Glossary

Every term you will meet reading Firecracker source, an issue thread, a PR review, a swagger.yaml, or a KVM_EXIT log line — defined in one to three lines, with a link to the chapter, level, or lab that covers it in full. Use this as a fast lookup; follow the link when you need depth. Terms span four layers: the Firecracker VMM itself (the vmm/firecracker/jailer crates), the rust-vmm crates beneath it (kvm-ioctls, vm-memory, linux-loader, …), KVM / Linux primitives (ioctls, userfaultfd, TAP), and the virtio device-model spec.

Note: Firecracker is Apache-2.0, Rust, by AWS, built on KVM, powering AWS Lambda and AWS Fargate. Contribution is by GitHub PR with a DCO Signed-off-by sign-off (git commit -s) — there is no CLA. A term missing here is usually a sign the codebase renamed it: rg the checkout for the current name, then send a PR adding the row.

Jump to: A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · R · S · T · U · V · W · Z

A

aarch64 / arm64 — One of Firecracker's two target architectures (the other is x86_64). No zero page: the VMM builds an FDT and passes its address in x0. Uses the GIC interrupt controller and an arm64 PE Image kernel. See ../masterclass/the-boot-process/lab-03-aarch64-fdt.md.

ACPI (Advanced Configuration and Power Interface) — Tables (RSDP/MADT/…) Firecracker builds to describe CPUs and devices to the guest; the acpi-tables crate writes them. Firecracker is migrating from MPTable to ACPI for CPU topology (verify the default on your branch). See ../deep-dives/acpi-and-mptable.md.

ACPIDeviceManager — The part of the device manager that registers ACPI-exposed devices (x86_64). See ../deep-dives/the-mmio-bus-and-device-manager.md.

Action (/actions) — The REST endpoint that triggers one-shot operations: InstanceStart, FlushMetrics, SendCtrlAltDel. See the API endpoint map and Level 3.

Available ring (avail ring) — The virtqueue ring the driver (guest) writes to hand descriptor chains to the device; an idx plus a ring[] of descriptor head indices. See ../deep-dives/virtqueues.md.

API thread — The Firecracker thread that runs the HTTP server on the Unix socket; the control plane, never in the fast path, absent under --no-api. See ../deep-dives/the-vmm-threading-model.md.

ApiServer — The HTTP server type in the firecracker binary (src/firecracker/src/api_server/) that turns requests into ParsedRequests. See ../deep-dives/api-server-and-action-channel.md.

B

Balloon (virtio-balloon, device type 5) — A device that reclaims guest RAM back to the host by "inflating" (the guest gives pages, the VMM madvise(MADV_DONTNEED)s them) and "deflating." Has optional /balloon/statistics. See ../deep-dives/virtio-balloon.md.

Block (virtio-block, device type 2) — The virtio disk device: one request queue, file-backed, rate-limited, with a Sync or io_uring/Async I/O engine. Configured via /drives/{id}. See ../deep-dives/virtio-block.md and Lab 7.1.

boot_args — The kernel command line, set via /boot-source. Default ≈ reboot=k panic=1 pci=off nomodule 8250.nr_uarts=0 console=ttyS0 (varies — verify). See ../deep-dives/the-boot-sequence.md.

boot_params — See zero page.

Builder (builder.rs) — The vmm module whose functions assemble a microVM: build_microvm_for_boot, build_and_boot_microvm, build_microvm_from_snapshot. See ../deep-dives/the-boot-sequence.md and Level 6.

bzImage — A compressed/self-extracting kernel image format; supported on aarch64 (as a PE Image) and partially on x86 — Firecracker's canonical x86 path loads an uncompressed vmlinux ELF instead. See ../masterclass/the-boot-process/lab-01-trace-kernel-load.md.

C

cgroups — Linux control groups the jailer uses to bound a microVM's CPU, memory, and other resources (--cgroup, --resource-limit). See ../deep-dives/the-jailer.md.

CHANGELOG — The CHANGELOG.md entry every user-facing PR adds (Added / Changed / Deprecated / Removed / Fixed). Part of the contribution checklist. See ../level-2/index.md.

CMDLINE_START — The guest physical address where the kernel command line is placed (0x20000 on x86_64 — verify in arch/x86_64/layout.rs). See the memory layout cheat-sheet.

Cloud Hypervisor — Another rust-vmm-based VMM, sharing low-level crates with Firecracker but targeting full cloud guests (virtio-PCI, ACPI, hotplug, migration). See Firecracker vs. others.

CPUID — The x86 instruction returning CPU feature bits; Firecracker filters it via KVM_GET_SUPPORTED_CPUID/KVM_SET_CPUID2 and CPU templates so the guest sees a consistent feature set across heterogeneous hosts. See ../deep-dives/cpu-templates-and-cpuid.md and Lab 4.3.

CPU template — A static (built-in) or custom (/cpu-config) specification that normalizes the guest's CPUID/MSRs for snapshot portability and consistency. Tooling: cpu-template-helper. See ../deep-dives/cpu-templates-and-cpuid.md.

cpu-template-helper — The in-tree binary crate that creates, inspects, and verifies CPU templates. See Key Types by Crate.

crosvm — Google's Rust VMM that Firecracker was originally forked from. See ../introduction.md.

D

DCO (Developer Certificate of Origin) — The Signed-off-by: line every commit needs (git commit -s); Firecracker's contribution gate instead of a CLA, enforced by the DCO bot. See ../release-governance/licensing-and-dco.md.

Descriptor table — The virtqueue array of virtq_desc{addr,len,flags,next} entries describing guest buffers; flags NEXT=1, WRITE=2, INDIRECT=4. Chains of descriptors are the unit of I/O. See ../deep-dives/virtqueues.md.

DeviceManager — The vmm device_manager/ component wrapping MMIODeviceManager + PortIODeviceManager (x86) + ACPIDeviceManager; places and dispatches devices. See ../deep-dives/the-mmio-bus-and-device-manager.md.

devtool (tools/devtool) — The Docker-based build/test wrapper: build, test, fmt, checkstyle, checkbuild --all. See Lab 1.1 and Lab 1.2.

Diff snapshot — A snapshot that records only dirty pages since a base; needs track_dirty_pages, dev-preview. Contrast full snapshot. See ../deep-dives/snapshotting.md.

DRAM_MEM_START — The aarch64 guest-RAM base (0x8000_0000 — verify in arch/aarch64/layout.rs). See the memory layout cheat-sheet.

Drive (/drives/{id}) — A virtio-block device configured pre-boot; PATCH can update the path or rate limiter. See the API endpoint map.

dumbo — The tiny in-VMM TCP/IP stack (vmm/src/dumbo/) that backs MMDS so the guest can reach the metadata service over a normal HTTP socket. See ../deep-dives/mmds-metadata-service.md.

E

e820 — The legacy x86 memory map the VMM writes into the zero page so the kernel learns which physical ranges are usable RAM vs reserved (e.g. the MMIO gap). See ../masterclass/the-boot-process/lab-02-zero-page-and-e820.md.

ELF (loader::Elf) — The executable format of an uncompressed vmlinux; linux-loader parses PT_LOAD segments, copies them into guest memory, and reports e_entry. See ../rust-vmm/linux-loader.md.

Entropy (virtio-rng, device type 4) — The randomness device, configured via /entropy; serves host randomness to the guest (≈64 KiB/request cap). See ../deep-dives/virtio-rng-entropy.md.

EventManager — The rust-vmm event-manager crate's epoll loop the VMM thread runs; device file descriptors register as subscribers. See ../deep-dives/the-event-manager.md and Lab 3.2.

eventfd — A Linux counter file descriptor used for cross-thread/cross-fd wakeups: the API→VMM channel uses one to wake the epoll loop; irqfd and ioeventfd use eventfds at the KVM boundary. EventFd lives in vmm-sys-util. See ../rust-vmm/vmm-sys-util.md.

F

FDT / DTB (Flattened Device Tree / Device Tree Blob) — The aarch64 description of memory, CPUs, and devices the VMM builds (rust-vmm vm-fdt FdtWriter) and passes to the kernel in x0. The aarch64 analogue of the x86 zero page. See ../masterclass/the-boot-process/lab-03-aarch64-fdt.md.

Feature negotiation — The virtio handshake where driver and device agree on feature bits (VIRTIO_F_VERSION_1=32, EVENT_IDX=29, INDIRECT_DESC=28, RING_PACKED=34) before DRIVER_OK. See ../deep-dives/virtio-transport-mmio.md.

Firecracker — The open-source VMM by AWS (Apache-2.0, Rust, on KVM) that creates microVMs; the subject of this curriculum. See ../introduction.md.

firecracker-containerd — The Go project that runs OCI containers inside Firecracker microVMs via a containerd shim + an in-VM agent. See ../integration-labs/lab-i1-firecracker-containerd.md.

Full snapshot — A snapshot capturing all guest RAM and device/KVM state (GA). Contrast diff snapshot. See ../deep-dives/snapshotting.md.

G

GDT (Global Descriptor Table) — The x86 segment-descriptor table the VMM sets up low in guest memory so the vCPU can enter long mode. See the memory layout cheat-sheet.

GIC (Generic Interrupt Controller) — The aarch64 interrupt controller (GICv2/GICv3) created via KVM; the ARM analogue of the x86 IRQ chip. See ../deep-dives/interrupts-and-irqchip.md.

Guest memory — The host mmap'd region(s) registered with KVM via KVM_SET_USER_MEMORY_REGION that the guest sees as its physical RAM; modeled by rust-vmm vm-memory (GuestMemoryMmap/GuestAddress). See ../deep-dives/guest-memory-management.md and ../rust-vmm/vm-memory.md.

H

HIMEM_START — The x86_64 1 MiB boundary (0x100000) above which the kernel is loaded. See the memory layout cheat-sheet.

Huge pages — Backing guest memory with 2 MiB/1 GiB pages (via machine-config's huge_pages) to cut TLB pressure. See ../engineering/hugepages-and-memory-performance.md.

Hotplug (memory) — Adding memory to a running guest, via the newer /hotplug/memory endpoint / virtio-mem (verify on your branch). See the API endpoint map.

I

i8042 — The legacy keyboard/mouse controller; Firecracker emulates only the reset path (enough to catch a guest-triggered reboot). See ../deep-dives/serial-console-and-legacy-devices.md.

InstanceStart — The /actions command that boots the configured microVM: allocates vCPU threads, each entering KVM_RUN. See the API endpoint map.

ioeventfd (KVM_IOEVENTFD) — A KVM mechanism that turns a guest MMIO/PIO write to a chosen address into an eventfd signal — no VM exit to userspace; the virtio fast path (the guest's queue-notify "kick"). See the KVM ioctl cheat-sheet and ../deep-dives/virtio-transport-mmio.md.

ioctl — The ioctl() syscall through which userspace drives /dev/kvm; every KVM operation is an ioctl. See the KVM ioctl cheat-sheet.

io_uring / io engine — The asynchronous (Async) block I/O backend, an alternative to the synchronous (Sync) pread/pwrite engine. See ../engineering/io-engines.md.

irqfd (KVM_IRQFD) — A KVM mechanism binding an eventfd to a guest IRQ: the VMM writes the eventfd and KVM injects the interrupt without a VM exit; the device→guest fast path. See the KVM ioctl cheat-sheet.

IRQ (interrupt request) — A signal raised to the guest (e.g. a virtio device finishing work updates the used ring and raises its IRQ). See ../deep-dives/interrupts-and-irqchip.md.

IRQ chip (KVM_CREATE_IRQCHIP) — The in-kernel interrupt controller KVM emulates (x86 PIC/IOAPIC/LAPIC; aarch64 GIC), so most interrupt handling avoids a userspace exit. See ../deep-dives/interrupts-and-irqchip.md.

J

Jailer — The jailer binary that runs as root, sets up the isolation barrier (pivot_root/chroot, cgroups, namespaces, mknod for /dev/kvm & /dev/net/tun), then drops privileges and execs firecracker. It does not apply seccomp — firecracker does. See ../deep-dives/the-jailer.md and Lab 9.1.

K

KVM (Kernel-based Virtual Machine) — The Linux kernel module exposing /dev/kvm that runs guest code on the hardware virtualization extensions (Intel VT-x, AMD-V, ARM EL2). The VMM drives it via ioctls. See ../deep-dives/kvm-fundamentals.md and Lab 1.4.

kvm-bindings — The rust-vmm crate of raw KVM struct/ioctl bindings used by Firecracker. See ../rust-vmm/kvm-ioctls-and-kvm-bindings.md.

kvm-ioctls — The rust-vmm safe wrapper over KVM ioctls (Kvm/VmFd/VcpuFd/VcpuExit) Firecracker uses. See ../rust-vmm/kvm-ioctls-and-kvm-bindings.md.

KVM_RUN — The ioctl that enters the guest and blocks until a VM exit; the core of the vCPU run loop. See the KVM ioctl cheat-sheet and ../deep-dives/vcpu-run-loop-and-vm-exits.md.

Kick — The guest writing the virtio QueueNotify register to tell the device a queue has new descriptors; via ioeventfd it becomes an eventfd signal. See ../deep-dives/virtqueues.md.

L

Lambda (AWS Lambda) — One of the two AWS services Firecracker powers (the other is Fargate). See ../introduction.md.

linux-loader — The rust-vmm crate that parses the kernel (loader::Elf) and writes boot params (bootparam, LinuxBootConfigurator). See ../rust-vmm/linux-loader.md.

Long mode — 64-bit x86 mode; Firecracker sets up paging (cr0 PE|PG, cr4 PAE, efer LME|LMA) and jumps the vCPU straight into it for vmlinux, skipping real mode. See ../deep-dives/the-boot-sequence.md.

M

MachineConfig (/machine-config) — The vCPU count, memory size, SMT, huge pages, CPU template, and dirty-page tracking config. See the API endpoint map. Defaults: vCPU=1, mem=128 MiB, smt=false.

MADV_DONTNEED — The madvise advice the balloon uses to return inflated guest pages to the host. See ../deep-dives/virtio-balloon.md.

MicroVM — A minimal, fast-booting, low-overhead virtual machine: boots in <125 ms, <5 MiB overhead, tiny device model. The thing Firecracker creates (one process = exactly one microVM). See ../introduction.md.

MMDS (microVM Metadata Service) — An IMDS-like in-VMM metadata service the guest reads over HTTP; V2 is token/session-based (IMDSv2-like), V1 deprecated. Backed by dumbo. Config via /mmds/config. See ../deep-dives/mmds-metadata-service.md.

MMIO (memory-mapped I/O) — Device registers exposed as guest physical memory; a guest read/write traps as a KVM_EXIT_MMIO exit (or, for writes to a registered address, an ioeventfd). See ../deep-dives/the-mmio-bus-and-device-manager.md.

MMIO gap — The reserved region just below 4 GiB where MMIO device windows and the APIC live; RAM above it is "high RAM." See the memory layout cheat-sheet.

MMIODeviceManager — The device-manager component that assigns each virtio-MMIO device a fixed register window + IRQ and dispatches accesses. See ../deep-dives/the-mmio-bus-and-device-manager.md.

MPTable — The legacy x86 MultiProcessor table describing CPU topology; Firecracker is deprecating it in favor of ACPI (verify default). See ../deep-dives/acpi-and-mptable.md.

mpsc channel — The std::sync::mpsc channel carrying a boxed VmmAction (ApiRequest) from the API thread to the VMM thread; the reply is an ApiResponse. See ../deep-dives/api-server-and-action-channel.md.

MSR (Model-Specific Register) — x86 control/feature registers Firecracker reads/sets and normalizes via CPU templates (alongside CPUID). See ../masterclass/kvm-and-vcpus/lab-03-cpuid-and-msrs.md.

musl — The default libc Firecracker links against (-l musl); produces the static x86_64-unknown-linux-musl binary. See Lab 1.1.

N

Net (virtio-net, device type 1) — The virtio network device backed by a host TAP interface (/dev/net/tun); RX/TX queues, rate-limited. Configured via /network-interfaces/{id}. See ../deep-dives/virtio-net-and-tap.md.

Network interface (/network-interfaces/{id}) — The REST config for a virtio-net device: iface_id, guest_mac, host_dev_name (the TAP); PATCH sets rate limiters. See the API endpoint map.

--no-api — Boot from a --config-file with no API server (and thus no API thread). See Level 3.

O

Oversubscription — Running many microVMs whose configured memory sums to more than host RAM, relying on the balloon, lazy faulting, and idle guests; AWS tests

20x. See ../engineering/oversubscription-and-density.md.

P

ParsedRequest — The API server's parsed form of an HTTP request, converted into a VmmAction for the channel. See ../deep-dives/api-server-and-action-channel.md.

Persist (trait) — The vmm trait every snapshottable device implements to serialize/restore its state. See ../deep-dives/snapshotting.md.

PIO (port I/O) — x86 in/out instruction I/O; a guest access traps as a KVM_EXIT_IO exit. The serial console and i8042 use PIO. See ../deep-dives/vcpu-run-loop-and-vm-exits.md.

pmem (virtio-pmem) — A newer persistent-memory device exposed via /pmem/{id} (verify on your branch). See the API endpoint map.

PortIODeviceManager — The x86-only device-manager component for PIO devices (serial, i8042). See ../deep-dives/the-mmio-bus-and-device-manager.md.

PrebootApiController / RuntimeApiController — The two dispatchers for VmmActions: the preboot one runs before StartMicroVm, the runtime one after. See ../deep-dives/api-server-and-action-channel.md.

R

Rate limiter — A token-bucket limiter (vmm/src/rate_limiter/) with two buckets (ops/s + bandwidth) per net/block device; params size, one_time_burst, refill_time. See ../deep-dives/rate-limiting-token-bucket.md.

rebase-snap — The in-tree binary that rebases a diff-snapshot memory file onto a base. See Key Types by Crate.

Real mode — The 16-bit x86 mode a vCPU starts in by default; Firecracker bypasses it by entering long mode directly for vmlinux. See ../deep-dives/the-boot-sequence.md.

rpc_interface (rpc_interface.rs) — The vmm module defining VmmAction, VmmData, VmmActionError, and the controllers that dispatch them. See ../deep-dives/api-server-and-action-channel.md.

rust-vmm — The community project of shared low-level crates (jointly maintained by AWS/Intel/Red Hat/…) used by Firecracker and Cloud Hypervisor: kvm-ioctls, kvm-bindings, vm-memory, linux-loader, vm-superio, event-manager, vmm-sys-util, vm-fdt. Firecracker donated seccompiler, event-manager, and vm-superio upstream. See ../rust-vmm/index.md.

S

seccomp / seccomp-BPF — Per-thread-category syscall filters (vmm, api, vcpu) compiled to BPF and applied so each Firecracker thread can make only its allowed syscalls. See ../deep-dives/seccomp-filtering.md and Lab 9.1.

seccompiler — The in-tree crate compiling JSON seccomp filters (resources/seccomp/<arch>.json) → BPF at build time; rust-vmm's external seccompiler originated here. See ../rust-vmm/seccompiler.md.

Serial console — The 16550 UART (rust-vmm vm-superio) Firecracker emulates so the guest gets a console=ttyS0; PIO-based on x86. See ../deep-dives/serial-console-and-legacy-devices.md.

SendCtrlAltDel — The /actions command that signals a guest reboot (caught by the partial i8042). See the API endpoint map.

Snapshot / restore — Capturing a paused microVM's KVM + device state (the state file) and guest RAM (the memory file) and restoring it elsewhere. Workflow: PATCH /vm {Paused} → PUT /snapshot/create → resume; load via PUT /snapshot/load. See ../deep-dives/snapshotting.md and Lab 9.2.

snapshot-editor — The in-tree binary to inspect/edit snapshot files. See Key Types by Crate.

SMT (simultaneous multithreading) — Hyper-threading; machine-config's smt flag (default false). Disabled in production to reduce side channels. See ../deep-dives/cpu-templates-and-cpuid.md.

SREGS (special registers) — The control/segment registers (KVM_GET/SET_SREGS) the VMM sets to put the vCPU in long mode. See the KVM ioctl cheat-sheet.

T

TAP — A host kernel virtual Ethernet interface (/dev/net/tun) that virtio-net is backed by; the host endpoint of the guest's network. See ../deep-dives/virtio-net-and-tap.md and ../masterclass/networking/lab-01-tap-and-bridges.md.

Token bucket — The algorithm behind the rate limiter: tokens refill over refill_time; an op needs a token; one_time_burst seeds extra. See ../deep-dives/rate-limiting-token-bucket.md.

track_dirty_pages — The machine-config flag enabling dirty-page tracking for diff snapshots (renamed from enable_diff_snapshots). See ../deep-dives/snapshotting.md.

U

UART (16550) — The serial-port chip Firecracker emulates for the console (via vm-superio). See ../deep-dives/serial-console-and-legacy-devices.md.

UFFD (userfaultfd) — A Linux mechanism letting a userspace handler service guest page faults on demand; used on snapshot restore (mem_backend type Uffd) for lazy memory loading. See ../masterclass/snapshotting/lab-02-uffd-page-fault-handler.md.

Unikernel — A single-address-space image linking an app with library-OS components into one bootable artifact; an isolation/footprint alternative compared in Firecracker vs. others.

Used ring — The virtqueue ring the device writes to return finished descriptor chains to the driver, each a virtq_used_elem{id,len}; the device then raises an IRQ. See ../deep-dives/virtqueues.md.

utils — The internal shared-utilities crate in the workspace. See Key Types by Crate.

V

vCPU — A virtual CPU: one KVM vCPU fd per configured CPU, each run in its own thread executing the KVM_RUN loop. See ../deep-dives/vcpu-run-loop-and-vm-exits.md and Lab 4.1.

VcpuExit — The kvm-ioctls enum of VM-exit reasons returned from KVM_RUN (IoIn, IoOut, MmioRead, MmioWrite, Hlt, Shutdown, FailEntry, InternalError, …). See the KVM ioctl cheat-sheet.

virtio — The standardized paravirtualized device interface (queues + a status state machine + feature bits) Firecracker implements for net/block/vsock/rng/ balloon. See ../deep-dives/virtio-transport-mmio.md and Level 7.

virtio-mmio — Firecracker's default virtio transport: a fixed MMIO register block per device + an IRQ, with no PCI enumeration (the guest is told the location via cmdline virtio_mmio.device=SIZE@ADDR:IRQ or an FDT node). See ../deep-dives/virtio-transport-mmio.md.

virtio-PCI — An alternative transport behind --enable-pci (verify; note CVE-2026-5747 was in the PCI transport, fixed in 1.14.4/1.15.1). See ../deep-dives/virtio-transport-mmio.md.

Virtqueue (split) — The shared-memory ring structure of a virtio device: descriptor table + available ring + used ring. See ../deep-dives/virtqueues.md and Lab 7.2.

VM (virtual machine fd) — The KVM VM created by KVM_CREATE_VM; the parent of vCPUs and memory regions. See ../deep-dives/kvm-fundamentals.md.

VM exit — A transition from guest to host (VMM) execution: KVM returns from KVM_RUN with an exit reason for the VMM to service (I/O, MMIO, halt, …). See ../deep-dives/vcpu-run-loop-and-vm-exits.md.

Vmm (struct) — The running-microVM object owned by the VMM thread (src/vmm/src/lib.rs). See ../deep-dives/the-vmm-threading-model.md.

VMM (Virtual Machine Monitor) — The userspace process (Firecracker) that creates a VM, gives it memory and vCPUs, emulates devices, loads a kernel, and runs it via KVM. Also called a hypervisor's userspace. See ../introduction.md.

VmmAction — The control-plane command enum (in rpc_interface.rs) the API thread sends to the VMM thread over the mpsc channel. See ../deep-dives/api-server-and-action-channel.md.

VMM thread — The thread owning the Vmm struct and running the EventManager epoll loop: device emulation, MMDS, rate limiting. See ../deep-dives/the-vmm-threading-model.md.

vmlinux — The uncompressed Linux kernel ELF Firecracker loads directly on x86_64. See ../masterclass/the-boot-process/lab-01-trace-kernel-load.md.

vm-memory — The rust-vmm crate modeling guest memory (GuestMemoryMmap/GuestAddress). See ../rust-vmm/vm-memory.md.

vmm-sys-util — The rust-vmm utility crate (EventFd, ioctl macros); externalized (no longer vendored). See ../rust-vmm/vmm-sys-util.md.

vm-superio — The rust-vmm crate providing the serial/i8042/RTC legacy devices. See ../rust-vmm/vm-superio.md.

VmResources — The aggregated pre-boot microVM configuration (resources.rs) the builder consumes. See ../deep-dives/the-boot-sequence.md.

Vsock (virtio-vsock, device type 19) — A host↔guest socket device (AF_VSOCK) backed by a host Unix socket; configured via /vsock. See ../deep-dives/virtio-vsock.md and ../masterclass/virtio-devices/lab-03-vsock.md.

VT-x / AMD-V / SVM — The hardware virtualization extensions KVM uses (Intel VMX with VMCS+EPT; AMD-V/SVM with VMCB+NPT; ARM EL2 + stage-2). See ../deep-dives/kvm-fundamentals.md.

W

Workspace — The Cargo workspace under src/ whose members are the crates (vmm, firecracker, jailer, seccompiler, …). See Key Types by Crate.

Z

Zero page (boot_params) — The x86 struct boot_params the VMM fills (via linux-loader LinuxBootConfigurator) with the e820 map, cmdline pointer, and initrd pointer; its address goes in rsi at boot. Placed at ZERO_PAGE_START (0x7000 — verify). See ../masterclass/the-boot-process/lab-02-zero-page-and-e820.md.

Note: A term missing here is usually a sign the codebase renamed it — rg the vmm/firecracker/jailer checkout (and cargo doc for the rust-vmm deps) to find the current name, then send a PR adding the row. The glossary is only as current as your last rg.

Next: Key Types by Crate — the "where does X live" map.