一句话：利用大语言模型从驱动源码中提取硬件交互逻辑，自动迭代生成 QEMU 虚拟设备，以支撑无真实硬件的内核驱动模糊测试。
Linux 内核设备驱动与硬件紧耦合，其执行与测试高度依赖设备接口与响应。缺乏真实硬件或精确设备仿真时，大量驱动代码无法被测试，给内核安全带来风险；而现有方法依赖人工设备建模或有限的物理硬件，难以扩展到庞大的驱动生态。本文提出 DevGen，首个利用大语言模型自动生成虚拟设备以增强内核驱动 fuzzing 的方法：它从驱动源码中抽取硬件交互逻辑，迭代生成基于 QEMU 的虚拟设备，并借助语法检查与由执行反馈引导的语义修复逐步修正生成结果；生成的设备进一步与 Syzkaller 集成，从而在无物理硬件条件下探索驱动代码路径。在 Linux 6.18 内核的 50 个驱动上，DevGen 为 44 个驱动成功生成虚拟设备，其中 24% 的驱动 fuzzing 覆盖率显著提升，并触发了 7 个此前未知的崩溃。
A large number of Linux kernel device drivers are tightly coupled with hardware, making their execution and testing heavily dependent on device interfaces and responses. Without access to real hardware or accurate device emulation, significant parts of driver code remain untested, posing a major risk to kernel security. Existing approaches mainly rely on manual device modeling or limited physical hardware, making it difficult to scale across the vast driver ecosystem. In this paper, we introduce DevGen, the first approach for automatically generating virtual devices using Large Language Models (LLMs) to enhance kernel driver fuzzing. Our approach extracts hardware interaction logic from driver source code and generates QEMU-based virtual devices iteratively, employing syntax checking and semantic repair guided by execution feedback. Furthermore, the generated devices are integrated with Syzkaller, enabling the exploration of driver code paths without the need for physical hardware. Experiments on 50 drivers from the latest Linux 6.18 kernel show that DevGen successfully generates virtual devices for 44 drivers. With these generated models, 24% of the drivers achieve significant improvements in fuzzing coverage, and 7 previously unknown crashes are triggered.
@inproceedings{WangYLGWWLT26,
title = {DevGen: Automated Generation of Virtual Device Models for Kernel Drivers via Large Language Models},
author = {Mingyu Wang and Bin Yu and Wenjian Lu and Kefeng Gao and Zhi Wang and Cheng Wen and Xu Lu and Cong Tian},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805564}
}