From ef81fcee56fa583619e68adc65cb55265a7a32d1 Mon Sep 17 00:00:00 2001 From: Christoph Urlacher Date: Wed, 1 Jul 2026 15:38:19 +0200 Subject: [PATCH] Add "placeholder" text from proposal --- chapters/00_abstract/00_00_abstract.tex | 16 ------ .../01_introduction/01_00_introduction.tex | 29 +++++++++- .../02_related_work/02_00_related_work.tex | 14 +++-- chapters/03_background/03_00_background.tex | 23 +++++++- .../04_00_experiment_setup.tex | 50 +++++++++++++++- ...metal.tex => 04_01_wamr_modifications.tex} | 3 +- .../04_02_wasm_host_program.tex | 14 ----- chapters/06_discussion/06_00_discussion.tex | 52 +++++++++++++++++ glossary.tex | 57 +++++++++++++++---- preamble.tex | 24 ++++---- thesis.tex | 4 +- titlepage.tex | 6 +- 12 files changed, 222 insertions(+), 70 deletions(-) delete mode 100644 chapters/00_abstract/00_00_abstract.tex rename chapters/04_experiment_setup/{04_01_wamr_baremetal.tex => 04_01_wamr_modifications.tex} (65%) delete mode 100644 chapters/04_experiment_setup/04_02_wasm_host_program.tex diff --git a/chapters/00_abstract/00_00_abstract.tex b/chapters/00_abstract/00_00_abstract.tex deleted file mode 100644 index 943a955..0000000 --- a/chapters/00_abstract/00_00_abstract.tex +++ /dev/null @@ -1,16 +0,0 @@ -%! TeX program = lualatex -\documentclass[../../thesis.tex]{subfiles} - -\begin{document} - -\addchap{Abstract}\label{ch:abstract} - -As semiconductor node sizes shrink, transient hardware faults pose a growing risk to computing systems, especially in environments where reliability is critical. -\Gls{wasm}, a binary-code format developed for the web, is increasingly used in embedded systems through standalone runtimes such as the \Gls{wamr}. -This thesis investigates \Gls{wamr}'s compatibility with hardening techniques for transient hardware faults through systematic single-bit fault injection on a simulated IA-32 CPU using the \Gls{fail} fault-injection framework. - -The interpreter and \Gls{aot} execution modes of \Gls{wamr} are compared under fault conditions and software-based hardening techniques are evaluated at two levels: (I) the language/application level, by hardening source programs before compilation to Wasm, and (II) the runtime level, by hardening \Gls{wamr} itself. - -\todo[inline]{Copied from proposal} - -\end{document} diff --git a/chapters/01_introduction/01_00_introduction.tex b/chapters/01_introduction/01_00_introduction.tex index 211cad9..fd6c799 100644 --- a/chapters/01_introduction/01_00_introduction.tex +++ b/chapters/01_introduction/01_00_introduction.tex @@ -5,6 +5,33 @@ \chapter{Introduction}\label{ch:introduction} -\lipsum% +As semiconductor node sizes shrink, transient hardware faults pose a growing risk to computing systems, especially in environments where reliability is critical. +\Gls{wasm}, a binary-code format developed for the web, is increasingly used in embedded systems through standalone runtimes such as the \Gls{wamr}~\autocite{wamr}. +This thesis investigates \Gls{wamr}'s compatibility with hardening techniques for transient hardware faults through systematic single-bit fault injection on a simulated IA-32 CPU using the \Gls{fail} \gls{fi} framework. + +The interpreter and \gls{aot} execution modes of \Gls{wamr} are compared under fault conditions and software-based hardening techniques are evaluated at two levels: (I) the language/application level, by hardening source programs before compilation to \Gls{wasm}, and (II) the runtime level, by hardening \Gls{wamr} itself. + +\todo[inline]{Abstract from expose, needs to be rewritten} + +Transient hardware faults can manifest in different types of errors such as \glspl{sdc} or \glspl{due}. +This work focuses on \glspl{sdc} specifically as they can propagate silently through subsequent data-/program-flow without causing detectable system failures, thus producing trusted but incorrect results. +As \Gls{wasm} is adopted beyond the web, the resilience of \Gls{wasm} runtimes against these types of failures becomes a relevant question. + +\Gls{wamr}~\autocite{wamr} is designed for lightweight standalone execution of \Gls{wasm} modules. +It supports interpretation (with and without \gls{jit} compilation) and \gls{aot} compilation, trading memory footprint and portability for performance. +Besides platform independence, the \Gls{wasm} specification mandates additional safety features such as memory-isolated program execution and bounds-checked memory access. +This raises the question of how fault resilience compares between executing a (hardened) program natively or introducing \Gls{wamr} as an additional abstraction layer to the execution environment. + +To answer these questions, this thesis uses the \Gls{fail} \gls{fi} framework~\autocite{schirmeierFAILVersatileFaultInjection2012} that allows injecting bit-level faults into a simulated CPU using the Bochs IA-32 emulator~\autocite{bochs}. +\Gls{fail} is able to exhaustively cover the fault-space of possible bit flips by applying fault-similarity pruning to reduce the size of the fault-space and smart-hopping to accelerate single experiment simulations~\autocite{schirmeierEfficientFaultInjectionbasedAssessment}. + +To mitigate \Glspl{sdc}, software-based fault tolerance techniques are evaluated. +\Glspl{anbcode}~\autocite{forinVitalCodedMicroprocessor1990} are a method of encoding and verifying data- and program-flow integrity during execution. +\Gls{replication}~\autocite{polednaReplicaDeterminismDistributed1994} improves fault resilience by executing multiple independent copies of computations and using majority voting to detect or correct errors. +Both techniques can be applied either at the application level, by hardening the program before compilation to \Gls{wasm}, or at the runtime level, by hardening \Gls{wamr} itself to transparently improve fault resilience. + +The central objective is to analyze the effects of transient faults on \Gls{wamr} and assess the effectiveness of hardening techniques across execution modes. + +\todo[inline]{Introduction from expose, needs to be rewritten} \end{document} diff --git a/chapters/02_related_work/02_00_related_work.tex b/chapters/02_related_work/02_00_related_work.tex index 8a2c10d..c260d86 100644 --- a/chapters/02_related_work/02_00_related_work.tex +++ b/chapters/02_related_work/02_00_related_work.tex @@ -5,9 +5,15 @@ \chapter{Related Work}\label{ch:relatedwork} -\begin{itemize} - \item FAIL* paper/dissertation - \item Hardening papers -\end{itemize} +Related work is for similar work (e.g., Wasm with software-based mitigation). + +\section{FAIL* Paper/Dissertation} + +\section{Other Fault-Injection Papers?} + +\section{Wasm Hardening Papers} + +In a wider sense also hardening papers for e.g., Python could be considered. + \end{document} diff --git a/chapters/03_background/03_00_background.tex b/chapters/03_background/03_00_background.tex index a9c8d1e..a9752f9 100644 --- a/chapters/03_background/03_00_background.tex +++ b/chapters/03_background/03_00_background.tex @@ -5,10 +5,27 @@ \chapter{Background}\label{ch:background} +\section{WebAssembly} \begin{itemize} - \item Related work - \item Relevant information on WebAssembly - \item Relevant information on FAIL* + \item What is it + \item WebAssembly text format + \item WebAssembly memory, containerization, restricted controlflow +\end{itemize} + + +\section{WebAssembly Micro Runtime} +\begin{itemize} + \item Memory allocators (pool, usage), linear memory, memory usage + \item Different interpreters + JiTs + AoT (information + tradeoffs) +\end{itemize} +\todo[inline]{Not sure where the Wasm/WAMR separation is} + +\section{Fault-Injection Leveraged~\autocite{schirmeierFAILOpenVersatile2015}} +\begin{itemize} + \item FAIL* architecture + \item FAIL*Bochs backend, how does FAIL* inject + \item FAIL*'s generic-experiment + \item How to perform a FAIL* experiment \end{itemize} \end{document} diff --git a/chapters/04_experiment_setup/04_00_experiment_setup.tex b/chapters/04_experiment_setup/04_00_experiment_setup.tex index 9e74b70..265446d 100644 --- a/chapters/04_experiment_setup/04_00_experiment_setup.tex +++ b/chapters/04_experiment_setup/04_00_experiment_setup.tex @@ -5,7 +5,53 @@ \chapter{Experiment Setup}\label{ch:experimentsetup} -\subfile{04_01_wamr_baremetal.tex} -\subfile{04_02_wasm_host_program.tex} +\section{Execution Environment} +\begin{itemize} + \item Baremetal execution in BOCHS +\end{itemize} + +\subfile{04_01_wamr_modifications.tex} + +\section{Wasm Host Program} +\begin{itemize} + \item WAMR setup + \item Calling \code{FAIL\_MARKER}s (native functions) +\end{itemize} + +\section{Experiment Types} +\begin{itemize} + \item C only + \item WAMR AOT + \item WAMR interpreter +\end{itemize} + +\section{Controlling What Gets Injected/Memory Isolation} +\begin{itemize} + \item --catch-write-textsegment (does NOT prevent injections into the textsegment!) + \item --catch-outerspace +\end{itemize} + +\section{Missing FAIL\_MARKERs for AOT experiments} +\begin{itemize} + \item AOT Addressauflösung/Def-Use chain theory + \item Somehow caught by --catch-write-textsegment or --catch-outerspace because stuff was linked to .text? + \item Optimization theory + \begin{itemize} + \item Does the target program contain the expected instructions? + \item Does FAIL* treat the variables as not live? (volatile, fail\_stop\_trace(sum)) + \item Trying more complex programs, as -O0 always writes intermediate results to memory + \item Swap fail\_marker\_positive and fail\_marker\_negative + \end{itemize} + \item Does the pruner clear those injections for some reason? + \item Does the disassembler not disassemble the .text subsections? + \item Is the TracingPlugin broken? (GDB -> No, but FAIL* doesn't trace register accesses) + \item Solution: Gap in the .elf symbol space (addresses that are not covered by some symbol). FAIL needs this to disassemble the Wasm AOT code to find the register accesses. FAIL also needs to find this AOT code, so it can't be relocated -> Needs --xip +\end{itemize} + +\section{Target Programs} +\begin{itemize} + \item Toy examples + \item TacleBench~\autocite{TACLeBench,seidlerTACLeBenchWasmConverter2026} +\end{itemize} \end{document} diff --git a/chapters/04_experiment_setup/04_01_wamr_baremetal.tex b/chapters/04_experiment_setup/04_01_wamr_modifications.tex similarity index 65% rename from chapters/04_experiment_setup/04_01_wamr_baremetal.tex rename to chapters/04_experiment_setup/04_01_wamr_modifications.tex index 9c07930..ac6042d 100644 --- a/chapters/04_experiment_setup/04_01_wamr_baremetal.tex +++ b/chapters/04_experiment_setup/04_01_wamr_modifications.tex @@ -3,11 +3,12 @@ \begin{document} -\section{WAMR Baremetal Platform}\label{sec:wamrbaremetal} +\section{\Gls{wamr} Modifications}\label{sec:wamrmodifications} \begin{itemize} \item Cross-compiler issues \item Which platform functions? + \item WAMR exception handler marker? \end{itemize} \end{document} diff --git a/chapters/04_experiment_setup/04_02_wasm_host_program.tex b/chapters/04_experiment_setup/04_02_wasm_host_program.tex deleted file mode 100644 index d71e45d..0000000 --- a/chapters/04_experiment_setup/04_02_wasm_host_program.tex +++ /dev/null @@ -1,14 +0,0 @@ -%! TeX program = lualatex -\documentclass[../../thesis.tex]{subfiles} - -\begin{document} - -\section{Wasm Host Program}\label{sec:wasmhost} - -\begin{itemize} - \item WAMR setup - \item Calling \code{FAIL\_MARKER}s - \item WAMR exception handler marker? -\end{itemize} - -\end{document} diff --git a/chapters/06_discussion/06_00_discussion.tex b/chapters/06_discussion/06_00_discussion.tex index 91be6da..ef964ae 100644 --- a/chapters/06_discussion/06_00_discussion.tex +++ b/chapters/06_discussion/06_00_discussion.tex @@ -5,4 +5,56 @@ \chapter{Discussion}\label{ch:discussion} +\section{Research Questions} + +\subsection{How do transient hardware faults affect the correctness of programs executed in \Gls{wamr} in comparison to native execution?} + +\Gls{wamr} provides additional abstractions and safety features over native execution but brings increased complexity and a larger memory footprint. +This question evaluates how these differences affect the rate of silent data corruption and if the increased fault surface outweighs the safety gains. +The analysis distinguishes different experiment results such as correct execution, \gls{sdc} and \gls{due} to characterize the impact of \Gls{wamr} on system behavior under fault. +Additionally, the distribution of faults is examined to determine particularly vulnerable code paths in \Gls{wamr}. + +\subsection{How does the resilience of \Gls{wamr} differ between interpreter mode and \gls{aot} execution mode?} + +\Gls{wamr} supports both \gls{aot} compilation and interpreted execution of \Gls{wasm} modules. +\Gls{aot} mode executes a \Gls{wasm} module pre-compiled to native code. +\Gls{wamr} sets up an execution environment that provides \Gls{wasm}-specific benefits such as isolated execution or checked memory access before jumping into native code. +In contrast, interpreter mode executes \Gls{wasm} bytecode directly using one of \Gls{wamr}'s interpreter implementations. +This question compares both modes under identical \gls{fi} campaigns to determine if the interpreters' additional runtime checks and safety mechanisms provide a more resilient execution environment than \gls{aot} mode. + +\subsection{To what extent can source program hardening techniques applied to the source code reduce \gls{sdc}?} + +This question evaluates application-level hardening such as software \gls{replication} and \glspl{anbcode} before compilation to \Gls{wasm}. +Techniques include the \Gls{cored}~\autocite{ulbrichEliminatingSinglePoints2012} approach, where programs are executed repeatedly before masking errors using the \gls{anbcode}d majority voter. +The effectiveness of the tested methods is measured in terms of \gls{sdc} reduction in comparison to the non-hardened variants. +Further considerations include the difference between detectable and correctable errors and the possibility of combining different hardening techniques. + +\subsection{To what extent can the intermediate \Gls{wasm} program be hardened to reduce \gls{sdc}?} + +Instead of hardening the source program by modifying its source code, hardening techniques can be applied to the intermediate \Gls{wasm} bytecode representation. +This allows exploiting properties of the source program that are not accessible in its source representation, such as \Gls{wasm}'s operand stack or its restricted control flow. +The bytecode level also allows a more fine-grained approach to methods like software-based replication, as individual instructions can be replicated. + +\subsection{How effectively can hardening techniques be applied directly to the WAMR runtime's interpreter execution mode?} + +In contrast to application-level hardening, this question investigates modifying the \Gls{wamr} runtime itself to improve reliability. +This could offer advantages since it eliminates the need to harden each program on the application level individually, but could be unfeasible to implement or introduce high performance penalties. +Key components of the interpreter loop, such as the opcode dispatch mechanism or arithmetic operations, could be hardened. +Additionally, other critical runtime components that contribute disproportionately to fault propagation are to be identified. +The evaluation focuses on the feasibility of hardening the \Gls{wamr} runtime, its impact on \gls{sdc} rates, and its runtime cost. + +\subsection{How effectively can hardening techniques be applied directly to the WAMR runtime's ahead-of-time execution mode?} + +To implement the safety features required by the \Gls{wasm} specification, \gls{wamr}'s \gls{aot} compiler (\textquote{\gls{wamrc}}) instruments the resulting native code with \textquote{glue}-code, for example to guard memory accesses or implement function lookups. +Since transparently hardening \gls{aot} execution by modifying the compiler itself is out of scope for this thesis, this glue-code could be targeted instead. +The hardening potential of this approach is compared to the hardening of the interpreter execution mode in the previous research question. + +\subsection{How do the runtime overheads of application- and runtime-level hardening compare?} + +Fault tolerance mechanisms introduce computational overhead, which is especially important in resource-constrained environments. +This question compares the performance impact of application-level and runtime-level hardening to determine trade-offs between resilience and efficiency. +Performance is evaluated in the context of embedded/resource-restrained systems, where constraints might limit the ability to use certain hardening strategies. + +\todo[inline]{Taken from expose for reference} + \end{document} diff --git a/glossary.tex b/glossary.tex index 3818743..7672f81 100644 --- a/glossary.tex +++ b/glossary.tex @@ -6,12 +6,18 @@ % Acronyms %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% -% \newacronym{acpi}{ACPI}{Advanced Configuration and Power Interface} +% \newacronym[ +% text={text in the glossary (uses text in the document if omitted)}, +% plural={plural text in the document (uses text if omitted)}, +% description={description in the glossary (uses description in the document if omitted)}, +% ]{key}{text in the document}{description in the document} -\newacronym{aot}{AoT}{Ahead-of-Time} -\newacronym{fi}{FI}{Fault Injection} -\newacronym{fail}{FAIL*}{Fault Injection Leveraged} -\newacronym{sdc}{SDC}{Silent Data Corruption} +\newacronym[description={Ahead-of-Time}]{aot}{AOT}{ahead-of-time} +\newacronym{fail}{FAIL*}{Fault-Injection Leveraged} +\newacronym[description={Faul-Injection}]{fi}{FI}{fault-injection} +\newacronym[description={Detected Unrecoverable Error}]{due}{DUE}{detected unrecoverable error} +\newacronym[description={Just-in-Time}]{jit}{JIT}{just-in-time} +\newacronym[description={Silent Data Corruption}]{sdc}{SDC}{silent data corruption} \newacronym{wamr}{WAMR}{WebAssembly Micro Runtime} \newacronym{wasm}{Wasm}{WebAssembly} @@ -19,12 +25,39 @@ % Glossary Entries %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% -% \newglossaryentry{apic timer}{% -% name={APIC Timer}, -% description={A hardware timer that can trigger periodic interrupts by using a counter, integrated in the local APIC} +% \newglossaryentry{key}{% +% name={text in the glossary}, +% text={text in the document (uses name if omitted)}, +% plural={plural text in the document (uses text if omitted)}, +% description={description in the glossary}, % } -% \newglossaryentry{fail}{% -% name={FAIL*}, -% description={Fault Injection Leveraged, a \Gls{fi} framework} -% } +\newglossaryentry{ancode}{% + name={AN-Code}, + text={AN-code}, + description={Arithmetic coding scheme protecting against operand errors} +} +\newglossaryentry{anbcode}{% + name={ANB-Code}, + text={ANB-code}, + description={Arithmetic coding scheme protecting against operand and operator errors} +} +\newglossaryentry{anbdcode}{% + name={ANBD-Code}, + text={ANBD-code}, + description={Arithmetic coding scheme protecting against operand, operator and operation errors} +} +\newglossaryentry{replication}{% + name={Replication}, + text={replication}, + description={Hardening technique utilizing replicated hardware or execution in combination with a majority voter} +} +\newglossaryentry{cored}{% + name={Combined Redundancy}, + first={Combined Redundancy (CoRed)}, + description={Hardening technique utilizing \Gls{replication} in combination with an \gls{anbcode}d majority voter}, +} +\newglossaryentry{wamrc}{% + name={wamrc}, + description={\Gls{wamr}'s \gls{aot} compiler for \Gls{wasm}} +} diff --git a/preamble.tex b/preamble.tex index f323552..f096b4e 100644 --- a/preamble.tex +++ b/preamble.tex @@ -10,7 +10,7 @@ % Bibliography \usepackage[backend=biber,urldate=iso,date=iso,seconds=true]{biblatex} -\bibliography{references} +\bibliography{references,zotero} \usepackage[nottoc,notlof,notlot]{tocbibind} % Include bibliography in ToC, nottoc disables the "Contents" entry for the ToC itself % Figures @@ -58,8 +58,8 @@ appendixprefix, headsepline, % footsepline, - % cleardoublepage=current, - cleardoublepage=plain, % linenumbers on interleaf pages + % cleardoublepage=current, % linenumbers and headers on interleaf pages + % cleardoublepage=plain, % linenumbers on interleaf pages footnotes=multiple, % TODO: Doesn't work, maybe because of hyperref? } @@ -77,8 +77,9 @@ \usepackage[autostyle]{csquotes} % Correct quotation marks with \textquote{} \usepackage{silence} % Silence warnings % \usepackage[intoc]{nomencl} % Nomenclature -\usepackage[luatex,hidelinks]{hyperref} % Load late -\usepackage[acronym,automake,nonumberlist,nogroupskip,toc]{glossaries} % Load after hyperref, toc +\usepackage[luatex,colorlinks]{hyperref} % Load late, hidelinks +\usepackage{bookmark} % Needed for hyperref with scrbook +\usepackage[acronym,automake=immediate,nonumberlist,nogroupskip,toc]{glossaries} % Load after hyperref, toc \usepackage{xurl} % xurl does url-line-breaks in contrast to url % Multi-file @@ -176,26 +177,27 @@ \frontmatter% \pagestyle{plain} - % \pagenumbering{Roman} - % \tableofcontents{\thispagestyle{plain}} + \pagenumbering{Roman} \tableofcontents% \cleardoublepage% \todototoc\listoftodos% \cleardoublepage% - \setacronymstyle{short-long} - \printglossary[type=\acronymtype] + \setacronymstyle{long-short} + \printacronyms% \cleardoublepage% \printglossary% + \cleardoublepage% \mainmatter% \pagestyle{headings} - % \pagenumbering{arabic} + \pagenumbering{arabic} } \AtEndDocument{ \backmatter% \pagestyle{plain} + \pagenumbering{Roman} \let\url\undefined% \let\url\oldurl% @@ -227,7 +229,7 @@ \phantomsection% \addcontentsline{toc}{chapter}{Statutory Declaration} - \includepdf[pages=-]{declaration.pdf} + \includepdf[pages=-]{declaration_signed.pdf} } % Colors diff --git a/thesis.tex b/thesis.tex index 0033fc8..2a441af 100644 --- a/thesis.tex +++ b/thesis.tex @@ -8,9 +8,6 @@ % TODO: Double check the autofilled Zotero references -\subfile{chapters/00_abstract/00_00_abstract.tex} -\cleardoublepage% - \subfile{chapters/01_introduction/01_00_introduction.tex} \cleardoublepage% @@ -33,6 +30,7 @@ \cleardoublepage% \appendix +% \pagenumbering{Roman} \subfile{chapters/examples/examples.tex} \cleardoublepage% diff --git a/titlepage.tex b/titlepage.tex index c2c2bbe..089a8c4 100644 --- a/titlepage.tex +++ b/titlepage.tex @@ -15,7 +15,7 @@ \begin{center} - \includegraphics[width=5cm]{tud_logo_rgb.jpg} + \includegraphics[width=6cm]{tud_logo_rgb.jpg} \vspace{0.75cm} @@ -36,8 +36,8 @@ \vspace{7.5em} - {submitted by} \\[.5em] - {\huge \theauthor} \\[.5em] + {submitted by} \\[.6em] + {\huge \theauthor} \\[.2em] {from Ratingen}\\ \vfill