refactor: make devctr build process multi-staged.

SPECIFICATION.md

@@ -63,8 +63,8 @@ on the following:
     getting consistent measurements for some performance metrics.
 
 [^2]: No logs are currently produced in the span of time between the `jailer`
-    process start-up and the logging system initialization in the `firecracker`
-    process.
+    process start-up and the logging system initialization in the
+    `firecracker` process.
 
 [1]: https://aws.amazon.com/ec2/instance-types/m5/
 [2]: https://aws.amazon.com/ec2/instance-types/m6/

rust-toolchain.toml

@@ -11,7 +11,7 @@
 # allowlisted using a toolchain that requires it, causing the A/B-test to
 # always fail.
 [toolchain]
-channel = "1.93.0"
+channel = "1.94.1"
 targets = ["x86_64-unknown-linux-musl", "aarch64-unknown-linux-musl"]
 profile = "minimal"
 

src/vmm/src/arch/x86_64/cpu_model.rs

@@ -60,6 +60,8 @@ impl CpuModel {
     pub fn get_cpu_model() -> Self {
         // SAFETY: This operation is safe as long as the processor implements this CPUID function.
         // 0x1 is the defined code for getting the processor version information.
+        // TODO: Remove `unsafe` block when Kani nightly toolchain is updated to be >=1.94.0
+        #[allow(unused_unsafe)]
         let eax = unsafe { host_cpuid(0x1) }.eax;
         CpuModel::from(&eax)
     }

src/vmm/src/cpu_config/x86_64/cpuid/common.rs

@@ -25,6 +25,8 @@ pub enum GetCpuidError {
 /// - When the given `leaf` is more than `max_leaf` supported by CPUID.
 /// - When the CPUID leaf `sub-leaf` is invalid (all its register equal 0).
 pub fn get_cpuid(leaf: u32, subleaf: u32) -> Result<std::arch::x86_64::CpuidResult, GetCpuidError> {
+    // TODO: Remove `unsafe` block when Kani nightly toolchain is updated to be >=1.94.0
+    #[allow(unused_unsafe)]
     let max_leaf =
         // JUSTIFICATION: There is no safe alternative.
         // SAFETY: This is safe because the host supports the `cpuid` instruction
@@ -144,6 +146,8 @@ mod tests {
 
     #[test]
     fn get_cpuid_unsupported_leaf() {
+        // TODO: Remove `unsafe` block when Kani nightly toolchain is updated to be >=1.94.0
+        #[allow(unused_unsafe)]
         let max_leaf =
             // JUSTIFICATION: There is no safe alternative.
             // SAFETY: This is safe because the host supports the `cpuid` instruction

src/vmm/src/cpu_config/x86_64/cpuid/mod.rs

@@ -77,7 +77,11 @@ fn cpuid(leaf: u32) -> std::arch::x86_64::CpuidResult {
 fn cpuid_count(leaf: u32, subleaf: u32) -> std::arch::x86_64::CpuidResult {
     // JUSTIFICATION: There is no safe alternative.
     // SAFETY: The `cfg(cpuid)` wrapping the `cpuid` module guarantees `CPUID` is supported.
-    unsafe { std::arch::x86_64::__cpuid_count(leaf, subleaf) }
+    // TODO: Remove `unsafe` block when Kani nightly toolchain is updated to be >=1.94.0
+    #[allow(unused_unsafe)]
+    unsafe {
+        std::arch::x86_64::__cpuid_count(leaf, subleaf)
+    }
 }
 
 /// Gets the Intel default brand.

tests/framework/ab_test.py

@@ -21,6 +21,7 @@
 of both invocations is the same, the test passes (with us being alerted to this situtation via a special pipeline that
 does not block PRs). If not, it fails, preventing PRs from introducing new vulnerable dependencies.
 """
+
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from typing import Callable, Optional, TypeVar

tests/framework/guest_stats.py

@@ -1,8 +1,7 @@
 # Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-"""Classes for querying guest stats inside microVMs.
-"""
+"""Classes for querying guest stats inside microVMs."""
 
 
 class ByteUnit:

tests/framework/microvm_helpers.py

@@ -254,22 +254,18 @@ def tmux_gdb(self):
         with tempfile.NamedTemporaryFile(
             mode="w", suffix=".gdb", delete=False, prefix="fc_gdb_"
         ) as f:
-            f.write(
-                f"""
+            f.write(f"""
                 target remote {chroot_gdb_socket}
                 directory resources/linux
                 hbreak start_kernel
                 continue
-            """
-            )
+            """)
             gdb_script = f.name
 
-        self.tmux_neww(
-            f"""
+        self.tmux_neww(f"""
             until [ -S {chroot_gdb_socket} ]; do
                 echo 'waiting for {chroot_gdb_socket}';
                 sleep 1;
             done;
             gdb {self.vm.kernel_file} -x {gdb_script}
-            """
-        )
+            """)

tests/framework/properties.py

@@ -6,6 +6,7 @@
 """
 Metadata we want to attach to tests for further analysis and troubleshooting
 """
+
 import os
 import platform
 import re
@@ -26,7 +27,7 @@ def get_os_version():
     """Get the OS version
 
     >>> get_os_version()
-    'Ubuntu 24.04.3 LTS'
+    'Ubuntu 24.04.4 LTS'
     """
 
     os_release = Path("/etc/os-release").read_text(encoding="ascii")

tests/framework/utils.py

@@ -1,6 +1,7 @@
 # Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Generic utility functions that are used in the framework."""
+
 import errno
 import json
 import logging
@@ -558,9 +559,7 @@ def guest_run_fio_iteration(ssh_connection, iteration):
     fio = """fio --filename=/dev/vda --direct=1 --rw=randread --bs=4k \
         --ioengine=libaio --iodepth=16 --runtime=10 --numjobs=4 --time_based \
         --group_reporting --name=iops-test-job --eta-newline=1 --readonly \
-        --output /tmp/fio{} > /dev/null &""".format(
-        iteration
-    )
+        --output /tmp/fio{} > /dev/null &""".format(iteration)
     exit_code, _, stderr = ssh_connection.run(fio)
     assert exit_code == 0, stderr
 

tests/framework/utils_ftrace.py

@@ -1,6 +1,7 @@
 # Copyright 2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Utilities for interacting with the kernel's ftrace subsystem"""
+
 import contextlib
 
 from framework.utils import check_output

tests/framework/utils_imdsv2.py

@@ -11,7 +11,6 @@
 `ec2:MetadataHttpPutResponseHopLimit`
 """
 
-
 import time
 
 import requests

tests/framework/with_filelock.py

@@ -10,7 +10,6 @@
 TBD disambiguate with the module name in that case.
 """
 
-
 import functools
 import tempfile
 from pathlib import Path

tests/host_tools/cpu_load.py

@@ -1,6 +1,7 @@
 # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Utilities for measuring cpu utilisation for a process."""
+
 import time
 from threading import Thread
 

tests/host_tools/proc.py

@@ -1,6 +1,7 @@
 # Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Utility functions for interacting with the processor."""
+
 import re
 
 from framework import utils

tests/integration_tests/build/test_clippy.py

@@ -2,7 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 """Tests ensuring codebase style compliance for Rust and Python."""
 
-
 import platform
 
 import pytest

tests/integration_tests/build/test_coverage.py

@@ -1,6 +1,7 @@
 # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Tests enforcing code coverage for production code."""
+
 import os
 import warnings
 

tests/integration_tests/build/test_seccomp_no_redundant_rules.py

@@ -3,6 +3,7 @@
 """A test that fails if it can definitely prove a seccomp rule redundant
 (although it passing does not guarantee the converse, that all rules are definitely needed).
 """
+
 import platform
 from pathlib import Path
 

tests/integration_tests/functional/test_cmd_line_start.py

@@ -210,7 +210,7 @@ def test_config_machine_config_params(uvm_plain, test_config):
 
     # Test configuration determines if the file is a valid config or not
     # based on the CPU
-    (vm_config_file, cpu_template_used, smt_used) = test_config
+    vm_config_file, cpu_template_used, smt_used = test_config
 
     _configure_vm_from_json(test_microvm, vm_config_file)
     test_microvm.jailer.extra_args.update({"no-api": None})

tests/integration_tests/functional/test_log_instrument.py

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """Checks that the output of instrumentation examples is correct"""
+
 import pytest
 
 from framework import utils

tests/integration_tests/functional/test_rng.py

@@ -145,7 +145,7 @@ def _process_dd_output(out):
     report = out.splitlines()[-1].split(" ")
 
     # Last two items in the line are value and units
-    (value, units) = (report[-2], report[-1])
+    value, units = (report[-2], report[-1])
 
     return float(value) * _throughput_units_multiplier(units) / 1000
 

tests/integration_tests/functional/test_rtc.py

@@ -1,6 +1,7 @@
 # Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Check the well functioning af the RTC device on aarch64 platforms."""
+
 import platform
 import re
 

tests/integration_tests/performance/test_drive_rate_limiter.py

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 """Tests for checking the rate limiter on /drives resources."""
+
 import json
 import os
 

tests/integration_tests/performance/test_huge_pages.py

@@ -1,6 +1,7 @@
 # Copyright 2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Integration tests for Firecracker's huge pages support"""
+
 import signal
 import time
 

tests/integration_tests/performance/test_initrd.py

@@ -1,6 +1,7 @@
 # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Tests for initrd."""
+
 import pytest
 
 from framework.microvm import HugePagesConfig, Serial

tests/integration_tests/performance/test_rate_limiter.py

@@ -1,6 +1,7 @@
 # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Tests that fail if network throughput does not obey rate limits."""
+
 import time
 
 from framework import utils

tests/integration_tests/performance/test_snapshot.py

@@ -1,6 +1,7 @@
 # Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Performance benchmark for snapshot restore."""
+
 import re
 import signal
 import tempfile

tests/integration_tests/security/test_jail.py

@@ -322,12 +322,12 @@ def get_cpus(node):
 def check_limits(pid, no_file, fsize):
     """Verify resource limits against expected values."""
     # Fetch firecracker process limits for number of open fds
-    (soft, hard) = resource.prlimit(pid, resource.RLIMIT_NOFILE)
+    soft, hard = resource.prlimit(pid, resource.RLIMIT_NOFILE)
     assert soft == no_file
     assert hard == no_file
 
     # Fetch firecracker process limits for maximum file size
-    (soft, hard) = resource.prlimit(pid, resource.RLIMIT_FSIZE)
+    soft, hard = resource.prlimit(pid, resource.RLIMIT_FSIZE)
     assert soft == fsize
     assert hard == fsize
 
@@ -521,13 +521,13 @@ def test_args_default_resource_limits(uvm_plain):
     assert pid != 0
 
     # Fetch firecracker process limits for number of open fds
-    (soft, hard) = resource.prlimit(pid, resource.RLIMIT_NOFILE)
+    soft, hard = resource.prlimit(pid, resource.RLIMIT_NOFILE)
     # Check that the default limit was set.
     assert soft == 2048
     assert hard == 2048
 
     # Fetch firecracker process limits for number of open fds
-    (soft, hard) = resource.prlimit(pid, resource.RLIMIT_FSIZE)
+    soft, hard = resource.prlimit(pid, resource.RLIMIT_FSIZE)
     # Check that no limit was set
     assert soft == -1
     assert hard == -1

tests/integration_tests/security/test_sec_audit.py

@@ -1,6 +1,7 @@
 # Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Tests ensuring security vulnerabilities are not present in dependencies."""
+
 import json
 
 import pytest

tests/integration_tests/style/test_rust.py

@@ -1,6 +1,7 @@
 # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 """Tests ensuring codebase style compliance for Rust."""
+
 from collections import defaultdict
 
 from framework import utils

tests/integration_tests/test_kani.py

@@ -4,6 +4,7 @@
 Proofs ensuring memory safety properties, user-defined assertions,
 absence of panics and some types of unexpected behavior (e.g., arithmetic overflows).
 """
+
 import os
 import platform