Recent kernels support a kprobe-like API for trapping MMIO operations.
See include/linux/mmiotrace.h, [un]register_kmmio_probe().
Possible syntax:

    probe kernel.mmio(0xaddr).length(0xsize)  { $addr }

There is also a *tracing* widget backend nearby for ftrace,
but it does not appear relevant to systemtap.


commit 8b7d89d02ef3c6a7c73d6596f28cea7632850af4
Author: Pekka Paalanen <pq@iki.fi>
Date:   Mon May 12 21:20:56 2008 +0200

    x86: mmiotrace - trace memory mapped IO
    
    Mmiotrace is a tool for trapping memory mapped IO (MMIO) accesses within
    the kernel. It is used for debugging and especially for reverse
    engineering evil binary drivers.
    
    Mmiotrace works by wrapping the ioremap family of kernel functions and
    marking the returned pages as not present. Access to the IO memory
    triggers a page fault, which will be handled by mmiotrace's custom page
    fault handler. This will single-step the faulted instruction with the
    MMIO page marked as present. Access logs are directed to user space via
    relay and debug_fs.
    
    This page fault approach is necessary, because binary drivers have
    readl/writel etc. calls inlined and therefore extremely difficult to
    trap with with e.g. kprobes.