Cally is a tool that uses GCC's Register Transfer Language (RTL) files to build a caller or callee call graphs for C projects.

It uses the same concepts as the egypt tool, however, this tool is not useful for large projects. The dot file processed by Graphviz will result in a single dark blur image.

Cally either builds a tree for the given function down, i.e. what functions are being called by this given function. Or it builds a tree resulting in the paths that lead to the given function to be called. If none is requested it will build a full map just like egypt.

In addition, it has options to specify the maximum tree depth, and/or a regular expression for functions to exclude.

NOTE: Cally does NOT support indirect function calls!

For the program (or files) you want the generate the GCC RTL data all you have to do is add the -fdump-rtl-expand option. For simple main.c based project:

$ gcc -fdump-rtl-expand main.c
$ ls
a.out  main.c  main.c.229r.expand

usage: cally.py [-h] [-d] [-f [FUNCTION]] [--callee FUNCTION]
                [--caller FUNCTION] [-e REGEX] [--no-externs] [--no-warnings]
                [--max-depth DEPTH]
                RTLFILE [RTLFILE ...]

positional arguments:
  RTLFILE               GCCs RTL .expand file

optional arguments:
  -h, --help            show this help message and exit
  -d, --debug           Enable debugging
  -f [FUNCTION], --functions [FUNCTION]
                        Dump functions name(s)
  --callee FUNCTION     Callgraph for function being called
  --caller FUNCTION     Callgraph for functions being called by
  -e REGEX, --exclude REGEX
                        RegEx for functions to exclude
  --no-externs          Do not show external functions
  --no-warnings         Do not show warnings on console
  --max-depth DEPTH     Maximum tree depth traversal, default no depth

If the --callee or --caller option is not supplied, only one can be given at a time, the full call graph is generated.

The examples below are based on the source code of the Open vSwitch project. To checkout, and build this project including the RTL files do the following:

$ git clone https://github.com/openvswitch/ovs.git ovs_cally
Cloning into 'ovs_cally'...
remote: Counting objects: 127897, done.
remote: Total 127897 (delta 0), reused 0 (delta 0), pack-reused 127896
Receiving objects: 100% (127897/127897), 65.36 MiB | 6.16 MiB/s, done.
Resolving deltas: 100% (102051/102051), done.

$ cd ovs_cally/

$ ./boot.sh
libtoolize: putting auxiliary files in AC_CONFIG_AUX_DIR, 'build-aux'.
libtoolize: copying file 'build-aux/ltmain.sh'
...
...

$ ./configure
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
...
...

$ make -j `nproc` CFLAGS="`sed -n 's/^ *CFLAGS *= *//p' Makefile` -fdump-rtl-expand"
 cd . && /bin/sh /home/echaudro/Documents/Scratch/ovs_cally/build-aux/missing automake-1.15 --foreign Makefile
 cd . && /bin/sh ./config.status Makefile depfiles
...
...
make[2]: Leaving directory '/home/echaudro/Documents/Scratch/ovs_cally'
make[1]: Leaving directory '/home/echaudro/Documents/Scratch/ovs_cally'

NOTE: Sometimes you are interested in seeing the static functions. You can get them by adding the following additional options -fno-inline-functions -O0. But be warned that this might make the graph messy. You could first start by removing the external functions --no-externs. If this is still too much, limit the depth of the graph.

Below is the complete call graph for a single file from the Open vSwitch repository. The first picture was generated from RTL files which had the -fno-inline-functions -O0 options added, the second one without:

$ cally.py ./lib/dpif-netlink-rtnl.c.229r.expand | \
    dot -Grankdir=LR -Tpng -o full_call_graph.png

With -fno-inline-functions -O0 it's showing the static functions:

Without -fno-inline-functions -O0 there are no static functions:

NOTE: The dashed nodes in the graph are external functions, i.e. not defined in any of the RTL files given. If you would like to exclude them from the graph you can use the --no-externs option.

This example will create a full call graph with all functions being called by miniflow_extract():

$ find . -name *.expand | xargs cally.py --caller miniflow_extract | \
    dot -Grankdir=LR -Tpng -o full_caller.png

NOTE: Use | dot -Grankdir=LR -Tpdf -o callgraph.pdf to create a searchable PDF document.

This example will create a call graph for miniflow_extract() with a maximum depth of 6, and with ds_*() and write() functions removed:

$ find . -name *.expand | xargs cally.py --caller miniflow_extract --max-depth 6 \
    --exclude "ds_.*|write" | dot -Grankdir=LR -Tpng -o limited_caller.png

NOTE: The red nodes in the graph represents nodes which had calls removed due to either the --max-depth, --exclude or --no-externs options.

This example will create a full callee graph with all functions calling bond_active_slave_changed():

$ find . -name *.expand | xargs cally.py --callee bond_active_slave_changed  | \
    dot -Grankdir=LR -Tpng -o full_callee.png

Creating a full callee graph for miniflow_extract() will be possible but is not very practical. The example below will limit the path depth to 5 levels, which is enough to get the picture :)

$ find . -name *.expand | xargs cally.py --callee miniflow_extract \
    --max-depth 5 | dot -Grankdir=LR -Tpng -o limited_callee.png