config/hypervisor/mod.rs
@@ -26,6 +26,7 @@
 use super::{default, ConfigOps, ConfigPlugin, TomlConfig};
 use crate::annotations::KATA_ANNO_CFG_HYPERVISOR_PREFIX;
 use crate::{resolve_path, sl, validate_path};
+use byte_unit::{Byte, Unit};
 use lazy_static::lazy_static;
 use regex::RegexSet;
 use serde_enum_str::{Deserialize_enum_str, Serialize_enum_str};
@@ -33,6 +34,7 @@ use std::collections::HashMap;
 use std::io::{self, Result};
 use std::path::Path;
 use std::sync::{Arc, Mutex};
+use sysinfo::{MemoryRefreshKind, RefreshKind, System};

 mod dragonball;
 pub use self::dragonball::{DragonballConfig, HYPERVISOR_NAME_DRAGONBALL};
@@ -1005,57 +1007,6 @@ fn default_guest_swap_create_threshold_secs() -> u64 {
    60
 }

-/// Get host memory size in MiB.
-/// Retrieves the total physical memory of the host across different platforms.
-fn host_memory_mib() -> io::Result<u64> {
-    // Select a platform-specific implementation via a function pointer.
-    let get_memory: fn() -> io::Result<u64> = {
-        #[cfg(target_os = "linux")]
-        {
-            || {
-                let info = nix::sys::sysinfo::sysinfo().map_err(io::Error::other)?;
-                Ok(info.ram_total() / (1024 * 1024)) // MiB
-            }
-        }
-
-        #[cfg(target_os = "macos")]
-        {
-            || {
-                use sysctl::{Ctl, CtlValue, Sysctl};
-
-                let v = Ctl::new("hw.memsize")
-                    .map_err(io::Error::other)?
-                    .value()
-                    .map_err(io::Error::other)?;
-
-                let bytes = match v {
-                    CtlValue::S64(x) if x >= 0 => x as u64,
-                    other => {
-                        return Err(io::Error::new(
-                            io::ErrorKind::InvalidData,
-                            format!("unexpected sysctl hw.memsize value type: {:?}", other),
-                        ));
-                    }
-                };
-
-                Ok(bytes / (1024 * 1024)) // MiB
-            }
-        }
-
-        #[cfg(not(any(target_os = "linux", target_os = "macos")))]
-        {
-            || {
-                Err(io::Error::new(
-                    io::ErrorKind::Unsupported,
-                    "host memory query not implemented on this platform",
-                ))
-            }
-        }
-    };
-
-    get_memory()
-}
-
 impl MemoryInfo {
    /// Adjusts the configuration information after loading from a configuration file.
    ///
@@ -1067,15 +1018,13 @@ impl MemoryInfo {
            self.file_mem_backend,
            "Memory backend file {} is invalid: {}"
        )?;
-
-        let host_memory = host_memory_mib()?;
-
-        if u64::from(self.default_memory) > host_memory {
-            self.default_memory = host_memory as u32;
-        }
-
-        if self.default_maxmemory == 0 || u64::from(self.default_maxmemory) > host_memory {
-            self.default_maxmemory = host_memory as u32;
+        if self.default_maxmemory == 0 {
+            let s = System::new_with_specifics(
+                RefreshKind::nothing().with_memory(MemoryRefreshKind::everything()),
+            );
+            self.default_maxmemory = Byte::from_u64(s.total_memory())
+                .get_adjusted_unit(Unit::MiB)
+                .get_value() as u32;
        }
        Ok(())
    }
@@ -1218,29 +1167,6 @@ pub struct SecurityInfo {
    #[serde(default)]
    pub sev_snp_guest: bool,

-    /// SNP 'ID Block' and 'ID Authentication Information Structure'.
-    /// If one of snp_id_block or snp_id_auth is specified, the other must be specified, too.
-    /// Notice that the default SNP policy of QEMU (0x30000) is used by Kata, if not explicitly
-    /// set via 'snp_guest_policy' option. The IDBlock contains the guest policy as field, and
-    /// it must match the value from 'snp_guest_policy' or, if unset, the QEMU default policy.
-    /// 96-byte, base64-encoded blob to provide the 'ID Block' structure for the
-    /// SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-    #[serde(default)]
-    pub snp_id_block: String,
-
-    /// 4096-byte, base64-encoded blob to provide the 'ID Authentication Information Structure'
-    /// for the SNP_LAUNCH_FINISH command defined in the SEV-SNP firmware ABI (QEMU default: all-zero)
-    #[serde(default)]
-    pub snp_id_auth: String,
-
-    /// SNP Guest Policy, the 'POLICY' parameter to the SNP_LAUNCH_START command.
-    /// If unset, the QEMU default policy (0x30000) will be used.
-    /// Notice that the guest policy is enforced at VM launch, and your pod VMs
-    /// won't start at all if the policy denys it. This will be indicated by a
-    /// 'SNP_LAUNCH_START' error.
-    #[serde(default = "default_snp_guest_policy")]
-    pub snp_guest_policy: u32,
-
    /// Path to OCI hook binaries in the *guest rootfs*.
    ///
    /// This setting does not affect host-side hooks, which must instead be
@@ -1302,10 +1228,6 @@ fn default_qgs_port() -> u32 {
    4050
 }

-fn default_snp_guest_policy() -> u32 {
-    0x30000
-}
-
 impl SecurityInfo {
    /// Adjusts the security configuration information after loading from a configuration file.
    ///
--- a/src/libs/mem-agent/Cargo.toml
+++ b/src/libs/mem-agent/Cargo.toml
@@ -10,6 +10,7 @@ anyhow = "1.0"
 page_size = "0.6"
 chrono = "0.4"
 tokio = { version = "1.45.1", features = ["full"] }
+async-trait = "0.1"
 maplit = "1.0"
 nix = { version = "0.30.1", features = ["fs", "sched"] }

--- a/src/libs/runtime-spec/Cargo.toml
+++ b/src/libs/runtime-spec/Cargo.toml
@@ -9,3 +9,4 @@ license = "Apache-2.0"
 serde = "1.0.131"
 serde_derive = "1.0.131"
 serde_json = "1.0.73"
+libc = "0.2.112"
--- a/src/runtime-rs/Cargo.toml
+++ b/src/runtime-rs/Cargo.toml
@@ -28,4 +28,5 @@ nix = { workspace = true }
 tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
 shim = { path = "crates/shim" }
 common = { workspace = true }
+logging = { workspace = true }
 runtimes = { workspace = true }
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -298,7 +298,7 @@ ifneq (,$(CLHCMD))
    KERNELTYPE_CLH = uncompressed
    KERNEL_NAME_CLH = $(call MAKE_KERNEL_NAME,$(KERNELTYPE_CLH))
    KERNELPATH_CLH = $(KERNELDIR)/$(KERNEL_NAME_CLH)
-    VMROOTFSDRIVER_CLH := virtio-blk-pci
+    VMROOTFSDRIVER_CLH := virtio-pmem

    DEFSANDBOXCGROUPONLY_CLH := true
    DEFSTATICRESOURCEMGMT_CLH := false
--- a/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
+++ b/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
@@ -22,8 +22,6 @@ rootfs_type = @DEFROOTFSTYPE@

 # Block storage driver to be used for the VM rootfs is backed
 # by a block device.
-#
-# virtio-pmem is not supported with Cloud Hypervisor.
 vm_rootfs_driver = "@VMROOTFSDRIVER_CLH@"

 # Path to the firmware.
--- a/src/runtime-rs/crates/agent/Cargo.toml
+++ b/src/runtime-rs/crates/agent/Cargo.toml
@@ -5,9 +5,13 @@ authors = { workspace = true }
 edition = { workspace = true }
 license = { workspace = true }

+[dev-dependencies]
+futures = "0.1.27"
+
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
+log = { workspace = true }
 protobuf = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -27,6 +31,3 @@ protocols = { workspace = true, features = ["async"] }

 [features]
 default = []
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
--- a/src/runtime-rs/crates/hypervisor/Cargo.toml
+++ b/src/runtime-rs/crates/hypervisor/Cargo.toml
@@ -28,6 +28,8 @@ path-clean = "1.0.1"
 lazy_static = { workspace = true }
 tracing = { workspace = true }
 ttrpc = { workspace = true, features = ["async"] }
+protobuf = { workspace = true }
+oci-spec = { workspace = true }
 futures = "0.3.25"
 safe-path = "0.1.0"
 crossbeam-channel = "0.5.6"
@@ -42,6 +44,7 @@ kata-sys-util = { workspace = true }
 kata-types = { workspace = true }
 logging = { workspace = true }
 protocols = { workspace = true, features = ["async"] }
+shim-interface = { workspace = true }
 persist = { workspace = true }
 ch-config = { workspace = true, optional = true }
 tests_utils = { workspace = true }
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
@@ -118,11 +118,13 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {

        // Note how CH handles the different image types:
        //
+        // - A standard image is specified in PmemConfig.
        // - An initrd/initramfs is specified in PayloadConfig.
-        // - An image is specified in DiskConfig.
-        //   Note: pmem is not used as it's not properly supported by Cloud Hypervisor.
+        // - A confidential guest image is specified by a DiskConfig.
        //   - If TDX is enabled, the firmware (`td-shim` [1]) must be
        //     specified in PayloadConfig.
+        // - A confidential guest initrd is specified by a PayloadConfig with
+        //   firmware.
        //
        // [1] - https://github.com/confidential-containers/td-shim
        let boot_info = cfg.boot_info;
@@ -138,6 +140,14 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {
            return Err(VmConfigError::NoBootFile);
        }

+        let pmem = if use_initrd || guest_protection_is_tdx(guest_protection_to_use.clone()) {
+            None
+        } else {
+            let pmem = PmemConfig::try_from(&boot_info).map_err(VmConfigError::PmemError)?;
+
+            Some(vec![pmem])
+        };
+
        let payload = Some(
            PayloadConfig::try_from((
                boot_info.clone(),
@@ -149,7 +159,7 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {

        let mut disks: Vec<DiskConfig> = vec![];

-        if use_image {
+        if use_image && guest_protection_is_tdx(guest_protection_to_use.clone()) {
            let disk = DiskConfig::try_from(boot_info).map_err(VmConfigError::DiskError)?;

            disks.push(disk);
@@ -189,6 +199,7 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {
            fs,
            net,
            devices: host_devices,
+            pmem,
            disks,
            vsock: Some(vsock),
            rng,
@@ -1645,6 +1656,7 @@ mod tests {
        let (memory_info_confidential_guest, mem_config_confidential_guest) =
            make_memory_objects(79, usable_max_mem_bytes, true);

+        let (_, pmem_config_with_image) = make_bootinfo_pmemconfig_objects(image);
        let (machine_info, rng_config) = make_machineinfo_rngconfig_objects(entropy_source);

        let payload_firmware = None;
@@ -1652,7 +1664,6 @@ mod tests {
        let (boot_info_with_initrd, payload_config_with_initrd) =
            make_bootinfo_payloadconfig_objects(kernel, initramfs, payload_firmware, None);

-        let (_, disk_config_with_image) = make_bootinfo_diskconfig_objects(image);
        let (_, disk_config_confidential_guest_image) = make_bootinfo_diskconfig_objects(image);

        let boot_info_tdx_image = BootInfo {
@@ -1751,7 +1762,7 @@ mod tests {
            vsock: Some(valid_vsock.clone()),

            // rootfs image specific
-            disks: Some(vec![disk_config_with_image]),
+            pmem: Some(vec![pmem_config_with_image]),

            payload: Some(PayloadConfig {
                kernel: Some(PathBuf::from(kernel)),
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
@@ -110,16 +110,6 @@ pub struct DeviceConfig {
    pub pci_segment: u16,
 }

-#[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq, Eq, Default)]
-pub enum ImageType {
-    FixedVhd,
-    Qcow2,
-    Raw,
-    Vhdx,
-    #[default]
-    Unknown,
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Default)]
 pub struct DiskConfig {
    pub path: Option<PathBuf>,
@@ -145,8 +135,6 @@ pub struct DiskConfig {
    pub disable_io_uring: bool,
    #[serde(default)]
    pub pci_segment: u16,
-    #[serde(default)]
-    pub image_type: ImageType,
 }

 #[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, Default)]
--- a/src/runtime-rs/crates/hypervisor/src/ch/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner.rs
@@ -123,12 +123,7 @@ impl CloudHypervisorInner {
        }
    }

-    pub fn set_hypervisor_config(&mut self, mut config: HypervisorConfig) {
-        // virtio-pmem is not supported for Cloud Hypervisor.
-        if config.boot_info.vm_rootfs_driver == crate::VM_ROOTFS_DRIVER_PMEM {
-            config.boot_info.vm_rootfs_driver = crate::VM_ROOTFS_DRIVER_BLK.to_string();
-        }
-
+    pub fn set_hypervisor_config(&mut self, config: HypervisorConfig) {
        self.config = config;
    }

--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
@@ -27,7 +27,6 @@ use ch_config::ch_api::{
 };
 use ch_config::convert::DEFAULT_NUM_PCI_SEGMENTS;
 use ch_config::DiskConfig;
-use ch_config::ImageType;
 use ch_config::{net_util::MacAddr, DeviceConfig, FsConfig, NetConfig, VsockConfig};
 use kata_sys_util::netns::NetnsGuard;
 use kata_types::config::hypervisor::RateLimiterConfig;
@@ -551,7 +550,6 @@ impl TryFrom<BlockConfig> for DiskConfig {
            readonly: blkcfg.is_readonly,
            num_queues: blkcfg.num_queues,
            queue_size: blkcfg.queue_size as u16,
-            image_type: ImageType::Raw,
            ..Default::default()
        };

--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
@@ -15,6 +15,7 @@ use crate::utils::vm_cleanup;
 use crate::utils::{bytes_to_megs, get_jailer_root, get_sandbox_path, megs_to_bytes};
 use crate::MemoryConfig;
 use crate::VM_ROOTFS_DRIVER_BLK;
+use crate::VM_ROOTFS_DRIVER_PMEM;
 use crate::{VcpuThreadIds, VmmState};
 use anyhow::{anyhow, Context, Result};
 use ch_config::ch_api::cloud_hypervisor_vm_netdev_add_with_fds;
@@ -129,8 +130,12 @@ impl CloudHypervisorInner {
        let confidential_guest = cfg.security_info.confidential_guest;

        // Note that the configuration option hypervisor.block_device_driver is not used.
-        // NVDIMM is not supported for Cloud Hypervisor.
-        let rootfs_driver = VM_ROOTFS_DRIVER_BLK;
+        let rootfs_driver = if confidential_guest {
+            // PMEM is not available with TDX.
+            VM_ROOTFS_DRIVER_BLK
+        } else {
+            VM_ROOTFS_DRIVER_PMEM
+        };

        let rootfs_type = match cfg.boot_info.rootfs_type.is_empty() {
            true => DEFAULT_CH_ROOTFS_TYPE,
@@ -150,7 +155,6 @@ impl CloudHypervisorInner {
            &cfg.boot_info.kernel_verity_params,
            rootfs_driver,
            rootfs_type,
-            true,
        )?;

        let mut console_params = if enable_debug {
@@ -1100,7 +1104,7 @@ fn get_guest_protection() -> Result<GuestProtection> {
    Ok(guest_protection)
 }

-// Return a VCPU/TID map from a specified /proc/{pid} path.
+// Return a TID/VCPU map from a specified /proc/{pid} path.
 fn get_ch_vcpu_tids(proc_path: &str) -> Result<HashMap<u32, u32>> {
    const VCPU_STR: &str = "vcpu";

@@ -1143,7 +1147,7 @@ fn get_ch_vcpu_tids(proc_path: &str) -> Result<HashMap<u32, u32>> {
            .parse::<u32>()
            .map_err(|e| anyhow!(e).context("Invalid vcpu id."))?;

-        vcpus.insert(vcpu_id, tid);
+        vcpus.insert(tid, vcpu_id);
    }

    if vcpus.is_empty() {
@@ -1609,65 +1613,4 @@ mod tests {
            assert!(actual_error == expected_error, "{}", msg);
        }
    }
-
-    #[actix_rt::test]
-    async fn test_get_ch_vcpu_tids_mapping() {
-        let tmp_dir = Builder::new().prefix("fake-proc-pid").tempdir().unwrap();
-        let task_dir = tmp_dir.path().join("task");
-        fs::create_dir_all(&task_dir).unwrap();
-
-        #[derive(Debug)]
-        struct ThreadInfo<'a> {
-            tid: &'a str,
-            comm: &'a str,
-        }
-
-        let threads = &[
-            // Non-vcpu thread, should be skipped.
-            ThreadInfo {
-                tid: "1000",
-                comm: "main_thread\n",
-            },
-            ThreadInfo {
-                tid: "2001",
-                comm: "vcpu0\n",
-            },
-            ThreadInfo {
-                tid: "2002",
-                comm: "vcpu1\n",
-            },
-            ThreadInfo {
-                tid: "2003",
-                comm: "vcpu2\n",
-            },
-        ];
-
-        for t in threads {
-            let tid_dir = task_dir.join(t.tid);
-            fs::create_dir_all(&tid_dir).unwrap();
-            fs::write(tid_dir.join("comm"), t.comm).unwrap();
-        }
-
-        let proc_path = tmp_dir.path().to_str().unwrap();
-        let result = get_ch_vcpu_tids(proc_path);
-
-        let msg = format!("result: {result:?}");
-
-        if std::env::var("DEBUG").is_ok() {
-            println!("DEBUG: {msg}");
-        }
-
-        let vcpus = result.unwrap();
-
-        // The mapping must be vcpu_id -> tid.
-        assert_eq!(vcpus.len(), 3, "non-vcpu threads should be excluded");
-        assert_eq!(vcpus[&0], 2001, "vcpu 0 should map to tid 2001");
-        assert_eq!(vcpus[&1], 2002, "vcpu 1 should map to tid 2002");
-        assert_eq!(vcpus[&2], 2003, "vcpu 2 should map to tid 2003");
-
-        assert!(
-            !vcpus.contains_key(&1000),
-            "non-vcpu thread should not be in the map"
-        );
-    }
 }
--- a/src/runtime-rs/crates/hypervisor/src/device/driver/virtio_blk.rs
+++ b/src/runtime-rs/crates/hypervisor/src/device/driver/virtio_blk.rs
@@ -13,17 +13,17 @@ use crate::device::DeviceType;
 use crate::Hypervisor as hypervisor;
 use anyhow::{Context, Result};
 use async_trait::async_trait;
-pub use kata_types::device::{
-    DRIVER_BLK_CCW_TYPE as KATA_CCW_DEV_TYPE, DRIVER_BLK_MMIO_TYPE as KATA_MMIO_BLK_DEV_TYPE,
-    DRIVER_BLK_PCI_TYPE as KATA_BLK_DEV_TYPE, DRIVER_NVDIMM_TYPE as KATA_NVDIMM_DEV_TYPE,
-    DRIVER_SCSI_TYPE as KATA_SCSI_DEV_TYPE,
-};

 /// VIRTIO_BLOCK_PCI indicates block driver is virtio-pci based
 pub const VIRTIO_BLOCK_PCI: &str = "virtio-blk-pci";
 pub const VIRTIO_BLOCK_MMIO: &str = "virtio-blk-mmio";
 pub const VIRTIO_BLOCK_CCW: &str = "virtio-blk-ccw";
 pub const VIRTIO_PMEM: &str = "virtio-pmem";
+pub const KATA_MMIO_BLK_DEV_TYPE: &str = "mmioblk";
+pub const KATA_BLK_DEV_TYPE: &str = "blk";
+pub const KATA_CCW_DEV_TYPE: &str = "ccw";
+pub const KATA_NVDIMM_DEV_TYPE: &str = "nvdimm";
+pub const KATA_SCSI_DEV_TYPE: &str = "scsi";

 #[derive(Clone, Copy, Debug, Default)]
 pub enum BlockDeviceAio {
@@ -95,9 +95,6 @@ pub struct BlockConfig {
    /// scsi_addr is of the format SCSI-Id:LUN
    pub scsi_addr: Option<String>,

-    /// CCW device address for virtio-blk-ccw on s390x (e.g., "0.0.0005")
-    pub ccw_addr: Option<String>,
-
    /// device attach count
    pub attach_count: u64,

--- a/src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/dragonball/inner.rs
@@ -150,7 +150,6 @@ impl DragonballInner {
                &self.config.boot_info.kernel_verity_params,
                &rootfs_driver,
                &self.config.boot_info.rootfs_type,
-                true,
            )?;
            kernel_params.append(&mut rootfs_params);
        }
--- a/src/runtime-rs/crates/hypervisor/src/firecracker/fc_api.rs
+++ b/src/runtime-rs/crates/hypervisor/src/firecracker/fc_api.rs
@@ -90,7 +90,6 @@ impl FcInner {
            &self.config.boot_info.kernel_verity_params,
            &self.config.blockdev_info.block_device_driver,
            &self.config.boot_info.rootfs_type,
-            true,
        )?;
        kernel_params.append(&mut rootfs_params);
        kernel_params.append(&mut KernelParams::from_string(
--- a/src/runtime-rs/crates/hypervisor/src/kernel_param.rs
+++ b/src/runtime-rs/crates/hypervisor/src/kernel_param.rs
@@ -10,8 +10,8 @@ use crate::{
    VM_ROOTFS_DRIVER_BLK, VM_ROOTFS_DRIVER_BLK_CCW, VM_ROOTFS_DRIVER_MMIO, VM_ROOTFS_DRIVER_PMEM,
    VM_ROOTFS_ROOT_BLK, VM_ROOTFS_ROOT_PMEM,
 };
-use kata_types::config::hypervisor::{parse_kernel_verity_params, VERITY_BLOCK_SIZE_BYTES};
 use kata_types::config::LOG_VPORT_OPTION;
+use kata_types::config::hypervisor::{parse_kernel_verity_params, VERITY_BLOCK_SIZE_BYTES};
 use kata_types::fs::{
    VM_ROOTFS_FILESYSTEM_EROFS, VM_ROOTFS_FILESYSTEM_EXT4, VM_ROOTFS_FILESYSTEM_XFS,
 };
@@ -66,7 +66,8 @@ struct KernelVerityConfig {
 }

 fn new_kernel_verity_params(params_string: &str) -> Result<Option<KernelVerityConfig>> {
-    let cfg = parse_kernel_verity_params(params_string).map_err(|err| anyhow!(err.to_string()))?;
+    let cfg = parse_kernel_verity_params(params_string)
+        .map_err(|err| anyhow!(err.to_string()))?;

    Ok(cfg.map(|params| KernelVerityConfig {
        root_hash: params.root_hash,
@@ -144,7 +145,6 @@ impl KernelParams {
        kernel_verity_params: &str,
        rootfs_driver: &str,
        rootfs_type: &str,
-        use_dax: bool,
    ) -> Result<Self> {
        let mut params = vec![];

@@ -153,29 +153,16 @@ impl KernelParams {
                params.push(Param::new("root", VM_ROOTFS_ROOT_PMEM));
                match rootfs_type {
                    VM_ROOTFS_FILESYSTEM_EXT4 => {
-                        if use_dax {
-                            params.push(Param::new(
-                                "rootflags",
-                                "dax,data=ordered,errors=remount-ro ro",
-                            ));
-                        } else {
-                            params
-                                .push(Param::new("rootflags", "data=ordered,errors=remount-ro ro"));
-                        }
+                        params.push(Param::new(
+                            "rootflags",
+                            "dax,data=ordered,errors=remount-ro ro",
+                        ));
                    }
                    VM_ROOTFS_FILESYSTEM_XFS => {
-                        if use_dax {
-                            params.push(Param::new("rootflags", "dax ro"));
-                        } else {
-                            params.push(Param::new("rootflags", "ro"));
-                        }
+                        params.push(Param::new("rootflags", "dax ro"));
                    }
                    VM_ROOTFS_FILESYSTEM_EROFS => {
-                        if use_dax {
-                            params.push(Param::new("rootflags", "dax ro"));
-                        } else {
-                            params.push(Param::new("rootflags", "ro"));
-                        }
+                        params.push(Param::new("rootflags", "dax ro"));
                    }
                    _ => {
                        return Err(anyhow!("Unsupported rootfs type {}", rootfs_type));
@@ -359,7 +346,6 @@ mod tests {
    struct TestData<'a> {
        rootfs_driver: &'a str,
        rootfs_type: &'a str,
-        use_dax: bool,
        expect_params: KernelParams,
        result: Result<()>,
    }
@@ -367,11 +353,10 @@ mod tests {
    #[test]
    fn test_rootfs_kernel_params() {
        let tests = &[
-            // EXT4 with DAX
+            // EXT4
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_PMEM,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EXT4,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_PMEM),
@@ -385,7 +370,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EXT4,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -396,15 +380,14 @@ mod tests {
                },
                result: Ok(()),
            },
-            // XFS without DAX
+            // XFS
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_PMEM,
                rootfs_type: VM_ROOTFS_FILESYSTEM_XFS,
-                use_dax: false,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_PMEM),
-                        Param::new("rootflags", "ro"),
+                        Param::new("rootflags", "dax ro"),
                        Param::new("rootfstype", VM_ROOTFS_FILESYSTEM_XFS),
                    ]
                    .to_vec(),
@@ -414,7 +397,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: VM_ROOTFS_FILESYSTEM_XFS,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -425,11 +407,10 @@ mod tests {
                },
                result: Ok(()),
            },
-            // EROFS with DAX
+            // EROFS
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_PMEM,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EROFS,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_PMEM),
@@ -443,7 +424,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: VM_ROOTFS_FILESYSTEM_EROFS,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -458,7 +438,6 @@ mod tests {
            TestData {
                rootfs_driver: "foo",
                rootfs_type: VM_ROOTFS_FILESYSTEM_EXT4,
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -473,7 +452,6 @@ mod tests {
            TestData {
                rootfs_driver: VM_ROOTFS_DRIVER_BLK,
                rootfs_type: "foo",
-                use_dax: true,
                expect_params: KernelParams {
                    params: [
                        Param::new("root", VM_ROOTFS_ROOT_BLK),
@@ -488,12 +466,8 @@ mod tests {

        for (i, t) in tests.iter().enumerate() {
            let msg = format!("test[{i}]: {t:?}");
-            let result = KernelParams::new_rootfs_kernel_params(
-                "",
-                t.rootfs_driver,
-                t.rootfs_type,
-                t.use_dax,
-            );
+            let result =
+                KernelParams::new_rootfs_kernel_params("", t.rootfs_driver, t.rootfs_type);
            let msg = format!("{msg}, result: {result:?}");
            if t.result.is_ok() {
                assert!(result.is_ok(), "{}", msg);
@@ -512,7 +486,6 @@ mod tests {
            "root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )?;
        let params_string = params.to_string()?;
        assert!(params_string.contains("dm-mod.create="));
@@ -523,7 +496,6 @@ mod tests {
            "root_hash=abc,data_blocks=1,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected missing salt error");
@@ -533,7 +505,6 @@ mod tests {
            "root_hash=abc,salt=def,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected missing data_blocks error");
@@ -543,7 +514,6 @@ mod tests {
            "root_hash=abc,salt=def,data_blocks=foo,data_block_size=4096,hash_block_size=4096",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected invalid data_blocks error");
@@ -553,7 +523,6 @@ mod tests {
            "root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096,badfield",
            VM_ROOTFS_DRIVER_BLK,
            VM_ROOTFS_FILESYSTEM_EXT4,
-            false,
        )
        .err()
        .expect("expected invalid entry error");
--- a/src/runtime-rs/crates/hypervisor/src/qemu/cmdline_generator.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/cmdline_generator.rs
@@ -179,17 +179,10 @@ impl Kernel {
        let mut kernel_params = KernelParams::new(config.debug_info.enable_debug);

        if config.boot_info.initrd.is_empty() {
-            // DAX is disabled on ARM due to a kernel panic in caches_clean_inval_pou.
-            #[cfg(target_arch = "aarch64")]
-            let use_dax = false;
-            #[cfg(not(target_arch = "aarch64"))]
-            let use_dax = true;
-
            let mut rootfs_params = KernelParams::new_rootfs_kernel_params(
                &config.boot_info.kernel_verity_params,
                &config.boot_info.vm_rootfs_driver,
                &config.boot_info.rootfs_type,
-                use_dax,
            )
            .context("adding rootfs/verity params failed")?;
            kernel_params.append(&mut rootfs_params);
@@ -256,8 +249,29 @@ struct Memory {

 impl Memory {
    fn new(config: &HypervisorConfig) -> Memory {
-        let mem_size = config.memory_info.default_memory as u64;
-        let max_mem_size = config.memory_info.default_maxmemory as u64;
+        // Move this to QemuConfig::adjust_config()?
+
+        let mut mem_size = config.memory_info.default_memory as u64;
+        let mut max_mem_size = config.memory_info.default_maxmemory as u64;
+
+        if let Ok(sysinfo) = nix::sys::sysinfo::sysinfo() {
+            let host_memory = sysinfo.ram_total() >> 20;
+
+            if mem_size > host_memory {
+                info!(sl!(), "'default_memory' given in configuration.toml is greater than host memory, adjusting to host memory");
+                mem_size = host_memory
+            }
+
+            if max_mem_size == 0 || max_mem_size > host_memory {
+                max_mem_size = host_memory
+            }
+        } else {
+            warn!(sl!(), "Failed to get host memory size, cannot verify or adjust configuration.toml's 'default_maxmemory'");
+
+            if max_mem_size == 0 {
+                max_mem_size = mem_size;
+            };
+        }

        // Memory sizes are given in megabytes in configuration.toml so we
        // need to convert them to bytes for storage.
@@ -279,18 +293,6 @@ impl Memory {
        self.memory_backend_file = Some(mem_file.clone());
        self
    }
-
-    #[allow(dead_code)]
-    fn set_maxmem_size(&mut self, max_size: u64) -> &mut Self {
-        self.max_size = max_size;
-        self
-    }
-
-    #[allow(dead_code)]
-    fn set_num_slots(&mut self, num_slots: u32) -> &mut Self {
-        self.num_slots = num_slots;
-        self
-    }
 }

 #[async_trait]
@@ -383,7 +385,7 @@ impl ToQemuParams for Cpu {
 /// Error type for CCW Subchannel operations
 #[derive(Debug)]
 #[allow(dead_code)]
-pub enum CcwError {
+enum CcwError {
    DeviceAlreadyExists(String), // Error when trying to add an existing device
    #[allow(dead_code)]
    DeviceNotFound(String), // Error when trying to remove a nonexistent device
@@ -414,7 +416,7 @@ impl CcwSubChannel {
    /// # Returns
    /// - `Result<u32, CcwError>`: slot index of the added device
    ///   or an error if the device already exists
-    pub fn add_device(&mut self, dev_id: &str) -> Result<u32, CcwError> {
+    fn add_device(&mut self, dev_id: &str) -> Result<u32, CcwError> {
        if self.devices.contains_key(dev_id) {
            Err(CcwError::DeviceAlreadyExists(dev_id.to_owned()))
        } else {
@@ -433,7 +435,8 @@ impl CcwSubChannel {
    /// # Returns
    /// - `Result<(), CcwError>`: Ok(()) if the device was removed
    ///   or an error if the device was not found
-    pub fn remove_device(&mut self, dev_id: &str) -> Result<(), CcwError> {
+    #[allow(dead_code)]
+    fn remove_device(&mut self, dev_id: &str) -> Result<(), CcwError> {
        if self.devices.remove(dev_id).is_some() {
            Ok(())
        } else {
@@ -441,30 +444,17 @@ impl CcwSubChannel {
        }
    }

-    /// Formats the CCW address for a given slot.
-    /// Uses the 0xfe channel subsystem ID used by QEMU.
+    /// Formats the CCW address for a given slot
    ///
    /// # Arguments
    /// - `slot`: slot index
    ///
    /// # Returns
    /// - `String`: formatted CCW address (e.g. `fe.0.0000`)
-    pub fn address_format_ccw(&self, slot: u32) -> String {
+    fn address_format_ccw(&self, slot: u32) -> String {
        format!("fe.{:x}.{:04x}", self.addr, slot)
    }

-    /// Formats the guest-visible CCW address for a given slot.
-    /// Uses channel subsystem ID 0 (guest perspective).
-    ///
-    /// # Arguments
-    /// - `slot`: slot index
-    ///
-    /// # Returns
-    /// - `String`: formatted guest-visible CCW address (e.g. `0.0.0000`)
-    pub fn address_format_ccw_for_virt_server(&self, slot: u32) -> String {
-        format!("0.{:x}.{:04x}", self.addr, slot)
-    }
-
    /// Sets the address of the subchannel.
    /// # Arguments
    /// - `addr`: subchannel address to set
@@ -1879,7 +1869,6 @@ struct ObjectSevSnpGuest {
    reduced_phys_bits: u32,
    kernel_hashes: bool,
    host_data: Option<String>,
-    policy: u32,
    is_snp: bool,
 }

@@ -1891,15 +1880,9 @@ impl ObjectSevSnpGuest {
            reduced_phys_bits,
            kernel_hashes: true,
            host_data,
-            policy: 0x30000,
            is_snp,
        }
    }
-
-    fn set_policy(&mut self, policy: u32) -> &mut Self {
-        self.policy = policy;
-        self
-    }
 }

 #[async_trait]
@@ -1922,7 +1905,6 @@ impl ToQemuParams for ObjectSevSnpGuest {
                "kernel-hashes={}",
                if self.kernel_hashes { "on" } else { "off" }
            ));
-            params.push(format!("policy=0x{:x}", self.policy));
            if let Some(host_data) = &self.host_data {
                params.push(format!("host-data={host_data}"))
            }
@@ -2285,12 +2267,6 @@ impl<'a> QemuCmdLine<'a> {
        Ok(qemu_cmd_line)
    }

-    /// Takes ownership of the CCW subchannel, leaving `None` in its place.
-    /// Used to transfer boot-time CCW state to Qmp for hotplug allocation.
-    pub fn take_ccw_subchannel(&mut self) -> Option<CcwSubChannel> {
-        self.ccw_subchannel.take()
-    }
-
    fn add_monitor(&mut self, proto: &str) -> Result<()> {
        let monitor = QmpSocket::new(self.id.as_str(), MonitorProtocol::new(proto))?;
        self.devices.push(Box::new(monitor));
@@ -2578,19 +2554,13 @@ impl<'a> QemuCmdLine<'a> {
        firmware: &str,
        host_data: &Option<String>,
    ) {
-        // For SEV-SNP, memory overcommit is not supported. we only set the memory size.
-        self.memory.set_maxmem_size(0).set_num_slots(0);
-
-        let mut sev_snp_object =
+        let sev_snp_object =
            ObjectSevSnpGuest::new(true, cbitpos, phys_addr_reduction, host_data.clone());
-        sev_snp_object.set_policy(self.config.security_info.snp_guest_policy);
-
        self.devices.push(Box::new(sev_snp_object));

        self.devices.push(Box::new(Bios::new(firmware.to_owned())));

        self.machine
-            .set_kernel_irqchip("split")
            .set_confidential_guest_support("snp")
            .set_nvdimm(false);

--- a/src/runtime-rs/crates/hypervisor/src/qemu/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/inner.rs
@@ -10,7 +10,6 @@ use crate::qemu::qmp::get_qmp_socket_path;
 use crate::{
    device::driver::ProtectionDeviceConfig, hypervisor_persist::HypervisorState, selinux,
    HypervisorConfig, MemoryConfig, VcpuThreadIds, VsockDevice, HYPERVISOR_QEMU,
-    KATA_BLK_DEV_TYPE, KATA_CCW_DEV_TYPE, KATA_NVDIMM_DEV_TYPE, KATA_SCSI_DEV_TYPE,
 };

 use crate::utils::{
@@ -22,7 +21,7 @@ use anyhow::{anyhow, Context, Result};
 use async_trait::async_trait;
 use kata_sys_util::netns::NetnsGuard;
 use kata_types::build_path;
-use kata_types::config::hypervisor::{RootlessUser, VIRTIO_BLK_CCW};
+use kata_types::config::hypervisor::RootlessUser;
 use kata_types::rootless::is_rootless;
 use kata_types::{
    capabilities::{Capabilities, CapabilityBits},
@@ -134,18 +133,18 @@ impl QemuInner {
                        continue;
                    }
                    match block_dev.config.driver_option.as_str() {
-                        KATA_NVDIMM_DEV_TYPE => cmdline.add_nvdimm(
+                        "nvdimm" => cmdline.add_nvdimm(
                            &block_dev.config.path_on_host,
                            block_dev.config.is_readonly,
                        )?,
-                        KATA_CCW_DEV_TYPE | KATA_BLK_DEV_TYPE | KATA_SCSI_DEV_TYPE => cmdline.add_block_device(
+                        "ccw" | "blk" | "scsi" => cmdline.add_block_device(
                            block_dev.device_id.as_str(),
                            &block_dev.config.path_on_host,
                            block_dev
                                .config
                                .is_direct
                                .unwrap_or(self.config.blockdev_info.block_device_cache_direct),
-                            block_dev.config.driver_option.as_str() == KATA_SCSI_DEV_TYPE,
+                            block_dev.config.driver_option.as_str() == "scsi",
                        )?,
                        unsupported => {
                            info!(sl!(), "unsupported block device driver: {}", unsupported)
@@ -286,12 +285,7 @@ impl QemuInner {
        let qmp_socket_path = get_qmp_socket_path(self.id.as_str());

        match Qmp::new(&qmp_socket_path) {
-            Ok(mut qmp) => {
-                if let Some(subchannel) = cmdline.take_ccw_subchannel() {
-                    qmp.set_ccw_subchannel(subchannel);
-                }
-                self.qmp = Some(qmp);
-            }
+            Ok(qmp) => self.qmp = Some(qmp),
            Err(e) => {
                error!(sl!(), "couldn't initialise QMP: {:?}", e);
                return Err(e);
@@ -848,10 +842,9 @@ impl QemuInner {
                qmp.hotplug_network_device(&netdev, &virtio_net_device)?
            }
            DeviceType::Block(mut block_device) => {
-                let block_driver = &self.config.blockdev_info.block_device_driver;
-                let (pci_path, addr_str) = qmp
+                let (pci_path, scsi_addr) = qmp
                    .hotplug_block_device(
-                        block_driver,
+                        &self.config.blockdev_info.block_device_driver,
                        block_device.config.index,
                        &block_device.config.path_on_host,
                        &block_device.config.blkdev_aio.to_string(),
@@ -864,12 +857,8 @@ impl QemuInner {
                if pci_path.is_some() {
                    block_device.config.pci_path = pci_path;
                }
-                if let Some(addr) = addr_str {
-                    if block_driver == VIRTIO_BLK_CCW {
-                        block_device.config.ccw_addr = Some(addr);
-                    } else {
-                        block_device.config.scsi_addr = Some(addr);
-                    }
+                if scsi_addr.is_some() {
+                    block_device.config.scsi_addr = scsi_addr;
                }

                return Ok(DeviceType::Block(block_device));
--- a/src/runtime-rs/crates/hypervisor/src/qemu/qmp.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/qmp.rs
@@ -4,12 +4,12 @@
 //

 use crate::device::pci_path::PciPath;
-use crate::qemu::cmdline_generator::{CcwSubChannel, DeviceVirtioNet, Netdev, QMP_SOCKET_FILE};
+use crate::qemu::cmdline_generator::{DeviceVirtioNet, Netdev, QMP_SOCKET_FILE};
 use crate::utils::get_jailer_root;
 use crate::VcpuThreadIds;

 use anyhow::{anyhow, Context, Result};
-use kata_types::config::hypervisor::{VIRTIO_BLK_CCW, VIRTIO_SCSI};
+use kata_types::config::hypervisor::VIRTIO_SCSI;
 use kata_types::rootless::is_rootless;
 use nix::sys::socket::{sendmsg, ControlMessage, MsgFlags};
 use qapi_qmp::{
@@ -50,11 +50,6 @@ pub struct Qmp {
    // blocks seem ever to be onlined in the guest by kata-agent.
    // Store as u64 to keep up the convention of bytes being represented as u64.
    guest_memory_block_size: u64,
-
-    // CCW subchannel for s390x device address management.
-    // Transferred from QemuCmdLine after boot so that hotplug allocations
-    // continue from where boot-time allocations left off.
-    ccw_subchannel: Option<CcwSubChannel>,
 }

 // We have to implement Debug since the Hypervisor trait requires it and Qmp
@@ -81,7 +76,6 @@ impl Qmp {
                    stream,
                )),
                guest_memory_block_size: 0,
-                ccw_subchannel: None,
            };

            let info = qmp.qmp.handshake().context("qmp handshake failed")?;
@@ -108,10 +102,6 @@ impl Qmp {
            .with_context(|| format!("timed out waiting for QMP ready: {}", qmp_sock_path))
    }

-    pub fn set_ccw_subchannel(&mut self, subchannel: CcwSubChannel) {
-        self.ccw_subchannel = Some(subchannel);
-    }
-
    pub fn set_ignore_shared_memory_capability(&mut self) -> Result<()> {
        self.qmp
            .execute(&migrate_set_capabilities {
@@ -615,13 +605,6 @@ impl Qmp {
    /// {"execute":"device_add","arguments":{"driver":"scsi-hd","drive":"virtio-scsi0","id":"scsi_device_0","bus":"virtio-scsi1.0"}}
    /// {"return": {}}
    ///
-    /// Hotplug virtio-blk-ccw block device on s390x
-    /// # virtio-blk-ccw0
-    /// {"execute":"blockdev_add", "arguments": {"file":"/path/to/block.image","format":"qcow2","id":"virtio-blk-ccw0"}}
-    /// {"return": {}}
-    /// {"execute":"device_add","arguments":{"driver":"virtio-blk-ccw","id":"virtio-blk-ccw0","drive":"virtio-blk-ccw0","devno":"fe.0.0005","share-rw":true}}
-    /// {"return": {}}
-    ///
    #[allow(clippy::too_many_arguments)]
    pub fn hotplug_block_device(
        &mut self,
@@ -728,14 +711,6 @@ impl Qmp {
            blkdev_add_args.insert("lun".to_string(), lun.into());
            blkdev_add_args.insert("share-rw".to_string(), true.into());

-            info!(
-                sl!(),
-                "hotplug_block_device(): device_add arguments: bus: {}, id: {}, driver: {}, blkdev_add_args: {:#?}",
-                "scsi0.0",
-                node_name,
-                "scsi-hd",
-                blkdev_add_args
-            );
            self.qmp
                .execute(&qmp::device_add {
                    bus: Some("scsi0.0".to_string()),
@@ -752,60 +727,11 @@ impl Qmp {
            );

            Ok((None, Some(scsi_addr)))
-        } else if block_driver == VIRTIO_BLK_CCW {
-            let subchannel = self
-                .ccw_subchannel
-                .as_mut()
-                .ok_or_else(|| anyhow!("CCW subchannel not available for virtio-blk-ccw hotplug"))?;
-
-            let slot = subchannel
-                .add_device(&node_name)
-                .map_err(|e| anyhow!("CCW subchannel add_device failed: {:?}", e))?;
-            let devno = subchannel.address_format_ccw(slot);
-            let ccw_addr = subchannel.address_format_ccw_for_virt_server(slot);
-
-            blkdev_add_args.insert("devno".to_owned(), devno.clone().into());
-            blkdev_add_args.insert("share-rw".to_string(), true.into());
-
-            info!(
-                sl!(),
-                "hotplug_block_device(): CCW device_add: id: {}, driver: {}, blkdev_add_args: {:#?}, ccw_addr: {}",
-                node_name,
-                block_driver,
-                blkdev_add_args,
-                ccw_addr
-            );
-            let device_add_result = self.qmp.execute(&qmp::device_add {
-                bus: None,
-                id: Some(node_name.clone()),
-                driver: block_driver.to_string(),
-                arguments: blkdev_add_args,
-            });
-            if let Err(e) = device_add_result {
-                // Roll back CCW subchannel state if QMP device_add fails
-                let _ = subchannel.remove_device(&node_name);
-                return Err(anyhow!("device_add {:?}", e));
-            }
-
-            info!(
-                sl!(),
-                "hotplug CCW block device return ccw address: {:?}", &ccw_addr
-            );
-
-            Ok((None, Some(ccw_addr)))
        } else {
            let (bus, slot) = self.find_free_slot()?;
            blkdev_add_args.insert("addr".to_owned(), format!("{slot:02}").into());
            blkdev_add_args.insert("share-rw".to_string(), true.into());

-            info!(
-                sl!(),
-                "hotplug_block_device(): device_add arguments: bus: {}, id: {}, driver: {}, blkdev_add_args: {:#?}",
-                bus,
-                node_name,
-                block_driver,
-                blkdev_add_args
-            );
            self.qmp
                .execute(&qmp::device_add {
                    bus: Some(bus),
--- a/src/runtime-rs/crates/persist/Cargo.toml
+++ b/src/runtime-rs/crates/persist/Cargo.toml
@@ -8,10 +8,12 @@ license = { workspace = true }
 [dependencies]
 async-trait = { workspace = true }
 anyhow = { workspace = true }
+libc = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

 # Local dependencies
 kata-sys-util = { workspace = true }
 kata-types = { workspace = true }
+shim-interface = { workspace = true }
 safe-path = { workspace = true }
--- a/src/runtime-rs/crates/resource/Cargo.toml
+++ b/src/runtime-rs/crates/resource/Cargo.toml
@@ -15,6 +15,7 @@ test-utils = { workspace = true }
 actix-rt = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
+bitflags = "2.9.0"
 byte-unit = "5.1.6"
 cgroups-rs = { version = "0.5.0", features = ["oci"] }
 futures = "0.3.11"
@@ -40,6 +41,7 @@ hex = "0.4"

 ## Dependencies from `rust-netlink`
 netlink-packet-route = "0.26"
+netlink-sys = "0.8"
 rtnetlink = "0.19"

 # Local dependencies
@@ -52,7 +54,3 @@ persist = { workspace = true }
 tests_utils = { workspace = true }

 [features]
-
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
--- a/src/runtime-rs/crates/resource/src/manager_inner.rs
+++ b/src/runtime-rs/crates/resource/src/manager_inner.rs
@@ -429,16 +429,14 @@ impl ResourceManagerInner {
                        .await
                        .context("do handle device")?;

-                    // create block device for kata agent.
-                    // The device ID is derived from the available address: PCI, SCSI,
-                    // CCW, or virtual path, depending on the driver and configuration.
+                    // create block device for kata agent,
+                    // if driver is virtio-blk-pci, the id will be pci address.
                    if let DeviceType::Block(device) = device_info {
+                        // The following would work for drivers virtio-blk-pci and virtio-mmio and virtio-scsi.
                        let id = if let Some(pci_path) = device.config.pci_path {
                            pci_path.to_string()
                        } else if let Some(scsi_address) = device.config.scsi_addr {
                            scsi_address
-                        } else if let Some(ccw_addr) = device.config.ccw_addr {
-                            ccw_addr
                        } else {
                            device.config.virt_path.clone()
                        };
--- a/src/runtime-rs/crates/resource/src/rootfs/block_rootfs.rs
+++ b/src/runtime-rs/crates/resource/src/rootfs/block_rootfs.rs
@@ -100,13 +100,7 @@ impl BlockRootfs {
                VIRTIO_BLK_MMIO => {
                    storage.source = device.config.virt_path;
                }
-                VIRTIO_BLK_CCW => {
-                    storage.source = device
-                        .config
-                        .ccw_addr
-                        .ok_or_else(|| anyhow!("CCW address missing for ccw block device"))?;
-                }
-                VIRTIO_SCSI | VIRTIO_PMEM => {
+                VIRTIO_SCSI | VIRTIO_BLK_CCW | VIRTIO_PMEM => {
                    return Err(anyhow!(
                        "Complete support for block driver {} has not been implemented yet",
                        block_driver
--- a/src/runtime-rs/crates/resource/src/volume/utils.rs
+++ b/src/runtime-rs/crates/resource/src/volume/utils.rs
@@ -15,10 +15,6 @@ use crate::{
 };
 use anyhow::{anyhow, Context, Result};
 use kata_sys_util::mount::{get_mount_options, get_mount_path};
-use kata_types::device::{
-    DRIVER_BLK_CCW_TYPE as KATA_CCW_DEV_TYPE, DRIVER_BLK_PCI_TYPE as KATA_BLK_DEV_TYPE,
-    DRIVER_SCSI_TYPE as KATA_SCSI_DEV_TYPE,
-};
 use oci_spec::runtime as oci;

 use hypervisor::device::DeviceType;
@@ -26,6 +22,9 @@ use hypervisor::device::DeviceType;
 pub const DEFAULT_VOLUME_FS_TYPE: &str = "ext4";
 pub const KATA_MOUNT_BIND_TYPE: &str = "bind";

+pub const KATA_BLK_DEV_TYPE: &str = "blk";
+pub const KATA_SCSI_DEV_TYPE: &str = "scsi";
+
 pub fn get_file_name<P: AsRef<Path>>(src: P) -> Result<String> {
    let file_name = src
        .as_ref()
@@ -105,13 +104,6 @@ pub async fn handle_block_volume(
                    return Err(anyhow!("block driver is scsi but no scsi address exists"));
                }
            }
-            KATA_CCW_DEV_TYPE => {
-                if let Some(ccw_addr) = device.config.ccw_addr {
-                    ccw_addr.to_string()
-                } else {
-                    return Err(anyhow!("block driver is ccw but no ccw address exists"));
-                }
-            }
            _ => device.config.virt_path,
        };
        device_id = device.device_id;
--- a/src/runtime-rs/crates/runtimes/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/Cargo.toml
@@ -26,6 +26,7 @@ opentelemetry-jaeger = { version = "0.17.0", features = [
 ] }
 tracing-subscriber = { version = "0.3", features = ["registry", "std"] }
 hyper = { workspace = true, features = ["stream", "server", "http1"] }
+hyperlocal = { workspace = true }
 serde_json = { workspace = true }
 nix = "0.25.0"
 url = { workspace = true }
--- a/src/runtime-rs/crates/runtimes/common/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/common/Cargo.toml
@@ -11,14 +11,20 @@ license = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 containerd-shim-protos = { workspace = true, features = ["sandbox"] }
+lazy_static = { workspace = true }
 nix = { workspace = true }
 protobuf = { workspace = true }
+serde_json = { workspace = true }
+slog = { workspace = true }
+slog-scope = { workspace = true }
 strum = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "process", "fs"] }
+ttrpc = { workspace = true }
 oci-spec = { workspace = true }

 # Local dependencies
+persist = { workspace = true }
 agent = { workspace = true }
 kata-sys-util = { workspace = true }
 kata-types = { workspace = true }
--- a/src/runtime-rs/crates/runtimes/virt_container/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/virt_container/Cargo.toml
@@ -10,6 +10,8 @@ anyhow = { workspace = true }
 async-trait = { workspace = true }
 awaitgroup = "0.6.0"
 containerd-shim-protos = { workspace = true }
+futures = "0.3.19"
+lazy_static = { workspace = true }
 libc = { workspace = true }
 nix = { workspace = true }
 protobuf = { workspace = true }
@@ -19,7 +21,9 @@ serde_json = { workspace = true }
 slog = { workspace = true }
 slog-scope = { workspace = true }
 tokio = { workspace = true }
+toml = "0.4.2"
 url = { workspace = true }
+async-std = "1.12.0"
 tracing = { workspace = true }
 oci-spec = { workspace = true }
 strum = { workspace = true }
@@ -44,7 +48,3 @@ cloud-hypervisor = ["hypervisor/cloud-hypervisor"]

 # Enable the build-in VMM Dragtonball
 dragonball = ["hypervisor/dragonball"]
-
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
--- a/src/runtime-rs/crates/service/Cargo.toml
+++ b/src/runtime-rs/crates/service/Cargo.toml
@@ -11,6 +11,7 @@ async-trait = { workspace = true }
 slog = { workspace = true }
 slog-scope = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread"] }
+tracing = { workspace = true }
 ttrpc = { workspace = true }
 containerd-shim-protos = { workspace = true, features = ["async", "sandbox"] }
 containerd-shim = { workspace = true }
@@ -20,7 +21,4 @@ common = { workspace = true }
 logging = { workspace = true }
 kata-types = { workspace = true }
 runtimes = { workspace = true }
-
-
-[package.metadata.cargo-machete]
-ignored = ["slog-scope"]
+persist = { workspace = true }
--- a/src/runtime-rs/crates/shim-ctl/Cargo.toml
+++ b/src/runtime-rs/crates/shim-ctl/Cargo.toml
@@ -9,8 +9,9 @@ license = { workspace = true }

 [dependencies]
 anyhow = { workspace = true }
-tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
+tokio = { workspace = true, features = [ "rt", "rt-multi-thread" ] }

 # Local dependencies
 common = { workspace = true }
+logging = { workspace = true }
 runtimes = { workspace = true }
--- a/src/runtime-rs/crates/shim/Cargo.toml
+++ b/src/runtime-rs/crates/shim/Cargo.toml
@@ -36,6 +36,8 @@ slog-stdlog = "4.1.0"
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
 unix_socket2 = "0.5.4"
+tracing = { workspace = true }
+tracing-opentelemetry = { workspace = true }
 oci-spec = { workspace = true }

 # Local dependencies
@@ -44,7 +46,12 @@ kata-sys-util = { workspace = true }
 logging = { workspace = true }
 runtime-spec = { workspace = true }
 service = { workspace = true }
+runtimes = { workspace = true }

 [dev-dependencies]
 tempfile = { workspace = true }
+rand = { workspace = true }
 serial_test = "0.10.0"
+
+# Local dev-dependencies
+tests_utils = { workspace = true }
--- a/src/runtime/Makefile
+++ b/src/runtime/Makefile
@@ -288,7 +288,6 @@ DEFSTATICRESOURCEMGMT_NV = true

 DEFDISABLEIMAGENVDIMM ?= false
 DEFDISABLEIMAGENVDIMM_NV = true
-DEFDISABLEIMAGENVDIMM_CLH ?= true

 DEFBINDMOUNTS := []

@@ -789,7 +788,6 @@ USER_VARS += DEFVFIOMODE_SE
 USER_VARS += BUILDFLAGS
 USER_VARS += DEFDISABLEIMAGENVDIMM
 USER_VARS += DEFDISABLEIMAGENVDIMM_NV
-USER_VARS += DEFDISABLEIMAGENVDIMM_CLH
 USER_VARS += DEFCCAMEASUREMENTALGO
 USER_VARS += DEFSHAREDFS_QEMU_CCA_VIRTIOFS
 USER_VARS += DEFPODRESOURCEAPISOCK
--- a/src/runtime/cmd/kata-monitor/main.go
+++ b/src/runtime/cmd/kata-monitor/main.go
@@ -196,7 +196,7 @@ func indexPageText(w http.ResponseWriter, r *http.Request) {
 	formatter := fmt.Sprintf("%%-%ds: %%s\n", spacing)

 	for _, endpoint := range endpoints {
-		fmt.Fprintf(w, formatter, endpoint.path, endpoint.desc)
+		w.Write([]byte(fmt.Sprintf(formatter, endpoint.path, endpoint.desc)))
 	}
 }

--- a/src/runtime/cmd/kata-runtime/kata-check_amd64.go
+++ b/src/runtime/cmd/kata-runtime/kata-check_amd64.go
@@ -63,7 +63,7 @@ func setCPUtype(hypervisorType vc.HypervisorType) error {
 	cpuType = getCPUtype()

 	if cpuType == cpuTypeUnknown {
-		return fmt.Errorf("Unknown CPU Type")
+		return fmt.Errorf("Unknow CPU Type")
 	} else if cpuType == cpuTypeIntel {
 		var kvmIntelParams map[string]string
 		onVMM, err := vc.RunningOnVMM(procCPUInfo)
--- a/src/runtime/cmd/kata-runtime/kata-check_amd64_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-check_amd64_test.go
@@ -55,17 +55,18 @@ func TestCCCheckCLIFunction(t *testing.T) {
 	var moduleData []testModuleData

 	cpuType = getCPUtype()
-	moduleData = []testModuleData{}
-
-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		cpuData = []testCPUData{
 			{archGenuineIntel, "lm vmx sse4_1", false},
 		}
-	case cpuTypeAMD:
+
+		moduleData = []testModuleData{}
+	} else if cpuType == cpuTypeAMD {
 		cpuData = []testCPUData{
 			{archAuthenticAMD, "lm svm sse4_1", false},
 		}
+
+		moduleData = []testModuleData{}
 	}

 	genericCheckCLIFunction(t, cpuData, moduleData)
@@ -275,8 +276,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 	var moduleData []testModuleData
 	cpuType = getCPUtype()

-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		cpuData = []testCPUData{
 			{"", "", true},
 			{"Intel", "", true},
@@ -292,7 +292,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 			{filepath.Join(sysModuleDir, "kvm_intel/parameters/nested"), "Y", false},
 			{filepath.Join(sysModuleDir, "kvm_intel/parameters/unrestricted_guest"), "Y", false},
 		}
-	case cpuTypeAMD:
+	} else if cpuType == cpuTypeAMD {
 		cpuData = []testCPUData{
 			{"", "", true},
 			{"AMD", "", true},
@@ -340,7 +340,7 @@ func TestCheckHostIsVMContainerCapable(t *testing.T) {
 		// Write the following into the denylist file
 		// blacklist <mod>
 		// install <mod> /bin/false
-		_, err = fmt.Fprintf(denylistFile, "blacklist %s\ninstall %s /bin/false\n", mod, mod)
+		_, err = denylistFile.WriteString(fmt.Sprintf("blacklist %s\ninstall %s /bin/false\n", mod, mod))
 		assert.Nil(err)
 	}
 	denylistFile.Close()
@@ -505,10 +505,9 @@ func TestSetCPUtype(t *testing.T) {
 	assert.NotEmpty(archRequiredKernelModules)

 	cpuType = getCPUtype()
-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		assert.Equal(archRequiredCPUFlags["vmx"], "Virtualization support")
-	case cpuTypeAMD:
+	} else if cpuType == cpuTypeAMD {
 		assert.Equal(archRequiredCPUFlags["svm"], "Virtualization support")
 	}

--- a/src/runtime/cmd/kata-runtime/kata-check_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-check_test.go
@@ -17,6 +17,7 @@ import (
 	"testing"

 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils"
+	ktu "github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils"
 	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/sirupsen/logrus"
@@ -508,7 +509,7 @@ func TestCheckCheckCPUAttribs(t *testing.T) {
 }

 func TestCheckHaveKernelModule(t *testing.T) {
-	if tc.NotValid(katatestutils.NeedRoot()) {
+	if tc.NotValid(ktu.NeedRoot()) {
 		t.Skip(testDisabledAsNonRoot)
 	}

@@ -637,8 +638,8 @@ func TestCheckCheckKernelModules(t *testing.T) {
 func TestCheckCheckKernelModulesUnreadableFile(t *testing.T) {
 	assert := assert.New(t)

-	if tc.NotValid(katatestutils.NeedNonRoot()) {
-		t.Skip(katatestutils.TestDisabledNeedNonRoot)
+	if tc.NotValid(ktu.NeedNonRoot()) {
+		t.Skip(ktu.TestDisabledNeedNonRoot)
 	}

 	dir := t.TempDir()
--- a/src/runtime/cmd/kata-runtime/kata-env_amd64_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-env_amd64_test.go
@@ -56,10 +56,9 @@ func TestEnvGetEnvInfoSetsCPUType(t *testing.T) {
 	assert.NotEmpty(archRequiredKernelModules)

 	cpuType = getCPUtype()
-	switch cpuType {
-	case cpuTypeIntel:
+	if cpuType == cpuTypeIntel {
 		assert.Equal(archRequiredCPUFlags["vmx"], "Virtualization support")
-	case cpuTypeAMD:
+	} else if cpuType == cpuTypeAMD {
 		assert.Equal(archRequiredCPUFlags["svm"], "Virtualization support")
 	}

--- a/src/runtime/cmd/kata-runtime/kata-env_test.go
+++ b/src/runtime/cmd/kata-runtime/kata-env_test.go
@@ -14,6 +14,7 @@ import (
 	"path"
 	"path/filepath"
 	"runtime"
+	goruntime "runtime"
 	"strings"
 	"testing"

@@ -183,7 +184,7 @@ func genericGetExpectedHostDetails(tmpdir string, expectedVendor string, expecte
 	}

 	const expectedKernelVersion = "99.1"
-	const expectedArch = runtime.GOARCH
+	const expectedArch = goruntime.GOARCH

 	expectedDistro := DistroInfo{
 		Name:    "Foo",
@@ -253,7 +254,7 @@ VERSION_ID="%s"
 		}
 	}

-	if runtime.GOARCH == "arm64" {
+	if goruntime.GOARCH == "arm64" {
 		expectedHostDetails.CPU.Vendor = "ARM Limited"
 		expectedHostDetails.CPU.Model = "v8"
 	}
--- a/src/runtime/cmd/kata-runtime/kata-iptables.go
+++ b/src/runtime/cmd/kata-runtime/kata-iptables.go
@@ -55,9 +55,9 @@ var getIPTablesCommand = cli.Command{
 			return err
 		}

-		url := containerdshim.IPTablesURL
+		url := containerdshim.IPTablesUrl
 		if isIPv6 {
-			url = containerdshim.IP6TablesURL
+			url = containerdshim.IP6TablesUrl
 		}
 		body, err := shimclient.DoGet(sandboxID, defaultTimeout, url)
 		if err != nil {
@@ -108,9 +108,9 @@ var setIPTablesCommand = cli.Command{
 			return err
 		}

-		url := containerdshim.IPTablesURL
+		url := containerdshim.IPTablesUrl
 		if isIPv6 {
-			url = containerdshim.IP6TablesURL
+			url = containerdshim.IP6TablesUrl
 		}

 		if err = shimclient.DoPut(sandboxID, defaultTimeout, url, "application/octet-stream", buf); err != nil {
--- a/src/runtime/cmd/kata-runtime/kata-policy.go
+++ b/src/runtime/cmd/kata-runtime/kata-policy.go
@@ -62,7 +62,7 @@ var setPolicyCommand = cli.Command{
 			return err
 		}

-		url := containerdshim.PolicyURL
+		url := containerdshim.PolicyUrl

 		if err = shimclient.DoPut(sandboxID, defaultTimeout, url, "application/octet-stream", buf); err != nil {
 			return fmt.Errorf("Error observed when making policy-set request(%s): %s", policyFile, err)
--- a/src/runtime/cmd/kata-runtime/kata-volume.go
+++ b/src/runtime/cmd/kata-runtime/kata-volume.go
@@ -126,7 +126,7 @@ var resizeCommand = cli.Command{

 // Stats retrieves the filesystem stats of the direct volume inside the guest.
 func Stats(volumePath string) ([]byte, error) {
-	sandboxID, err := volume.GetSandboxIDForVolume(volumePath)
+	sandboxId, err := volume.GetSandboxIdForVolume(volumePath)
 	if err != nil {
 		return nil, err
 	}
@@ -136,8 +136,8 @@ func Stats(volumePath string) ([]byte, error) {
 	}

 	urlSafeDevicePath := url.PathEscape(volumeMountInfo.Device)
-	body, err := shimclient.DoGet(sandboxID, defaultTimeout,
-		fmt.Sprintf("%s?%s=%s", containerdshim.DirectVolumeStatURL, containerdshim.DirectVolumePathKey, urlSafeDevicePath))
+	body, err := shimclient.DoGet(sandboxId, defaultTimeout,
+		fmt.Sprintf("%s?%s=%s", containerdshim.DirectVolumeStatUrl, containerdshim.DirectVolumePathKey, urlSafeDevicePath))
 	if err != nil {
 		return nil, err
 	}
@@ -146,7 +146,7 @@ func Stats(volumePath string) ([]byte, error) {

 // Resize resizes a direct volume inside the guest.
 func Resize(volumePath string, size uint64) error {
-	sandboxID, err := volume.GetSandboxIDForVolume(volumePath)
+	sandboxId, err := volume.GetSandboxIdForVolume(volumePath)
 	if err != nil {
 		return err
 	}
@@ -163,5 +163,5 @@ func Resize(volumePath string, size uint64) error {
 	if err != nil {
 		return err
 	}
-	return shimclient.DoPost(sandboxID, defaultTimeout, containerdshim.DirectVolumeResizeURL, "application/json", encoded)
+	return shimclient.DoPost(sandboxId, defaultTimeout, containerdshim.DirectVolumeResizeUrl, "application/json", encoded)
 }
--- a/src/runtime/cmd/kata-runtime/release.go
+++ b/src/runtime/cmd/kata-runtime/release.go
@@ -94,12 +94,11 @@ func releaseURLIsValid(url string) error {
 func getReleaseURL(currentVersion semver.Version) (url string, err error) {
 	major := currentVersion.Major

-	switch major {
-	case 0:
+	if major == 0 {
 		return "", fmt.Errorf("invalid current version: %v", currentVersion)
-	case 1:
+	} else if major == 1 {
 		url = kataLegacyReleaseURL
-	default:
+	} else {
 		url = kataReleaseURL
 	}

--- a/src/runtime/config/configuration-clh.toml.in
+++ b/src/runtime/config/configuration-clh.toml.in
@@ -222,8 +222,8 @@ hypervisor_loglevel = 1
 # If false and nvdimm is supported, use nvdimm device to plug guest image.
 # Otherwise virtio-block device is used.
 #
-# nvdimm is not supported with Cloud Hypervisor or when `confidential_guest = true`.
-disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM_CLH@
+# nvdimm is not supported when `confidential_guest = true`.
+disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@

 # Enable hot-plugging of VFIO devices to a root-port.
 # The default setting is  "no-port"
--- a/src/runtime/go.mod
+++ b/src/runtime/go.mod
@@ -8,7 +8,7 @@ go 1.24.13

 require (
 	code.cloudfoundry.org/bytefmt v0.0.0-20211005130812-5bb3c17173e5
-	github.com/BurntSushi/toml v1.6.0
+	github.com/BurntSushi/toml v1.5.0
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/blang/semver/v4 v4.0.0
 	github.com/container-orchestrated-devices/container-device-interface v0.6.0
--- a/src/runtime/go.sum
+++ b/src/runtime/go.sum
@@ -8,9 +8,8 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
-github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
--- a/src/runtime/pkg/containerd-shim-v2/create.go
+++ b/src/runtime/pkg/containerd-shim-v2/create.go
@@ -40,6 +40,7 @@ import (
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils/katatrace"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/oci"
+	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/compatoci"
 	"tags.cncf.io/container-device-interface/pkg/cdi"
 )
@@ -51,7 +52,7 @@ var defaultStartManagementServerFunc startManagementServerFunc = func(s *service
 	shimLog.Info("management server started")
 }

-func copyLayersToMounts(rootFs *virtcontainers.RootFs, spec *specs.Spec) error {
+func copyLayersToMounts(rootFs *vc.RootFs, spec *specs.Spec) error {
 	for _, o := range rootFs.Options {
 		if !strings.HasPrefix(o, annotations.FileSystemLayer) {
 			continue
@@ -74,7 +75,7 @@ func copyLayersToMounts(rootFs *virtcontainers.RootFs, spec *specs.Spec) error {
 }

 func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*container, error) {
-	rootFs := virtcontainers.RootFs{}
+	rootFs := vc.RootFs{}
 	if len(r.Rootfs) == 1 {
 		m := r.Rootfs[0]
 		rootFs.Source = m.Source
@@ -107,7 +108,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 	}

 	switch containerType {
-	case virtcontainers.PodSandbox, virtcontainers.SingleContainer:
+	case vc.PodSandbox, vc.SingleContainer:
 		if s.sandbox != nil {
 			return nil, fmt.Errorf("cannot create another sandbox in sandbox: %s", s.sandbox.ID())
 		}
@@ -150,7 +151,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 		//   2. If this is not a sandbox infrastructure container, but instead a standalone single container (analogous to "docker run..."),
 		//	then the container spec itself will contain appropriate sizing information for the entire sandbox (since it is
 		//	a single container.
-		if containerType == virtcontainers.PodSandbox {
+		if containerType == vc.PodSandbox {
 			s.config.SandboxCPUs, s.config.SandboxMemMB = oci.CalculateSandboxSizing(ociSpec)
 		} else {
 			s.config.SandboxCPUs, s.config.SandboxMemMB = oci.CalculateContainerSizing(ociSpec)
@@ -202,7 +203,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 			defaultStartManagementServerFunc(s, ctx, ociSpec)
 		}

-	case virtcontainers.PodContainer:
+	case vc.PodContainer:
 		span, ctx := katatrace.Trace(s.ctx, shimLog, "create", shimTracingTags)
 		defer span.End()

@@ -324,7 +325,7 @@ func checkAndMount(s *service, r *taskAPI.CreateTaskRequest) (bool, error) {
 			return false, nil
 		}

-		if virtcontainers.IsNydusRootFSType(m.Type) {
+		if vc.IsNydusRootFSType(m.Type) {
 			// if kata + nydus, do not mount
 			return false, nil
 		}
@@ -360,7 +361,7 @@ func doMount(mounts []*containerd_types.Mount, rootfs string) error {
 	return nil
 }

-func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID string) error {
+func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxId string) error {
 	userName, err := utils.CreateVmmUser()
 	if err != nil {
 		return err
@@ -369,7 +370,7 @@ func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID stri
 		if err != nil {
 			shimLog.WithFields(logrus.Fields{
 				"user_name":  userName,
-				"sandbox_id": sandboxID,
+				"sandbox_id": sandboxId,
 			}).WithError(err).Warn("configure non root hypervisor failed, delete the user")
 			if err2 := utils.RemoveVmmUser(userName); err2 != nil {
 				shimLog.WithField("userName", userName).WithError(err).Warn("failed to remove user")
@@ -397,7 +398,7 @@ func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID stri
 		"user_name":  userName,
 		"uid":        uid,
 		"gid":        gid,
-		"sandbox_id": sandboxID,
+		"sandbox_id": sandboxId,
 	}).Debug("successfully created a non root user for the hypervisor")

 	userTmpDir := path.Join("/run/user/", fmt.Sprint(uid))
@@ -409,7 +410,7 @@ func configureNonRootHypervisor(runtimeConfig *oci.RuntimeConfig, sandboxID stri
 		}
 	}

-	if err = os.Mkdir(userTmpDir, virtcontainers.DirMode); err != nil {
+	if err = os.Mkdir(userTmpDir, vc.DirMode); err != nil {
 		return err
 	}
 	defer func() {
--- a/src/runtime/pkg/containerd-shim-v2/shim_management.go
+++ b/src/runtime/pkg/containerd-shim-v2/shim_management.go
@@ -34,13 +34,13 @@ import (

 const (
 	DirectVolumePathKey   = "path"
-	AgentURL              = "/agent-url"
-	DirectVolumeStatURL   = "/direct-volume/stats"
-	DirectVolumeResizeURL = "/direct-volume/resize"
-	IPTablesURL           = "/iptables"
-	PolicyURL             = "/policy"
-	IP6TablesURL          = "/ip6tables"
-	MetricsURL            = "/metrics"
+	AgentUrl              = "/agent-url"
+	DirectVolumeStatUrl   = "/direct-volume/stats"
+	DirectVolumeResizeUrl = "/direct-volume/resize"
+	IPTablesUrl           = "/iptables"
+	PolicyUrl             = "/policy"
+	IP6TablesUrl          = "/ip6tables"
+	MetricsUrl            = "/metrics"
 )

 var (
@@ -288,13 +288,13 @@ func (s *service) startManagementServer(ctx context.Context, ociSpec *specs.Spec

 	// bind handler
 	m := http.NewServeMux()
-	m.Handle(MetricsURL, http.HandlerFunc(s.serveMetrics))
-	m.Handle(AgentURL, http.HandlerFunc(s.agentURL))
-	m.Handle(DirectVolumeStatURL, http.HandlerFunc(s.serveVolumeStats))
-	m.Handle(DirectVolumeResizeURL, http.HandlerFunc(s.serveVolumeResize))
-	m.Handle(IPTablesURL, http.HandlerFunc(s.ipTablesHandler))
-	m.Handle(PolicyURL, http.HandlerFunc(s.policyHandler))
-	m.Handle(IP6TablesURL, http.HandlerFunc(s.ip6TablesHandler))
+	m.Handle(MetricsUrl, http.HandlerFunc(s.serveMetrics))
+	m.Handle(AgentUrl, http.HandlerFunc(s.agentURL))
+	m.Handle(DirectVolumeStatUrl, http.HandlerFunc(s.serveVolumeStats))
+	m.Handle(DirectVolumeResizeUrl, http.HandlerFunc(s.serveVolumeResize))
+	m.Handle(IPTablesUrl, http.HandlerFunc(s.ipTablesHandler))
+	m.Handle(PolicyUrl, http.HandlerFunc(s.policyHandler))
+	m.Handle(IP6TablesUrl, http.HandlerFunc(s.ip6TablesHandler))
 	s.mountPprofHandle(m, ociSpec)

 	// register shim metrics
@@ -373,7 +373,7 @@ func ClientSocketAddress(id string) (string, error) {
 	if _, err := os.Stat(socketPath); err != nil {
 		socketPath = SocketPathRust(id)
 		if _, err := os.Stat(socketPath); err != nil {
-			return "", fmt.Errorf("it fails to stat both %s and %s with error %v", SocketPathGo(id), SocketPathRust(id), err)
+			return "", fmt.Errorf("It fails to stat both %s and %s with error %v.", SocketPathGo(id), SocketPathRust(id), err)
 		}
 	}

--- a/src/runtime/pkg/device/drivers/vfio.go
+++ b/src/runtime/pkg/device/drivers/vfio.go
@@ -139,7 +139,7 @@ func (device *VFIODevice) Detach(ctx context.Context, devReceiver api.DeviceRece
 		}
 	}()

-	if device.DeviceInfo.ColdPlug {
+	if device.GenericDevice.DeviceInfo.ColdPlug {
 		// nothing to detach, device was cold plugged
 		deviceLogger().WithFields(logrus.Fields{
 			"device-group": device.DeviceInfo.HostPath,
@@ -264,7 +264,7 @@ func GetVFIODetails(deviceFileName, iommuDevicesPath string) (deviceBDF, deviceS
 // getMediatedBDF returns the BDF of a VF
 // Expected input string format is /sys/devices/pci0000:d7/BDF0/BDF1/.../MDEVBDF/UUID
 func getMediatedBDF(deviceSysfsDev string) string {
-	tokens := strings.Split(deviceSysfsDev, "/")
+	tokens := strings.SplitN(deviceSysfsDev, "/", -1)
 	if len(tokens) < 4 {
 		return ""
 	}
--- a/src/runtime/pkg/device/manager/manager.go
+++ b/src/runtime/pkg/device/manager/manager.go
@@ -59,11 +59,15 @@ func NewDeviceManager(blockDriver string, vhostUserStoreEnabled bool, vhostUserS
 		vhostUserReconnectTimeout: vhostUserReconnect,
 		devices:                   make(map[string]api.Device),
 	}
-
-	switch blockDriver {
-	case config.VirtioMmio, config.VirtioBlock, config.Nvdimm, config.VirtioBlockCCW:
-		dm.blockDriver = blockDriver
-	default:
+	if blockDriver == config.VirtioMmio {
+		dm.blockDriver = config.VirtioMmio
+	} else if blockDriver == config.VirtioBlock {
+		dm.blockDriver = config.VirtioBlock
+	} else if blockDriver == config.Nvdimm {
+		dm.blockDriver = config.Nvdimm
+	} else if blockDriver == config.VirtioBlockCCW {
+		dm.blockDriver = config.VirtioBlockCCW
+	} else {
 		dm.blockDriver = config.VirtioSCSI
 	}

--- a/src/runtime/pkg/direct-volume/utils.go
+++ b/src/runtime/pkg/direct-volume/utils.go
@@ -99,18 +99,18 @@ func VolumeMountInfo(volumePath string) (*MountInfo, error) {
 	return &mountInfo, nil
 }

-// RecordSandboxID associates a sandbox id with a direct volume.
-func RecordSandboxID(sandboxID string, volumePath string) error {
+// RecordSandboxId associates a sandbox id with a direct volume.
+func RecordSandboxId(sandboxId string, volumePath string) error {
 	encodedPath := b64.URLEncoding.EncodeToString([]byte(volumePath))
 	mountInfoFilePath := filepath.Join(kataDirectVolumeRootPath, encodedPath, mountInfoFileName)
 	if _, err := os.Stat(mountInfoFilePath); err != nil {
 		return err
 	}

-	return os.WriteFile(filepath.Join(kataDirectVolumeRootPath, encodedPath, sandboxID), []byte(""), 0600)
+	return os.WriteFile(filepath.Join(kataDirectVolumeRootPath, encodedPath, sandboxId), []byte(""), 0600)
 }

-func GetSandboxIDForVolume(volumePath string) (string, error) {
+func GetSandboxIdForVolume(volumePath string) (string, error) {
 	files, err := os.ReadDir(filepath.Join(kataDirectVolumeRootPath, b64.URLEncoding.EncodeToString([]byte(volumePath))))
 	if err != nil {
 		return "", err
--- a/src/runtime/pkg/direct-volume/utils_test.go
+++ b/src/runtime/pkg/direct-volume/utils_test.go
@@ -56,7 +56,7 @@ func TestAdd(t *testing.T) {
 	assert.Nil(t, err)
 }

-func TestRecordSandboxID(t *testing.T) {
+func TestRecordSandboxId(t *testing.T) {
 	var err error
 	kataDirectVolumeRootPath = t.TempDir()

@@ -73,22 +73,22 @@ func TestRecordSandboxID(t *testing.T) {
 	// Add the mount info
 	assert.Nil(t, Add(volumePath, string(buf)))

-	sandboxID := uuid.Generate().String()
-	err = RecordSandboxID(sandboxID, volumePath)
+	sandboxId := uuid.Generate().String()
+	err = RecordSandboxId(sandboxId, volumePath)
 	assert.Nil(t, err)

-	id, err := GetSandboxIDForVolume(volumePath)
+	id, err := GetSandboxIdForVolume(volumePath)
 	assert.Nil(t, err)
-	assert.Equal(t, sandboxID, id)
+	assert.Equal(t, sandboxId, id)
 }

-func TestRecordSandboxIDNoMountInfoFile(t *testing.T) {
+func TestRecordSandboxIdNoMountInfoFile(t *testing.T) {
 	var err error
 	kataDirectVolumeRootPath = t.TempDir()

 	var volumePath = "/a/b/c"
-	sandboxID := uuid.Generate().String()
-	err = RecordSandboxID(sandboxID, volumePath)
+	sandboxId := uuid.Generate().String()
+	err = RecordSandboxId(sandboxId, volumePath)
 	assert.Error(t, err)
 	assert.True(t, errors.Is(err, os.ErrNotExist))
 }
--- a/src/runtime/pkg/govmm/qemu/qemu.go
+++ b/src/runtime/pkg/govmm/qemu/qemu.go
@@ -496,8 +496,8 @@ type TdxQomObject struct {
 	Debug                 *bool         `json:"debug,omitempty"`
 }

-func (s *SocketAddress) String() string {
-	b, err := json.Marshal(*s)
+func (this *SocketAddress) String() string {
+	b, err := json.Marshal(*this)

 	if err != nil {
 		log.Fatalf("Unable to marshal SocketAddress object: %s", err.Error())
@@ -507,8 +507,8 @@ func (s *SocketAddress) String() string {
 	return string(b)
 }

-func (t *TdxQomObject) String() string {
-	b, err := json.Marshal(*t)
+func (this *TdxQomObject) String() string {
+	b, err := json.Marshal(*this)

 	if err != nil {
 		log.Fatalf("Unable to marshal TDX QOM object: %s", err.Error())
--- a/src/runtime/pkg/kata-monitor/metrics.go
+++ b/src/runtime/pkg/kata-monitor/metrics.go
@@ -259,7 +259,7 @@ func (km *KataMonitor) aggregateSandboxMetrics(encoder expfmt.Encoder, filterFam
 }

 func getParsedMetrics(sandboxID string, sandboxMetadata sandboxCRIMetadata) ([]*dto.MetricFamily, error) {
-	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsURL)
+	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsUrl)
 	if err != nil {
 		return nil, err
 	}
@@ -269,7 +269,7 @@ func getParsedMetrics(sandboxID string, sandboxMetadata sandboxCRIMetadata) ([]*

 // GetSandboxMetrics will get sandbox's metrics from shim
 func GetSandboxMetrics(sandboxID string) (string, error) {
-	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsURL)
+	body, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.MetricsUrl)
 	if err != nil {
 		return "", err
 	}
--- a/src/runtime/pkg/kata-monitor/metrics_test.go
+++ b/src/runtime/pkg/kata-monitor/metrics_test.go
@@ -138,11 +138,9 @@ func TestEncodeMetricFamily(t *testing.T) {
 			continue
 		}
 		// only check kata_monitor_running_shim_count and kata_monitor_scrape_count
-		switch fields[0] {
-		case "kata_monitor_running_shim_count":
+		if fields[0] == "kata_monitor_running_shim_count" {
 			assert.Equal("11", fields[1], "kata_monitor_running_shim_count should be 11")
-
-		case "kata_monitor_scrape_count":
+		} else if fields[0] == "kata_monitor_scrape_count" {
 			assert.Equal("2", fields[1], "kata_monitor_scrape_count should be 2")
 		}
 	}
--- a/src/runtime/pkg/kata-monitor/monitor.go
+++ b/src/runtime/pkg/kata-monitor/monitor.go
@@ -184,7 +184,7 @@ func (km *KataMonitor) GetAgentURL(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	data, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.AgentURL)
+	data, err := shimclient.DoGet(sandboxID, defaultTimeout, containerdshim.AgentUrl)
 	if err != nil {
 		commonServeError(w, http.StatusBadRequest, err)
 		return
@@ -206,14 +206,14 @@ func (km *KataMonitor) ListSandboxes(w http.ResponseWriter, r *http.Request) {

 func listSandboxesText(sandboxes []string, w http.ResponseWriter) {
 	for _, s := range sandboxes {
-		fmt.Fprintf(w, "%s\n", s)
+		w.Write([]byte(fmt.Sprintf("%s\n", s)))
 	}
 }
 func listSandboxesHtml(sandboxes []string, w http.ResponseWriter) {
 	w.Write([]byte("<h1>Sandbox list</h1>\n"))
 	w.Write([]byte("<ul>\n"))
 	for _, s := range sandboxes {
-		fmt.Fprintf(w, "<li>%s: <a href='/debug/pprof/?sandbox=%s'>pprof</a>, <a href='/metrics?sandbox=%s'>metrics</a>, <a href='/agent-url?sandbox=%s'>agent-url</a></li>\n", s, s, s, s)
+		w.Write([]byte(fmt.Sprintf("<li>%s: <a href='/debug/pprof/?sandbox=%s'>pprof</a>, <a href='/metrics?sandbox=%s'>metrics</a>, <a href='/agent-url?sandbox=%s'>agent-url</a></li>\n", s, s, s, s)))
 	}
 	w.Write([]byte("</ul>\n"))
 }
--- a/src/runtime/pkg/kata-monitor/pprof.go
+++ b/src/runtime/pkg/kata-monitor/pprof.go
@@ -98,7 +98,7 @@ func (km *KataMonitor) ExpvarHandler(w http.ResponseWriter, r *http.Request) {
 // PprofIndex handles other `/debug/pprof/` requests
 func (km *KataMonitor) PprofIndex(w http.ResponseWriter, r *http.Request) {
 	if len(strings.TrimPrefix(r.URL.Path, "/debug/pprof/")) == 0 {
-		km.proxyRequest(w, r, copyResponseAddingSandboxIDToHref)
+		km.proxyRequest(w, r, copyResponseAddingSandboxIdToHref)
 	} else {
 		km.proxyRequest(w, r, nil)
 	}
@@ -132,7 +132,7 @@ func copyResponse(req *http.Request, w io.Writer, r io.Reader) error {
 	return err
 }

-func copyResponseAddingSandboxIDToHref(req *http.Request, w io.Writer, r io.Reader) error {
+func copyResponseAddingSandboxIdToHref(req *http.Request, w io.Writer, r io.Reader) error {
 	sb, err := getSandboxIDFromReq(req)
 	if err != nil {
 		monitorLog.WithError(err).Warning("missing sandbox query in pprof url")
--- a/src/runtime/pkg/kata-monitor/pprof_test.go
+++ b/src/runtime/pkg/kata-monitor/pprof_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )

-func TestCopyResponseAddingSandboxIDToHref(t *testing.T) {
+func TestCopyResponseAddingSandboxIdToHref(t *testing.T) {
 	assert := assert.New(t)

 	htmlIn := strings.NewReader(`
@@ -112,6 +112,6 @@ Profile Descriptions:

 	req := &http.Request{URL: &url.URL{RawQuery: "sandbox=1234567890"}}
 	buf := bytes.NewBuffer(nil)
-	copyResponseAddingSandboxIDToHref(req, buf, htmlIn)
+	copyResponseAddingSandboxIdToHref(req, buf, htmlIn)
 	assert.Equal(htmlExpected, buf)
 }
--- a/src/runtime/pkg/katatestutils/constraints.go
+++ b/src/runtime/pkg/katatestutils/constraints.go
@@ -98,8 +98,8 @@ func getKernelVersion() (string, error) {
 // These kernel version can't be parsed by the current lib and lead to panic
 // therefore the '+' should be removed.
 func fixKernelVersion(version string) string {
-	version = strings.ReplaceAll(version, "_", "-")
-	return strings.ReplaceAll(version, "+", "")
+	version = strings.Replace(version, "_", "-", -1)
+	return strings.Replace(version, "+", "", -1)
 }

 // handleKernelVersion checks that the current kernel version is compatible with
--- a/src/runtime/pkg/katatestutils/utils.go
+++ b/src/runtime/pkg/katatestutils/utils.go
@@ -23,7 +23,7 @@ const (
 	testDirMode  = os.FileMode(0750)
 	testFileMode = os.FileMode(0640)

-	busyboxConfigJSON = `
+	busyboxConfigJson = `
 {
 	"ociVersion": "1.0.1-dev",
 	"process": {
@@ -359,7 +359,7 @@ func SetupOCIConfigFile(t *testing.T) (rootPath string, bundlePath, ociConfigFil
 	assert.NoError(err)

 	ociConfigFile = filepath.Join(bundlePath, "config.json")
-	err = os.WriteFile(ociConfigFile, []byte(busyboxConfigJSON), testFileMode)
+	err = os.WriteFile(ociConfigFile, []byte(busyboxConfigJson), testFileMode)
 	assert.NoError(err)

 	return tmpdir, bundlePath, ociConfigFile
--- a/src/runtime/pkg/katautils/config.go
+++ b/src/runtime/pkg/katautils/config.go
@@ -22,6 +22,7 @@ import (
 	govmmQemu "github.com/kata-containers/kata-containers/src/runtime/pkg/govmm/qemu"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils/katatrace"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/oci"
+	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	exp "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/experimental"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/types"
@@ -1899,8 +1900,8 @@ func checkConfig(config oci.RuntimeConfig) error {
 // checkPCIeConfig ensures the PCIe configuration is valid.
 // Only allow one of the following settings for cold-plug:
 // no-port, root-port, switch-port
-func checkPCIeConfig(coldPlug config.PCIePort, hotPlug config.PCIePort, machineType string, hypervisorType vc.HypervisorType) error {
-	if hypervisorType != vc.QemuHypervisor && hypervisorType != vc.ClhHypervisor {
+func checkPCIeConfig(coldPlug config.PCIePort, hotPlug config.PCIePort, machineType string, hypervisorType virtcontainers.HypervisorType) error {
+	if hypervisorType != virtcontainers.QemuHypervisor && hypervisorType != virtcontainers.ClhHypervisor {
 		kataUtilsLogger.Warn("Advanced PCIe Topology only available for QEMU/CLH hypervisor, ignoring hot(cold)_vfio_port setting")
 		return nil
 	}
@@ -1916,7 +1917,7 @@ func checkPCIeConfig(coldPlug config.PCIePort, hotPlug config.PCIePort, machineT
 	if machineType != "q35" && machineType != "virt" {
 		return nil
 	}
-	if hypervisorType == vc.ClhHypervisor {
+	if hypervisorType == virtcontainers.ClhHypervisor {
 		if coldPlug != config.NoPort {
 			return fmt.Errorf("cold-plug not supported on CLH")
 		}
--- a/src/runtime/pkg/katautils/create_test.go
+++ b/src/runtime/pkg/katautils/create_test.go
@@ -21,6 +21,7 @@ import (
 	config "github.com/kata-containers/kata-containers/src/runtime/pkg/device/config"
 	ktu "github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils"
 	"github.com/kata-containers/kata-containers/src/runtime/pkg/oci"
+	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/compatoci"
 	"github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/vcmock"
@@ -426,7 +427,7 @@ func TestVfioChecksClh(t *testing.T) {

 	// Check valid CLH vfio configs
 	f := func(coldPlug, hotPlug config.PCIePort) error {
-		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, vc.ClhHypervisor)
+		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, virtcontainers.ClhHypervisor)
 	}
 	assert.NoError(f(config.NoPort, config.NoPort))
 	assert.NoError(f(config.NoPort, config.RootPort))
@@ -440,7 +441,7 @@ func TestVfioCheckQemu(t *testing.T) {

 	// Check valid Qemu vfio configs
 	f := func(coldPlug, hotPlug config.PCIePort) error {
-		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, vc.QemuHypervisor)
+		return checkPCIeConfig(coldPlug, hotPlug, defaultMachineType, virtcontainers.QemuHypervisor)
 	}

 	assert.NoError(f(config.NoPort, config.NoPort))
--- a/src/runtime/pkg/katautils/logger_test.go
+++ b/src/runtime/pkg/katautils/logger_test.go
@@ -90,7 +90,7 @@ func TestNewSystemLogHook(t *testing.T) {

 	output := string(bytes)
 	output = strings.TrimSpace(output)
-	output = strings.ReplaceAll(output, `"`, "")
+	output = strings.Replace(output, `"`, "", -1)

 	fields := strings.Fields(output)

--- a/src/runtime/pkg/oci/utils_test.go
+++ b/src/runtime/pkg/oci/utils_test.go
@@ -1143,7 +1143,7 @@ func TestParseAnnotationBoolConfiguration(t *testing.T) {
 			ocispec := specs.Spec{
 				Annotations: map[string]string{tc.annotationKey: annotaionValue},
 			}
-			val := false
+			var val bool = false

 			err := newAnnotationConfiguration(ocispec, tc.annotationKey).setBool(func(v bool) {
 				val = v
--- a/src/runtime/pkg/utils/shimclient/shim_management_client.go
+++ b/src/runtime/pkg/utils/shimclient/shim_management_client.go
@@ -47,8 +47,8 @@ func buildUnixSocketClient(socketAddr string, timeout time.Duration) (*http.Clie
 	return client, nil
 }

-func DoGet(sandboxID string, timeout time.Duration, urlPath string) ([]byte, error) {
-	client, err := BuildShimClient(sandboxID, timeout)
+func DoGet(sandboxID string, timeoutInSeconds time.Duration, urlPath string) ([]byte, error) {
+	client, err := BuildShimClient(sandboxID, timeoutInSeconds)
 	if err != nil {
 		return nil, err
 	}
@@ -71,8 +71,8 @@ func DoGet(sandboxID string, timeout time.Duration, urlPath string) ([]byte, err
 }

 // DoPut will make a PUT request to the shim endpoint that handles the given sandbox ID
-func DoPut(sandboxID string, timeout time.Duration, urlPath, contentType string, payload []byte) error {
-	client, err := BuildShimClient(sandboxID, timeout)
+func DoPut(sandboxID string, timeoutInSeconds time.Duration, urlPath, contentType string, payload []byte) error {
+	client, err := BuildShimClient(sandboxID, timeoutInSeconds)
 	if err != nil {
 		return err
 	}
@@ -103,8 +103,8 @@ func DoPut(sandboxID string, timeout time.Duration, urlPath, contentType string,
 }

 // DoPost will make a POST request to the shim endpoint that handles the given sandbox ID
-func DoPost(sandboxID string, timeout time.Duration, urlPath, contentType string, payload []byte) error {
-	client, err := BuildShimClient(sandboxID, timeout)
+func DoPost(sandboxID string, timeoutInSeconds time.Duration, urlPath, contentType string, payload []byte) error {
+	client, err := BuildShimClient(sandboxID, timeoutInSeconds)
 	if err != nil {
 		return err
 	}
--- a/src/runtime/vendor/github.com/BurntSushi/toml/README.md
+++ b/src/runtime/vendor/github.com/BurntSushi/toml/README.md
@@ -1,7 +1,7 @@
 TOML stands for Tom's Obvious, Minimal Language. This Go package provides a
 reflection interface similar to Go's standard library `json` and `xml` packages.

-Compatible with TOML version [v1.1.0](https://toml.io/en/v1.1.0).
+Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).

 Documentation: https://pkg.go.dev/github.com/BurntSushi/toml

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .27.0
 .26.0