Secure and fast microVMs for serverless computing.
This report summarizes scanner evidence for firecracker-microvm/firecracker, a Rust project with 37,282 GitHub stars. SynthScan examined 220,594 lines of code across 681 source files, recording 767 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 694 finding(s).
Are imports declared and package/API names verified? 38 finding(s).
Are wrappers, guards, and repeated structures necessary? 258 finding(s).
Which changes need focused human review? 767 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 767 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | rust-toolchain.toml | 1 | # Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tools/ab_test.py | 361 | # direction). In particular, if one scenario yields a slight improvement and the next yields a | COMMENT |
| LOW | resources/rebuild.sh | 101 | COMMENT | |
| LOW | resources/rootfs/overlay/usr/local/bin/readmem.c | 1 | // Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | resources/rootfs/overlay/usr/local/bin/init.c | 1 | // Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | resources/rootfs/overlay/usr/local/bin/fillmem.c | 1 | // Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | …/rootfs/overlay/usr/local/bin/fast_page_fault_helper.c | 1 | // Copyright 2024 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/conftest.py | 601 | # uvm_restored — uvm_booted, snapshotted, restored from the snapshot | COMMENT |
| LOW | tests/conftest.py | 621 | # | COMMENT |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 101 | # | COMMENT |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 181 | assert res.returncode == 1, res.stdout | COMMENT |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 341 | uvm_a = request.getfixturevalue("uvm_any_a") | COMMENT |
| LOW | tests/integration_tests/security/__init__.py | 1 | # Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/integration_tests/style/__init__.py | 1 | # Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/integration_tests/style/test_licenses.py | 141 | COMMENT | |
| LOW | tests/integration_tests/performance/__init__.py | 1 | # Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/integration_tests/performance/test_huge_pages.py | 21 | COMMENT | |
| LOW | tests/integration_tests/performance/test_huge_pages.py | 41 | # Referenced: 0 kB | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_template_helper.py | 101 | return cpu_config_dict | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_template_helper.py | 121 | # is 0 on all tested platforms. On the other hand, the userspace cpuid | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_template_helper.py | 141 | # CPUID.20000000h is not documented in Intel SDM and AMD APM. KVM doesn't | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_template_helper.py | 181 | # List of MSR indices that should not be tested due to its mutability or inavailablility | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_template_helper.py | 201 | # SYSENTER. | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_template_helper.py | 221 | 0x6E0, | COMMENT |
| LOW | …/integration_tests/functional/test_net_config_space.py | 161 | # on the interface. | COMMENT |
| LOW | tests/integration_tests/functional/__init__.py | 1 | # Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/integration_tests/functional/test_vsock.py | 161 | COMMENT | |
| LOW | …on_tests/functional/test_cpu_features_host_vs_guest.py | 161 | } | COMMENT |
| LOW | …on_tests/functional/test_cpu_features_host_vs_guest.py | 381 | COMMENT | |
| LOW | …on_tests/functional/test_cpu_features_host_vs_guest.py | 441 | COMMENT | |
| LOW | …on_tests/functional/test_cpu_features_host_vs_guest.py | 461 | # ENQCMD/ENQCMDS are instructions that allow software to atomically write 64-byte | COMMENT |
| LOW | …on_tests/functional/test_cpu_features_host_vs_guest.py | 481 | # (#AC) exception if an operand of an atomic operation crosses two cache lines. It | COMMENT |
| LOW | tests/integration_tests/functional/test_balloon.py | 401 | COMMENT | |
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 221 | # * TSC is different for each guest. | COMMENT |
| LOW | tests/framework/http_api.py | 21 | def __init__(self): | COMMENT |
| LOW | tests/host_tools/sysgenid.c | 1 | // Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/host_tools/vmclock.c | 1 | // Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/host_tools/vsock_helper.c | 1 | // Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/host_tools/test_syscalls.c | 1 | // Copyright 2024 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | tests/host_tools/devmem.c | 1 | // Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved. | COMMENT |
| LOW | src/jailer/src/env.rs | 41 | const DEV_NET_TUN_MINOR: u32 = 200; | COMMENT |
| LOW | src/jailer/src/env.rs | 81 | // pid namespace, we will call clone with a NULL stack pointer. We can do this because we will | COMMENT |
| LOW | src/jailer/src/env.rs | 681 | // for all of them. | COMMENT |
| LOW | src/jailer/src/cgroup.rs | 41 | // search PROC_MOUNTS for cgroup mount points | COMMENT |
| LOW | src/jailer/src/cgroup.rs | 241 | } | COMMENT |
| LOW | src/jailer/src/cgroup.rs | 261 | // on the following helper function) helps with propagating the values. | COMMENT |
| LOW | src/jailer/src/resource_limits.rs | 21 | RlimitFsize, | COMMENT |
| LOW | src/jailer/src/resource_limits.rs | 41 | // c_uint (which is an u32) | COMMENT |
| LOW | src/clippy-tracing/src/main.rs | 21 | #[derive(Parser)] | COMMENT |
| LOW | src/acpi-tables/src/aml.rs | 201 | } | COMMENT |
| LOW | src/acpi-tables/src/aml.rs | 1241 | COMMENT | |
| LOW | src/acpi-tables/src/aml.rs | 1301 | .unwrap() | COMMENT |
| LOW | src/acpi-tables/src/aml.rs | 1321 | // 0x0CF8, // Length | COMMENT |
| LOW | src/acpi-tables/src/aml.rs | 1341 | // 0x00000000, // Translation Offset | COMMENT |
| LOW | src/acpi-tables/src/aml.rs | 1621 | [0x14, 0x09, 0x5F, 0x53, 0x54, 0x41, 0x00, 0xA4, 0x0A, 0x0F] | COMMENT |
| LOW | src/acpi-tables/src/aml.rs | 1861 | COMMENT | |
| LOW | src/acpi-tables/src/aml.rs | 1981 | // { | COMMENT |
| LOW | src/acpi-tables/src/fadt.rs | 21 | COMMENT | |
| LOW | src/acpi-tables/src/rsdp.rs | 1 | // Copyright © 2019 Intel Corporation | COMMENT |
| LOW | src/utils/src/time.rs | 181 | /// Converts a timestamp in seconds to an equivalent one in nanoseconds. | COMMENT |
| 336 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/conftest.py | 121 | def pytest_collection_modifyitems(items): | CODE |
| LOW | tests/conftest.py | 130 | def pytest_runtest_makereport(item, call): # pylint:disable=unused-argument | CODE |
| LOW | tests/conftest.py | 271 | def test_fc_session_root_path(): | CODE |
| LOW | tests/README.md | 503 | def test_with_any_microvm_and_my_init(test_microvm_any): | CODE |
| LOW | tests/integration_tests/security/test_fips.py | 61 | def test_fips_rng_reseed_on_snapshot_restore(uvm_booted, microvm_factory): | CODE |
| LOW | tests/integration_tests/security/test_fips.py | 76 | def test_fips_reseeded_kernel_csprng(fips_snapshot_pair): | CODE |
| LOW | tests/integration_tests/security/test_seccomp.py | 180 | def test_default_seccomp_level(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 114 | def test_exec_destination_path_is_symlink(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 134 | def test_exec_destination_path_is_hardlink(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 154 | def test_default_chroot_hierarchy(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 209 | def test_arbitrary_usocket_location(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 227 | def test_jailer_bind_mount_propagation(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 302 | def enable_controller_in_subtree(self, cgname, controller): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 429 | def test_cgroups_custom_parent(uvm, cgroups_info): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 484 | def test_cgroups_without_numa(uvm, cgroups_info): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 521 | def test_cgroups_parent_cgroup_but_no_cgroup( | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 584 | def test_args_default_resource_limits(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 608 | def test_args_resource_limits(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 624 | def test_positive_file_size_limit(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 642 | def test_negative_file_size_limit(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 678 | def test_negative_no_file_limit(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 697 | def test_new_pid_ns_resource_limits(uvm): | CODE |
| LOW | tests/integration_tests/security/test_jail.py | 753 | def test_firecracker_kill_by_pid(uvm, daemonize, new_pid_ns): | CODE |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 141 | def download_spectre_meltdown_checker(tmp_path_factory): | CODE |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 166 | def test_spectre_meltdown_checker_on_host(spectre_meltdown_checker): | CODE |
| LOW⚡ | …sts/integration_tests/security/test_vulnerabilities.py | 177 | def test_vulnerabilities_on_host(): | CODE |
| LOW⚡ | …sts/integration_tests/security/test_vulnerabilities.py | 184 | def get_vuln_files_exception_dict(template, guest_kernel_version): | CODE |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 240 | def check_vulnerabilities_files_on_guest(microvm): | CODE |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 318 | def test_check_vulnerability_files_ab(request, uvm_any): | CODE |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 332 | def test_spectre_meltdown_checker_on_guest( | CODE |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 364 | def test_spec_store_bypass_mitigated(uvm_booted): | CODE |
| LOW | tests/integration_tests/security/test_nv.py | 23 | def test_no_nested_virtualization(uvm_booted): | CODE |
| LOW | tests/integration_tests/style/test_repo.py | 15 | def test_repo_no_spaces_in_paths(): | CODE |
| LOW | tests/integration_tests/style/test_repo.py | 39 | def test_repo_validate_changelog(): | CODE |
| LOW | tests/integration_tests/style/test_markdown.py | 25 | def test_markdown_internal_links(): | CODE |
| LOW | tests/integration_tests/performance/test_boottime.py | 71 | def get_systemd_analyze_times(microvm): | CODE |
| LOW | tests/integration_tests/performance/test_boottime.py | 102 | def launch_vm_with_boot_timer( | CODE |
| LOW | …s/integration_tests/performance/test_hotplug_memory.py | 282 | def test_virtio_mem_hotplug_hotunplug(uvm_any_memhp): | CODE |
| LOW | …s/integration_tests/performance/test_hotplug_memory.py | 301 | def test_unplug_keeps_region_protected(uvm_any_memhp): | CODE |
| LOW | …s/integration_tests/performance/test_hotplug_memory.py | 361 | def test_snapshot_restore_persistence(uvm, microvm_factory, snapshot_type): | CODE |
| LOW | …s/integration_tests/performance/test_hotplug_memory.py | 401 | def test_snapshot_restore_incremental(uvm, microvm_factory, snapshot_type): | CODE |
| LOW | …s/integration_tests/performance/test_hotplug_memory.py | 522 | def test_memory_hotplug_latency( | CODE |
| LOW | tests/integration_tests/performance/test_block.py | 174 | def test_block_vhost_user_performance( | CODE |
| LOW | tests/integration_tests/performance/test_vsock.py | 99 | def consume_vsock_ping_output(ping_output): | CODE |
| LOW | tests/integration_tests/performance/test_initrd.py | 28 | def test_microvm_initrd_with_serial(uvm_with_initrd, huge_pages): | CODE |
| LOW | tests/integration_tests/performance/test_network.py | 97 | def test_network_tcp_throughput( | CODE |
| LOW | …tegration_tests/performance/test_vhost_user_metrics.py | 16 | def test_vhost_user_block_metrics(uvm, vcpu_count, metrics): | CODE |
| LOW | tests/integration_tests/performance/test_steal_time.py | 21 | def test_pvtime_steal_time_increases(uvm): | CODE |
| LOW | …sts/integration_tests/performance/test_rate_limiter.py | 97 | def test_rx_rate_limiting_cpu_load(uvm): | CODE |
| LOW | …sts/integration_tests/performance/test_rate_limiter.py | 237 | def _check_tx_rate_limit_patch(test_microvm): | CODE |
| LOW | …sts/integration_tests/performance/test_rate_limiter.py | 263 | def _check_rx_rate_limit_patch(test_microvm): | CODE |
| LOW | …sts/integration_tests/performance/test_rate_limiter.py | 340 | def _start_iperf_server_on_guest(test_microvm): | CODE |
| LOW | …sts/integration_tests/performance/test_rate_limiter.py | 356 | def _start_iperf_server_on_host(netns_cmd_prefix): | CODE |
| LOW | tests/integration_tests/performance/test_snapshot.py | 153 | def test_post_restore_latency( | CODE |
| LOW | tests/integration_tests/performance/test_snapshot.py | 266 | def test_snapshot_create_latency( | CODE |
| LOW | tests/integration_tests/performance/test_pmem.py | 156 | def emit_fio_single_read_metrics(logs_dir, metrics): | CODE |
| LOW | tests/integration_tests/performance/test_balloon.py | 51 | def test_hinting_reporting_cpu( | CODE |
| LOW | tests/integration_tests/performance/test_balloon.py | 126 | def test_hinting_fault_latency( | CODE |
| LOW | …gration_tests/performance/test_process_startup_time.py | 19 | def test_startup_time_new_pid_ns(microvm_factory, guest_kernel, rootfs, metrics): | CODE |
| LOW | …gration_tests/performance/test_process_startup_time.py | 31 | def test_startup_time_daemonize(microvm_factory, guest_kernel, rootfs, metrics): | CODE |
| 158 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/conftest.py | 455 | except: # pylint: disable=bare-except | CODE |
| HIGH | tests/conftest.py | 473 | except: # pylint: disable=bare-except | CODE |
| HIGH | tests/integration_tests/security/test_custom_seccomp.py | 84 | except: | CODE |
| HIGH | …ts/integration_tests/functional/test_cmd_line_start.py | 391 | except: # pylint: disable=bare-except | CODE |
| HIGH | …ts/integration_tests/functional/test_cmd_line_start.py | 415 | except: # pylint: disable=bare-except | CODE |
| HIGH | tests/integration_tests/functional/test_vsock.py | 316 | except (SocketTimeout, ConnectionResetError, BrokenPipeError): | CODE |
| HIGH | tests/framework/jailer.py | 206 | except TimeoutError: | CODE |
| HIGH | tests/framework/utils.py | 526 | except (FileNotFoundError, PermissionError): | CODE |
| HIGH | tests/framework/utils.py | 537 | except (FileNotFoundError, PermissionError, IndexError, ValueError): | CODE |
| HIGH | tests/framework/utils.py | 551 | except (FileNotFoundError, PermissionError): | CODE |
| HIGH | tests/framework/utils.py | 589 | except (FileNotFoundError, subprocess.TimeoutExpired, OSError): | CODE |
| HIGH | tests/framework/utils.py | 622 | except (FileNotFoundError, subprocess.TimeoutExpired, OSError): | CODE |
| HIGH | tests/framework/utils.py | 574 | except (FileNotFoundError, PermissionError): | CODE |
| HIGH | tests/framework/utils.py | 567 | except (FileNotFoundError, PermissionError): | CODE |
| HIGH | tests/framework/microvm.py | 356 | except ProcessLookupError: | CODE |
| HIGH | tests/host_tools/drive.py | 63 | except OSError: | CODE |
| HIGH | tests/host_tools/cpu_load.py | 75 | except KeyError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/release-tag.sh | 12 | # Create a tag for the specified release. | COMMENT |
| MEDIUM | resources/rebuild.sh | 139 | # Create a temporary branch where we can apply patches and then | COMMENT |
| MEDIUM | resources/rebuild.sh | 327 | # Create the directory in which we will store the kernels and rootfs | COMMENT |
| MEDIUM | tests/integration_tests/security/test_jail.py | 544 | # Create the parent cgroup. | COMMENT |
| MEDIUM | tests/integration_tests/performance/test_vsock.py | 138 | # Create a vsock device | COMMENT |
| MEDIUM | …/integration_tests/functional/test_net_config_space.py | 32 | # Create the control ssh connection. | COMMENT |
| MEDIUM | …/integration_tests/functional/test_drive_vhost_user.py | 53 | # Create a rw rootfs file that is unique to the microVM | COMMENT |
| MEDIUM | …/integration_tests/functional/test_drive_vhost_user.py | 187 | # Create a rw rootfs file that is unique to the microVM | COMMENT |
| MEDIUM | …/integration_tests/functional/test_drive_vhost_user.py | 243 | # Create a rootfs with partuuid unique to this microVM | COMMENT |
| MEDIUM | tests/integration_tests/functional/test_vsock.py | 384 | # Create a socat process in the guest which will connect to the host socat | COMMENT |
| MEDIUM | …sts/functional/test_snapshot_not_losing_dirty_pages.py | 51 | # Create a large file dynamically based on available space | COMMENT |
| MEDIUM | tests/integration_tests/functional/test_api.py | 1123 | # Create a vsock device. | COMMENT |
| MEDIUM | tests/integration_tests/functional/test_api.py | 1155 | # Create a new entropy device should be OK. | COMMENT |
| MEDIUM | …ts/integration_tests/functional/test_snapshot_basic.py | 254 | # Create a snapshot from a microvm. | COMMENT |
| MEDIUM | tests/framework/utils.py | 430 | # Create the async process | COMMENT |
| MEDIUM | tests/framework/microvm.py | 238 | # Create the jailer context associated with this microvm. | COMMENT |
| MEDIUM | tests/host_tools/udp_offload.py | 37 | # Create a UDP socket | COMMENT |
| MEDIUM | tests/host_tools/network.py | 276 | # Create the tap device tap0 directly in the network namespace to avoid | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/data/metadata.json | 3 | "meta-data": "Lorem ipsum dolor sit amet, consectetur adipiscing elit", | CODE |
| LOW⚡ | tests/data/metadata.json | 3 | "meta-data": "Lorem ipsum dolor sit amet, consectetur adipiscing elit", | CODE |
| LOW⚡ | tests/data/metadata.json | 7 | "meta-data": "Lorem ipsum dolor sit amet" | CODE |
| LOW⚡ | tests/data/metadata.json | 7 | "meta-data": "Lorem ipsum dolor sit amet" | CODE |
| LOW | tests/data/metadata_invalid.json | 3 | "meta-data": "Lorem ipsum dolor sit amet, consectetur adipiscing elit", | CODE |
| LOW | tests/data/metadata_invalid.json | 3 | "meta-data": "Lorem ipsum dolor sit amet, consectetur adipiscing elit", | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 72 | let mut dummy_data = [1u8; BYTES_COUNT]; | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 76 | dummy_data.as_mut_ptr() as *const c_void, | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 77 | dummy_data.len(), | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 80 | assert!(dummy_data.len() == usize::try_from(rc).unwrap()); | CODE |
| LOW | src/vmm/tests/devices.rs | 102 | assert!(data[..31] == dummy_data[..31]); | CODE |
| LOW | src/vmm/tests/devices.rs | 103 | assert!(data[32..64] == dummy_data[32..64]); | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 118 | dummy_data.as_mut_ptr() as *const c_void, | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 119 | dummy_data.len(), | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 122 | assert!(dummy_data.len() == usize::try_from(rc).unwrap()); | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 220 | let mut dummy_data = [1u8; BYTES_COUNT]; | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 224 | dummy_data.as_mut_ptr() as *const c_void, | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 225 | dummy_data.len(), | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 228 | assert!(dummy_data.len() == usize::try_from(rc).unwrap()); | CODE |
| LOW | src/vmm/tests/devices.rs | 250 | assert!(data[..31] == dummy_data[..31]); | CODE |
| LOW | src/vmm/tests/devices.rs | 251 | assert!(data[32..64] == dummy_data[32..64]); | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 266 | dummy_data.as_mut_ptr() as *const c_void, | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 267 | dummy_data.len(), | CODE |
| LOW⚡ | src/vmm/tests/devices.rs | 270 | assert!(dummy_data.len() == usize::try_from(rc).unwrap()); | CODE |
| LOW | src/vmm/src/vmm_config/drive.rs | 242 | let dummy_id = String::from("1"); | CODE |
| LOW | src/vmm/src/vmm_config/drive.rs | 244 | drive_id: dummy_id.clone(), | CODE |
| LOW | src/vmm/src/vmm_config/drive.rs | 267 | assert_eq!(block_devs.get_index_of_drive_id(&dummy_id), Some(0)); | CODE |
| LOW | src/firecracker/src/api_server/request/drive.rs | 119 | "drive_id": "dummy_id", | CODE |
| LOW | src/firecracker/src/api_server/request/balloon.rs | 165 | "amount_mib": "dummy_id", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/integration_tests/functional/test_drive_vhost_user.py | 312 | mkfs_mount_cmd = "mkfs.ext4 /dev/vdb && mkdir -p /tmp/tmp && mount /dev/vdb /tmp/tmp && umount /tmp/tmp" | CODE |
| HIGH | tests/integration_tests/functional/test_drive_virtio.py | 445 | vm.ssh.check_output("mount /dev/vdb /tmp && umount /tmp") | CODE |
| HIGH | tests/integration_tests/functional/test_drive_virtio.py | 463 | vm.ssh.check_output("mount /dev/vdb /tmp && umount /tmp") | CODE |
| HIGH | tests/integration_tests/functional/test_serial_io.py | 362 | "echo 'hello' > /dev/ttyS0 && stty -F /dev/ttyS0 $(stty -F /dev/ttyS0 -g)" | CODE |
| HIGH | tests/framework/utils.py | 659 | cmd = "cd ../src/firecracker && cargo pkgid | cut -d# -f2 | cut -d: -f2" | CODE |
| HIGH | .buildkite/pipeline_release_qa.py | 69 | "| jq '(..|select(.priority? != null).priority) += 100' " | CODE |
| HIGH | .buildkite/pipeline_pr.py | 44 | "./tools/devtool -y build_devctr && DEVCTR_IMAGE_TAG=latest ./tools/devtool test --no-build -- integration_tests | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/ab_plot.py | 113 | CODE | |
| LOW | tools/ab_plot.py | 191 | CODE | |
| LOW | tests/conftest.py | 410 | CODE | |
| LOW | …ts/integration_tests/security/test_seccomp_validate.py | 33 | CODE | |
| LOW | …sts/integration_tests/security/test_vulnerabilities.py | 240 | CODE | |
| LOW | tests/integration_tests/functional/test_vsock.py | 341 | CODE | |
| LOW | tests/integration_tests/functional/test_vsock.py | 499 | CODE | |
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 615 | CODE | |
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 870 | CODE | |
| LOW | tests/framework/swagger_validator.py | 52 | CODE | |
| LOW | tests/framework/swagger_validator.py | 156 | CODE | |
| LOW | tests/framework/gitlint_rules.py | 24 | CODE | |
| LOW | tests/framework/guest_stats.py | 62 | CODE | |
| LOW | tests/framework/jailer.py | 85 | CODE | |
| LOW | tests/framework/jailer.py | 180 | CODE | |
| LOW | tests/framework/utils.py | 498 | CODE | |
| LOW | tests/framework/microvm.py | 317 | CODE | |
| LOW | tests/framework/microvm.py | 602 | CODE | |
| LOW | tests/framework/static_analysis.py | 441 | CODE | |
| LOW | tests/framework/static_analysis.py | 565 | CODE | |
| LOW | tests/framework/utils_cpuid.py | 106 | CODE | |
| LOW | tests/host_tools/fcmetrics.py | 28 | CODE | |
| LOW | tests/host_tools/fcmetrics.py | 460 | CODE | |
| LOW | .buildkite/pipeline_perf.py | 181 | CODE | |
| LOW | .buildkite/common.py | 134 | CODE | |
| LOW | .buildkite/common.py | 364 | CODE | |
| LOW | .buildkite/common.py | 440 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/conftest.py | 592 | # ============================================================================= | COMMENT |
| MEDIUM | tests/conftest.py | 594 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | …sts/integration_tests/security/test_vulnerabilities.py | 191 | # ============================== | COMMENT |
| MEDIUM⚡ | …sts/integration_tests/security/test_vulnerabilities.py | 194 | # -------------------------------------------- | COMMENT |
| MEDIUM | src/vmm/src/logger/rate_limited.rs | 16 | //! ┌───────────────────┬────────────────────────────────────────┐ | COMMENT |
| MEDIUM | src/vmm/src/logger/rate_limited.rs | 18 | //! └───────────────────┴────────────────────────────────────────┘ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/vmm/src/devices/virtio/transport/pci/device.rs | 634 | let bar_offset: u32 = self.cap_pci_cfg_info.cap.cap.offset.into(); | CODE |
| CRITICAL | src/vmm/src/devices/virtio/transport/pci/device.rs | 659 | let bar_offset: u32 = self.cap_pci_cfg_info.cap.cap.offset.into(); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/ab_plot.py | 215 | # Check if difference is significant | COMMENT |
| LOW | tests/integration_tests/performance/test_huge_pages.py | 200 | # Verify if guest can run commands, and also wake up the fast page fault helper to trigger page faults. | COMMENT |
| LOW | tests/integration_tests/functional/test_net.py | 62 | # Check if the high ingress traffic broke the net interface. | COMMENT |
| LOW | tests/integration_tests/functional/test_metrics.py | 131 | # Verify if guest can run commands. | COMMENT |
| LOW | tests/integration_tests/functional/test_error_code.py | 35 | # Check if FC process is closed | COMMENT |
| LOW | tests/integration_tests/functional/test_max_devices.py | 54 | # Verify if guest can run commands. | COMMENT |
| LOW | tests/integration_tests/functional/test_uffd.py | 101 | # Verify if the restored guest works. | COMMENT |
| LOW | tests/integration_tests/functional/test_uffd.py | 107 | # Verify if the restored guest works. | COMMENT |
| LOW | tests/integration_tests/functional/test_drive_virtio.py | 49 | # Check if reading from the entire disk results in a file of the same size | COMMENT |
| LOW | tests/integration_tests/functional/test_serial_io.py | 271 | # Check if the total memory size changed. | COMMENT |
| LOW | tests/framework/swagger_validator.py | 176 | # Check if it's a parameter placeholder or exact match | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/framework/properties.py | 135 | except Exception: | CODE |
| LOW | tests/framework/utils_vsock.py | 54 | except Exception as err: | CODE |
| LOW | tests/framework/http_api.py | 65 | except Exception as e: | CODE |
| LOW | tests/framework/http_api.py | 93 | except Exception as e: | CODE |
| LOW | tests/framework/http_api.py | 109 | except Exception as e: | CODE |
| LOW | tests/framework/utils.py | 74 | except Exception as exc: | CODE |
| LOW | tests/framework/utils.py | 83 | except Exception as exc: | CODE |
| MEDIUM | tests/host_tools/udp_offload.py | 57 | eprint(f"Error sending message: {e}") | CODE |
| LOW | tests/host_tools/network.py | 59 | except Exception as exc: | CODE |
| LOW | tests/host_tools/network.py | 149 | except Exception: | CODE |
| LOW | tests/host_tools/network.py | 225 | except Exception as exc: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ts/integration_tests/security/test_seccomp_validate.py | 77 | # We just add 1000000 to the allowed arg and assume it | COMMENT |
| MEDIUM | .github/codecov.yml | 2 | # We utilize optional statuses that are okay to fail, so | COMMENT |
| MEDIUM | src/vmm/src/vstate/vm.rs | 770 | // TODO: Once Host 5.10 goes out of support, we can make this more robust and work on | COMMENT |
| MEDIUM | src/firecracker/examples/uffd/uffd_utils.rs | 80 | // happening, but let's try to be a bit more robust and retry a few times | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 450 | # Step 1: Verify that guest CPUID exposes IA32_ARCH_CAPABILITIES. | COMMENT |
| LOW⚡ | …tegration_tests/functional/test_cpu_features_x86_64.py | 475 | # Step 2: Capture a live IA32_ARCH_CAPABILITIES baseline. | COMMENT |
| LOW⚡ | …tegration_tests/functional/test_cpu_features_x86_64.py | 484 | # Step 3: Build a minimal template that leaves CPUID unchanged, toggles | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 495 | # Step 4: Apply the template and verify that only bit 0 differs from the | COMMENT |
| LOW | docs/device-hotplug.md | 68 | ### Step 1: Remove the device from the guest | COMMENT |
| LOW | docs/device-hotplug.md | 84 | ### Step 2: Unplug from the host | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 450 | # Step 1: Verify that guest CPUID exposes IA32_ARCH_CAPABILITIES. | COMMENT |
| LOW⚡ | …tegration_tests/functional/test_cpu_features_x86_64.py | 475 | # Step 2: Capture a live IA32_ARCH_CAPABILITIES baseline. | COMMENT |
| LOW⚡ | …tegration_tests/functional/test_cpu_features_x86_64.py | 484 | # Step 3: Build a minimal template that leaves CPUID unchanged, toggles | COMMENT |
| LOW | …tegration_tests/functional/test_cpu_features_x86_64.py | 495 | # Step 4: Apply the template and verify that only bit 0 differs from the | COMMENT |
| LOW | src/vmm/src/devices/virtio/queue.rs | 936 | // With firecracker's batching of used IRQs, we need to check if addition of the last | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/pyproject.toml | 29 | # to run only the similarities checker, you can use "--disable=all | COMMENT |
| LOW | src/vmm/src/devices/virtio/balloon/util.rs | 58 | // Don't forget to push the last range to the result. | COMMENT |
| MEDIUM | src/firecracker/src/main.rs | 134 | // It's worth noting that the abort is caused by sending a SIG_ABORT signal to the process. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/vmm/src/devices/virtio/vsock/csm/connection.rs | 55 | // respected, the receiving peer's behaviour is undefined. In this implementation, we | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/framework/jailer.py | 42 | CODE | |
| LOW | tests/framework/utils.py | 731 | CODE | |
| LOW | tests/framework/microvm.py | 660 | CODE | |
| LOW | tests/framework/microvm.py | 848 | CODE | |
| LOW | tests/framework/kvm.py | 39 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/framework/static_analysis.py | 23 | logger = logging.getLogger(__name__) | CODE |