Re: [libvirt] PATCH: 0/28: Thread safety for libvirtd daemon and drivers

On Wed, Dec 03, 2008 at 08:20:36PM +0100, Daniel Veillard wrote: I started off from Rich's example, and then bashed my head again a brick for 2 days and the attached file is the result :-) Basically CIL is able to parse the GCC intermediate files - the .i files generated from -save-temps. It can compute the control flow information - eg various paths from if/while/switch statements. There's a handy module called 'DataFlow' which traverses the graph and invokes an instance of what they call the 'ForwardsTransfer' module interface. This is what you implement todo your analysis on the code. I've tried to stuff a bunch of comments in my code to explain what I'm doing. The key thing is that I'm not attempting to solve the general problem of checking thread safety in arbitrary code. That would justbe insane & impossible. Instead I'm only trying to analyse the internal driver API entry points for each driver we have and so far just checking everything is unlocked upon exit. Its fairly easy to extend to track other rules we define. eg validate that you lock the 'qemud_driver *' object before locking the virDomainObjPtr instance. These libvirt specific rules I apply are what makes the analysis even remotely practical. I'll document this more fully & try and figure out how we can integrate it into our build system, but here's my quick notes on how I use it - Edit gnulib/lib/c-ctype.h, gnulib/lib/c-ctype.c, src/xmlrpc.c src/xmlrpc.h, src/cgroup.c and replace all references to the datatype 'bool' with 'char' CIL wants the compiler temporary files (eg -save-tmps) but thse include 'bool' data types, and it doesn't know how to handle them so I have to remove them by editing the source. - Run 'make distclean' and 'find -name *.i | xargs rm' - Run autogen.sh as normal - Run make CFLAGS="-save-temps -g -O0" - Install 'ocaml-devel', 'ocaml-cil-devel', 'ocaml-findlib' RPMS - Edit cilvirtflow.ml and find where it says '/home/berrange/....' and make that point to your libvirt directory. - Compile the program ocamlfind ocamlopt -package unix,str,cil -c cilvirtflow.ml ocamlfind ocamlopt -package unix,str,cil cilvirtflow.cmx -linkpkg -o cilvirtflow - Run the analysis ./cilvirtflow If all went to plan it should print out a huge report along the lines of this - this is without my fixes from a few minutes ago - showing the kind of info it gives for identifying bugs Function: qemuDriverLock - Total exit points with locked vars: 0 Function: qemuDriverUnlock - Total exit points with locked vars: 0 Function: qemudSetCloseExec - Total exit points with locked vars: 0 Function: qemudSetNonBlock - Total exit points with locked vars: 0 Function: qemudAutostartConfigs - Total exit points with locked vars: 0 Function: qemudStartup - Total exit points with locked vars: 0 Function: qemudNotifyLoadDomain - Total exit points with locked vars: 0 Function: qemudReload - Total exit points with locked vars: 0 Function: qemudActive - Total exit points with locked vars: 0 Function: qemudShutdown - Total exit points with locked vars: 0 Function: qemudReadMonitorOutput - Total exit points with locked vars: 0 Function: qemudCheckMonitorPrompt - Total exit points with locked vars: 0 Function: qemudOpenMonitor - Total exit points with locked vars: 0 Function: qemudExtractMonitorPath - Total exit points with locked vars: 0 Function: qemudFindCharDevicePTYs - Total exit points with locked vars: 0 Function: qemudWaitForMonitor - Total exit points with locked vars: 0 Function: qemudDetectVcpuPIDs - Total exit points with locked vars: 0 Function: qemudInitCpus - Total exit points with locked vars: 0 Function: qemudNextFreeVNCPort - Total exit points with locked vars: 0 Function: qemudStartVMDaemon - Total exit points with locked vars: 0 Function: qemudVMData - Total exit points with locked vars: 0 Function: qemudShutdownVMDaemon - Total exit points with locked vars: 0 Function: qemudDispatchVMEvent - Total exit points with locked vars: 0 Function: qemudMonitorCommand - Total exit points with locked vars: 0 Function: qemudProbe - Total exit points with locked vars: 0 Function: qemudOpen - Total exit points with locked vars: 0 Function: qemudClose - Total exit points with locked vars: 0 Function: qemudSupportsFeature - Total exit points with locked vars: 0 Function: qemudGetType - Total exit points with locked vars: 0 Function: qemudGetMaxVCPUs - Total exit points with locked vars: 0 Function: qemudGetNodeInfo - Total exit points with locked vars: 0 Function: qemudGetCapabilities - Total exit points with locked vars: 0 Function: qemudNodeGetCellsFreeMemory - Total exit points with locked vars: 0 Function: qemudNodeGetFreeMemory - Total exit points with locked vars: 0 Function: qemudGetProcessInfo - Total exit points with locked vars: 0 Function: qemudDomainLookupByID - Total exit points with locked vars: 0 Function: qemudDomainLookupByUUID - Total exit points with locked vars: 0 Function: qemudDomainLookupByName - Total exit points with locked vars: 0 Function: qemudGetVersion - Total exit points with locked vars: 0 Function: qemudGetHostname - Total exit points with locked vars: 0 Function: qemudListDomains - Total exit points with locked vars: 0 Function: qemudNumDomains - Total exit points with locked vars: 0 Function: qemudDomainCreate - Total exit points with locked vars: 0 Function: qemudDomainSuspend - Total exit points with locked vars: 0 Function: qemudDomainResume - Total exit points with locked vars: 0 Function: qemudDomainShutdown - Total exit points with locked vars: 0 Function: qemudDomainDestroy - Total exit points with locked vars: 0 Function: qemudDomainGetOSType - Total exit points with locked vars: 0 Function: qemudDomainGetMaxMemory - Total exit points with locked vars: 0 Function: qemudDomainSetMaxMemory - Total exit points with locked vars: 0 Function: qemudDomainSetMemory - Total exit points with locked vars: 0 Function: qemudDomainGetInfo - Total exit points with locked vars: 0 Function: qemudEscape - Total exit points with locked vars: 0 Function: qemudEscapeMonitorArg - Total exit points with locked vars: 0 Function: qemudEscapeShellArg - Total exit points with locked vars: 0 Function: qemudDomainSave - Total exit points with locked vars: 1 - Locked vars at exit #line 2131 "qemu_driver.c" return (-1); ^^^^^^^^^ Var: driver 14905 Var: vm 14906 Function: qemudDomainSetVcpus - Total exit points with locked vars: 0 Function: qemudDomainPinVcpu - Total exit points with locked vars: 0 Function: qemudDomainGetVcpus - Total exit points with locked vars: 0 Function: qemudDomainGetMaxVcpus - Total exit points with locked vars: 0 Function: qemudDomainRestore - Total exit points with locked vars: 0 Function: qemudDomainDumpXML - Total exit points with locked vars: 0 Function: qemudListDefinedDomains - Total exit points with locked vars: 0 Function: qemudNumDefinedDomains - Total exit points with locked vars: 0 Function: qemudDomainStart - Total exit points with locked vars: 0 Function: qemudDomainDefine - Total exit points with locked vars: 0 Function: qemudDomainUndefine - Total exit points with locked vars: 0 Function: qemudDiskDeviceName - Total exit points with locked vars: 0 Function: qemudDomainChangeEjectableMedia - Total exit points with locked vars: 0 Function: qemudDomainAttachPciDiskDevice - Total exit points with locked vars: 0 Function: qemudDomainAttachUsbMassstorageDevice - Total exit points with locked vars: 0 Function: qemudDomainAttachHostDevice - Total exit points with locked vars: 0 Function: qemudDomainAttachDevice - Total exit points with locked vars: 0 Function: qemudDomainDetachPciDiskDevice - Total exit points with locked vars: 0 Function: qemudDomainDetachDevice - Total exit points with locked vars: 0 Function: qemudDomainGetAutostart - Total exit points with locked vars: 0 Function: qemudDomainSetAutostart - Total exit points with locked vars: 0 Function: qemudDomainBlockStats - Total exit points with locked vars: 0 Function: qemudDomainInterfaceStats - Total exit points with locked vars: 0 Function: qemudDomainBlockPeek - Total exit points with locked vars: 0 Function: qemudDomainMemoryPeek - Total exit points with locked vars: 0 Function: qemudDomainEventRegister - Total exit points with locked vars: 0 Function: qemudDomainEventDeregister - Total exit points with locked vars: 0 Function: qemuDomainEventDispatchFunc - Total exit points with locked vars: 1 - Locked vars at exit #line 3777 return; ^^^^^^^^^ Var: driver 16606 Function: qemuDomainEventFlush - Total exit points with locked vars: 0 Function: qemuDomainEventQueue - Total exit points with locked vars: 0 Function: qemudDomainMigratePrepare2 - Total exit points with locked vars: 0 Function: qemudDomainMigratePerform - Total exit points with locked vars: 0 Function: qemudDomainMigrateFinish2 - Total exit points with locked vars: 0 Function: qemuRegister - Total exit points with locked vars: 0 Function: umlDriverLock - Total exit points with locked vars: 0 Function: umlDriverUnlock - Total exit points with locked vars: 0 Function: umlSetCloseExec - Total exit points with locked vars: 0 Function: umlAutostartConfigs - Total exit points with locked vars: 0 Function: umlIdentifyOneChrPTY - Total exit points with locked vars: 0 Function: umlIdentifyChrPTY - Total exit points with locked vars: 0 Function: umlInotifyEvent - Total exit points with locked vars: 3 - Locked vars at exit #line 232 "uml_driver.c" return; ^^^^^^^^^ Var: dom 30814 - Locked vars at exit #line 239 return; ^^^^^^^^^ Var: dom 30814 - Locked vars at exit #line 283 return; ^^^^^^^^^ Var: dom 30814 Function: umlStartup - Total exit points with locked vars: 0 Function: umlReload - Total exit points with locked vars: 0 Function: umlActive - Total exit points with locked vars: 0 Function: umlShutdown - Total exit points with locked vars: 0 Function: umlReadPidFile - Total exit points with locked vars: 0 Function: umlMonitorAddress - Total exit points with locked vars: 0 Function: umlOpenMonitor - Total exit points with locked vars: 0 Function: umlMonitorCommand - Total exit points with locked vars: 0 Function: umlStartVMDaemon - Total exit points with locked vars: 0 Function: umlShutdownVMDaemon - Total exit points with locked vars: 0 Function: umlOpen - Total exit points with locked vars: 0 Function: umlClose - Total exit points with locked vars: 0 Function: umlGetType - Total exit points with locked vars: 0 Function: umlGetNodeInfo - Total exit points with locked vars: 0 Function: umlGetCapabilities - Total exit points with locked vars: 0 Function: umlNodeGetCellsFreeMemory - Total exit points with locked vars: 0 Function: umlNodeGetFreeMemory - Total exit points with locked vars: 0 Function: umlGetProcessInfo - Total exit points with locked vars: 0 Function: umlDomainLookupByID - Total exit points with locked vars: 0 Function: umlDomainLookupByUUID - Total exit points with locked vars: 0 Function: umlDomainLookupByName - Total exit points with locked vars: 0 Function: umlGetVersion - Total exit points with locked vars: 0 Function: umlGetHostname - Total exit points with locked vars: 0 Function: umlListDomains - Total exit points with locked vars: 0 Function: umlNumDomains - Total exit points with locked vars: 0 Function: umlDomainCreate - Total exit points with locked vars: 0 Function: umlDomainShutdown - Total exit points with locked vars: 0 Function: umlDomainDestroy - Total exit points with locked vars: 0 Function: umlDomainGetOSType - Total exit points with locked vars: 0 Function: umlDomainGetMaxMemory - Total exit points with locked vars: 0 Function: umlDomainSetMaxMemory - Total exit points with locked vars: 0 Function: umlDomainSetMemory - Total exit points with locked vars: 0 Function: umlDomainGetInfo - Total exit points with locked vars: 0 Function: umlDomainDumpXML - Total exit points with locked vars: 0 Function: umlListDefinedDomains - Total exit points with locked vars: 0 Function: umlNumDefinedDomains - Total exit points with locked vars: 0 Function: umlDomainStart - Total exit points with locked vars: 0 Function: umlDomainDefine - Total exit points with locked vars: 0 Function: umlDomainUndefine - Total exit points with locked vars: 0 Function: umlDomainGetAutostart - Total exit points with locked vars: 0 Function: umlDomainSetAutostart - Total exit points with locked vars: 0 Function: umlDomainBlockPeek - Total exit points with locked vars: 0 Function: umlRegister - Total exit points with locked vars: 0 Function: lxcDriverLock - Total exit points with locked vars: 0 Function: lxcDriverUnlock - Total exit points with locked vars: 0 Function: lxcProbe - Total exit points with locked vars: 0 Function: lxcOpen - Total exit points with locked vars: 0 Function: lxcClose - Total exit points with locked vars: 0 Function: lxcDomainLookupByID - Total exit points with locked vars: 0 Function: lxcDomainLookupByUUID - Total exit points with locked vars: 0 Function: lxcDomainLookupByName - Total exit points with locked vars: 0 Function: lxcListDomains - Total exit points with locked vars: 0 Function: lxcNumDomains - Total exit points with locked vars: 0 Function: lxcListDefinedDomains - Total exit points with locked vars: 0 Function: lxcNumDefinedDomains - Total exit points with locked vars: 0 Function: lxcDomainDefine - Total exit points with locked vars: 0 Function: lxcDomainUndefine - Total exit points with locked vars: 0 Function: lxcDomainGetInfo - Total exit points with locked vars: 0 Function: lxcGetOSType - Total exit points with locked vars: 0 Function: lxcDomainDumpXML - Total exit points with locked vars: 0 Function: lxcVMCleanup - Total exit points with locked vars: 0 Function: lxcSetupInterfaces - Total exit points with locked vars: 0 Function: lxcMonitorClient - Total exit points with locked vars: 0 Function: lxcVmTerminate - Total exit points with locked vars: 0 Function: lxcMonitorEvent - Total exit points with locked vars: 0 Function: lxcControllerStart - Total exit points with locked vars: 0 Function: lxcVmStart - Total exit points with locked vars: 0 Function: lxcDomainStart - Total exit points with locked vars: 0 Function: lxcDomainCreateAndStart - Total exit points with locked vars: 0 Function: lxcDomainShutdown - Total exit points with locked vars: 0 Function: lxcDomainDestroy - Total exit points with locked vars: 0 Function: lxcCheckNetNsSupport - Total exit points with locked vars: 0 Function: lxcStartup - Total exit points with locked vars: 0 Function: lxcShutdown - Total exit points with locked vars: 0 Function: lxcActive - Total exit points with locked vars: 0 Function: lxcVersion - Total exit points with locked vars: 0 Function: lxcGetSchedulerType - Total exit points with locked vars: 0 Function: lxcSetSchedulerParameters - Total exit points with locked vars: 0 Function: lxcGetSchedulerParameters - Total exit points with locked vars: 0 Function: lxcRegister - Total exit points with locked vars: 0 Function: openvzDriverLock - Total exit points with locked vars: 0 Function: openvzDriverUnlock - Total exit points with locked vars: 0 Function: openvzDomainDefineCmd - Total exit points with locked vars: 0 Function: openvzDomainLookupByID - Total exit points with locked vars: 0 Function: openvzGetVersion - Total exit points with locked vars: 0 Function: openvzGetOSType - Total exit points with locked vars: 0 Function: openvzDomainLookupByUUID - Total exit points with locked vars: 0 Function: openvzDomainLookupByName - Total exit points with locked vars: 0 Function: openvzDomainGetInfo - Total exit points with locked vars: 0 Function: openvzDomainDumpXML - Total exit points with locked vars: 0 Function: openvzSetProgramSentinal - Total exit points with locked vars: 0 Function: openvzDomainShutdown - Total exit points with locked vars: 0 Function: openvzDomainReboot - Total exit points with locked vars: 0 Function: openvzGenerateVethName - Total exit points with locked vars: 0 Function: openvzGenerateContainerVethName - Total exit points with locked vars: 0 Function: openvzDomainSetNetwork - Total exit points with locked vars: 0 Function: openvzDomainSetNetworkConfig - Total exit points with locked vars: 0 Function: openvzDomainDefineXML - Total exit points with locked vars: 0 Function: openvzDomainCreateXML - Total exit points with locked vars: 0 Function: openvzDomainCreate - Total exit points with locked vars: 0 Function: openvzDomainUndefine - Total exit points with locked vars: 0 Function: openvzDomainSetAutostart - Total exit points with locked vars: 0 Function: openvzDomainGetAutostart - Total exit points with locked vars: 0 Function: openvzGetMaxVCPUs - Total exit points with locked vars: 0 Function: openvzDomainGetMaxVcpus - Total exit points with locked vars: 0 Function: openvzDomainSetVcpus - Total exit points with locked vars: 0 Function: openvzProbe - Total exit points with locked vars: 0 Function: openvzOpen - Total exit points with locked vars: 0 Function: openvzClose - Total exit points with locked vars: 0 Function: openvzGetType - Total exit points with locked vars: 0 Function: openvzGetNodeInfo - Total exit points with locked vars: 0 Function: openvzGetCapabilities - Total exit points with locked vars: 0 Function: openvzListDomains - Total exit points with locked vars: 0 Function: openvzNumDomains - Total exit points with locked vars: 0 Function: openvzListDefinedDomains - Total exit points with locked vars: 0 Function: openvzGetProcessInfo - Total exit points with locked vars: 0 Function: openvzNumDefinedDomains - Total exit points with locked vars: 0 Function: openvzRegister - Total exit points with locked vars: 0 Function: testDriverLock - Total exit points with locked vars: 0 Function: testDriverUnlock - Total exit points with locked vars: 0 Function: testBuildCapabilities - Total exit points with locked vars: 0 Function: testOpenDefault - Total exit points with locked vars: 0 Function: testBuildFilename - Total exit points with locked vars: 0 Function: testOpenFromFile - Total exit points with locked vars: 0 Function: testOpen - Total exit points with locked vars: 0 Function: testClose - Total exit points with locked vars: 0 Function: testGetVersion - Total exit points with locked vars: 0 Function: testGetHostname - Total exit points with locked vars: 0 Function: testGetMaxVCPUs - Total exit points with locked vars: 0 Function: testNodeGetInfo - Total exit points with locked vars: 0 Function: testGetCapabilities - Total exit points with locked vars: 0 Function: testNumOfDomains - Total exit points with locked vars: 0 Function: testDomainCreateXML - Total exit points with locked vars: 0 Function: testLookupDomainByID - Total exit points with locked vars: 0 Function: testLookupDomainByUUID - Total exit points with locked vars: 0 Function: testLookupDomainByName - Total exit points with locked vars: 0 Function: testListDomains - Total exit points with locked vars: 0 Function: testDestroyDomain - Total exit points with locked vars: 0 Function: testResumeDomain - Total exit points with locked vars: 0 Function: testPauseDomain - Total exit points with locked vars: 0 Function: testShutdownDomain - Total exit points with locked vars: 0 Function: testRebootDomain - Total exit points with locked vars: 0 Function: testGetDomainInfo - Total exit points with locked vars: 0 Function: testDomainSave - Total exit points with locked vars: 0 Function: testDomainRestore - Total exit points with locked vars: 0 Function: testDomainCoreDump - Total exit points with locked vars: 0 Function: testGetOSType - Total exit points with locked vars: 0 Function: testGetMaxMemory - Total exit points with locked vars: 0 Function: testSetMaxMemory - Total exit points with locked vars: 0 Function: testSetMemory - Total exit points with locked vars: 0 Function: testSetVcpus - Total exit points with locked vars: 0 Function: testDomainDumpXML - Total exit points with locked vars: 0 Function: testNumOfDefinedDomains - Total exit points with locked vars: 0 Function: testListDefinedDomains - Total exit points with locked vars: 0 Function: testDomainDefineXML - Total exit points with locked vars: 0 Function: testNodeGetCellsFreeMemory - Total exit points with locked vars: 0 Function: testDomainCreate - Total exit points with locked vars: 0 Function: testDomainUndefine - Total exit points with locked vars: 0 Function: testDomainGetAutostart - Total exit points with locked vars: 0 Function: testDomainSetAutostart - Total exit points with locked vars: 0 Function: testDomainGetSchedulerType - Total exit points with locked vars: 0 Function: testDomainGetSchedulerParams - Total exit points with locked vars: 0 Function: testDomainSetSchedulerParams - Total exit points with locked vars: 0 Function: testOpenNetwork - Total exit points with locked vars: 0 Function: testCloseNetwork - Total exit points with locked vars: 0 Function: testLookupNetworkByUUID - Total exit points with locked vars: 0 Function: testLookupNetworkByName - Total exit points with locked vars: 0 Function: testNumNetworks - Total exit points with locked vars: 0 Function: testListNetworks - Total exit points with locked vars: 0 Function: testNumDefinedNetworks - Total exit points with locked vars: 0 Function: testListDefinedNetworks - Total exit points with locked vars: 0 Function: testNetworkCreate - Total exit points with locked vars: 0 Function: testNetworkDefine - Total exit points with locked vars: 0 Function: testNetworkUndefine - Total exit points with locked vars: 0 Function: testNetworkStart - Total exit points with locked vars: 0 Function: testNetworkDestroy - Total exit points with locked vars: 0 Function: testNetworkDumpXML - Total exit points with locked vars: 0 Function: testNetworkGetBridgeName - Total exit points with locked vars: 0 Function: testNetworkGetAutostart - Total exit points with locked vars: 0 Function: testNetworkSetAutostart - Total exit points with locked vars: 0 Function: testStoragePoolObjSetDefaults - Total exit points with locked vars: 0 Function: testStorageOpen - Total exit points with locked vars: 0 Function: testStorageClose - Total exit points with locked vars: 0 Function: testStoragePoolLookupByUUID - Total exit points with locked vars: 0 Function: testStoragePoolLookupByName - Total exit points with locked vars: 0 Function: testStoragePoolLookupByVolume - Total exit points with locked vars: 0 Function: testStorageNumPools - Total exit points with locked vars: 0 Function: testStorageListPools - Total exit points with locked vars: 0 Function: testStorageNumDefinedPools - Total exit points with locked vars: 0 Function: testStorageListDefinedPools - Total exit points with locked vars: 0 Function: testStoragePoolStart - Total exit points with locked vars: 0 Function: testStorageFindPoolSources - Total exit points with locked vars: 0 Function: testStoragePoolCreate - Total exit points with locked vars: 1 - Locked vars at exit #line 2396 "test.c" return ((virStoragePool *)((void *)0)); ^^^^^^^^^ Var: privconn 73413 Function: testStoragePoolDefine - Total exit points with locked vars: 0 Function: testStoragePoolUndefine - Total exit points with locked vars: 0 Function: testStoragePoolBuild - Total exit points with locked vars: 0 Function: testStoragePoolDestroy - Total exit points with locked vars: 0 Function: testStoragePoolDelete - Total exit points with locked vars: 0 Function: testStoragePoolRefresh - Total exit points with locked vars: 0 Function: testStoragePoolGetInfo - Total exit points with locked vars: 0 Function: testStoragePoolDumpXML - Total exit points with locked vars: 0 Function: testStoragePoolGetAutostart - Total exit points with locked vars: 0 Function: testStoragePoolSetAutostart - Total exit points with locked vars: 0 Function: testStoragePoolNumVolumes - Total exit points with locked vars: 0 Function: testStoragePoolListVolumes - Total exit points with locked vars: 0 Function: testStorageVolumeLookupByName - Total exit points with locked vars: 0 Function: testStorageVolumeLookupByKey - Total exit points with locked vars: 0 Function: testStorageVolumeLookupByPath - Total exit points with locked vars: 0 Function: testStorageVolumeCreateXML - Total exit points with locked vars: 0 Function: testStorageVolumeDelete - Total exit points with locked vars: 0 Function: testStorageVolumeTypeForPool - Total exit points with locked vars: 0 Function: testStorageVolumeGetInfo - Total exit points with locked vars: 0 Function: testStorageVolumeGetXMLDesc - Total exit points with locked vars: 0 Function: testStorageVolumeGetPath - Total exit points with locked vars: 0 Function: testDevMonOpen - Total exit points with locked vars: 0 Function: testDevMonClose - Total exit points with locked vars: 0 Function: testRegister - Total exit points with locked vars: 0 Function: networkDriverLock - Total exit points with locked vars: 0 Function: networkDriverUnlock - Total exit points with locked vars: 0 Function: networkAutostartConfigs - Total exit points with locked vars: 0 Function: networkStartup - Total exit points with locked vars: 0 Function: networkReload - Total exit points with locked vars: 0 Function: networkActive - Total exit points with locked vars: 0 Function: networkShutdown - Total exit points with locked vars: 0 Function: networkBuildDnsmasqArgv - Total exit points with locked vars: 0 Function: networkAddMasqueradingIptablesRules - Total exit points with locked vars: 0 Function: networkAddRoutingIptablesRules - Total exit points with locked vars: 0 Function: networkAddIptablesRules - Total exit points with locked vars: 0 Function: networkRemoveIptablesRules - Total exit points with locked vars: 0 Function: networkEnableIpForwarding - Total exit points with locked vars: 0 Function: networkStartNetworkDaemon - Total exit points with locked vars: 0 Function: networkShutdownNetworkDaemon - Total exit points with locked vars: 0 Function: networkLookupByUUID - Total exit points with locked vars: 0 Function: networkLookupByName - Total exit points with locked vars: 0 Function: networkOpenNetwork - Total exit points with locked vars: 0 Function: networkCloseNetwork - Total exit points with locked vars: 0 Function: networkNumNetworks - Total exit points with locked vars: 0 Function: networkListNetworks - Total exit points with locked vars: 0 Function: networkNumDefinedNetworks - Total exit points with locked vars: 0 Function: networkListDefinedNetworks - Total exit points with locked vars: 0 Function: networkCreate - Total exit points with locked vars: 0 Function: networkDefine - Total exit points with locked vars: 0 Function: networkUndefine - Total exit points with locked vars: 0 Function: networkStart - Total exit points with locked vars: 0 Function: networkDestroy - Total exit points with locked vars: 0 Function: networkDumpXML - Total exit points with locked vars: 0 Function: networkGetBridgeName - Total exit points with locked vars: 0 Function: networkGetAutostart - Total exit points with locked vars: 0 Function: networkSetAutostart - Total exit points with locked vars: 0 Function: networkRegister - Total exit points with locked vars: 0 Function: nodeDeviceLock - Total exit points with locked vars: 0 Function: nodeDeviceUnlock - Total exit points with locked vars: 0 Function: nodeNumOfDevices - Total exit points with locked vars: 0 Function: nodeListDevices - Total exit points with locked vars: 0 Function: nodeDeviceLookupByName - Total exit points with locked vars: 0 Function: nodeDeviceDumpXML - Total exit points with locked vars: 0 Function: nodeDeviceGetParent - Total exit points with locked vars: 0 Function: nodeDeviceNumOfCaps - Total exit points with locked vars: 0 Function: nodeDeviceListCaps - Total exit points with locked vars: 0 Function: nodedevRegister - Total exit points with locked vars: 0 Function: nodeDeviceWatchFree - Total exit points with locked vars: 0 Function: storageDriverLock - Total exit points with locked vars: 0 Function: storageDriverUnlock - Total exit points with locked vars: 0 Function: storageDriverAutostart - Total exit points with locked vars: 0 Function: storageDriverStartup - Total exit points with locked vars: 0 Function: storageDriverReload - Total exit points with locked vars: 0 Function: storageDriverActive - Total exit points with locked vars: 0 Function: storageDriverShutdown - Total exit points with locked vars: 0 Function: storagePoolLookupByUUID - Total exit points with locked vars: 0 Function: storagePoolLookupByName - Total exit points with locked vars: 0 Function: storagePoolLookupByVolume - Total exit points with locked vars: 0 Function: storageOpen - Total exit points with locked vars: 0 Function: storageClose - Total exit points with locked vars: 0 Function: storageNumPools - Total exit points with locked vars: 0 Function: storageListPools - Total exit points with locked vars: 0 Function: storageNumDefinedPools - Total exit points with locked vars: 0 Function: storageListDefinedPools - Total exit points with locked vars: 0 Function: storageFindPoolSources - Total exit points with locked vars: 0 Function: storagePoolCreate - Total exit points with locked vars: 0 Function: storagePoolDefine - Total exit points with locked vars: 0 Function: storagePoolUndefine - Total exit points with locked vars: 0 Function: storagePoolStart - Total exit points with locked vars: 0 Function: storagePoolBuild - Total exit points with locked vars: 0 Function: storagePoolDestroy - Total exit points with locked vars: 0 Function: storagePoolDelete - Total exit points with locked vars: 0 Function: storagePoolRefresh - Total exit points with locked vars: 0 Function: storagePoolGetInfo - Total exit points with locked vars: 0 Function: storagePoolDumpXML - Total exit points with locked vars: 0 Function: storagePoolGetAutostart - Total exit points with locked vars: 0 Function: storagePoolSetAutostart - Total exit points with locked vars: 0 Function: storagePoolNumVolumes - Total exit points with locked vars: 0 Function: storagePoolListVolumes - Total exit points with locked vars: 0 Function: storageVolumeLookupByName - Total exit points with locked vars: 0 Function: storageVolumeLookupByKey - Total exit points with locked vars: 0 Function: storageVolumeLookupByPath - Total exit points with locked vars: 0 Function: storageVolumeCreateXML - Total exit points with locked vars: 0 Function: storageVolumeDelete - Total exit points with locked vars: 0 Function: storageVolumeGetInfo - Total exit points with locked vars: 0 Function: storageVolumeGetXMLDesc - Total exit points with locked vars: 0 Function: storageVolumeGetPath - Total exit points with locked vars: 0 Function: storageRegister - Total exit points with locked vars: 0 There was one false positive there qemuDomainEventDispatchFunc which is defined to expect a locked input & output, thus violating the assumptions in my program Oh, and it'll dump .dot files for the control flow graphs which you can view with 'dotty' Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|