Revision 3 as of 2010-04-20 08:53:00

Clear message

What is an MMIO Trace

MMIO (Memory Mapped I/O) tracing is a technique that can be used to reverse-engineer hardware drivers. It works by intercepting all the reads and writes by a driver to memory, recording how the driver is poking the hardware and what hardware state it reads. This tool was partially written, has been extensively used, by the Nouveau project to reverse-engineer the nVidia binary drivers.

Tracing the binary nVidia drivers

Some bugs in the Nouveau drivers can best be solved by working out what the binary nVidia drivers do and adapting that. This is particularly true for new hardware support and where the nouveau drivers fail to activate a monitor correctly.


  • Kernel 2.6.32-17 or newer. The mmiotrace kernel framework was enabled in the 2.6.32-17-generic kernel in the Lucid development cycle. You'll need to be running a kernel at least as new as this. An appropriate kernel is included in Lucid Beta 1 and later.
  • Working nVidia restricted drivers. We'll be tracing how the binary drivers interact with the graphics card, so we need the nVidia drivers to be working. You can enable the nVidia drivers through the Hardware Drivers configuration applet in System→Administration→Hardware Drivers. Boot at least once normally to check that the nVidia drivers are working correctly.


The initial set up for an MMIO trace needs to be done [i]before[/i] the driver is loaded. This means that we need to do it outside of X.

Boot your system in “recovery mode”. You can select this from the GRUB boot menu. If the GRUB menu is not shown by default you can bring it up early in your boot process by pressing the “shift” key. Select “Drop to a root shell prompt” from the recovery menu to bring up a terminal.

From here we will ensure that the nvidia driver is not loaded, enable the mmio tracer, load the nvidia driver, perform the action we want to trace, then collect the log.

Ensure the nvidia driver is not loaded

Run lsmod | grep nvidia. This should not produce any output. If it returns some output like

nvidia               9932176  5 
agpgart                31724  2 nvidia,intel_agp

then you need to remove the nvidia module by running rmmod nvidia. Run lsmod | grep nvidia again to check.

Enable the mmio tracer