Merge pull request #4971 from Megan-Wright/CCv0

CCv0: Merge main into CCv0 branch
2026-01-24 16:54:26 +01:00 · 2022-08-24 09:13:01 -05:00
parent 4960f43ef6 c6c8018730
commit ccf21299cc
76 changed files with 2048 additions and 1380 deletions
--- a/ci/install_libseccomp.sh
+++ b/ci/install_libseccomp.sh
@@ -28,7 +28,7 @@ workdir="$(mktemp -d --tmpdir build-libseccomp.XXXXX)"
 # After solving the issue, replace this code by using the `versions.yaml`.
 # libseccomp_version=$(get_version "externals.libseccomp.version")
 # libseccomp_url=$(get_version "externals.libseccomp.url")
-libseccomp_version="2.5.1"
+libseccomp_version="2.5.4"
 libseccomp_url="https://github.com/seccomp/libseccomp"
 libseccomp_tarball="libseccomp-${libseccomp_version}.tar.gz"
 libseccomp_tarball_url="${libseccomp_url}/releases/download/v${libseccomp_version}/${libseccomp_tarball}"
--- a/docs/install/minikube-installation-guide.md
+++ b/docs/install/minikube-installation-guide.md
@@ -55,11 +55,11 @@ Here are the features to set up a CRI-O based Minikube, and why you need them:

 | what | why |
 | ---- | --- |
-| `--bootstrapper=kubeadm` | As recommended for [minikube CRI-o](https://kubernetes.io/docs/setup/minikube/#cri-o) |
+| `--bootstrapper=kubeadm` | As recommended for [minikube CRI-O](https://minikube.sigs.k8s.io/docs/handbook/config/#runtime-configuration) |
 | `--container-runtime=cri-o` | Using CRI-O for Kata |
-| `--enable-default-cni` | As recommended for [minikube CRI-o](https://kubernetes.io/docs/setup/minikube/#cri-o) |
+| `--enable-default-cni` | As recommended for [minikube CRI-O](https://minikube.sigs.k8s.io/docs/handbook/config/#runtime-configuration) |
 | `--memory 6144` | Allocate sufficient memory, as Kata Containers default to 1 or 2Gb |
-| `--network-plugin=cni` | As recommended for [minikube CRI-o](https://kubernetes.io/docs/setup/minikube/#cri-o) |
+| `--network-plugin=cni` | As recommended for [minikube CRI-O](https://minikube.sigs.k8s.io/docs/handbook/config/#runtime-configuration) |
 | `--vm-driver kvm2` | The host VM driver |

 To use containerd, modify the `--container-runtime` argument:
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -206,7 +206,7 @@ parts:

      # Install raw kernel
      vmlinux_path="vmlinux"
-      [ "${arch}" = "s390x" ] && vmlinux_path="arch/s390/boot/compressed/vmlinux"
+      [ "${arch}" = "s390x" ] && vmlinux_path="arch/s390/boot/vmlinux"
      vmlinux_name="vmlinux-${kernel_suffix}"
      cp "${vmlinux_path}" "${kata_kernel_dir}/${vmlinux_name}"
      ln -sf "${vmlinux_name}" "${kata_kernel_dir}/vmlinux.container"
--- a/src/agent/Cargo.lock
+++ b/src/agent/Cargo.lock
@@ -1836,21 +1836,20 @@ checksum = "292a948cd991e376cf75541fe5b97a1081d713c618b4f1b9500f8844e49eb565"

 [[package]]
 name = "libseccomp"
-version = "0.1.3"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36ad71a5b66ceef3acfe6a3178b29b4da063f8bcb2c36dab666d52a7a9cfdb86"
+checksum = "49bda1fbf25c42ac8942ff7df1eb6172a3bc36299e84be0dba8c888a7db68c80"
 dependencies = [
 "libc",
 "libseccomp-sys",
- "nix 0.17.0",
 "pkg-config",
 ]

 [[package]]
 name = "libseccomp-sys"
-version = "0.1.1"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "539912de229a4fc16e507e8df12a394038a524a5b5b6c92045ad344472aac475"
+checksum = "9a7cbbd4ad467251987c6e5b47d53b11a5a05add08f2447a9e2d70aef1e0d138"

 [[package]]
 name = "libz-sys"
@@ -2100,19 +2099,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"

-[[package]]
-name = "nix"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50e4785f2c3b7589a0d0c1dd60285e1188adac4006e8abd6dd578e1567027363"
-dependencies = [
- "bitflags",
- "cc",
- "cfg-if 0.1.10",
- "libc",
- "void",
-]
-
 [[package]]
 name = "nix"
 version = "0.23.1"
@@ -3119,6 +3105,7 @@ dependencies = [
 "slog",
 "slog-scope",
 "tempfile",
+ "test-utils",
 "tokio",
 ]

@@ -4304,12 +4291,6 @@ version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"

-[[package]]
-name = "void"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
-
 [[package]]
 name = "vsock"
 version = "0.2.6"
@@ -4328,7 +4309,7 @@ dependencies = [
 "bincode",
 "byteorder",
 "libc",
- "nix 0.23.1",
+ "nix 0.24.2",
 "opentelemetry",
 "serde",
 "slog",
--- a/src/agent/Cargo.toml
+++ b/src/agent/Cargo.toml
@@ -12,7 +12,7 @@ lazy_static = "1.3.0"
 ttrpc = { version = "0.6.0", features = ["async"], default-features = false }
 protobuf = "2.27.0"
 libc = "0.2.58"
-nix = "0.24.1"
+nix = "0.24.2"
 capctl = "0.2.0"
 serde_json = "1.0.39"
 scan_fmt = "0.2.3"
@@ -51,7 +51,7 @@ log = "0.4.11"
 prometheus = { version = "0.13.0", features = ["process"] }
 procfs = "0.12.0"
 anyhow = "1.0.32"
-cgroups = { package = "cgroups-rs", version = "0.2.8" }
+cgroups = { package = "cgroups-rs", version = "0.2.10" }

 # Tracing
 tracing = "0.1.26"
--- a/src/agent/rustjail/Cargo.toml
+++ b/src/agent/rustjail/Cargo.toml
@@ -23,7 +23,7 @@ scan_fmt = "0.2.6"
 regex = "1.5.5"
 path-absolutize = "1.2.0"
 anyhow = "1.0.32"
-cgroups = { package = "cgroups-rs", version = "0.2.8" }
+cgroups = { package = "cgroups-rs", version = "0.2.10" }
 rlimit = "0.5.3"
 cfg-if = "0.1.0"

@@ -31,11 +31,12 @@ tokio = { version = "1.2.0", features = ["sync", "io-util", "process", "time", "
 futures = "0.3.17"
 async-trait = "0.1.31"
 inotify = "0.9.2"
-libseccomp = { version = "0.1.3", optional = true }
+libseccomp = { version = "0.2.3", optional = true }

 [dev-dependencies]
 serial_test = "0.5.0"
 tempfile = "3.1.0"
+test-utils = { path = "../../libs/test-utils" }

 [features]
 seccomp = ["libseccomp"]
--- a/src/agent/rustjail/src/container.rs
+++ b/src/agent/rustjail/src/container.rs
@@ -1457,7 +1457,12 @@ impl LinuxContainer {
            linux.cgroups_path.clone()
        };

-        let cgroup_manager = FsManager::new(cpath.as_str())?;
+        let cgroup_manager = FsManager::new(cpath.as_str()).map_err(|e| {
+            anyhow!(format!(
+                "fail to create cgroup manager with path {}: {:}",
+                cpath, e
+            ))
+        })?;
        info!(logger, "new cgroup_manager {:?}", &cgroup_manager);

        Ok(LinuxContainer {
@@ -1656,12 +1661,12 @@ fn valid_env(e: &str) -> Option<(&str, &str)> {
 mod tests {
    use super::*;
    use crate::process::Process;
-    use crate::skip_if_not_root;
    use nix::unistd::Uid;
    use std::fs;
    use std::os::unix::fs::MetadataExt;
    use std::os::unix::io::AsRawFd;
    use tempfile::tempdir;
+    use test_utils::skip_if_not_root;
    use tokio::process::Command;

    macro_rules! sl {
--- a/src/agent/rustjail/src/lib.rs
+++ b/src/agent/rustjail/src/lib.rs
@@ -520,15 +520,6 @@ pub fn grpc_to_oci(grpc: &grpc::Spec) -> oci::Spec {
 #[cfg(test)]
 mod tests {
    use super::*;
-    #[macro_export]
-    macro_rules! skip_if_not_root {
-        () => {
-            if !nix::unistd::Uid::effective().is_root() {
-                println!("INFO: skipping {} which needs root", module_path!());
-                return;
-            }
-        };
-    }

    // Parameters:
    //
--- a/src/agent/rustjail/src/mount.rs
+++ b/src/agent/rustjail/src/mount.rs
@@ -1072,7 +1072,6 @@ fn readonly_path(path: &str) -> Result<()> {
 mod tests {
    use super::*;
    use crate::assert_result;
-    use crate::skip_if_not_root;
    use std::fs::create_dir;
    use std::fs::create_dir_all;
    use std::fs::remove_dir_all;
@@ -1080,6 +1079,7 @@ mod tests {
    use std::os::unix::fs;
    use std::os::unix::io::AsRawFd;
    use tempfile::tempdir;
+    use test_utils::skip_if_not_root;

    #[test]
    #[serial(chdir)]
--- a/src/agent/rustjail/src/seccomp.rs
+++ b/src/agent/rustjail/src/seccomp.rs
@@ -26,12 +26,15 @@ fn get_rule_conditions(args: &[LinuxSeccompArg]) -> Result<Vec<ScmpArgCompare>>
            return Err(anyhow!("seccomp opreator is required"));
        }

-        let cond = ScmpArgCompare::new(
-            arg.index,
-            ScmpCompareOp::from_str(&arg.op)?,
-            arg.value,
-            Some(arg.value_two),
-        );
+        let mut op = ScmpCompareOp::from_str(&arg.op)?;
+        let mut value = arg.value;
+        // For SCMP_CMP_MASKED_EQ, arg.value is the mask and arg.value_two is the value
+        if op == ScmpCompareOp::MaskedEqual(u64::default()) {
+            op = ScmpCompareOp::MaskedEqual(arg.value);
+            value = arg.value_two;
+        }
+
+        let cond = ScmpArgCompare::new(arg.index, op, value);

        conditions.push(cond);
    }
@@ -44,7 +47,7 @@ pub fn get_unknown_syscalls(scmp: &LinuxSeccomp) -> Option<Vec<String>> {

    for syscall in &scmp.syscalls {
        for name in &syscall.names {
-            if get_syscall_from_name(name, None).is_err() {
+            if ScmpSyscall::from_name(name).is_err() {
                unknown_syscalls.push(name.to_string());
            }
        }
@@ -60,7 +63,7 @@ pub fn get_unknown_syscalls(scmp: &LinuxSeccomp) -> Option<Vec<String>> {
 // init_seccomp creates a seccomp filter and loads it for the current process
 // including all the child processes.
 pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> {
-    let def_action = ScmpAction::from_str(scmp.default_action.as_str(), Some(libc::EPERM as u32))?;
+    let def_action = ScmpAction::from_str(scmp.default_action.as_str(), Some(libc::EPERM as i32))?;

    // Create a new filter context
    let mut filter = ScmpFilterContext::new_filter(def_action)?;
@@ -72,7 +75,7 @@ pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> {
    }

    // Unset no new privileges bit
-    filter.set_no_new_privs_bit(false)?;
+    filter.set_ctl_nnp(false)?;

    // Add a rule for each system call
    for syscall in &scmp.syscalls {
@@ -80,13 +83,13 @@ pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> {
            return Err(anyhow!("syscall name is required"));
        }

-        let action = ScmpAction::from_str(&syscall.action, Some(syscall.errno_ret))?;
+        let action = ScmpAction::from_str(&syscall.action, Some(syscall.errno_ret as i32))?;
        if action == def_action {
            continue;
        }

        for name in &syscall.names {
-            let syscall_num = match get_syscall_from_name(name, None) {
+            let syscall_num = match ScmpSyscall::from_name(name) {
                Ok(num) => num,
                Err(_) => {
                    // If we cannot resolve the given system call, we assume it is not supported
@@ -96,10 +99,10 @@ pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> {
            };

            if syscall.args.is_empty() {
-                filter.add_rule(action, syscall_num, None)?;
+                filter.add_rule(action, syscall_num)?;
            } else {
                let conditions = get_rule_conditions(&syscall.args)?;
-                filter.add_rule(action, syscall_num, Some(&conditions))?;
+                filter.add_rule_conditional(action, syscall_num, &conditions)?;
            }
        }
    }
@@ -119,10 +122,10 @@ pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::skip_if_not_root;
    use libc::{dup3, process_vm_readv, EPERM, O_CLOEXEC};
    use std::io::Error;
    use std::ptr::null;
+    use test_utils::skip_if_not_root;

    macro_rules! syscall_assert {
        ($e1: expr, $e2: expr) => {
--- a/src/agent/src/mount.rs
+++ b/src/agent/src/mount.rs
@@ -840,7 +840,8 @@ pub fn get_mount_fs_type_from_file(mount_file: &str, mount_point: &str) -> Resul
        return Err(anyhow!("Invalid mount point {}", mount_point));
    }

-    let content = fs::read_to_string(mount_file)?;
+    let content = fs::read_to_string(mount_file)
+        .map_err(|e| anyhow!("read mount file {}: {}", mount_file, e))?;

    let re = Regex::new(format!("device .+ mounted on {} with fstype (.+)", mount_point).as_str())?;

--- a/src/agent/src/rpc.rs
+++ b/src/agent/src/rpc.rs
@@ -298,7 +298,20 @@ impl AgentService {
            info!(sl!(), "no process configurations!");
            return Err(anyhow!(nix::Error::EINVAL));
        };
-        ctr.start(p).await?;
+
+        // if starting container failed, we will do some rollback work
+        // to ensure no resources are leaked.
+        if let Err(err) = ctr.start(p).await {
+            error!(sl!(), "failed to start container: {:?}", err);
+            if let Err(e) = ctr.destroy().await {
+                error!(sl!(), "failed to destroy container: {:?}", e);
+            }
+            if let Err(e) = remove_container_resources(&mut s, &cid) {
+                error!(sl!(), "failed to remove container resources: {:?}", e);
+            }
+            return Err(err);
+        }
+
        s.update_shared_pidns(&ctr)?;
        s.add_container(ctr);
        info!(sl!(), "created container!");
@@ -344,27 +357,6 @@ impl AgentService {
        req: protocols::agent::RemoveContainerRequest,
    ) -> Result<()> {
        let cid = req.container_id.clone();
-        let mut cmounts: Vec<String> = vec![];
-
-        let mut remove_container_resources = |sandbox: &mut Sandbox| -> Result<()> {
-            // Find the sandbox storage used by this container
-            let mounts = sandbox.container_mounts.get(&cid);
-            if let Some(mounts) = mounts {
-                for m in mounts.iter() {
-                    if sandbox.storages.get(m).is_some() {
-                        cmounts.push(m.to_string());
-                    }
-                }
-            }
-
-            for m in cmounts.iter() {
-                sandbox.unset_and_remove_sandbox_storage(m)?;
-            }
-
-            sandbox.container_mounts.remove(cid.as_str());
-            sandbox.containers.remove(cid.as_str());
-            Ok(())
-        };

        if req.timeout == 0 {
            let s = Arc::clone(&self.sandbox);
@@ -378,7 +370,7 @@ impl AgentService {
                .destroy()
                .await?;

-            remove_container_resources(&mut sandbox)?;
+            remove_container_resources(&mut sandbox, &cid)?;

            return Ok(());
        }
@@ -410,8 +402,7 @@ impl AgentService {

        let s = self.sandbox.clone();
        let mut sandbox = s.lock().await;
-
-        remove_container_resources(&mut sandbox)?;
+        remove_container_resources(&mut sandbox, &cid)?;

        Ok(())
    }
@@ -1853,6 +1844,35 @@ fn update_container_namespaces(
    Ok(())
 }

+fn remove_container_resources(sandbox: &mut Sandbox, cid: &str) -> Result<()> {
+    let mut cmounts: Vec<String> = vec![];
+
+    // Find the sandbox storage used by this container
+    let mounts = sandbox.container_mounts.get(cid);
+    if let Some(mounts) = mounts {
+        for m in mounts.iter() {
+            if sandbox.storages.get(m).is_some() {
+                cmounts.push(m.to_string());
+            }
+        }
+    }
+
+    for m in cmounts.iter() {
+        if let Err(err) = sandbox.unset_and_remove_sandbox_storage(m) {
+            error!(
+                sl!(),
+                "failed to unset_and_remove_sandbox_storage for container {}, error: {:?}",
+                cid,
+                err
+            );
+        }
+    }
+
+    sandbox.container_mounts.remove(cid);
+    sandbox.containers.remove(cid);
+    Ok(())
+}
+
 fn append_guest_hooks(s: &Sandbox, oci: &mut Spec) -> Result<()> {
    if let Some(ref guest_hooks) = s.hooks {
        let mut hooks = oci.hooks.take().unwrap_or_default();
@@ -2191,6 +2211,7 @@ mod tests {
        let result = load_kernel_module(&m);
        assert!(result.is_err(), "load module should failed");

+        skip_if_not_root!();
        // case 3: normal module.
        // normally this module should eixsts...
        m.name = "bridge".to_string();
--- a/src/agent/vsock-exporter/Cargo.toml
+++ b/src/agent/vsock-exporter/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2018"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
-nix = "0.23.0"
+nix = "0.24.2"
 libc = "0.2.94"
 thiserror = "1.0.26"
 opentelemetry = { version = "0.14.0", features=["serialize"] }
--- a/src/dragonball/Cargo.toml
+++ b/src/dragonball/Cargo.toml
@@ -28,7 +28,7 @@ lazy_static = "1.2"
 libc = "0.2.39"
 linux-loader = "0.4.0"
 log = "0.4.14"
-nix = "0.23.1"
+nix = "0.24.2"
 seccompiler = "0.2.0"
 serde = "1.0.27"
 serde_derive = "1.0.27"
--- a/src/libs/Cargo.lock
+++ b/src/libs/Cargo.lock
@@ -404,6 +404,7 @@ dependencies = [
 "serde_json",
 "slog",
 "slog-scope",
+ "tempfile",
 "thiserror",
 "toml",
 ]
--- a/src/libs/kata-sys-util/Cargo.toml
+++ b/src/libs/kata-sys-util/Cargo.toml
@@ -18,7 +18,7 @@ common-path = "=1.0.0"
 fail = "0.5.0"
 lazy_static = "1.4.0"
 libc = "0.2.100"
-nix = "0.24.1"
+nix = "0.24.2"
 once_cell = "1.9.0"
 serde_json = "1.0.73"
 slog = "2.5.2"
--- a/src/libs/kata-types/Cargo.toml
+++ b/src/libs/kata-types/Cargo.toml
@@ -26,6 +26,8 @@ toml = "0.5.8"
 oci = { path = "../oci" }

 [dev-dependencies]
+tempfile = "3"
+
 [features]
 default = []
 enable-vendor = []
--- a/src/libs/kata-types/src/config/drop_in.rs
+++ b/src/libs/kata-types/src/config/drop_in.rs
@@ -0,0 +1,384 @@
+// Copyright Red Hat
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+pub use drop_in_directory_handling::load;
+
+mod toml_tree_ops {
+    // The following pair of functions implement toml::Value tree merging, with
+    // the second argument being merged into the first one and consumed in the
+    // process.  The toml parser crate in use here doesn't support parsing into
+    // a pre-existing (possibly pre-filled) TomlConfig instance but can parse
+    // into a toml::Value tree so we use that instead.  All files (base and
+    // drop-ins) are initially parsed into toml::Value trees which are
+    // subsequently merged.  Only when the fully merged tree is computed it is
+    // converted to a TomlConfig instance.
+
+    fn merge_tables(base_table: &mut toml::value::Table, dropin_table: toml::value::Table) {
+        for (key, val) in dropin_table.into_iter() {
+            match base_table.get_mut(&key) {
+                Some(base_val) => merge(base_val, val),
+                None => {
+                    base_table.insert(key, val);
+                }
+            }
+        }
+    }
+
+    pub fn merge(base: &mut toml::Value, dropin: toml::Value) {
+        match dropin {
+            toml::Value::Table(dropin_table) => {
+                if let toml::Value::Table(base_table) = base {
+                    merge_tables(base_table, dropin_table);
+                } else {
+                    *base = toml::Value::Table(dropin_table);
+                }
+            }
+
+            _ => *base = dropin,
+        }
+    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+
+        // Mock config structure to stand in for TomlConfig for low-level
+        // toml::Value trees merging.
+        #[derive(Deserialize, Debug, Default, PartialEq)]
+        struct SubConfig {
+            #[serde(default)]
+            another_string: String,
+            #[serde(default)]
+            yet_another_number: i32,
+            #[serde(default)]
+            sub_array: Vec<i32>,
+        }
+
+        #[derive(Deserialize, Debug, Default, PartialEq)]
+        struct Config {
+            #[serde(default)]
+            number: i32,
+            #[serde(default)]
+            string: String,
+            #[serde(default)]
+            another_number: u8,
+            #[serde(default)]
+            array: Vec<i32>,
+
+            #[serde(default)]
+            sub: SubConfig,
+        }
+
+        #[test]
+        fn dropin_does_not_interfere_with_base() {
+            let mut base: toml::Value = toml::from_str(
+                r#"
+                number = 42
+            "#,
+            )
+            .unwrap();
+
+            let dropin: toml::Value = toml::from_str(
+                r#"
+                string = "foo"
+            "#,
+            )
+            .unwrap();
+
+            merge(&mut base, dropin);
+
+            assert_eq!(
+                base.try_into(),
+                Ok(Config {
+                    number: 42,
+                    string: "foo".into(),
+                    sub: Default::default(),
+                    ..Default::default()
+                })
+            );
+        }
+
+        #[test]
+        fn dropin_overrides_base() {
+            let mut base: toml::Value = toml::from_str(
+                r#"
+                number = 42
+                [sub]
+                another_string = "foo"
+            "#,
+            )
+            .unwrap();
+
+            let dropin: toml::Value = toml::from_str(
+                r#"
+                number = 43
+                [sub]
+                another_string = "bar"
+            "#,
+            )
+            .unwrap();
+
+            merge(&mut base, dropin);
+
+            assert_eq!(
+                base.try_into(),
+                Ok(Config {
+                    number: 43,
+                    sub: SubConfig {
+                        another_string: "bar".into(),
+                        ..Default::default()
+                    },
+                    ..Default::default()
+                })
+            );
+        }
+
+        #[test]
+        fn dropin_extends_base() {
+            let mut base: toml::Value = toml::from_str(
+                r#"
+                number = 42
+                [sub]
+                another_string = "foo"
+            "#,
+            )
+            .unwrap();
+
+            let dropin: toml::Value = toml::from_str(
+                r#"
+                string = "hello"
+                [sub]
+                yet_another_number = 13
+            "#,
+            )
+            .unwrap();
+
+            merge(&mut base, dropin);
+
+            assert_eq!(
+                base.try_into(),
+                Ok(Config {
+                    number: 42,
+                    string: "hello".into(),
+                    sub: SubConfig {
+                        another_string: "foo".into(),
+                        yet_another_number: 13,
+                        ..Default::default()
+                    },
+                    ..Default::default()
+                })
+            );
+        }
+
+        // Drop-ins can change the type of a value.  This might look weird but at
+        // this level we have no idea about semantics so we just do what the
+        // .toml's tell us.  The final type check is only performed by try_into().
+        // Also, we don't necessarily test this because it's a desired feature.
+        // It's just something that seems to follow from the way Value tree
+        // merging is implemented so why not acknowledge and verify it.
+        #[test]
+        fn dropin_overrides_base_type() {
+            let mut base: toml::Value = toml::from_str(
+                r#"
+                number = "foo"
+                [sub]
+                another_string = 42
+            "#,
+            )
+            .unwrap();
+
+            let dropin: toml::Value = toml::from_str(
+                r#"
+                number = 42
+                [sub]
+                another_string = "foo"
+            "#,
+            )
+            .unwrap();
+
+            merge(&mut base, dropin);
+
+            assert_eq!(
+                base.try_into(),
+                Ok(Config {
+                    number: 42,
+                    sub: SubConfig {
+                        another_string: "foo".into(),
+                        ..Default::default()
+                    },
+                    ..Default::default()
+                })
+            );
+        }
+    }
+}
+
+mod drop_in_directory_handling {
+    use crate::config::TomlConfig;
+    use std::fs;
+    use std::io::{self, Result};
+    use std::path::{Path, PathBuf};
+
+    fn get_dropin_dir_path(base_cfg_file_path: &Path) -> Result<PathBuf> {
+        let mut dropin_dir = base_cfg_file_path.to_path_buf();
+        if !dropin_dir.pop() {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "base cfg file path too short",
+            ));
+        }
+        dropin_dir.push("config.d");
+        Ok(dropin_dir)
+    }
+
+    fn update_from_dropin(base_config: &mut toml::Value, dropin_file: &fs::DirEntry) -> Result<()> {
+        if !dropin_file.file_type()?.is_file() {
+            return Err(io::Error::new(
+                io::ErrorKind::Other,
+                "drop-in cfg file can only be a regular file or a symlink",
+            ));
+        }
+        let dropin_contents = fs::read_to_string(&dropin_file.path())?;
+        let dropin_config: toml::Value = toml::from_str(&dropin_contents)?;
+        super::toml_tree_ops::merge(base_config, dropin_config);
+        Ok(())
+    }
+
+    fn update_from_dropins(base_config: &mut toml::Value, dropin_dir: &Path) -> Result<()> {
+        let dropin_files_iter = match fs::read_dir(dropin_dir) {
+            Ok(iter) => iter,
+            Err(err) => {
+                if err.kind() == io::ErrorKind::NotFound {
+                    return Ok(());
+                } else {
+                    return Err(err);
+                }
+            }
+        };
+
+        let mut dropin_files = dropin_files_iter.collect::<Result<Vec<_>>>()?;
+        dropin_files.sort_by_key(|direntry| direntry.file_name());
+        for dropin_file in &dropin_files {
+            update_from_dropin(base_config, dropin_file)?;
+        }
+        Ok(())
+    }
+
+    pub fn load(base_cfg_file_path: &Path) -> Result<TomlConfig> {
+        let base_toml_str = fs::read_to_string(&base_cfg_file_path)?;
+        let mut base_config: toml::Value = toml::from_str(&base_toml_str)?;
+        let dropin_dir = get_dropin_dir_path(base_cfg_file_path)?;
+
+        update_from_dropins(&mut base_config, &dropin_dir)?;
+
+        let config: TomlConfig = base_config.try_into()?;
+        Ok(config)
+    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+        use std::io::Write;
+
+        const BASE_CONFIG_DATA: &str = r#"
+            [hypervisor.qemu]
+            path = "/usr/bin/qemu-kvm"
+            default_bridges = 3
+            [runtime]
+            enable_debug = true
+            internetworking_model="tcfilter"
+        "#;
+
+        fn check_base_config(config: &TomlConfig) {
+            assert_eq!(
+                config.hypervisor["qemu"].path,
+                "/usr/bin/qemu-kvm".to_string()
+            );
+            assert_eq!(config.hypervisor["qemu"].device_info.default_bridges, 3);
+            assert!(config.runtime.debug);
+            assert_eq!(config.runtime.internetworking_model, "tcfilter".to_string());
+        }
+
+        fn create_file(path: &Path, contents: &[u8]) -> Result<()> {
+            fs::File::create(path)?.write_all(contents)
+        }
+
+        #[test]
+        fn test_no_dropins_dir() {
+            let tmpdir = tempfile::tempdir().unwrap();
+
+            let config_path = tmpdir.path().join("runtime.toml");
+            create_file(&config_path, BASE_CONFIG_DATA.as_bytes()).unwrap();
+
+            let config = load(&config_path).unwrap();
+            check_base_config(&config);
+        }
+
+        #[test]
+        fn test_no_dropins() {
+            let tmpdir = tempfile::tempdir().unwrap();
+
+            let config_path = tmpdir.path().join("runtime.toml");
+            create_file(&config_path, BASE_CONFIG_DATA.as_bytes()).unwrap();
+
+            let dropin_dir = tmpdir.path().join("config.d");
+            fs::create_dir(&dropin_dir).unwrap();
+
+            let config = load(&config_path).unwrap();
+            check_base_config(&config);
+        }
+
+        #[test]
+        fn test_dropins() {
+            let tmpdir = tempfile::tempdir().unwrap();
+
+            let dropin_data = r#"
+                [hypervisor.qemu]
+                default_vcpus = 2
+                default_bridges = 4
+                shared_fs = "virtio-fs"
+                [runtime]
+                sandbox_cgroup_only=true
+                internetworking_model="macvtap"
+                vfio_mode="guest-kernel"
+            "#;
+
+            let dropin_override_data = r#"
+                [hypervisor.qemu]
+                shared_fs = "virtio-9p"
+                [runtime]
+                vfio_mode="vfio"
+            "#;
+
+            let config_path = tmpdir.path().join("runtime.toml");
+            create_file(&config_path, BASE_CONFIG_DATA.as_bytes()).unwrap();
+
+            let dropin_dir = tmpdir.path().join("config.d");
+            fs::create_dir(&dropin_dir).unwrap();
+
+            let dropin_path = dropin_dir.join("10-base");
+            create_file(&dropin_path, dropin_data.as_bytes()).unwrap();
+
+            let dropin_override_path = dropin_dir.join("20-override");
+            create_file(&dropin_override_path, dropin_override_data.as_bytes()).unwrap();
+
+            let config = load(&config_path).unwrap();
+            assert_eq!(
+                config.hypervisor["qemu"].path,
+                "/usr/bin/qemu-kvm".to_string()
+            );
+            assert_eq!(config.hypervisor["qemu"].cpu_info.default_vcpus, 2);
+            assert_eq!(config.hypervisor["qemu"].device_info.default_bridges, 4);
+            assert_eq!(
+                config.hypervisor["qemu"].shared_fs.shared_fs.as_deref(),
+                Some("virtio-9p")
+            );
+            assert!(config.runtime.debug);
+            assert!(config.runtime.sandbox_cgroup_only);
+            assert_eq!(config.runtime.internetworking_model, "macvtap".to_string());
+            assert_eq!(config.runtime.vfio_mode, "vfio".to_string());
+        }
+    }
+}
--- a/src/libs/kata-types/src/config/mod.rs
+++ b/src/libs/kata-types/src/config/mod.rs
@@ -19,6 +19,7 @@ use crate::{eother, sl};
 pub mod default;

 mod agent;
+mod drop_in;
 pub mod hypervisor;

 pub use self::agent::Agent;
@@ -94,21 +95,15 @@ impl TomlConfig {
    /// If `config_file` is valid, it will used, otherwise a built-in default path list will be
    /// scanned.
    pub fn load_from_file<P: AsRef<Path>>(config_file: P) -> Result<(TomlConfig, PathBuf)> {
-        let file_path = if !config_file.as_ref().as_os_str().is_empty() {
-            fs::canonicalize(config_file)?
-        } else {
-            Self::get_default_config_file()?
-        };
+        let mut result = Self::load_raw_from_file(config_file);
+        if let Ok((ref mut config, _)) = result {
+            Hypervisor::adjust_config(config)?;
+            Runtime::adjust_config(config)?;
+            Agent::adjust_config(config)?;
+            info!(sl!(), "get kata config: {:?}", config);
+        }

-        info!(
-            sl!(),
-            "load configuration from: {}",
-            file_path.to_string_lossy()
-        );
-        let content = fs::read_to_string(&file_path)?;
-        let config = Self::load(&content)?;
-
-        Ok((config, file_path))
+        result
    }

    /// Load raw Kata configuration information from configuration files.
@@ -127,13 +122,15 @@ impl TomlConfig {
            "load configuration from: {}",
            file_path.to_string_lossy()
        );
-        let content = fs::read_to_string(&file_path)?;
-        let config: TomlConfig = toml::from_str(&content)?;
+        let config = drop_in::load(&file_path)?;

        Ok((config, file_path))
    }

    /// Load Kata configuration information from string.
+    ///
+    /// This function only works with `configuration.toml` and does not handle
+    /// drop-in config file fragments in config.d/.
    pub fn load(content: &str) -> Result<TomlConfig> {
        let mut config: TomlConfig = toml::from_str(content)?;
        Hypervisor::adjust_config(&mut config)?;
--- a/src/runtime-rs/Cargo.lock
+++ b/src/runtime-rs/Cargo.lock
@@ -99,6 +99,52 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"

+[[package]]
+name = "async-macros"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421d59b24c1feea2496e409b3e0a8de23e5fc130a2ddc0b012e551f3b272bba"
+dependencies = [
+ "futures-core-preview",
+ "pin-utils",
+]
+
+[[package]]
+name = "async-std"
+version = "0.99.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44501a9f7961bb539b67be0c428b3694e26557046a52759ca7eaf790030a64cc"
+dependencies = [
+ "async-macros",
+ "async-task",
+ "crossbeam-channel 0.3.9",
+ "crossbeam-deque",
+ "crossbeam-utils 0.6.6",
+ "futures-core",
+ "futures-io",
+ "futures-timer 1.0.3",
+ "kv-log-macro",
+ "log",
+ "memchr",
+ "mio 0.6.23",
+ "mio-uds",
+ "num_cpus",
+ "once_cell",
+ "pin-project-lite 0.1.12",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "async-task"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ac2c016b079e771204030951c366db398864f5026f84a44dafb0ff20f02085d"
+dependencies = [
+ "libc",
+ "winapi 0.3.9",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.56"
@@ -280,7 +326,7 @@ dependencies = [
 "num-integer",
 "num-traits",
 "time 0.1.43",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -294,8 +340,9 @@ dependencies = [
 "kata-sys-util",
 "kata-types",
 "lazy_static",
- "nix 0.24.1",
+ "nix 0.24.2",
 "oci",
+ "persist",
 "protobuf",
 "serde_json",
 "slog",
@@ -353,6 +400,15 @@ dependencies = [
 "cfg-if 1.0.0",
 ]

+[[package]]
+name = "crossbeam-channel"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ec7fcd21571dc78f96cc96243cab8d8f035247c3efd16c687be154c3fa9efa"
+dependencies = [
+ "crossbeam-utils 0.6.6",
+]
+
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.4"
@@ -360,7 +416,54 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5aaa7bd5fb665c6864b5f963dd9097905c54125909c7aa94c9e18507cdbe6c53"
 dependencies = [
 "cfg-if 1.0.0",
- "crossbeam-utils",
+ "crossbeam-utils 0.8.8",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20ff29ded3204c5106278a81a38f4b482636ed4fa1e6cfbeef193291beb29ed"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils 0.7.2",
+ "maybe-uninit",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "058ed274caafc1f60c4997b5fc07bf7dc7cca454af7c6e81edffe5f33f70dace"
+dependencies = [
+ "autocfg",
+ "cfg-if 0.1.10",
+ "crossbeam-utils 0.7.2",
+ "lazy_static",
+ "maybe-uninit",
+ "memoffset 0.5.6",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04973fa96e96579258a5091af6003abde64af786b860f18622b82e026cca60e6"
+dependencies = [
+ "cfg-if 0.1.10",
+ "lazy_static",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
+dependencies = [
+ "autocfg",
+ "cfg-if 0.1.10",
+ "lazy_static",
 ]

 [[package]]
@@ -383,6 +486,16 @@ dependencies = [
 "typenum",
 ]

+[[package]]
+name = "ctor"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f877be4f7c9f246b183111634f75baa039715e3f46ce860677d3b19a69fb229c"
+dependencies = [
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "darling"
 version = "0.13.4"
@@ -460,7 +573,7 @@ dependencies = [
 "kvm-bindings",
 "kvm-ioctls",
 "libc",
- "memoffset",
+ "memoffset 0.6.5",
 "vm-memory",
 "vmm-sys-util",
 ]
@@ -520,7 +633,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b773f7f1b9088438e9746890c7c0836b133b07935812867a33e06e81c92c0cdc"
 dependencies = [
 "libc",
- "mio",
+ "mio 0.8.3",
 ]

 [[package]]
@@ -631,7 +744,7 @@ dependencies = [
 "libc",
 "linux-loader",
 "log",
- "nix 0.23.1",
+ "nix 0.24.2",
 "seccompiler",
 "serde",
 "serde_derive",
@@ -668,7 +781,7 @@ checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
 dependencies = [
 "errno-dragonfly",
 "libc",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -749,6 +862,22 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"

+[[package]]
+name = "fuchsia-zircon"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e9763c69ebaae630ba35f74888db465e49e259ba1bc0eda7d06f4a067615d82"
+dependencies = [
+ "bitflags",
+ "fuchsia-zircon-sys",
+]
+
+[[package]]
+name = "fuchsia-zircon-sys"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3dcaa9ae7725d12cdb85b3ad99a434db70b468c09ded17e012d86b5c1010f7a7"
+
 [[package]]
 name = "fuse-backend-rs"
 version = "0.9.0"
@@ -763,7 +892,7 @@ dependencies = [
 "lazy_static",
 "libc",
 "log",
- "mio",
+ "mio 0.8.3",
 "nix 0.23.1",
 "virtio-queue",
 "vm-memory",
@@ -807,6 +936,12 @@ version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"

+[[package]]
+name = "futures-core-preview"
+version = "0.3.0-alpha.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b35b6263fb1ef523c3056565fa67b1d16f0a8604ff12b11b08c25f28a734c60a"
+
 [[package]]
 name = "futures-executor"
 version = "0.3.21"
@@ -847,6 +982,16 @@ version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"

+[[package]]
+name = "futures-timer"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7946248e9429ff093345d3e8fdf4eb0f9b2d79091611c9c14f744971a6f8be45"
+dependencies = [
+ "futures-core-preview",
+ "pin-utils",
+]
+
 [[package]]
 name = "futures-timer"
 version = "3.0.2"
@@ -866,7 +1011,7 @@ dependencies = [
 "futures-sink",
 "futures-task",
 "memchr",
- "pin-project-lite",
+ "pin-project-lite 0.2.9",
 "pin-utils",
 "slab",
 ]
@@ -932,7 +1077,7 @@ checksum = "19775995ee20209163239355bc3ad2f33f83da35d9ef72dea26e5af753552c87"
 dependencies = [
 "dashmap",
 "futures 0.3.21",
- "futures-timer",
+ "futures-timer 3.0.2",
 "no-std-compat",
 "nonzero_ext",
 "parking_lot 0.12.1",
@@ -990,8 +1135,10 @@ dependencies = [
 "kata-types",
 "libc",
 "logging",
- "nix 0.24.1",
+ "nix 0.24.2",
+ "persist",
 "seccompiler",
+ "serde",
 "serde_json",
 "slog",
 "slog-scope",
@@ -1106,7 +1253,7 @@ dependencies = [
 "kata-types",
 "lazy_static",
 "libc",
- "nix 0.24.1",
+ "nix 0.24.2",
 "oci",
 "once_cell",
 "rand 0.7.3",
@@ -1135,6 +1282,25 @@ dependencies = [
 "toml 0.5.9",
 ]

+[[package]]
+name = "kernel32-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7507624b29483431c0ba2d82aece8ca6cdba9382bff4ddd0f7490560c056098d"
+dependencies = [
+ "winapi 0.2.8",
+ "winapi-build",
+]
+
+[[package]]
+name = "kv-log-macro"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de8b303297635ad57c9f5059fd9cee7a47f8e8daa09df0fcd07dd39fb22977f"
+dependencies = [
+ "log",
+]
+
 [[package]]
 name = "kvm-bindings"
 version = "0.5.0"
@@ -1210,6 +1376,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
 dependencies = [
 "cfg-if 1.0.0",
+ "value-bag",
 ]

 [[package]]
@@ -1248,12 +1415,27 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"

+[[package]]
+name = "maybe-uninit"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60302e4db3a61da70c0cb7991976248362f30319e88850c487b9b95bbf059e00"
+
 [[package]]
 name = "memchr"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"

+[[package]]
+name = "memoffset"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.6.5"
@@ -1272,6 +1454,25 @@ dependencies = [
 "adler",
 ]

+[[package]]
+name = "mio"
+version = "0.6.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4afd66f5b91bf2a3bc13fad0e21caedac168ca4c707504e75585648ae80e4cc4"
+dependencies = [
+ "cfg-if 0.1.10",
+ "fuchsia-zircon",
+ "fuchsia-zircon-sys",
+ "iovec",
+ "kernel32-sys",
+ "libc",
+ "log",
+ "miow",
+ "net2",
+ "slab",
+ "winapi 0.2.8",
+]
+
 [[package]]
 name = "mio"
 version = "0.8.3"
@@ -1284,12 +1485,46 @@ dependencies = [
 "windows-sys",
 ]

+[[package]]
+name = "mio-uds"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afcb699eb26d4332647cc848492bbc15eafb26f08d0304550d5aa1f612e066f0"
+dependencies = [
+ "iovec",
+ "libc",
+ "mio 0.6.23",
+]
+
+[[package]]
+name = "miow"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebd808424166322d4a38da87083bfddd3ac4c131334ed55856112eb06d46944d"
+dependencies = [
+ "kernel32-sys",
+ "net2",
+ "winapi 0.2.8",
+ "ws2_32-sys",
+]
+
 [[package]]
 name = "multimap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5ce46fe64a9d73be07dcbe690a38ce1b293be448fd8ce1e6c1b8062c9f72c6a"

+[[package]]
+name = "net2"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "391630d12b68002ae1e25e8f974306474966550ad82dac6886fb8910c19568ae"
+dependencies = [
+ "cfg-if 0.1.10",
+ "libc",
+ "winapi 0.3.9",
+]
+
 [[package]]
 name = "netlink-packet-core"
 version = "0.4.2"
@@ -1356,19 +1591,6 @@ dependencies = [
 "tokio",
 ]

-[[package]]
-name = "nix"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd0eaf8df8bab402257e0a5c17a254e4cc1f72a93588a1ddfb5d356c801aa7cb"
-dependencies = [
- "bitflags",
- "cc",
- "cfg-if 0.1.10",
- "libc",
- "void",
-]
-
 [[package]]
 name = "nix"
 version = "0.23.1"
@@ -1379,19 +1601,19 @@ dependencies = [
 "cc",
 "cfg-if 1.0.0",
 "libc",
- "memoffset",
+ "memoffset 0.6.5",
 ]

 [[package]]
 name = "nix"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f17df307904acd05aa8e32e97bb20f2a0df1728bbc2d771ae8f9a90463441e9"
+checksum = "195cdbc1741b8134346d515b3a56a1c94b0912758009cfd53f99ea0f57b065fc"
 dependencies = [
 "bitflags",
 "cfg-if 1.0.0",
 "libc",
- "memoffset",
+ "memoffset 0.6.5",
 ]

 [[package]]
@@ -1539,7 +1761,7 @@ dependencies = [
 "libc",
 "redox_syscall",
 "smallvec",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -1567,6 +1789,21 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4fd5641d01c8f18a23da7b6fe29298ff4b55afcccdf78973b24cf3175fee32e"

+[[package]]
+name = "persist"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "kata-sys-util",
+ "kata-types",
+ "libc",
+ "rustc-serialize",
+ "safe-path",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "petgraph"
 version = "0.5.1"
@@ -1577,6 +1814,12 @@ dependencies = [
 "indexmap",
 ]

+[[package]]
+name = "pin-project-lite"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "257b64915a082f7811703966789728173279bdebb956b143dbcd23f6f970a777"
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.9"
@@ -1701,14 +1944,14 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20afe714292d5e879d8b12740aa223c6a88f118af41870e8b6196e39a02238a8"
 dependencies = [
- "crossbeam-utils",
+ "crossbeam-utils 0.8.8",
 "libc",
 "mach",
 "once_cell",
 "raw-cpuid",
 "wasi 0.10.2+wasi-snapshot-preview1",
 "web-sys",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -1768,7 +2011,7 @@ dependencies = [
 "libc",
 "rand_core 0.3.1",
 "rdrand",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -1907,7 +2150,7 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
 dependencies = [
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -1929,11 +2172,13 @@ dependencies = [
 "logging",
 "netlink-packet-route",
 "netlink-sys",
- "nix 0.24.1",
+ "nix 0.24.2",
 "oci",
+ "persist",
 "rand 0.7.3",
 "rtnetlink",
 "scopeguard",
+ "serde",
 "slog",
 "slog-scope",
 "tokio",
@@ -1959,7 +2204,7 @@ dependencies = [
 "log",
 "netlink-packet-route",
 "netlink-proto",
- "nix 0.24.1",
+ "nix 0.24.2",
 "thiserror",
 "tokio",
 ]
@@ -1975,6 +2220,7 @@ dependencies = [
 "linux_container",
 "logging",
 "oci",
+ "persist",
 "slog",
 "slog-scope",
 "tokio",
@@ -1988,6 +2234,12 @@ version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"

+[[package]]
+name = "rustc-serialize"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"
+
 [[package]]
 name = "rustix"
 version = "0.34.8"
@@ -1999,7 +2251,7 @@ dependencies = [
 "io-lifetimes",
 "libc",
 "linux-raw-sys",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2014,6 +2266,13 @@ version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"

+[[package]]
+name = "safe-path"
+version = "0.1.0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.1.0"
@@ -2031,18 +2290,18 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.137"
+version = "1.0.143"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61ea8d54c77f8315140a05f4c7237403bf38b72704d031543aa1d16abbf517d1"
+checksum = "53e8e5d5b70924f74ff5c6d64d9a5acd91422117c60f48c4e07855238a254553"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.137"
+version = "1.0.143"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f26faba0c3959972377d3b2d306ee9f71faee9714294e41bb777f83f88578be"
+checksum = "d3d8e8de557aee63c26b85b947f5e59b690d0454c753f3adeb5cd7835ab88391"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2051,9 +2310,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.81"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b7ce2b32a1aed03c558dc61a5cd328f15aff2dbc17daad8fb8af04d2100e15c"
+checksum = "38dd04e3c8279e75b31ef29dbdceebfe5ad89f4d0937213c53f7d49d01b3d5a7"
 dependencies = [
 "itoa",
 "ryu",
@@ -2113,6 +2372,7 @@ dependencies = [
 "common",
 "containerd-shim-protos",
 "logging",
+ "persist",
 "runtimes",
 "slog",
 "slog-scope",
@@ -2146,7 +2406,7 @@ dependencies = [
 "libc",
 "log",
 "logging",
- "nix 0.24.1",
+ "nix 0.24.2",
 "oci",
 "protobuf",
 "rand 0.8.5",
@@ -2191,7 +2451,7 @@ version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "766c59b252e62a34651412870ff55d8c4e6d04df19b43eecb2703e417b097ffe"
 dependencies = [
- "crossbeam-channel",
+ "crossbeam-channel 0.5.4",
 "slog",
 "take_mut",
 "thread_local",
@@ -2244,7 +2504,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66d72b759436ae32898a2af0a14218dbf55efde3feeb170eb623637db85ee1e0"
 dependencies = [
 "libc",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2316,7 +2576,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c2e86926081dda636c546d8c5e641661049d7562a68f5488be4a1f7f66f6086"
 dependencies = [
 "libc",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2353,7 +2613,7 @@ dependencies = [
 "libc",
 "redox_syscall",
 "remove_dir_all",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2408,7 +2668,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438"
 dependencies = [
 "libc",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2455,15 +2715,15 @@ dependencies = [
 "bytes 1.1.0",
 "libc",
 "memchr",
- "mio",
+ "mio 0.8.3",
 "num_cpus",
 "once_cell",
 "parking_lot 0.12.1",
- "pin-project-lite",
+ "pin-project-lite 0.2.9",
 "signal-hook-registry",
 "socket2",
 "tokio-macros",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2617,6 +2877,16 @@ dependencies = [
 "rand 0.3.23",
 ]

+[[package]]
+name = "value-bag"
+version = "1.0.0-alpha.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2209b78d1249f7e6f3293657c9779fe31ced465df091bbd433a1cf88e916ec55"
+dependencies = [
+ "ctor",
+ "version_check",
+]
+
 [[package]]
 name = "version_check"
 version = "0.9.4"
@@ -2629,6 +2899,7 @@ version = "0.1.0"
 dependencies = [
 "agent",
 "anyhow",
+ "async-std",
 "async-trait",
 "awaitgroup",
 "common",
@@ -2640,8 +2911,9 @@ dependencies = [
 "lazy_static",
 "libc",
 "logging",
- "nix 0.16.1",
+ "nix 0.24.2",
 "oci",
+ "persist",
 "protobuf",
 "resource",
 "serde",
@@ -2685,7 +2957,7 @@ checksum = "339d4349c126fdcd87e034631d7274370cf19eb0e87b33166bcd956589fc72c5"
 dependencies = [
 "arc-swap 1.5.0",
 "libc",
- "winapi",
+ "winapi 0.3.9",
 ]

 [[package]]
@@ -2704,12 +2976,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "void"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
-
 [[package]]
 name = "vsock"
 version = "0.2.6"
@@ -2824,6 +3090,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "winapi"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167dc9d6949a9b857f3451275e911c3f44255842c1f7a76f33c55103a909087a"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -2834,6 +3106,12 @@ dependencies = [
 "winapi-x86_64-pc-windows-gnu",
 ]

+[[package]]
+name = "winapi-build"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d315eee3b34aca4797b2da6b13ed88266e6d612562a0c46390af8299fc699bc"
+
 [[package]]
 name = "winapi-i686-pc-windows-gnu"
 version = "0.4.0"
@@ -2889,6 +3167,16 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"

+[[package]]
+name = "ws2_32-sys"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d59cefebd0c892fa2dd6de581e937301d8552cb44489cdff035c6187cb63fa5e"
+dependencies = [
+ "winapi 0.2.8",
+ "winapi-build",
+]
+
 [[package]]
 name = "zstd"
 version = "0.11.2+zstd.1.5.2"
--- a/src/runtime-rs/crates/hypervisor/Cargo.toml
+++ b/src/runtime-rs/crates/hypervisor/Cargo.toml
@@ -12,7 +12,7 @@ async-trait = "0.1.48"
 dbs-utils = "0.1.0"
 go-flag = "0.1.0"
 libc = ">=0.2.39"
-nix = "0.24.1"
+nix = "0.24.2"
 persist = { path = "../persist" }
 seccompiler = "0.2.0"
 serde = { version = "1.0.138", features = ["derive"] }
--- a/src/runtime-rs/crates/resource/Cargo.toml
+++ b/src/runtime-rs/crates/resource/Cargo.toml
@@ -14,7 +14,7 @@ lazy_static = "1.4.0"
 libc = ">=0.2.39"
 netlink-sys = "0.8.3"
 netlink-packet-route = "0.13.0"
-nix = "0.24.1"
+nix = "0.24.2"
 rand = "^0.7.2"
 rtnetlink = "0.11.0"
 scopeguard = "1.0.0"
--- a/src/runtime-rs/crates/runtimes/common/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/common/Cargo.toml
@@ -11,7 +11,7 @@ anyhow = "^1.0"
 async-trait = "0.1.48"
 containerd-shim-protos = { version = "0.2.0", features = ["async"]}
 lazy_static = "1.4.0"
-nix = "0.24.1"
+nix = "0.24.2"
 protobuf = "2.27.0"
 serde_json = "1.0.39"
 slog = "2.5.2"
--- a/src/runtime-rs/crates/runtimes/virt_container/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/virt_container/Cargo.toml
@@ -12,7 +12,7 @@ containerd-shim-protos = { version = "0.2.0", features = ["async"]}
 futures = "0.3.19"
 lazy_static = "1.4.0"
 libc = ">=0.2.39"
-nix = "0.16.0"
+nix = "0.24.2"
 protobuf = "2.27.0"
 serde = { version = "1.0.100", features = ["derive"] }
 serde_derive = "1.0.27"
--- a/src/runtime-rs/crates/shim/Cargo.toml
+++ b/src/runtime-rs/crates/shim/Cargo.toml
@@ -19,7 +19,7 @@ containerd-shim-protos = { version = "0.2.0", features = ["async"]}
 go-flag = "0.1.0"
 libc = "0.2.108"
 log = "0.4.14"
-nix = "0.24.1"
+nix = "0.24.2"
 protobuf = "2.27.0"
 sha2 = "=0.9.3"
 slog = {version = "2.5.2", features = ["std", "release_max_level_trace", "max_level_trace"]}
--- a/src/runtime/pkg/containerd-shim-v2/create.go
+++ b/src/runtime/pkg/containerd-shim-v2/create.go
@@ -97,9 +97,10 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con
 		}

 		// create root span
+		// rootSpan will be ended when the entire trace is ended
 		rootSpan, newCtx := katatrace.Trace(s.ctx, shimLog, "rootSpan", shimTracingTags)
 		s.rootCtx = newCtx
-		defer rootSpan.End()
+		s.rootSpan = rootSpan

 		// create span
 		span, newCtx := katatrace.Trace(s.rootCtx, shimLog, "create", shimTracingTags)
--- a/src/runtime/pkg/containerd-shim-v2/service.go
+++ b/src/runtime/pkg/containerd-shim-v2/service.go
@@ -28,6 +28,7 @@ import (
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+	otelTrace "go.opentelemetry.io/otel/trace"
 	"golang.org/x/sys/unix"

 	"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils"
@@ -122,8 +123,9 @@ type exit struct {
 type service struct {
 	sandbox vc.VCSandbox

-	ctx     context.Context
-	rootCtx context.Context // root context for tracing
+	ctx      context.Context
+	rootCtx  context.Context // root context for tracing
+	rootSpan otelTrace.Span

 	containers map[string]*container

@@ -946,6 +948,7 @@ func (s *service) Shutdown(ctx context.Context, r *taskAPI.ShutdownRequest) (_ *
 		s.mu.Unlock()

 		span.End()
+		s.rootSpan.End()
 		katatrace.StopTracing(s.rootCtx)

 		return empty, nil
--- a/src/runtime/virtcontainers/clh.go
+++ b/src/runtime/virtcontainers/clh.go
@@ -459,13 +459,15 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net
 	// to fetch if this is the first time the hypervisor is created.
 	clh.Logger().WithField("function", "CreateVM").Info("Sandbox not found creating")

+	// Create the VM config via the constructor to ensure default values are properly assigned
+	clh.vmconfig = *chclient.NewVmConfig(*chclient.NewPayloadConfig())
+
 	// Make sure the kernel path is valid
 	kernelPath, err := clh.config.KernelAssetPath()
 	if err != nil {
 		return err
 	}
-	// Create the VM config via the constructor to ensure default values are properly assigned
-	clh.vmconfig = *chclient.NewVmConfig(*chclient.NewKernelConfig(kernelPath))
+	clh.vmconfig.Payload.SetKernel(kernelPath)

 	if clh.config.ConfidentialGuest {
 		if err := clh.enableProtection(); err != nil {
@@ -505,7 +507,7 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net
 	// Followed by extra kernel parameters defined in the configuration file
 	params = append(params, clh.config.KernelParams...)

-	clh.vmconfig.Cmdline = chclient.NewCmdLineConfig(kernelParamsToString(params))
+	clh.vmconfig.Payload.SetCmdline(kernelParamsToString(params))

 	// set random device generator to hypervisor
 	clh.vmconfig.Rng = chclient.NewRngConfig(clh.config.EntropySource)
@@ -547,9 +549,7 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net
 			return err
 		}

-		initrd := chclient.NewInitramfsConfig(initrdPath)
-
-		clh.vmconfig.SetInitramfs(*initrd)
+		clh.vmconfig.Payload.SetInitramfs(initrdPath)
 	}

 	// Use serial port as the guest console only in debug mode,
--- a/src/runtime/virtcontainers/clh_test.go
+++ b/src/runtime/virtcontainers/clh_test.go
@@ -557,7 +557,7 @@ func TestCloudHypervisorResizeMemory(t *testing.T) {
 			clh := cloudHypervisor{}

 			mockClient := &clhClientMock{}
-			mockClient.vmInfo.Config = *chclient.NewVmConfig(*chclient.NewKernelConfig(""))
+			mockClient.vmInfo.Config = *chclient.NewVmConfig(*chclient.NewPayloadConfig())
 			mockClient.vmInfo.Config.Memory = chclient.NewMemoryConfig(int64(utils.MemUnit(clhConfig.MemorySize) * utils.MiB))
 			mockClient.vmInfo.Config.Memory.HotplugSize = func(i int64) *int64 { return &i }(int64(40 * utils.GiB.ToBytes()))

--- a/src/runtime/virtcontainers/network_linux.go
+++ b/src/runtime/virtcontainers/network_linux.go
@@ -708,8 +708,8 @@ func tapNetworkPair(ctx context.Context, endpoint Endpoint, queues int, disableV
 	}

 	if err := netHandle.LinkSetHardwareAddr(tapLink, tapHardAddr); err != nil {
-		return fmt.Errorf("Could not set MAC address %s for veth interface %s: %s",
-			netPair.VirtIface.HardAddr, netPair.VirtIface.Name, err)
+		return fmt.Errorf("Could not set MAC address %s for TAP interface %s: %s",
+			netPair.TAPIface.HardAddr, netPair.TAPIface.Name, err)
 	}

 	if err := netHandle.LinkSetUp(tapLink); err != nil {
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/.openapi-generator/FILES
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/.openapi-generator/FILES
@@ -7,7 +7,6 @@ api_default.go
 client.go
 configuration.go
 docs/BalloonConfig.md
-docs/CmdLineConfig.md
 docs/ConsoleConfig.md
 docs/CpuAffinity.md
 docs/CpuFeatures.md
@@ -18,13 +17,12 @@ docs/DeviceConfig.md
 docs/DeviceNode.md
 docs/DiskConfig.md
 docs/FsConfig.md
-docs/InitramfsConfig.md
-docs/KernelConfig.md
 docs/MemoryConfig.md
 docs/MemoryZoneConfig.md
 docs/NetConfig.md
 docs/NumaConfig.md
 docs/NumaDistance.md
+docs/PayloadConfig.md
 docs/PciDeviceInfo.md
 docs/PlatformConfig.md
 docs/PmemConfig.md
@@ -51,7 +49,6 @@ git_push.sh
 go.mod
 go.sum
 model_balloon_config.go
-model_cmd_line_config.go
 model_console_config.go
 model_cpu_affinity.go
 model_cpu_features.go
@@ -61,13 +58,12 @@ model_device_config.go
 model_device_node.go
 model_disk_config.go
 model_fs_config.go
-model_initramfs_config.go
-model_kernel_config.go
 model_memory_config.go
 model_memory_zone_config.go
 model_net_config.go
 model_numa_config.go
 model_numa_distance.go
+model_payload_config.go
 model_pci_device_info.go
 model_platform_config.go
 model_pmem_config.go
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/README.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/README.md
@@ -110,7 +110,6 @@ Class | Method | HTTP request | Description
 ## Documentation For Models

 - [BalloonConfig](docs/BalloonConfig.md)
- - [CmdLineConfig](docs/CmdLineConfig.md)
 - [ConsoleConfig](docs/ConsoleConfig.md)
 - [CpuAffinity](docs/CpuAffinity.md)
 - [CpuFeatures](docs/CpuFeatures.md)
@@ -120,13 +119,12 @@ Class | Method | HTTP request | Description
 - [DeviceNode](docs/DeviceNode.md)
 - [DiskConfig](docs/DiskConfig.md)
 - [FsConfig](docs/FsConfig.md)
- - [InitramfsConfig](docs/InitramfsConfig.md)
- - [KernelConfig](docs/KernelConfig.md)
 - [MemoryConfig](docs/MemoryConfig.md)
 - [MemoryZoneConfig](docs/MemoryZoneConfig.md)
 - [NetConfig](docs/NetConfig.md)
 - [NumaConfig](docs/NumaConfig.md)
 - [NumaDistance](docs/NumaDistance.md)
+ - [PayloadConfig](docs/PayloadConfig.md)
 - [PciDeviceInfo](docs/PciDeviceInfo.md)
 - [PlatformConfig](docs/PlatformConfig.md)
 - [PmemConfig](docs/PmemConfig.md)
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml
@@ -479,7 +479,6 @@ components:
            vhost_socket: vhost_socket
            vhost_user: false
            direct: false
-            poll_queue: true
            rate_limiter_config:
              ops:
                size: 0
@@ -499,7 +498,6 @@ components:
            vhost_socket: vhost_socket
            vhost_user: false
            direct: false
-            poll_queue: true
            rate_limiter_config:
              ops:
                size: 0
@@ -540,8 +538,6 @@ components:
            path: path
            iommu: false
            id: id
-          kernel:
-            path: path
          vdpa:
          - pci_segment: 3
            path: path
@@ -620,7 +616,11 @@ components:
            - 3
            - 3
            num_pci_segments: 7
+            oem_strings:
+            - oem_strings
+            - oem_strings
            serial_number: serial_number
+            uuid: uuid
          pmem:
          - pci_segment: 5
            file: file
@@ -634,16 +634,16 @@ components:
            iommu: false
            id: id
            discard_writes: false
-          cmdline:
-            args: args
          watchdog: false
          iommu: false
+          payload:
+            cmdline: cmdline
+            kernel: kernel
+            initramfs: initramfs
          serial:
            mode: "false"
            file: file
            iommu: false
-          initramfs:
-            path: path
          net:
          - tap: tap
            num_queues: 9
@@ -763,6 +763,20 @@ components:
      - bdf
      - id
      type: object
+    PayloadConfig:
+      description: Payloads to boot in guest
+      example:
+        cmdline: cmdline
+        kernel: kernel
+        initramfs: initramfs
+      properties:
+        kernel:
+          type: string
+        cmdline:
+          type: string
+        initramfs:
+          type: string
+      type: object
    VmConfig:
      description: Virtual machine configuration
      example:
@@ -817,7 +831,6 @@ components:
          vhost_socket: vhost_socket
          vhost_user: false
          direct: false
-          poll_queue: true
          rate_limiter_config:
            ops:
              size: 0
@@ -837,7 +850,6 @@ components:
          vhost_socket: vhost_socket
          vhost_user: false
          direct: false
-          poll_queue: true
          rate_limiter_config:
            ops:
              size: 0
@@ -878,8 +890,6 @@ components:
          path: path
          iommu: false
          id: id
-        kernel:
-          path: path
        vdpa:
        - pci_segment: 3
          path: path
@@ -958,7 +968,11 @@ components:
          - 3
          - 3
          num_pci_segments: 7
+          oem_strings:
+          - oem_strings
+          - oem_strings
          serial_number: serial_number
+          uuid: uuid
        pmem:
        - pci_segment: 5
          file: file
@@ -972,16 +986,16 @@ components:
          iommu: false
          id: id
          discard_writes: false
-        cmdline:
-          args: args
        watchdog: false
        iommu: false
+        payload:
+          cmdline: cmdline
+          kernel: kernel
+          initramfs: initramfs
        serial:
          mode: "false"
          file: file
          iommu: false
-        initramfs:
-          path: path
        net:
        - tap: tap
          num_queues: 9
@@ -1030,12 +1044,8 @@ components:
          $ref: '#/components/schemas/CpusConfig'
        memory:
          $ref: '#/components/schemas/MemoryConfig'
-        kernel:
-          $ref: '#/components/schemas/KernelConfig'
-        initramfs:
-          $ref: '#/components/schemas/InitramfsConfig'
-        cmdline:
-          $ref: '#/components/schemas/CmdLineConfig'
+        payload:
+          $ref: '#/components/schemas/PayloadConfig'
        disks:
          items:
            $ref: '#/components/schemas/DiskConfig'
@@ -1089,7 +1099,7 @@ components:
        platform:
          $ref: '#/components/schemas/PlatformConfig'
      required:
-      - kernel
+      - payload
      type: object
    CpuAffinity:
      example:
@@ -1182,7 +1192,11 @@ components:
        - 3
        - 3
        num_pci_segments: 7
+        oem_strings:
+        - oem_strings
+        - oem_strings
        serial_number: serial_number
+        uuid: uuid
      properties:
        num_pci_segments:
          format: int16
@@ -1194,6 +1208,12 @@ components:
          type: array
        serial_number:
          type: string
+        uuid:
+          type: string
+        oem_strings:
+          items:
+            type: string
+          type: array
      type: object
    MemoryZoneConfig:
      example:
@@ -1313,34 +1333,6 @@ components:
      required:
      - size
      type: object
-    KernelConfig:
-      example:
-        path: path
-      properties:
-        path:
-          type: string
-      required:
-      - path
-      type: object
-    InitramfsConfig:
-      example:
-        path: path
-      nullable: true
-      properties:
-        path:
-          type: string
-      required:
-      - path
-      type: object
-    CmdLineConfig:
-      example:
-        args: args
-      properties:
-        args:
-          type: string
-      required:
-      - args
-      type: object
    TokenBucket:
      description: Defines a token bucket with a maximum capacity (_size_), an initial
        burst size (_one_time_burst_) and an interval for refilling purposes (_refill_time_).
@@ -1404,7 +1396,6 @@ components:
        vhost_socket: vhost_socket
        vhost_user: false
        direct: false
-        poll_queue: true
        rate_limiter_config:
          ops:
            size: 0
@@ -1438,9 +1429,6 @@ components:
          type: boolean
        vhost_socket:
          type: string
-        poll_queue:
-          default: true
-          type: boolean
        rate_limiter_config:
          $ref: '#/components/schemas/RateLimiterConfig'
        pci_segment:
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api_default.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api_default.go
@@ -38,8 +38,8 @@ func (r ApiBootVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 BootVM Boot the previously created VM instance.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiBootVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiBootVMRequest
 */
 func (a *DefaultApiService) BootVM(ctx _context.Context) ApiBootVMRequest {
 	return ApiBootVMRequest{
@@ -133,8 +133,8 @@ func (r ApiCreateVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 CreateVM Create the cloud-hypervisor Virtual Machine (VM) instance. The instance is not booted, only created.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiCreateVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiCreateVMRequest
 */
 func (a *DefaultApiService) CreateVM(ctx _context.Context) ApiCreateVMRequest {
 	return ApiCreateVMRequest{
@@ -226,8 +226,8 @@ func (r ApiDeleteVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 DeleteVM Delete the cloud-hypervisor Virtual Machine (VM) instance.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiDeleteVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiDeleteVMRequest
 */
 func (a *DefaultApiService) DeleteVM(ctx _context.Context) ApiDeleteVMRequest {
 	return ApiDeleteVMRequest{
@@ -314,8 +314,8 @@ func (r ApiPauseVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 PauseVM Pause a previously booted VM instance.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiPauseVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiPauseVMRequest
 */
 func (a *DefaultApiService) PauseVM(ctx _context.Context) ApiPauseVMRequest {
 	return ApiPauseVMRequest{
@@ -402,8 +402,8 @@ func (r ApiPowerButtonVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 PowerButtonVM Trigger a power button in the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiPowerButtonVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiPowerButtonVMRequest
 */
 func (a *DefaultApiService) PowerButtonVM(ctx _context.Context) ApiPowerButtonVMRequest {
 	return ApiPowerButtonVMRequest{
@@ -490,8 +490,8 @@ func (r ApiRebootVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 RebootVM Reboot the VM instance.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiRebootVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiRebootVMRequest
 */
 func (a *DefaultApiService) RebootVM(ctx _context.Context) ApiRebootVMRequest {
 	return ApiRebootVMRequest{
@@ -578,8 +578,8 @@ func (r ApiResumeVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 ResumeVM Resume a previously paused VM instance.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiResumeVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiResumeVMRequest
 */
 func (a *DefaultApiService) ResumeVM(ctx _context.Context) ApiResumeVMRequest {
 	return ApiResumeVMRequest{
@@ -666,8 +666,8 @@ func (r ApiShutdownVMRequest) Execute() (*_nethttp.Response, error) {
 /*
 ShutdownVM Shut the VM instance down.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiShutdownVMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiShutdownVMRequest
 */
 func (a *DefaultApiService) ShutdownVM(ctx _context.Context) ApiShutdownVMRequest {
 	return ApiShutdownVMRequest{
@@ -754,8 +754,8 @@ func (r ApiShutdownVMMRequest) Execute() (*_nethttp.Response, error) {
 /*
 ShutdownVMM Shuts the cloud-hypervisor VMM.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiShutdownVMMRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiShutdownVMMRequest
 */
 func (a *DefaultApiService) ShutdownVMM(ctx _context.Context) ApiShutdownVMMRequest {
 	return ApiShutdownVMMRequest{
@@ -849,8 +849,8 @@ func (r ApiVmAddDevicePutRequest) Execute() (PciDeviceInfo, *_nethttp.Response,
 /*
 VmAddDevicePut Add a new device to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddDevicePutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddDevicePutRequest
 */
 func (a *DefaultApiService) VmAddDevicePut(ctx _context.Context) ApiVmAddDevicePutRequest {
 	return ApiVmAddDevicePutRequest{
@@ -860,7 +860,8 @@ func (a *DefaultApiService) VmAddDevicePut(ctx _context.Context) ApiVmAddDeviceP
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddDevicePutExecute(r ApiVmAddDevicePutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -960,8 +961,8 @@ func (r ApiVmAddDiskPutRequest) Execute() (PciDeviceInfo, *_nethttp.Response, er
 /*
 VmAddDiskPut Add a new disk to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddDiskPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddDiskPutRequest
 */
 func (a *DefaultApiService) VmAddDiskPut(ctx _context.Context) ApiVmAddDiskPutRequest {
 	return ApiVmAddDiskPutRequest{
@@ -971,7 +972,8 @@ func (a *DefaultApiService) VmAddDiskPut(ctx _context.Context) ApiVmAddDiskPutRe
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddDiskPutExecute(r ApiVmAddDiskPutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -1071,8 +1073,8 @@ func (r ApiVmAddFsPutRequest) Execute() (PciDeviceInfo, *_nethttp.Response, erro
 /*
 VmAddFsPut Add a new virtio-fs device to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddFsPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddFsPutRequest
 */
 func (a *DefaultApiService) VmAddFsPut(ctx _context.Context) ApiVmAddFsPutRequest {
 	return ApiVmAddFsPutRequest{
@@ -1082,7 +1084,8 @@ func (a *DefaultApiService) VmAddFsPut(ctx _context.Context) ApiVmAddFsPutReques
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddFsPutExecute(r ApiVmAddFsPutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -1182,8 +1185,8 @@ func (r ApiVmAddNetPutRequest) Execute() (PciDeviceInfo, *_nethttp.Response, err
 /*
 VmAddNetPut Add a new network device to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddNetPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddNetPutRequest
 */
 func (a *DefaultApiService) VmAddNetPut(ctx _context.Context) ApiVmAddNetPutRequest {
 	return ApiVmAddNetPutRequest{
@@ -1193,7 +1196,8 @@ func (a *DefaultApiService) VmAddNetPut(ctx _context.Context) ApiVmAddNetPutRequ
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddNetPutExecute(r ApiVmAddNetPutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -1293,8 +1297,8 @@ func (r ApiVmAddPmemPutRequest) Execute() (PciDeviceInfo, *_nethttp.Response, er
 /*
 VmAddPmemPut Add a new pmem device to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddPmemPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddPmemPutRequest
 */
 func (a *DefaultApiService) VmAddPmemPut(ctx _context.Context) ApiVmAddPmemPutRequest {
 	return ApiVmAddPmemPutRequest{
@@ -1304,7 +1308,8 @@ func (a *DefaultApiService) VmAddPmemPut(ctx _context.Context) ApiVmAddPmemPutRe
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddPmemPutExecute(r ApiVmAddPmemPutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -1404,8 +1409,8 @@ func (r ApiVmAddVdpaPutRequest) Execute() (PciDeviceInfo, *_nethttp.Response, er
 /*
 VmAddVdpaPut Add a new vDPA device to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddVdpaPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddVdpaPutRequest
 */
 func (a *DefaultApiService) VmAddVdpaPut(ctx _context.Context) ApiVmAddVdpaPutRequest {
 	return ApiVmAddVdpaPutRequest{
@@ -1415,7 +1420,8 @@ func (a *DefaultApiService) VmAddVdpaPut(ctx _context.Context) ApiVmAddVdpaPutRe
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddVdpaPutExecute(r ApiVmAddVdpaPutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -1515,8 +1521,8 @@ func (r ApiVmAddVsockPutRequest) Execute() (PciDeviceInfo, *_nethttp.Response, e
 /*
 VmAddVsockPut Add a new vsock device to the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmAddVsockPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmAddVsockPutRequest
 */
 func (a *DefaultApiService) VmAddVsockPut(ctx _context.Context) ApiVmAddVsockPutRequest {
 	return ApiVmAddVsockPutRequest{
@@ -1526,7 +1532,8 @@ func (a *DefaultApiService) VmAddVsockPut(ctx _context.Context) ApiVmAddVsockPut
 }

 // Execute executes the request
-//  @return PciDeviceInfo
+//
+//	@return PciDeviceInfo
 func (a *DefaultApiService) VmAddVsockPutExecute(r ApiVmAddVsockPutRequest) (PciDeviceInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodPut
@@ -1626,8 +1633,8 @@ func (r ApiVmCoredumpPutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmCoredumpPut Takes a VM coredump.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmCoredumpPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmCoredumpPutRequest
 */
 func (a *DefaultApiService) VmCoredumpPut(ctx _context.Context) ApiVmCoredumpPutRequest {
 	return ApiVmCoredumpPutRequest{
@@ -1719,8 +1726,8 @@ func (r ApiVmCountersGetRequest) Execute() (map[string]map[string]int64, *_netht
 /*
 VmCountersGet Get counters from the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmCountersGetRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmCountersGetRequest
 */
 func (a *DefaultApiService) VmCountersGet(ctx _context.Context) ApiVmCountersGetRequest {
 	return ApiVmCountersGetRequest{
@@ -1730,7 +1737,8 @@ func (a *DefaultApiService) VmCountersGet(ctx _context.Context) ApiVmCountersGet
 }

 // Execute executes the request
-//  @return map[string]map[string]int64
+//
+//	@return map[string]map[string]int64
 func (a *DefaultApiService) VmCountersGetExecute(r ApiVmCountersGetRequest) (map[string]map[string]int64, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodGet
@@ -1818,8 +1826,8 @@ func (r ApiVmInfoGetRequest) Execute() (VmInfo, *_nethttp.Response, error) {
 /*
 VmInfoGet Returns general information about the cloud-hypervisor Virtual Machine (VM) instance.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmInfoGetRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmInfoGetRequest
 */
 func (a *DefaultApiService) VmInfoGet(ctx _context.Context) ApiVmInfoGetRequest {
 	return ApiVmInfoGetRequest{
@@ -1829,7 +1837,8 @@ func (a *DefaultApiService) VmInfoGet(ctx _context.Context) ApiVmInfoGetRequest
 }

 // Execute executes the request
-//  @return VmInfo
+//
+//	@return VmInfo
 func (a *DefaultApiService) VmInfoGetExecute(r ApiVmInfoGetRequest) (VmInfo, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodGet
@@ -1924,8 +1933,8 @@ func (r ApiVmReceiveMigrationPutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmReceiveMigrationPut Receive a VM migration from URL

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmReceiveMigrationPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmReceiveMigrationPutRequest
 */
 func (a *DefaultApiService) VmReceiveMigrationPut(ctx _context.Context) ApiVmReceiveMigrationPutRequest {
 	return ApiVmReceiveMigrationPutRequest{
@@ -2024,8 +2033,8 @@ func (r ApiVmRemoveDevicePutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmRemoveDevicePut Remove a device from the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmRemoveDevicePutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmRemoveDevicePutRequest
 */
 func (a *DefaultApiService) VmRemoveDevicePut(ctx _context.Context) ApiVmRemoveDevicePutRequest {
 	return ApiVmRemoveDevicePutRequest{
@@ -2124,8 +2133,8 @@ func (r ApiVmResizePutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmResizePut Resize the VM

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmResizePutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmResizePutRequest
 */
 func (a *DefaultApiService) VmResizePut(ctx _context.Context) ApiVmResizePutRequest {
 	return ApiVmResizePutRequest{
@@ -2224,8 +2233,8 @@ func (r ApiVmResizeZonePutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmResizeZonePut Resize a memory zone

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmResizeZonePutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmResizeZonePutRequest
 */
 func (a *DefaultApiService) VmResizeZonePut(ctx _context.Context) ApiVmResizeZonePutRequest {
 	return ApiVmResizeZonePutRequest{
@@ -2324,8 +2333,8 @@ func (r ApiVmRestorePutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmRestorePut Restore a VM from a snapshot.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmRestorePutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmRestorePutRequest
 */
 func (a *DefaultApiService) VmRestorePut(ctx _context.Context) ApiVmRestorePutRequest {
 	return ApiVmRestorePutRequest{
@@ -2424,8 +2433,8 @@ func (r ApiVmSendMigrationPutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmSendMigrationPut Send a VM migration to URL

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmSendMigrationPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmSendMigrationPutRequest
 */
 func (a *DefaultApiService) VmSendMigrationPut(ctx _context.Context) ApiVmSendMigrationPutRequest {
 	return ApiVmSendMigrationPutRequest{
@@ -2524,8 +2533,8 @@ func (r ApiVmSnapshotPutRequest) Execute() (*_nethttp.Response, error) {
 /*
 VmSnapshotPut Returns a VM snapshot.

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmSnapshotPutRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmSnapshotPutRequest
 */
 func (a *DefaultApiService) VmSnapshotPut(ctx _context.Context) ApiVmSnapshotPutRequest {
 	return ApiVmSnapshotPutRequest{
@@ -2617,8 +2626,8 @@ func (r ApiVmmPingGetRequest) Execute() (VmmPingResponse, *_nethttp.Response, er
 /*
 VmmPingGet Ping the VMM to check for API server availability

- @param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
- @return ApiVmmPingGetRequest
+	@param ctx _context.Context - for authentication, logging, cancellation, deadlines, tracing, etc. Passed from http.Request or context.Background().
+	@return ApiVmmPingGetRequest
 */
 func (a *DefaultApiService) VmmPingGet(ctx _context.Context) ApiVmmPingGetRequest {
 	return ApiVmmPingGetRequest{
@@ -2628,7 +2637,8 @@ func (a *DefaultApiService) VmmPingGet(ctx _context.Context) ApiVmmPingGetReques
 }

 // Execute executes the request
-//  @return VmmPingResponse
+//
+//	@return VmmPingResponse
 func (a *DefaultApiService) VmmPingGetExecute(r ApiVmmPingGetRequest) (VmmPingResponse, *_nethttp.Response, error) {
 	var (
 		localVarHTTPMethod   = _nethttp.MethodGet
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/CmdLineConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/CmdLineConfig.md
@@ -1,51 +0,0 @@
-# CmdLineConfig
-
-## Properties
-
-Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
-**Args** | **string** |  | 
-
-## Methods
-
-### NewCmdLineConfig
-
-`func NewCmdLineConfig(args string, ) *CmdLineConfig`
-
-NewCmdLineConfig instantiates a new CmdLineConfig object
-This constructor will assign default values to properties that have it defined,
-and makes sure properties required by API are set, but the set of arguments
-will change when the set of required properties is changed
-
-### NewCmdLineConfigWithDefaults
-
-`func NewCmdLineConfigWithDefaults() *CmdLineConfig`
-
-NewCmdLineConfigWithDefaults instantiates a new CmdLineConfig object
-This constructor will only assign default values to properties that have it defined,
-but it doesn't guarantee that properties required by API are set
-
-### GetArgs
-
-`func (o *CmdLineConfig) GetArgs() string`
-
-GetArgs returns the Args field if non-nil, zero value otherwise.
-
-### GetArgsOk
-
-`func (o *CmdLineConfig) GetArgsOk() (*string, bool)`
-
-GetArgsOk returns a tuple with the Args field if it's non-nil, zero value otherwise
-and a boolean to check if the value has been set.
-
-### SetArgs
-
-`func (o *CmdLineConfig) SetArgs(v string)`
-
-SetArgs sets Args field to given value.
-
-
-
-[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
-
-
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DefaultApi.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DefaultApi.md
@@ -110,7 +110,7 @@ import (
 )

 func main() {
-    vmConfig := *openapiclient.NewVmConfig(*openapiclient.NewKernelConfig("Path_example")) // VmConfig | The VM configuration
+    vmConfig := *openapiclient.NewVmConfig(*openapiclient.NewPayloadConfig()) // VmConfig | The VM configuration

    configuration := openapiclient.NewConfiguration()
    api_client := openapiclient.NewAPIClient(configuration)
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DiskConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DiskConfig.md
@@ -12,7 +12,6 @@ Name | Type | Description | Notes
 **QueueSize** | Pointer to **int32** |  | [optional] [default to 128]
 **VhostUser** | Pointer to **bool** |  | [optional] [default to false]
 **VhostSocket** | Pointer to **string** |  | [optional] 
-**PollQueue** | Pointer to **bool** |  | [optional] [default to true]
 **RateLimiterConfig** | Pointer to [**RateLimiterConfig**](RateLimiterConfig.md) |  | [optional] 
 **PciSegment** | Pointer to **int32** |  | [optional] 
 **Id** | Pointer to **string** |  | [optional] 
@@ -231,31 +230,6 @@ SetVhostSocket sets VhostSocket field to given value.

 HasVhostSocket returns a boolean if a field has been set.

-### GetPollQueue
-
-`func (o *DiskConfig) GetPollQueue() bool`
-
-GetPollQueue returns the PollQueue field if non-nil, zero value otherwise.
-
-### GetPollQueueOk
-
-`func (o *DiskConfig) GetPollQueueOk() (*bool, bool)`
-
-GetPollQueueOk returns a tuple with the PollQueue field if it's non-nil, zero value otherwise
-and a boolean to check if the value has been set.
-
-### SetPollQueue
-
-`func (o *DiskConfig) SetPollQueue(v bool)`
-
-SetPollQueue sets PollQueue field to given value.
-
-### HasPollQueue
-
-`func (o *DiskConfig) HasPollQueue() bool`
-
-HasPollQueue returns a boolean if a field has been set.
-
 ### GetRateLimiterConfig

 `func (o *DiskConfig) GetRateLimiterConfig() RateLimiterConfig`
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/InitramfsConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/InitramfsConfig.md
@@ -1,51 +0,0 @@
-# InitramfsConfig
-
-## Properties
-
-Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
-**Path** | **string** |  | 
-
-## Methods
-
-### NewInitramfsConfig
-
-`func NewInitramfsConfig(path string, ) *InitramfsConfig`
-
-NewInitramfsConfig instantiates a new InitramfsConfig object
-This constructor will assign default values to properties that have it defined,
-and makes sure properties required by API are set, but the set of arguments
-will change when the set of required properties is changed
-
-### NewInitramfsConfigWithDefaults
-
-`func NewInitramfsConfigWithDefaults() *InitramfsConfig`
-
-NewInitramfsConfigWithDefaults instantiates a new InitramfsConfig object
-This constructor will only assign default values to properties that have it defined,
-but it doesn't guarantee that properties required by API are set
-
-### GetPath
-
-`func (o *InitramfsConfig) GetPath() string`
-
-GetPath returns the Path field if non-nil, zero value otherwise.
-
-### GetPathOk
-
-`func (o *InitramfsConfig) GetPathOk() (*string, bool)`
-
-GetPathOk returns a tuple with the Path field if it's non-nil, zero value otherwise
-and a boolean to check if the value has been set.
-
-### SetPath
-
-`func (o *InitramfsConfig) SetPath(v string)`
-
-SetPath sets Path field to given value.
-
-
-
-[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
-
-
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/KernelConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/KernelConfig.md
@@ -1,51 +0,0 @@
-# KernelConfig
-
-## Properties
-
-Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
-**Path** | **string** |  | 
-
-## Methods
-
-### NewKernelConfig
-
-`func NewKernelConfig(path string, ) *KernelConfig`
-
-NewKernelConfig instantiates a new KernelConfig object
-This constructor will assign default values to properties that have it defined,
-and makes sure properties required by API are set, but the set of arguments
-will change when the set of required properties is changed
-
-### NewKernelConfigWithDefaults
-
-`func NewKernelConfigWithDefaults() *KernelConfig`
-
-NewKernelConfigWithDefaults instantiates a new KernelConfig object
-This constructor will only assign default values to properties that have it defined,
-but it doesn't guarantee that properties required by API are set
-
-### GetPath
-
-`func (o *KernelConfig) GetPath() string`
-
-GetPath returns the Path field if non-nil, zero value otherwise.
-
-### GetPathOk
-
-`func (o *KernelConfig) GetPathOk() (*string, bool)`
-
-GetPathOk returns a tuple with the Path field if it's non-nil, zero value otherwise
-and a boolean to check if the value has been set.
-
-### SetPath
-
-`func (o *KernelConfig) SetPath(v string)`
-
-SetPath sets Path field to given value.
-
-
-
-[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
-
-
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/PayloadConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/PayloadConfig.md
@@ -0,0 +1,108 @@
+# PayloadConfig
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**Kernel** | Pointer to **string** |  | [optional] 
+**Cmdline** | Pointer to **string** |  | [optional] 
+**Initramfs** | Pointer to **string** |  | [optional] 
+
+## Methods
+
+### NewPayloadConfig
+
+`func NewPayloadConfig() *PayloadConfig`
+
+NewPayloadConfig instantiates a new PayloadConfig object
+This constructor will assign default values to properties that have it defined,
+and makes sure properties required by API are set, but the set of arguments
+will change when the set of required properties is changed
+
+### NewPayloadConfigWithDefaults
+
+`func NewPayloadConfigWithDefaults() *PayloadConfig`
+
+NewPayloadConfigWithDefaults instantiates a new PayloadConfig object
+This constructor will only assign default values to properties that have it defined,
+but it doesn't guarantee that properties required by API are set
+
+### GetKernel
+
+`func (o *PayloadConfig) GetKernel() string`
+
+GetKernel returns the Kernel field if non-nil, zero value otherwise.
+
+### GetKernelOk
+
+`func (o *PayloadConfig) GetKernelOk() (*string, bool)`
+
+GetKernelOk returns a tuple with the Kernel field if it's non-nil, zero value otherwise
+and a boolean to check if the value has been set.
+
+### SetKernel
+
+`func (o *PayloadConfig) SetKernel(v string)`
+
+SetKernel sets Kernel field to given value.
+
+### HasKernel
+
+`func (o *PayloadConfig) HasKernel() bool`
+
+HasKernel returns a boolean if a field has been set.
+
+### GetCmdline
+
+`func (o *PayloadConfig) GetCmdline() string`
+
+GetCmdline returns the Cmdline field if non-nil, zero value otherwise.
+
+### GetCmdlineOk
+
+`func (o *PayloadConfig) GetCmdlineOk() (*string, bool)`
+
+GetCmdlineOk returns a tuple with the Cmdline field if it's non-nil, zero value otherwise
+and a boolean to check if the value has been set.
+
+### SetCmdline
+
+`func (o *PayloadConfig) SetCmdline(v string)`
+
+SetCmdline sets Cmdline field to given value.
+
+### HasCmdline
+
+`func (o *PayloadConfig) HasCmdline() bool`
+
+HasCmdline returns a boolean if a field has been set.
+
+### GetInitramfs
+
+`func (o *PayloadConfig) GetInitramfs() string`
+
+GetInitramfs returns the Initramfs field if non-nil, zero value otherwise.
+
+### GetInitramfsOk
+
+`func (o *PayloadConfig) GetInitramfsOk() (*string, bool)`
+
+GetInitramfsOk returns a tuple with the Initramfs field if it's non-nil, zero value otherwise
+and a boolean to check if the value has been set.
+
+### SetInitramfs
+
+`func (o *PayloadConfig) SetInitramfs(v string)`
+
+SetInitramfs sets Initramfs field to given value.
+
+### HasInitramfs
+
+`func (o *PayloadConfig) HasInitramfs() bool`
+
+HasInitramfs returns a boolean if a field has been set.
+
+
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/PlatformConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/PlatformConfig.md
@@ -7,6 +7,8 @@ Name | Type | Description | Notes
 **NumPciSegments** | Pointer to **int32** |  | [optional] 
 **IommuSegments** | Pointer to **[]int32** |  | [optional] 
 **SerialNumber** | Pointer to **string** |  | [optional] 
+**Uuid** | Pointer to **string** |  | [optional] 
+**OemStrings** | Pointer to **[]string** |  | [optional] 

 ## Methods

@@ -102,6 +104,56 @@ SetSerialNumber sets SerialNumber field to given value.

 HasSerialNumber returns a boolean if a field has been set.

+### GetUuid
+
+`func (o *PlatformConfig) GetUuid() string`
+
+GetUuid returns the Uuid field if non-nil, zero value otherwise.
+
+### GetUuidOk
+
+`func (o *PlatformConfig) GetUuidOk() (*string, bool)`
+
+GetUuidOk returns a tuple with the Uuid field if it's non-nil, zero value otherwise
+and a boolean to check if the value has been set.
+
+### SetUuid
+
+`func (o *PlatformConfig) SetUuid(v string)`
+
+SetUuid sets Uuid field to given value.
+
+### HasUuid
+
+`func (o *PlatformConfig) HasUuid() bool`
+
+HasUuid returns a boolean if a field has been set.
+
+### GetOemStrings
+
+`func (o *PlatformConfig) GetOemStrings() []string`
+
+GetOemStrings returns the OemStrings field if non-nil, zero value otherwise.
+
+### GetOemStringsOk
+
+`func (o *PlatformConfig) GetOemStringsOk() (*[]string, bool)`
+
+GetOemStringsOk returns a tuple with the OemStrings field if it's non-nil, zero value otherwise
+and a boolean to check if the value has been set.
+
+### SetOemStrings
+
+`func (o *PlatformConfig) SetOemStrings(v []string)`
+
+SetOemStrings sets OemStrings field to given value.
+
+### HasOemStrings
+
+`func (o *PlatformConfig) HasOemStrings() bool`
+
+HasOemStrings returns a boolean if a field has been set.
+

 [[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)

--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/VmConfig.md
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/VmConfig.md
@@ -6,9 +6,7 @@ Name | Type | Description | Notes
 ------------ | ------------- | ------------- | -------------
 **Cpus** | Pointer to [**CpusConfig**](CpusConfig.md) |  | [optional] 
 **Memory** | Pointer to [**MemoryConfig**](MemoryConfig.md) |  | [optional] 
-**Kernel** | [**KernelConfig**](KernelConfig.md) |  | 
-**Initramfs** | Pointer to [**NullableInitramfsConfig**](InitramfsConfig.md) |  | [optional] 
-**Cmdline** | Pointer to [**CmdLineConfig**](CmdLineConfig.md) |  | [optional] 
+**Payload** | [**PayloadConfig**](PayloadConfig.md) |  | 
 **Disks** | Pointer to [**[]DiskConfig**](DiskConfig.md) |  | [optional] 
 **Net** | Pointer to [**[]NetConfig**](NetConfig.md) |  | [optional] 
 **Rng** | Pointer to [**RngConfig**](RngConfig.md) |  | [optional] 
@@ -31,7 +29,7 @@ Name | Type | Description | Notes

 ### NewVmConfig

-`func NewVmConfig(kernel KernelConfig, ) *VmConfig`
+`func NewVmConfig(payload PayloadConfig, ) *VmConfig`

 NewVmConfig instantiates a new VmConfig object
 This constructor will assign default values to properties that have it defined,
@@ -96,86 +94,26 @@ SetMemory sets Memory field to given value.

 HasMemory returns a boolean if a field has been set.

-### GetKernel
+### GetPayload

-`func (o *VmConfig) GetKernel() KernelConfig`
+`func (o *VmConfig) GetPayload() PayloadConfig`

-GetKernel returns the Kernel field if non-nil, zero value otherwise.
+GetPayload returns the Payload field if non-nil, zero value otherwise.

-### GetKernelOk
+### GetPayloadOk

-`func (o *VmConfig) GetKernelOk() (*KernelConfig, bool)`
+`func (o *VmConfig) GetPayloadOk() (*PayloadConfig, bool)`

-GetKernelOk returns a tuple with the Kernel field if it's non-nil, zero value otherwise
+GetPayloadOk returns a tuple with the Payload field if it's non-nil, zero value otherwise
 and a boolean to check if the value has been set.

-### SetKernel
+### SetPayload

-`func (o *VmConfig) SetKernel(v KernelConfig)`
+`func (o *VmConfig) SetPayload(v PayloadConfig)`

-SetKernel sets Kernel field to given value.
+SetPayload sets Payload field to given value.


-### GetInitramfs
-
-`func (o *VmConfig) GetInitramfs() InitramfsConfig`
-
-GetInitramfs returns the Initramfs field if non-nil, zero value otherwise.
-
-### GetInitramfsOk
-
-`func (o *VmConfig) GetInitramfsOk() (*InitramfsConfig, bool)`
-
-GetInitramfsOk returns a tuple with the Initramfs field if it's non-nil, zero value otherwise
-and a boolean to check if the value has been set.
-
-### SetInitramfs
-
-`func (o *VmConfig) SetInitramfs(v InitramfsConfig)`
-
-SetInitramfs sets Initramfs field to given value.
-
-### HasInitramfs
-
-`func (o *VmConfig) HasInitramfs() bool`
-
-HasInitramfs returns a boolean if a field has been set.
-
-### SetInitramfsNil
-
-`func (o *VmConfig) SetInitramfsNil(b bool)`
-
- SetInitramfsNil sets the value for Initramfs to be an explicit nil
-
-### UnsetInitramfs
-`func (o *VmConfig) UnsetInitramfs()`
-
-UnsetInitramfs ensures that no value is present for Initramfs, not even an explicit nil
-### GetCmdline
-
-`func (o *VmConfig) GetCmdline() CmdLineConfig`
-
-GetCmdline returns the Cmdline field if non-nil, zero value otherwise.
-
-### GetCmdlineOk
-
-`func (o *VmConfig) GetCmdlineOk() (*CmdLineConfig, bool)`
-
-GetCmdlineOk returns a tuple with the Cmdline field if it's non-nil, zero value otherwise
-and a boolean to check if the value has been set.
-
-### SetCmdline
-
-`func (o *VmConfig) SetCmdline(v CmdLineConfig)`
-
-SetCmdline sets Cmdline field to given value.
-
-### HasCmdline
-
-`func (o *VmConfig) HasCmdline() bool`
-
-HasCmdline returns a boolean if a field has been set.
-
 ### GetDisks

 `func (o *VmConfig) GetDisks() []DiskConfig`
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_cmd_line_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_cmd_line_config.go
@@ -1,106 +0,0 @@
-/*
-Cloud Hypervisor API
-
-Local HTTP based API for managing and inspecting a cloud-hypervisor virtual machine.
-
-API version: 0.3.0
-*/
-
-// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
-
-package openapi
-
-import (
-	"encoding/json"
-)
-
-// CmdLineConfig struct for CmdLineConfig
-type CmdLineConfig struct {
-	Args string `json:"args"`
-}
-
-// NewCmdLineConfig instantiates a new CmdLineConfig object
-// This constructor will assign default values to properties that have it defined,
-// and makes sure properties required by API are set, but the set of arguments
-// will change when the set of required properties is changed
-func NewCmdLineConfig(args string) *CmdLineConfig {
-	this := CmdLineConfig{}
-	this.Args = args
-	return &this
-}
-
-// NewCmdLineConfigWithDefaults instantiates a new CmdLineConfig object
-// This constructor will only assign default values to properties that have it defined,
-// but it doesn't guarantee that properties required by API are set
-func NewCmdLineConfigWithDefaults() *CmdLineConfig {
-	this := CmdLineConfig{}
-	return &this
-}
-
-// GetArgs returns the Args field value
-func (o *CmdLineConfig) GetArgs() string {
-	if o == nil {
-		var ret string
-		return ret
-	}
-
-	return o.Args
-}
-
-// GetArgsOk returns a tuple with the Args field value
-// and a boolean to check if the value has been set.
-func (o *CmdLineConfig) GetArgsOk() (*string, bool) {
-	if o == nil {
-		return nil, false
-	}
-	return &o.Args, true
-}
-
-// SetArgs sets field value
-func (o *CmdLineConfig) SetArgs(v string) {
-	o.Args = v
-}
-
-func (o CmdLineConfig) MarshalJSON() ([]byte, error) {
-	toSerialize := map[string]interface{}{}
-	if true {
-		toSerialize["args"] = o.Args
-	}
-	return json.Marshal(toSerialize)
-}
-
-type NullableCmdLineConfig struct {
-	value *CmdLineConfig
-	isSet bool
-}
-
-func (v NullableCmdLineConfig) Get() *CmdLineConfig {
-	return v.value
-}
-
-func (v *NullableCmdLineConfig) Set(val *CmdLineConfig) {
-	v.value = val
-	v.isSet = true
-}
-
-func (v NullableCmdLineConfig) IsSet() bool {
-	return v.isSet
-}
-
-func (v *NullableCmdLineConfig) Unset() {
-	v.value = nil
-	v.isSet = false
-}
-
-func NewNullableCmdLineConfig(val *CmdLineConfig) *NullableCmdLineConfig {
-	return &NullableCmdLineConfig{value: val, isSet: true}
-}
-
-func (v NullableCmdLineConfig) MarshalJSON() ([]byte, error) {
-	return json.Marshal(v.value)
-}
-
-func (v *NullableCmdLineConfig) UnmarshalJSON(src []byte) error {
-	v.isSet = true
-	return json.Unmarshal(src, &v.value)
-}
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_disk_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_disk_config.go
@@ -24,7 +24,6 @@ type DiskConfig struct {
 	QueueSize         *int32             `json:"queue_size,omitempty"`
 	VhostUser         *bool              `json:"vhost_user,omitempty"`
 	VhostSocket       *string            `json:"vhost_socket,omitempty"`
-	PollQueue         *bool              `json:"poll_queue,omitempty"`
 	RateLimiterConfig *RateLimiterConfig `json:"rate_limiter_config,omitempty"`
 	PciSegment        *int32             `json:"pci_segment,omitempty"`
 	Id                *string            `json:"id,omitempty"`
@@ -49,8 +48,6 @@ func NewDiskConfig(path string) *DiskConfig {
 	this.QueueSize = &queueSize
 	var vhostUser bool = false
 	this.VhostUser = &vhostUser
-	var pollQueue bool = true
-	this.PollQueue = &pollQueue
 	return &this
 }

@@ -71,8 +68,6 @@ func NewDiskConfigWithDefaults() *DiskConfig {
 	this.QueueSize = &queueSize
 	var vhostUser bool = false
 	this.VhostUser = &vhostUser
-	var pollQueue bool = true
-	this.PollQueue = &pollQueue
 	return &this
 }

@@ -324,38 +319,6 @@ func (o *DiskConfig) SetVhostSocket(v string) {
 	o.VhostSocket = &v
 }

-// GetPollQueue returns the PollQueue field value if set, zero value otherwise.
-func (o *DiskConfig) GetPollQueue() bool {
-	if o == nil || o.PollQueue == nil {
-		var ret bool
-		return ret
-	}
-	return *o.PollQueue
-}
-
-// GetPollQueueOk returns a tuple with the PollQueue field value if set, nil otherwise
-// and a boolean to check if the value has been set.
-func (o *DiskConfig) GetPollQueueOk() (*bool, bool) {
-	if o == nil || o.PollQueue == nil {
-		return nil, false
-	}
-	return o.PollQueue, true
-}
-
-// HasPollQueue returns a boolean if a field has been set.
-func (o *DiskConfig) HasPollQueue() bool {
-	if o != nil && o.PollQueue != nil {
-		return true
-	}
-
-	return false
-}
-
-// SetPollQueue gets a reference to the given bool and assigns it to the PollQueue field.
-func (o *DiskConfig) SetPollQueue(v bool) {
-	o.PollQueue = &v
-}
-
 // GetRateLimiterConfig returns the RateLimiterConfig field value if set, zero value otherwise.
 func (o *DiskConfig) GetRateLimiterConfig() RateLimiterConfig {
 	if o == nil || o.RateLimiterConfig == nil {
@@ -478,9 +441,6 @@ func (o DiskConfig) MarshalJSON() ([]byte, error) {
 	if o.VhostSocket != nil {
 		toSerialize["vhost_socket"] = o.VhostSocket
 	}
-	if o.PollQueue != nil {
-		toSerialize["poll_queue"] = o.PollQueue
-	}
 	if o.RateLimiterConfig != nil {
 		toSerialize["rate_limiter_config"] = o.RateLimiterConfig
 	}
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_initramfs_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_initramfs_config.go
@@ -1,106 +0,0 @@
-/*
-Cloud Hypervisor API
-
-Local HTTP based API for managing and inspecting a cloud-hypervisor virtual machine.
-
-API version: 0.3.0
-*/
-
-// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
-
-package openapi
-
-import (
-	"encoding/json"
-)
-
-// InitramfsConfig struct for InitramfsConfig
-type InitramfsConfig struct {
-	Path string `json:"path"`
-}
-
-// NewInitramfsConfig instantiates a new InitramfsConfig object
-// This constructor will assign default values to properties that have it defined,
-// and makes sure properties required by API are set, but the set of arguments
-// will change when the set of required properties is changed
-func NewInitramfsConfig(path string) *InitramfsConfig {
-	this := InitramfsConfig{}
-	this.Path = path
-	return &this
-}
-
-// NewInitramfsConfigWithDefaults instantiates a new InitramfsConfig object
-// This constructor will only assign default values to properties that have it defined,
-// but it doesn't guarantee that properties required by API are set
-func NewInitramfsConfigWithDefaults() *InitramfsConfig {
-	this := InitramfsConfig{}
-	return &this
-}
-
-// GetPath returns the Path field value
-func (o *InitramfsConfig) GetPath() string {
-	if o == nil {
-		var ret string
-		return ret
-	}
-
-	return o.Path
-}
-
-// GetPathOk returns a tuple with the Path field value
-// and a boolean to check if the value has been set.
-func (o *InitramfsConfig) GetPathOk() (*string, bool) {
-	if o == nil {
-		return nil, false
-	}
-	return &o.Path, true
-}
-
-// SetPath sets field value
-func (o *InitramfsConfig) SetPath(v string) {
-	o.Path = v
-}
-
-func (o InitramfsConfig) MarshalJSON() ([]byte, error) {
-	toSerialize := map[string]interface{}{}
-	if true {
-		toSerialize["path"] = o.Path
-	}
-	return json.Marshal(toSerialize)
-}
-
-type NullableInitramfsConfig struct {
-	value *InitramfsConfig
-	isSet bool
-}
-
-func (v NullableInitramfsConfig) Get() *InitramfsConfig {
-	return v.value
-}
-
-func (v *NullableInitramfsConfig) Set(val *InitramfsConfig) {
-	v.value = val
-	v.isSet = true
-}
-
-func (v NullableInitramfsConfig) IsSet() bool {
-	return v.isSet
-}
-
-func (v *NullableInitramfsConfig) Unset() {
-	v.value = nil
-	v.isSet = false
-}
-
-func NewNullableInitramfsConfig(val *InitramfsConfig) *NullableInitramfsConfig {
-	return &NullableInitramfsConfig{value: val, isSet: true}
-}
-
-func (v NullableInitramfsConfig) MarshalJSON() ([]byte, error) {
-	return json.Marshal(v.value)
-}
-
-func (v *NullableInitramfsConfig) UnmarshalJSON(src []byte) error {
-	v.isSet = true
-	return json.Unmarshal(src, &v.value)
-}
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_kernel_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_kernel_config.go
@@ -1,106 +0,0 @@
-/*
-Cloud Hypervisor API
-
-Local HTTP based API for managing and inspecting a cloud-hypervisor virtual machine.
-
-API version: 0.3.0
-*/
-
-// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
-
-package openapi
-
-import (
-	"encoding/json"
-)
-
-// KernelConfig struct for KernelConfig
-type KernelConfig struct {
-	Path string `json:"path"`
-}
-
-// NewKernelConfig instantiates a new KernelConfig object
-// This constructor will assign default values to properties that have it defined,
-// and makes sure properties required by API are set, but the set of arguments
-// will change when the set of required properties is changed
-func NewKernelConfig(path string) *KernelConfig {
-	this := KernelConfig{}
-	this.Path = path
-	return &this
-}
-
-// NewKernelConfigWithDefaults instantiates a new KernelConfig object
-// This constructor will only assign default values to properties that have it defined,
-// but it doesn't guarantee that properties required by API are set
-func NewKernelConfigWithDefaults() *KernelConfig {
-	this := KernelConfig{}
-	return &this
-}
-
-// GetPath returns the Path field value
-func (o *KernelConfig) GetPath() string {
-	if o == nil {
-		var ret string
-		return ret
-	}
-
-	return o.Path
-}
-
-// GetPathOk returns a tuple with the Path field value
-// and a boolean to check if the value has been set.
-func (o *KernelConfig) GetPathOk() (*string, bool) {
-	if o == nil {
-		return nil, false
-	}
-	return &o.Path, true
-}
-
-// SetPath sets field value
-func (o *KernelConfig) SetPath(v string) {
-	o.Path = v
-}
-
-func (o KernelConfig) MarshalJSON() ([]byte, error) {
-	toSerialize := map[string]interface{}{}
-	if true {
-		toSerialize["path"] = o.Path
-	}
-	return json.Marshal(toSerialize)
-}
-
-type NullableKernelConfig struct {
-	value *KernelConfig
-	isSet bool
-}
-
-func (v NullableKernelConfig) Get() *KernelConfig {
-	return v.value
-}
-
-func (v *NullableKernelConfig) Set(val *KernelConfig) {
-	v.value = val
-	v.isSet = true
-}
-
-func (v NullableKernelConfig) IsSet() bool {
-	return v.isSet
-}
-
-func (v *NullableKernelConfig) Unset() {
-	v.value = nil
-	v.isSet = false
-}
-
-func NewNullableKernelConfig(val *KernelConfig) *NullableKernelConfig {
-	return &NullableKernelConfig{value: val, isSet: true}
-}
-
-func (v NullableKernelConfig) MarshalJSON() ([]byte, error) {
-	return json.Marshal(v.value)
-}
-
-func (v *NullableKernelConfig) UnmarshalJSON(src []byte) error {
-	v.isSet = true
-	return json.Unmarshal(src, &v.value)
-}
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_payload_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_payload_config.go
@@ -0,0 +1,185 @@
+/*
+Cloud Hypervisor API
+
+Local HTTP based API for managing and inspecting a cloud-hypervisor virtual machine.
+
+API version: 0.3.0
+*/
+
+// Code generated by OpenAPI Generator (https://openapi-generator.tech); DO NOT EDIT.
+
+package openapi
+
+import (
+	"encoding/json"
+)
+
+// PayloadConfig Payloads to boot in guest
+type PayloadConfig struct {
+	Kernel    *string `json:"kernel,omitempty"`
+	Cmdline   *string `json:"cmdline,omitempty"`
+	Initramfs *string `json:"initramfs,omitempty"`
+}
+
+// NewPayloadConfig instantiates a new PayloadConfig object
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed
+func NewPayloadConfig() *PayloadConfig {
+	this := PayloadConfig{}
+	return &this
+}
+
+// NewPayloadConfigWithDefaults instantiates a new PayloadConfig object
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set
+func NewPayloadConfigWithDefaults() *PayloadConfig {
+	this := PayloadConfig{}
+	return &this
+}
+
+// GetKernel returns the Kernel field value if set, zero value otherwise.
+func (o *PayloadConfig) GetKernel() string {
+	if o == nil || o.Kernel == nil {
+		var ret string
+		return ret
+	}
+	return *o.Kernel
+}
+
+// GetKernelOk returns a tuple with the Kernel field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *PayloadConfig) GetKernelOk() (*string, bool) {
+	if o == nil || o.Kernel == nil {
+		return nil, false
+	}
+	return o.Kernel, true
+}
+
+// HasKernel returns a boolean if a field has been set.
+func (o *PayloadConfig) HasKernel() bool {
+	if o != nil && o.Kernel != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetKernel gets a reference to the given string and assigns it to the Kernel field.
+func (o *PayloadConfig) SetKernel(v string) {
+	o.Kernel = &v
+}
+
+// GetCmdline returns the Cmdline field value if set, zero value otherwise.
+func (o *PayloadConfig) GetCmdline() string {
+	if o == nil || o.Cmdline == nil {
+		var ret string
+		return ret
+	}
+	return *o.Cmdline
+}
+
+// GetCmdlineOk returns a tuple with the Cmdline field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *PayloadConfig) GetCmdlineOk() (*string, bool) {
+	if o == nil || o.Cmdline == nil {
+		return nil, false
+	}
+	return o.Cmdline, true
+}
+
+// HasCmdline returns a boolean if a field has been set.
+func (o *PayloadConfig) HasCmdline() bool {
+	if o != nil && o.Cmdline != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetCmdline gets a reference to the given string and assigns it to the Cmdline field.
+func (o *PayloadConfig) SetCmdline(v string) {
+	o.Cmdline = &v
+}
+
+// GetInitramfs returns the Initramfs field value if set, zero value otherwise.
+func (o *PayloadConfig) GetInitramfs() string {
+	if o == nil || o.Initramfs == nil {
+		var ret string
+		return ret
+	}
+	return *o.Initramfs
+}
+
+// GetInitramfsOk returns a tuple with the Initramfs field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *PayloadConfig) GetInitramfsOk() (*string, bool) {
+	if o == nil || o.Initramfs == nil {
+		return nil, false
+	}
+	return o.Initramfs, true
+}
+
+// HasInitramfs returns a boolean if a field has been set.
+func (o *PayloadConfig) HasInitramfs() bool {
+	if o != nil && o.Initramfs != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetInitramfs gets a reference to the given string and assigns it to the Initramfs field.
+func (o *PayloadConfig) SetInitramfs(v string) {
+	o.Initramfs = &v
+}
+
+func (o PayloadConfig) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if o.Kernel != nil {
+		toSerialize["kernel"] = o.Kernel
+	}
+	if o.Cmdline != nil {
+		toSerialize["cmdline"] = o.Cmdline
+	}
+	if o.Initramfs != nil {
+		toSerialize["initramfs"] = o.Initramfs
+	}
+	return json.Marshal(toSerialize)
+}
+
+type NullablePayloadConfig struct {
+	value *PayloadConfig
+	isSet bool
+}
+
+func (v NullablePayloadConfig) Get() *PayloadConfig {
+	return v.value
+}
+
+func (v *NullablePayloadConfig) Set(val *PayloadConfig) {
+	v.value = val
+	v.isSet = true
+}
+
+func (v NullablePayloadConfig) IsSet() bool {
+	return v.isSet
+}
+
+func (v *NullablePayloadConfig) Unset() {
+	v.value = nil
+	v.isSet = false
+}
+
+func NewNullablePayloadConfig(val *PayloadConfig) *NullablePayloadConfig {
+	return &NullablePayloadConfig{value: val, isSet: true}
+}
+
+func (v NullablePayloadConfig) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+func (v *NullablePayloadConfig) UnmarshalJSON(src []byte) error {
+	v.isSet = true
+	return json.Unmarshal(src, &v.value)
+}
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_platform_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_platform_config.go
@@ -16,9 +16,11 @@ import (

 // PlatformConfig struct for PlatformConfig
 type PlatformConfig struct {
-	NumPciSegments *int32   `json:"num_pci_segments,omitempty"`
-	IommuSegments  *[]int32 `json:"iommu_segments,omitempty"`
-	SerialNumber   *string  `json:"serial_number,omitempty"`
+	NumPciSegments *int32    `json:"num_pci_segments,omitempty"`
+	IommuSegments  *[]int32  `json:"iommu_segments,omitempty"`
+	SerialNumber   *string   `json:"serial_number,omitempty"`
+	Uuid           *string   `json:"uuid,omitempty"`
+	OemStrings     *[]string `json:"oem_strings,omitempty"`
 }

 // NewPlatformConfig instantiates a new PlatformConfig object
@@ -134,6 +136,70 @@ func (o *PlatformConfig) SetSerialNumber(v string) {
 	o.SerialNumber = &v
 }

+// GetUuid returns the Uuid field value if set, zero value otherwise.
+func (o *PlatformConfig) GetUuid() string {
+	if o == nil || o.Uuid == nil {
+		var ret string
+		return ret
+	}
+	return *o.Uuid
+}
+
+// GetUuidOk returns a tuple with the Uuid field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *PlatformConfig) GetUuidOk() (*string, bool) {
+	if o == nil || o.Uuid == nil {
+		return nil, false
+	}
+	return o.Uuid, true
+}
+
+// HasUuid returns a boolean if a field has been set.
+func (o *PlatformConfig) HasUuid() bool {
+	if o != nil && o.Uuid != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetUuid gets a reference to the given string and assigns it to the Uuid field.
+func (o *PlatformConfig) SetUuid(v string) {
+	o.Uuid = &v
+}
+
+// GetOemStrings returns the OemStrings field value if set, zero value otherwise.
+func (o *PlatformConfig) GetOemStrings() []string {
+	if o == nil || o.OemStrings == nil {
+		var ret []string
+		return ret
+	}
+	return *o.OemStrings
+}
+
+// GetOemStringsOk returns a tuple with the OemStrings field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *PlatformConfig) GetOemStringsOk() (*[]string, bool) {
+	if o == nil || o.OemStrings == nil {
+		return nil, false
+	}
+	return o.OemStrings, true
+}
+
+// HasOemStrings returns a boolean if a field has been set.
+func (o *PlatformConfig) HasOemStrings() bool {
+	if o != nil && o.OemStrings != nil {
+		return true
+	}
+
+	return false
+}
+
+// SetOemStrings gets a reference to the given []string and assigns it to the OemStrings field.
+func (o *PlatformConfig) SetOemStrings(v []string) {
+	o.OemStrings = &v
+}
+
 func (o PlatformConfig) MarshalJSON() ([]byte, error) {
 	toSerialize := map[string]interface{}{}
 	if o.NumPciSegments != nil {
@@ -145,6 +211,12 @@ func (o PlatformConfig) MarshalJSON() ([]byte, error) {
 	if o.SerialNumber != nil {
 		toSerialize["serial_number"] = o.SerialNumber
 	}
+	if o.Uuid != nil {
+		toSerialize["uuid"] = o.Uuid
+	}
+	if o.OemStrings != nil {
+		toSerialize["oem_strings"] = o.OemStrings
+	}
 	return json.Marshal(toSerialize)
 }

--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_vm_config.go
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_vm_config.go
@@ -16,37 +16,35 @@ import (

 // VmConfig Virtual machine configuration
 type VmConfig struct {
-	Cpus      *CpusConfig             `json:"cpus,omitempty"`
-	Memory    *MemoryConfig           `json:"memory,omitempty"`
-	Kernel    KernelConfig            `json:"kernel"`
-	Initramfs NullableInitramfsConfig `json:"initramfs,omitempty"`
-	Cmdline   *CmdLineConfig          `json:"cmdline,omitempty"`
-	Disks     *[]DiskConfig           `json:"disks,omitempty"`
-	Net       *[]NetConfig            `json:"net,omitempty"`
-	Rng       *RngConfig              `json:"rng,omitempty"`
-	Balloon   *BalloonConfig          `json:"balloon,omitempty"`
-	Fs        *[]FsConfig             `json:"fs,omitempty"`
-	Pmem      *[]PmemConfig           `json:"pmem,omitempty"`
-	Serial    *ConsoleConfig          `json:"serial,omitempty"`
-	Console   *ConsoleConfig          `json:"console,omitempty"`
-	Devices   *[]DeviceConfig         `json:"devices,omitempty"`
-	Vdpa      *[]VdpaConfig           `json:"vdpa,omitempty"`
-	Vsock     *VsockConfig            `json:"vsock,omitempty"`
-	SgxEpc    *[]SgxEpcConfig         `json:"sgx_epc,omitempty"`
-	Tdx       *TdxConfig              `json:"tdx,omitempty"`
-	Numa      *[]NumaConfig           `json:"numa,omitempty"`
-	Iommu     *bool                   `json:"iommu,omitempty"`
-	Watchdog  *bool                   `json:"watchdog,omitempty"`
-	Platform  *PlatformConfig         `json:"platform,omitempty"`
+	Cpus     *CpusConfig     `json:"cpus,omitempty"`
+	Memory   *MemoryConfig   `json:"memory,omitempty"`
+	Payload  PayloadConfig   `json:"payload"`
+	Disks    *[]DiskConfig   `json:"disks,omitempty"`
+	Net      *[]NetConfig    `json:"net,omitempty"`
+	Rng      *RngConfig      `json:"rng,omitempty"`
+	Balloon  *BalloonConfig  `json:"balloon,omitempty"`
+	Fs       *[]FsConfig     `json:"fs,omitempty"`
+	Pmem     *[]PmemConfig   `json:"pmem,omitempty"`
+	Serial   *ConsoleConfig  `json:"serial,omitempty"`
+	Console  *ConsoleConfig  `json:"console,omitempty"`
+	Devices  *[]DeviceConfig `json:"devices,omitempty"`
+	Vdpa     *[]VdpaConfig   `json:"vdpa,omitempty"`
+	Vsock    *VsockConfig    `json:"vsock,omitempty"`
+	SgxEpc   *[]SgxEpcConfig `json:"sgx_epc,omitempty"`
+	Tdx      *TdxConfig      `json:"tdx,omitempty"`
+	Numa     *[]NumaConfig   `json:"numa,omitempty"`
+	Iommu    *bool           `json:"iommu,omitempty"`
+	Watchdog *bool           `json:"watchdog,omitempty"`
+	Platform *PlatformConfig `json:"platform,omitempty"`
 }

 // NewVmConfig instantiates a new VmConfig object
 // This constructor will assign default values to properties that have it defined,
 // and makes sure properties required by API are set, but the set of arguments
 // will change when the set of required properties is changed
-func NewVmConfig(kernel KernelConfig) *VmConfig {
+func NewVmConfig(payload PayloadConfig) *VmConfig {
 	this := VmConfig{}
-	this.Kernel = kernel
+	this.Payload = payload
 	var iommu bool = false
 	this.Iommu = &iommu
 	var watchdog bool = false
@@ -130,103 +128,28 @@ func (o *VmConfig) SetMemory(v MemoryConfig) {
 	o.Memory = &v
 }

-// GetKernel returns the Kernel field value
-func (o *VmConfig) GetKernel() KernelConfig {
+// GetPayload returns the Payload field value
+func (o *VmConfig) GetPayload() PayloadConfig {
 	if o == nil {
-		var ret KernelConfig
+		var ret PayloadConfig
 		return ret
 	}

-	return o.Kernel
+	return o.Payload
 }

-// GetKernelOk returns a tuple with the Kernel field value
+// GetPayloadOk returns a tuple with the Payload field value
 // and a boolean to check if the value has been set.
-func (o *VmConfig) GetKernelOk() (*KernelConfig, bool) {
+func (o *VmConfig) GetPayloadOk() (*PayloadConfig, bool) {
 	if o == nil {
 		return nil, false
 	}
-	return &o.Kernel, true
+	return &o.Payload, true
 }

-// SetKernel sets field value
-func (o *VmConfig) SetKernel(v KernelConfig) {
-	o.Kernel = v
-}
-
-// GetInitramfs returns the Initramfs field value if set, zero value otherwise (both if not set or set to explicit null).
-func (o *VmConfig) GetInitramfs() InitramfsConfig {
-	if o == nil || o.Initramfs.Get() == nil {
-		var ret InitramfsConfig
-		return ret
-	}
-	return *o.Initramfs.Get()
-}
-
-// GetInitramfsOk returns a tuple with the Initramfs field value if set, nil otherwise
-// and a boolean to check if the value has been set.
-// NOTE: If the value is an explicit nil, `nil, true` will be returned
-func (o *VmConfig) GetInitramfsOk() (*InitramfsConfig, bool) {
-	if o == nil {
-		return nil, false
-	}
-	return o.Initramfs.Get(), o.Initramfs.IsSet()
-}
-
-// HasInitramfs returns a boolean if a field has been set.
-func (o *VmConfig) HasInitramfs() bool {
-	if o != nil && o.Initramfs.IsSet() {
-		return true
-	}
-
-	return false
-}
-
-// SetInitramfs gets a reference to the given NullableInitramfsConfig and assigns it to the Initramfs field.
-func (o *VmConfig) SetInitramfs(v InitramfsConfig) {
-	o.Initramfs.Set(&v)
-}
-
-// SetInitramfsNil sets the value for Initramfs to be an explicit nil
-func (o *VmConfig) SetInitramfsNil() {
-	o.Initramfs.Set(nil)
-}
-
-// UnsetInitramfs ensures that no value is present for Initramfs, not even an explicit nil
-func (o *VmConfig) UnsetInitramfs() {
-	o.Initramfs.Unset()
-}
-
-// GetCmdline returns the Cmdline field value if set, zero value otherwise.
-func (o *VmConfig) GetCmdline() CmdLineConfig {
-	if o == nil || o.Cmdline == nil {
-		var ret CmdLineConfig
-		return ret
-	}
-	return *o.Cmdline
-}
-
-// GetCmdlineOk returns a tuple with the Cmdline field value if set, nil otherwise
-// and a boolean to check if the value has been set.
-func (o *VmConfig) GetCmdlineOk() (*CmdLineConfig, bool) {
-	if o == nil || o.Cmdline == nil {
-		return nil, false
-	}
-	return o.Cmdline, true
-}
-
-// HasCmdline returns a boolean if a field has been set.
-func (o *VmConfig) HasCmdline() bool {
-	if o != nil && o.Cmdline != nil {
-		return true
-	}
-
-	return false
-}
-
-// SetCmdline gets a reference to the given CmdLineConfig and assigns it to the Cmdline field.
-func (o *VmConfig) SetCmdline(v CmdLineConfig) {
-	o.Cmdline = &v
+// SetPayload sets field value
+func (o *VmConfig) SetPayload(v PayloadConfig) {
+	o.Payload = v
 }

 // GetDisks returns the Disks field value if set, zero value otherwise.
@@ -782,13 +705,7 @@ func (o VmConfig) MarshalJSON() ([]byte, error) {
 		toSerialize["memory"] = o.Memory
 	}
 	if true {
-		toSerialize["kernel"] = o.Kernel
-	}
-	if o.Initramfs.IsSet() {
-		toSerialize["initramfs"] = o.Initramfs.Get()
-	}
-	if o.Cmdline != nil {
-		toSerialize["cmdline"] = o.Cmdline
+		toSerialize["payload"] = o.Payload
 	}
 	if o.Disks != nil {
 		toSerialize["disks"] = o.Disks
--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml
+++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml
@@ -8,10 +8,9 @@ info:
  version: 0.3.0

 servers:
- url: http://localhost/api/v1
+  - url: http://localhost/api/v1

 paths:
-
  /vmm.ping:
    get:
      summary: Ping the VMM to check for API server availability
@@ -21,7 +20,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/VmmPingResponse'
+                $ref: "#/components/schemas/VmmPingResponse"

  /vmm.shutdown:
    put:
@@ -40,7 +39,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/VmInfo'
+                $ref: "#/components/schemas/VmInfo"

  /vm.counters:
    get:
@@ -51,7 +50,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/VmCounters'
+                $ref: "#/components/schemas/VmCounters"

  /vm.create:
    put:
@@ -62,7 +61,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmConfig'
+              $ref: "#/components/schemas/VmConfig"
        required: true
      responses:
        204:
@@ -154,7 +153,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmResize'
+              $ref: "#/components/schemas/VmResize"
        required: true
      responses:
        204:
@@ -170,7 +169,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmResizeZone'
+              $ref: "#/components/schemas/VmResizeZone"
        required: true
      responses:
        204:
@@ -186,7 +185,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmAddDevice'
+              $ref: "#/components/schemas/VmAddDevice"
        required: true
      responses:
        200:
@@ -194,7 +193,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new device was successfully (cold) added to the VM instance.
        404:
@@ -208,7 +207,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmRemoveDevice'
+              $ref: "#/components/schemas/VmRemoveDevice"
        required: true
      responses:
        204:
@@ -224,7 +223,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/DiskConfig'
+              $ref: "#/components/schemas/DiskConfig"
        required: true
      responses:
        200:
@@ -232,7 +231,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new disk was successfully (cold) added to the VM instance.
        500:
@@ -246,7 +245,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/FsConfig'
+              $ref: "#/components/schemas/FsConfig"
        required: true
      responses:
        200:
@@ -254,7 +253,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new device was successfully (cold) added to the VM instance.
        500:
@@ -268,7 +267,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/PmemConfig'
+              $ref: "#/components/schemas/PmemConfig"
        required: true
      responses:
        200:
@@ -276,7 +275,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new device was successfully (cold) added to the VM instance.
        500:
@@ -290,7 +289,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/NetConfig'
+              $ref: "#/components/schemas/NetConfig"
        required: true
      responses:
        200:
@@ -298,7 +297,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new device was successfully (cold) added to the VM instance.
        500:
@@ -312,7 +311,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VsockConfig'
+              $ref: "#/components/schemas/VsockConfig"
        required: true
      responses:
        200:
@@ -320,12 +319,12 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new device was successfully (cold) added to the VM instance.
        500:
          description: The new device could not be added to the VM instance.
-  
+
  /vm.add-vdpa:
    put:
      summary: Add a new vDPA device to the VM
@@ -334,7 +333,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VdpaConfig'
+              $ref: "#/components/schemas/VdpaConfig"
        required: true
      responses:
        200:
@@ -342,7 +341,7 @@ paths:
          content:
            application/json:
              schema:
-                $ref: '#/components/schemas/PciDeviceInfo'
+                $ref: "#/components/schemas/PciDeviceInfo"
        204:
          description: The new vDPA device was successfully (cold) added to the VM instance.
        500:
@@ -356,7 +355,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmSnapshotConfig'
+              $ref: "#/components/schemas/VmSnapshotConfig"
        required: true
      responses:
        204:
@@ -374,7 +373,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/VmCoredumpData'
+              $ref: "#/components/schemas/VmCoredumpData"
        required: true
      responses:
        204:
@@ -392,7 +391,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/RestoreConfig'
+              $ref: "#/components/schemas/RestoreConfig"
        required: true
      responses:
        204:
@@ -408,7 +407,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/ReceiveMigrationData'
+              $ref: "#/components/schemas/ReceiveMigrationData"
        required: true
      responses:
        204:
@@ -424,7 +423,7 @@ paths:
        content:
          application/json:
            schema:
-              $ref: '#/components/schemas/SendMigrationData'
+              $ref: "#/components/schemas/SendMigrationData"
        required: true
      responses:
        204:
@@ -434,10 +433,9 @@ paths:

 components:
  schemas:
-
    VmmPingResponse:
      required:
-      - version
+        - version
      type: object
      properties:
        version:
@@ -446,12 +444,12 @@ components:

    VmInfo:
      required:
-      - config
-      - state
+        - config
+        - state
      type: object
      properties:
        config:
-          $ref: '#/components/schemas/VmConfig'
+          $ref: "#/components/schemas/VmConfig"
        state:
          type: string
          enum: [Created, Running, Shutdown, Paused]
@@ -461,7 +459,7 @@ components:
        device_tree:
          type: object
          additionalProperties:
-            $ref: '#/components/schemas/DeviceNode'
+            $ref: "#/components/schemas/DeviceNode"
      description: Virtual Machine information

    DeviceNode:
@@ -491,8 +489,8 @@ components:

    PciDeviceInfo:
      required:
-      - id
-      - bdf
+        - id
+        - bdf
      type: object
      properties:
        id:
@@ -501,65 +499,72 @@ components:
          type: string
      description: Information about a PCI device

+    PayloadConfig:
+      type: object
+      properties:
+        kernel:
+          type: string
+        cmdline:
+          type: string
+        initramfs:
+          type: string
+      description: Payloads to boot in guest
+
    VmConfig:
      required:
-      - kernel
+        - payload
      type: object
      properties:
        cpus:
-          $ref: '#/components/schemas/CpusConfig'
+          $ref: "#/components/schemas/CpusConfig"
        memory:
-          $ref: '#/components/schemas/MemoryConfig'
-        kernel:
-          $ref: '#/components/schemas/KernelConfig'
-        initramfs:
-          $ref: '#/components/schemas/InitramfsConfig'
-        cmdline:
-          $ref: '#/components/schemas/CmdLineConfig'
+          $ref: "#/components/schemas/MemoryConfig"
+        payload:
+          $ref: "#/components/schemas/PayloadConfig"
        disks:
          type: array
          items:
-            $ref: '#/components/schemas/DiskConfig'
+            $ref: "#/components/schemas/DiskConfig"
        net:
          type: array
          items:
-            $ref: '#/components/schemas/NetConfig'
+            $ref: "#/components/schemas/NetConfig"
        rng:
-          $ref: '#/components/schemas/RngConfig'
+          $ref: "#/components/schemas/RngConfig"
        balloon:
-          $ref: '#/components/schemas/BalloonConfig'
+          $ref: "#/components/schemas/BalloonConfig"
        fs:
          type: array
          items:
-            $ref: '#/components/schemas/FsConfig'
+            $ref: "#/components/schemas/FsConfig"
        pmem:
          type: array
          items:
-            $ref: '#/components/schemas/PmemConfig'
+            $ref: "#/components/schemas/PmemConfig"
        serial:
-          $ref: '#/components/schemas/ConsoleConfig'
+          $ref: "#/components/schemas/ConsoleConfig"
        console:
-          $ref: '#/components/schemas/ConsoleConfig'
+          $ref: "#/components/schemas/ConsoleConfig"
        devices:
          type: array
          items:
-            $ref: '#/components/schemas/DeviceConfig'
+            $ref: "#/components/schemas/DeviceConfig"
        vdpa:
          type: array
          items:
-            $ref: '#/components/schemas/VdpaConfig'
+            $ref: "#/components/schemas/VdpaConfig"
        vsock:
-            $ref: '#/components/schemas/VsockConfig'
+          $ref: "#/components/schemas/VsockConfig"
        sgx_epc:
          type: array
          items:
-            $ref: '#/components/schemas/SgxEpcConfig'
+            $ref: "#/components/schemas/SgxEpcConfig"
        tdx:
-          $ref: '#/components/schemas/TdxConfig'
+          $ref: "#/components/schemas/TdxConfig"
        numa:
          type: array
          items:
-            $ref: '#/components/schemas/NumaConfig'
+            $ref: "#/components/schemas/NumaConfig"
        iommu:
          type: boolean
          default: false
@@ -567,7 +572,7 @@ components:
          type: boolean
          default: false
        platform:
-          $ref: '#/components/schemas/PlatformConfig'
+          $ref: "#/components/schemas/PlatformConfig"
      description: Virtual machine configuration

    CpuAffinity:
@@ -600,8 +605,8 @@ components:

    CpusConfig:
      required:
-      - boot_vcpus
-      - max_vcpus
+        - boot_vcpus
+        - max_vcpus
      type: object
      properties:
        boot_vcpus:
@@ -613,7 +618,7 @@ components:
          default: 1
          type: integer
        topology:
-          $ref: '#/components/schemas/CpuTopology'
+          $ref: "#/components/schemas/CpuTopology"
        kvm_hyperv:
          type: boolean
          default: false
@@ -622,9 +627,9 @@ components:
        affinity:
          type: array
          items:
-            $ref: '#/components/schemas/CpuAffinity'
+            $ref: "#/components/schemas/CpuAffinity"
        features:
-          $ref: '#/components/schemas/CpuFeatures'
+          $ref: "#/components/schemas/CpuFeatures"

    PlatformConfig:
      type: object
@@ -639,11 +644,17 @@ components:
            format: int16
        serial_number:
          type: string
+        uuid:
+          type: string
+        oem_strings:
+          type: array
+          items:
+            type: string

    MemoryZoneConfig:
      required:
-      - id
-      - size
+        - id
+        - size
      type: object
      properties:
        id:
@@ -681,7 +692,7 @@ components:

    MemoryConfig:
      required:
-      - size
+        - size
      type: object
      properties:
        size:
@@ -715,37 +726,12 @@ components:
        zones:
          type: array
          items:
-            $ref: '#/components/schemas/MemoryZoneConfig'
-
-    KernelConfig:
-      required:
-      - path
-      type: object
-      properties:
-        path:
-          type: string
-
-    InitramfsConfig:
-      nullable: true
-      required:
-      - path
-      type: object
-      properties:
-        path:
-          type: string
-
-    CmdLineConfig:
-      required:
-      - args
-      type: object
-      properties:
-        args:
-          type: string
+            $ref: "#/components/schemas/MemoryZoneConfig"

    TokenBucket:
      required:
-      - size
-      - refill_time
+        - size
+        - refill_time
      type: object
      properties:
        size:
@@ -777,16 +763,16 @@ components:
      type: object
      properties:
        bandwidth:
-          $ref: '#/components/schemas/TokenBucket'
+          $ref: "#/components/schemas/TokenBucket"
        ops:
-          $ref: '#/components/schemas/TokenBucket'
+          $ref: "#/components/schemas/TokenBucket"
      description:
        Defines an IO rate limiter with independent bytes/s and ops/s limits.
        Limits are defined by configuring each of the _bandwidth_ and _ops_ token buckets.

    DiskConfig:
      required:
-      - path
+        - path
      type: object
      properties:
        path:
@@ -811,11 +797,8 @@ components:
          default: false
        vhost_socket:
          type: string
-        poll_queue:
-          type: boolean
-          default: true
        rate_limiter_config:
-            $ref: '#/components/schemas/RateLimiterConfig'
+          $ref: "#/components/schemas/RateLimiterConfig"
        pci_segment:
          type: integer
          format: int16
@@ -858,11 +841,11 @@ components:
          type: integer
          format: int16
        rate_limiter_config:
-            $ref: '#/components/schemas/RateLimiterConfig'
+          $ref: "#/components/schemas/RateLimiterConfig"

    RngConfig:
      required:
-      - src
+        - src
      type: object
      properties:
        src:
@@ -874,7 +857,7 @@ components:

    BalloonConfig:
      required:
-      - size
+        - size
      type: object
      properties:
        size:
@@ -891,10 +874,10 @@ components:

    FsConfig:
      required:
-      - num_queues
-      - queue_size
-      - socket
-      - tag
+        - num_queues
+        - queue_size
+        - socket
+        - tag
      type: object
      properties:
        tag:
@@ -915,7 +898,7 @@ components:

    PmemConfig:
      required:
-      - file
+        - file
      type: object
      properties:
        file:
@@ -937,7 +920,7 @@ components:

    ConsoleConfig:
      required:
-      - mode
+        - mode
      type: object
      properties:
        file:
@@ -951,7 +934,7 @@ components:

    DeviceConfig:
      required:
-      - path
+        - path
      type: object
      properties:
        path:
@@ -967,8 +950,8 @@ components:

    VdpaConfig:
      required:
-      - path
-      - num_queues
+        - path
+        - num_queues
      type: object
      properties:
        path:
@@ -987,8 +970,8 @@ components:

    VsockConfig:
      required:
-      - cid
-      - socket
+        - cid
+        - socket
      type: object
      properties:
        cid:
@@ -1010,8 +993,8 @@ components:

    SgxEpcConfig:
      required:
-      - id
-      - size
+        - id
+        - size
      type: object
      properties:
        id:
@@ -1025,7 +1008,7 @@ components:

    TdxConfig:
      required:
-      - firmware
+        - firmware
      type: object
      properties:
        firmware:
@@ -1034,8 +1017,8 @@ components:

    NumaDistance:
      required:
-      - destination
-      - distance
+        - destination
+        - distance
      type: object
      properties:
        destination:
@@ -1047,7 +1030,7 @@ components:

    NumaConfig:
      required:
-      - guest_numa_id
+        - guest_numa_id
      type: object
      properties:
        guest_numa_id:
@@ -1061,7 +1044,7 @@ components:
        distances:
          type: array
          items:
-            $ref: '#/components/schemas/NumaDistance'
+            $ref: "#/components/schemas/NumaDistance"
        memory_zones:
          type: array
          items:
@@ -1127,7 +1110,7 @@ components:

    RestoreConfig:
      required:
-      - source_url
+        - source_url
      type: object
      properties:
        source_url:
@@ -1137,7 +1120,7 @@ components:

    ReceiveMigrationData:
      required:
-      - receiver_url
+        - receiver_url
      type: object
      properties:
        receiver_url:
@@ -1145,7 +1128,7 @@ components:

    SendMigrationData:
      required:
-      - destination_url
+        - destination_url
      type: object
      properties:
        destination_url:
--- a/src/runtime/virtcontainers/qemu_amd64.go
+++ b/src/runtime/virtcontainers/qemu_amd64.go
@@ -46,6 +46,8 @@ const (

 	defaultQemuMachineOptions = "accel=kvm,kernel_irqchip=on"

+	splitIrqChipMachineOptions = "accel=kvm,kernel_irqchip=split"
+
 	qmpMigrationWaitTimeout = 5 * time.Second

 	sevAttestationGrpcTimeout = 10 * time.Second
@@ -57,11 +59,6 @@ const (
 	sevAttestationSessionFileName = "session_file.b64"
 )

-var qemuPaths = map[string]string{
-	QemuQ35:     defaultQemuPath,
-	QemuMicrovm: defaultQemuPath,
-}
-
 var kernelParams = []Param{
 	{"tsc", "reliable"},
 	{"no_timer_check", ""},
@@ -117,7 +114,7 @@ func newQemuArch(config HypervisorConfig) (qemuArch, error) {
 	// IOMMU and Guest Protection require a split IRQ controller for handling interrupts
 	// otherwise QEMU won't be able to create the kernel irqchip
 	if config.IOMMU || config.ConfidentialGuest {
-		mp.Options = "accel=kvm,kernel_irqchip=split"
+		mp.Options = splitIrqChipMachineOptions
 	}

 	if config.IOMMU {
@@ -130,7 +127,7 @@ func newQemuArch(config HypervisorConfig) (qemuArch, error) {
 	q := &qemuAmd64{
 		qemuArchBase: qemuArchBase{
 			qemuMachine:          *mp,
-			qemuExePath:          qemuPaths[machineType],
+			qemuExePath:          defaultQemuPath,
 			memoryOffset:         config.MemOffset,
 			kernelParamsNonDebug: kernelParamsNonDebug,
 			kernelParamsDebug:    kernelParamsDebug,
@@ -188,19 +185,6 @@ func (q *qemuAmd64) bridges(number uint32) {
 	q.Bridges = genericBridges(number, q.qemuMachine.Type)
 }

-func (q *qemuAmd64) cpuModel() string {
-	cpuModel := defaultCPUModel
-
-	// VMX is not migratable yet.
-	// issue: https://github.com/kata-containers/runtime/issues/1750
-	if q.vmFactory {
-		hvLogger.WithField("subsystem", "qemuAmd64").Warn("VMX is not migratable yet: turning it off")
-		cpuModel += ",vmx=off"
-	}
-
-	return cpuModel
-}
-
 func (q *qemuAmd64) memoryTopology(memoryMb, hostMemoryMb uint64, slots uint8) govmmQemu.Memory {
 	return genericMemoryTopology(memoryMb, hostMemoryMb, slots, q.memoryOffset)
 }
--- a/src/runtime/virtcontainers/qemu_amd64_test.go
+++ b/src/runtime/virtcontainers/qemu_amd64_test.go
@@ -86,7 +86,7 @@ func TestQemuAmd64CPUModel(t *testing.T) {
 	base, ok := amd64.(*qemuAmd64)
 	assert.True(ok)
 	base.vmFactory = true
-	expectedOut = defaultCPUModel + ",vmx=off"
+	expectedOut = defaultCPUModel
 	model = amd64.cpuModel()
 	assert.Equal(expectedOut, model)
 }
--- a/src/runtime/virtcontainers/qemu_ppc64le.go
+++ b/src/runtime/virtcontainers/qemu_ppc64le.go
@@ -114,10 +114,6 @@ func (q *qemuPPC64le) bridges(number uint32) {
 	q.Bridges = genericBridges(number, q.qemuMachine.Type)
 }

-func (q *qemuPPC64le) cpuModel() string {
-	return defaultCPUModel
-}
-
 func (q *qemuPPC64le) memoryTopology(memoryMb, hostMemoryMb uint64, slots uint8) govmmQemu.Memory {

 	q.Logger().Debug("Aligning maxmem to multiples of 256MB. Assumption: Kernel Version >= 4.11")
--- a/src/tools/runk/Cargo.lock
+++ b/src/tools/runk/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 3

+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
 [[package]]
 name = "aho-corasick"
 version = "0.7.18"
@@ -111,13 +117,13 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
 name = "cgroups-rs"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdae996d9638ba03253ffa1c93345a585974a97abbdeab9176c77922f3efc1e8"
+checksum = "cf5525f2cf84d5113ab26bfb6474180eb63224b4b1e4be31ee87be4098f11399"
 dependencies = [
 "libc",
 "log",
- "nix",
+ "nix 0.24.2",
 "regex",
 ]

@@ -174,6 +180,15 @@ dependencies = [
 "os_str_bytes",
 ]

+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.4"
@@ -313,6 +328,16 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d"

+[[package]]
+name = "flate2"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f82b0f4c27ad9f8bfd1f3208d882da2b09c301bc1c828fd3a00d0216d2fbbff6"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -438,6 +463,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -485,6 +516,12 @@ dependencies = [
 "cfg-if 1.0.0",
 ]

+[[package]]
+name = "io-lifetimes"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24c3f4eff5495aee4c0399d7b6a0dc2b6e81be84242ffbfcf253ebacccc1d0cb"
+
 [[package]]
 name = "itertools"
 version = "0.10.3"
@@ -508,27 +545,30 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
-version = "0.2.124"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a41fed9d98f27ab1c6d161da622a4fa35e8a54a8adc24bbf3ddd0ef70b0e50"
+checksum = "505e71a4706fa491e9b1b55f51b95d4037d0821ee40131190475f692b35b009b"

 [[package]]
 name = "libcontainer"
 version = "0.0.1"
 dependencies = [
 "anyhow",
+ "cgroups-rs",
 "chrono",
 "derive_builder",
 "libc",
 "logging",
- "nix",
+ "nix 0.23.1",
 "oci",
+ "procfs",
 "rustjail",
 "scopeguard",
 "serde",
 "serde_json",
 "slog",
 "tempfile",
+ "test-utils",
 ]

 [[package]]
@@ -540,6 +580,12 @@ dependencies = [
 "clap",
 ]

+[[package]]
+name = "linux-raw-sys"
+version = "0.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4d2456c373231a208ad294c33dc5bff30051eafd954cd4caae83a712b12854d"
+
 [[package]]
 name = "lock_api"
 version = "0.4.7"
@@ -585,6 +631,15 @@ dependencies = [
 "autocfg",
 ]

+[[package]]
+name = "miniz_oxide"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f5c75688da582b8ffc1f1799e9db273f32133c49e048f614d22ec3256773ccc"
+dependencies = [
+ "adler",
+]
+
 [[package]]
 name = "mio"
 version = "0.8.2"
@@ -627,6 +682,18 @@ dependencies = [
 "memoffset",
 ]

+[[package]]
+name = "nix"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "195cdbc1741b8134346d515b3a56a1c94b0912758009cfd53f99ea0f57b065fc"
+dependencies = [
+ "bitflags",
+ "cfg-if 1.0.0",
+ "libc",
+ "memoffset",
+]
+
 [[package]]
 name = "ntapi"
 version = "0.3.7"
@@ -716,7 +783,7 @@ dependencies = [
 "libc",
 "redox_syscall",
 "smallvec",
- "windows-sys",
+ "windows-sys 0.34.0",
 ]

 [[package]]
@@ -793,6 +860,21 @@ dependencies = [
 "unicode-xid",
 ]

+[[package]]
+name = "procfs"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1391b61957e3b6f25a59ca2e057d22a44415917d87893986f6627fef109d32f"
+dependencies = [
+ "bitflags",
+ "byteorder",
+ "chrono",
+ "flate2",
+ "hex",
+ "lazy_static",
+ "rustix",
+]
+
 [[package]]
 name = "prost"
 version = "0.8.0"
@@ -947,7 +1029,7 @@ dependencies = [
 "libcontainer",
 "liboci-cli",
 "logging",
- "nix",
+ "nix 0.23.1",
 "oci",
 "rustjail",
 "serde",
@@ -960,6 +1042,20 @@ dependencies = [
 "users",
 ]

+[[package]]
+name = "rustix"
+version = "0.35.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d51cc38aa10f6bbb377ed28197aa052aa4e2b762c22be9d3153d01822587e787"
+dependencies = [
+ "bitflags",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.36.1",
+]
+
 [[package]]
 name = "rustjail"
 version = "0.1.0"
@@ -974,7 +1070,7 @@ dependencies = [
 "inotify",
 "lazy_static",
 "libc",
- "nix",
+ "nix 0.23.1",
 "oci",
 "path-absolutize",
 "protobuf",
@@ -1176,6 +1272,13 @@ dependencies = [
 "winapi-util",
 ]

+[[package]]
+name = "test-utils"
+version = "0.1.0"
+dependencies = [
+ "nix 0.24.2",
+]
+
 [[package]]
 name = "textwrap"
 version = "0.15.0"
@@ -1273,7 +1376,7 @@ dependencies = [
 "byteorder",
 "libc",
 "log",
- "nix",
+ "nix 0.23.1",
 "protobuf",
 "protobuf-codegen-pure",
 "thiserror",
@@ -1400,11 +1503,24 @@ version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5acdd78cb4ba54c0045ac14f62d8f94a03d10047904ae2a40afa1e99d8f70825"
 dependencies = [
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_msvc",
+ "windows_aarch64_msvc 0.34.0",
+ "windows_i686_gnu 0.34.0",
+ "windows_i686_msvc 0.34.0",
+ "windows_x86_64_gnu 0.34.0",
+ "windows_x86_64_msvc 0.34.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
+dependencies = [
+ "windows_aarch64_msvc 0.36.1",
+ "windows_i686_gnu 0.36.1",
+ "windows_i686_msvc 0.36.1",
+ "windows_x86_64_gnu 0.36.1",
+ "windows_x86_64_msvc 0.36.1",
 ]

 [[package]]
@@ -1413,26 +1529,56 @@ version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "17cffbe740121affb56fad0fc0e421804adf0ae00891205213b5cecd30db881d"

+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2564fde759adb79129d9b4f54be42b32c89970c18ebf93124ca8870a498688ed"

+[[package]]
+name = "windows_i686_gnu"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9cd9d32ba70453522332c14d38814bceeb747d80b3958676007acadd7e166956"

+[[package]]
+name = "windows_i686_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfce6deae227ee8d356d19effc141a509cc503dfd1f850622ec4b0f84428e1f4"

+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d19538ccc21819d01deaf88d6a17eae6596a12e9aafdbb97916fb49896d89de9"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
--- a/src/tools/runk/libcontainer/Cargo.toml
+++ b/src/tools/runk/libcontainer/Cargo.toml
@@ -19,6 +19,9 @@ chrono = { version = "0.4.19", features = ["serde"] }
 serde = { version = "1.0.133", features = ["derive"] }
 serde_json = "1.0.74"
 scopeguard = "1.1.0"
+cgroups = { package = "cgroups-rs", version = "0.2.10" }
+procfs = "0.14.0"

 [dev-dependencies]
 tempfile = "3.3.0"
+test-utils = { path = "../../../libs/test-utils" }
--- a/src/tools/runk/libcontainer/src/builder.rs
+++ b/src/tools/runk/libcontainer/src/builder.rs
@@ -3,11 +3,8 @@
 // SPDX-License-Identifier: Apache-2.0
 //

-use crate::container::{get_config_path, ContainerLauncher};
-use crate::{
-    status::{get_current_container_state, Status},
-    utils::validate_process_spec,
-};
+use crate::container::{get_config_path, Container, ContainerLauncher};
+use crate::utils::validate_process_spec;
 use anyhow::{anyhow, Result};
 use derive_builder::Builder;
 use oci::{ContainerState, Process as OCIProcess, Spec};
@@ -138,32 +135,35 @@ impl ActivatedContainer {
            logger,
            "enter ActivatedContainer::create_launcher {:?}", self
        );
-        let status = Status::load(&self.root, &self.id)?;
-        let state = get_current_container_state(&status)?;
+        let container = Container::load(&self.root, &self.id)?;

        // If state is Created or Running, we can execute the process.
-        if state != ContainerState::Created && state != ContainerState::Running {
-            return Err(anyhow!("cannot exec in a stopped or paused container"));
+        if container.state != ContainerState::Created && container.state != ContainerState::Running
+        {
+            return Err(anyhow!(
+                "cannot exec in a stopped or paused container, state: {:?}",
+                container.state
+            ));
        }

-        let mut config = status.config;
+        let mut config = container.status.config;
        let spec = config.spec.as_mut().unwrap();
-        self.adapt_exec_spec(spec, status.pid, logger)?;
+        self.adapt_exec_spec(spec, container.status.pid, logger)?;
        debug!(logger, "adapted spec: {:?}", spec);
        validate_spec(spec, &self.console_socket)?;

        debug!(logger, "create LinuxContainer with config: {:?}", config);
        // Maybe we should move some properties from status into LinuxContainer,
        // like pid, process_start_time, created, cgroup_manager, etc. But it works now.
-        let container =
+        let runner =
            create_linux_container(&self.id, &self.root, config, self.console_socket, logger)?;

        Ok(ContainerLauncher::new(
            &self.id,
-            &status.bundle,
+            &container.status.bundle,
            &self.root,
            false,
-            container,
+            runner,
            self.pid_file,
        ))
    }
@@ -264,13 +264,14 @@ pub fn validate_spec(spec: &Spec, console_socket: &Option<PathBuf>) -> Result<()
 mod tests {
    use super::*;
    use crate::container::CONFIG_FILE_NAME;
-    use crate::utils::test_utils::TEST_ROOTFS_PATH;
+    use crate::status::Status;
+    use crate::utils::test_utils::*;
    use chrono::DateTime;
    use nix::unistd::getpid;
    use oci::{self, Root, Spec};
    use oci::{Linux, LinuxNamespace, User};
-    use rustjail::cgroups::fs::Manager;
    use rustjail::container::TYPETONAME;
+    use scopeguard::defer;
    use slog::o;
    use std::fs::create_dir;
    use std::time::SystemTime;
@@ -279,6 +280,7 @@ mod tests {
        path::PathBuf,
    };
    use tempfile::tempdir;
+    use test_utils::skip_if_not_root;

    #[derive(Debug)]
    struct TestData {
@@ -323,7 +325,9 @@ mod tests {
            .to_string_lossy()
            .to_string();
        let test_data = TestData {
-            id: String::from("test"),
+            // Since tests are executed concurrently, container_id must be unique in tests with cgroup.
+            // Or the cgroup directory may be removed by other tests in advance.
+            id: String::from("test_init_container_create_launcher"),
            bundle: bundle_dir.path().to_path_buf(),
            root: root_dir.into_path(),
            console_socket: Some(PathBuf::from("test")),
@@ -356,6 +360,10 @@ mod tests {
            Some(launcher.runner.console_socket),
            test_data.console_socket
        );
+        // If it is run by root, create_launcher will create cgroup dirs successfully. So we need to do some cleanup stuff.
+        if nix::unistd::Uid::effective().is_root() {
+            clean_up_cgroup(Path::new(&test_data.id));
+        }
    }

    #[test]
@@ -454,6 +462,11 @@ mod tests {
    }

    fn create_dummy_status(id: &str, pid: i32, root: &Path, spec: &Spec) -> Status {
+        let start_time = procfs::process::Process::new(pid)
+            .unwrap()
+            .stat()
+            .unwrap()
+            .starttime;
        Status {
            oci_version: spec.version.clone(),
            id: id.to_string(),
@@ -461,9 +474,9 @@ mod tests {
            root: root.to_path_buf(),
            bundle: PathBuf::from("/tmp"),
            rootfs: TEST_ROOTFS_PATH.to_string(),
-            process_start_time: 0,
+            process_start_time: start_time,
            created: DateTime::from(SystemTime::now()),
-            cgroup_manager: Manager::new("test").unwrap(),
+            cgroup_manager: serde_json::from_str(TEST_CGM_DATA).unwrap(),
            config: CreateOpts {
                spec: Some(spec.clone()),
                ..Default::default()
@@ -498,11 +511,14 @@ mod tests {

    #[test]
    fn test_activated_container_create() {
+        // create cgroup directory needs root permission
+        skip_if_not_root!();
        let logger = slog::Logger::root(slog::Discard, o!());
        let bundle_dir = tempdir().unwrap();
        let root = tempdir().unwrap();
-        // let bundle = temp
-        let id = "test".to_string();
+        // Since tests are executed concurrently, container_id must be unique in tests with cgroup.
+        // Or the cgroup directory may be removed by other tests in advance.
+        let id = "test_activated_container_create".to_string();
        create_activated_dirs(root.path(), &id, bundle_dir.path());
        let pid = getpid().as_raw();

@@ -516,6 +532,10 @@ mod tests {
        let status = create_dummy_status(&id, pid, root.path(), &spec);
        status.save().unwrap();

+        // create empty cgroup directory to avoid is_pause failing
+        let cgroup = create_dummy_cgroup(Path::new(id.as_str()));
+        defer!(cgroup.delete().unwrap());
+
        let result = ActivatedContainerBuilder::default()
            .id(id)
            .root(root.into_path())
@@ -575,6 +595,8 @@ mod tests {

    #[test]
    fn test_activated_container_create_with_process() {
+        // create cgroup directory needs root permission
+        skip_if_not_root!();
        const PROCESS_FILE_NAME: &str = "process.json";
        let bundle_dir = tempdir().unwrap();
        let process_file = bundle_dir.path().join(PROCESS_FILE_NAME);
@@ -588,7 +610,9 @@ mod tests {

        let logger = slog::Logger::root(slog::Discard, o!());
        let root = tempdir().unwrap();
-        let id = "test".to_string();
+        // Since tests are executed concurrently, container_id must be unique in tests with cgroup.
+        // Or the cgroup directory may be removed by other tests in advance.
+        let id = "test_activated_container_create_with_process".to_string();
        let pid = getpid().as_raw();
        let mut spec = create_dummy_spec();
        spec.root.as_mut().unwrap().path = bundle_dir
@@ -600,6 +624,10 @@ mod tests {

        let status = create_dummy_status(&id, pid, root.path(), &spec);
        status.save().unwrap();
+        // create empty cgroup directory to avoid is_pause failing
+        let cgroup = create_dummy_cgroup(Path::new(id.as_str()));
+        defer!(cgroup.delete().unwrap());
+
        let launcher = ActivatedContainerBuilder::default()
            .id(id)
            .root(root.into_path())
--- a/src/tools/runk/libcontainer/src/cgroup.rs
+++ b/src/tools/runk/libcontainer/src/cgroup.rs
@@ -3,24 +3,15 @@
 // SPDX-License-Identifier: Apache-2.0
 //

-use anyhow::{anyhow, Result};
-use rustjail::cgroups::fs::Manager as CgroupManager;
-use std::{
-    path::Path,
-    {fs, thread, time},
-};
-
-pub fn destroy_cgroup(cgroup_mg: &CgroupManager) -> Result<()> {
-    for path in cgroup_mg.paths.values() {
-        remove_cgroup_dir(Path::new(path))?;
-    }
-
-    Ok(())
-}
+use anyhow::anyhow;
+use anyhow::Result;
+use cgroups;
+use cgroups::freezer::{FreezerController, FreezerState};
+use std::{thread, time};

 // Try to remove the provided cgroups path five times with increasing delay between tries.
 // If after all there are not removed cgroups, an appropriate error will be returned.
-fn remove_cgroup_dir(path: &Path) -> Result<()> {
+pub fn remove_cgroup_dir(cgroup: &cgroups::Cgroup) -> Result<()> {
    let mut retries = 5;
    let mut delay = time::Duration::from_millis(10);
    while retries != 0 {
@@ -29,12 +20,58 @@ fn remove_cgroup_dir(path: &Path) -> Result<()> {
            thread::sleep(delay);
        }

-        if !path.exists() || fs::remove_dir(path).is_ok() {
+        if cgroup.delete().is_ok() {
            return Ok(());
        }

        retries -= 1;
    }

-    return Err(anyhow!("failed to remove cgroups paths: {:?}", path));
+    return Err(anyhow!("failed to remove cgroups paths"));
+}
+
+// Make sure we get a stable freezer state, so retry if the cgroup is still undergoing freezing.
+pub fn get_freezer_state(freezer: &FreezerController) -> Result<FreezerState> {
+    let mut retries = 10;
+    while retries != 0 {
+        let state = freezer.state()?;
+        match state {
+            FreezerState::Thawed => return Ok(FreezerState::Thawed),
+            FreezerState::Frozen => return Ok(FreezerState::Frozen),
+            FreezerState::Freezing => {
+                // sleep for 10 ms, wait for the cgroup to finish freezing
+                thread::sleep(time::Duration::from_millis(10));
+                retries -= 1;
+            }
+        }
+    }
+    Ok(FreezerState::Freezing)
+}
+
+// check whether freezer state is frozen
+pub fn is_paused(cgroup: &cgroups::Cgroup) -> Result<bool> {
+    let freezer_controller: &FreezerController = cgroup
+        .controller_of()
+        .ok_or_else(|| anyhow!("failed to get freezer controller"))?;
+    let freezer_state = get_freezer_state(freezer_controller)?;
+    match freezer_state {
+        FreezerState::Frozen => Ok(true),
+        _ => Ok(false),
+    }
+}
+
+pub fn freeze(cgroup: &cgroups::Cgroup, state: FreezerState) -> Result<()> {
+    let freezer_controller: &FreezerController = cgroup
+        .controller_of()
+        .ok_or_else(|| anyhow!("failed to get freezer controller"))?;
+    match state {
+        FreezerState::Frozen => {
+            freezer_controller.freeze()?;
+        }
+        FreezerState::Thawed => {
+            freezer_controller.thaw()?;
+        }
+        _ => return Err(anyhow!("invalid freezer state")),
+    }
+    Ok(())
 }
--- a/src/tools/runk/libcontainer/src/container.rs
+++ b/src/tools/runk/libcontainer/src/container.rs
@@ -3,14 +3,20 @@
 // SPDX-License-Identifier: Apache-2.0
 //

-use crate::status::{self, get_all_pid, get_current_container_state, Status};
+use crate::cgroup::{freeze, remove_cgroup_dir};
+use crate::status::{self, get_current_container_state, Status};
 use anyhow::{anyhow, Result};
+use cgroups;
+use cgroups::freezer::FreezerState;
+use cgroups::hierarchies::is_cgroup2_unified_mode;
 use nix::sys::signal::kill;
 use nix::{
    sys::signal::Signal,
+    sys::signal::SIGKILL,
    unistd::{chdir, unlink, Pid},
 };
 use oci::ContainerState;
+use procfs;
 use rustjail::{
    container::{BaseContainer, LinuxContainer, EXEC_FIFO_FILENAME},
    process::{Process, ProcessOperations},
@@ -35,20 +41,55 @@ pub enum ContainerAction {
 pub struct Container {
    pub status: Status,
    pub state: ContainerState,
+    pub cgroup: cgroups::Cgroup,
 }

+// Container represents a container that is created by the container runtime.
 impl Container {
    pub fn load(state_root: &Path, id: &str) -> Result<Self> {
        let status = Status::load(state_root, id)?;
-        let state = get_current_container_state(&status)?;
-        Ok(Self { status, state })
+        let spec = status
+            .config
+            .spec
+            .as_ref()
+            .ok_or_else(|| anyhow!("spec config was not present"))?;
+        let linux = spec
+            .linux
+            .as_ref()
+            .ok_or_else(|| anyhow!("linux config was not present"))?;
+        let cpath = if linux.cgroups_path.is_empty() {
+            id.to_string()
+        } else {
+            linux
+                .cgroups_path
+                .clone()
+                .trim_start_matches('/')
+                .to_string()
+        };
+        let cgroup = cgroups::Cgroup::load(cgroups::hierarchies::auto(), cpath);
+        let state = get_current_container_state(&status, &cgroup)?;
+        Ok(Self {
+            status,
+            state,
+            cgroup,
+        })
    }

    pub fn processes(&self) -> Result<Vec<Pid>> {
-        get_all_pid(&self.status.cgroup_manager)
+        let pids = self.cgroup.tasks();
+        let result = pids.iter().map(|x| Pid::from_raw(x.pid as i32)).collect();
+        Ok(result)
    }

    pub fn kill(&self, signal: Signal, all: bool) -> Result<()> {
+        if self.state == ContainerState::Stopped {
+            return Err(anyhow!(
+                "container {} can't be killed because it is {:?}",
+                self.status.id,
+                self.state
+            ));
+        }
+
        if all {
            let pids = self.processes()?;
            for pid in pids {
@@ -58,18 +99,46 @@ impl Container {
                kill(pid, signal)?;
            }
        } else {
-            if self.state == ContainerState::Stopped {
-                return Err(anyhow!("container {} not running", self.status.id));
-            }
            let pid = Pid::from_raw(self.status.pid);
            if status::is_process_running(pid)? {
                kill(pid, signal)?;
            }
        }
+        // For cgroup v1, killing a process in a frozen cgroup does nothing until it's thawed.
+        // Only thaw the cgroup for SIGKILL.
+        // Ref: https://github.com/opencontainers/runc/pull/3217
+        if !is_cgroup2_unified_mode() && self.state == ContainerState::Paused && signal == SIGKILL {
+            freeze(&self.cgroup, FreezerState::Thawed)?;
+        }
        Ok(())
    }

-    // TODO: add pause and resume
+    pub fn pause(&self) -> Result<()> {
+        if self.state != ContainerState::Running && self.state != ContainerState::Created {
+            return Err(anyhow!(
+                "failed to pause container: current status is: {:?}",
+                self.state
+            ));
+        }
+        freeze(&self.cgroup, FreezerState::Frozen)?;
+        Ok(())
+    }
+
+    pub fn resume(&self) -> Result<()> {
+        if self.state != ContainerState::Paused {
+            return Err(anyhow!(
+                "failed to resume container: current status is: {:?}",
+                self.state
+            ));
+        }
+        freeze(&self.cgroup, FreezerState::Thawed)?;
+        Ok(())
+    }
+
+    pub fn destroy(&self) -> Result<()> {
+        remove_cgroup_dir(&self.cgroup)?;
+        self.status.remove_dir()
+    }
 }

 /// Used to run a process. If init is set, it will create a container and run the process in it.
@@ -190,11 +259,14 @@ impl ContainerLauncher {
    /// Generate runk specified Status
    fn get_status(&self) -> Result<Status> {
        let oci_state = self.runner.oci_state()?;
+        // read start time from /proc/<pid>/stat
+        let proc = procfs::process::Process::new(self.runner.init_process_pid)?;
+        let process_start_time = proc.stat()?.starttime;
        Status::new(
            &self.state_root,
            &self.bundle,
            oci_state,
-            self.runner.init_process_start_time,
+            process_start_time,
            self.runner.created,
            self.runner
                .cgroup_manager
--- a/src/tools/runk/libcontainer/src/status.rs
+++ b/src/tools/runk/libcontainer/src/status.rs
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 //

+use crate::cgroup::is_paused;
 use crate::container::get_fifo_path;
 use crate::utils::*;
 use anyhow::{anyhow, Result};
@@ -14,6 +15,7 @@ use nix::{
    unistd::Pid,
 };
 use oci::{ContainerState, State as OCIState};
+use procfs::process::ProcState;
 use rustjail::{cgroups::fs::Manager as CgroupManager, specconv::CreateOpts};
 use serde::{Deserialize, Serialize};
 use std::{
@@ -35,6 +37,10 @@ pub struct Status {
    pub rootfs: String,
    pub process_start_time: u64,
    pub created: DateTime<Utc>,
+    // Methods of Manager traits in rustjail are invisible, and CgroupManager.cgroup can't be serialized.
+    // So it is cumbersome to manage cgroups by this field. Instead, we use cgroups-rs::cgroup directly in Container to manager cgroups.
+    // Another solution is making some methods public outside rustjail and adding getter/setter for CgroupManager.cgroup.
+    // Temporarily keep this field for compatibility.
    pub cgroup_manager: CgroupManager,
    pub config: CreateOpts,
 }
@@ -143,53 +149,34 @@ pub fn is_process_running(pid: Pid) -> Result<bool> {
    }
 }

-pub fn get_current_container_state(status: &Status) -> Result<ContainerState> {
-    let running = is_process_running(Pid::from_raw(status.pid))?;
-    let mut has_fifo = false;
-
-    if running {
-        let fifo = get_fifo_path(status);
-        if fifo.exists() {
-            has_fifo = true
-        }
+// Returns the current state of a container. It will read cgroupfs and procfs to determine the state.
+// https://github.com/opencontainers/runc/blob/86d6898f3052acba1ebcf83aa2eae3f6cc5fb471/libcontainer/container_linux.go#L1953
+pub fn get_current_container_state(
+    status: &Status,
+    cgroup: &cgroups::Cgroup,
+) -> Result<ContainerState> {
+    if is_paused(cgroup)? {
+        return Ok(ContainerState::Paused);
    }
-
-    if running && !has_fifo {
-        // TODO: Check paused status.
-        // runk does not support pause command currently.
+    let proc = procfs::process::Process::new(status.pid);
+    // if reading /proc/<pid> occurs error, then the process is not running
+    if proc.is_err() {
+        return Ok(ContainerState::Stopped);
    }
-
-    if !running {
-        Ok(ContainerState::Stopped)
-    } else if has_fifo {
-        Ok(ContainerState::Created)
-    } else {
-        Ok(ContainerState::Running)
+    let proc_stat = proc.unwrap().stat()?;
+    // if start time is not equal, then the pid is reused, and the process is not running
+    if proc_stat.starttime != status.process_start_time {
+        return Ok(ContainerState::Stopped);
    }
-}
-
-pub fn get_all_pid(cgm: &CgroupManager) -> Result<Vec<Pid>> {
-    let cgroup_path = cgm.paths.get("devices");
-    match cgroup_path {
-        Some(v) => {
-            let path = Path::new(v);
-            if !path.exists() {
-                return Err(anyhow!("cgroup devices file does not exist"));
+    match proc_stat.state()? {
+        ProcState::Zombie | ProcState::Dead => Ok(ContainerState::Stopped),
+        _ => {
+            let fifo = get_fifo_path(status);
+            if fifo.exists() {
+                return Ok(ContainerState::Created);
            }
-
-            let procs_path = path.join("cgroup.procs");
-            let pids: Vec<Pid> = lines_from_file(&procs_path)?
-                .into_iter()
-                .map(|v| {
-                    Pid::from_raw(
-                        v.parse::<pid_t>()
-                            .expect("failed to parse string into pid_t"),
-                    )
-                })
-                .collect();
-            Ok(pids)
+            Ok(ContainerState::Running)
        }
-        None => Err(anyhow!("cgroup devices file dose not exist")),
    }
 }

@@ -197,10 +184,12 @@ pub fn get_all_pid(cgm: &CgroupManager) -> Result<Vec<Pid>> {
 mod tests {
    use super::*;
    use crate::utils::test_utils::*;
+    use ::test_utils::skip_if_not_root;
    use chrono::{DateTime, Utc};
    use nix::unistd::getpid;
    use oci::ContainerState;
    use rustjail::cgroups::fs::Manager as CgroupManager;
+    use scopeguard::defer;
    use std::path::Path;
    use std::time::SystemTime;

@@ -235,14 +224,13 @@ mod tests {

    #[test]
    fn test_get_current_container_state() {
-        let status = create_dummy_status();
-        let state = get_current_container_state(&status).unwrap();
+        skip_if_not_root!();
+        let mut status = create_dummy_status();
+        status.id = "test_get_current_container_state".to_string();
+        // crete a dummy cgroup to make sure is_pause doesn't return error
+        let cgroup = create_dummy_cgroup(Path::new(&status.id));
+        defer!(cgroup.delete().unwrap());
+        let state = get_current_container_state(&status, &cgroup).unwrap();
        assert_eq!(state, ContainerState::Running);
    }
-
-    #[test]
-    fn test_get_all_pid() {
-        let cgm: CgroupManager = serde_json::from_str(TEST_CGM_DATA).unwrap();
-        assert!(get_all_pid(&cgm).is_ok());
-    }
 }
--- a/src/tools/runk/libcontainer/src/utils.rs
+++ b/src/tools/runk/libcontainer/src/utils.rs
@@ -114,11 +114,16 @@ pub(crate) mod test_utils {
        let cgm: CgroupManager = serde_json::from_str(TEST_CGM_DATA).unwrap();
        let oci_state = create_dummy_oci_state();
        let created = SystemTime::now();
+        let start_time = procfs::process::Process::new(oci_state.pid)
+            .unwrap()
+            .stat()
+            .unwrap()
+            .starttime;
        let status = Status::new(
            Path::new(TEST_STATE_ROOT_PATH),
            Path::new(TEST_BUNDLE_PATH),
            oci_state,
-            1,
+            start_time,
            created,
            cgm,
            create_dummy_opts(),
@@ -128,6 +133,15 @@ pub(crate) mod test_utils {
        status
    }

+    pub fn create_dummy_cgroup(cpath: &Path) -> cgroups::Cgroup {
+        cgroups::Cgroup::new(cgroups::hierarchies::auto(), cpath)
+    }
+
+    pub fn clean_up_cgroup(cpath: &Path) {
+        let cgroup = cgroups::Cgroup::load(cgroups::hierarchies::auto(), cpath);
+        cgroup.delete().unwrap();
+    }
+
    #[test]
    pub fn test_validate_process_spec() {
        let valid_process = Process {
--- a/src/tools/runk/src/commands/delete.rs
+++ b/src/tools/runk/src/commands/delete.rs
@@ -4,13 +4,10 @@
 //

 use anyhow::{anyhow, Result};
-use libcontainer::{
-    cgroup,
-    status::{get_current_container_state, Status},
-};
+use libcontainer::{container::Container, status::Status};
 use liboci_cli::Delete;
 use nix::{
-    errno::Errno,
+    sys::signal::SIGKILL,
    sys::signal::{kill, Signal},
    unistd::Pid,
 };
@@ -26,13 +23,14 @@ pub async fn run(opts: Delete, root: &Path, logger: &Logger) -> Result<()> {
        return Err(anyhow!("container {} does not exist", container_id));
    }

-    let status = if let Ok(value) = Status::load(root, container_id) {
+    let container = if let Ok(value) = Container::load(root, container_id) {
        value
    } else {
        fs::remove_dir_all(status_dir)?;
        return Ok(());
    };

+    let status = &container.status;
    let spec = status
        .config
        .spec
@@ -42,7 +40,7 @@ pub async fn run(opts: Delete, root: &Path, logger: &Logger) -> Result<()> {
    let oci_state = OCIState {
        version: status.oci_version.clone(),
        id: status.id.clone(),
-        status: get_current_container_state(&status)?,
+        status: container.state,
        pid: status.pid,
        bundle: status
            .bundle
@@ -64,20 +62,16 @@ pub async fn run(opts: Delete, root: &Path, logger: &Logger) -> Result<()> {

    match oci_state.status {
        ContainerState::Stopped => {
-            destroy_container(&status)?;
+            container.destroy()?;
        }
        ContainerState::Created => {
            kill(Pid::from_raw(status.pid), Some(Signal::SIGKILL))?;
-            destroy_container(&status)?;
+            container.destroy()?;
        }
        _ => {
            if opts.force {
-                if let Err(errno) = kill(Pid::from_raw(status.pid), Some(Signal::SIGKILL)) {
-                    if errno != Errno::ESRCH {
-                        return Err(anyhow!("{}", errno));
-                    }
-                }
-                destroy_container(&status)?;
+                container.kill(SIGKILL, true)?;
+                container.destroy()?;
            } else {
                return Err(anyhow!(
                    "cannot delete container {} that is not stopped",
@@ -91,10 +85,3 @@ pub async fn run(opts: Delete, root: &Path, logger: &Logger) -> Result<()> {

    Ok(())
 }
-
-fn destroy_container(status: &Status) -> Result<()> {
-    cgroup::destroy_cgroup(&status.cgroup_manager)?;
-    status.remove_dir()?;
-
-    Ok(())
-}
--- a/src/tools/runk/src/commands/list.rs
+++ b/src/tools/runk/src/commands/list.rs
@@ -5,7 +5,7 @@

 use super::state::get_container_state_name;
 use anyhow::Result;
-use libcontainer::status::{get_current_container_state, Status};
+use libcontainer::container::Container;
 use liboci_cli::List;
 use oci::ContainerState;
 use slog::{info, Logger};
@@ -19,7 +19,7 @@ pub fn run(_: List, root: &Path, logger: &Logger) -> Result<()> {
    let mut content = String::new();
    for entry in fs::read_dir(root)? {
        let entry = entry?;
-        // Possibly race with runk delete, so continue loop when any error occurs below
+        // Possibly race with other command of runk, so continue loop when any error occurs below
        let metadata = match entry.metadata() {
            Ok(metadata) => metadata,
            Err(_) => continue,
@@ -31,18 +31,15 @@ pub fn run(_: List, root: &Path, logger: &Logger) -> Result<()> {
            Ok(id) => id,
            Err(_) => continue,
        };
-        let status = match Status::load(root, &container_id) {
-            Ok(status) => status,
-            Err(_) => continue,
-        };
-        let state = match get_current_container_state(&status) {
-            Ok(state) => state,
+        let container = match Container::load(root, &container_id) {
+            Ok(container) => container,
            Err(_) => continue,
        };
+        let state = container.state;
        // Just like runc, pid of stopped container is 0
        let pid = match state {
            ContainerState::Stopped => 0,
-            _ => status.pid,
+            _ => container.status.pid,
        };
        // May replace get_user_by_uid with getpwuid(3)
        let owner = match get_user_by_uid(metadata.uid()) {
@@ -55,8 +52,8 @@ pub fn run(_: List, root: &Path, logger: &Logger) -> Result<()> {
            container_id,
            pid,
            get_container_state_name(state),
-            status.bundle.display(),
-            status.created,
+            container.status.bundle.display(),
+            container.status.created,
            owner
        );
    }
--- a/src/tools/runk/src/commands/mod.rs
+++ b/src/tools/runk/src/commands/mod.rs
@@ -8,7 +8,9 @@ pub mod delete;
 pub mod exec;
 pub mod kill;
 pub mod list;
+pub mod pause;
 pub mod ps;
+pub mod resume;
 pub mod run;
 pub mod spec;
 pub mod start;
--- a/src/tools/runk/src/commands/pause.rs
+++ b/src/tools/runk/src/commands/pause.rs
@@ -0,0 +1,18 @@
+// Copyright 2021-2022 Kata Contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+use anyhow::Result;
+use libcontainer::container::Container;
+use liboci_cli::Pause;
+use slog::{info, Logger};
+use std::path::Path;
+
+pub fn run(opts: Pause, root: &Path, logger: &Logger) -> Result<()> {
+    let container = Container::load(root, &opts.container_id)?;
+    container.pause()?;
+
+    info!(&logger, "pause command finished successfully");
+    Ok(())
+}
--- a/src/tools/runk/src/commands/resume.rs
+++ b/src/tools/runk/src/commands/resume.rs
@@ -0,0 +1,18 @@
+// Copyright 2021-2022 Kata Contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+use anyhow::Result;
+use libcontainer::container::Container;
+use liboci_cli::Resume;
+use slog::{info, Logger};
+use std::path::Path;
+
+pub fn run(opts: Resume, root: &Path, logger: &Logger) -> Result<()> {
+    let container = Container::load(root, &opts.container_id)?;
+    container.resume()?;
+
+    info!(&logger, "pause command finished successfully");
+    Ok(())
+}
--- a/src/tools/runk/src/commands/start.rs
+++ b/src/tools/runk/src/commands/start.rs
@@ -5,39 +5,29 @@

 use crate::commands::state::get_container_state_name;
 use anyhow::{anyhow, Result};
-use libcontainer::{
-    container::get_fifo_path,
-    status::{get_current_container_state, Status},
-};
+use libcontainer::container::{get_fifo_path, Container};
 use liboci_cli::Start;
 use nix::unistd::unlink;
 use oci::ContainerState;
 use slog::{info, Logger};
-use std::{fs::OpenOptions, io::prelude::*, path::Path, time::SystemTime};
+use std::{fs::OpenOptions, io::prelude::*, path::Path};

 pub fn run(opts: Start, state_root: &Path, logger: &Logger) -> Result<()> {
-    let mut status = Status::load(state_root, &opts.container_id)?;
-    let state = get_current_container_state(&status)?;
-    if state != ContainerState::Created {
+    let container = Container::load(state_root, &opts.container_id)?;
+    if container.state != ContainerState::Created {
        return Err(anyhow!(
            "cannot start a container in the {} state",
-            get_container_state_name(state)
+            get_container_state_name(container.state)
        ));
    };

-    let fifo_path = get_fifo_path(&status);
+    let fifo_path = get_fifo_path(&container.status);
    let mut file = OpenOptions::new().write(true).open(&fifo_path)?;

    file.write_all("0".as_bytes())?;

    info!(&logger, "container started");

-    status.process_start_time = SystemTime::now()
-        .duration_since(SystemTime::UNIX_EPOCH)?
-        .as_secs();
-
-    status.save()?;
-
    if fifo_path.exists() {
        unlink(&fifo_path)?;
    }
--- a/src/tools/runk/src/commands/state.rs
+++ b/src/tools/runk/src/commands/state.rs
@@ -5,7 +5,7 @@

 use anyhow::Result;
 use chrono::{DateTime, Utc};
-use libcontainer::status::{get_current_container_state, Status};
+use libcontainer::{container::Container, status::Status};
 use liboci_cli::State;
 use oci::ContainerState;
 use serde::{Deserialize, Serialize};
@@ -37,9 +37,8 @@ impl RuntimeState {
 }

 pub fn run(opts: State, state_root: &Path, logger: &Logger) -> Result<()> {
-    let status = Status::load(state_root, &opts.container_id)?;
-    let state = get_current_container_state(&status)?;
-    let oci_state = RuntimeState::new(status, state);
+    let container = Container::load(state_root, &opts.container_id)?;
+    let oci_state = RuntimeState::new(container.status, container.state);
    let json_state = &serde_json::to_string_pretty(&oci_state)?;

    println!("{}", json_state);
--- a/src/tools/runk/src/main.rs
+++ b/src/tools/runk/src/main.rs
@@ -81,6 +81,8 @@ async fn cmd_run(subcmd: SubCommand, root_path: &Path, logger: &Logger) -> Resul
            CommonCmd::List(list) => commands::list::run(list, root_path, logger),
            CommonCmd::Exec(exec) => commands::exec::run(exec, root_path, logger).await,
            CommonCmd::Ps(ps) => commands::ps::run(ps, root_path, logger),
+            CommonCmd::Pause(pause) => commands::pause::run(pause, root_path, logger),
+            CommonCmd::Resume(resume) => commands::resume::run(resume, root_path, logger),
            _ => {
                return Err(anyhow!("command is not implemented yet"));
            }
--- a/tools/packaging/kernel/build-kernel.sh
+++ b/tools/packaging/kernel/build-kernel.sh
@@ -127,7 +127,10 @@ get_tee_kernel() {
 	mkdir -p ${kernel_path}

 	[ -z "${kernel_url}" ] && kernel_url=$(get_from_kata_deps "assets.kernel.${tee}.url")
-	kernel_tarball="${version}.tar.gz"
+
+	kernel_tarball="linux-${version}.tar.gz"
+	tarball_name=$(get_from_kata_deps "assets.kernel.${tee}.tarball")
+	[ -z "$tarball_name" ] || kernel_tarball="$tarball_name"

 	if [ ! -f "${kernel_tarball}" ]; then
 	   curl --fail -OL "${kernel_url}/${kernel_tarball}"
@@ -460,7 +463,7 @@ install_kata() {
 	if [ "${arch_target}" = "arm64" ]; then
 		install --mode 0644 -D "arch/${arch_target}/boot/Image" "${install_path}/${vmlinux}"
 	elif [ "${arch_target}" = "s390" ]; then
-		install --mode 0644 -D "arch/${arch_target}/boot/compressed/vmlinux" "${install_path}/${vmlinux}"
+		install --mode 0644 -D "arch/${arch_target}/boot/vmlinux" "${install_path}/${vmlinux}"
 	else
 		install --mode 0644 -D "vmlinux" "${install_path}/${vmlinux}"
 	fi
@@ -557,7 +560,8 @@ main() {
 			esac
 		elif [[ "${conf_guest}" != "" ]]; then
 			#If specifying a tag for kernel_version, must be formatted version-like to avoid unintended parsing issues
-			kernel_version=$(get_from_kata_deps "assets.kernel.${conf_guest}.tag")
+			kernel_version=$(get_from_kata_deps "assets.kernel.${conf_guest}.version" 2>/dev/null || true)
+			[ -n "${kernel_version}" ] || kernel_version=$(get_from_kata_deps "assets.kernel.${conf_guest}.tag")
 		else
 			kernel_version=$(get_from_kata_deps "assets.kernel.version")
 		fi
--- a/tools/packaging/kernel/configs/fragments/common/dax.conf
+++ b/tools/packaging/kernel/configs/fragments/common/dax.conf
@@ -12,7 +12,6 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 # Without these the pmem_should_map_pages() call in the kernel fails with new
 # Related to the ARCH_HAS_HMM set in the arch files.
 CONFIG_ZONE_DEVICE=y
-CONFIG_DEV_PAGEMAP_OPS=y

 CONFIG_ND_PFN=y
 CONFIG_NVDIMM_PFN=y
@@ -23,7 +22,6 @@ CONFIG_BLK_DEV=y
 CONFIG_BLK_DEV_PMEM=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_LIBNVDIMM=y
-CONFIG_ND_BLK=y
 CONFIG_BTT=y
 # FIXME: Should check if this is really needed
 # https://github.com/kata-containers/packaging/issues/483
--- a/tools/packaging/kernel/configs/fragments/s390/network.conf
+++ b/tools/packaging/kernel/configs/fragments/s390/network.conf
@@ -1,2 +0,0 @@
-# Options needed by HAVE_EBPF_JIT
-CONFIG_PACK_STACK=y
--- a/tools/packaging/kernel/configs/fragments/x86_64/base.conf
+++ b/tools/packaging/kernel/configs/fragments/x86_64/base.conf
@@ -15,6 +15,7 @@ CONFIG_NR_CPUS=240

 # For security
 CONFIG_LEGACY_VSYSCALL_NONE=y
+CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_RETPOLINE=y

 # Boot directly into the uncompressed kernel
--- a/tools/packaging/kernel/configs/fragments/x86_64/sev/sev.conf
+++ b/tools/packaging/kernel/configs/fragments/x86_64/sev/sev.conf
@@ -1,12 +1,9 @@
 # AMD Secure Encrypted Virtualization (SEV)
 
 CONFIG_AMD_MEM_ENCRYPT=y
-CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y
-CONFIG_CRYPTO_DEV_SP_PSP=y
-CONFIG_CRYPTO_DEV_CCP=y
-CONFIG_SECURITYFS=y
-CONFIG_VIRT_DRIVERS=y
 CONFIG_EFI=y
 CONFIG_EFI_SECRET=m
+CONFIG_EFI_STUB=y
 CONFIG_MODULE_SIG=y
-CONFIG_MODULES=y
+CONFIG_MODULES=y
+CONFIG_VIRT_DRIVERS=y
--- a/tools/packaging/kernel/kata_config_version
+++ b/tools/packaging/kernel/kata_config_version
@@ -1 +1 @@
-94
+95
--- a/tools/packaging/kernel/patches/5.19.x/no_patches.txt
+++ b/tools/packaging/kernel/patches/5.19.x/no_patches.txt
--- a/versions.yaml
+++ b/versions.yaml
@@ -75,7 +75,7 @@ assets:
      url: "https://github.com/cloud-hypervisor/cloud-hypervisor"
      uscan-url: >-
        https://github.com/cloud-hypervisor/cloud-hypervisor/tags.*/v?(\d\S+)\.tar\.gz
-      version: "v25.0"
+      version: "v26.0"

    firecracker:
      description: "Firecracker micro-VMM"
@@ -151,16 +151,16 @@ assets:
  kernel:
    description: "Linux kernel optimised for virtual machines"
    url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/"
-    version: "v5.15.48"
+    version: "v5.19.2"
    tdx:
      description: "Linux kernel that supports TDX"
      url: "https://github.com/intel/linux-kernel-dcp/archive/refs/tags"
      tag: "SPR-BKC-PC-v9.6"
+      tarball: "SPR-BKC-PC-v9.6.tar.gz"
    sev:
-      description: "Linux kernel with efi_secret support"
-      url: "https://github.com/confidential-containers-demo/\
-      linux/archive/refs/tags/"
-      tag: "efi-secret-v5.17-rc6"
+      description: "Linux kernel that supports SEV"
+      url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/"
+      version: "v5.19.2"

  kernel-experimental:
    description: "Linux kernel with virtio-fs support"