Update chapter title style

chapters/03_background/03_03_fail.tex

@@ -6,17 +6,51 @@
 
 \section{Fault-Injection Leveraged}\label{sec:fail}
 
-\begin{itemize}
-  \item FAIL*~\autocite{schirmeierFAILOpenVersatile2015} architecture
-  \item FailBochs backend, how does FAIL* inject
-  \item FAIL*'s generic-experiment
-  \item How to perform a FAIL* experiment
-\end{itemize}
-
 \Gls{fail}~\autocite{schirmeierFAILOpenVersatile2015} is an emulation-based vulnerability analysis tool.
 It provides a toolset to perform \gls{fi} experiments to analyze the vulnerability of software to transient hardware faults.
-In contrast to other \gls{fi} tools, \Gls{fail} enables deep simulator state access while simultaneously supporting multiple simulator backends, like BOCHS~\autocite{bochs} or gem5\footnote{\url[2026-07-02]{https://www.gem5.org/}}. % TODO: Give examples for other FI frameworks
+In contrast to other \gls{fi} tools\todo{give examples}, \Gls{fail} enables deep simulator state access while simultaneously supporting multiple simulator backends, like BOCHS~\autocite{bochs} or gem5\footnote{\url[2026-07-02]{https://www.gem5.org/}}.
 
-% FAIL components/structure/architecture
+\Gls{fail} is split into different components: A \textit{campaign} consists of multiple \gls{fi} \textit{experiments}, where each experiment injects a single fault.
+The \textit{campaign controller} distributes those experiments to running \Gls{fail} instances.
+Campaigns can be parallelized by running multiple instances on different systems or cores.
+Each experiment utilizes \Gls{fail}'s \textit{simulator abstraction layer} to control the target backend, to fast-forward the target to the desired state and inject a fault.
+This abstraction layer allows switching out backends to support different target platforms.
+
+To perform a vulnerability analysis, the examined program needs to be instrumented with fences that define the region to trace (see \autoref{lst:tracefencemarkers}).
+\begin{codeblock}[label=lst:tracefencemarkers]{Trace Region Fence}{.cpp}
+  \inputminted{cpp}{\subfix{listings/tracefence.cpp}}
+\end{codeblock}
+\Gls{fail} then records the instruction pointer changes and memory accesses inside this region during the so-called \textquote{golden run}: a faultless execution of the program that determines which injections should be performed during the campaign.
+Then, the golden run is enriched with the traced region's disassembly to take into account the read and written registers.
+The last step before campaign execution is the \textit{prune} step, where the collected data is translated into corresponding experiments.
+Different data points from the trace that result in the same \textquote{fault-similarity class} (as used by Schirmeier~\autocite{schirmeierEfficientFaultInjectionbasedAssessment}) are removed from the campaign.
+Two experiments belong to the same similarity class if the \textit{relevant} parts of their resulting simulator state are identical.
+From the pruned instruction pointer changes, memory accesses, and register accesses \Gls{fail} constructs a number of \textit{pilots}: representatives of the existing fault-similarity classes.
+Each pilot then corresponds to a single experiment.
+
+\Gls{fail}'s campaigns are event-driven: the user specifies conditions, for example an access to a certain memory region.
+Once a condition is reached, a user-defined action is performed, like injecting a fault or registering a certain experiment outcome.
+Users do not have to write every campaign from scratch, as \Gls{fail} includes a \textquote{generic experiment} which can be used as a starting point.
+The generic experiment performs three types of fault injections by default:
+\begin{itemize}
+  \item \sansbf{Memory} injections: Before the program reads from a memory address, a fault is injected.
+  \item \sansbf{Register} injections: Before the program reads from a register, a fault is injected.
+  \item \sansbf{Instruction Pointer} injections: The instruction pointer's value is randomized to disturb the program flow and introduce random jumps.
+\end{itemize}
+Furthermore, different experiment outcomes are classified:
+\begin{itemize}
+  \item \sansbf{Trap}: The injected fault caused the simulated CPU to throw an exception.
+  \item \sansbf{Timeout}: The injected fault caused the program to stall.
+  \item \sansbf{Ok Marker} (\code{fail\_marker\_positive()}): The program executed correctly even with the injected fault.
+  \item \sansbf{Detected Marker} (\code{fail\_marker\_detected()}): The injected fault was detected by the program.
+  \item \sansbf{Fail Marker} (\code{fail\_marker\_negative()}): The injected fault was not detected by the program.
+  \item \sansbf{Access Outerspace}: Caught if the program reads or writes anywhere outside valid ELF addresses.
+  \item \sansbf{Write Textsegment}: Caught if the program writes to addresses inside the \code{.text} section of the program.
+\end{itemize}
+Ok/Detected/Fail outcomes are classified by instrumenting the tested code with \textquote{markers} (see \autoref{lst:classificationmarkers}).
+If the program execution passes a marker, the experiment outcome is classified accordingly.
+\begin{codeblock}[label=lst:classificationmarkers]{Classification Markers}{.cpp}
+  \inputminted{cpp}{\subfix{listings/classificationmarkers.cpp}}
+\end{codeblock}
 
 \end{document}

chapters/03_background/listings/classificationmarkers.cpp

@@ -0,0 +1,6 @@
+// Continuation of previous example
+if (sum == 100) {
+  fail_marker_positive();
+} else {
+  fail_marker_negative();
+}

chapters/03_background/listings/tracefence.cpp

@@ -0,0 +1,8 @@
+fail_start_trace();
+
+int sum = 0;
+for (int i = 0; i < 100; ++i) {
+  ++sum;
+}
+
+fail_stop_trace();

chapters/examples/examples.tex

@@ -13,6 +13,9 @@ This is \code{inline code}.
 This is a reference to \Gls{fail}.
 This is another reference to \Gls{fail}.
 This is a citation~\autocite{polednaReplicaDeterminismDistributed1994}.
+
+\section{This is a section}\label{sec:examplesection}
+
 This is a reference to \autoref{ch:introduction}.
 This is a formula: \( \sum\limits_{f=1}^{\infty}\frac{o}{r}\cdot m_{u} + l^{a} \).
 This is \textbf{bold text that is slightly bold}, so underwhelming.
@@ -24,12 +27,20 @@ In contrast, \sansbf{this text is very strong}, very cool\footnote{very cool}.
 
 \begin{figure}[H]
   \centering
-  \begin{subfigure}[b]{0.55\textwidth}
+  \begin{subfigure}[b]{0.85\textwidth}
     \includesvg[width=1.0\linewidth]{\subfix{figures/example.svg}}
   \end{subfigure}
   \caption{This is a figure.}\label{fig:examplefigure}
 \end{figure}
 
+\begin{figure}[H]
+  \centering
+  \begin{subfigure}[b]{0.95\textwidth}
+    \includesvg[width=1.0\linewidth]{\subfix{figures/heatmap2.svg}}
+  \end{subfigure}
+  \caption{This is another figure.}\label{fig:exampleheatmap}
+\end{figure}
+
 \lipsum%
 
 \end{document}

glossary.tex

@@ -55,7 +55,7 @@
   description={Hardening technique utilizing \Gls{replication} in combination with an \glsdisp{anbcode}{ANB-coded} majority voter},
 }
 \newglossaryentry{iwasm}{%
-  name={iwasm},
+  name={iWasm},
   description={\Gls{wamr}'s standalone binary that provides a command-line interface to load and execute \Gls{wasm} modules}
 }
 \newglossaryentry{replication}{%
@@ -68,6 +68,6 @@
   description={\Gls{wamr}'s runtime libraries for \Gls{wasm} module loading and execution}
 }
 \newglossaryentry{wamrc}{%
-  name={wamrc},
+  name={WamrC},
   description={\Gls{wamr}'s \gls{aot} compiler for \Gls{wasm}}
 }

preamble.tex

@@ -35,6 +35,7 @@
 \usepackage{tikz}
 \usetikzlibrary{shadings, backgrounds}
 \usepackage[minted]{tcolorbox}
+\setminted{style=default}
 \tcbuselibrary{skins} % breakable
 
 % Math
@@ -60,8 +61,8 @@
 
 % Pagestyle
 \KOMAoptions{%
-  chapterprefix,
-  appendixprefix,
+  % chapterprefix,
+  % appendixprefix,
   headsepline,
   % footsepline,
   % cleardoublepage=current, % linenumbers and headers on interleaf pages
@@ -69,6 +70,17 @@
   footnotes=multiple, % TODO: Doesn't work, maybe because of hyperref?
 }
 
+% Chapter style
+\renewcommand*{\chapterformat}{%
+  {\huge\mdseries\chapapp~\thechapter\autodot\enskip}%
+}
+\setkomafont{chapter}{\huge\bfseries}
+\renewcommand{\chapterlinesformat}[3]{%
+  #2{\MakeUppercase{#3}}%
+  \par\nobreak\vspace{.3\baselineskip}%
+  \rule{\textwidth}{.5pt}%
+}
+
 % Various stuff
 \usepackage[page]{appendix} % [toc]
 \usepackage{lipsum}
@@ -79,13 +91,16 @@
 \usepackage{siunitx}
 \sisetup{detect-all}
 \usepackage[l2tabu,orthodox]{nag}
-% \usepackage{etoolbox} % For \ifstrequal
+\usepackage{etoolbox} % For \ifstrequal
 \usepackage[autostyle]{csquotes} % Correct quotation marks with \textquote{}
 \usepackage{silence} % Silence warnings
 % \usepackage[intoc]{nomencl} % Nomenclature
 \usepackage[luatex,colorlinks]{hyperref} % Load late, hidelinks
 \usepackage{bookmark} % Needed for hyperref with scrbook
 \usepackage[acronym,automake=immediate,nonumberlist,nogroupskip,toc]{glossaries} % Load after hyperref, toc
+\setacronymstyle{long-short}
+\setglossarystyle{super}
+\renewcommand{\glsnamefont}[1]{\sansbf{#1}}
 \usepackage{xurl} % xurl does url-line-breaks in contrast to url
 
 % Multi-file
@@ -182,10 +197,10 @@
     \tableofcontents%
     \cleardoublepage%
 
+    \phantomsection%
     \todototoc\listoftodos%
     \cleardoublepage%
 
-    \setacronymstyle{long-short}
     \printacronyms%
     \cleardoublepage%
     \printglossary%

thesis.tex

@@ -18,6 +18,7 @@
 \subfile{chapters/03_background/03_01_wasm.tex}
 \subfile{chapters/03_background/03_02_wamr.tex}
 \subfile{chapters/03_background/03_03_fail.tex}
+% TODO: Write about faults/errors/fault chain?
 \cleardoublepage%
 
 \subfile{chapters/04_experiment_setup/04_00_experiment_setup.tex}