copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Publications

We have developed a technology, fine-grained dynamic instrumentation of commodity kernels, which can splice (insert) dynamically generated code before almost any machine code instruction of a completely unmodified running commodity operating system kernel. This technology is well-suited to performance profiling, debugging, code coverage, security auditing, runtime code optimizations, and kernel extensions. We have designed and implemented a tool called KernInst that performs dynamic instrumentation on a stock production Solaris kernel running on an UltraSPARC. On top of KernInst, we have implemented a kernel performance profiling tool, and used it to understand kernel and application performance under a Web proxy server workload. We used this information to make two changes (one to the kernel, one to the proxy) that cumulatively reduce the percentage of elapsed time that the proxy spends opening disk cache files from 40 % to 7%. 1

parts of a program that did not execute in one or more runs of a program. The traditional approach for code coverage tools is to use static code instrumentation. In this paper we present a new approach to dynamically insert and remove instrumentation code to reduce the runtime overhead of code coverage. We also explore the use of dominator tree information to reduce the number of instrumentation points needed. Our experiments show that our approach reduces runtime overhead by 38-90% compared with purecov, a commercial code coverage tool. Our tool is fully automated and available for download from the Internet.

In program profiling to assess test set adequacy, a challenge is to select code to be included in the assessment. Current mechanisms are coarse-grained; biased to dominant modularizations; require tedious, error-prone manual selection; and leave tester intent implicit in inputs to testing tools. Aspect-oriented constructs promise to improving testing in two ways: by improving our ability to select the code to include in adequacy criteria, and by documenting selection intentions in declarative form in the code itself. One problem is that current join point models do not reveal program behavior in enough detail to support white-box coverage analysis. Our contribution is the formulation, prototyping, and evaluation of a language-and-tool-based approach to white-box coverage adequacy analysis that we call concern coverage. We develop and evaluate one instance of the general idea in which branches, in particular, are exposed as join points to support branch coverage analysis of crosscutting concerns. Our results are consistent with the claim that the idea has the potential to improve test coverage analysis. Categories and Subject Descriptors D.2.5 [Testing and Debugging]: Testing tools – code coverage analysis, testing. D.3.3 [Programming Languages]: Language constructs and features – generalized join point model, generalized advice.

Coverage testing techniques, such as statement and decision coverage, play a significant role in improving the quality of software systems. Constructing a thorough set of tests that yield high coverage, however, is often avery tedious, time consuming task. In this paper we present a technique to find a small subset of a program's statements and decisions with the property that covering the subset implies covering the rest. We introduce the notion of a mega block which is a set of basic blocks spanning multiple procedures with the property that one basic block in it is executed iff every basic block in it is executed. We also present an algorithm to construct a data structure called the global dominator graph showing dominator relationships among mega blocks. A tester only needs to create test cases that are aimed at executing one basic block from each of the leaf nodes in this directed acyclic graph. Every other basic block in the program will automatically be covered by the same test set.

The abdity to count events in a program’s execution M reqmred by many program analysls applications. We present an instrumentation method for efficiently counting events in a program’s execution, with support for on-line queries of the event count, Event counting differs from basic block profiling in that an aggregate count of events is kept rather than a set of counters, Due to this difference, solutions to basic block profiling are not well suited to event counting. Our algorithm finds a subset of points in a program to instrument, while guaranteeing that accurate event counts can be obtained efficiently at every point m the execution.

In this paper we present techniques to #nd subsets of nodes of a #owgraph that satisfy the following property: A test set that exercises all nodes in a subset exercises all nodes in the #owgraph. Analogous techniques to #nd subsets of edges are also proposed. These techniques may be used to signi#cantly reduce the cost of coverage testing of programs. A notion of a super block consisting of one or more basic blocks is developed. If any basic block in a super block is exercised by an input then all basic blocks in that super blockmust be exercised by the same input. Dominator relationships among super blocks are used to identify a subset of the super blocks whose coverage implies that of all super blocks and, in turn, that of all basic blocks. Experiments with eight systems in the range of 1-75K lines of code show that, on the average, test cases targeted to cover just 29# of the basic blocks and 32# of the branches ensure 100# block and branchcoverage, respectively.

In profiling program execution to assess the adequacy of a test set, a challenge is to select the code to be included in the coverage assessment. Current mechanisms for doing this are coarse-grained, assume traditional concepts of modularity, require tedious and error-prone manual selection, and leave the tester’s intent implicit in the input provided to the testing tools. The aspect-oriented constructs of languages such as AspectJ promise to help ease and extend our ability to select the code to be included in a test adequacy criterion and to document the tester’s intent within the source code itself. Our contribution is a language-centric approach to automated test adequacy analysis that we call concern coverage. We claim that our approach enables explicit, precise, abstract, and machine-readable representation of the tester’s intent and that it can ease testing by eliminating the need for manual selection and explicit maintenance of test adequacy criteria. Categories and Subject Descriptors D.2.5 [Testing and Debugging]: Testing tools – code coverage analysis, testing. D.3.3 [Programming Languages]: Language constructs and features – generalized join point model, generalized advice.

Program development, debugging, and maintenance can be greatly improved by the use of software tools that provide information about program behavior. This thesis focuses on a number of useful software tools and shows how their efficiency, generality, and precision can be increased through the use of control-flow and control dependence analysis. We consider two classes of tools: execution measurement tools, which collect information about a particular program execution; and program analysis tools, which provide information about potential program behavior by statically analyzing the program. We consider three tools that measure aspects of a program's execution: profiling, tracing, and event counting tools. We describe algorithms for profiling and tracing programs that use a combination of control-flow analysis and program instrumentation to produce exact profiles and traces with low run-time overhead. Rather than record information at every point in a program, the algorithms record info...

Over the past few years, the subject of Wireless Intelligent Network (WIN) has captured the interest of the North American telecommunications community. The objective of WIN is to integrate Intelligent Network (IN) concepts into the IS-41 architecture. The introduction of a Service Control Point (SCP) in the Interim Standard IS-41 architecture enables independent specification of services. By using the IN architecture, call processing intelligence and feature functionality is separated from network switches. Subscribers can take advantage of such IN services as call name presentation (CNAP) in a wireless environment. In the first part of the thesis, we apply a scenario analysis technique to capture the requirements of the CNAP system. The analysis includes building a design model composed of User Case Maps (UCMs) and Message Sequence Charts (MSCs). This technique helps in specifying the designed system at a high level, brings us one step closer towards the specification of CNAP in LOT...