A software operation exception diagnosis method

Abstract

The present application relates to the technical field of computer software fault diagnosis, in particular to a software running abnormality diagnosis method, which constructs execution track and register state mapping by using time stamp, combines nodes exceeding the limit into lag sections by calculating return reading interval, rearranges nodes in lag sections according to execution starting time to correct order, compares the state change direction of rearranged nodes to demarcate abnormal trigger position, compares the overlapping dislocation relationship of abnormal node interval and lag interval and classifies, and generates abnormal diagnosis information set. The present application acquires function start and end information and associates state register content, realizes joint representation of calling process and abnormal position, identifies lag area in combination with return reading interval, corrects the order of time inversion nodes, accurately associates abnormal trigger position with execution state, improves the accuracy of abnormality identification of complex calling chain compared with single record analysis method, and reduces the positioning deviation of track disorder.

Description

Technical Field

[0001] This invention relates to the field of computer software fault diagnosis technology, and in particular to a method for diagnosing software malfunctions. Background Technology

[0002] The field of computer software fault diagnosis technology includes software operation status monitoring technology, abnormal behavior identification technology, log recording and parsing technology, and fault location and analysis technology. The core of this technology lies in continuously collecting data on the instruction call sequence, memory usage changes, thread scheduling, and input / output interaction records during software execution. Based on time series data, the operating status is correlated and analyzed. At the same time, combined with the judgment rules of abnormal triggering conditions, error information generated by the software at different stages of operation is classified and traced to its source. This leads to the construction of a complete fault diagnosis technology system, covering key aspects such as data collection, status identification, anomaly comparison, and cause tracing.

[0003] Among them, the software operation anomaly diagnosis method refers to the processing method for identifying and analyzing unexpected behaviors that occur during software execution. The main technical issues it addresses include extracting operation log content, recording function call paths, marking abnormal trigger points, collecting operation parameters, and associating and matching error information. Specifically, it involves reading the log files generated during program execution in segments, arranging the call order according to timestamps, marking the entry and exit points of key functions, recording the return values ​​of abnormal codes, and comparing the operation parameters with historical records item by item, thereby completing the process of identifying and diagnosing abnormal situations.

[0004] Existing technologies primarily rely on recorded information generated during program execution for status assessment during software anomaly diagnosis. However, when function call chains are long, threads are executed in an interleaved manner, or there are delays in processing return results, the recorded information cannot accurately reflect the actual execution sequence of functions and the correlation between state changes. This makes it difficult to clarify the impact relationship between abnormal nodes. For example, when multiple functions respond to anomalies consecutively, it is impossible to distinguish the correspondence between changes in the call order and the triggering of state anomalies, which affects the efficiency of fault location in complex fault scenarios. Summary of the Invention

[0005] To address the technical problems existing in the prior art, embodiments of the present invention provide a method for diagnosing software malfunctions. The technical solution is as follows: A method for diagnosing software malfunctions includes the following steps: Obtain the function entry timestamp and the function return instruction trigger timestamp, generate and pair call instance identifiers according to thread and call order to form function execution intervals, read and map the contents of the program status word register, connect adjacent function execution intervals according to time and associate relevant information to obtain the function execution trajectory mapping set; The function is called to execute the trajectory mapping set, the function nodes are determined according to the calling order, the return read events are collected and matched according to the calling instance identifier, the first read after the return is used to form the return read interval, the adjacent intervals are marked as abnormal, the consecutive abnormal nodes are merged and associated with the start and end function nodes and trajectory positions to obtain the return lag segment distribution map; Based on the returned lag segment distribution map, extract the function nodes within the segment, compare the execution start time of adjacent function nodes according to the original calling order, repeatedly swap and verify the inverted function nodes until the function node order is consistent with the execution start time, put them back to the corresponding trajectory position and integrate the function nodes outside the segment to obtain the call path rearrangement result; Based on the call path rearrangement result, the function node is marked as a state detection node, the register content is obtained according to the call instance identifier, the change direction is recorded by comparing with adjacent state detection nodes, the intermediate state detection node is verified by three consecutive state detection nodes, and the state detection nodes with abnormal status before and after are retained and their positions are marked to obtain the state abnormality trigger position identifier set. The system calls the set of state anomaly trigger locations, locates the corresponding rearranged function node in the call path rearrangement result, reads the function execution interval and call instance identifier, forms the return lag interval from the return lag interval distribution map, compares the interval markings with the overlapping and misaligned state detection nodes, classifies them according to relationship type and associates the information, and obtains the software anomaly diagnosis information set.

[0006] The beneficial effects of the technical solutions provided by the embodiments of the present invention include at least the following: In this invention, by acquiring the start and end information of function execution and associating it with the contents of the program status word register, a joint representation of the function call process, the state change process, and the location of the abnormal trajectory is achieved. Potential lag areas are identified by combining the changes in the return read interval, and the order of call nodes with time inversion is corrected. This allows the abnormal trigger location to be accurately associated with the execution state. Compared with the method of relying on a single running record for analysis, this can improve the accuracy of abnormal behavior identification and fault cause tracing in complex call chains and reduce the positioning deviation caused by execution trajectory disorder. Attached Figure Description

[0007] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a flowchart illustrating the acquisition process of S1 in this invention; Figure 3 This is a flowchart illustrating the acquisition process of S2 in this invention; Figure 4 This is a flowchart illustrating the acquisition process of S3 in this invention; Figure 5 This is a flowchart illustrating the acquisition process of S4 in this invention; Figure 6This is a flowchart of the acquisition process for S5 of the present invention. Detailed Implementation

[0008] The following detailed explanation illustrates the specific implementation methods: The basic implementation examples are as follows: Figure 1 As shown: A method for diagnosing software malfunctions, comprising the following steps: S1: Obtain the function entry timestamp and function return instruction trigger timestamp during the execution of the server application. Generate a call instance identifier for each function call according to the thread and call order. Pair the two types of timestamps based on the call instance identifier. Mark the function entry timestamp as the execution start point and the function return instruction trigger timestamp as the execution end point to form a function execution interval. Sort the function execution intervals according to the function entry timestamp. When the function return instruction is triggered, read the contents of the program status word register and map the register contents to the corresponding function execution interval. Connect adjacent function execution intervals in sequence according to the time relationship to form a continuous execution trajectory. Associate each function execution interval, call instance identifier and corresponding register contents to obtain a function execution trajectory mapping set. Please see Figure 2 Specifically, S1 includes: S11: Obtain the function entry timestamp and function return instruction trigger timestamp during the server application's execution. Generate call instance identifiers according to thread and call order. Determine the ownership and pair them based on the call instance identifiers. Mark the function entry timestamp as the execution start point and the function return instruction trigger timestamp as the execution end point. Connect the timestamps to form the function execution interval, obtaining the call instance execution interval set; as detailed below: This module acquires the function entry timestamps and function return instruction trigger timestamps during the execution of a server application. In a multi-threaded concurrent scenario, the server application continuously outputs a function call event stream. Utilizing an eBPF probe deployed in kernel space and the Perf-Event hardware performance counter component, it captures the execution trajectory of application-layer functions in real time. For example, if the system detects that the first thread calls function A, which handles network requests, in its stack frame, the probe module captures the function entry timestamp of function A as 1688000000.100 seconds, and the subsequent function return instruction trigger timestamp as 1688000000.150 seconds. Simultaneously, if the system detects that the second thread calls function B, which is logged, the system captures the function entry timestamp of function B as 1688000000.105 seconds, and the function return instruction trigger timestamp as 1688000000.115 seconds. Every second, the captured timestamps are pushed into the processing buffer in the order of acquisition. The thread identifier string Thread_1 of the first thread is extracted, and the name code of function A, String_FuncA, is merged and concatenated to form the call instance identifier ID_1. For the second thread, the thread identifier string Thread_2 is extracted, and the name code of function B, String_FuncB, is merged and concatenated to form the call instance identifier ID_2. The thread identifier field of each call instance identifier is extracted, and the historical registration record corresponding to the thread identifier field is searched in the preset thread relationship mapping set. If the thread identifier in the data packet to be paired matches the historical registration record, and the function entry timestamp is earlier than the function return instruction trigger timestamp, then the group of timestamps is assigned to the corresponding call instance identifier. The timestamp pairing difference is calculated based on the time difference calculation formula. , where parameters This indicates the time stamp of the function return instruction triggered by the hardware counter, in seconds (s). The parameter... Represents the function entry timestamp in seconds (s), parameters This represents the execution time obtained from the pairing, expressed in seconds (s). Let the timestamp pairing difference for function A be 1688000000.150 seconds minus 1688000000.100 seconds, which equals 0.050 seconds. If this difference is greater than the preset minimum fluctuation threshold of 0.000001 seconds, the pairing is considered valid. The function entry timestamp of function A, 1688000000.100 seconds, is marked as the execution start point, and the function return instruction trigger timestamp of function A, 1688000000.150 seconds, is marked as the execution end point. The execution start point and execution end point are then... The row data structure is encapsulated and arranged in chronological order to construct a continuous associative array of the start and end points. Let the associative array generated by function A be the first interval containing the start point 1688000000.100 seconds and the end point 1688000000.150 seconds, and the associative array generated by function B be the second interval containing the start point 1688000000.105 seconds and the end point 1688000000.115 seconds. The generated intervals are then attached to a global linked list, and the nodes are linked using memory pointers to obtain the set of execution intervals for the calling instance.

[0009] S12: Based on the set of execution intervals for called instances, the function execution intervals are arranged in ascending order of function entry timestamps. When a function return instruction is triggered, the contents of the program status word register are read, the function execution interval is located according to the called instance identifier, the register bit value is written to the interval association position, and the function execution interval sequence number, called instance identifier, and register bit value mapping relationship are recorded to generate a register interval mapping value set; specifically as follows: Based on the execution interval set of the invoked instance, all interval data in the execution interval set are retrieved. The execution start point of the first interval (1688000000.100 seconds), the execution start point of the second interval (1688000000.105 seconds), and the execution start point of the third interval (1688000000.098 seconds) are extracted. A bubble sort algorithm is applied to the execution start point values ​​of each interval in ascending order. Comparing 1688000000.098 seconds with 1688000000.100 seconds, and comparing 1688000000.100 seconds with 1688000000.105 seconds, the intervals are adjusted in the memory buffer to the third group. Interval 1, Interval 2: At the instant the server system's hardware interrupt handling unit detects the function return instruction trigger signal, it reads the 32-bit binary value of the current kernel program status word register (PSW) using the CPU's built-in architecture-level register read instruction. Assuming the register value read when function A returns is translated to hexadecimal as 0x00000003, the call instance identifier ID_1 is extracted. The data nodes that perfectly match ID_1 are scanned in the sorted interval dataset, accurately locating the first interval, which consists of the starting point 1688000000.100 seconds and the ending point 1688000000.150 seconds. The bit-weighted radix conversion formula is then used... Convert the hexadecimal register value to a binary string, where the parameter Represents a dimensionless intermediate conversion value in decimal, parameter This represents the total length of the hexadecimal digits, and here it is taken as 8. (Parameter) Indicates the first The dimensionless numerical value corresponding to a hexadecimal character, symbol This indicates a cumulative summation. The binary bit values ​​are written into the reserved register attribute mapping field Address_PSW in the first group of interval data structures. Let the written mapping relationship data structure contain the interval index value 1, the call instance identifier string ID_1, and the register bit value binary string 00000000000000000000000000000011. Let the mapping relationship data structure corresponding to the second thread function B contain the interval index value 2, the call instance identifier string ID_2, and the register bit value binary string 00000000000000000000000000000001. Load all the sequentially generated mapping relationship data structures into the static mapping data table to obtain the register interval mapping value set.

[0010] S13: Based on the set of execution intervals for called instances and the set of mapped values ​​for register intervals, sequentially read the timestamps of the starting points of adjacent function execution intervals, connect adjacent function execution intervals according to their chronological order, record the trajectory positions, associate the function execution intervals, the called instance identifier, and the register bit values ​​with the corresponding trajectory positions, and arrange all trajectory positions according to the function entry timestamp to obtain the function execution trajectory mapping set; specifically as follows: Based on the set of execution intervals of the calling instance and the set of mapped values ​​of the register intervals, extract the execution start timestamp of the first interval Node_1 (1688000000.098 seconds) and the execution start timestamp of the second interval Node_2 (1688000000.100 seconds) from the set of execution intervals of the calling instance, and perform a subtraction operation to calculate the time difference between adjacent nodes. In the example calculation It lasted for 1688000000.100 seconds. The time is 1688000000.098 seconds, calculated as follows: seconds, parameter The timestamp of the execution start point for the next node, in seconds (s), parameter The timestamp of the current node's execution start point, in seconds (s), parameter Given the time difference between adjacent nodes in seconds (s), determine... If the second is greater than zero, determine that the time order of Node_1 takes precedence over Node_2. Establish a data connection line from the end pointer of Node_1 to the start pointer of Node_2. Generate the first trajectory position identifier Loc_1 corresponding to Node_1 and the second trajectory position identifier Loc_2 corresponding to Node_2. Retrieve the call instance identifier ID_3 bound to Node_1 and the register bit value 0x00000001 from the register interval mapping value set. Combine the interval data of Node_1, ID_3, and 0x0000... 0001 is packaged together and injected into the memory slot corresponding to the trajectory position identifier Loc_1. The call instance identifier ID_1 bound to Node_2 and the register bit value 0x00000003 are retrieved from the register interval mapping value set. The interval data of Node_2, ID_1, and 0x00000003 are packaged together and injected into the memory slot corresponding to the trajectory position identifier Loc_2. The function entry timestamp values ​​contained within all trajectory position slots are extracted. Following the logic of ascending entry timestamps, the linear memory offset calculation formula is used... Calculate the physical memory address, where the parameters are... Indicates the first The physical memory byte offset of each trajectory position slot, in bytes (Byte), parameter Indicates the starting memory base address and is set to 0x0000 here, parameter This indicates the dimensionless arrangement index of the slot, with a value of 0 or 1. (Parameter) The memory bytes occupied by a single slot are represented as 0x0040 bytes. The offset of the first slot is calculated to be 0x0000 address, and the offset of the second slot is 0x0040 address. The physical storage offsets of the trajectory position slots in the global trajectory map are rearranged in turn to obtain the function execution trajectory mapping set.

[0011] S2: The continuous execution trajectory, call instance identifier, and function return instruction trigger timestamp of the function execution trajectory mapping set are called. The execution interval of each function is determined as a function node according to the call order. The return result reading event and its timestamp are collected along the continuous execution trajectory. The reading event is matched with the function node according to the call instance identifier. The timestamp of the first reading of the return result after the function return instruction is triggered is determined as the return result reading timestamp. The function return instruction trigger timestamp and the return result reading timestamp are matched to form the return reading interval. The return reading intervals in the same path are arranged according to the function node order. The current function node is compared with the adjacent function nodes before and after. Function nodes that exceed the range of adjacent interval changes are marked. The continuously marked function nodes are merged into the return lag segment according to the original call order. The starting function node, ending function node and trajectory position of the return lag segment are associated to obtain the return lag segment distribution map. Please see Figure 3 Specifically, S2 includes: S21: Using the continuous execution trajectory, call instance identifier, and function return instruction trigger timestamp from the function execution trajectory mapping set, the execution interval is determined as a function node according to the call order. Return read event timestamps are collected along the execution trajectory. The event attribution is determined based on the call instance identifier. The first read event timestamp after the return instruction is triggered is determined as the return result read timestamp, thus obtaining the return read timestamp set; specifically as follows: The continuous execution trajectories, call instance identifiers, and function return instruction trigger timestamps in the function execution trajectory mapping set are used to extract the continuous trajectory linked list containing Loc_1, Loc_2, and Loc_3 from memory offsets 0x0000 and 0x0040 in the function execution trajectory mapping set. The call instance identifiers ID_3 (corresponding to Loc_1), ID_1 (corresponding to Loc_2), and ID_2 (corresponding to Loc_3) are read, and the function return instruction trigger timestamps recorded at each position are extracted. Let the log recording function C corresponding to Loc_1 return... The return timestamp is 1688000000.099 seconds. The network request function A corresponding to Loc_2 returns a timestamp of 1688000000.150 seconds. The logging function B corresponding to Loc_3 returns a timestamp of 1688000000.115 seconds. Following the order of the linked list pointers, Loc_1 is encapsulated as the first function node Node_C, Loc_2 as the second function node Node_A, and Loc_3 as the third function node Node_B. This is achieved through the upro deployed in the system kernel. The user-mode dynamic tracing instrumentation probe and shared memory bus monitoring module listen for read commands on the process memory bus, capture access actions of the application layer or kernel layer to the function return value storage area, and collect the return result read event stream and its corresponding timestamp. Let the timestamp of the first read event to the memory address of return value ID_3 be 1688000000.101 seconds, the timestamp of the first read event to the memory address of return value ID_1 be 1688000000.280 seconds, and the timestamp of the second read event to the memory address of return value ID_1 be... At 1688000000.290 seconds, the timestamp of the first read event of the memory address returned by ID_2 is 1688000000.118 seconds. Parsing the call instance identifier field contained in each return result read event data packet, we find that read event ID_3 belongs to function node Node_C, read event ID_1 belongs to function node Node_A, and read event ID_2 belongs to function node Node_B. For multiple read event timestamps belonging to the same call instance identifier ID_1, the first read timestamp extraction formula is used. , where parameters This indicates the earliest retrieved result's read timestamp, in seconds (s). (Parameter) Indicates the corresponding number The function reads the timestamp of the event in seconds (s). The function extracts the minimum value. It compares 1688000000.280 seconds with 1688000000.290 seconds, finding the minimum to be 1688000000.280 seconds. It extracts the earlier value, 1688000000.280 seconds, discarding subsequent read event timestamps. The timestamp for the return result of function node Node_C is determined to be 1688000000.101 seconds, for function node Node_A it is 1688000000.280 seconds, and for function node Node_B it is 1688000000.118 seconds. The timestamp data from each node is then packaged to obtain the return read timestamp set.

[0012] S22: Based on the return read timestamp set, extract the function return instruction trigger timestamp and return result read timestamp corresponding to each function node. Match the two timestamps one by one according to the call instance identifier. Calculate the duration obtained by subtracting the function return instruction trigger timestamp from the return result read timestamp to form the return read interval. Arrange the return read intervals of the same path according to the function node order to generate a path interval sequence value; as detailed below. Based on the return read timestamp set, retrieve the data items corresponding to Node_C, Node_A, and Node_B in the return read timestamp set. Extract the function return instruction trigger timestamp of 1688000000.099 seconds and the return result read timestamp of 1688000000.101 seconds for Node_C. Extract the function return instruction trigger timestamp of 1688000000.150 seconds and the return result read timestamp of 1688000000.280 seconds for Node_A. Extract the function return instruction of Node_B. The trigger timestamp is 1688000000.115 seconds and the return result read timestamp is 1688000000.118 seconds. The call instance identifiers ID_3, ID_1, and ID_2 in each data item are read. The return timestamp and read timestamp of Node_C are bound to ID_3, the return timestamp and read timestamp of Node_A are bound to ID_1, and the return timestamp and read timestamp of Node_B are bound to ID_2. For each call instance identifier, the return lag time is calculated according to the formula. Perform a subtraction operation, where the parameter This indicates the return interval duration in seconds (s). This indicates that the returned result reads the timestamp in seconds (s). Parameter This represents the time stamp of the function return instruction, in seconds (s). For instance ID_3, the duration is calculated by subtracting 1688000000.101 seconds from 1688000000.099 seconds, resulting in a difference of 0.002 seconds, which is recorded as the return read interval for Node_C. For instance ID_1, the duration is calculated by subtracting 1688000000.280 seconds from 1688000000.150 seconds, resulting in a difference of 0.130 seconds, which is recorded as the return read interval for Node_A. For instance ID_2, the duration difference of 0.003 seconds is calculated by subtracting 1688000000.115 seconds from 1688000000.118 seconds, and recorded as the return read interval of Node_B. The nodes on the same call path are extracted from the function execution trajectory mapping set in the order of Node_C, Node_A, and Node_B. The corresponding return read interval values ​​of 0.002 seconds, 0.130 seconds, and 0.003 seconds are arranged in sequence to obtain the path interval sequence value.

[0013] S23: Based on the path interval sequence value, take the minimum and maximum values ​​of the return read intervals of adjacent function nodes to form the range of adjacent interval changes. Compare the current function node's return read interval with the range of adjacent interval changes, mark function nodes outside the range, merge consecutively marked function nodes along the original calling order, determine the starting and ending function nodes of the segment and the trajectory position, and establish a distribution map of the return lag segment; specifically as follows: Based on the path interval sequence values, the return read interval of Node_C (0.002 seconds) and the return read interval of Node_B (0.003 seconds) are extracted, according to the dynamic boundary definition formula: ; Where parameters Indicates the range of variation between adjacent intervals, with the unit being seconds (s). Parameter The function represents an unordered set of read intervals returned by adjacent nodes. and The operations represent the extraction of minimum and maximum values, respectively. Comparing 0.002 seconds to 0.003 seconds, the minimum value of 0.002 seconds is taken as the lower limit of the interval, and the maximum value of 0.003 seconds is taken as the upper limit of the interval, constructing the range of adjacent interval changes as [0.002 seconds, 0.003 seconds]. The returned read interval value of the current node Node_A, 0.130 seconds, is extracted. This value is compared with the lower limit of the interval (0.002 seconds) and the upper limit of the interval (0.003 seconds). It is determined that 0.130 seconds is greater than the upper limit of the interval (0.003 seconds), meaning the current node value exceeds the range of adjacent interval changes [0.002 seconds, 0.003 seconds]. Node_A is marked as an abnormally lagging node (Flag_Lag) in the system memory data table. The adjacent nodes before and after Node_A are checked; if a new node Nod is added subsequently... The return read interval of e_A2 is 0.125 seconds and also exceeds its adjacent range [0.002 seconds, 0.003 seconds]. Therefore, Node_A and Node_A2 are linearly merged end-to-end according to the original call path order. If there are no consecutive abnormal nodes, a single Node_A constitutes an independent lag segment. The starting function node of the merged segment is determined to be Node_A, and the ending function node is Node_A (or Node_A2). The physical storage offset 0x0040 of node Node_A in the function execution trajectory mapping set is retrieved as the trajectory position identifier. The starting function node identifier Node_A, the ending function node identifier Node_A (or Node_A2), and the trajectory position identifier 0x0040 are mapped to the graph structure nodes to obtain the return lag segment distribution map.

[0014] S3: Based on the return lag segment distribution map, function nodes, and trajectory positions, extract the function nodes within each return lag segment according to the original call order, and compare the execution start time of the corresponding execution interval of adjacent function nodes in turn. When the execution start time of the previous function node is later than that of the next function node, swap the positions of the two function nodes. Continue to verify the execution start time of adjacent function nodes from the swapped position. Repeat the position swapping and order verification for function nodes that still have reversed time order until the arrangement order of each function node in the return lag segment is consistent with the execution start time order. Put the rearranged function nodes back into the corresponding trajectory positions and integrate them with the function nodes outside the return lag segment in turn according to the original call path to obtain the call path rearrangement result. Please see Figure 4 Specifically, S3 includes: S31: Based on the return lag segments, function nodes, and trajectory positions in the return lag segment distribution map, extract the function nodes within the segments according to the original calling order, read the execution start time of the function node's execution interval, determine the node's affiliation based on the trajectory position, arrange the nodes in the same segment according to the calling sequence number, and record the node identifier, execution start time, trajectory position, and segment sequence number to obtain the segment node index; specifically as follows: Based on the return lag segment, function node, and trajectory positions in the return lag segment distribution map, the starting function node Node_A, the ending function node Node_A2, and the physical storage offset 0x0040 recorded in the return lag segment distribution map are analyzed. Following the initially generated original call order, function nodes Node_A and Node_A2 within the lag segment are extracted. The global linked list is called to read the execution start time stamp (1688000000.100 seconds) bound to node_A and the execution start time stamp (1688000000.095 seconds) bound to node_A2. The physical storage offset 0x0040 of each node is retrieved, and the mapping relationship between offset 0x0040 and the return lag segment distribution map is matched. It is determined that Node_A and Node_A2 both belong to the same lag segment Seg_1. The sequence numbers of the two nodes in the original call sequence are extracted. Let the original call sequence number of Node_A be 2 and the original call sequence number of Node_A2 be 3. Based on the ascending order rule and the linear mapping formula... Create an ascending order queue, where the parameters are... Indicates the dimensionless location of storage in the queue, parameter This represents the original dimensionless call sequence number input. Node_A corresponds to the first position in the queue, and Node_A2 corresponds to the second position. The identifier string ID_1, execution start timestamp 1688000000.100 seconds, and trajectory position 0x0040 of Node_A are read. The identifier string ID_12, execution start timestamp 1688000000.095 seconds, and trajectory position 0x0044 of Node_A2 are read. The extracted identifier, execution start timestamp, trajectory position, and segment sequence number 1 are integrated to construct a data structure index item, thus obtaining the segment node index.

[0015] S32: Call the segment node index, compare the execution start time of adjacent function nodes, swap the positions when the execution start time of the previous node is later than that of the next node, verify the time order of subsequent adjacent nodes from the swap position, repeat the swap and verification for nodes with reversed time until the node arrangement order in the segment is consistent with the execution start time order, record the node identifier, arrangement number and execution start time, and generate the segment reorder number; Comparing the execution start times of adjacent function nodes includes: According to the order of adjacent function nodes formed by arranging nodes in the same segment according to the call sequence number, read the execution start time of the previous function node and the execution start time of the next function node one by one. Determine the adjacent function nodes whose execution start time of the previous function node is greater than the execution start time of the next function node as time inversion node pairs, and swap the arrangement positions of the previous and next function nodes in the time inversion node pairs. Verifying the time order of subsequent adjacent nodes from the swapped positions includes: Using the position of the function node after the swap as the starting position for verification, the execution start time of the function node corresponding to the starting position and its next adjacent function node are read. If the execution start time of the function node corresponding to the starting position is later than the execution start time of the next adjacent function node, the positions of the function node corresponding to the starting position and its next adjacent function node are swapped. This process continues until the execution start time of adjacent function nodes within the returned lag segment satisfies the condition that the execution start time of the preceding function node is not later than the execution start time of the following function node. Specifically: The system calls the segment node index to retrieve the execution start timestamp of the first node Node_A (1688000000.100 seconds) and the execution start timestamp of the second node Node_A2 (1688000000.095 seconds) under segment sequence number 1. It then performs a subtraction operation to calculate the time difference. In the example calculation It lasted for 1688000000.100 seconds. The time is 1688000000.095 seconds, calculated as follows: seconds, parameter The timestamp of the execution start point of the previous node, in seconds (s), parameter The timestamp of the execution start point of the next node, in seconds (s), parameter Given the time difference from the starting point and in seconds (s), determine... If the second is greater than zero, it is determined that the execution start time of the preceding node Node_A is later than that of the following node Node_A2. Node_A and Node_A2 are considered to form a time-reversed node pair. The pointer positions of Node_A and Node_A2 in the queue are swapped, so that Node_A2 is moved to the first position of the queue (sequence number 1), and Node_A is moved to the second position (sequence number 2). The sequence number 2 of Node_A after the swap is taken as the starting position for verification. The execution start timestamp of Node_A at sequence number 2 (1688000000.100 seconds) is read and compared with the execution start timestamp of the next adjacent node at sequence number 3, Node_A3 (168...). At 8000000.102 seconds, the subtraction difference 1688000000.100 minus 1688000000.102 equals -0.002 seconds. Since -0.002 seconds is less than or equal to zero, it is determined that the execution start time of Node_A is earlier than that of Node_A3. The backward swap of Node_A is stopped, and the verification ends. It is confirmed that the execution start time of all adjacent nodes in the segment satisfies that the previous node is not later than the next node. The permutation number 1 is mapped to Node_A2 and 1688000000.095 seconds, and the permutation number 2 is mapped to Node_A and 1688000000.100 seconds. The data is packaged to generate the segment reorder number.

[0016] S33: Based on the segment reordering number, extract the reordering function nodes, trajectory positions, and return lag segment boundary numbers. Adjust the reordering node backfill positions according to the boundary numbers, retain the original call numbers of function nodes outside the segment, connect the reordering nodes within the segment and the function nodes outside the segment along the original call path, and record the function node identifier, reordered trajectory position, and path number to obtain the call path reordering result; specifically as follows: Based on the segment reordering number, extract the reordering function node Node_A2 corresponding to reordering number 1 and the reordering function node Node_A corresponding to reordering number 2. Retrieve their respective physical storage offsets 0x0040 and 0x0044. Extract the starting boundary number 2 and ending boundary number 3 of segment Seg_1 in the trajectory linked list. Based on the starting boundary number 2, calculate the physical memory backfill address using the formula: Calculate the backfill location, where the parameters are... This represents the backfilled physical memory address of the rearranged node, in bytes. (Parameter) This represents the physical memory address of the starting boundary of the segment, and is set to 0x0040 here. (Parameter) The parameter represents the dimensionless reordering number of the node within the segment, and its value is either 1 or 2. The physical space length of the slot is set to 0x0004 bytes. Node_A2 is backfilled to physical storage offset 0x0040. The rearranged Node_A is backfilled to physical storage offset 0x0044. The function node Node_C outside the segment is extracted, retaining its original call sequence number 1 and physical storage offset 0x0000. Following the pointer nodes of the original call path, a pointer connection is established between Node_C at physical storage offset 0x0000 and Node_A2 at physical storage offset 0x0040. This establishes the physical storage offset... A pointer connection is established between Node_A2 at offset 0x0040 and Node_A at physical storage offset 0x0044. A pointer connection is established between Node_A at physical storage offset 0x0044 and Node_B at physical storage offset 0x0048. The node identifiers Node_C, Node_A2, Node_A, and Node_B, the rearranged trajectory positions 0x0000, 0x0040, 0x0044, and 0x0048, and the updated global path numbers 1, 2, 3, and 4 are associated and encapsulated to obtain the call path rearrangement result.

[0017] S4: Based on the rearranged function nodes and corresponding trajectory positions in the call path rearrangement result, mark each function node as a state detection node according to the rearranged path order. Obtain the program status word register content corresponding to each state detection node according to the call instance identifier. Compare the register contents of adjacent state detection nodes one by one and record the state change direction of the current state detection node relative to the previous state detection node. Select three consecutive state detection nodes in sequence and compare the state change directions before and after the intermediate state detection node. Mark the intermediate state detection nodes with inconsistent state change directions. Perform adjacency verification on the marked nodes according to the rearranged trajectory position. Retain the state detection nodes with different state change directions before and after. Arrange them according to the rearranged path order and mark the corresponding rearranged trajectory position as the abnormal trajectory position to obtain the state abnormal trigger position identifier set. Please see Figure 5 Specifically, S4 includes: S41: Based on the rearranged function nodes and corresponding trajectory positions in the call path rearrangement result, each function node is marked as a status detection node according to the rearranged path order. The program status word register content corresponding to each status detection node is obtained according to the call instance identifier. The status detection node, call instance identifier, register content, and trajectory position are associated to obtain a status node register mapping table; as detailed below: Based on the rearranged function nodes and their corresponding trajectory positions in the call path rearrangement results, the updated path numbers 1, 2, 3, and 4 are extracted from the call path rearrangement result data structure set. The corresponding rearranged function nodes Node_C, Node_A2, Node_A, and Node_B are retrieved sequentially, and their physical storage offsets 0x0000, 0x0040, 0x0044, and 0x0048 are retrieved. Each function node is written into a flag array according to the global path order of 1, 2, 3, and 4, and then mapped using the dimensionless indexing formula. Determine the array index, where the parameters are... The dimensionless number representing the state detection node, parameter This represents the dimensionless global path number after the call path is rearranged. Node_C is marked as the first state detection node StateNode_1, Node_A2 as the second state detection node StateNode_2, Node_A as the third state detection node StateNode_3, and Node_B as the fourth state detection node StateNode_4. The call instance identifiers ID_3, ID_12, ID_1, and ID_2 bound to StateNode_1, StateNode_3, and StateNode_4 are retrieved. The register range mapping value table is accessed. Based on ID_3, the binary value of the program status word register is retrieved: 00000000000000000000000000000001. Based on ID_12, the binary value of the program status word register is retrieved: 0000000000000000000000000000010. Based on ID_1, the program status is retrieved. The binary value of the word register is 000000000000000000000000000000011. Based on ID_2, the binary value of the program status word register is retrieved as 0000000000000000000000000000001. The status detection node StateNode_1, the call instance identifier ID_3, the binary value 0x00000001, and the trajectory position 0x0000 are packaged and placed into the first item of the mapping table. The status detection node StateNode_2, the call instance identifier ID_3, and the binary value 0x0000001 are then packaged and placed into the first item of the mapping table. 12. Pack the binary value 0x00000002 and the trajectory position 0x000040 into the second item of the mapping table. Pack the state detection node StateNode_3, the call instance ID_1, the binary value 0x00000003 and the trajectory position 0x000044 into the third item of the mapping table. Pack the state detection node StateNode_4, the call instance ID_2, the binary value 0x00000001 and the trajectory position 0x000048 into the fourth item of the mapping table to obtain the state node register mapping table.

[0018] S42: Call the status node register mapping table, extract adjacent status detection nodes sequentially according to the rearranged path order, compare the contents of the corresponding program status word registers of adjacent nodes item by item, record the direction of the status change of the current status detection node relative to the previous status detection node, and associate the previous node, current node, direction of change, and trajectory position according to the node order to generate a node status change sequence; as follows: The state node register mapping table is invoked, and the first, second, third, and fourth items in the table, arranged in rearranged path order, are read. StateNode_1 (item 1) and StateNode_2 (item 2) are extracted as the first pair of adjacent nodes; StateNode_2 and StateNode_3 are extracted as the second pair; and StateNode_3 and StateNode_4 are extracted as the third pair. The binary values ​​0x00000001 and 0x00000002 in the registers of StateNode_1 and StateNode_2 are retrieved, and the two 32-bit binary strings are subjected to a bitwise XOR operation. Calculate the state differences, where the parameters This represents a dimensionless bit string generated by bitwise XOR, with the parameter... This represents the binary value of the 32-bit register of the previous node, parameter. This represents the binary value of the 32-bit register of the next node, sign... This represents the bitwise XOR operator. The result of the XOR operation is checked bitwise and compared. Changing the first bit from 0 to 1 is defined as a positive state transition (Flag_Up), and changing the 0th bit from 1 to 0 is defined as a negative state transition (Flag_Down). The state change direction of StateNode_2 relative to its predecessor StateNode_1 is calculated as +1, denoted as Vector_12. The binary value of StateNode_2 (0x00000002) is compared bit-by-bit with the binary value of StateNode_3 (0x00000003), resulting in a state change direction of StateNode_3 relative to its predecessor StateNode_2, denoted as Vector_23. The binary value of StateNode_3 (0x00000003) is compared with the binary value of StateNode_4... The value 0x00000001 is compared bit by bit to calculate that the state change direction of StateNode_4 relative to the previous node StateNode_3 is -1, denoted as Vector_34. The memory fields of the previous node StateNode_1, the current node StateNode_2, the change direction Vector_12 equal to +1 and the trajectory position 0x0040 are associated. The memory fields of the previous node StateNode_2, the current node StateNode_3, the change direction Vector_23 equal to +1 and the trajectory position 0x0044 are associated. The memory fields of the previous node StateNode_3, the current node StateNode_4, the change direction Vector_34 equal to -1 and the trajectory position 0x0048 are associated. The array is assembled according to the path order to generate the node state change sequence.

[0019] S43: Based on the node state change sequence, select three consecutive state detection nodes sequentially, compare the state change directions before and after the intermediate node, mark nodes with inconsistent directions, verify the adjacency relationship of the marked nodes based on the rearranged trajectory position, retain nodes whose change directions differ before and after, arrange the retained nodes according to the rearranged path order, mark the trajectory position as the abnormal trajectory position, and establish a state abnormality trigger position identifier set; as detailed below. Based on the node state change sequence, a combination of three consecutive state detection nodes is extracted sequentially along the path. The first sliding window contains StateNode_1, StateNode_2, and StateNode_3, and the second sliding window contains StateNode_2, StateNode_3, and StateNode_4. For the first sliding window, the forward state change direction Vector_12 of the middle node StateNode_2 is equal to +1, and the backward state change direction Vector_23 is equal to +1. An equality check is performed, and if the values ​​+1 equal to the values ​​+1, the forward and backward change directions are considered to be consistent and no mark is made. For the second sliding window, the forward state of the middle node StateNode_3 is extracted. The change direction Vector_23 equals +1, and the backward change direction Vector_34 equals -1. An equality check is performed. Since +1 does not equal -1, the forward and backward change directions are inconsistent. This inconsistency physically represents an abnormal flip of the program state word flag and a sudden change in control flow state during context switching or instruction reordering. A difference flag, Flag_Diff, is added to the intermediate node StateNode_3 in system memory. The physical storage offset of the flag node StateNode_3 in the reordering path, 0x0044, is read. The offsets of its predecessor StateNode_2 (0x0040) and its successor StateNode_4 (0x0048) are retrieved, and the absolute address difference formula is applied. Calculate the adjacent offset difference, where the parameter Represents the absolute address difference in bytes. This parameter represents the physical storage offset of the current node in bytes. The forward difference is calculated by representing the physical storage offset of adjacent nodes in bytes. Calculate the backward difference The threshold for consecutive adjacent addresses is set to 0x0004 bytes. If the forward offset difference is equal to 0x0004 and the backward offset difference is equal to 0x0004, it is determined that StateNode_3 is strictly adjacent to the physical locations of the preceding and following nodes. It is confirmed that StateNode_3 is a valid node with differences in both forward and backward change directions. The physical storage offset 0x0044 corresponding to the retained node StateNode_3 is extracted and marked as the abnormal trajectory location Loc_Err1. StateNode_3 and Loc_Err1 are packaged and written into the identifier table to establish a set of identifiers for abnormal state trigger locations.

[0020] S5: Based on the status detection nodes and abnormal trajectory positions in the set of status anomaly trigger location identifiers, locate the corresponding rearranged function node in the call path rearrangement result according to the abnormal trajectory position, obtain the corresponding function execution interval and call instance identifier, determine the return lag segment to which the status detection node belongs in the return lag segment distribution map, form the return lag interval based on the function return instruction trigger timestamp of the starting function node of the return lag segment and the return result read timestamp of the ending function node, and compare the function execution interval and return lag interval corresponding to each status detection node item by item according to the rearranged path order, mark the status detection nodes with time overlap or misalignment, classify the nodes according to the relationship type, and associate the abnormal trajectory position, call instance identifier and corresponding interval relationship to obtain the software anomaly diagnosis information set.

[0021] Please see Figure 6 Specifically, in S5, this includes: S51: Based on the status detection nodes and abnormal trajectory positions in the set of abnormal status trigger location identifiers, locate the function node in the call path rearrangement result according to the abnormal trajectory position, obtain the function execution interval and call instance identifier, determine the return lag segment to which the status detection node belongs based on the trajectory position, associate the node identifier, call instance identifier, function execution interval and segment boundary, and obtain the abnormal node attribution table; as detailed below: Based on the state detection nodes and abnormal trajectory positions in the state anomaly trigger location identifier set, extract the state detection node StateNode_3 and the abnormal trajectory position Loc_Err1 from the state anomaly trigger location identifier set. Retrieve the physical storage offset 0x0044 corresponding to the abnormal trajectory position Loc_Err1. Scan memory address 0x0044 in the call path rearrangement result data structure set, match and locate the rearranged function node Node_A, and retrieve the call instance identifier ID_1 corresponding to Node_A. Retrieve the execution start timestamp (1688000000.100 seconds) and end timestamp (1688000000.150 seconds) bound to node Node_A, package them into a function execution interval containing the start and end timestamps (1688000000.100 seconds and 1688000000.150 seconds), extract the physical storage offset (0x0044), retrieve the start and end offsets (0x0040 and 0x0044) of segment Seg_1 in the returned lag segment distribution map, and determine the segment inclusion logic based on the following formula: Perform a comparison and judgment, where the parameters This indicates that the node completely belongs to this segment, parameter Represents the physical storage offset of the state detection node, parameter Indicates the starting physical storage offset of the returned lagging segment, parameter Indicates the final physical storage offset of the returned lagging segment, symbol and Indicates numerical comparison, symbols This represents a logical AND operation, determining if the condition 0x0044 is greater than or equal to 0x0040 and 0x0044 is less than or equal to 0x0044. If the condition is met, the state detection node StateNode_3 is determined to belong entirely to the return lag segment Seg_1. The starting function node identifier Node_A and the ending function node identifier Node_A2 of segment Seg_1 are extracted as segment boundary identifiers. The node identifier StateNode_3, the call instance identifier ID_1, the function execution interval start time 1688000000.100 seconds and end time 1688000000.150 seconds, and the segment boundary Node_A and Node_A2 are mapped and bound to data fields to obtain the abnormal node attribution table.

[0022] S52: Call the abnormal node attribution table, read the function return instruction trigger timestamp corresponding to the starting function node of the return lag segment, read the return result read timestamp corresponding to the terminating function node, determine the start and end points of the interval based on the time sequence, form the return lag interval, associate the status detection nodes, function execution intervals, and return lag intervals according to the rearranged path order, and generate a list of node intervals; as detailed below: The abnormal node attribution table is invoked to extract the associated delayed return segment Seg_1. The starting function node Node_A and the ending function node Node_A2 corresponding to segment Seg_1 are retrieved. The function return instruction trigger timestamp of the starting function node Node_A is retrieved at 1688000000.150 seconds, and the return result read timestamp of the ending function node Node_A2 is retrieved at 1688000000.280 seconds. This is then processed according to the endpoint mapping formula. and Establish a mapping, where the parameters This indicates that the timestamp of the start of the lag interval is returned in seconds (s). The parameter... This indicates the function return instruction trigger timestamp of the segment's starting function node, in seconds (s). (Parameter) This indicates that the time stamp of the end of the lag interval is returned in seconds (s). Parameter The function returns a timestamp in seconds (s) from the end of the interval. Since 1688000000.150 seconds is less than 1688000000.280 seconds, the earlier timestamp, 1688000000.150 seconds, is marked as the start of the interval. Mark the later timestamp 1688000000.280 seconds as the end of the interval. Connecting the start and end points, a return lag interval of [1688000000.150 seconds, 1688000000.280 seconds] is constructed. The state detection node StateNode_3 is extracted sequentially along the rearranged path. The function execution interval of StateNode_3 is retrieved [1688000000.100 seconds, 1688000000.150 seconds]. The constructed return lag interval is retrieved [1688000000.150 seconds, 1688000000.280 seconds]. The state detection node identifier StateNode_3, the function execution interval data, and the corresponding return lag interval data are loaded into a linearly corresponding linked list structure, generating a list of corresponding node intervals.

[0023] S53: Based on the list of node intervals, compare the function execution interval and return lag interval of the status detection node along the rearranged path. Mark the status detection node as a time overlap node or a misaligned node. Complete the node classification based on the overlap and misalignment relationship, and associate the abnormal trajectory location, call instance identifier, function execution interval, return lag interval, and interval relationship to obtain the software anomaly diagnosis information set; as detailed below: Based on the list of node intervals, retrieve the starting point of the function execution interval of the StateNode_3, the state detection node, in the rearranged path order. Seconds and the finish line Seconds, retrieve the start of the associated return lag interval. Seconds and the finish line Seconds, compare the end point of the execution interval and the starting point of the lag interval The numerical relationship is used to calculate the intersection overlap time interval values ​​based on the interval overlap time calculation formula. Substituting the specific numerical values, we get... seconds, where the parameter This represents the function execution start time stamp in seconds (s), and the parameter... This indicates the function execution endpoint timestamp in seconds (s), and the parameter... This indicates that the timestamp of the start of the lag interval is returned in seconds (s). The parameter... This indicates that the time stamp of the end of the lag interval is returned in seconds (s). Parameter The function represents the duration of intersection overlap in seconds (s). and These represent the maximum and minimum value extraction functions, respectively, to determine the overlap duration. The execution endpoint of 1688000000.150 seconds is compared to the starting point of the lag interval of 1688000000.150 seconds. This means the execution interval is exactly to the left of the lag interval, indicating a misalignment relationship. The state detection node StateNode_3 is marked as a misaligned node (Flag_Misaligned). If the execution interval of another node, StateNode_X, is set to [1688000000.160 seconds, 1688000000.200 seconds], the overlap duration is calculated. If the second is greater than zero, it is marked as a time overlap node (Flag_Overlapped). Based on the marking result, StateNode_3 is classified into the misaligned node set category (Type_Misaligned). The abnormal trajectory position (Loc_Err1, i.e., 0x0044), the call instance identifier (ID_1), the function execution interval [1688000000.100 seconds, 1688000000.150 seconds], the return lag interval [1688000000.150 seconds, 1688000000.280 seconds], and the classification result (Type_Misaligned) are extracted and structurally associated and assembled to obtain the software anomaly diagnostic information set.

[0024] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for diagnosing software malfunctions, characterized in that, Includes the following steps: Obtain the function entry timestamp and the function return instruction trigger timestamp, generate and pair call instance identifiers according to thread and call order to form function execution intervals, read and map the contents of the program status word register, connect adjacent function execution intervals according to time and associate relevant information to obtain the function execution trajectory mapping set; The function is called to execute the trajectory mapping set, the function nodes are determined according to the calling order, the return read events are collected and matched according to the calling instance identifier, the first read after the return is used to form the return read interval, the adjacent intervals are marked as abnormal, the consecutive abnormal nodes are merged and associated with the start and end function nodes and trajectory positions to obtain the return lag segment distribution map; Based on the returned lag segment distribution map, extract the function nodes within the segment, compare the execution start time of adjacent function nodes according to the original calling order, repeatedly swap and verify the inverted function nodes until the function node order is consistent with the execution start time, put them back to the corresponding trajectory position and integrate the function nodes outside the segment to obtain the call path rearrangement result; Based on the call path rearrangement result, the function node is marked as a state detection node, the register content is obtained according to the call instance identifier, the change direction is recorded by comparing with adjacent state detection nodes, the intermediate state detection node is verified by three consecutive state detection nodes, and the state detection nodes with abnormal status before and after are retained and their positions are marked to obtain the state abnormality trigger position identifier set. The system calls the set of state anomaly trigger locations, locates the corresponding rearranged function node in the call path rearrangement result, reads the function execution interval and call instance identifier, forms the return lag interval from the return lag interval distribution map, compares the interval markings with the overlapping and misaligned state detection nodes, classifies them according to relationship type and associates the information, and obtains the software anomaly diagnosis information set.

2. The software operation anomaly diagnosis method according to claim 1, characterized in that: The steps for obtaining the function execution trajectory mapping set are as follows: Obtain the function entry timestamp and function return instruction trigger timestamp during the execution of the server application. Generate call instance identifiers according to the thread and call order. Determine the ownership and pair them according to the call instance identifiers. Mark the function entry timestamp as the execution start point and the function return instruction trigger timestamp as the execution end point. Connect the timestamps to form the function execution interval and obtain the call instance execution interval set. Based on the set of execution intervals for the called instances, the function execution intervals are arranged in ascending order of function entry timestamps. When the function return instruction is triggered, the contents of the program status word register are read. The function execution interval is located according to the called instance identifier. The register bit value is written to the interval association position. The function execution interval number, the called instance identifier and the register bit value mapping relationship are recorded to generate a set of register interval mapping values. Based on the set of execution intervals of the called instance and the set of mapping values ​​of the register intervals, the timestamps of the execution start points of adjacent function execution intervals are read sequentially. Adjacent function execution intervals are connected according to their time sequence and their trajectory positions are recorded. The function execution intervals, the call instance identifiers, and the register bit values ​​are associated with the corresponding trajectory positions. All trajectory positions are arranged according to the function entry timestamps to obtain the function execution trajectory mapping set.

3. The software operation anomaly diagnosis method according to claim 1, characterized in that: The steps for obtaining the distribution map of the returned lag segment are as follows: The continuous execution trajectory, call instance identifier, and function return instruction trigger timestamp of the function execution trajectory mapping set are called. The execution interval is determined as function node according to the call order. The return read event timestamp is collected along the execution trajectory. The event ownership is determined according to the call instance identifier. The first read event timestamp after the return instruction is triggered is determined as the return result read timestamp, thus obtaining the return read timestamp set. Based on the return read timestamp set, extract the function return instruction trigger timestamp and return result read timestamp corresponding to each function node, match the two timestamps one by one according to the call instance identifier, calculate the duration obtained by subtracting the function return instruction trigger timestamp from the return result read timestamp to form the return read interval, arrange the return read intervals of the same path according to the function node order, and generate path interval sequence values. Based on the path interval sequence value, the minimum and maximum values ​​of the return read intervals of adjacent function nodes are taken to form the range of adjacent interval changes. The return read interval of the current function node is compared with the range of adjacent interval changes. Function nodes outside the range are marked. The continuously marked function nodes are merged along the original calling order. The starting function node, ending function node and trajectory position of the segment are determined, and a distribution map of the return lag segment is established.

4. The software operation anomaly diagnosis method according to claim 1, characterized in that: The steps for obtaining the call path rearrangement result are as follows: Based on the return lag segment, function node, and trajectory position in the return lag segment distribution map, extract the function nodes within the segment according to the original calling order, read the execution start time of the function node's execution interval, determine the node's affiliation based on the trajectory position, arrange the nodes in the same segment according to the calling sequence number, and record the node identifier, execution start time, trajectory position, and segment sequence number to obtain the segment node index. The segment node index is called, and the execution start time of adjacent function nodes is compared. If the execution start time of the previous node is later than that of the next node, their positions are swapped. The time order of subsequent adjacent nodes is verified from the swapped positions. The swapping and verification are repeated for nodes with reversed time until the node arrangement order in the segment is consistent with the execution start time order. The node identifier, arrangement number and execution start time are recorded, and the segment reorder number is generated. Based on the segment reordering number, extract the reordering function node, trajectory position, and return lag segment boundary number. Adjust the reordering node backfill position according to the boundary number, retain the original call sequence number of the function node outside the segment, connect the reordering node inside the segment with the function node outside the segment along the original call path, and record the function node identifier, reordering trajectory position, and path sequence number to obtain the call path reordering result.

5. The software operation anomaly diagnosis method according to claim 4, characterized in that: The execution start time of the comparison of adjacent function nodes includes: According to the order of adjacent function nodes formed by arranging the nodes in the same segment according to the call sequence number, the execution start time of the previous function node and the execution start time of the next function node are read one by one. The adjacent function nodes whose execution start time of the previous function node is greater than the execution start time of the next function node are determined as time inversion node pairs, and the arrangement positions of the previous function node and the next function node in the time inversion node pair are swapped.

6. The software operation anomaly diagnosis method according to claim 4, characterized in that: The steps for obtaining this information are as follows: Verifying the time order of subsequent adjacent nodes from the swapped positions includes: Using the arrangement position of the next function node after the exchange as the verification start position, read the execution start time of the function node corresponding to the verification start position and the next adjacent function node. When the execution start time of the function node corresponding to the verification start position is later than the execution start time of the next adjacent function node, exchange the arrangement positions of the function node corresponding to the verification start position and the next adjacent function node, until the execution start time of the adjacent function nodes in the return lag segment satisfies that the execution start time of the previous function node is not later than the execution start time of the next function node.

7. The software operation anomaly diagnosis method according to claim 1, characterized in that: The steps for obtaining the set of location identifiers for the abnormal status trigger are as follows: Based on the rearranged function nodes and corresponding trajectory positions in the call path rearrangement result, each function node is marked as a status detection node according to the rearranged path order. The program status word register content corresponding to each status detection node is obtained according to the call instance identifier. The status detection node, call instance identifier, register content and trajectory position are associated to obtain the status node register mapping table. The state node register mapping table is called, and adjacent state detection nodes are extracted sequentially according to the rearranged path order. The contents of the program state word registers corresponding to the adjacent nodes are compared item by item. The state change direction of the current state detection node relative to the previous state detection node is recorded. The previous node, the current node, the change direction and the trajectory position are associated according to the node order to generate a node state change sequence. Based on the node state change sequence, three consecutive state detection nodes are selected in sequence, the state change directions before and after the middle node are compared, nodes with inconsistent directions are marked, the adjacency relationship of the marked nodes is verified according to the rearranged trajectory position, nodes with differences in both the before and after change directions are retained, the retained nodes are arranged in the order of the rearranged path, the trajectory position is marked as the abnormal trajectory position, and a set of state abnormality trigger position identifiers is established.

8. The software operation anomaly diagnosis method according to claim 1, characterized in that: The steps for obtaining the software anomaly diagnostic information set are as follows: Based on the status detection nodes and abnormal trajectory positions in the set of status anomaly triggering location identifiers, the function nodes are located in the call path rearrangement results according to the abnormal trajectory positions. The function execution interval and the call instance identifier are obtained. The return lag segment to which the status detection node belongs is determined based on the trajectory position. The node identifier, the call instance identifier, the function execution interval and the segment boundary are associated to obtain the abnormal node attribution table. The abnormal node attribution table is called, the function return instruction trigger timestamp corresponding to the starting function node of the return lag segment is read, the return result reading timestamp corresponding to the terminating function node is read, the start and end points of the interval are determined according to the time sequence, and the return lag interval is formed. The status detection nodes, function execution intervals and return lag intervals are associated according to the rearranged path order to generate a list of node intervals. Based on the list of node intervals, the execution intervals of the function of the status detection node and the return lag intervals are compared along the rearranged path. The status detection nodes are marked as time overlap nodes or misaligned nodes. The nodes are classified according to the overlap and misalignment relationships. The abnormal trajectory location, call instance identifier, function execution interval, return lag interval and interval relationship are associated to obtain the software abnormal diagnosis information set.

Images