Automatic variability analysis method for configurable software system

Abstract

The invention discloses an automatic variability analysis method for a configurable software system, which relates to the technical field of software debugging and analysis, and comprises the following steps of: importing and analyzing a source code, constructing a code attribute graph, and dividing nodes in the code attribute graph into command nodes or statement nodes; analyzing the command node, constructing a feature expression and determining an existence condition; searching all initial nodes and respectively carrying out depth traversal; during traversal, searching the nearest command node in the front nodes as a father node for the current node; updating existence conditions of the current nodes of different types; analyzing and searching seed nodes and seed statements thereof; performing slice analysis on the seed statement, searching an associated program statement, and obtaining a corresponding statement node to obtain a node group; and logic and operation of existence conditions are carried out on all nodes in the node group, a feature interaction expression is finally obtained, and the possible internal feature interaction combination condition in the configurable software system can be efficiently reflected.

Description

Technical Field

[0001] The present invention relates to the technical field of software debugging and analysis, and in particular to an automatic analysis method for the variability of a configurable software system. Background Art

[0002] Configurable software systems based on precompiled macros are a type of software development model that uses macro-defined switches to tailor and combine functionality. These systems typically leverage conditional compilation mechanisms (such as preprocessing directives like #ifdef, #ifndef, and #define in the C language) to enable developers to flexibly select, tailor, and combine software features, rapidly generating software variants tailored to different application scenarios and requirements. This configuration approach is widely used in embedded systems, operating system kernels, and other resource-constrained software applications. Its advantages include effectively reducing software size, lowering resource overhead, and improving software reusability and maintainability, while also meeting diverse and personalized user needs.

[0003] Because configurable software systems based on precompiled macro commands involve a large number of macro switch combinations, each of which may correspond to a different program execution path and behavior, the system exhibits significant variability in functionality, performance, and even reliability. This high degree of variability poses significant challenges to static and dynamic analysis and testing of software. Traditional program analysis methods often struggle to effectively address the combinatorial explosion caused by the numerous configurations. Therefore, developing accurate and efficient program analysis methods for such software systems is not only of practical significance for improving software quality and ensuring system reliability, but also provides a solid theoretical support and technical foundation for improving the efficiency of configurable software development and maintenance, making it of great research value.

[0004] The existing technology for analyzing configurable software systems based on precompiled macro commands has the following deficiencies: (1) For large-scale basic software systems, such as the Linux kernel and BusyBox, existing technologies for analyzing the existence conditions of statements are inefficient or cannot be handled.

[0005] (2) There is no method yet to analyze and obtain the internal feature interaction information of the system.

[0006] (3) When implementing program slicing, existing methods cannot retain syntax information or may result in incorrect slicing.

[0007] Therefore, there is an urgent need to provide an efficient and high-performance automatic variability analysis technology for configurable software systems to solve the above technical problems. Summary of the Invention

[0008] In response to the problems existing in the prior art, the present invention provides an automatic variability analysis method for configurable software systems. By constructing a code property graph with variability awareness, it analyzes the existence conditions of program statements, feature interactions within the system, and precise program slicing that retains grammatical information.

[0009] The technical solution of the present invention is achieved as follows: A method for automatically analyzing the variability of a configurable software system, wherein the configurable software system includes precompiled macro commands and a plurality of features, and any number of the features are selected according to the precompiled macro commands to compile a customized target system. Variability refers to the fact that some statements in the program are not always compiled and executed. The method comprises the following steps: T1. Import and parse the source code of the configurable software system, obtain abstract syntax trees of all program statements in the source code, and determine the types of the program statements, which include precompiled macro commands, declaration statements, and function call statements, as well as program statements of types such as expression statements and judgment statements; perform static analysis based on the abstract syntax tree to construct a code attribute graph; the code attribute graph includes directed edges and nodes; each node corresponds to an existence condition; An Abstract Syntax Tree (AST) is a tree-like representation of source code, retaining only the core elements of the grammatical structure (such as expressions and statements) and ignoring redundant symbols like parentheses. For example, an if statement is represented in the AST as a node and its branches. For example, in "a=1," the element / attribute "a," the operation "=", and the value "1" are all part of the AST node.

[0010] The Code Property Graph (CPG) is a multi-graph fusion model that integrates the AST, control flow graph (CFG), and program dependency graph (PDG) into a unified graph structure. It accurately describes program structure and semantics. Nodes can simultaneously carry syntax, control flow, and data dependency information. The CPG can be saved to a graph database or embedded database, such as Neo4j and BerkeleyDB.

[0011] In the code attribute graph, if the type of the program statement corresponding to a node is the precompiled macro command, the node is recorded as a command node; otherwise, the node is recorded as a statement node; During AST generation, each program statement is broken down into a separate tree, with the top node representing the program statement. Statement nodes do not include statements such as comments that have no impact on program execution.

[0012] T2. Parse the command node and construct a feature expression; the precompiled macro command corresponding to the command node is associated with a plurality of features; the feature expression is used to represent the selection state and logical relationship of the features; the existence condition of the command node is the value of the feature expression; Here, "several" refers to one or more; selecting a state means selecting "enable / use" a feature, or selecting "disable / not use" a feature; During the parsing process, either rule-based or large-model approaches can be used to parse the content of precompiled macro commands. Whether using a rule-based or large-model approach, complete precompilation rules must be designed (or the large-model must be prompted). For example, in C / C++ programming, these include #ifdef, #ifndef, and #if. For #if, it can handle the state of the feature through define() or through expression conditions. Furthermore, there are special precompiled macro commands, such as #if 1 and #if 0, which indicate that the controlled program statement's existence condition is always true and always false, respectively. Regardless of the technique used, all possible precompiled macro command scenarios must be considered.

[0013] Specifically, precompiled macros need to be converted into Boolean expressions, or other expressions that preserve both feature attributes and Boolean values, and then converted into a standardized format that can be used for logical expression processing, such as Z3 expressions. Z3 expressions are a core concept in Microsoft's SMT (Satisfiability Modulo Theory) solver, used to describe logical constraints and automatically solve for variable values ​​that satisfy the conditions.

[0014] Logical relationships include logical operations in the computer field such as "and", "or", and "not".

[0015] T3. In the code attribute graph, search for all initial nodes; the initial node is a command node, and there is no preceding command node directly or indirectly pointing to the initial node through a directed edge; perform a deep traversal on all initial nodes respectively.

[0016] T4. During depth traversal, for the current node, find the command node closest to its predecessor node as the parent node; If the current node is a statement node, the existence condition of the current node is updated to the existence condition of the parent node; that is, assuming the existence condition of the current node is A and the existence condition of the parent node is B, then A=B, that is, B is assigned to A; If the current node is a command node, the characteristic expression of the current node and the existence condition of the parent node are logically operated to generate a new expression to update the existence condition of the current node; that is, assuming that the existence condition of the current node is A and the existence condition of the parent node is C, then A=A∘C, where "∘" represents logical operation operations in the computer field such as "and", "or", and "not".

[0017] T5. In the code attribute graph, a statement node directly associated with the command node is recorded as a variable node; wherein, if the type of the program statement corresponding to the variable node is a declaration statement or a function call statement, the variable node is recorded as a seed node, and the program statement corresponding to the seed node is recorded as a seed statement; Performing slicing analysis on the seed statement, searching for associated program statements, and obtaining corresponding statement nodes; the seed node and the associated statement nodes constitute a node group; For seed statements, we must consider both slicing efficiency and whether all feature interactions can be covered. Therefore, we use declaration statements with conditions that are not always true or false and statements with call relationships as seed statements, and obtain the node IDs of all seed statement nodes in the graph.

[0018] T6. Perform a logical AND operation on all nodes in the node group based on the existence conditions, and generate and output a feature interaction expression.

[0019] Feature interaction refers to the interaction / reference and control relationship between statements controlled by two or more features. By constructing a feature expression, the selection status of several features of a compiled macro command can be clearly displayed. Furthermore, the tree structure of the AST can be used to quickly clarify the dependencies of program statements at different levels on the selection of each feature. Finally, by screening seed statements and conditionally associating related program statements, the feature interaction expression formed can effectively reflect the possible internal feature interaction combinations in configurable software systems. Based on this internal feature interaction information, it is conducive to the efficient location and repair of defects during the testing process.

[0020] As a further optimization of the above solution, it also includes: T7, reconstructing the code attribute graph according to the node group: in the code attribute graph, for any one of the node groups, constructing a directed edge or an undirected edge between any two nodes in the node group.

[0021] By retaining the grammatical information of the slice analysis results through the code property graph, efficient code transplantation or version iteration can be achieved in subsequent system maintenance, which is conducive to reducing the labor cost of system maintenance.

[0022] As a further optimization of the above solution, in T4, when the current node is a command node, if the program statements corresponding to the current node and the parent node are in a nested relationship, the update of the existence condition is: ; in, Indicates the current node, Indicates the existence condition of the current node; Represents the parent node, Indicates the existence condition of the parent node, Represents the characteristic expression of the current node; If the program statements corresponding to the current node and the parent node are in a parallel relationship, the update of the existence condition is: .

[0023] As a further optimization of the above solution, in T5, the slicing analysis includes pre-analysis, which is a slicing analysis of the interaction of program statements in the same file; the pre-analysis includes structural relationship analysis, call relationship analysis, definition relationship analysis, data flow analysis, control flow analysis and variability analysis.

[0024] For pre-analysis, we first retrieve all abstract syntax tree nodes of the seed statement. Then, we use a data structure like a queue to iteratively analyze and process all associated nodes based on rules. During this iterative analysis, we use a cache mechanism to prevent repeated analysis of the same nodes, and we skip analyzing meaningless nodes that do not appear directly in the code.

[0025] As a further optimization of the above solution, in T5, the slice analysis also includes post-analysis, which is a slice analysis of the program statement interactions between different files; The post-analysis further analyzes the node group obtained by the pre-analysis, that is, searches for nodes associated with the nodes in the node group, and obtains new nodes to join the node group.

[0026] For example, when it comes to function calls, library file calls, data structure types, object references, etc., the call statements and function statement blocks / data structure definition statements / object definition statement blocks exist in different files. Therefore, post-analysis can provide a deeper understanding and identification of program statement interactions between different files. The "object" here refers to the object in "object-oriented programming."

[0027] Post-analysis is an optional analysis and is not a must-do step.

[0028] As a further optimization of the above solution, T5 also includes conflict handling, namely: For each node group, if the existence conditions between any two nodes constitute a conditional conflict, both nodes are recorded as conflicting nodes; the conditional conflict is that at least one of the same characteristics exists in each of the two existence conditions, and the selection status of the characteristics in the two existence conditions is different; The conflicting nodes are taken out from the node group; each of the conflicting nodes and the remaining nodes in the node group form a new node group.

[0029] As a further optimization of the above solution, the feature expression, the existence condition and the feature interaction expression are converted into a DNF format or a CNF format, and a formula simplification operation is performed.

[0030] DNF (Disjunctive Normal Form) and CNF (Conjunctive Normal Form) are normalized representations of logical expressions.

[0031] DNF: Each clause describes a complete set of scenarios that may satisfy the condition, suitable for extracting expressions from the truth table (each true row corresponds to a clause).

[0032] CNF: Each clause defines a set of minimum constraints that must be met and is often used to describe complex combinatorial restrictions.

[0033] Compared with the prior art, the present invention achieves the following beneficial effects: The present invention provides a method for automatically analyzing the variability of a configurable software system. By constructing feature expressions and building a code attribute graph with variability awareness, the selection status of several features of a compiled macro command can be clearly and intuitively displayed. On this basis, the tree structure of AST can be used to quickly clarify the selection dependence of program statements at different levels on various features. Finally, by screening seed statements and associating the associated program statements with existence conditions, the feature interaction expression formed can efficiently reflect the possible internal feature interaction combinations in the configurable software system. Based on the internal feature interaction information, it is conducive to the efficient location and repair of defects in the testing process.

[0034] In addition, by retaining the grammatical information of the slice analysis results through the code property graph, efficient code transplantation or version iteration can be achieved in subsequent system maintenance, which is conducive to reducing the labor cost of system maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The present invention provides a flow chart of a method for automatically analyzing the variability of a configurable software system. DETAILED DESCRIPTION

[0036] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0037] like Figure 1 As shown, this embodiment provides a method for automatically analyzing the variability of a configurable software system, comprising the following steps: T1. Import and parse the source code of the configurable software system, which includes all header files and source files; obtain the abstract syntax tree of all program statements in the source code and determine the type of program statements, which include precompiled macro commands, declaration statements, and function call statements. In addition, they also include program statements of types such as expression statements and judgment statements; perform static analysis based on the abstract syntax tree and construct a code property graph; the code property graph includes directed edges and nodes; in particular, the variable information of the target system is additionally recorded in the directed edges, which are recorded as variable edges and represented by "VARIABILITY" to describe the program statements controlled ("executed" or "not executed") by the precompiled macro commands.

[0038] One node corresponds to one existence condition.

[0039] In the code attribute graph, if the type of the program statement corresponding to the node is a precompiled macro command, the node is recorded as a command node; otherwise, the node is recorded as a statement node.

[0040] T2. Parse the command node and construct a feature expression. The precompiled macro command corresponding to the command node is associated with several features. The feature expression is used to represent the selection status and logical relationship of the feature. The existence condition of the command node is the feature expression.

[0041] T3. In the code attribute graph, find all initial nodes; the initial node is a command node, and there is no preceding command node directly or indirectly pointing to the initial node through a directed edge; mapped to the code attribute graph, the initial node is a command node without an incoming edge of type "VARIABILITY", which represents the starting point of all precompiled macro commands.

[0042] Perform depth traversal on all initial nodes separately.

[0043] T4. During deep traversal, for the current node, find the nearest command node among its predecessor nodes as the parent node; analyze the control relationship between the current node and the parent node, and update the existence condition of the current node according to the existence condition of the parent node.

[0044] If the current node is a statement node, the existence condition of the current node is updated to the existence condition of the parent node; at this time, the parent node has a "VARIABILITY" edge pointing to the current node, that is, assuming that the existence condition of the current node is A and the existence condition of the parent node is B, then A=B, that is, B is assigned to A; specifically, the program statement (precompiled macro command) directly associated with a command node is "#ifndef CONFIG_NO_HZ_COMMON", and the three statement nodes directly pointed to by this command node are s1, s2, and s3. The existence conditions of these three statement nodes are "Not(CONFIG_NO_HZ_COMMON)", which can also be expressed in another form as "!CONFIG_NO_HZ_COMMON".

[0045] If the current node is a command node, a logical operation is performed on the characteristic expression of the current node and the existence condition of the parent node to generate a new expression and update it to the existence condition of the current node.

[0046] In this embodiment, when the relationship between the current node and the parent node is different, the process of the logical operation is different.

[0047] If the program statements corresponding to the current node and the parent node are nested, the update of the existence condition is: ; in, Indicates the current node, Indicates the existence condition of the current node; Represents the parent node, Indicates the existence condition of the parent node, Represents the characteristic expression of the current node; If the program statements corresponding to the current node and the parent node are in a parallel relationship, the update of the existence condition is: .

[0048] For example, for a node 1, the corresponding pre-compiled macro command is "#if feature A & feature B". At this time, there is a node 2, the corresponding pre-compiled macro command is "#elif feature A & !(feature B)", and there is a node 3, the corresponding pre-compiled macro command is "#else !(feature)A & feature B". At this time, the three parent nodes belong to three scenarios realized by the judgment method, that is, they are in a parallel relationship; At this point, there is also a node 4, and the corresponding pre-compiled macro command is "#if feature C & feature D". The implementation premise of node 4 is node 1, which means that nodes 1 and 4 are nested and mapped to the program statement, that is, "there is another layer of if (conditional judgment) in the statement block under if."

[0049] T5. In the code attribute graph, the statement node directly associated with the command node is recorded as a variable node. If the type of the program statement corresponding to the variable node is a declaration statement or a function call statement, the variable node is recorded as a seed node, and the program statement corresponding to the seed node is recorded as a seed statement. Perform slice analysis on the seed statement, find the associated program statement, and obtain the corresponding statement node; the seed node and the associated statement node constitute a node group; In this embodiment, the slicing analysis includes pre-analysis and post-analysis. The pre-analysis is a slicing analysis of the program statement interactions within the same file; the pre-analysis includes structural relationship analysis, call relationship analysis, definition relationship analysis, data flow analysis, control flow analysis, and variability analysis.

[0050] Structural relationship analysis is to search all abstract syntax tree child nodes of the seed node; Call relationship analysis is to check whether there is a function call in the seed node, and if so, search for the related nodes of the called function; Define relationship analysis as checking whether the seed node has a custom data type / structure, and if so, search for related nodes of the data type / structure; Data flow analysis is to search for nodes related to all variable definitions and uses of the seed node; Control flow analysis is to search for the corresponding node of the program statement to which the seed node belongs, that is, the statement node corresponding to the program statement that has a control relationship with the seed statement, such as the application of "if", "for" and other statements; Variability analysis is to search for nodes that have a variability relationship with the seed node.

[0051] For pre-analysis, we first retrieve all abstract syntax tree nodes of the seed statement. Then, we use a data structure like a queue to iteratively analyze and process all associated nodes based on rules. During this iterative analysis, we use a cache mechanism to prevent repeated analysis of the same nodes, and we skip analyzing meaningless nodes that do not appear directly in the code.

[0052] Post-analysis is to perform slice analysis on the interaction of program statements between different files; post-analysis is based on the node group obtained by the previous analysis for further analysis, that is, to find nodes associated with nodes in the node group and obtain new nodes to join the node group.

[0053] For example, when it comes to function calls, library file calls, data structure types, object references, etc., the call statements and function statement blocks / data structure definition statements / object definition statement blocks exist in different files. Therefore, post-analysis can provide a deeper understanding and identification of program statement interactions between different files. The "object" here refers to the object in "object-oriented programming."

[0054] In this embodiment, conflict handling is also included, namely: For each node group, if the existence conditions between any two nodes constitute a condition conflict, both nodes are recorded as conflicting nodes; a condition conflict occurs when at least one feature is the same in each of the two existence conditions, and the feature has different selection states in the two existence conditions; For example, a node's existence expression is " ", the existence expression of another node is " ", from this we can see that feature A exists in both expressions, but the former " " indicates that feature A is not selected, and the latter" " indicates that feature A is selected, which means there is a conflict in feature selection, that is, a condition conflict.

[0055] Remove conflicting nodes from the node group; each conflicting node and the remaining nodes in the node group form a new node group.

[0056] For example, if a node group is [s1, s2, s3, s4], and nodes s2 and s3 are both conflicting nodes, then new node groups are constructed: [s1, s2, s4] and [s1, s3, s4]. Furthermore, if s2 and s4 conflict, then [s1, s2, s4] can be divided into new node groups: [s1, s2] and [s1, s4].

[0057] T6. Perform a logical AND operation on all nodes in the node group based on the existence conditions, and generate and output a feature interaction expression.

[0058] T7. Reconstruct the code attribute graph based on the node group: In the code attribute graph, for any node group, construct a directed edge between any two nodes in the node group.

[0059] In this embodiment, the feature expressions, existence conditions, and feature interaction expressions are converted into DNF format or CNF format, and formula simplification operations are performed.

[0060] DNF (Disjunctive Normal Form) and CNF (Conjunctive Normal Form) are normalized representations of logical expressions.

[0061] DNF: Each clause describes a complete set of scenarios that may satisfy the condition, suitable for extracting expressions from truth tables (each true row corresponds to a clause). For example, the original expression A→(B∧C) is converted to the DNF expression ¬A∨(B∧C).

[0062] CNF: Each clause defines a set of minimum constraints that must be satisfied. This is often used to describe complex combinatorial restrictions. For example, the original expression A→(B∧C) is converted to the CNF expression (¬A∨B)∧(¬A∨C).

[0063] Based on the disclosure and teachings of the above description, those skilled in the art may also make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and modifications and variations of the present invention should also fall within the scope of protection of the claims of the present invention. In addition, although certain specific terms are used in this description, these terms are only for convenience of description and do not constitute any limitation to the present invention.

Claims

1. A method for automatically analyzing the variability of a configurable software system, characterized in that: The steps include: T1. Import and parse the source code of the configurable software system, obtain an abstract syntax tree of all program statements in the source code, and determine the types of program statements, including precompiled macro commands, declaration statements, and function call statements; perform static analysis based on the abstract syntax tree to construct a code attribute graph; the code attribute graph includes directed edges and nodes, and each node corresponds to an existence condition; In the code attribute graph, if the type of the program statement corresponding to a node is the precompiled macro command, the node is recorded as a command node; otherwise, the node is recorded as a statement node; T2. parse the command node and construct a feature expression; The precompiled macro command corresponding to the command node is associated with several features; The feature expression is used to represent the selection state and logical relationship of the feature; the existence condition of the command node is the feature expression; T3. Find all initial nodes in the code attribute graph; The initial node is a command node, and there is no preceding command node directly or indirectly pointing to the initial node through a directed edge; Perform depth traversal on all initial nodes respectively; T4. During depth traversal, for the current node, find the command node closest to its predecessor node as the parent node; If the current node is a statement node, the existence condition of the current node is updated to the existence condition of the parent node; If the current node is a command node, a logical operation is performed on the characteristic expression of the current node and the existence condition of the parent node to generate a new expression to update the existence condition of the current node; T5. In the code attribute graph, a statement node directly associated with the command node is recorded as a variable node; wherein, if the type of the program statement corresponding to the variable node is a declaration statement or a function call statement, the variable node is recorded as a seed node, and the program statement corresponding to the seed node is recorded as a seed statement; Performing slicing analysis on the seed statement, searching for associated program statements, and obtaining corresponding statement nodes; the seed node and the associated statement nodes constitute a node group; T6. Perform a logical AND operation on all nodes in the node group based on the existence conditions, and generate and output a feature interaction expression.

2. The method for automatically analyzing the variability of a configurable software system according to claim 1, characterized in that: Also includes: T7. Reconstruct the code attribute graph according to the node groups: in the code attribute graph, for any one of the node groups, construct a directed edge or an undirected edge between any two nodes in the node group.

3. The method for automatically analyzing the variability of a configurable software system according to claim 1, characterized in that: In T4, when the current node is a command node, if the program statements corresponding to the current node and the parent node are in a nested relationship, the update of the existence condition is: ； in, Indicates the current node, Indicates the existence condition of the current node; Represents the parent node, Indicates the existence condition of the parent node, Represents the characteristic expression of the current node; If the program statements corresponding to the current node and the parent node are in a parallel relationship, the update of the existence condition is: .

4. The method for automatically analyzing the variability of a configurable software system according to claim 1, wherein: In T5, the slicing analysis includes pre-analysis, which is a slicing analysis of the interaction of program statements in the same file; the pre-analysis includes structural relationship analysis, call relationship analysis, definition relationship analysis, data flow analysis, control flow analysis and variability analysis.

5. The method for automatically analyzing the variability of a configurable software system according to claim 4, characterized in that: In T5, the slicing analysis also includes post-analysis, which is slicing analysis of program statement interactions between different files; The post-analysis further analyzes the node group obtained by the pre-analysis to obtain new nodes to join the node group.

6. The method for automatically analyzing the variability of a configurable software system according to claim 4, characterized in that: Said T5 also includes conflict handling, namely: For each node group, if the existence conditions between any two nodes constitute a conditional conflict, both nodes are recorded as conflicting nodes; the conditional conflict is that at least one of the same characteristics exists in each of the two existence conditions, and the selection status of the characteristics in the two existence conditions is different; The conflicting nodes are taken out from the node group; each of the conflicting nodes and the remaining nodes in the node group form a new node group.

7. The method for automatically analyzing the variability of a configurable software system according to claim 1, characterized in that: The feature expression, the existence condition and the feature interaction expression are converted into DNF format or CNF format, and a formula simplification operation is performed.

Images