A CIL Tutorial - Department of Computer Science - ETH Zürich

Chapter 13
Whole-program Analysis
CIL has a simple mechanism for allowing whole-program analysis. This mechanism is invoked when
the --merge switch is passed to ciltutcc. First, in the compilation phase, instead of compiling
source code to an object le with the back-end compiler, the emitted .o le will contain the preprocessed
source. Then, in the link stage, ciltutcc parses the .o les, and uses the CIL Mergecil
module to combine the separate source les into a single Cil.file. More details of this process can
be found in the ocial CIL documentation.
13.1 tut13.ml
In this tutorial, we'll see how to compute a whole-program call graph. The code in thie module is very
simple since there is already a pretty good module for computing call graphs in cil/src/ext/callgraph.ml.
Additionally, we'll use the ocamlgraph library to output a .dot le, which can be used to generate
an image of the call-graph.
module H = Hashtbl
module CG = Callgraph
This module uses the Ocamlgraph library, which must be installed to build the code for this tutorial.
Here, we use its functorial interface to dene a module for functions on a graph type that mirrors
the graph we get back from the Callgraph module.
module SG = Graph.Imperative.Digraph.ConcreteBidirectional(struct
(∗ ... ∗)
end)
We'll also need to dene a module that extends the graph module above with functions to dene
properties of vertices used by Dot to draw the graph. We'll just use the defaults. These functions
can be modied to add more information to the graph.
110