Memory Mapped I/O Trace

Mmiotrace is a toolbox for tracing memory mapped I/O access within the kernel. It can be used to record how a driver module uses MMIO reads and writes, for reverse engineering and debugging.

The supported architectures are x86 and x86_64, they both seem to be pretty stable. If you get a crash, see if there's any information about it in your log files and contact PekkaPaalanen by email or at #mmio-trace IRC channel on Freenode.

Developers and analysts might be interested in MmioTraceDeveloper and old debugging notes in MmioTraceDebugging.

Features:

timestamped events
a mechanism to inject markers into the log while tracing
no kernel patching
collect block-reads/writes in mmio-parse
use register names (Rules-ng)

The modern format of an mmiotrace log is described in MmioTraceLogFormat.

Instructions for specific kernel versions

The latest kernel (or at least 2.6.29) is the recommended one, if you can choose. The installation and usage instructions depend on your kernel version.

These kernel version notes are for people doing mmiotrace dumps. People analysing mmiotrace dumps likely want to get the out-of-tree mmiotrace, too, because it contains useful analysis tools.

2.6.27 and later

Mmiotrace is in the kernel, no need to fetch or patch anything extra. Please read the instructions in the file Documentation/tracers/mmiotrace.txt or Documentation/trace/mmiotrace.txt in your kernel source tree. No special programs are needed to record the output.

2.6.29: Crash fixes. If you had trouble getting a trace due to the machine freezing, that is hopefully fixed now.
2.6.28: Added marker support, fixed the 8-bit write bug.
2.6.27: The first kernel carrying mmiotrace. No marker support. Has a bug related to 8-bit writes showing incorrect data.

The following kernel versions are not recommended:

2.6.25

Mmiotrace must be patched into the kernel, see MmioTrace2_6_25. Kernel 2.6.26 is not supported, but the same patch could probably be adapted.

2.6.24

The 2.6.24 kernel needs a patch, after which you can use the out-of-tree mmiotrace. 0001-x86-Add-a-list-for-custom-page-fault-handlers.patch.txt. Do enable CONFIG_PAGE_FAULT_HANDLERS. Then follow MmioTraceOldHowto.

2.6.19 to 2.6.23

Use the out-of-tree mmiotrace, see MmioTraceOldHowto.

The page fault notifier hooks required by the kernel-patchless mmiotrace were introduced in Linus's kernel tree in 2.6.19-rc1, commits 474c256841074b913e76e392082373e12103a75d and 273819a2d982faace30e587b86a0683882251fe7.

Submitting results

If you want to send mmio-trace dumps to us, please send them to mmio dot dumps at gmail dot com. Please, pack into a compressed archive the trace file and a free description about what you do during the trace. The output of lspci is already included in the trace file, but do add the output of uname -a and the driver version into your description. Tell also what display connectors you have, what kind of monitors you have connected to what outputs, whether it has tv-in/out, and what display mode you used. The name of the archive file should contain the PCI id and GPU family, or the commercial name of your card. Thank you.