Instrumentation API

Typedefs
typedef VOID(*	INS_INSTRUMENT_CALLBACK) (INS ins, VOID *v)

Functions
PIN_CALLBACK	INS_AddInstrumentFunction (INS_INSTRUMENT_CALLBACK fun, VOID *val)
VOID	INS_InsertPredicatedCall (INS ins, IPOINT ipoint, AFUNPTR funptr,...)
VOID	INS_InsertCall (INS ins, IPOINT action, AFUNPTR funptr,...)
VOID	INS_InsertIfCall (INS ins, IPOINT action, AFUNPTR funptr,...)
VOID	INS_InsertThenCall (INS ins, IPOINT action, AFUNPTR funptr,...)
VOID	INS_InsertIfPredicatedCall (INS ins, IPOINT action, AFUNPTR funptr,...)
VOID	INS_InsertThenPredicatedCall (INS ins, IPOINT action, AFUNPTR funptr,...)
VOID	INS_InsertFillBuffer (INS ins, IPOINT action, BUFFER_ID id,...)
VOID	INS_InsertFillBufferPredicated (INS ins, IPOINT action, BUFFER_ID id,...)
VOID	INS_InsertFillBufferThen (INS ins, IPOINT action, BUFFER_ID id,...)

Detailed Description

Use these functions to instrument instructions.

Typedef Documentation

INS_INSTRUMENT_CALLBACK

typedef VOID(* INS_INSTRUMENT_CALLBACK) (INS ins, VOID *v)

Call back function used to instrument instructions

Function Documentation

INS_AddInstrumentFunction()

PIN_CALLBACK INS_AddInstrumentFunction	(	INS_INSTRUMENT_CALLBACK	fun,
		VOID *	val
	)

Add a function used to instrument at instruction granularity

Parameters

fun	Instrumentation function for instructions
val	passed as the second argument to the instrumentation function

Returns

PIN_CALLBACK A handle to a callback that can be used to further modify this callback's properties

Note

The pin client lock is obtained during the call of this API.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All

INS_InsertCall()

VOID INS_InsertCall	(	INS	ins,
		IPOINT	action,
		AFUNPTR	funptr,
			...
	)

Insert a call to funptr relative to instruction ins.

Parameters

ins	Instruction to instrument
action	Specifies before, after, etc. IPOINT_BEFORE is always valid for all instructions. IPOINT_AFTER is valid only when a fall-through exists (i.e. Calls and unconditional branches will fail). It is only allowed when INS_IsValidForIpointAfter(ins) is true. IPOINT_TAKEN_BRANCH is invalid for non-branches. It is only allowed when INS_IsValidForIpointTakenBranch is true.
funptr	Insert a call to funptr
...	List of arguments to pass funptr. See IARG_TYPE, terminated with IARG_END

If more than one call is inserted for the same instruction, the order is determined by IARG_CALL_ORDER. For more information, see CALL_ORDER.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All

INS_InsertFillBuffer()

VOID INS_InsertFillBuffer	(	INS	ins,
		IPOINT	action,
		BUFFER_ID	id,
			...
	)

Insert analysis code to fill one record in a trace buffer whenever an application instruction executes.

Parameters

[in]	ins	The application instruction.
[in]	action	Tells whether the record is filled before or after the instruction.
[in]	id	The ID of the buffer whose record is filled.
[in]	...	IARG_TYPE. Additional arguments to specify the fields of the trace buffer. These additional arguments take the form: IARG_TYPE arg, [optional IARG parameters], size_t offset, ..., IARG_END The \i arg argument specifies the value to write to the trace record field. The \i offset argument specifies the offset (in bytes) from the start of the trace record to this field. Typically, you would use "offsetof()" for this. if \i arg requires additional parameters, they come before \i offset.

Certain IARG_TYPEs cannot be used with the *_InsertFillBuffer APIs. The unsupported IARG_TYPEs are: IARG_CONTEXT, IARG_REG_REFERENCE, IARG_REG_CONST_REFERENCE and IARG_MULTI_ELEMENT_OPERAND.

Availability:

Mode: JIT
O/S: Linux & Windows
CPU: IA-32 and Intel(R) 64 architectures

INS_InsertFillBufferPredicated()

VOID INS_InsertFillBufferPredicated	(	INS	ins,
		IPOINT	action,
		BUFFER_ID	id,
			...
	)

Insert analysis code to fill one record in a trace buffer whenever an application instruction executes, based on that instruction's predicate.

Parameters

[in]	ins	The application instruction
[in]	action	Whether the record is filled before or after the instruction
[in]	id	The ID of the buffer whose record is filled
[in]	...	IARG_TYPE. Additional arguments to specify the fields of the trace buffer.

Certain IARG_TYPEs cannot be used with the *_InsertFillBuffer APIs. The unsupported IARG_TYPEs are: IARG_CONTEXT, IARG_REG_REFERENCE, IARG_REG_CONST_REFERENCE and IARG_MULTI_ELEMENT_OPERAND.

Availability:

Mode: JIT
O/S: Linux & Windows
CPU: IA-32 and Intel(R) 64 architectures

INS_InsertFillBufferThen()

VOID INS_InsertFillBufferThen	(	INS	ins,
		IPOINT	action,
		BUFFER_ID	id,
			...
	)

Insert analysis code to fill one record in a trace buffer whenever an application instruction executes. The record is only inserted if the preceding "if" analysis call returns a non-zero value.

Parameters

[in]	ins	The application instruction
[in]	action	Whether the record is filled before or after the instruction
[in]	id	The ID of the buffer whose record is to filled
[in]	...	IARG_TYPE. Additional arguments to specify the fields of the trace buffer.

Certain IARG_TYPEs cannot be used with the *_InsertFillBuffer APIs. The unsupported IARG_TYPEs are: IARG_CONTEXT, IARG_REG_REFERENCE, IARG_REG_CONST_REFERENCE and IARG_MULTI_ELEMENT_OPERAND.

Availability:

Mode: JIT
O/S: Linux & Windows
CPU: IA-32 and Intel(R) 64 architectures

INS_InsertIfCall()

VOID INS_InsertIfCall	(	INS	ins,
		IPOINT	action,
		AFUNPTR	funptr,
			...
	)

Insert a call to funptr relative to an INS. If funptr returns a non-zero ADDRINT, then the immediately following "then" analysis call is executed.

Parameters

ins	Instruction to instrument
action	Specifies before, after, etc. IPOINT_BEFORE is always valid for all instructions. IPOINT_AFTER is valid only when a fall-through exists (i.e. Calls and unconditional branches will fail). It is only allowed when INS_IsValidForIpointAfter(ins) is true. IPOINT_TAKEN_BRANCH is invalid for non-branches. It is only allowed when INS_IsValidForIpointTakenBranch is true. IPOINT_ANYWHERE is not supported and will result an error. action value must be identical to the value passed to the corresponding INS_InsertThenCall.
funptr	Insert a call to funptr. Its return type must be ADDRINT
...	List of arguments to pass funptr. See IARG_TYPE, terminated with IARG_END

If more than one call is inserted for the same instruction, the order is determined by IARG_CALL_ORDER. For more information, see CALL_ORDER. Note that if CALL_ORDER is used, Both "if" and "then" analysis calls must have the same order.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All

INS_InsertIfPredicatedCall()

VOID INS_InsertIfPredicatedCall	(	INS	ins,
		IPOINT	action,
		AFUNPTR	funptr,
			...
	)

Insert a call to funptr relative to an INS. If funptr returns a non-zero ADDRINT and the instruction has a true predicate, then the immediately following "then" analysis call is executed. If the instruction is not predicated, then this function is identical to INS_InsertIfCall.

Note that funptr may be called even if the predicate is false, the predicate is only defined to guard the execution of the following THEN function. (So if the function inserted here modifies the machine state it might affect the value of the predicate. Best practice is not to modify machine state here!)

On IA32 and Intel64, the sequences

INS_InsertIfCall(...);
INS_InsertThenPredicatedCall(...);

INS_InsertIfPredicatedCall(...);
INS_InsertThenCall(...);

and

INS_InsertIfPredicatedCall(...);
INS_InsertThenPredicatedCall(...);

produce identical results. They all generate code which can be represented like this

if (UsersIfFunction(...))
    if (predicate)
        UsersThenFunction(...);

However on other architectures the behavior may be different, and the "IF" call need not always be called.

This means that on IA32 and Intel64 the user's IF code is always called, however on these architectures that is very likely to generate faster code, since predicated instructions are rare. The dynamically most important predicated instructions are almost certainly REP MOVS, which have a very low (~80ppm) probablity of being predicated false. Unless the user's IF code is very large, or has a lower probability of filtering the execution, it is always better to use the test of the user condition to prevent execution of the predicate test. Of course, the code included in a user IF call is expected to be small, since the objective of INS_InsertIfCall, INS_InsertThenCall is to allow the code in the IF to be inlined.

If you need to know the instruction predicate inside the IF call, you should pass IARG_EXECUTING as an argument and test it.

Parameters

ins	Instruction to instrument
action	Specifies before, after, etc. IPOINT_BEFORE is always valid for all instructions. IPOINT_AFTER is valid only when a fall-through exists (i.e. Calls and unconditional branches will fail). It is only allowed when INS_IsValidForIpointAfter(ins) is true. IPOINT_TAKEN_BRANCH is invalid for non-branches. It is only allowed when INS_IsValidForIpointTakenBranch is true.
funptr	Insert a call to funptr. Its return type must be ADDRINT
...	List of arguments to pass funptr. See IARG_TYPE, terminated with IARG_END

If more than one call is inserted for the same instruction, the order is determined by IARG_CALL_ORDER. For more information, see CALL_ORDER. Note that if CALL_ORDER is used, Both "if" and "then" analysis calls must have the same order.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All

INS_InsertPredicatedCall()

VOID INS_InsertPredicatedCall	(	INS	ins,
		IPOINT	ipoint,
		AFUNPTR	funptr,
			...
	)

See INS_InsertCall. When the instruction has a predicate and the predicate is false, the analysis function is not called.

On the IA-32 and Intel 64 architectures the only instructions treated as predicated are CMOVcc, FCMOVcc and REPped string ops. For the conditional moves, the predicate is based on the condition codes tested by the instruction. For the REPped string ops the predicate is that the execution count is not zero. For all other instructions the predicate is always true, so INS_InsertPredicatedCall is identical to INS_InsertCall.

If you want to test both your own condition, and the predicate, you can use INS_InsertThenPredicatedCall, or use IARG_EXECUTING to pass the predicate value to an INS_InsertIfCall.

If more than one call is inserted for the same instruction, the order is determined by IARG_CALL_ORDER. For more information, see CALL_ORDER.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All

INS_InsertThenCall()

VOID INS_InsertThenCall	(	INS	ins,
		IPOINT	action,
		AFUNPTR	funptr,
			...
	)

Insert a call to funptr relative to an INS. The function is called only if the immediately preceding "if" analysis call returns a non-zero value.

Parameters

ins	Instruction to instrument
action	Specifies before, after, etc. IPOINT_BEFORE is always valid for all instructions. IPOINT_AFTER is valid only when a fall-through exists (i.e. Calls and unconditional branches will fail). It is only allowed when INS_IsValidForIpointAfter(ins) is true. IPOINT_TAKEN_BRANCH is invalid for non-branches. It is only allowed when INS_IsValidForIpointTakenBranch is true. IPOINT_ANYWHERE is not supported and will result an error. action value must be identical to the value passed to the corresponding INS_InsertIfCall.
funptr	Insert a call to funptr
...	List of arguments to pass funptr. See IARG_TYPE, terminated with IARG_END

If more than one call is inserted for the same instruction, the order is determined by IARG_CALL_ORDER. For more information, see CALL_ORDER. Note that if CALL_ORDER is used, Both "if" and "then" analysis calls must have the same order.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All

INS_InsertThenPredicatedCall()

VOID INS_InsertThenPredicatedCall	(	INS	ins,
		IPOINT	action,
		AFUNPTR	funptr,
			...
	)

Insert a call to funptr relative to an INS. The function is called only if the immediately preceding "if" analysis call returns a non-zero value and the instruction's predicate is true. See INS_InsertIfPredicatedCall for details of the semantics of mixing INS_InsertThenPredicatedCall with INS_InsertIfCall (and all the other possibilities).

Parameters

ins	Instruction to instrument
action	Specifies before, after, etc. IPOINT_BEFORE is always valid for all instructions. IPOINT_AFTER is valid only when a fall-through exists (i.e. Calls and unconditional branches will fail). It is only allowed when INS_IsValidForIpointAfter(ins) is true. IPOINT_TAKEN_BRANCH is invalid for non-branches. It is only allowed when INS_IsValidForIpointTakenBranch is true.
funptr	Insert a call to funptr
...	List of arguments to pass funptr. See IARG_TYPE, terminated with IARG_END

If more than one call is inserted for the same instruction, the order is determined by IARG_CALL_ORDER. For more information, see CALL_ORDER. Note that if CALL_ORDER is used, Both "if" and "then" analysis calls must have the same order.

Availability:

Mode: JIT
O/S: Linux, Windows & macOS*
CPU: All