Sandbox initialization for VideoToolbox.

content/common/gpu/media/vt_video_decode_accelerator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <CoreVideo/CoreVideo.h>
 #include <OpenGL/CGLIOSurface.h>
 #include <OpenGL/gl.h>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 20 matching lines @@
 
 // Size to use for NALU length headers in AVC format (can be 1, 2, or 4).
 static const int kNALUHeaderLength = 4;
 
 // We request 5 picture buffers from the client, each of which has a texture ID
 // that we can bind decoded frames to. We need enough to satisfy preroll, and
 // enough to avoid unnecessary stalling, but no more than that. The resource
 // requirements are low, as we don't need the textures to be backed by storage.
 static const int kNumPictureBuffers = media::limits::kMaxVideoFrames + 1;
 
+// Build an |image_config| dictionary for VideoToolbox initialization.
+static CFMutableDictionaryRef BuildImageConfig(
+    CMVideoDimensions coded_dimensions) {
+  // TODO(sandersd): RGBA option for 4:4:4 video.
+  int32_t pixel_format = kCVPixelFormatType_422YpCbCr8;
+
+#define CFINT(i) CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &i)
+  base::ScopedCFTypeRef<CFNumberRef> cf_pixel_format(CFINT(pixel_format));
+  base::ScopedCFTypeRef<CFNumberRef> cf_width(CFINT(coded_dimensions.width));
+  base::ScopedCFTypeRef<CFNumberRef> cf_height(CFINT(coded_dimensions.height));
+#undef CFINT
+
+  CFMutableDictionaryRef image_config = CFDictionaryCreateMutable(
+      kCFAllocatorDefault,
+      4,  // capacity
+      &kCFTypeDictionaryKeyCallBacks,
+      &kCFTypeDictionaryValueCallBacks);
+  CFDictionarySetValue(image_config, kCVPixelBufferPixelFormatTypeKey,
+                       cf_pixel_format);
+  CFDictionarySetValue(image_config, kCVPixelBufferWidthKey, cf_width);
+  CFDictionarySetValue(image_config, kCVPixelBufferHeightKey, cf_height);
+  CFDictionarySetValue(image_config, kCVPixelBufferOpenGLCompatibilityKey,
+                       kCFBooleanTrue);
+
+  return image_config;
+}
+
+// TODO(sandersd): Also decode a frame if it turns out to be necessary for some
+// hardware.
+void InitializeVideoToolbox() {

[DaleCurtis, 2014/11/21 19:01:02]

What's the impact on gpu process startup time with this call?

[sandersd (OOO until July 31), 2014/11/21 20:19:35]

Based on the benchmarking I just did, the perf test I ran was not being helpful.

On my MacBook Pro, a cold start is about 60ms and a warm start 30ms.

+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kDisableAcceleratedVideoDecode)) {
+    return;
+  }
+
+  if (!IsVtInitialized()) {
+    // CoreVideo is also required, but the loader stops after the first path is
+    // loaded. Instead we rely on the transitive dependency from VideoToolbox to
+    // CoreVideo.
+    // TODO(sandersd): Fallback to PrivateFrameworks.
+    StubPathMap paths;
+    paths[kModuleVt].push_back(FILE_PATH_LITERAL(
+        "/System/Library/Frameworks/VideoToolbox.framework/VideoToolbox"));
+    if (!InitializeStubs(paths))
+      return;
+  }
+
+  // Create a decoding session.

[DaleCurtis, 2014/11/20 23:08:33]

This seems a bit crazy, wouldn't we normally handle this during Initialize()
with actual data?

[sandersd (OOO until July 31), 2014/11/21 00:04:52]

Yes, but we don't have actual data because no video is being decoded yet, and if
we call it then it will be too late to initialize VideoToolbox.

[Side note: actually no, it normally happens after the first call to Decode()
because we don't get the initialization data in Initialize(). It's a problematic
feature of the VDA API.]

We just need some data (any data, as long as it is compatible with hardware
decoding) that VideoToolbox will accept to create a decompression session.

[DaleCurtis, 2014/11/21 02:04:13]

Is there any impact on the ability to play two videos at once?

[sandersd (OOO until July 31), 2014/11/21 02:07:07]

No, this initialization is called once per GPU process and is entirely separate
from the per-stream initialization.

[DaleCurtis, 2014/11/21 19:01:02]

To be clear, you're running this here so that all the necessary library calls
will be preloaded into the process prior to lockdown? Seems like that could fail
in odd ways if this misses calls that say a 1080p high profile decoding session
might use...

If this is the only way to do this, you at least need a much stronger comment
about what's happening here and how it could fail.

[sandersd (OOO until July 31), 2014/11/21 20:19:35]

Done.

+  // SPS and PPS data were taken from the 480p encoding of Big Buck Bunny.
+  uint8_t sps[] = {0x67, 0x64, 0x00, 0x1e, 0xac, 0xd9, 0x80, 0xd4, 0x3d, 0xa1,

[DaleCurtis, 2014/11/21 19:01:02]

Will the API let you const all these?

[sandersd (OOO until July 31), 2014/11/21 20:19:35]

Done.

+                   0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x03, 0x00, 0x30,
+                   0x8f, 0x16, 0x2d, 0x9a};
+  uint8_t pps[] = {0x68, 0xe9, 0x7b, 0xcb};
+  uint8_t* data_ptrs[] = {sps, pps};
+  size_t data_sizes[] = {arraysize(sps), arraysize(pps)};
+
+  base::ScopedCFTypeRef<CMFormatDescriptionRef> format;
+  OSStatus status = CMVideoFormatDescriptionCreateFromH264ParameterSets(
+      kCFAllocatorDefault,
+      2,                          // parameter_set_count
+      data_ptrs,                  // &parameter_set_pointers
+      data_sizes,                 // &parameter_set_sizes
+      kNALUHeaderLength,          // nal_unit_header_length
+      format.InitializeInto());
+  if (status) {
+    LOG(ERROR) << "Failed to create CMVideoFormatDescription while "
+               << "initializing VideoToolbox";
+    UninitializeVt();
+    return;
+  }
+
+  base::ScopedCFTypeRef<CFMutableDictionaryRef> decoder_config(
+      CFDictionaryCreateMutable(
+          kCFAllocatorDefault,
+          1,  // capacity
+          &kCFTypeDictionaryKeyCallBacks,
+          &kCFTypeDictionaryValueCallBacks));
+
+  CFDictionarySetValue(
+      decoder_config,
+      // kVTVideoDecoderSpecification_RequireHardwareAcceleratedVideoDecoder
+      CFSTR("RequireHardwareAcceleratedVideoDecoder"),
+      kCFBooleanTrue);
+
+  base::ScopedCFTypeRef<CFMutableDictionaryRef> image_config(
+      BuildImageConfig(CMVideoFormatDescriptionGetDimensions(format)));
+
+  VTDecompressionOutputCallbackRecord callback;
+  callback.decompressionOutputCallback = NULL;
+  callback.decompressionOutputRefCon = NULL;
+
+  base::ScopedCFTypeRef<VTDecompressionSessionRef> session;
+  status = VTDecompressionSessionCreate(
+      kCFAllocatorDefault,
+      format,               // video_format_description
+      decoder_config,       // video_decoder_specification
+      image_config,         // destination_image_buffer_attributes
+      &callback,            // output_callback
+      session.InitializeInto());
+  if (status) {
+    LOG(ERROR) << "Initializing VideoToolbox failed with status " << status;
+    UninitializeVt();
+    return;
+  }
+}
+
 // Route decoded frame callbacks back into the VTVideoDecodeAccelerator.
 static void OutputThunk(
     void* decompression_output_refcon,
     void* source_frame_refcon,
     OSStatus status,
     VTDecodeInfoFlags info_flags,
     CVImageBufferRef image_buffer,
     CMTime presentation_time_stamp,
     CMTime presentation_duration) {
   VTVideoDecodeAccelerator* vda =
@@ skipping 33 matching lines @@
 
 VTVideoDecodeAccelerator::~VTVideoDecodeAccelerator() {
 }
 
 bool VTVideoDecodeAccelerator::Initialize(
     media::VideoCodecProfile profile,
     Client* client) {
   DCHECK(gpu_thread_checker_.CalledOnValidThread());
   client_ = client;
 
+  if (!IsVtInitialized())
+    return false;
+
   // Only H.264 is supported.
   if (profile < media::H264PROFILE_MIN || profile > media::H264PROFILE_MAX)
     return false;
 
-  // Require --no-sandbox until VideoToolbox library loading is part of sandbox
-  // startup (and this VDA is ready for regular users).
-  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kNoSandbox))
-    return false;
-
-  if (!IsVtInitialized()) {
-    // CoreVideo is also required, but the loader stops after the first
-    // path is loaded. Instead we rely on the transitive dependency from
-    // VideoToolbox to CoreVideo.
-    // TODO(sandersd): Fallback to PrivateFrameworks for VideoToolbox.
-    StubPathMap paths;
-    paths[kModuleVt].push_back(FILE_PATH_LITERAL(
-        "/System/Library/Frameworks/VideoToolbox.framework/VideoToolbox"));
-    if (!InitializeStubs(paths))
-      return false;
-  }
-
   // Spawn a thread to handle parsing and calling VideoToolbox.
   if (!decoder_thread_.Start())
     return false;
 
   return true;
 }
 
 bool VTVideoDecodeAccelerator::FinishDelayedFrames() {
   DCHECK(decoder_thread_.message_loop_proxy()->BelongsToCurrentThread());
   if (session_) {
@@ skipping 60 matching lines @@
           &kCFTypeDictionaryKeyCallBacks,
           &kCFTypeDictionaryValueCallBacks));
 
   CFDictionarySetValue(
       decoder_config,
       // kVTVideoDecoderSpecification_EnableHardwareAcceleratedVideoDecoder
       CFSTR("EnableHardwareAcceleratedVideoDecoder"),
       kCFBooleanTrue);
 
   base::ScopedCFTypeRef<CFMutableDictionaryRef> image_config(
-      CFDictionaryCreateMutable(
-          kCFAllocatorDefault,
-          4,  // capacity
-          &kCFTypeDictionaryKeyCallBacks,
-          &kCFTypeDictionaryValueCallBacks));
-
-#define CFINT(i) CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &i)
-  // TODO(sandersd): RGBA option for 4:4:4 video.
-  int32_t pixel_format = kCVPixelFormatType_422YpCbCr8;
-  base::ScopedCFTypeRef<CFNumberRef> cf_pixel_format(CFINT(pixel_format));
-  base::ScopedCFTypeRef<CFNumberRef> cf_width(CFINT(coded_dimensions.width));
-  base::ScopedCFTypeRef<CFNumberRef> cf_height(CFINT(coded_dimensions.height));
-#undef CFINT
-  CFDictionarySetValue(
-      image_config, kCVPixelBufferPixelFormatTypeKey, cf_pixel_format);
-  CFDictionarySetValue(image_config, kCVPixelBufferWidthKey, cf_width);
-  CFDictionarySetValue(image_config, kCVPixelBufferHeightKey, cf_height);
-  CFDictionarySetValue(
-      image_config, kCVPixelBufferOpenGLCompatibilityKey, kCFBooleanTrue);
+      BuildImageConfig(coded_dimensions));
 
   // TODO(sandersd): Does the old session need to be flushed first?
   session_.reset();
   status = VTDecompressionSessionCreate(
       kCFAllocatorDefault,
       format_,              // video_format_description
       decoder_config,       // video_decoder_specification
       image_config,         // destination_image_buffer_attributes
       &callback_,           // output_callback
       session_.InitializeInto());
@@ skipping 443 matching lines @@
   assigned_bitstream_ids_.clear();
   state_ = STATE_DESTROYING;
   QueueFlush(TASK_DESTROY);
 }
 
 bool VTVideoDecodeAccelerator::CanDecodeOnIOThread() {
   return false;
 }
 
 }  // namespace content