A configurable software system variability automatic analysis method
By constructing a variable-aware code attribute graph, the problem of difficult analysis of feature interaction information in large-scale configurable software systems is solved, achieving efficient program slicing and syntax information preservation, and improving the analysis and maintenance efficiency of software systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SOUTH CHINA UNIV OF TECH
- Filing Date
- 2025-07-14
- Publication Date
- 2026-06-05
Smart Images
Figure CN120743326B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software debugging and analysis technology, and in particular to an automatic analysis method for the variability of configurable software systems. Background Technology
[0002] Configurable software systems based on precompiled macros represent a software development pattern that uses macro definitions to tailor and combine functionalities. These systems typically utilize conditional compilation mechanisms (such as preprocessor directives like #ifdef, #ifndef, and #define in C) to allow developers to flexibly select, tailor, and combine software features, quickly generating software variants adapted to different application scenarios and requirements. This configuration approach is widely used in embedded systems, operating system kernels, and other resource-constrained software domains. Its advantages include effectively reducing software size, lowering resource overhead, and improving software reusability and maintainability, while simultaneously meeting diverse and personalized user needs.
[0003] Because configurable software systems based on precompiled macro commands contain numerous macro switch combinations, each potentially corresponding to different program execution paths and behaviors, the systems exhibit high variability in functionality, performance, and even reliability. This high variability poses significant challenges to static analysis, dynamic analysis, and testing of the software. Traditional program analysis methods often struggle to effectively address the combinatorial explosion problem caused by numerous configurations. Therefore, researching precise and efficient program analysis methods for such software systems is not only of significant practical importance for improving software quality and ensuring system reliability, but also provides solid theoretical support and a technical foundation for enhancing the efficiency of configurable software development and maintenance, thus possessing immense research value.
[0004] Existing technologies for analyzing configurable software systems based on precompiled macro commands have the following shortcomings:
[0005] (1) For large-scale basic software systems, such as the Linux kernel and BusyBox, existing technology analysis statements are inefficient or cannot handle the existence conditions.
[0006] (2) There is no method yet available to analyze and obtain the internal characteristic interaction information of the system.
[0007] (3) When implementing program slicing using existing methods, it is impossible to retain syntax information or there are cases of incorrect slicing.
[0008] Therefore, there is an urgent need to provide an efficient and high-performance automatic variability analysis technology for configurable software systems to solve the above-mentioned technical problems. Summary of the Invention
[0009] To address the problems existing in the prior art, this invention provides an automatic variability analysis method for configurable software systems. By constructing a code attribute graph with variability awareness, it analyzes the existence conditions of program statements, the characteristic interactions within the system, and precise program slices that retain syntactic information.
[0010] The technical solution of this invention is implemented as follows:
[0011] An automatic variability analysis method for a configurable software system, wherein the configurable software system includes pre-compiled macro commands and several features, and an arbitrary number of the features are selected according to the pre-compiled macro commands to compile a customized target system; variability refers to the fact that some statements in the program are not always compiled and executed; the method includes the following steps:
[0012] T1. Import and parse the source code of the configurable software system, obtain the abstract syntax tree of all program statements in the source code, and determine the type of the program statements. The types include pre-compiled macro commands, declaration statements, and function call statements. In addition, they also include program statements of the types of expression statements, conditional statements, etc.; perform static analysis based on the abstract syntax tree to construct a code attribute graph; the code attribute graph includes directed edges and nodes; each node corresponds to an existence condition.
[0013] An Abstract Syntax Tree (AST) is a tree-like abstraction of source code that retains only the core elements of the syntactic structure (such as expressions and statements) while ignoring redundant symbols like parentheses. For example, an if statement is represented as a node and its branches in an AST. In the statement "a=1", the element / attribute "a", the operation "=", and the value "1" are all nodes in the AST.
[0014] Code Property Graph (CPG) is a multi-graph fusion model that integrates Abstract Syntax Trees (ASTs), Control Flow Graphs (CFGs), and Program Dependency Graphs (PDGs) into a unified graph structure. It is used to accurately describe program structure and semantic information, with nodes simultaneously carrying syntax, control flow, and data dependency information. CPGs can be stored in graph databases or embedded databases, such as Neo4j and BerkeleyDB.
[0015] In the code attribute diagram, if the type of the program statement corresponding to the node is the precompiled macro command, the node is recorded as a command node; otherwise, the node is recorded as a statement node.
[0016] During AST generation, each program statement can be broken down into a separate tree diagram, and the top node of the tree diagram represents that program statement. Statement types corresponding to statement nodes do not include comments or other statements that have no impact on program execution.
[0017] T2. Parse the command node and construct a feature expression; the precompiled macro command corresponding to the command node is associated with several features; the feature expression is used to represent the selection state and logical relationship of the feature; the existence condition of the command node is taken as the feature expression;
[0018] Here, "several" refers to one or more; selecting a status means selecting the "enabled / used" feature or the "disabled / unused" feature.
[0019] During the parsing process, either rule-based or model-based methods can be used to parse the precompiled macro commands. Regardless of the method used, a complete set of precompiled rules must be designed (or a model-based approach must be provided), similar to those used in C / C++ programming, including `#ifdef`, `#ifndef`, and `#if`. For `#if`, the state of the characteristic might be handled through `define()` or through expressions. Furthermore, there are special precompiled macro commands such as `#if 1` and `#if 0`, which respectively indicate that the condition of the controlled program statement is always true and always false. Regardless of the technique used, all possible cases of precompiled macro commands must be considered.
[0020] Specifically, precompiled macro commands need to be converted into Boolean expressions, or other expressions that can simultaneously retain characteristic attributes and Boolean value attributes, and then converted into a standardized format that can perform logical expression processing, such as Z3 expressions. Z3 expressions are a core concept in the SMT (Satisfiability Modular Theory) solver developed by Microsoft, used to describe logical constraints and automatically solve for variable values that satisfy the conditions.
[0021] The logical relationships are logical operations in the computer field such as "AND", "OR", and "NOT".
[0022] T3. In the code attribute graph, find all initial nodes; the initial node is a command node, and there is no preceding command node that points directly or indirectly to the initial node through directed edges; perform a depth-first traversal on all initial nodes respectively.
[0023] T4. During depth-first traversal, for the current node, find the nearest command node among its predecessor nodes and use it as the parent node;
[0024] If the current node is a statement node, then the existence condition of the current node is updated to the existence condition of the parent node; that is, assuming the existence condition of the current node is A and the existence condition of the parent node is B, then A=B, that is, B is assigned to A.
[0025] If the current node is a command node, then the characteristic expression of the current node and the existence condition of the parent node are logically operated to generate a new expression to update the existence condition of the current node; that is, assuming the existence condition of the current node is A and the existence condition of the parent node is C, then A = A∘C, where “∘” represents logical operations in the computer field such as “AND”, “OR”, and “NOT”.
[0026] T5. In the code attribute diagram, the statement node directly associated with the command node is denoted as a variable node; wherein, if the type of the program statement corresponding to the variable node is a declaration statement or a function call statement, the variable node is denoted as a seed node, and the program statement corresponding to the seed node is denoted as a seed statement.
[0027] The seed statement is sliced and analyzed to find associated program statements and obtain the corresponding statement nodes; the seed node and the associated statement node constitute a node group;
[0028] For seed statements, both the efficiency of slicing and whether it can cover all feature interaction scenarios need to be considered. Therefore, statements with non-permanently true or non-permanently false conditions and statements with call relationships are used as seed statements, and the node IDs of all seed statement nodes in the graph are obtained.
[0029] T6. Perform a logical AND operation on all nodes in the node group to determine their existence conditions, and generate and output the feature interaction expression.
[0030] Feature interaction refers to the interaction / reference or control relationship between statements controlled by two or more features. By constructing feature expressions, the selection states of several features of a compiled macro command can be clearly and intuitively displayed. Based on this, the tree structure of AST can be used to quickly clarify the dependencies of program statements at different levels on the selection of each feature. Finally, by filtering seed statements and associating related program statements with existence conditions, the resulting feature interaction expressions can efficiently reflect the possible internal feature interaction combinations in a configurable software system. Based on internal feature interaction information, it is beneficial to achieve efficient defect location and repair during testing.
[0031] As a further optimization of the above scheme, it also includes: T7, reconstructing the code attribute graph according to the node group: in the code attribute graph, for any node group, constructing a directed edge or an undirected edge between any two nodes in the node group.
[0032] By preserving the syntactic information of the slice analysis results through code attribute graphs, efficient code porting or version iteration can be achieved in subsequent system maintenance, which helps reduce the manual cost of system maintenance.
[0033] As a further optimization of the above scheme, in T4, when the current node is a command node, if the program statements corresponding to the current node and the parent node are nested, then the existence condition is updated as follows:
[0034] ;
[0035] in, Indicates the current node, Indicates the condition for the existence of the current node; Indicates the parent node, Indicates the condition for the existence of a parent node. Represents the characteristic expression of the current node;
[0036] If the program statements corresponding to the current node and the parent node are parallel, then the update of the existence condition is as follows: .
[0037] As a further optimization of the above scheme, in T5, the slice analysis includes pre-analysis, which is to perform slice analysis on the interaction of program statements within the same file; the pre-analysis includes structural relationship analysis, call relationship analysis, definition relationship analysis, data flow analysis, control flow analysis, and variability analysis.
[0038] For the pre-analysis, all abstract syntax tree nodes of the seed statement are first obtained. Then, data structures such as queues are used to iteratively analyze and process all related nodes of these nodes based on rules. During the iterative analysis process, a caching mechanism is used to avoid the same nodes being analyzed repeatedly, and nodes that are meaningless and do not appear directly in the code are not analyzed.
[0039] As a further optimization of the above scheme, in T5, the slice analysis also includes post-analysis, which is to perform slice analysis on the interaction of program statements between different files;
[0040] The post-analysis is based on the node group obtained from the pre-analysis and further analyzes it, that is, it finds nodes associated with nodes in the node group and obtains new nodes to add to the node group.
[0041] When dealing with function calls, library file calls, data structure types, and object references, the call statements and function / data structure / object definition blocks exist in different files. Therefore, post-analysis allows for a deeper understanding and identification of the interactions between program statements in different files. Here, "object" refers to the object in "object-oriented" programming.
[0042] Post-analysis is an optional step, not a mandatory one.
[0043] As a further optimization of the above scheme, T5 also includes conflict handling, namely:
[0044] For each node group, if the existence conditions between any two nodes constitute a condition conflict, then both nodes are recorded as conflicting nodes; the condition conflict is that each of the two existence conditions has at least one identical feature, and the selection state of the feature is different in the two existence conditions.
[0045] Remove the conflicting node from the node group; each conflicting node and the remaining nodes in the node group form a new node group.
[0046] As a further optimization of the above scheme, the feature expression, the existence condition, and the feature interaction expression are converted into DNF or CNF format and then simplified.
[0047] DNF (Disjunctive Normal Form) and CNF (Conjunctive Normal Form) are normalized representations of logical expressions.
[0048] DNF: Each clause describes a complete set of scenarios that may satisfy the condition, suitable for extracting expressions from a truth table (each true line corresponds to a clause).
[0049] CNF: Each clause defines a set of minimum constraints that must be satisfied, often used to describe complex combined constraints.
[0050] Compared with the prior art, the present invention achieves the following beneficial effects:
[0051] This invention provides an automatic variability analysis method for configurable software systems. By constructing feature expressions and a variability-aware code attribute graph, the selection states of several features of a compiled macro command can be clearly and intuitively displayed. Based on this, the tree structure of the Abstract Syntax Tree (AST) can be used to quickly clarify the selection dependencies of program statements at different levels on each feature. Finally, by filtering seed statements and associating related program statements with existence conditions, the resulting feature interaction expressions can efficiently reflect the possible internal feature interaction combinations in the configurable software system. Based on the internal feature interaction information, it is beneficial to achieve efficient defect location and repair during testing.
[0052] Furthermore, by preserving the syntactic information of the slice analysis results through code attribute graphs, efficient code porting or version iteration can be achieved in subsequent system maintenance, which helps reduce the manual cost of system maintenance. Attached Figure Description
[0053] Figure 1 This is a flowchart illustrating an automatic variability analysis method for a configurable software system provided in an embodiment of the present invention. Detailed Implementation
[0054] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0055] like Figure 1 As shown, this embodiment provides an automatic variability analysis method for a configurable software system, including the following steps:
[0056] T1. Import and parse the source code of the configurable software system, including all header files and source files; obtain the abstract syntax tree of all program statements in the source code and determine the type of program statement, including preprocessor macros, declaration statements, and function call statements, as well as expression statements, conditional statements, and other types of program statements; perform static analysis based on the abstract syntax tree to construct a code attribute graph; the code attribute graph includes directed edges and nodes; in particular, the directed edges additionally record the variable information of the target system, denoted as variable edges, using "VARIABILITY", to describe the program statements controlled by the preprocessor macros ("executed" or "not executed").
[0057] Each node corresponds to a condition for existence.
[0058] In the code attribute diagram, if the type of the program statement corresponding to the node is a precompiled macro command, the node is recorded as a command node; otherwise, the node is recorded as a statement node.
[0059] T2. Parse command nodes and construct feature expressions; the precompiled macro commands corresponding to command nodes are associated with several features; the feature expressions are used to represent the selection state and logical relationship of features; the existence condition of command nodes is the feature expression.
[0060] T3. In the code property graph, find all initial nodes; the initial node is a command node, and there is no preceding command node that points directly or indirectly to the initial node through directed edges; mapped to the code property graph, the initial node is a command node without an incoming edge of type "VARIABILITY", which means it represents the starting point of all precompiled macro commands.
[0061] Perform a depth-first traversal on each of the initial nodes.
[0062] T4. During depth-first traversal, for the current node, find the nearest command node among its predecessor nodes and take it as the parent node; analyze the control relationship between the current node and the parent node, and update the existence condition of the current node according to the existence condition of the parent node.
[0063] If the current node is a statement node, then the existence condition of the current node is updated to the existence condition of the parent node. At this time, the parent node has a "VARIABILITY" edge pointing to the current node. That is, assuming the existence condition of the current node is A and the existence condition of the parent node is B, then A=B, that is, B is assigned to A. Specifically, a command node is directly associated with the program statement (preprocessor macro command) "#ifndef CONFIG_NO_HZ_COMMON". The three statement nodes that this command node directly points to are s1, s2, and s3. The existence condition of these three statement nodes is "Not(CONFIG_NO_HZ_COMMON)", which can also be expressed in another form as "!CONFIG_NO_HZ_COMMON".
[0064] If the current node is a command node, then the characteristic expression of the current node and the existence condition of the parent node are logically operated to generate a new expression to update the existence condition of the current node.
[0065] In this embodiment, the logical operation process differs depending on the relationship between the current node and its parent node.
[0066] If the program statements corresponding to the current node and its parent node are nested, then the conditional update is as follows:
[0067] ;
[0068] in, Indicates the current node, Indicates the condition for the existence of the current node; Indicates the parent node, Indicates the condition for the existence of a parent node. Represents the characteristic expression of the current node;
[0069] If the program statements corresponding to the current node and its parent node are parallel, then the conditional update is as follows: .
[0070] For example, for a node 1, the corresponding preprocessor macro command is "#if Feature A & Feature B". There is a node 2, the corresponding preprocessor macro command is "#elif Feature A & !(Feature B)". There is a node 3, the corresponding preprocessor macro command is "#else !(Feature) A & Feature B". In this case, the three parent nodes represent three scenarios implemented by the judgment method, which are parallel relationships.
[0071] At this point, there is another node 4, whose corresponding pre-compiled macro command is "#if feature C & feature D". The implementation of node 4 is based on node 1, which means that node 1 and node 4 are nested. In terms of program statements, this means "there is another if (conditional judgment) in a statement block under an if".
[0072] T5. In the code attribute diagram, the statement node directly associated with the command node is called a variable node; among them, if the type of the program statement corresponding to the variable node is a declaration statement or a function call statement, the variable node is called a seed node, and the program statement corresponding to the seed node is called a seed statement.
[0073] The seed statement is sliced and analyzed to find related program statements and obtain the corresponding statement nodes; the seed node and the related statement nodes form a node group;
[0074] In this embodiment, slice analysis includes pre-analysis and post-analysis. Pre-analysis involves performing slice analysis on the interactions of program statements within the same file; pre-analysis includes structural relationship analysis, call relationship analysis, definition relationship analysis, data flow analysis, control flow analysis, and variability analysis.
[0075] Structural relation analysis involves searching all the abstract syntax tree child nodes of the seed node;
[0076] Call relationship analysis checks whether there are function calls in the seed node; if so, it searches for nodes related to that function call.
[0077] Relationship analysis is defined as checking whether a seed node has a custom data type / structure, and if it does, searching for related nodes of that data type / structure;
[0078] Data flow analysis involves searching for relevant nodes that define and use all variables related to the seed node;
[0079] Control flow analysis searches for the corresponding nodes of the program statements to which the control seed node belongs, that is, the statement nodes corresponding to the program statements that have a control relationship with the seed statement, such as the application of statements like "if" and "for".
[0080] Variability analysis searches for nodes that have a variability relationship with the seed node.
[0081] For the pre-analysis, all abstract syntax tree nodes of the seed statement are first obtained. Then, data structures such as queues are used to iteratively analyze and process all related nodes of these nodes based on rules. During the iterative analysis process, a caching mechanism is used to avoid the same nodes being analyzed repeatedly, and nodes that are meaningless and do not appear directly in the code are not analyzed.
[0082] The post-analysis involves slicing and analyzing the interactions between program statements in different files. The post-analysis is based on the node groups obtained from the pre-analysis and performs further analysis, that is, finding nodes associated with nodes in the node group and adding new nodes to the node group.
[0083] When dealing with function calls, library file calls, data structure types, and object references, the call statements and function / data structure / object definition blocks exist in different files. Therefore, post-analysis allows for a deeper understanding and identification of the interactions between program statements in different files. Here, "object" refers to the object in "object-oriented" programming.
[0084] This embodiment also includes conflict handling, namely:
[0085] For each node group, if the existence conditions between any two nodes constitute a condition conflict, then both nodes are recorded as conflicting nodes; a condition conflict is defined as the existence conditions each having at least one identical feature, and the feature being selected in different states in the two existence conditions.
[0086] For example, the existence expression of a node is " The existence expression for another node is "". Therefore, we can see that feature A exists in both expressions, but the former " "Indicates that feature A is not selected, the latter" "" indicates that feature A is selected, meaning there is a conflict in feature selection, or a condition conflict.
[0087] Remove conflicting nodes from the node group; each conflicting node and the remaining nodes in the node group form a new node group.
[0088] For example, given a node group [s1, s2, s3, s4], if nodes s2 and s3 are both conflicting nodes, then new node groups [s1, s2, s4] and [s1, s3, s4] can be constructed. Furthermore, if s2 and s4 conflict, then [s1, s2, s4] can be divided into new node groups [s1, s2] and [s1, s4].
[0089] T6. Perform a logical AND operation on all nodes in the node group to determine their existence conditions, and generate and output the feature interaction expression.
[0090] T7. Reconstruct the code property graph based on node groups: In the code property graph, for any node group, construct a directed edge between any two nodes in the node group.
[0091] In this embodiment, the feature expression, existence condition, and feature interaction expression are converted into DNF or CNF format and then simplified.
[0092] DNF (Disjunctive Normal Form) and CNF (Conjunctive Normal Form) are normalized representations of logical expressions.
[0093] DNF: Each clause describes a complete set of possible scenarios that can satisfy the condition, suitable for extracting expressions from a truth table (each true line corresponds to a clause). For example, the original expression A→(B∧C) is transformed into the DNF expression ¬A∨(B∧C).
[0094] CNF: Each clause defines a minimal set of constraints that must be satisfied, often used to describe complex combined constraints. For example, the original expression A→(B∧C) is transformed into the CNF expression (¬A∨B)∧(¬A∨C).
[0095] Based on the disclosure and teachings of the foregoing specification, those skilled in the art can make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and some modifications and changes to the present invention should also fall within the protection scope of the claims of the present invention. Furthermore, although some specific terms are used in this specification, these terms are only for convenience of explanation and do not constitute any limitation on the present invention.
Claims
1. An automatic variability analysis method for a configurable software system, characterized in that, Includes the following steps: T1. Import and parse the source code of the configurable software system, obtain the abstract syntax tree of all program statements in the source code, and determine the type of program statement, including pre-compiled macro commands, declaration statements and function call statements; perform static analysis based on the abstract syntax tree to construct a code attribute graph; the code attribute graph includes directed edges and nodes, and each node corresponds to an existence condition; In the code attribute diagram, if the type of the program statement corresponding to the node is the precompiled macro command, the node is recorded as a command node; otherwise, the node is recorded as a statement node. T2. Parse the command node and construct the feature expression; The precompiled macro command corresponding to the command node is associated with several features; The feature expression is used to represent the selection state and logical relationship of the feature; the existence condition of the command node is taken from the feature expression; T3. Locate all initial nodes in the code attribute graph; The initial node is a command node, and there is no preceding command node that points directly or indirectly to the initial node through directed edges; Perform a depth-first traversal on each of the initial nodes; T4. During depth-first traversal, for the current node, find the nearest command node among its predecessor nodes and use it as the parent node; If the current node is a statement node, then the existence condition of the current node is updated to the existence condition of the parent node; If the current node is a command node, then the feature expression of the current node and the existence condition of the parent node are logically operated to generate a new expression to update the existence condition of the current node. T5. In the code attribute diagram, the statement node directly associated with the command node is denoted as a variable node; wherein, if the type of the program statement corresponding to the variable node is a declaration statement or a function call statement, the variable node is denoted as a seed node, and the program statement corresponding to the seed node is denoted as a seed statement. The seed statement is sliced and analyzed to find associated program statements and obtain the corresponding statement nodes; the seed node and the associated statement node constitute a node group; T6. Perform a logical AND operation on all nodes in the node group to determine their existence conditions, and generate and output the feature interaction expression.
2. The automatic variability analysis method for a configurable software system according to claim 1, characterized in that, Also includes: T7. Reconstruct the code attribute graph based on the node group: In the code attribute graph, for any node group, construct a directed edge or an undirected edge between any two nodes in the node group.
3. The automatic variability analysis method for a configurable software system according to claim 1, characterized in that, In T4, when the current node is a command node, if the program statements corresponding to the current node and the parent node are nested, then the update of the existence condition is as follows: ； in, Indicates the current node, Indicates the condition for the existence of the current node; Indicates the parent node, Indicates the condition for the existence of a parent node. Represents the characteristic expression of the current node; If the program statements corresponding to the current node and the parent node are parallel, then the update of the existence condition is as follows: .
4. The automatic variability analysis method for a configurable software system according to claim 1, characterized in that, In T5, the slice analysis includes pre-analysis, which is to perform slice analysis on the interaction of program statements within the same file; the pre-analysis includes structural relationship analysis, call relationship analysis, definition relationship analysis, data flow analysis, control flow analysis, and variability analysis.
5. The automatic variability analysis method for a configurable software system according to claim 4, characterized in that, In T5, the slice analysis also includes post-analysis, which is to perform slice analysis on the interaction of program statements between different files; The post-analysis is based on the node group obtained from the pre-analysis and further analyzes it to obtain new nodes to be added to the node group.
6. The automatic variability analysis method for a configurable software system according to claim 4, characterized in that, The T5 also includes conflict handling, namely: For each node group, if the existence conditions between any two nodes constitute a condition conflict, then both nodes are recorded as conflicting nodes; the condition conflict is that each of the two existence conditions has at least one identical feature, and the selection state of the feature is different in the two existence conditions. Remove the conflicting node from the node group; each conflicting node and the remaining nodes in the node group form a new node group.
7. The automatic variability analysis method for a configurable software system according to claim 1, characterized in that, The feature expression, the existence condition, and the feature interaction expression are converted into DNF or CNF format, and then simplified into formulas.