[llvm-dev] Find targets of indirect call sites

Ronny Chevalier via llvm-dev llvm-dev at lists.llvm.org
Sun Apr 3 04:50:12 PDT 2016

On 02/04/2016 16:14, Syed Rafiul Hussain via llvm-dev wrote:
> Hi,


> I would like to find the targets of indirect callsties. The callsite
> and the targets may be located in different functions or in different
> modules.

LLVM does not provide such feature.

> Any hint or suggestion would be much appreciated.

You could use the poolalloc project [1]. It includes DSA which allows to
find a list a potential targets of an indirect call. It is worth noting,
however, that such process is an over-approximation, and can be
sometimes incomplete (e.g. indirect call to another module, loss of

Also, John Criswell mentioned multiple issues [2] regarding the loss of
precision of DSA, because of assumptions it made on the LLVM IR when it
was originally written.llvm

Anyway, I managed to make the current version of poolalloc works with
LLVM 3.7, and some minor patches (but I think DSA can be built on its
own without modifications).

[1] https://github.com/llvm-mirror/poolalloc
[2] http://lists.llvm.org/pipermail/llvm-dev/2015-May/085359.html

More information about the llvm-dev mailing list