diff --git a/chapters/03_background/03_03_fail.tex b/chapters/03_background/03_03_fail.tex index bf7167f..6ac933b 100644 --- a/chapters/03_background/03_03_fail.tex +++ b/chapters/03_background/03_03_fail.tex @@ -6,17 +6,51 @@ \section{Fault-Injection Leveraged}\label{sec:fail} -\begin{itemize} - \item FAIL*~\autocite{schirmeierFAILOpenVersatile2015} architecture - \item FailBochs backend, how does FAIL* inject - \item FAIL*'s generic-experiment - \item How to perform a FAIL* experiment -\end{itemize} - \Gls{fail}~\autocite{schirmeierFAILOpenVersatile2015} is an emulation-based vulnerability analysis tool. It provides a toolset to perform \gls{fi} experiments to analyze the vulnerability of software to transient hardware faults. -In contrast to other \gls{fi} tools, \Gls{fail} enables deep simulator state access while simultaneously supporting multiple simulator backends, like BOCHS~\autocite{bochs} or gem5\footnote{\url[2026-07-02]{https://www.gem5.org/}}. % TODO: Give examples for other FI frameworks +In contrast to other \gls{fi} tools\todo{give examples}, \Gls{fail} enables deep simulator state access while simultaneously supporting multiple simulator backends, like BOCHS~\autocite{bochs} or gem5\footnote{\url[2026-07-02]{https://www.gem5.org/}}. -% FAIL components/structure/architecture +\Gls{fail} is split into different components: A \textit{campaign} consists of multiple \gls{fi} \textit{experiments}, where each experiment injects a single fault. +The \textit{campaign controller} distributes those experiments to running \Gls{fail} instances. +Campaigns can be parallelized by running multiple instances on different systems or cores. +Each experiment utilizes \Gls{fail}'s \textit{simulator abstraction layer} to control the target backend, to fast-forward the target to the desired state and inject a fault. +This abstraction layer allows switching out backends to support different target platforms. + +To perform a vulnerability analysis, the examined program needs to be instrumented with fences that define the region to trace (see \autoref{lst:tracefencemarkers}). +\begin{codeblock}[label=lst:tracefencemarkers]{Trace Region Fence}{.cpp} + \inputminted{cpp}{\subfix{listings/tracefence.cpp}} +\end{codeblock} +\Gls{fail} then records the instruction pointer changes and memory accesses inside this region during the so-called \textquote{golden run}: a faultless execution of the program that determines which injections should be performed during the campaign. +Then, the golden run is enriched with the traced region's disassembly to take into account the read and written registers. +The last step before campaign execution is the \textit{prune} step, where the collected data is translated into corresponding experiments. +Different data points from the trace that result in the same \textquote{fault-similarity class} (as used by Schirmeier~\autocite{schirmeierEfficientFaultInjectionbasedAssessment}) are removed from the campaign. +Two experiments belong to the same similarity class if the \textit{relevant} parts of their resulting simulator state are identical. +From the pruned instruction pointer changes, memory accesses, and register accesses \Gls{fail} constructs a number of \textit{pilots}: representatives of the existing fault-similarity classes. +Each pilot then corresponds to a single experiment. + +\Gls{fail}'s campaigns are event-driven: the user specifies conditions, for example an access to a certain memory region. +Once a condition is reached, a user-defined action is performed, like injecting a fault or registering a certain experiment outcome. +Users do not have to write every campaign from scratch, as \Gls{fail} includes a \textquote{generic experiment} which can be used as a starting point. +The generic experiment performs three types of fault injections by default: +\begin{itemize} + \item \sansbf{Memory} injections: Before the program reads from a memory address, a fault is injected. + \item \sansbf{Register} injections: Before the program reads from a register, a fault is injected. + \item \sansbf{Instruction Pointer} injections: The instruction pointer's value is randomized to disturb the program flow and introduce random jumps. +\end{itemize} +Furthermore, different experiment outcomes are classified: +\begin{itemize} + \item \sansbf{Trap}: The injected fault caused the simulated CPU to throw an exception. + \item \sansbf{Timeout}: The injected fault caused the program to stall. + \item \sansbf{Ok Marker} (\code{fail\_marker\_positive()}): The program executed correctly even with the injected fault. + \item \sansbf{Detected Marker} (\code{fail\_marker\_detected()}): The injected fault was detected by the program. + \item \sansbf{Fail Marker} (\code{fail\_marker\_negative()}): The injected fault was not detected by the program. + \item \sansbf{Access Outerspace}: Caught if the program reads or writes anywhere outside valid ELF addresses. + \item \sansbf{Write Textsegment}: Caught if the program writes to addresses inside the \code{.text} section of the program. +\end{itemize} +Ok/Detected/Fail outcomes are classified by instrumenting the tested code with \textquote{markers} (see \autoref{lst:classificationmarkers}). +If the program execution passes a marker, the experiment outcome is classified accordingly. +\begin{codeblock}[label=lst:classificationmarkers]{Classification Markers}{.cpp} + \inputminted{cpp}{\subfix{listings/classificationmarkers.cpp}} +\end{codeblock} \end{document} diff --git a/chapters/03_background/listings/classificationmarkers.cpp b/chapters/03_background/listings/classificationmarkers.cpp new file mode 100644 index 0000000..9f95e84 --- /dev/null +++ b/chapters/03_background/listings/classificationmarkers.cpp @@ -0,0 +1,6 @@ +// Continuation of previous example +if (sum == 100) { + fail_marker_positive(); +} else { + fail_marker_negative(); +} diff --git a/chapters/03_background/listings/tracefence.cpp b/chapters/03_background/listings/tracefence.cpp new file mode 100644 index 0000000..3c17b39 --- /dev/null +++ b/chapters/03_background/listings/tracefence.cpp @@ -0,0 +1,8 @@ +fail_start_trace(); + +int sum = 0; +for (int i = 0; i < 100; ++i) { + ++sum; +} + +fail_stop_trace(); diff --git a/chapters/examples/examples.tex b/chapters/examples/examples.tex index 83a0902..f492a0d 100644 --- a/chapters/examples/examples.tex +++ b/chapters/examples/examples.tex @@ -13,6 +13,9 @@ This is \code{inline code}. This is a reference to \Gls{fail}. This is another reference to \Gls{fail}. This is a citation~\autocite{polednaReplicaDeterminismDistributed1994}. + +\section{This is a section}\label{sec:examplesection} + This is a reference to \autoref{ch:introduction}. This is a formula: \( \sum\limits_{f=1}^{\infty}\frac{o}{r}\cdot m_{u} + l^{a} \). This is \textbf{bold text that is slightly bold}, so underwhelming. @@ -24,12 +27,20 @@ In contrast, \sansbf{this text is very strong}, very cool\footnote{very cool}. \begin{figure}[H] \centering - \begin{subfigure}[b]{0.55\textwidth} + \begin{subfigure}[b]{0.85\textwidth} \includesvg[width=1.0\linewidth]{\subfix{figures/example.svg}} \end{subfigure} \caption{This is a figure.}\label{fig:examplefigure} \end{figure} +\begin{figure}[H] + \centering + \begin{subfigure}[b]{0.95\textwidth} + \includesvg[width=1.0\linewidth]{\subfix{figures/heatmap2.svg}} + \end{subfigure} + \caption{This is another figure.}\label{fig:exampleheatmap} +\end{figure} + \lipsum% \end{document} diff --git a/chapters/examples/figures/heatmap2.svg b/chapters/examples/figures/heatmap2.svg new file mode 100644 index 0000000..814a5e4 --- /dev/null +++ b/chapters/examples/figures/heatmap2.svg @@ -0,0 +1,3912 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +0x127DC0 +0x128EC0 +0x1293C0 +0x129980 +0x129B00 +0x12A680 +0x12ABC0 +0x12AF80 +0x12B600 +0x12B840 +0x12CB00 +0x12CD80 +0x12DFC0 +0x130E80 +0x138580 ++0x0 ++0x4 ++0x8 ++0xC ++0x10 ++0x14 ++0x18 ++0x1C ++0x20 ++0x24 ++0x28 ++0x2C ++0x30 ++0x34 ++0x38 ++0x3C +Byte Offset +Base Address +Faults + + + + + + + + + +1e+05 +2e+05 +3e+05 +4e+05 +Region + +TEXT +Total: 841,151 +FAIL_MARKER / mem + + + diff --git a/glossary.tex b/glossary.tex index 577ef33..6665d7c 100644 --- a/glossary.tex +++ b/glossary.tex @@ -55,7 +55,7 @@ description={Hardening technique utilizing \Gls{replication} in combination with an \glsdisp{anbcode}{ANB-coded} majority voter}, } \newglossaryentry{iwasm}{% - name={iwasm}, + name={iWasm}, description={\Gls{wamr}'s standalone binary that provides a command-line interface to load and execute \Gls{wasm} modules} } \newglossaryentry{replication}{% @@ -68,6 +68,6 @@ description={\Gls{wamr}'s runtime libraries for \Gls{wasm} module loading and execution} } \newglossaryentry{wamrc}{% - name={wamrc}, + name={WamrC}, description={\Gls{wamr}'s \gls{aot} compiler for \Gls{wasm}} } diff --git a/thesis.tex b/thesis.tex index 0e60544..50962f9 100644 --- a/thesis.tex +++ b/thesis.tex @@ -18,6 +18,7 @@ \subfile{chapters/03_background/03_01_wasm.tex} \subfile{chapters/03_background/03_02_wamr.tex} \subfile{chapters/03_background/03_03_fail.tex} +% TODO: Write about faults/errors/fault chain? \cleardoublepage% \subfile{chapters/04_experiment_setup/04_00_experiment_setup.tex}