diff --git a/build_library/qemu_template.sh b/build_library/qemu_template.sh
index e98410e2e9..67f414067c 100755
--- a/build_library/qemu_template.sh
+++ b/build_library/qemu_template.sh
@@ -4,15 +4,17 @@ SCRIPT_DIR="`dirname "$0"`"
 VM_NAME=
 VM_UUID=
 VM_IMAGE=
+VM_KERNEL=
+VM_INITRD=
 VM_MEMORY=
 VM_NCPUS="`grep -c ^processor /proc/cpuinfo`"
-IMAGE_PATH="${SCRIPT_DIR}/${VM_IMAGE}"
 SSH_PORT=2222
 SSH_KEYS=""
 USAGE="Usage: $0 [-a authorized_keys] [--] [qemu options...]
 Options:
     -a FILE     SSH public keys for login access. [~/.ssh/id_{dsa,rsa}.pub]
     -p PORT     The port on localhost to map to the VM's sshd. [2222]
+    -s          Safe settings: single simple cpu, ide disks.
     -h          this ;-)
 
 This script is a wrapper around qemu for starting CoreOS virtual machines.
@@ -26,12 +28,14 @@ Any arguments after -a and -p will be passed through to qemu, -- may be
 used as an explicit separator. See the qemu(1) man page for more details.
 "
 
+safe_args=0
 script_args=1
-while getopts ":a:p:vh" OPTION
+while getopts ":a:p:svh" OPTION
 do
     case $OPTION in
         a) SSH_KEYS="$OPTARG" ;;
         p) SSH_PORT="$OPTARG" ;;
+        s) safe_args=1 ;;
         v) set -x ;;
         h) echo "$USAGE"; exit ;;
         ?) break ;;
@@ -73,18 +77,35 @@ else
     done
 fi
 
+# Start assembling our default command line arguments
+if [ "${safe_args}" -eq 1 ]; then
+    disk_type="ide"
+else
+    disk_type="virtio"
+    # Emulate the host CPU closely in both features and cores.
+    set -- -cpu host -smp "${VM_NCPUS}" "$@"
+fi
+
+if [ -n "${VM_IMAGE}" ]; then
+    set -- -drive if=${disk_type},file="${SCRIPT_DIR}/${VM_IMAGE}" "$@"
+fi
+
+if [ -n "${VM_KERNEL}" ]; then
+    set -- -kernel "${SCRIPT_DIR}/${VM_KERNEL}" "$@"
+fi
+
+if [ -n "${VM_INITRD}" ]; then
+    set -- -initrd "${SCRIPT_DIR}/${VM_INITRD}" "$@"
+fi
+
 
 # Default to KVM, fall back on full emulation
-# Emulate the host CPU closely in both features and cores.
 # ${METADATA} will be mounted in CoreOS as /media/metadata
 qemu-system-x86_64 \
     -name "$VM_NAME" \
     -uuid "$VM_UUID" \
     -m ${VM_MEMORY} \
-    -cpu host \
-    -smp "${VM_NCPUS}" \
     -machine accel=kvm:tcg \
-    -drive index=0,if=virtio,media=disk,format=qcow2,file="${IMAGE_PATH}" \
     -net nic,vlan=0,model=virtio \
     -net user,vlan=0,hostfwd=tcp::"${SSH_PORT}"-:22 \
     -fsdev local,id=metadata,security_model=none,readonly,path="${METADATA}" \
@@ -96,4 +117,4 @@ RET=$?
 # Cleanup!
 rm -rf "${METADATA}"
 trap - EXIT
-exit $?
+exit ${RET}
diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh
index 163fa424b9..41316bc3dd 100644
--- a/build_library/vm_image_util.sh
+++ b/build_library/vm_image_util.sh
@@ -111,7 +111,6 @@ IMG_openstack_OEM_PACKAGE=oem-ami
 IMG_pxe_DISK_FORMAT=cpio
 IMG_pxe_PARTITIONED_IMG=0
 IMG_pxe_CONF_FORMAT=pxe
-IMG_pxe_OEM_PACKAGE=oem-pxe
 
 ## gce, image tarball
 IMG_gce_CONF_FORMAT=gce
@@ -279,22 +278,54 @@ _write_cpio_disk() {
     local cpio_target="${VM_TMP_DIR}/rootcpio"
     local dst_dir=$(_dst_dir)
     local vmlinuz_name="$(_dst_name ".vmlinuz")"
+    local base_dir="${VM_TMP_ROOT}/usr"
+    local squashfs="usr.squashfs"
 
-    # The STATE partition and all of its bind mounts shouldn't be
-    # packed into the squashfs image. Just ROOT and OEM.
-    if mountpoint -q "${VM_TMP_ROOT}/media/state"; then
+    sudo mkdir -p "${cpio_target}/etc"
+
+    # If not a /usr image pack up root instead
+    if ! mountpoint -q "${base_dir}"; then
+        base_dir="${VM_TMP_ROOT}"
+        squashfs="newroot.squashfs"
+
+        # The STATE partition and all of its bind mounts shouldn't be
+        # packed into the squashfs image. Just ROOT.
         sudo umount --all-targets "${VM_TMP_ROOT}/media/state"
+
+        # Set squashfs as the default root filesystem
+        sudo_clobber "${cpio_target}/etc/fstab" <<EOF
+${squashfs} /sysroot squashfs x-initrd.mount 0 0
+tmpfs /sysroot/usr/share/oem tmpfs size=0,mode=755,x-initrd.mount 0 0
+EOF
+    else
+        # Set tmpfs as default root, squashfs as default /usr
+        sudo_clobber "${cpio_target}/etc/fstab" <<EOF
+tmpfs /sysroot tmpfs mode=755,x-initrd.mount 0 0
+${squashfs} /sysroot/usr squashfs x-initrd.mount 0 0
+tmpfs /sysroot/usr/share/oem tmpfs size=0,mode=755,x-initrd.mount 0 0
+EOF
+
+        # Use OEM cloud-config to setup the core user's password
+        if [[ -s /etc/shared_user_passwd.txt ]]; then
+            sudo mkdir -p "${cpio_target}/usr/share/oem"
+            sudo_clobber "${cpio_target}/usr/share/oem/cloud-config.yml" <<EOF
+#cloud-config
+
+users:
+  - name: core
+    passwd: $(</etc/shared_user_passwd.txt)
+EOF
+        fi
     fi
 
     # Build the squashfs, embed squashfs into a gzipped cpio
-    mkdir -p "${cpio_target}"
     pushd "${cpio_target}" >/dev/null
-    sudo mksquashfs "${VM_TMP_ROOT}" ./newroot.squashfs
-    echo ./newroot.squashfs | cpio -o -H newc | gzip > "$2"
+    sudo mksquashfs "${base_dir}" "./${squashfs}"
+    find . | cpio -o -H newc | gzip > "$2"
     popd >/dev/null
 
-    # Pull the kernel out of the root filesystem
-    cp "${VM_TMP_ROOT}"/boot/vmlinuz "${dst_dir}/${vmlinuz_name}"
+    # Pull the kernel out of the filesystem
+    cp "${base_dir}"/boot/vmlinuz "${dst_dir}/${vmlinuz_name}"
     VM_GENERATED_FILES+=( "${dst_dir}/${vmlinuz_name}" )
 }
 
@@ -307,16 +338,12 @@ write_vm_conf() {
     fi
 }
 
-_write_qemu_conf() {
-    local vm_mem="${1:-$(_get_vm_opt MEM)}"
-    local src_name=$(basename "$VM_SRC_IMG")
-    local dst_name=$(basename "$VM_DST_IMG")
-    local dst_dir=$(dirname "$VM_DST_IMG")
-    local script="${dst_dir}/$(_src_to_dst_name "${src_name}" ".sh")"
+_write_qemu_common() {
+    local script="$1"
+    local vm_mem="$(_get_vm_opt MEM)"
 
     sed -e "s%^VM_NAME=.*%VM_NAME='${VM_NAME}'%" \
         -e "s%^VM_UUID=.*%VM_UUID='${VM_UUID}'%" \
-        -e "s%^VM_IMAGE=.*%VM_IMAGE='${dst_name}'%" \
         -e "s%^VM_MEMORY=.*%VM_MEMORY='${vm_mem}'%" \
         "${BUILD_LIBRARY_DIR}/qemu_template.sh" > "${script}"
     checkbashisms --posix "${script}" || die
@@ -341,19 +368,31 @@ EOF
     VM_GENERATED_FILES+=( "${script}" "${VM_README}" )
 }
 
-_write_pxe_conf() {
+_write_qemu_conf() {
+    local script="$(_dst_dir)/$(_dst_name ".sh")"
     local dst_name=$(basename "$VM_DST_IMG")
+
+    _write_qemu_common "${script}"
+    sed -e "s%^VM_IMAGE=.*%VM_IMAGE='${dst_name}'%" -i "${script}"
+}
+
+_write_pxe_conf() {
+    local script="$(_dst_dir)/$(_dst_name ".sh")"
     local vmlinuz_name="$(_dst_name ".vmlinuz")"
+    local dst_name=$(basename "$VM_DST_IMG")
 
-    cat >"${VM_README}" <<EOF
-If you have qemu installed (or in the SDK), you can start the image with:
-  cd path/to/image
+    _write_qemu_common "${script}"
+    sed -e "s%^VM_KERNEL=.*%VM_KERNEL='${vmlinuz_name}'%" \
+        -e "s%^VM_INITRD=.*%VM_INITRD='${dst_name}'%" -i "${script}"
 
-  qemu-kvm -m 1024 -kernel ${vmlinuz_name} -initrd ${dst_name} -append 'state=tmpfs: root=squashfs: sshkey="PUT AN SSH KEY HERE"'
+    cat >>"${VM_README}" <<EOF
 
+You can pass extra kernel parameters with -append, for example:
+  ./$(basename "${script}") -curses -append 'sshkey="PUT AN SSH KEY HERE"'
+
+When using -nographic or -serial you must also enable the serial console:
+  ./$(basename "${script}") -nographic -append 'console=ttyS0,115200n8'
 EOF
-
-    VM_GENERATED_FILES+=( "${VM_README}" )
 }
 
 # Generate the vmware config file
diff --git a/oem/ami/upload_ami_txt.sh b/oem/ami/upload_ami_txt.sh
index 0d5b2d55f9..f2be924822 100755
--- a/oem/ami/upload_ami_txt.sh
+++ b/oem/ami/upload_ami_txt.sh
@@ -60,6 +60,16 @@ if [[ ! -n "$VER" ]]; then
     exit 1
 fi
 
+if [[ -z "$GROUP" ]]; then
+    if [[ "$BOARD" == "amd64-generic" ]]; then
+        GROUP="dev-channel"
+    elif [[ "$BOARD" == "amd64-usr" ]]; then
+        GROUP="alpha"
+    else
+        GROUP="$BOARD"
+    fi
+fi
+
 declare -A AMIS
 for r in "${!AKI[@]}"; do
     AMI=$(ec2-describe-images --region=${r} -F name="CoreOS-$GROUP-$VER" \