发表机构
Huawei Technologies Co., Ltd（华为技术有限公司）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
NosRacer是用于工业级设备端网络操作系统的动态竞态条件检测框架，通过两阶段设计降低开销，在5个控制平面组件中检测到21个严重竞态条件，精度达66%且开销低于10%。
AI 中文摘要
商用设备端网络操作系统（NOS）在生产路由器和交换机中运行复杂的控制平面，配置更新任务由多个松耦合组件通过异步消息传递执行。此类执行易出现竞态条件：相同的有序输入命令在消息传递顺序不同时会产生不同结果。竞态条件难以暴露，因为它们常表现为细微、延迟的故障。现有静态分析技术对大规模工业NOS缺乏可扩展性和精度，而动态分析在尝试覆盖异步消息交织空间时会产生大量系统执行开销。为应对上述挑战，我们提出NosRacer，这是一个用于工业级设备端NOS中竞态条件检测的动态分析框架。NosRacer采用两阶段设计：集中阶段利用配置更新任务的局部性缩小分析范围，将竞态条件检测限制在涉及的少量组件和关键状态变量中，从而降低检测成本；扰动阶段主动扰动消息异步性，提高出现竞态条件的消息交织执行的可能性，通过将兼容扰动分组并行执行并自适应强化扰动来保持扰动的实用性。我们在一款商用、活跃开发的NOS中实现了NosRacer，将其集成到现有测试工厂中，用于检测5个关键控制平面组件中的竞态条件。NosRacer达到66%的精度，检测到21个被开发者确认为严重漏洞的竞态条件，同时将检测开销控制在10%以下。
英文摘要
Commercial on-device network operating systems (NOSes) run complex control planes in production routers and switches, where configuration update tasks are executed by multiple loosely coupled components through asynchronous message passing. Such executions are prone to race conditions: the same ordered input commands may produce different outcomes when messages are delivered in different orders. The race conditions are difficult to expose because they often manifest only as subtle, delayed malfunctions. Existing static analysis techniques lack scalability and precision for large-scale industrial NOSes, while dynamic ones incur substantial system-execution cost when attempting to cover the space of asynchronous message interleavings. To address the challenges above, we present NosRacer, a dynamic analysis framework for race condition detection in industrial-grade on-device NOSes. NosRacer uses a two-phase design. The concentration phase reduces analysis scope by leveraging the locality of configuration update tasks. Race condition detection is then limited to a small subset of involved components and crucial state variables, thereby reducing the detection cost. The perturbation phase proactively perturbs message asynchrony to increase the likelihood of executions with race-condition-exposing message interleavings. It keeps perturbation practical by grouping compatible perturbations for parallel execution and adaptively strengthening perturbations. We implement NosRacer in a commercial, actively developed NOS. NosRacer is integrated into the existing testing factory and used to detect race conditions in 5 key control-plane components. NosRacer achieves 66% precision and detects 21 race conditions confirmed by developers as severe bugs, while keeping the detection overhead below 10%.
Comments18 pages, 5 figures, 6 tables. Accepted to SIGOPS ATC 2026
