How to Generate a Call Graph for C Code Using LLVM?

Generating a Call Graph for C Code

To uncover potential execution paths for a specific function, particularly when manual identification is impractical, it is useful to generate a call graph.

Creating a Call Graph Using LLVM:

To construct a call graph using LLVM (Low-Level Virtual Machine), follow these steps:

1. Compile the C code with the -emit-llvm option to generate LLVM assembly:

   clang++ -S -emit-llvm main.cpp -o -

2. Analyze the assembly using the opt tool with the -analyze flag:

   opt -analyze main.ll

3. Generate a DOT file representing the call graph:

   opt -analyze -dot-callgraph main.ll

4. Convert the DOT file to an image format using Graphviz:

   dot -Tpng -o callgraph.png callgraph.dot

This process will produce a visual representation of the call graph, showing all paths leading to the target function.

Example:

Consider the following C code:

static void D() { }
static void Y() { D(); }
static void X() { Y(); }
static void C() { D(); X(); }
static void B() { C(); }
static void S() { D(); }
static void P() { S(); }
static void O() { P(); }
static void N() { O(); }
static void M() { N(); }
static void G() { M(); }
static void A() { B(); G(); }

int main() {
  A();
}

Using the steps outlined above, we can generate a call graph that reveals all possible paths through which D() can be called.

Additional Considerations:

• For complex codebases with numerous call paths, it may be necessary to post-process the DOT file using tools like c filt to obtain human-readable function names.
• By default, opt will assume the presence of an external function, which can be filtered out or renamed for clarity.
• Ensure that the target function is not inlined to accurately capture the call hierarchy.

The above is the detailed content of How to Generate a Call Graph for C Code Using LLVM?. For more information, please follow other related articles on the PHP Chinese website!