mmt update

1 files changed, 86 insertions, 49 deletions

diff --git a/Valgrind-mmt.mdwn b/Valgrind-mmt.mdwn
index 52e61c6..aad6fa1 100644
--- a/Valgrind-mmt.mdwn
+++ b/Valgrind-mmt.mdwn
@@ -3,7 +3,7 @@
 <script type="text/javascript" src="/wiki/translate.js"></script>
 
 
-Valgrind-mmt is a [[Valgrind|http://valgrind.org/]] modification which allows tracing application accesses to mmaped memory (which is how userspace parts of graphics drivers communicate with hardware). It was created by Dave Airlie and then extended/fixed by others. 
+Valgrind-mmt is a [[Valgrind|http://valgrind.org/]] modification which allows tracing application accesses to mmaped memory (which is how userspace parts of graphics drivers communicate with hardware). It was created by Dave Airlie and then extended/fixed by others.
 
 Installation: 
 [[!format txt """
@@ -30,75 +30,112 @@ cd ..
 
 Use:
 [[!format txt """
-valgrind --tool=mmt --mmt-trace-file=/dev/nvidia0 --mmt-trace-file=/dev/nvidiactl --mmt-trace-nvidia-ioctls glxgears
-"""]]
-or (preferred):
-[[!format txt """
-valgrind --tool=mmt --mmt-trace-file=/dev/nvidia0 --mmt-trace-file=/dev/nvidiactl --mmt-trace-nvidia-ioctls --mmt-output-binary --log-file=file.log glxgears
+valgrind --tool=mmt --mmt-trace-file=/dev/nvidia0 --mmt-trace-file=/dev/nvidiactl --mmt-trace-nvidia-ioctls --log-file=file-bin.log glxgears
 """]]
 
 Options: 
 [[!format txt """
---mmt-trace-file=path      trace loads and stores to memory mapped for this file (e.g. /dev/nvidia0) (you can pass this option multiple times)
---mmt-trace-all-files      trace loads and stores to memory mapped for all files
---mmt-trace-nvidia-ioctls  trace nvidia ioctls on /dev/nvidiactl
---mmt-trace-nouveau-ioctls trace nouveau ioctls on /dev/dri/cardX
---mmt-trace-all-opens      trace all 'open' syscalls
---mmt-trace-marks          send mmiotrace marks before and after ioctls
---mmt-output-binary        output in binary format (readable by demmt and mmt_bin2dedma)
-"""]]
+--mmt-trace-file=path        trace loads and stores to memory mapped for this file (e.g. /dev/nvidia0) (you can pass this option multiple times)
+--mmt-trace-all-files        trace loads and stores to memory mapped for all files
+--mmt-trace-nvidia-ioctls    trace nvidia ioctls on /dev/nvidiactl
+--mmt-trace-nouveau-ioctls   trace nouveau ioctls on /dev/dri/cardX
+--mmt-trace-all-opens        trace all 'open' syscalls
+--mmt-trace-marks            send mmiotrace marks before and after ioctls
+--mmt-trace-stdout-stderr    trace writes to stdout and stderr
+--mmt-ioctl-create-fuzzer=   0-disabled (default), 1-enabled (safe), 2-enabled (unsafe)
+--mmt-object-ctr=class,cargs sets the number of u32 constructor args(dec) for specified class(hex)
+--mmt-ioctl-call-fuzzer=     0-disabled (default), 1-enabled
 
-Some notes about tracing Xorg:
-
-* valgrind can't trace suid binaries, you have to copy Xorg to e.g. Xorg-nosuid 
-* running plain Xorg won't load any windowmanager - before starting X, start on another console:[[!format txt """
-export DISPLAY=:0; while [ true ]; do xterm; sleep 1; done
 """]]
-* nvidia ioctl tracing used to be fragile, now it's pretty good
-* when valgrind crashes, Xorg leaves only black screen - you need to press Alt-SysRq-R, switch to some free console (ctrl-alt-fxx), blindly login and start normal Xorg (startx) 
 
 What to do with generated trace:
-All tools come from [[envytools|https://github.com/envytools/envytools/]] repository.
-Text log can be parsed by "dedma":
+
+You can decode (binary) trace by:
 [[!format txt """
-./dedma -m nvXX -v $(mapid) file.log
+./demmt -m nvXX -l file-bin.log
 """]]
-where $(mapid) is a buffer number. Note that dedma won't properly decode buffers other than main one. You need binary mmt trace and demmt to see them.
-
-Binary output can be converted back to text output with "mmt_bin2text" tool (if for some reason demmt does not work):
+(If your file name starts with nvXX string, you can skip -m).
 
+or translate it to text:
 [[!format txt """
 ./mmt_bin2dedma < file-bin.log > file-txt.log
 """]]
 
-and fed back to dedma or directly parsed by demmt:
-
+and feed it to dedma:
 [[!format txt """
-./demmt -m nvXX -f < file-bin.log
+./dedma -m nvXX -v $(mapid) file-txt.log
 """]]
+where $(mapid) is a buffer number. Note that dedma is a pretty basic tool and have unfixable bugs. Using demmt is recommended.
 
-which will output "possible IB buffer: $id" or "possible USER buffer: $id" and then:
+All decoding tools (demmt, mmt_bin2dedma and dedma) are from [[envytools|https://github.com/envytools/envytools/]] repository.
+Note: Valgrind-mmt used to output in purely text form (dedma-compatible). However, due to binary output being way more powerful, the text output was removed.
 
 [[!format txt """
-./demmt -m nvXX -n $id < file-bin.log
+  -l file		use "file" as input
+         		- it can be compressed by gzip, bzip2 or xz
+         		- demmt extracts chipset version from characters following "nv"
+  -m 'chipset'		set chipset version (required, but see -l)
+  -q			(quiet) print only the most important data (= -d all -e pb,shader,macro,tsc,tic,cp,classes=all,buffer-usage,nvrm-class-desc)
+  -c 0/1		disable/enable colors (default: 1)
+  -g 0/1		= -d/-e gpu-addr (default: 0)
+  -o 0/1		= -d/-e ioctl-raw (default: 0)
+  -r 0/1		= -d/-e macro-rt-verbose (default: 0)
+  -i 0/1		disable/enable log indentation (default: 0)
+  -f			find possible pushbuf pointers (IB / USER)
+  -n id[,offset]	set pushbuf pointer to "id" and optionally offset within this buffer to "offset"
+  -a			= -d classes=all
+  -x			force pushbuf decoding even without pushbuf pointer
+
+  -d msg_type1[,msg_type2[,msg_type3....]] - disable messages
+  -e msg_type1[,msg_type2[,msg_type3....]] - enable messages
+     message types:
+     - write - memory write
+     - read - memory read
+     - gpu-addr - gpu address
+     - mem = read,write
+     - pb - push buffer
+     - class=[all,0x...] - class decoder
+     - tsc - texture sampler control block
+     - tic - texture image control block
+     - vp - vertex program
+     - fp - fragment program
+     - gp - geometry program
+     - cp - compute program
+     - tep
+     - tcp
+     - shader = vp,fp,gp,tep,tcp
+     - macro-rt-verbose - verbose macro interpreter
+     - macro-rt - macro interpreter 
+     - macro-dis - macro disasm
+     - macro = macro-rt,macro-dis
+     - sys_mmap
+     - sys_munmap
+     - sys_mremap
+     - sys_open
+     - sys_write
+     - sys = sys_mmap,sys_munmap,sys_mremap,sys_open,sys_write,ioctl-desc
+     - ioctl-raw - raw ioctl data
+     - ioctl-desc - decoded ioctl
+     - ioctl = ioctl-raw,ioctl-desc
+     - nvrm-ioctl=[all,name] name=create,call,host_map,etc...
+     - nvrm-mthd=[all,0x...] - method call
+     - nvrm-handle-desc - handle description
+     - nvrm-class-desc - class description
+     - nvrm-unk-0-fields - unk zero fields
+     - nvrm = nvrm-ioctl=all,nvrm-mthd=all,nvrm-handle-desc,nvrm-class-desc
+     - buffer-usage
+     - msg - textual valgrind message
+     - info - various informations
+     - all - everything above
 """]]
 
-If -f can't find IB/USER buffer (it's a bug, please report it), you can skip -n, but demmt output will be less reliable (but still better than dedma).
+Some notes about tracing Xorg:
 
-All demmt options:
-[[!format txt """
--m 'chipset'    set chipset version (required)
--f              find possible pushbuf pointers (IB / USER)
--n id           set pushbuf pointer to "id"
--g              print gpu addresses
--o              dump ioctl data
--q              (quiet) print only the most important data (pushbufs from IB / USER and disassembled code)
--a              disable shader disassembly
--c              enable colors
--l file         use "file" as input
-
--s              do not "compress" obvious buffer clears
--i              do not guess invalid pushbufs
--d              hide invalid pushbufs
--e              do not decode invalid pushbufs
+* Valgrind can't trace suid binaries, so you have to copy Xorg, unset its suid bit, and trace that file.
+* Because of the above, you need to be root when tracing.
+* X and Xorg sometimes are not the same file. Make sure you are tracing the correct file.
+* Running plain Xorg binary won't load any window manager, so before tracing, start on another console:[[!format txt """
+export DISPLAY=:0; while [ true ]; do xterm; sleep 1; done
 """]]
+* When Valgrind crashes, Xorg leaves only black screen - you need to press Alt-SysRq-R, switch to some free console (ctrl-alt-fxx), blindly login and start normal Xorg (startx)
+