6.823: Computer System Architecture Introduction To PIN

6.823: ComputerSystem ArchitectureIntroduction to PINHyun Ryong (Ryan) Lee6823-tas@csail.mit.eduAdapted from: Prior 6.823 offerings, andIntel’s Tutorial at CGO 20102/19/20216.823 Spring 20211

Designing Computer ArchitecturesBuild computers that run programs efficientlyTwo important components:1. Study of programs and patterns– Guides interface, design choices2. Engineering under constraints– Evaluate tradeoffs of architectural choices2/19/20216.823 Spring 20212

Simulation: An Essential Tool inArchitecture Research A tool to reproduce the behavior of acomputing device Why use simulators?– Obtain fine-grained details about internal behavior– Enable software development– Obtain performance predictions for candidatearchitectures– Cheaper than building system2/19/20216.823 Spring 20213

LabsBenchmarkSuite Focus on understanding program behavior,evaluating architectural tradeoffs2/19/2021Model6.823 Spring 2021Results4

PIN www.pintool.org– Developed by Intel– Free for download and use A tool for dynamic binary instrumentationRuntime2/19/2021No need tore-compileor re-link6.823 Spring 2021Insert code in theprogram to collectinformation5

Pin: A Versatile Tool Architecture research– Simulators: zsim, CMPsim, Graphite, Sniper, Swarm Software Development– Intel Parallel Studio, Intel SDE– Memory debugging, correctness/perf. analysis Security– Taint analysis2/19/2021Useful tool to have inyour arsenal!6.823 Spring 20216

PIN www.pintool.org– Developed by Intel– Free for download and use A tool for dynamic binary instrumentationRuntime2/19/2021No need tore-compileor re-link6.823 Spring 2021Insert code in theprogram to collectinformation7

Instrumenting Instructionssub 0xff, %edxcmp %esi, %edxjle L1 mov 0x1, %ediadd 0x10, %eax2/19/20216.823 Spring 20218

Example 1: Instruction CountI want to countthe number ofinstructions executed.sub 0xff, %edxcmp %esi, %edxjle L1 mov 0x1, %ediadd 0x10, %eax2/19/20216.823 Spring 20219

Example 1: Instruction CountLet’s incrementcounter by onebefore every instruction!counter ;sub 0xff, %edxcounter ;cmp %esi, %edxcounter ;jle L1 counter ;mov 0x1, %edicounter ;add 0x10, %eax2/19/20216.823 Spring 202110

Example 2: Instruction TraceI want to generateinstruction trace.sub 0xff, %edxcmp %esi, %edxjle L1 mov 0x1, %ediadd 0x10, %eax2/19/20216.823 Spring 202111

Example 2: Instruction TraceLet’s printinstruction pointersbefore every instruction!Print(ip);sub 0xff, %edxPrint(ip);cmp %esi, %edxPrint(ip);jle L1 Print(ip);mov 0x1, %ediPrint(ip);add 0x10, %eax2/19/20216.823 Spring 202112

Example 2: Instruction TraceLet’s printinstruction pointersbefore every instruction!Print(ip);sub 0xff, %edxPrint(ip);This is “Instrumentation”cmp %esi, %edxPrint(ip);jle L1 Print(ip);mov 0x1, %ediPrint(ip);add 0x10, %eax2/19/20216.823 Spring 202113

What is Instrumentation? A technique that inserts extra code into a programto collect runtime information– Program Analysis: performance profiling, errordetection, capture and replay– Architectural study: processor and cache simulation,trace collection Instrumentation approaches:– Source instrumentation: Instrument source programs– Binary instrumentation: Instrument executables directly2/19/20216.823 Spring 202114

What can you do with Pin? Pin gives you the ability to– inspect every instruction, and then insert extra code (optional) executed the inserted codeInstrumentationroutineAnalysis routine2/19/20216.823 Spring 202115

How to use Pin pin –t pintool –- inedplug in tool)Instrumentation APIsJIT Compiler6.823 Spring 2021Code Cache16

Advantages of Pin Dynamic Instrumentation– No need for source code, re-compilation or post-linking Programmable Instrumentation– Provides rich APIs to write in C/C your own instrumentationtools (called Pintools) Multiplatform– Supports IA-32, IA-64, Itanium– Supports Linux, Windows, MacOS Robust– Instrument real life applications: web browsers, databases– Instrument multithreaded applications If you can run it, you can Pin it2/19/20216.823 Spring 202117

How is Instrumentation used in ComputerArchitecture? Trace GenerationBranch Predictor and Cache ModelingFault Tolerance StudyEmulating SpeculationEmulating New InstructionsCache Coherence Protocols2/19/20216.823 Spring 202118

Writing Pintools2/19/20216.823 Spring 202119

Pin Instrumentation APIs Basic APIs are architecture independent:– Provide common functionalities like determining: Control-flow changes Memory accesses Architecture-specific APIs– E.g., Info about segmentation registers on IA32 Call-based APIs:– Instrumentation routines– Analysis routines2/19/20216.823 Spring 202120

Example 1: Instruction CountLet’s incrementcounter by onebefore every instruction!counter ;sub 0xff, %edxcounter ;cmp %esi, %edxcounter ;jle L1 counter ;mov 0x1, %edicounter ;add 0x10, %eax2/19/20216.823 Spring 202121

Example 1: Instruction CountLet’s incrementcounter by onebefore every instruction!Instrumentation routinecounter ;sub 0xff, %edxcounter ;cmp %esi, %edxcounter ;jle L1 counter ;mov 0x1, %edicounter ;add 0x10, %eax2/19/20216.823 Spring 202122

Example 1: Instruction CountAnalysis routineLet’s incrementcounter by onebefore every instruction!Instrumentation routinecounter ;sub 0xff, %edxcounter ;cmp %esi, %edxcounter ;jle L1 counter ;mov 0x1, %edicounter ;add 0x10, %eax2/19/20216.823 Spring 202123

Instrumentation vs. Analysis Instrumentation routines define whereinstrumentation is inserted– e.g. before instruction– C Occurs first time an instruction is executed Analysis routines define what to do wheninstrumentation is activated– e.g. increment counter– C Occurs every time an instruction is executed2/19/20216.823 Spring 202124

Pintool 1: Instruction Countcounter ;sub 0xff, %edxcounter ;cmp %esi, %edxcounter ;jle L1 counter ;mov 0x1, %edicounter ;add 0x10, %eax2/19/20216.823 Spring 202125

Pintool 1: Instruction Count Output /bin/lsMakefile atrace.o imageload.out itraceproccount Makefile.example imageloadinscount0 itrace.o proccount.o atraceimageload.o inscount0.o itrace.out pin –ifeellucky -t inscount0 -- /bin/lsMakefile atrace.o imageload.out itraceproccount Makefile.example imageloadinscount0 itrace.o proccount.o atraceimageload.o inscount0.o itrace.outCount 4228382/19/20216.823 Spring 202126

ManualExamples/inscount0.C#include iostream #include "pin.h"UINT64 icount 0;KNOB string KnobOutputFile(KNOB MODE WRITEONCE, “pintool”, “o”,“results.out”, “specify output file”);void docount() { icount ; }analysis routinevoid Instruction(INS ins, void *v)instrumentation routine{INS InsertCall(ins, IPOINT BEFORE, (AFUNPTR)docount, IARG END);}void Fini(INT32 code, void *v){ FILE* outfile fopen(KnobOutputFile.Value().c str(),”w”);fprintf(outfile, “Count %d\n”, icount);}int main(int argc, char * argv[]){PIN Init(argc, argv);INS AddInstrumentFunction(Instruction, 0);PIN AddFiniFunction(Fini, 0);PIN StartProgram();return 0;2/19/20216.823 Spring 2021}27

ManualExamples/inscount0.C#include iostream #include "pin.h"UINT64 icount 0;KNOB string KnobOutputFile(KNOB MODE WRITEONCE, “pintool”, “o”,“results.out”, “specify output file”);void docount() { icount ; }analysis routinevoid Instruction(INS ins, void *v)instrumentation routine{INS InsertCall(ins, IPOINT BEFORE, (AFUNPTR)docount, IARG END);}void Fini(INT32 code, void *v){ FILE* outfile fopen(KnobOutputFile.Value().c str(),”w”);fprintf(outfile, “Count %d\n”, icount);}int main(int argc, char * argv[]){PIN Init(argc, argv);INS AddInstrumentFunction(Instruction, 0);PIN AddFiniFunction(Fini, 0);PIN StartProgram();return 0;2/19/20216.823 Spring 2021}28

Instrumentation Points Instrument points relative to an instruction:– Before (IPOINT BEFORE)– After: Fall-through edge (IPOINT AFTER) Taken edge (IPOINT TAKEN BRANCH)count()count()2/19/2021cmpjle%esi, %edx count() L1 L1 :mov 0x1, %edi6.823 Spring 2021mov 0x8,%edi29

Pintool 2: Instruction TracePrint(ip);sub 0xff, %edxPrint(ip);cmp %esi, %edxPrint(ip);jle L1 Print(ip);mov 0x1, %ediPrint(ip);add 0x10, %eax2/19/20216.823 Spring 202130

Pintool 2: Instruction Trace Output pin –ifeellucky -t itrace -/bin/lsMakefile atrace.o imageload.outitrace proccountMakefile.example imageloadinscount0 itrace.o proccount.oatrace imageload.o inscount0.oitrace.out head -4 2/19/20216.823 Spring 202131

ManualExamples/itrace.C#include stdio.h argument to analysis routine#include "pin.H"FILE * trace;void printip(void *ip) { fprintf(trace, "%p\n", ip); }analysis routinevoid Instruction(INS ins, void *v) {INS InsertCall(ins, IPOINT BEFORE, (AFUNPTR)printip,IARG INST PTR, IARG END);}instrumentation routinevoid Fini(INT32 code, void *v) { fclose(trace); }int main(int argc, char * argv[]) {trace fopen("itrace.out", "w");PIN Init(argc, argv);INS AddInstrumentFunction(Instruction, 0);PIN AddFiniFunction(Fini, 0);PIN StartProgram();return 0;}2/19/20216.823 Spring 202132

Examples of Arguments to AnalysisRoutine IARG INST PTR– Instruction pointer (program counter) value IARG PTR pointer – A pointer to some data IARG REG VALUE register name – Value of the register specified IARG BRANCH TARGET ADDR– Target address of the branch instrumented IARG MEMORY READ EA– Effective address of a memory readAnd many more (refer to the Pin manual for details)2/19/20216.823 Spring 202133

Modifying Program Behavior Pin allows you not only to observe, but also changeprogram behavior Ways to change program behavior:–––––2/19/2021Add/delete instructionsChange register valuesChange memory valuesChange control flowInject errors6.823 Spring 202134

Writing Efficient Pintools(we will cover this in detail next week)2/19/20216.823 Spring 202135

Reducing Instrumentation OverheadTotal Overhead Pin’s Overhead Pintool’s Overhead The job of Pin developers to minimize this 5% for SPECfp and 20% for SPECint2/19/20216.823 Spring 202136

Reducing Instrumentation OverheadTotal Overhead Pin’s Overhead Pintool’s Overhead The job of Pin developers to minimize this 5% for SPECfp and 20% for SPECint Pintool writers can help minimize this!2/19/20216.823 Spring 202137

Reducing Pintool’s OverheadPintool’s OverheadInstrumentation Routines Overhead Analysis Routines OverheadFrequency of calling an Analysis Routine x Work required in the Analysis RoutineNext week, we will seehow we can reduce these overheads2/19/20216.823 Spring 202138

Conclusions Instrumentation is a technique for inserting extra codeinto a program to observe its behavior Pin is a dynamic binary instrumentation system Instrumentation tools (Pintools) are written in C/C using Pin’s rich API Instrumentation routines define where instrumentationis inserted Analysis routines define what to do wheninstrumentation is activated2/19/20216.823 Spring 202139

Conclusions Instrumentation is a technique for inserting extra codeinto a program to observe its behavior Pin is a dynamic binary instrumentation system Instrumentation tools (Pintools) are written in C/C using Pin’s rich API Instrumentation routines define where instrumentationis inserted Analysis routines define what to do wheninstrumentation is activatedLab 0 released on website2/19/20216.823 Spring 202140

Introduction to PIN Hyun Ryong(Ryan) Lee 6823-tas@csail.mit.edu Adapted from: Prior 6.823 offerings, and Intel’s Tutorial at CGO 2010 2/19/2021 6.823 Spring 2021 1 6.823: