From 00a03180413224dfc932c83a53fa2ccd145784ef Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 23 Oct 2026 11:15:53 -0400 Subject: docs: ANALYSIS-egl-engine-selection - entry trace narrows the wall to glsi+0x33b80's state machine Batch-gdb entry trace (r543 boot): engine-init -> 1aba0 -> 22f30 (device lookup, miss=0xee00002) / 2c360 (object lookup, miss=0xee00003) / 33b80 (device flags + state machine) -> 301b0 (state, 3a6f0 x7, 2ac10 x2) -> EGL_BAD_ALLOC. All three lookups were entered, so the failure lands inside 33b80's state machine; the busy path (30ef2 in 30b20) sets bit 0x20 on the per-engine state record and returns 0xee00001 once, and eglcore rejects the engine without retry. 22f30 is called ~1300x (enumeration), so it is not a lookup miss. Also records the inconclusive Xorg DMA/push-buffer test on a boot that had a stalled client. --- .../570.144/docs/ANALYSIS-egl-engine-selection.md | 49 ++++++++++++++++++++-- 1 file changed, 45 insertions(+), 4 deletions(-) (limited to 'userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md') diff --git a/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md b/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md index 9c7ed67..48e9f35 100644 --- a/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md +++ b/userspace/cuda/570.144/docs/ANALYSIS-egl-engine-selection.md @@ -77,11 +77,52 @@ is what fails. * **Not ASLR-dependent.** All offsets above are stable under gdb (`set disable-randomization on`). -## 4. Next steps (for the successor) +## 4. Entry-trace update (2026-10-23, r543 boot) -1. Trace `glsi +0x301b0`'s internal calls (returns of `+0x3a6f0`, - `+0x2ac10`, `+0x2fbe0`, `+0x29760`, `+0x32110`, `+0x2dc70`) to find the - first non-zero return; that call is the true failing layer. +A batch-gdb entry trace (breakpoints on the glsi engine-init entry and its +inner functions, breakpoint set after `eglInitialize` so the vendor libraries +are mapped; ASLR disabled reproduces glsi base `0x7ffff7e2a000`) captured the +failing call order: + +``` +glsi+0x5f480 (engine-init) + glsi+0x1aba0 (first inner call) + glsi+0x22f30 device lookup by GPU id (miss -> 0xee00002) + glsi+0x2c360 object lookup (miss -> 0xee00003) + glsi+0x33b80 device-flags + state <-- the failing layer + glsi+0x301b0 (state machine, entered twice) + glsi+0x3a6f0 (entered ~7x) + glsi+0x2ac10 (entered twice) + -> EGL_CURRENT_FAIL err=0x3003 (eglcore rejects the engine) +``` + +`+0x5f480` returns as soon as `+0x1aba0` reports non-zero; `+0x1aba0` +propagates the first failure of `+0x22f30` / `+0x2c360` / `+0x33b80`. In the +trace all three were entered, and the failure lands inside `+0x33b80`'s +state-machine call. `+0x33b80` reads the device flags word at `+0xb84`; on a +state-machine failure with the retry bit set it marks the device busy +(`or 0x20` into the state record at `device + idx*0xdc8 + 0x291b4`) and +returns `0xee00001` once (`glsi+0x30ef2` inside its callee `+0x30b20`); +the higher layer reads `+0xb84` bit 0x20 and rejects the engine for this +attempt without retry. `+0x22f30` is called ~1300 times during the probe +(per-device/per-engine enumeration) - the failure is not a lookup miss. + +The state machine (`+0x301b0`) consumes per-engine context records; its +inputs are the fields the caller passes in (`+0x95` mode byte, `+0x38` +record array, `+0x74` id, `+0x98` index) plus the device flags. The next +step is a return-value trace of `+0x3a6f0`/`+0x2ac10` (their failure +conditions) or a differential state dump against a physical-GPU run. + +Note (same day): a control experiment was attempted - Xorg (GLX path) on +the same boot died in `Failed to initialize DMA` / `Failed to allocate push +buffer`, but that boot had a stalled CUDA client holding the device, so the +result is inconclusive; retry on a clean boot. + +## 5. Next steps (for the successor) + +1. Return-value trace of `glsi +0x33b80`'s callees (`+0x301b0`'s + `+0x3a6f0` / `+0x2ac10` results): the first non-zero return there is the + true failing layer. 2. Compare the glsi device-engine state with the same probe on a physical Turing GPU (the host's own 570 driver runs the identical userspace; a host-side `egl_frame` run with the real GPU succeeds, so a differential -- cgit v1.2.3