SwiftShader throws different faults on ARM32

[Joonas Kylmälä]

Hi,

I get different faults when using SwiftShader on ARM32 cortex-a9. For
most of the part graphics are rendered just fine but in this particular
section (Wifi in settings app embedded to Lineageos setup wizard) it
faults. Also, I'm still totally not sure this is a SwiftShader issue but
the decoded ARM instructions near PC suggest me so since some of them
contained vector operations, and also no binary is linked in the
tombstone for these instructions meaning it is probably generated by a JIT.

I catched one of the faults here:

Tombstone and decoded program around PC:
https://paste2.org/OwjOEdtK
http://paste.debian.net/plain/1139870

Issue happens on line 20:

20: e4813004 str r3, [r1], #4

The value in r1 is #0 meaning SP + #20 is an address with #0 as its value.

Second tombstone and decoded program near PC:
https://paste2.org/yJHYtgj1
http://paste.debian.net/plain/1139574

Third tombstone:
https://paste2.org/5MfkdJ0V

AFAIK, there is no JIT debugging info available on Android platform so I
have been just trying to guess what the issue could be. One person
suggested me this could be caused by a variable not being initialized in
the stack, and so there is some function allocateStackVariable() in
src/Reactor/LLVMReactor.cpp which could be related to this or something
that calls it. I have also checked the alignedAlloc and alignedFree
functions in LLVMJIT.cpp and couldn't find any bug there.

Any help debugging this is appreciated!

Joonas

[bojana obradovic]

Hi Joonas,

Sorry for resurrecting an old thread.

I’m currently working on running Android 10 on ARM32 Cortex-A9 and have been facing a similar issue when using Swiftshader.

Did you manage to resolve your issue? I would appreciate any insights you might have.

This is logcat of the crash:
F DEBUG   : Revision: '0'
F DEBUG   : ABI: 'arm'
F DEBUG   : Timestamp: 2024-07-11 11:17:01+0000
F DEBUG   : pid: 97, tid: 97, name: surfaceflinger  >>> /system/bin/surfaceflinger <<<
F DEBUG   : uid: 1000
F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x4
F DEBUG   : Cause: null pointer dereference
F DEBUG   :     r0  00000004  r1  a4bf1a84  r2  00000000  r3  00000008
F DEBUG   :     r4  00000000  r5  a4bc4040  r6  a4b81000  r7  00000000
F DEBUG   :     r8  a4bef4e4  r9  a4bf1190  r10 a4bf119c  r11 a4bf1b10
F DEBUG   :     ip  80000000  sp  ae845808  lr  a1c7e687  pc  a1c555e6
F DEBUG   :
F DEBUG   : backtrace:
F DEBUG   :       #00 pc 002825e6  /vendor/lib/egl/libGLESv2_swiftshader.so (rr::Routine::bind()+6) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #01 pc 002ab683  /vendor/lib/egl/libGLESv2_swiftshader.so (sw::LRUCache<sw::VertexProcessor::State, rr::Routine>::add(sw::VertexProcessor::State const&, rr::Routine*)+46) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #02 pc 002ab5c1  /vendor/lib/egl/libGLESv2_swiftshader.so (sw::VertexProcessor::routine(sw::VertexProcessor::State const&)+120) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #03 pc 00288807  /vendor/lib/egl/libGLESv2_swiftshader.so (sw::Renderer::draw(sw::DrawType, unsigned int, unsigned int, bool)+594) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #04 pc 002239f7  /vendor/lib/egl/libGLESv2_swiftshader.so (es2::Device::drawPrimitive(sw::DrawType, unsigned int)+44) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #05 pc 00220753  /vendor/lib/egl/libGLESv2_swiftshader.so (es2::Context::drawArrays(unsigned int, int, int, int)+214) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #06 pc 0022802f  /vendor/lib/egl/libGLESv2_swiftshader.so (gl::DrawArrays(unsigned int, int, int)+82) (BuildId: cf55837d4154ca45a6986c8137d54f15)
F DEBUG   :       #07 pc 000c1429  /system/lib/libsurfaceflinger.so (android::renderengine::gl::GLESRenderEngine::drawMesh(android::renderengine::Mesh const&)+332) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #08 pc 000c0a0b  /system/lib/libsurfaceflinger.so (android::renderengine::gl::GLESRenderEngine::drawLayers(android::renderengine::DisplaySettings const&, std::__1::vector<android::renderengine::LayerSettings, std::__1::allocator<android::renderengine::LayerSettings>> const&, ANativeWindowBuffer*, bool, android::base::unique_fd_impl<android::base::DefaultCloser>&&, android::base::unique_fd_impl<android::base::DefaultCloser>*)+1886) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #09 pc 000918d1  /system/lib/libsurfaceflinger.so (android::SurfaceFlinger::doComposeSurfaces(android::sp<android::DisplayDevice> const&, android::Region const&, android::base::unique_fd_impl<android::base::DefaultCloser>*)+2832) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #10 pc 0008f295  /system/lib/libsurfaceflinger.so (android::SurfaceFlinger::handleMessageRefresh()+2596) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #11 pc 0008e6a9  /system/lib/libsurfaceflinger.so (android::SurfaceFlinger::onMessageReceived(int)+8104) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #12 pc 00010725  /system/lib/libutils.so (android::Looper::pollInner(int)+284) (BuildId: 12e497419781519ba2d6d1a83910beb4)
F DEBUG   :       #13 pc 0001058b  /system/lib/libutils.so (android::Looper::pollOnce(int, int*, int*, void**)+30) (BuildId: 12e497419781519ba2d6d1a83910beb4)
F DEBUG   :       #14 pc 000831ad  /system/lib/libsurfaceflinger.so (android::impl::MessageQueue::waitMessage()+56) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #15 pc 0008be8b  /system/lib/libsurfaceflinger.so (android::SurfaceFlinger::run()+8) (BuildId: 097de2364f742e6f7772861542a63077)
F DEBUG   :       #16 pc 00003273  /system/bin/surfaceflinger (main+554) (BuildId: 6ead6552cc57264408bb362727899337)
F DEBUG   :       #17 pc 00059213  /apex/com.android.runtime/lib/bionic/libc.so (__libc_init+66) (BuildId: dc6c1562fe6ee7afed9fce19515ca1d6)
F DEBUG   :       #18 pc 00003033  /system/bin/surfaceflinger (_start_main+42) (BuildId: 6ead6552cc57264408bb362727899337)
F DEBUG   :       #19 pc 000b3158  /apex/com.android.runtime/bin/linker (__dl___aeabi_uidivmod+12) (BuildId: 803ea1f59b28de7d294a1f56724510d4)
F DEBUG   :       #20 pc 00020a7f  [stack]

Also,
I tested the same android images on a different custom board with ARM64, and the issue does not appear there — everything works fine.

Best regards,
Bojana