Generate analyse traces
This page describes the processes and commands used to generate LLTFI instruction traces, as well as how to use the LLTFI tool set to analyse traces. The instruction trace is the dumped runtime value of all instructions in the provided program.
The first step required is to run the instrument/profile/injectfault script on your target program with the -tracingPropagation option within the input.yaml file. Detailed options are listed in the bin/intput_masterlist.yaml file.
This will tell the LLTFI to modify the LLVM IR of your target program, inserting function calls to output tracing information every time an instruction executes.
After the injectfault script has completed, the llfi generated directories will contain a single "Golden Trace" and a series of "Faulty Traces" depending on what options you specified in input.yaml. The "Golden Trace" exists in the baseline/ directory, and the "Faulty Traces" exist in the llfi_stat_output/ directory.
Below are examples of two traces: the first is golden trace, and the second is faulty trace.
LLTFI provides a few tools, in the form of python scripts to analyse program traces. They are:
1). tracediff: This script will take as input 1 golden trace file, and 1 faulty trace file and output to stdout a compacted summary of the differences of fault injection trace from golden trace, separated into Data and Control Differences. A Data difference is where the same instruction executes at the same time in both the golden and faulty traces, but its value is different. A Control difference is where the fault injection run's program runtime control flow deviates from golden run.
tracediff [goldenTraceFile] [faultyTraceFile] > [traceDiffReportFile]
Below is the trace difference summary generated by comparing the two trace files above.
2). traceunion: This script will take as input 2 or more trace report files generated by tracediff or traceunion. This script will output to stdout the union of the provided trace difference reports, adding traces together by fault injection location and Difference Data
traceunion [diffReport1] [diffReport2] .. [diffReportN] > [UnitedDiffReportFile]
3). traceontograph: This script will take as input 1 difference report file, as generated by tracediff or traceunion, as well as a dot format graph generated by the -llfiDotGraph pass (specify generateCDFG: True as tracingPropagationOption in input.yaml ). This script will output to stdout a dot format graph similar to its input, but with the tracing information applied to it. This updated graph will show where and how faults propagated.
traceontograph [diffReportFile] [graphFile.dot] > [tracedGraph.dot]
You can visualize the resulting dot graph file with AT&T's Graphviz software. We recommend using the ZGRViewer package though for a better user experience.
Below is the control-data-flow graph (CDFG) with difference report applied to it and visualized using GraphViz: the first is the CDFG, and the second is the CDFG with difference report applied to it.
