  Hardware/Software (HW/SW) interfaces, mostly implemented as devices and
device drivers, are pervasive in various computer systems. Nowadays HW/SW
interfaces typically undergo intensive testing and validation before release,
but they are still unreliable and insecure when deployed together with computer
systems to end users. Escaped logic bugs, hardware transient failures, and
malicious exploits are prevalent in HW/SW interactions, making the entire
system vulnerable and unstable.
  We present HW/SW co-monitoring, a runtime co-verification approach to
detecting failures and malicious exploits in device/driver interactions. Our
approach utilizes a formal device model (FDM), a transaction-level model
derived from the device specification, to shadow the real device execution.
Based on the co-execution of the device and FDM, HW/SW co-monitoring carries
out two-tier runtime checking: (1) device checking checks if the device
behaviors conform to the FDM behaviors; (2) property checking detects invalid
driver commands issued to the device by verifying system properties against
driver/device interactions. We have applied HW/SW co-monitoring to five
widely-used devices and their Linux drivers, discovering 9 real bugs and
vulnerabilities while introducing modest runtime overhead. The results
demonstrate the major potential of HW/SW co-monitoring in improving system
reliability and security.
