IssueTracker

When using AOSP 10.0 Cuttlefish emulators with minigbm+virgl graphics stack, we frequently encounter the following failure when the app plays videos in YV12 format using software decoder.

pid: 0，tid: 32066，name: MediaCodec_loop  >>> (null) <<<
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0xab1bc000
    r9  ab1bbfe0  r1  b242620e  r2  00000015  r3  00000000  
	r4  b242618e  r5  aab30780  r6  ab1b56a0  r7  b242c566
	r8  ab1b56a0  r9  00000076  sl  00006900  fp  000000e0
	ip  ed89ec50  sp  a4514f48  lr  ee8cd947  pc  ed84717c  cpsr  200e0010


backtrace:
    #00 pc  0005d17c  /apex/com.android.runtime/lib/bionic/libc.so
	#01 pc  000c3946  /system/lib/libstagefright.so

Some debugging reveals that the failures are caused by an unwritable memory location (dst_u) when calling memcpy() in SoftwareRenderer::render(). dst_u is in turn calculated from dst which points to a graphic buffer allocated and mapped by minigbm's gralloc allocator.

We believe that the problem is in the discrepencies in how minigbm and AOSP handles YV12 buffer height alignment. In Android specifications, buffer heights are unaligned, but in the underlying minigbm driver, buffer heights are aligned to 8 bytes (cf. virtio_dumb_bo_create() and drv_bo_from_format()). Some other backends (e.g., msm, tegra) use various alignment sizes as well. This creates inconsistencies that will ultimately lead to overruns and invalid accesses when these buffers are used in the Android framework.

Fortunately, we think that those problems are not hard to fix. A unification of the specifications used by AOSP and the underlying drivers would do the trick.