Valgrind-mmt is a Valgrind modification which allows tracing application accesses to mmaped memory (which is how userspace parts of graphics drivers communicate with hardware). It was created by Dave Airlie and then extended/fixed by others.

Installation:

git clone git://people.freedesktop.org/~mslusarz/valgrind
git clone git://people.freedesktop.org/~mslusarz/vex valgrind/VEX
cd valgrind
./autogen.sh
./configure --prefix=...
make
make install

Update:

cd valgrind
git pull
cd VEX
git pull
cd ..

Use:

valgrind --tool=mmt --mmt-trace-file=/dev/nvidia0 --mmt-trace-nvidia-ioctls Xorg

Options:

--mmt-trace-file=path      trace loads and stores to memory mapped for this file (e.g. /dev/nvidia0) (you can pass this option multiple times)
--mmt-trace-all-files      trace loads and stores to memory mapped for all files
--mmt-trace-nvidia-ioctls  trace nvidia ioctls on /dev/nvidiactl
--mmt-trace-nouveau-ioctls trace nouveau ioctls on /dev/dri/cardX
--mmt-trace-all-opens      trace all 'open' syscalls
--mmt-trace-marks          send mmiotrace marks before and after ioctls

Some notes about tracing Xorg:

• valgrind can't trace suid binaries, you have to copy Xorg to e.g. Xorg-nosuid

• running plain Xorg won't load any windowmanager - before starting X, start on another console:

  export DISPLAY=:0; while [ true ]; do xterm; sleep 1; done

• tracing slows down Xorg considerably - ~20x
• nvidia ioctl tracing is fragile - can crash easily

• when valgrind crashes, Xorg leaves only black screen - you need to press Alt-SysRq-R, switch to some free console (ctrl-alt-fxx), blindly login and start normal Xorg (startx)