185 lines · plain
1===================================2In-kernel memory-mapped I/O tracing3===================================4 5 6Home page and links to optional user space tools:7 8 https://nouveau.freedesktop.org/wiki/MmioTrace9 10MMIO tracing was originally developed by Intel around 2003 for their Fault11Injection Test Harness. In Dec 2006 - Jan 2007, using the code from Intel,12Jeff Muizelaar created a tool for tracing MMIO accesses with the Nouveau13project in mind. Since then many people have contributed.14 15Mmiotrace was built for reverse engineering any memory-mapped IO device with16the Nouveau project as the first real user. Only x86 and x86_64 architectures17are supported.18 19Out-of-tree mmiotrace was originally modified for mainline inclusion and20ftrace framework by Pekka Paalanen <pq@iki.fi>.21 22 23Preparation24-----------25 26Mmiotrace feature is compiled in by the CONFIG_MMIOTRACE option. Tracing is27disabled by default, so it is safe to have this set to yes. SMP systems are28supported, but tracing is unreliable and may miss events if more than one CPU29is on-line, therefore mmiotrace takes all but one CPU off-line during run-time30activation. You can re-enable CPUs by hand, but you have been warned, there31is no way to automatically detect if you are losing events due to CPUs racing.32 33 34Usage Quick Reference35---------------------36::37 38 $ mount -t debugfs debugfs /sys/kernel/debug39 $ echo mmiotrace > /sys/kernel/tracing/current_tracer40 $ cat /sys/kernel/tracing/trace_pipe > mydump.txt &41 Start X or whatever.42 $ echo "X is up" > /sys/kernel/tracing/trace_marker43 $ echo nop > /sys/kernel/tracing/current_tracer44 Check for lost events.45 46 47Usage48-----49 50Make sure debugfs is mounted to /sys/kernel/debug.51If not (requires root privileges)::52 53 $ mount -t debugfs debugfs /sys/kernel/debug54 55Check that the driver you are about to trace is not loaded.56 57Activate mmiotrace (requires root privileges)::58 59 $ echo mmiotrace > /sys/kernel/tracing/current_tracer60 61Start storing the trace::62 63 $ cat /sys/kernel/tracing/trace_pipe > mydump.txt &64 65The 'cat' process should stay running (sleeping) in the background.66 67Load the driver you want to trace and use it. Mmiotrace will only catch MMIO68accesses to areas that are ioremapped while mmiotrace is active.69 70During tracing you can place comments (markers) into the trace by71$ echo "X is up" > /sys/kernel/tracing/trace_marker72This makes it easier to see which part of the (huge) trace corresponds to73which action. It is recommended to place descriptive markers about what you74do.75 76Shut down mmiotrace (requires root privileges)::77 78 $ echo nop > /sys/kernel/tracing/current_tracer79 80The 'cat' process exits. If it does not, kill it by issuing 'fg' command and81pressing ctrl+c.82 83Check that mmiotrace did not lose events due to a buffer filling up. Either::84 85 $ grep -i lost mydump.txt86 87which tells you exactly how many events were lost, or use::88 89 $ dmesg90 91to view your kernel log and look for "mmiotrace has lost events" warning. If92events were lost, the trace is incomplete. You should enlarge the buffers and93try again. Buffers are enlarged by first seeing how large the current buffers94are::95 96 $ cat /sys/kernel/tracing/buffer_size_kb97 98gives you a number. Approximately double this number and write it back, for99instance::100 101 $ echo 128000 > /sys/kernel/tracing/buffer_size_kb102 103Then start again from the top.104 105If you are doing a trace for a driver project, e.g. Nouveau, you should also106do the following before sending your results::107 108 $ lspci -vvv > lspci.txt109 $ dmesg > dmesg.txt110 $ tar zcf pciid-nick-mmiotrace.tar.gz mydump.txt lspci.txt dmesg.txt111 112and then send the .tar.gz file. The trace compresses considerably. Replace113"pciid" and "nick" with the PCI ID or model name of your piece of hardware114under investigation and your nickname.115 116 117How Mmiotrace Works118-------------------119 120Access to hardware IO-memory is gained by mapping addresses from PCI bus by121calling one of the ioremap_*() functions. Mmiotrace is hooked into the122__ioremap() function and gets called whenever a mapping is created. Mapping is123an event that is recorded into the trace log. Note that ISA range mappings124are not caught, since the mapping always exists and is returned directly.125 126MMIO accesses are recorded via page faults. Just before __ioremap() returns,127the mapped pages are marked as not present. Any access to the pages causes a128fault. The page fault handler calls mmiotrace to handle the fault. Mmiotrace129marks the page present, sets TF flag to achieve single stepping and exits the130fault handler. The instruction that faulted is executed and debug trap is131entered. Here mmiotrace again marks the page as not present. The instruction132is decoded to get the type of operation (read/write), data width and the value133read or written. These are stored to the trace log.134 135Setting the page present in the page fault handler has a race condition on SMP136machines. During the single stepping other CPUs may run freely on that page137and events can be missed without a notice. Re-enabling other CPUs during138tracing is discouraged.139 140 141Trace Log Format142----------------143 144The raw log is text and easily filtered with e.g. grep and awk. One record is145one line in the log. A record starts with a keyword, followed by keyword-146dependent arguments. Arguments are separated by a space, or continue until the147end of line. The format for version 20070824 is as follows:148 149Explanation Keyword Space-separated arguments150---------------------------------------------------------------------------151 152read event R width, timestamp, map id, physical, value, PC, PID153write event W width, timestamp, map id, physical, value, PC, PID154ioremap event MAP timestamp, map id, physical, virtual, length, PC, PID155iounmap event UNMAP timestamp, map id, PC, PID156marker MARK timestamp, text157version VERSION the string "20070824"158info for reader LSPCI one line from lspci -v159PCI address map PCIDEV space-separated /proc/bus/pci/devices data160unk. opcode UNKNOWN timestamp, map id, physical, data, PC, PID161 162Timestamp is in seconds with decimals. Physical is a PCI bus address, virtual163is a kernel virtual address. Width is the data width in bytes and value is the164data value. Map id is an arbitrary id number identifying the mapping that was165used in an operation. PC is the program counter and PID is process id. PC is166zero if it is not recorded. PID is always zero as tracing MMIO accesses167originating in user space memory is not yet supported.168 169For instance, the following awk filter will pass all 32-bit writes that target170physical addresses in the range [0xfb73ce40, 0xfb800000]171::172 173 $ awk '/W 4 / { adr=strtonum($5); if (adr >= 0xfb73ce40 &&174 adr < 0xfb800000) print; }'175 176 177Tools for Developers178--------------------179 180The user space tools include utilities for:181 - replacing numeric addresses and values with hardware register names182 - replaying MMIO logs, i.e., re-executing the recorded writes183 184 185