Actions
OMAP4DucatiCamera » History » Revision 28
« Previous |
Revision 28/41
(diff)
| Next »
Denis 'GNUtoo' Carikli, 12/16/2012 09:55 PM
Omap4-tiler-Camera¶
The galaxy Nexus chip has a camera that accesible trough the ducati microcontroller.
Plan:¶
We don't support YV12 in the gralloc and in the software libgl yet.
There are several approachs to solve the issue:
Approach 1: Add support for it¶
Long and complicated
Approach 2: Change format:¶
The Camera supports the following formats:
compile,push, and run the omap4 camera_test program with the "F" argument:
Here for the back camera:
Choice: E
E
E
Supported Cameras: (null)
Supported Picture Sizes: 2592x1944,2592x1728,2592x1458,2048x1536,1600x1200,1280x1024,1152x864,1280x960,640x480,320x240
Supported Picture Formats: yuv420sp,yuv420p,yuv422i-yuyv,rgb565,raw,jpeg
Supported Preview Sizes: 1920x1080,1280x720,960x720,800x480,720x576,720x480,768x576,640x480,320x240,352x288,240x160,176x144,128x96
Supported Preview Formats: yuv420sp,yuv420p,yuv422i-yuyv,yuv420p
Supported Preview Frame Rates: 30,15
Supported Thumbnail Sizes: 640x480,160x120,200x120,320x240,512x384,352x144,176x144,96x96,0x0
Supported Whitebalance Modes: auto,daylight,cloudy-daylight,fluorescent,incandescent,
Supported Effects: none,negative,solarize,sepia,mono,whiteboard,blackboard,aqua,posterize
Supported Scene Modes: auto,action,night,party,sunset
Supported Focus Modes: continuous-video,auto,macro,infinity,infinity,continuous-picture
Supported Antibanding Options: auto,50hz,60hz,off
Supported Flash Modes: off,on,auto,torch
Supported Focus Areas: 10
Focus Distances: Infinity,Infinity,Infinity
Approach 3: Workarround¶
diff --git a/libs/ui/GraphicBufferAllocator.cpp b/libs/ui/GraphicBufferAllocator.cpp
index f7c4f4e..766a98f 100644
--- a/libs/ui/GraphicBufferAllocator.cpp
+++ b/libs/ui/GraphicBufferAllocator.cpp
@@ -99,8 +99,8 @@ status_t GraphicBufferAllocator::alloc(uint32_t w, uint32_t h, PixelFormat forma
// we have a h/w allocator and h/w buffer is requested
status_t err;
-#ifdef MISSING_EGL_PIXEL_FORMAT_YV12
- if (format == HAL_PIXEL_FORMAT_YV12) {
+#if 1
+ if (format == HAL_PIXEL_FORMAT_YV12 || format == 0x100 ) {
format = HAL_PIXEL_FORMAT_RGBX_8888;
}
if (usage & GRALLOC_USAGE_EXTERNAL_DISP) {
diff --git a/media/libstagefright/colorconversion/SoftwareRenderer.cpp b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
index 2ce8fa7..abe68dd 100644
--- a/media/libstagefright/colorconversion/SoftwareRenderer.cpp
+++ b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
@@ -62,7 +62,7 @@ SoftwareRenderer::SoftwareRenderer(
size_t bufWidth, bufHeight;
switch (mColorFormat) {
-#ifndef MISSING_EGL_PIXEL_FORMAT_YV12
+#if 0
case OMX_COLOR_FormatYUV420Planar:
case OMX_TI_COLOR_FormatYUV420PackedSemiPlanar:
{
Research¶
Using the camera application produces the following traces:
[...] V/camera ( 7834): Preview size is 960x720 V/MediaProfilesJNI( 7834): native_get_num_image_encoding_quality_levels V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level D/CameraSettings( 7834): Parameters: [antibanding-values=auto,50hz,60hz,off, antibanding=auto, auto-convergence-mode=, auto-convergence=, auto-exposure-lock-supported=true, auto-exposure-lock=false, auto-whitebalance-lock-supported=true, auto-whitebalance-lock=false, brightness=50, camera-mode=0, camera-name=S5K4E1GA, contrast=100, current-iso=100, effect-values=none,negative,solarize,sepia,mono,whiteboard,blackboard,aqua,posterize, effect=none, exif-make=Samsung, exif-model=Galaxy Nexus, exposure-compensation-step=0.1, exposure-compensation=0, exposure-mode-values=auto,night,backlighting,spotlight,sports,snow,beach,aperture,small-aperture,, exposure=auto, flash-mode-values=off,on,auto,torch, flash-mode=auto, focal-length=3.43, focus-distances=Infinity,Infinity,Infinity, focus-mode-values=continuous-video,auto,macro,infinity,infinity,continuous-picture, focus-mode=continuous-picture, gbce=disable, horizontal-view-angle=54.8, ipp-values=off,ldc,nsf,ldc-nsf, ipp=ldc-nsf, iso-mode-values=auto,100,200,400,800, iso=auto, jpeg-quality=95, jpeg-thumbnail-height=120, jpeg-thumbnail-quality=60, jpeg-thumbnail-size-values=640x480,160x120,200x120,320x240,512x384,352x144,176x144,96x96,0x0, jpeg-thumbnail-width=160, manual-convergence-values=, max-exposure-compensation=30, max-framerate=30, max-num-detected-faces-hw=35, max-num-detected-faces-sw=0, max-num-focus-areas=10, max-num-metering-areas=10, max-zoom=60, min-exposure-compensation=-30, min-framerate=15, picture-format-values=yuv420sp,yuv420p,yuv422i-yuyv,rgb565,raw,jpeg, picture-format=jpeg, picture-size-values=2592x1944,2592x1728,2592x1458,2048x1536,1600x1200,1280x1024,1152x864,1280x960,640x480,320x240, picture-size=2592x1944, preview-format-values=yuv420sp,yuv420p,yuv422i-yuyv,yuv420p, preview-format=yuv420sp, preview-fps-range-values=(15000,15000),(15000,30000),(24000,30000), preview-fps-range=15000,30000, preview-frame-rate-values=30,15, preview-frame-rate=30, preview-size-values=1920x1080,1280x720,960x720,800x480,720x576,720x480,768x576,640x480,320x240,352x288,240x160,176x144,128x96, preview-size=960x720, recording-hint=false, s3d-supported=, s3d2d-preview-values=, s3d2d-preview=, saturation=100, scene-mode-values=auto,action,night,party,sunset, scene-mode=auto, sensor-orientation-values=, sensor-orientation=, sharpness=100, smooth-zoom-supported=true, vertical-view-angle=42.5, video-frame-format=OMX_TI_COLOR_FormatYUV420PackedSemiPlanar, video-snapshot-supported=true, video-stabilization-supported=true, video-stabilization=false, whitebalance-values=auto,daylight,cloudy-daylight,fluorescent,incandescent,, whitebalance=auto, zoom-ratios=100,104,107,111,115,119,123,127,132,137,141,146,152,157,162,168,174,180,187,193,200,207,214,222,230,238,246,255,264,273,283,293,303,314,325,336,348,361,373,386,400,414,429,444,459,476,492,510,528,546,566,586,606,628,650,673,696,721,746,773,800, zoom-supported=true, zoom=0] V/camera ( 7834): startPreview I/CameraHAL( 7751): NULL ANativeWindow passed to setPreviewWindow D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706507, pParamStruct = 0x41b5ebd4 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706506, pParamStruct = 0x41b5ebd0 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706548, pParamStruct = 0x41b5ebc8 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706469, pParamStruct = 0x41b5ebd4 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 2130706509, pConfigStruct = 0x41b5ebbc D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706515, pParamStruct = 0x41b5ebd0 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706514, pParamStruct = 0x41b5ebcc D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440522, pConfigStruct = 0x41b5ebbc D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440522, pConfigStruct = 0x41b5ebbc D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706522, pParamStruct = 0x41b5eb14 I/Process ( 189): Sending signal. PID: 7834 SIG: 3 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 I/dalvikvm( 7834): threadid=3: reacting to signal 3 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706522, pParamStruct = 0x41b5eb14 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706519, pParamStruct = 0x41b5ebfc D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x7f000057 I/CameraHAL( 7751): Preview not started. Preview in progress flag set D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 2, nParam = 2, pCmdData = 0x0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): ENTER: D/DOMX ( 7751): TRACE: D/DOMX ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__** D/DOMX ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x2,nData2: 0x2,pEventData: 0x0 D/DOMX ( 7751): TRACE: Just Before Entering Proxy Event handler call D/DOMX ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x2, nData2=0x2, pEventData=0x0 D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 0, nParam = 2, pCmdData = 0x0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): ENTER: D/DOMX ( 7751): TRACE: D/DOMX ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__** D/DOMX ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x0,nData2: 0x2,pEventData: 0x0 D/DOMX ( 7751): TRACE: Just Before Entering Proxy Event handler call D/DOMX ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x0, nData2=0x2, pEventData=0x0 D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 0, nParam = 3, pCmdData = 0x0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): ENTER: D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: D/DOMX ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__** D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x0,nData2: 0x3,pEventData: 0x0 D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): TRACE: Just Before Entering Proxy Event handler call D/DOMX ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x0, nData2=0x3, pEventData=0x0 D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Waiting for messages from remote core V/camera ( 7834): surfaceChanged. w=720. h=960 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 2130706541, pConfigStruct = 0x413a1b58 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 3, nParam = 2, pCmdData = 0x0 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706545, pParamStruct = 0x413a1ba0 D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nPortIndex = 0x2, pAppPrivate = 0x0, nSizeBytes = 1142784, pBuffer = 0x154a580 D/DOMX ( 7751): TRACE: In UB, no. of buffers = 0 D/DOMX ( 7751): TRACE: Preparing buffer to Remote Core... D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): ERROR: [DBG] eError = 0, line 1037 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: PROXY_UTIL Get Parameter Successful D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: PROXY_UTIL Get Parameter Successful D/DOMX ( 7751): TRACE: Port Number: 2 :: NumOfLines 720 D/DOMX ( 7751): EXIT: eError: 0 D/DOMX ( 7751): ERROR: [DBG] eError = 0, line 1047 D/DOMX ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706550, pParamStruct = 0x413a1b34 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419 D/DOMX ( 7751): TRACE: Recd. omx message D/DOMX ( 7751): TRACE: Waiting for messages from remote core D/DOMX ( 7751): EXIT: D/DOMX ( 7751): TRACE: Corresponding RPC function executed successfully D/DOMX ( 7751): EXIT: eError: 0 index: 0x7f000076 D/DOMX ( 7751): ERROR: [DBG] eError = 0, line 1116 D/DOMX ( 7751): TRACE: Metadata size = 12332 D/DOMX ( 7751): TRACE: ion_fd=70 D/DOMX ( 7751): TRACE: ION being USED for allocation!!!!! handle = c3e30380, ret =0 D/DOMX ( 7751): ERROR: [DBG] eError = 0, line 1130 D/DOMX ( 7751): TRACE: Metadata buffer ion handle = c3e30380 D/DOMX ( 7751): ENTER: D/DOMX ( 7751): TRACE: Marshaling data D/DOMX ( 7751): TRACE: eMapInfo = 3 D/DOMX ( 7751): TRACE: UV buffer fd= 3141592 D/DOMX ( 7751): TRACE: Metadata buffer = c3e30380 D/DOMX ( 7751): TRACE: About to send packet D/DOMX ( 7751): TRACE: RPC_sendPacket_sync hCtx->fd_omx=26|nPacketSize=240 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_UseBuffer:1080 D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync write errno error 22 D/DOMX ( 7751): ERROR: DOMX Write failed 0xffffffff -1 D/DOMX ( 7751): ERROR: failed check:status >= 0 - returning error: 0x81001 - Write failed D/DOMX ( 7751): EXIT: D/DOMX ( 7751): ERROR: RPC function returned error 0x81001 D/DOMX ( 7751): TRACE: Use Buffer Successful D/DOMX ( 7751): TRACE: Value of pBufHeaderRemote: 0x0 LocalBufferHdr :0x15714e8, LocalBuffer :0x154a580 D/DOMX ( 7751): TRACE: Metadata buffer ion handle given to ion map = c3e30380 D/DOMX ( 7751): TRACE: Updating no. of buffer to 1 D/DOMX ( 7751): ERROR: [DBG] eError = -2147479551, line 1192 D/DOMX ( 7751): EXIT: eError: -2147479551 E/CameraHAL( 7751): OMX_UseBuffer-0x80001001 E/CameraHAL( 7751): Exiting function UseBuffersPreview because of ret 0 eError=80001001 D/DOMX ( 7751): ENTER: hComponent = 0x154e570 E/ion ( 7751): ioctl -1073460991 failed with code -1: Bad file number F/libc ( 7751): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree F/libc ( 7751): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1) I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' I/DEBUG ( 127): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** I/DEBUG ( 127): Build fingerprint: 'google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys' I/DEBUG ( 127): pid: 7751, tid: 7758 >>> /system/bin/mediaserver <<< I/DEBUG ( 127): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad I/DEBUG ( 127): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000 I/DEBUG ( 127): r4 00000000 r5 00000027 r6 401342f4 r7 401424d4 I/DEBUG ( 127): r8 01571540 r9 40fe1000 10 0155f9a0 fp 01570e5c I/DEBUG ( 127): ip ffffffff sp 413a19c0 lr 40115441 pc 40111788 cpsr 600f0030 I/DEBUG ( 127): d0 656c696620646120 d1 373565343531786e I/DEBUG ( 127): d2 6c202c3135353975 d3 3239313120656e6d I/DEBUG ( 127): d4 7264487265666675 d5 3137353178303a20 I/DEBUG ( 127): d6 636f4c202c386534 d7 7265666675426c61 I/DEBUG ( 127): d8 0000000000000000 d9 0000000000000000 I/DEBUG ( 127): d10 0000000000000000 d11 0000000000000000 I/DEBUG ( 127): d12 0000000000000000 d13 0000000000000000 I/DEBUG ( 127): d14 0000000000000000 d15 0000000000000000 I/DEBUG ( 127): d16 3f7316d1d399f1e0 d17 3ffd42315763b9eb I/DEBUG ( 127): d18 4000000000000000 d19 3fc5ee7544e230aa I/DEBUG ( 127): d20 3f1152f62f5a4167 d21 bebbb7b7df4a3093 I/DEBUG ( 127): d22 3ff0000000000000 d23 3ff316d1d399f1e0 I/DEBUG ( 127): d24 3e66376972bea4d0 d25 3fee147ae0000000 I/DEBUG ( 127): d26 0000000000000000 d27 0000000000000000 I/DEBUG ( 127): d28 0000000000000000 d29 0000000000000000 I/DEBUG ( 127): d30 0000000000000000 d31 0000000000000000 I/DEBUG ( 127): scr 68000010 I/DEBUG ( 127): I/DEBUG ( 127): #00 pc 00017788 /system/lib/libc.so I/DEBUG ( 127): #01 pc 00013732 /system/lib/libc.so I/DEBUG ( 127): #02 pc 00015a70 /system/lib/libc.so (dlfree) I/DEBUG ( 127): #03 pc 00016100 /system/lib/libc.so (free) I/DEBUG ( 127): #04 pc 000019e6 /system/lib/libmm_osal.so (TIMM_OSAL_Free) I/DEBUG ( 127): #05 pc 00006446 /system/lib/libdomx.so (PROXY_ComponentDeInit) I/DEBUG ( 127): #06 pc 000018ec /system/lib/libOMX.TI.DUCATI1.VIDEO.CAMERA.so I/DEBUG ( 127): #07 pc 00001df6 /system/lib/libOMX_Core.so (OMX_FreeHandle) I/DEBUG ( 127): #08 pc 000284fc /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter24performCleanupAfterErrorEv) I/DEBUG ( 127): #09 pc 0002b04e /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter17UseBuffersPreviewEPvi) I/DEBUG ( 127): #10 pc 0002b182 /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter10useBuffersENS_13CameraAdapter10CameraModeEPvijj) I/DEBUG ( 127): #11 pc 00024c4c /system/lib/hw/camera.omap4.so (_ZN7android17BaseCameraAdapter11sendCommandENS_13CameraAdapter14CameraCommandsEiii) I/DEBUG ( 127): #12 pc 0001d3d0 /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal12startPreviewEv) I/DEBUG ( 127): #13 pc 0001d6de /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal16setPreviewWindowEP18preview_stream_ops) I/DEBUG ( 127): #14 pc 0001ae80 /system/lib/hw/camera.omap4.so (_Z25camera_set_preview_windowP13camera_deviceP18preview_stream_ops) I/DEBUG ( 127): #15 pc 000076cc /system/lib/libcameraservice.so I/DEBUG ( 127): #16 pc 000091b4 /system/lib/libcameraservice.so (_ZN7android13CameraService6Client16setPreviewWindowERKNS_2spINS_7IBinderEEERKNS2_I13ANativeWindowEE) I/DEBUG ( 127): #17 pc 000092ea /system/lib/libcameraservice.so (_ZN7android13CameraService6Client17setPreviewDisplayERKNS_2spINS_7SurfaceEEE) I/DEBUG ( 127): #18 pc 00013592 /system/lib/libcamera_client.so (_ZN7android8BnCamera10onTransactEjRKNS_6ParcelEPS1_j) I/DEBUG ( 127): #19 pc 00017f44 /system/lib/libbinder.so (_ZN7android7BBinder8transactEjRKNS_6ParcelEPS1_j) I/DEBUG ( 127): #20 pc 0001b26e /system/lib/libbinder.so (_ZN7android14IPCThreadState14executeCommandEi) I/DEBUG ( 127): #21 pc 0001b44a /system/lib/libbinder.so (_ZN7android14IPCThreadState14joinThreadPoolEb) I/DEBUG ( 127): #22 pc 00020744 /system/lib/libbinder.so I/DEBUG ( 127): #23 pc 00022a1e /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv) I/DEBUG ( 127): #24 pc 00023064 /system/lib/libutils.so I/DEBUG ( 127): #25 pc 00012e2c /system/lib/libc.so (__thread_entry) I/DEBUG ( 127): #26 pc 0001295c /system/lib/libc.so (pthread_create) I/DEBUG ( 127): I/DEBUG ( 127): code around pc: I/DEBUG ( 127): 40111768 4623b15c 2c006824 e026d1fb b12368db \.#F$h.,..&..h#. I/DEBUG ( 127): 40111778 21014a17 6011447a 48124798 24002527 .J.!zD.`.G.H'%.$ I/DEBUG ( 127): 40111788 f7f47005 2106ef8c e838f7f6 460aa901 .p.....!..8....F I/DEBUG ( 127): 40111798 f04f2006 94015380 94029303 ebe4f7f5 . O..S.......... I/DEBUG ( 127): 401117a8 4622a905 f7f52002 f7f4ebee 2106ef78 .."F. ......x..! I/DEBUG ( 127): I/DEBUG ( 127): code around lr: I/DEBUG ( 127): 40115420 41f0e92d 46804c0c 447c2600 68a56824 -..A.L.F.&|D$h.h I/DEBUG ( 127): 40115430 e0076867 300cf9b5 dd022b00 47c04628 gh.....0.+..(F.G I/DEBUG ( 127): 40115440 35544306 37fff117 6824d5f4 d1ee2c00 .CT5...7..$h.,.. I/DEBUG ( 127): 40115450 e8bd4630 bf0081f0 000280be 41f0e92d 0F..........-..A I/DEBUG ( 127): 40115460 fb01b086 9004f602 461f4815 4615460c .........H.F.F.F I/DEBUG ( 127): I/DEBUG ( 127): memory map around addr deadbaad: I/DEBUG ( 127): bede2000-bee03000 [stack] I/DEBUG ( 127): (no map for address) I/DEBUG ( 127): ffff0000-ffff1000 [vectors] I/DEBUG ( 127): I/DEBUG ( 127): stack: I/DEBUG ( 127): 413a1980 00000001 I/DEBUG ( 127): 413a1984 413a19c0 I/DEBUG ( 127): 413a1988 4013d7e0 /system/lib/libc.so I/DEBUG ( 127): 413a198c 0000000c I/DEBUG ( 127): 413a1990 4013d780 /system/lib/libc.so I/DEBUG ( 127): 413a1994 4013d718 /system/lib/libc.so I/DEBUG ( 127): 413a1998 00000000 I/DEBUG ( 127): 413a199c 40115441 /system/lib/libc.so I/DEBUG ( 127): 413a19a0 00000000 I/DEBUG ( 127): 413a19a4 413a19d4 I/DEBUG ( 127): 413a19a8 401342f4 /system/lib/libc.so I/DEBUG ( 127): 413a19ac 401424d4 I/DEBUG ( 127): 413a19b0 01571540 [heap] I/DEBUG ( 127): 413a19b4 401145ad /system/lib/libc.so I/DEBUG ( 127): 413a19b8 df0027ad I/DEBUG ( 127): 413a19bc 00000000 I/DEBUG ( 127): #00 413a19c0 413a19bc I/DEBUG ( 127): 413a19c4 00000001 I/DEBUG ( 127): 413a19c8 401342d8 /system/lib/libc.so I/DEBUG ( 127): 413a19cc 00000005 I/DEBUG ( 127): 413a19d0 413a19ec I/DEBUG ( 127): 413a19d4 fffffbdf I/DEBUG ( 127): 413a19d8 413a19ec I/DEBUG ( 127): 413a19dc 413a19ec I/DEBUG ( 127): 413a19e0 401377f4 /system/lib/libc.so I/DEBUG ( 127): 413a19e4 4010d737 /system/lib/libc.so I/DEBUG ( 127): #01 413a19e8 01571560 [heap] I/DEBUG ( 127): 413a19ec 20404040 I/DEBUG ( 127): 413a19f0 524f4241 I/DEBUG ( 127): 413a19f4 474e4954 I/DEBUG ( 127): 413a19f8 4e49203a I/DEBUG ( 127): 413a19fc 494c4156 I/DEBUG ( 127): 413a1a00 45482044 I/DEBUG ( 127): 413a1a04 41205041 /dev/snd/pcmC0D0p I/DEBUG ( 127): 413a1a08 45524444 I/DEBUG ( 127): 413a1a0c 49205353 I/DEBUG ( 127): 413a1a10 6c64204e I/DEBUG ( 127): 413a1a14 65657266 I/DEBUG ( 127): 413a1a18 00000000 I/DEBUG ( 127): 413a1a1c 17f80cb3 I/DEBUG ( 127): 413a1a20 00000000 I/DEBUG ( 127): 413a1a24 00000060 I/DEBUG ( 127): 413a1a28 40fa4b13 /system/lib/libdomx.so I/DEBUG ( 127): 413a1a2c 40fa7c7d /system/lib/libdomx.so I/DEBUG ( 127): 413a1a30 00000020 I/DEBUG ( 127): 413a1a34 40f95340 /system/lib/libmm_osal.so I/DEBUG ( 127): 413a1a38 ffffffff I/DEBUG ( 127): 413a1a3c 02000001 I/DEBUG ( 127): 413a1a40 000000fb I/DEBUG ( 127): 413a1a44 401424d4 I/DEBUG ( 127): 413a1a48 01571568 [heap] I/DEBUG ( 127): 413a1a4c 00000000 I/DEBUG ( 127): 413a1a50 00000000 I/DEBUG ( 127): 413a1a54 401424d4 I/DEBUG ( 127): 413a1a58 7f000076 I/DEBUG ( 127): 413a1a5c 4010ec25 /system/lib/libc.so I/DEBUG ( 127): 413a1a60 01571560 [heap] I/DEBUG ( 127): 413a1a64 01571658 [heap] I/DEBUG ( 127): 413a1a68 000000fb I/DEBUG ( 127): 413a1a6c 401424d4 I/DEBUG ( 127): 413a1a70 01571568 [heap] I/DEBUG ( 127): 413a1a74 00000000 I/DEBUG ( 127): 413a1a78 8060f290 I/DEBUG ( 127): 413a1a7c 401424d4 I/DEBUG ( 127): 413a1a80 00000002 I/DEBUG ( 127): 413a1a84 4010ec25 /system/lib/libc.so I/DEBUG ( 127): 413a1a88 01571560 [heap] I/DEBUG ( 127): 413a1a8c 01571658 [heap] I/DEBUG ( 127): 413a1a90 00006288 I/DEBUG ( 127): 413a1a94 401424d4 I/DEBUG ( 127): 413a1a98 01571568 [heap] I/DEBUG ( 127): 413a1a9c 0157157c [heap] I/DEBUG ( 127): 413a1aa0 00000002 I/DEBUG ( 127): 413a1aa4 4010fa89 /system/lib/libc.so I/DEBUG ( 127): 413a1aa8 015714e8 [heap] I/DEBUG ( 127): 413a1aac 01571568 [heap] I/DEBUG ( 127): 413a1ab0 80001001 I/DEBUG ( 127): 413a1ab4 00000003 I/DEBUG ( 127): 413a1ab8 00000046 I/DEBUG ( 127): 413a1abc 413a1acc I/DEBUG ( 127): 413a1ac0 015714e0 [heap] I/DEBUG ( 127): 413a1ac4 01571538 [heap] I/DEBUG ( 127): 413a1ac8 00006308 I/DEBUG ( 127): 413a1acc 401424d4 I/DEBUG ( 127): 413a1ad0 015714e8 [heap] I/DEBUG ( 127): 413a1ad4 40fa8ae1 /system/lib/libdomx.so I/DEBUG ( 127): 413a1ad8 40143280 I/DEBUG ( 127): 413a1adc 4011c8ad /system/lib/libc.so I/DEBUG ( 127): 413a1ae0 01556240 [heap] I/DEBUG ( 127): 413a1ae4 01556240 [heap] I/DEBUG ( 127): 413a1ae8 00000000 I/DEBUG ( 127): 413a1aec 17f80cb3 I/DEBUG ( 127): 413a1af0 01571538 [heap] I/DEBUG ( 127): 413a1af4 01556240 [heap] I/DEBUG ( 127): 413a1af8 00000000 I/DEBUG ( 127): 413a1afc 4010fa75 /system/lib/libc.so I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800 I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800 I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800 I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' W/AudioSystem( 189): AudioFlinger server died! W/AudioSystem( 189): AudioPolicyService server died! I/ServiceManager( 122): service 'media.audio_flinger' died I/ServiceManager( 122): service 'media.player' died I/ServiceManager( 122): service 'media.camera' died I/ServiceManager( 122): service 'media.audio_policy' died W/IMediaDeathNotifier( 723): media server died E/MediaPlayer( 723): error (100, 0) W/Camera ( 7834): Camera server died! W/Camera ( 7834): ICamera died E/MediaPlayer( 723): Error (100,0) E/VanillaMusic( 723): MediaPlayer error: 100 0 I/ActivityManager( 189): Displayed com.android.camera/.Camera: +4s446ms D/CameraStorage( 7834): External storage state=mounted I/Thumbnail( 7834): Fail to load bitmap. java.io.FileNotFoundException: /data/data/com.android.camera/files/last_thumb: open failed: ENOENT (No such file or directory) E/Camera ( 7834): Error 100 E/CameraErrorCallback( 7834): Got camera error callback. error=100 D/AndroidRuntime( 7834): Shutting down VM W/dalvikvm( 7834): threadid=1: thread exiting with uncaught exception (group=0x40a411f8) I/ ( 7873): ServiceManager: 0x959958 E/SRS-Client( 7873): OpenClient_RILD D/SRS-Client( 7873): Unsolicited handler isn't implemented yet! I/AudioFlinger( 7873): Loaded primary audio interface from Tuna audio HW HAL (audio) I/AudioFlinger( 7873): Using 'Tuna audio HW HAL' (audio.primary) as the primary audio interface I/AudioFlinger( 7873): Loaded a2dp audio interface from A2DP Audio HW HAL (audio) I/CameraService( 7873): CameraService started (pid=7873) I/AudioFlinger( 7873): AudioFlinger's thread 0x960400 ready to run I/AudioPolicyService( 7873): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy) I/Process ( 189): Sending signal. PID: 7834 SIG: 3 I/dalvikvm( 7834): threadid=3: reacting to signal 3 I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt' E/AudioService( 189): Media server died. E/AudioService( 189): Media server started. W/AudioPolicyManagerBase( 7873): setPhoneState() setting same state 0
The interesting part in all that noise is the following:
D/DOMX ( 7751): ERROR: [DBG] RPC_sendPacket_sync write errno error 22 D/DOMX ( 7751): ERROR: DOMX Write failed 0xffffffff -1
Basically write fails at:
#define RPC_sendPacket_sync(hCtx, pPacket, nPacketSize, nFxnIdx, pRetPacket, nSize) do { \
DOMX_ERROR("[DBG] RPC_sendPacket_sync %s:%d",__func__,__LINE__); \
status = write(hCtx->fd_omx, pPacket, nPacketSize); \
if (status == -1){ \
int errsv = errno; \
DOMX_ERROR("[DBG] RPC_sendPacket_sync write errno error %d",errsv); \
} \
RPC_freePacket(pPacket); \
pPacket = NULL; \
if(status < 0 ) DOMX_ERROR("DOMX Write failed 0x%x %d",status,status); \
RPC_assert(status >= 0, RPC_OMX_ErrorUndefined, "Write failed"); \
eError = TIMM_OSAL_ReadFromPipe(hCtx->pMsgPipe[nFxnIdx], &pRetPacket, \
RPC_MSG_SIZE_FOR_PIPE, (TIMM_OSAL_U32 *)(&nSize), TIMM_OSAL_SUSPEND); \
RPC_assert(eError == TIMM_OSAL_ERR_NONE, eError, \
"Read failed"); \
} while(0)
That means that a normal unix write to /dev/rpmsg-omx1 fails with EINVAL.
Which produces something like that in the kernel when the powervr kernel driver is there but the non-free userland is not.
root@android:/ # dmesg <6>[ 105.768157] max17040 4-0036: online = 1 vcell = 4200000 soc = 100 status = 4 health = 1 temp = 380 charger status = 1 <6>[ 108.557067] request_suspend_state: wakeup (3->0) at 108550701674 (2012-11-02 19:41:27.498122569 UTC) <6>[ 108.558135] DSSCOMP: dsscomp_late_resume <6>[ 109.513000] vibrator: value=20, pwmval=127 <6>[ 109.872772] vibrator: value=20, pwmval=127 <6>[ 110.213806] vibrator: value=20, pwmval=127 <6>[ 110.543334] omap-iommu omap-iommu.0: iommu_get: ducati qos_request <4>[ 110.557281] omap_hwmod: ipu: failed to hardreset <6>[ 110.560150] omap-iommu omap-iommu.0: ducati: version 2.1 <6>[ 110.733123] sr_class1p5_calib_work: core: Calibration complete: Voltage:Nominal=1250000,Calib=1038160,margin=13000 <6>[ 111.117462] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 0) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c] <6>[ 111.117584] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c] <6>[ 111.117706] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c] <6>[ 114.291107] binder: release 138:532 transaction 8079 in, still active <6>[ 114.291168] binder: send failed reply for transaction 8079 to 814:814 <4>[ 116.686065] sr_class1p5_calib_work: iva Stop sampling: Voltage Nominal=950000 samples=18 <6>[ 116.686309] sr_class1p5_calib_work: iva: Calibration complete: Voltage:Nominal=950000,Calib=860920,margin=13000 <3>[ 119.851684] omap-rproc omap-rproc.1: rproc_watchdog_isr <6>[ 119.851959] omap_rproc_dump_registers: REGISTER DUMP FOR REMOTEPROC ipu <6>[ 119.852264] omap_rproc_dump_registers: PC is at 002a5006 <6>[ 119.852416] omap_rproc_dump_registers: LR is at 002a5007 <6>[ 119.852722] omap_rproc_dump_registers: pc : [<002a5006>] lr : [<002a5007>] psr: 61000000 <6>[ 119.852752] sp : 806041e8 ip : 806041a8 fp : 802b839c <6>[ 119.853210] omap_rproc_dump_registers: r10: 802a5f27 r9 : 0000804f r8 : 00000000 <6>[ 119.853515] omap_rproc_dump_registers: r7 : 00000137 r6 : 00000000 r5 : 80604214 r4 : 00254a3c <6>[ 119.853698] omap_rproc_dump_registers: r3 : 00000000 r2 : 9f070000 r1 : 00000010 r0 : 00000000 <6>[ 119.854003] omap_rproc_dump_registers: Flags: nZCv IRQs on FIQs on <6>[ 119.854675] _event_notify: remoteproc: ipu has crashed <3>[ 119.854827] rpmsg_rproc_error: Fatal error in ipu <3>[ 119.855133] rpmsg_rproc_error: Fatal error in ipu <3>[ 119.855316] rpmsg_reset_work: reseting virtio device 0 <6>[ 119.855682] rpmsg_resmgr rpmsg0: Enter rprm_remove <6>[ 119.862121] rpmsg_omx rpmsg-omx0: rpmsg omx driver is removed <3>[ 119.866668] rpmsg_reset_work: reseting virtio device 1 <6>[ 119.866912] rpmsg_resmgr rpmsg2: Enter rprm_remove <6>[ 119.868988] rpmsg_omx rpmsg-omx1: rpmsg omx driver is removed <4>[ 119.870544] rproc_reset_poolmem: invalid pool <6>[ 119.870819] omap-rproc omap-rproc.1: stopped remote processor ipu <6>[ 119.873626] omap-rproc omap-rproc.1: powering up ipu <6>[ 119.873962] virtio_rpmsg_bus virtio2: rpmsg backend virtproc probed successfully <6>[ 119.874877] virtio_rpmsg_bus virtio3: rpmsg backend virtproc probed successfully <6>[ 119.915710] omap-rproc omap-rproc.1: Loaded BIOS image ducati-m3.bin, size 4511300 <6>[ 119.915893] omap-rproc omap-rproc.1: BIOS image version is 2 <6>[ 119.927490] omap-iommu omap-iommu.0: iommu_get: ducati qos_request <4>[ 119.941894] omap_hwmod: ipu: failed to hardreset <6>[ 119.943176] omap-iommu omap-iommu.0: ducati: version 2.1 <6>[ 119.952117] omap-rproc omap-rproc.1: remote processor ipu is now up <6>[ 119.965270] omap_rpmsg_mbox_callback: received echo reply from ipu ! <6>[ 119.965393] omap_rpmsg_mbox_callback: received echo reply from ipu ! <6>[ 119.965545] omap_rpmsg_mbox_callback: received echo reply from ipu ! <6>[ 119.965637] omap_rpmsg_mbox_callback: received echo reply from ipu ! <6>[ 119.965820] virtio_rpmsg_bus virtio2: creating channel rpmsg-client-sample addr 0x32 <6>[ 119.966125] virtio_rpmsg_bus virtio2: creating channel rpmsg-client-sample addr 0x33 <6>[ 119.966400] virtio_rpmsg_bus virtio2: creating channel rpmsg-omx addr 0x3c <6>[ 119.966827] rpmsg_omx rpmsg-omx0: new OMX connection srv channel: 1024 -> 60! <6>[ 121.112823] virtio_rpmsg_bus virtio3: creating channel rpmsg-omx addr 0x3c <6>[ 121.116668] rpmsg_omx rpmsg-omx1: new OMX connection srv channel: 1024 -> 60!
Disabling the pvr driver with:
diff --git a/arch/arm/configs/cyanogenmod_tuna_defconfig b/arch/arm/configs/cyanogenmod_tuna_defconfig index 1a060a2..a9e3990 100644 --- a/arch/arm/configs/cyanogenmod_tuna_defconfig +++ b/arch/arm/configs/cyanogenmod_tuna_defconfig @@ -1,6 +1,6 @@ # # Automatically generated make config: don't edit -# Linux/arm 3.0.34 Kernel Configuration +# Linux/arm 3.0.36 Kernel Configuration # CONFIG_ARM=y CONFIG_HAVE_PWM=y @@ -70,6 +70,7 @@ CONFIG_GENERIC_IRQ_CHIP=y # RCU Subsystem # CONFIG_TREE_PREEMPT_RCU=y +# CONFIG_TINY_RCU is not set CONFIG_PREEMPT_RCU=y # CONFIG_RCU_TRACE is not set CONFIG_RCU_FANOUT=32 @@ -583,6 +584,8 @@ CONFIG_INET_DIAG=y CONFIG_INET_TCP_DIAG=y # CONFIG_TCP_CONG_ADVANCED is not set CONFIG_TCP_CONG_CUBIC=y +# CONFIG_DEFAULT_CUBIC is not set +# CONFIG_DEFAULT_RENO is not set CONFIG_DEFAULT_TCP_CONG="cubic" # CONFIG_TCP_MD5SIG is not set CONFIG_IPV6=y @@ -785,6 +788,9 @@ CONFIG_IP6_NF_RAW=y # CONFIG_BRIDGE_NF_EBTABLES is not set # CONFIG_IP_DCCP is not set # CONFIG_IP_SCTP is not set +# CONFIG_SCTP_HMAC_NONE is not set +# CONFIG_SCTP_HMAC_SHA1 is not set +# CONFIG_SCTP_HMAC_MD5 is not set # CONFIG_RDS is not set # CONFIG_TIPC is not set # CONFIG_ATM is not set @@ -917,6 +923,8 @@ CONFIG_CFG80211_DEFAULT_PS=y # CONFIG_LIB80211 is not set CONFIG_CFG80211_ALLOW_RECONNECT=y # CONFIG_MAC80211 is not set +# CONFIG_MAC80211_RC_DEFAULT_PID is not set +# CONFIG_MAC80211_RC_DEFAULT_MINSTREL is not set # CONFIG_WIMAX is not set CONFIG_RFKILL=y CONFIG_RFKILL_PM=y @@ -1204,6 +1212,9 @@ CONFIG_WLAN=y # CONFIG_USB_NET_RNDIS_WLAN is not set CONFIG_WIFI_CONTROL_FUNC=y # CONFIG_ATH_COMMON is not set +# CONFIG_B43LEGACY_DMA_AND_PIO_MODE is not set +# CONFIG_B43LEGACY_DMA_MODE is not set +# CONFIG_B43LEGACY_PIO_MODE is not set # CONFIG_BCM4329 is not set CONFIG_BCMDHD=y CONFIG_BCMDHD_FW_PATH="/system/vendor/firmware/fw_bcmdhd.bin" @@ -1688,24 +1699,13 @@ CONFIG_TILER_ENABLE_USERSPACE=y # Graphics support # # CONFIG_DRM is not set -CONFIG_PVR_SGX=y -CONFIG_PVR_SGXCORE_540=y -CONFIG_PVR_BUILD_RELEASE=y +# CONFIG_PVR_SGX is not set +# CONFIG_PVR_SGXCORE_540 is not set +# CONFIG_PVR_BUILD_RELEASE is not set # CONFIG_PVR_BUILD_DEBUG is not set -CONFIG_PVR_NEED_PVR_DPF=y -CONFIG_PVR_NEED_PVR_ASSERT=y -CONFIG_PVR_PERCONTEXT_PB=y -CONFIG_PVR_ACTIVE_POWER_MANAGEMENT=y -CONFIG_PVR_ACTIVE_POWER_LATENCY_MS=100 -CONFIG_PVR_SGX_LOW_LATENCY_SCHEDULING=y -CONFIG_PVR_USSE_EDM_STATUS_DEBUG=y -CONFIG_PVR_DUMP_MK_TRACE=y -# CONFIG_PVR_PDUMP is not set -CONFIG_PVR_OMAP_DSS2=y # CONFIG_SGX_DVFS_MODE_NONE is not set # CONFIG_SGX_DVFS_MODE_LINEAR is not set -CONFIG_SGX_DVFS_MODE_OPTIMIZED=y -CONFIG_SGX_DVFS_IDLE_TIMEOUT=1000 +# CONFIG_SGX_DVFS_MODE_OPTIMIZED is not set CONFIG_ION=y CONFIG_ION_OMAP=y # CONFIG_VGASTATE is not set @@ -1734,10 +1734,13 @@ CONFIG_FB_MODE_HELPERS=y # Frame buffer hardware drivers # # CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_CARMINE_DRAM_EVAL is not set +# CONFIG_CARMINE_DRAM_CUSTOM is not set # CONFIG_FB_TMIO is not set # CONFIG_FB_UDL is not set # CONFIG_FB_VIRTUAL is not set # CONFIG_FB_METRONOME is not set +# CONFIG_FB_MB862XX_PCI_GDC is not set # CONFIG_FB_BROADSHEET is not set CONFIG_HDMI_TI_4XXX_IP=y CONFIG_SII9234=y @@ -1765,7 +1768,6 @@ CONFIG_FB_OMAP2_NUM_FBS=3 CONFIG_PANEL_S6E8AA0=y # CONFIG_PANEL_TAAL is not set CONFIG_COLOR_HACK=y -CONFIG_DSSCOMP=y CONFIG_DSSCOMP_DEBUG_LOG=y CONFIG_OMAP4_HDCP=y # CONFIG_OMAP4_HDCP_DEBUG is not set @@ -2094,6 +2096,12 @@ CONFIG_USB_GADGET_SELECTED=y # CONFIG_USB_GADGET_R8A66597 is not set # CONFIG_USB_GADGET_PXA_U2O is not set # CONFIG_USB_GADGET_M66592 is not set +# CONFIG_USB_GADGET_AMD5536UDC is not set +# CONFIG_USB_GADGET_CI13XXX_PCI is not set +# CONFIG_USB_GADGET_NET2280 is not set +# CONFIG_USB_GADGET_GOKU is not set +# CONFIG_USB_GADGET_LANGWELL is not set +# CONFIG_USB_GADGET_EG20T is not set # CONFIG_USB_GADGET_DUMMY_HCD is not set CONFIG_USB_GADGET_DUALSPEED=y # CONFIG_USB_ZERO is not set @@ -2113,6 +2121,9 @@ CONFIG_USB_G_ANDROID=y # CONFIG_USB_G_MULTI is not set # CONFIG_USB_G_HID is not set # CONFIG_USB_G_DBGP is not set +# CONFIG_USB_G_DBGP_PRINTK is not set +# CONFIG_USB_G_DBGP_SERIAL is not set +# CONFIG_USB_G_WEBCAM is not set # # OTG and related infrastructure @@ -2265,9 +2276,15 @@ CONFIG_ANDROID_LOW_MEMORY_KILLER=y # CONFIG_USB_SERIAL_QUATECH_USB2 is not set # CONFIG_VT6656 is not set # CONFIG_IIO is not set +# CONFIG_LIS3L02DQ_BUF_KFIFO is not set +# CONFIG_LIS3L02DQ_BUF_RING_SW is not set +# CONFIG_AD2S1210_GPIO_INPUT is not set +# CONFIG_AD2S1210_GPIO_OUTPUT is not set +# CONFIG_AD2S1210_GPIO_NONE is not set # CONFIG_XVMALLOC is not set # CONFIG_ZRAM is not set # CONFIG_FB_SM7XX is not set +# CONFIG_EASYCAP_SND is not set CONFIG_MACH_NO_WESTBRIDGE=y # CONFIG_ATH6K_LEGACY is not set # CONFIG_USB_ENESTORAGE is not set @@ -2381,6 +2398,10 @@ CONFIG_MISC_FILESYSTEMS=y # CONFIG_EFS_FS is not set # CONFIG_YAFFS_FS is not set # CONFIG_JFFS2_FS is not set +# CONFIG_JFFS2_CMODE_NONE is not set +# CONFIG_JFFS2_CMODE_PRIORITY is not set +# CONFIG_JFFS2_CMODE_SIZE is not set +# CONFIG_JFFS2_CMODE_FAVOURLZO is not set # CONFIG_LOGFS is not set # CONFIG_CRAMFS is not set # CONFIG_SQUASHFS is not set @@ -2390,6 +2411,9 @@ CONFIG_MISC_FILESYSTEMS=y # CONFIG_HPFS_FS is not set # CONFIG_QNX4FS_FS is not set # CONFIG_ROMFS_FS is not set +# CONFIG_ROMFS_BACKED_BY_BLOCK is not set +# CONFIG_ROMFS_BACKED_BY_MTD is not set +# CONFIG_ROMFS_BACKED_BY_BOTH is not set # CONFIG_PSTORE is not set # CONFIG_SYSV_FS is not set # CONFIG_UFS_FS is not set @@ -2595,6 +2619,10 @@ CONFIG_SECURITY_MIDDLEWARE_COMPONENT=y # CONFIG_SMC_KERNEL_CRYPTO is not set CONFIG_SECURE_TRACE=y # CONFIG_TF_DRIVER_DEBUG_SUPPORT is not set +# CONFIG_DEFAULT_SECURITY_SELINUX is not set +# CONFIG_DEFAULT_SECURITY_SMACK is not set +# CONFIG_DEFAULT_SECURITY_TOMOYO is not set +# CONFIG_DEFAULT_SECURITY_APPARMOR is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_DEFAULT_SECURITY="" CONFIG_CRYPTO=y
Didn't fix it.
replicant-4.0/kernel/samsung/tuna/drivers/rpmsg$ grep rpmsg-omx -r *
rpmsg_omx.c: "rpmsg-omx");
rpmsg_omx.c: "rpmsg-omx%d", minor);
rpmsg_omx.c: { .name = "rpmsg-omx" },
replicant-4.0/kernel/samsung/tuna/drivers/rpmsg$ grep pvr -r *
rpmsg_omx.c:#include "../gpu/pvr/ion.h"
rpmsg_omx.c: struct ion_client *pvr_ion_client;
rpmsg_omx.c: handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
rpmsg_omx.c: !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
TODO¶
- investigate why the kernel fails without the PVR here:
static u32 _rpmsg_omx_buffer_lookup(struct rpmsg_omx_instance *omx, long buffer) { phys_addr_t pa; u32 va; #ifdef CONFIG_ION_OMAP struct ion_handle *handle; ion_phys_addr_t paddr; size_t unused; int fd; /* is it an ion handle? */ handle = (struct ion_handle *)buffer; if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) { pa = (phys_addr_t) paddr; goto to_va; } #ifdef CONFIG_PVR_SGX /* how about an sgx buffer wrapping an ion handle? */ { struct ion_client *pvr_ion_client; fd = buffer; handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client); if (handle && !ion_phys(pvr_ion_client, handle, &paddr, &unused)) { pa = (phys_addr_t)paddr; goto to_va; } } #endif #endif pa = (phys_addr_t) tiler_virt2phys(buffer); #ifdef CONFIG_ION_OMAP to_va: #endif va = _rpmsg_pa_to_da(pa); return va; }
That has to be corelated with:<6>[ 111.117462] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 0) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c] <6>[ 111.117584] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c] <6>[ 111.117706] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]
Newer infos from the kernel¶
static ssize_t rpmsg_omx_write(struct file *filp, const char __user *ubuf,
size_t len, loff_t *offp)
{
struct rpmsg_omx_instance *omx = filp->private_data;
struct rpmsg_omx_service *omxserv = omx->omxserv;
char kbuf[512];
struct omx_msg_hdr *hdr = (struct omx_msg_hdr *) kbuf;
int use, ret;
if (omx->state != OMX_CONNECTED)
return -ENOTCONN;
/*
* for now, limit msg size to 512 bytes (incl. header).
* (note: rpmsg's limit is even tighter. this whole thing needs fixing)
*/
use = min(sizeof(kbuf) - sizeof(*hdr), len);
/*
* copy the data. Later, number of copies can be optimized if found to
* be significant in real use cases
*/
if (copy_from_user(hdr->data, ubuf, use))
return -EMSGSIZE;
ret = _rpmsg_omx_map_buf(omx, hdr->data);
if (ret < 0)
return ret;
hdr->type = OMX_RAW_MSG;
hdr->flags = 0;
hdr->len = use;
use += sizeof(*hdr);
ret = rpmsg_send_offchannel(omxserv->rpdev, omx->ept->addr,
omx->dst, kbuf, use);
if (ret) {
dev_err(omxserv->dev, "rpmsg_send failed: %d\n", ret);
return ret;
}
return use;
}
So it copies the userspace data to hdr->data and passes it to _rpmsg_omx_map_buf
ret = _rpmsg_omx_map_buf(omx, hdr->data);
Then _rpmsg_omx_map_buf is like that:
static int _rpmsg_omx_map_buf(struct rpmsg_omx_instance *omx, char *packet)
{
int ret = -EINVAL, offset = 0;
long *buffer;
char *data;
enum rpc_omx_map_info_type maptype;
u32 da = 0;
data = (char *)((struct omx_packet *)packet)->data;
maptype = *((enum rpc_omx_map_info_type *)data);
/*Nothing to map*/
if (maptype == RPC_OMX_MAP_INFO_NONE)
return 0;
if ((maptype != RPC_OMX_MAP_INFO_THREE_BUF) &&
(maptype != RPC_OMX_MAP_INFO_TWO_BUF) &&
(maptype != RPC_OMX_MAP_INFO_ONE_BUF))
return ret;
offset = *(int *)((int)data + sizeof(maptype));
buffer = (long *)((int)data + offset);
da = _rpmsg_omx_buffer_lookup(omx, *buffer);
printk("[DBG] [%s] da = %x \n",__func__,da);
if (da) {
printk("[DBG] [%s] inside da\n",__func__);
*buffer = da;
ret = 0;
}else {
printk("[DBG] [%s] outside da\n",__func__);
}
if (!ret && (maptype >= RPC_OMX_MAP_INFO_TWO_BUF)) {
buffer = (long *)((int)data + offset + sizeof(*buffer));
if (*buffer != 0) {
ret = -EIO;
da = _rpmsg_omx_buffer_lookup(omx, *buffer);
if (da) {
*buffer = da;
ret = 0;
}
}
}
if (!ret && maptype >= RPC_OMX_MAP_INFO_THREE_BUF) {
buffer = (long *)((int)data + offset + 2*sizeof(*buffer));
if (*buffer != 0) {
ret = -EIO;
da = _rpmsg_omx_buffer_lookup(omx, *buffer);
if (da) {
*buffer = da;
ret = 0;
}
}
}
return ret;
}
It calls
da = _rpmsg_omx_buffer_lookup(omx, *buffer);which is like that:
static u32 _rpmsg_omx_buffer_lookup(struct rpmsg_omx_instance *omx, long buffer)
{
phys_addr_t pa;
u32 va;
#ifdef CONFIG_ION_OMAP
struct ion_handle *handle;
ion_phys_addr_t paddr;
size_t unused;
int fd;
/* is it an ion handle? */
handle = (struct ion_handle *)buffer;
printk("[DBG] handle:%x\n",handle);
if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {
printk("[DBG] is ion_phys\n");
pa = (phys_addr_t) paddr;
goto to_va;
}
#if 0
#ifdef CONFIG_PVR_SGX
printk("[DBG] INSIDE CONFIG_PVR_SGX\n");
/* how about an sgx buffer wrapping an ion handle? */
{
struct ion_client *pvr_ion_client;
fd = buffer;
handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
printk("[DBG] [INSIDE CONFIG_PVR_SGX] handle:%x\n",handle);
if (handle &&
!ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
printk("[DBG] [INSIDE CONFIG_PVR_SGX] goto to_va\n");
pa = (phys_addr_t)paddr;
goto to_va;
}
}
#endif
#endif
#endif
printk("[DBG] [after CONFIG_PVR_SGX]\n");
pa = (phys_addr_t) tiler_virt2phys(buffer);
printk("[DBG] [after CONFIG_PVR_SGX] pa = %x \n");
#ifdef CONFIG_ION_OMAP
to_va:
#endif
printk("[DBG] [to_va] \n");
va = _rpmsg_pa_to_da(pa);
printk("[DBG] [to_va] = %x \n",va);
return va;
}
which calls
/*
* TODO: Need to do this using lookup with rproc, but rproc is not
* visible to rpmsg_omx
*/
#define TILER_START 0x60000000
#define TILER_END 0x80000000
#define ION_1D_START 0xBA300000
#define ION_1D_END 0xBFD00000
#define ION_1D_VA 0x88000000
static u32 _rpmsg_pa_to_da(u32 pa)
{
if (pa >= TILER_START && pa < TILER_END){
printk("[DBG] TILER\n");
return pa;
}
else if (pa >= ION_1D_START && pa < ION_1D_END){
printk("[DBG] ION\n");
return (pa - ION_1D_START + ION_1D_VA);
}
else{
printk("[DBG] ELSE(not tiler and not ion)\n");
}
return 0;
}
which prints ION for the 2 good buffers and print ELSE for the bad buffer(the one which produces the EINVAL in write)...
then _rpmsg_omx_buffer_lookup returns 0 which results in:
static int _rpmsg_omx_map_buf(struct rpmsg_omx_instance *omx, char *packet)
{
int ret = -EINVAL, offset = 0;
[...]
da = _rpmsg_omx_buffer_lookup(omx, *buffer);
printk("[DBG] [%s] da = %x \n",__func__,da);
if (da) {
->not reached
printk("[DBG] [%s] inside da\n",__func__);
*buffer = da;
ret = 0;
}else {
->reached
printk("[DBG] [%s] outside da\n",__func__);
}
if (!ret && (maptype >= RPC_OMX_MAP_INFO_TWO_BUF)) {
[...] (not reached)
}
if (!ret && maptype >= RPC_OMX_MAP_INFO_THREE_BUF) {
[...] (not reached)
}
return ret;
}
Runtime tests.¶
Running replicant kernel with:
#if 0
#ifdef CONFIG_PVR_SGX
printk("[DBG] INSIDE CONFIG_PVR_SGX\n");
/* how about an sgx buffer wrapping an ion handle? */
{
struct ion_client *pvr_ion_client;
fd = buffer;
handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
printk("[DBG] [INSIDE CONFIG_PVR_SGX] handle:%x\n",handle);
if (handle &&
!ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
printk("[DBG] [INSIDE CONFIG_PVR_SGX] goto to_va\n");
pa = (phys_addr_t)paddr;
goto to_va;
}
}
#endif
#endif
with cyanogenmod userspace produces the same issue:
D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nConfigIndex = 117440523, pConfigStruct = 0x41365b50 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8 D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 index: 0x2000001 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nConfigIndex = 2130706541, pConfigStruct = 0x41365b58 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, eCmd = 3, nParam = 2, pCmdData = 0x0 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 2130706545, pParamStruct = 0x41365ba0 D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nPortIndex = 0x2, pAppPrivate = 0x0, nSizeBytes = 1142784, pBuffer = 0x1046f40 D/DOMX ( 135): TRACE: In UB, no. of buffers = 0 D/DOMX ( 135): TRACE: Preparing buffer to Remote Core... D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): ENTER: D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: PROXY_UTIL Get Parameter Successful D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: PROXY_UTIL Get Parameter Successful D/DOMX ( 135): TRACE: Port Number: 2 :: NumOfLines 720 D/DOMX ( 135): EXIT: eError: 0 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 2130706550, pParamStruct = 0x41365b34 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Recd. omx message D/DOMX ( 135): TRACE: Waiting for messages from remote core D/DOMX ( 135): EXIT: D/DOMX ( 135): TRACE: Corresponding RPC function executed successfully D/DOMX ( 135): EXIT: eError: 0 index: 0x7f000076 D/DOMX ( 135): TRACE: Metadata size = 12332 D/DOMX ( 135): TRACE: ION being USED for allocation!!!!! handle = c63ccd80, ret =0 D/DOMX ( 135): TRACE: Metadata buffer ion handle = -969093760 D/DOMX ( 135): ENTER: D/DOMX ( 135): TRACE: Marshaling data D/DOMX ( 135): TRACE: eMapInfo = 3 D/DOMX ( 135): TRACE: UV buffer fd= 109 D/DOMX ( 135): TRACE: Metadata buffer = -969093760 D/DOMX ( 135): TRACE: About to send packet D/DOMX ( 135): ERROR: DOMX Write failed 0xffffffff -1 D/DOMX ( 135): ERROR: failed check:status >= 0 - returning error: 0x81001 - Write failed D/DOMX ( 135): EXIT: D/DOMX ( 135): ERROR: RPC function returned error 0x81001 D/DOMX ( 135): TRACE: Use Buffer Successful D/DOMX ( 135): TRACE: Value of pBufHeaderRemote: 0x0 LocalBufferHdr :0x104f118, LocalBuffer :0x1046f40 D/DOMX ( 135): TRACE: Metadata buffer ion handle given to ion map = -969093760 D/DOMX ( 135): TRACE: Updating no. of buffer to 1 D/DOMX ( 135): EXIT: eError: -2147479551 E/CameraHAL( 135): OMX_UseBuffer-0x80001001 E/CameraHAL( 135): Exiting function UseBuffersPreview because of ret 0 eError=80001001 D/DOMX ( 135): ENTER: hComponent = 0x103f7e0 E/ion ( 135): ioctl -1073460991 failed with code -1: Bad file number F/libc ( 135): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree F/libc ( 135): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1) I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' I/DEBUG ( 130): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** I/DEBUG ( 130): Build fingerprint: 'google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys' I/DEBUG ( 130): pid: 135, tid: 187 >>> /system/bin/mediaserver <<< I/DEBUG ( 130): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad I/DEBUG ( 130): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000 I/DEBUG ( 130): r4 00000000 r5 00000027 r6 401022f4 r7 401104d4 I/DEBUG ( 130): r8 0104f170 r9 40110600 10 01040eb0 fp 010387fc I/DEBUG ( 130): ip ffffffff sp 413659c0 lr 400e3441 pc 400df788 cpsr 60000030 I/DEBUG ( 130): d0 656c696620646120 d1 653766333031786e I/DEBUG ( 130): d2 68206e6f69207275 d3 696720656c646e6d I/DEBUG ( 130): d4 426c61636f4c2030 d5 7264487265666675 I/DEBUG ( 130): d6 6634303178303a20 d7 636f4c202c383131 I/DEBUG ( 130): d8 0000000000000000 d9 0000000000000000 I/DEBUG ( 130): d10 0000000000000000 d11 0000000000000000 I/DEBUG ( 130): d12 0000000000000000 d13 0000000000000000 I/DEBUG ( 130): d14 0000000000000000 d15 0000000000000000 I/DEBUG ( 130): d16 3ff0000000000000 d17 3ff0000000000000 I/DEBUG ( 130): d18 7e37e43c8800759c d19 bfba43196d2f888d I/DEBUG ( 130): d20 3f115549a0c32687 d21 bebbbb72a4af9d58 I/DEBUG ( 130): d22 3ff0000000000000 d23 3fecedd52e2a681e I/DEBUG ( 130): d24 3e66376972bea4d0 d25 3fee147ae0000000 I/DEBUG ( 130): d26 0000000000000000 d27 0000000000000000 I/DEBUG ( 130): d28 0000000000000000 d29 0000000000000000 I/DEBUG ( 130): d30 0000000000000000 d31 0000000000000000 I/DEBUG ( 130): scr 68000010 I/DEBUG ( 130): I/DEBUG ( 130): #00 pc 00017788 /system/lib/libc.so I/DEBUG ( 130): #01 pc 00013732 /system/lib/libc.so I/DEBUG ( 130): #02 pc 00015a70 /system/lib/libc.so (dlfree) I/DEBUG ( 130): #03 pc 00016100 /system/lib/libc.so (free) I/DEBUG ( 130): #04 pc 000019e6 /system/lib/libmm_osal.so (TIMM_OSAL_Free) I/DEBUG ( 130): #05 pc 00005dda /system/lib/libdomx.so (PROXY_ComponentDeInit) I/DEBUG ( 130): #06 pc 000018ec /system/lib/libOMX.TI.DUCATI1.VIDEO.CAMERA.so I/DEBUG ( 130): #07 pc 00001df6 /system/lib/libOMX_Core.so (OMX_FreeHandle) I/DEBUG ( 130): #08 pc 000284fc /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter24performCleanupAfterErrorEv) I/DEBUG ( 130): #09 pc 0002b04e /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter17UseBuffersPreviewEPvi) I/DEBUG ( 130): #10 pc 0002b182 /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter10useBuffersENS_13CameraAdapter10CameraModeEPvijj) I/DEBUG ( 130): #11 pc 00024c4c /system/lib/hw/camera.omap4.so (_ZN7android17BaseCameraAdapter11sendCommandENS_13CameraAdapter14CameraCommandsEiii) I/DEBUG ( 130): #12 pc 0001d3d0 /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal12startPreviewEv) I/DEBUG ( 130): #13 pc 0001d6de /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal16setPreviewWindowEP18preview_stream_ops) I/DEBUG ( 130): #14 pc 0001ae80 /system/lib/hw/camera.omap4.so (_Z25camera_set_preview_windowP13camera_deviceP18preview_stream_ops) I/DEBUG ( 130): #15 pc 000076cc /system/lib/libcameraservice.so I/DEBUG ( 130): #16 pc 000091b4 /system/lib/libcameraservice.so (_ZN7android13CameraService6Client16setPreviewWindowERKNS_2spINS_7IBinderEEERKNS2_I13ANativeWindowEE) I/DEBUG ( 130): #17 pc 000092ea /system/lib/libcameraservice.so (_ZN7android13CameraService6Client17setPreviewDisplayERKNS_2spINS_7SurfaceEEE) I/DEBUG ( 130): #18 pc 00013592 /system/lib/libcamera_client.so (_ZN7android8BnCamera10onTransactEjRKNS_6ParcelEPS1_j) I/DEBUG ( 130): #19 pc 00017f44 /system/lib/libbinder.so (_ZN7android7BBinder8transactEjRKNS_6ParcelEPS1_j) I/DEBUG ( 130): #20 pc 0001b26e /system/lib/libbinder.so (_ZN7android14IPCThreadState14executeCommandEi) I/DEBUG ( 130): #21 pc 0001b44a /system/lib/libbinder.so (_ZN7android14IPCThreadState14joinThreadPoolEb) I/DEBUG ( 130): #22 pc 00020744 /system/lib/libbinder.so I/DEBUG ( 130): #23 pc 00022a1e /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv) I/DEBUG ( 130): #24 pc 00023064 /system/lib/libutils.so I/DEBUG ( 130): #25 pc 00012e2c /system/lib/libc.so (__thread_entry) I/DEBUG ( 130): #26 pc 0001295c /system/lib/libc.so (pthread_create) I/DEBUG ( 130): I/DEBUG ( 130): code around pc: I/DEBUG ( 130): 400df768 4623b15c 2c006824 e026d1fb b12368db \.#F$h.,..&..h#. I/DEBUG ( 130): 400df778 21014a17 6011447a 48124798 24002527 .J.!zD.`.G.H'%.$ I/DEBUG ( 130): 400df788 f7f47005 2106ef8c e838f7f6 460aa901 .p.....!..8....F I/DEBUG ( 130): 400df798 f04f2006 94015380 94029303 ebe4f7f5 . O..S.......... I/DEBUG ( 130): 400df7a8 4622a905 f7f52002 f7f4ebee 2106ef78 .."F. ......x..! I/DEBUG ( 130): I/DEBUG ( 130): code around lr: I/DEBUG ( 130): 400e3420 41f0e92d 46804c0c 447c2600 68a56824 -..A.L.F.&|D$h.h I/DEBUG ( 130): 400e3430 e0076867 300cf9b5 dd022b00 47c04628 gh.....0.+..(F.G I/DEBUG ( 130): 400e3440 35544306 37fff117 6824d5f4 d1ee2c00 .CT5...7..$h.,.. I/DEBUG ( 130): 400e3450 e8bd4630 bf0081f0 000280be 41f0e92d 0F..........-..A I/DEBUG ( 130): 400e3460 fb01b086 9004f602 461f4815 4615460c .........H.F.F.F I/DEBUG ( 130): I/DEBUG ( 130): memory map around addr deadbaad: I/DEBUG ( 130): bec5b000-bec7c000 [stack] I/DEBUG ( 130): (no map for address) I/DEBUG ( 130): ffff0000-ffff1000 [vectors] I/DEBUG ( 130): I/DEBUG ( 130): stack: I/DEBUG ( 130): 41365980 00000001 I/DEBUG ( 130): 41365984 413659c0 I/DEBUG ( 130): 41365988 4010b7e0 /system/lib/libc.so I/DEBUG ( 130): 4136598c 0000000c I/DEBUG ( 130): 41365990 4010b780 /system/lib/libc.so I/DEBUG ( 130): 41365994 4010b718 /system/lib/libc.so I/DEBUG ( 130): 41365998 00000000 I/DEBUG ( 130): 4136599c 400e3441 /system/lib/libc.so I/DEBUG ( 130): 413659a0 00000000 I/DEBUG ( 130): 413659a4 413659d4 I/DEBUG ( 130): 413659a8 401022f4 /system/lib/libc.so I/DEBUG ( 130): 413659ac 401104d4 I/DEBUG ( 130): 413659b0 0104f170 [heap] I/DEBUG ( 130): 413659b4 400e25ad /system/lib/libc.so I/DEBUG ( 130): 413659b8 df0027ad I/DEBUG ( 130): 413659bc 00000000 I/DEBUG ( 130): #00 413659c0 413659bc I/DEBUG ( 130): 413659c4 00000001 I/DEBUG ( 130): 413659c8 401022d8 /system/lib/libc.so I/DEBUG ( 130): 413659cc 00000005 I/DEBUG ( 130): 413659d0 413659ec I/DEBUG ( 130): 413659d4 fffffbdf I/DEBUG ( 130): 413659d8 413659ec I/DEBUG ( 130): 413659dc 413659ec I/DEBUG ( 130): 413659e0 401057f4 /system/lib/libc.so I/DEBUG ( 130): 413659e4 400db737 /system/lib/libc.so I/DEBUG ( 130): #01 413659e8 02000001 I/DEBUG ( 130): 413659ec 20404040 I/DEBUG ( 130): 413659f0 524f4241 I/DEBUG ( 130): 413659f4 474e4954 I/DEBUG ( 130): 413659f8 4e49203a I/DEBUG ( 130): 413659fc 494c4156 I/DEBUG ( 130): 41365a00 45482044 I/DEBUG ( 130): 41365a04 41205041 /dev/ashmem/OMXCodec (deleted) I/DEBUG ( 130): 41365a08 45524444 I/DEBUG ( 130): 41365a0c 49205353 I/DEBUG ( 130): 41365a10 6c64204e I/DEBUG ( 130): 41365a14 65657266 I/DEBUG ( 130): 41365a18 00000000 I/DEBUG ( 130): 41365a1c 00000000 I/DEBUG ( 130): 41365a20 8060f270 I/DEBUG ( 130): 41365a24 a5d1751e I/DEBUG ( 130): 41365a28 00000060 I/DEBUG ( 130): 41365a2c 41365a78 I/DEBUG ( 130): 41365a30 40fb75e9 /system/lib/libdomx.so I/DEBUG ( 130): 41365a34 40fba619 /system/lib/libdomx.so I/DEBUG ( 130): 41365a38 0000001c I/DEBUG ( 130): 41365a3c 40021340 /system/lib/libmm_osal.so I/DEBUG ( 130): 41365a40 ffffffff I/DEBUG ( 130): 41365a44 02000001 I/DEBUG ( 130): 41365a48 000000fb I/DEBUG ( 130): 41365a4c 401104d4 I/DEBUG ( 130): 41365a50 0104f198 [heap] I/DEBUG ( 130): 41365a54 00000000 I/DEBUG ( 130): 41365a58 8060f270 I/DEBUG ( 130): 41365a5c 401104d4 I/DEBUG ( 130): 41365a60 7f000076 I/DEBUG ( 130): 41365a64 400dcc25 /system/lib/libc.so I/DEBUG ( 130): 41365a68 0104f190 [heap] I/DEBUG ( 130): 41365a6c 0104f288 [heap] I/DEBUG ( 130): 41365a70 000000fb I/DEBUG ( 130): 41365a74 401104d4 I/DEBUG ( 130): 41365a78 0104f198 [heap] I/DEBUG ( 130): 41365a7c 00000000 I/DEBUG ( 130): 41365a80 00000000 I/DEBUG ( 130): 41365a84 401104d4 I/DEBUG ( 130): 41365a88 00000002 I/DEBUG ( 130): 41365a8c 400dcc25 /system/lib/libc.so I/DEBUG ( 130): 41365a90 0104f190 [heap] I/DEBUG ( 130): 41365a94 401105f0 I/DEBUG ( 130): 41365a98 000000f8 I/DEBUG ( 130): 41365a9c 401104d4 I/DEBUG ( 130): 41365aa0 0104f198 [heap] I/DEBUG ( 130): 41365aa4 0104f1ac [heap] I/DEBUG ( 130): 41365aa8 00000002 I/DEBUG ( 130): 41365aac 400dda89 /system/lib/libc.so I/DEBUG ( 130): 41365ab0 0104f118 [heap] I/DEBUG ( 130): 41365ab4 00000024 I/DEBUG ( 130): 41365ab8 01035ee0 [heap] I/DEBUG ( 130): 41365abc 00000003 I/DEBUG ( 130): 41365ac0 0000004d I/DEBUG ( 130): 41365ac4 41365ad4 I/DEBUG ( 130): 41365ac8 0104f110 [heap] I/DEBUG ( 130): 41365acc 00000001 I/DEBUG ( 130): 41365ad0 00000178 I/DEBUG ( 130): 41365ad4 00000001 I/DEBUG ( 130): 41365ad8 40111280 I/DEBUG ( 130): 41365adc 400ea8ad /system/lib/libc.so I/DEBUG ( 130): 41365ae0 01035ee0 [heap] I/DEBUG ( 130): 41365ae4 01035ee0 [heap] I/DEBUG ( 130): 41365ae8 00000000 I/DEBUG ( 130): 41365aec a5d1751e I/DEBUG ( 130): 41365af0 0104f168 [heap] I/DEBUG ( 130): 41365af4 01035ee0 [heap] I/DEBUG ( 130): 41365af8 00000000 I/DEBUG ( 130): 41365afc 400dda75 /system/lib/libc.so I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' D/dalvikvm( 203): GC_FOR_ALLOC freed 3709K, 60% free 4952K/12288K, paused 29ms W/AudioSystem( 203): AudioFlinger server died! W/IMediaDeathNotifier( 203): media server died W/AudioSystem( 203): AudioPolicyService server died! W/AudioSystem( 420): AudioFlinger server died! W/AudioSystem( 420): AudioPolicyService server died! I/ServiceManager( 124): service 'media.audio_flinger' died I/ServiceManager( 124): service 'media.player' died I/ServiceManager( 124): service 'media.camera' died I/ServiceManager( 124): service 'media.audio_policy' died W/IMediaDeathNotifier( 437): media server died W/Camera ( 914): Camera server died! W/Camera ( 914): ICamera died I/ActivityManager( 203): Displayed com.android.camera/.Camera: +4s438ms D/CameraStorage( 914): External storage state=mounted I/Thumbnail( 914): Fail to load bitmap. java.io.FileNotFoundException: /data/data/com.android.camera/files/last_thumb: open failed: ENOENT (No such file or directory) E/Camera ( 914): Error 100 E/CameraErrorCallback( 914): Got camera error callback. error=100 D/AndroidRuntime( 914): Shutting down VM W/dalvikvm( 914): threadid=1: thread exiting with uncaught exception (group=0x40a4e1f8) I/ ( 948): ServiceManager: 0x5cd958 I/AudioFlinger( 948): Loaded primary audio interface from Tuna audio HW HAL (audio) I/AudioFlinger( 948): Using 'Tuna audio HW HAL' (audio.primary) as the primary audio interface I/AudioFlinger( 948): Loaded a2dp audio interface from A2DP Audio HW HAL (audio) I/CameraService( 948): CameraService started (pid=948) I/AudioFlinger( 948): AudioFlinger's thread 0x5d44b8 ready to run D/dalvikvm( 203): GC_FOR_ALLOC freed 1181K, 59% free 5063K/12288K, paused 27ms I/AudioPolicyService( 948): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy) I/Process ( 203): Sending signal. PID: 914 SIG: 3 I/dalvikvm( 914): threadid=3: reacting to signal 3 I/dalvikvm( 914): Wrote stack traces to '/data/anr/traces.txt' E/AudioService( 203): Media server died. E/AudioService( 203): Media server started. W/AudioPolicyManagerBase( 948): setPhoneState() setting same state 0 W/AudioFlinger( 948): session id 13 not found for pid 203 I/Process ( 914): Sending signal. PID: 914 SIG: 9 [ 104.225494] binder: release proc 914, transaction 18351, not freed [ 104.234130] binder: release proc 914, transaction 18352, not freed W/InputDispatcher( 203): channel '40f93a50 com.android.camera/com.android.camera.Camera (server)' ~ Consumer closed input channel or an error occurred. events=0x8 E/InputDispatcher( 203): channel '40f93a50 com.android.camera/com.android.camera.Camera (server)' ~ Channel is unrecoverably broken and will be disposed! W/InputDispatcher( 203): Attempted to unregister already unregistered input channel '40f93a50 com.android.camera/com.android.camera.Camera (server)'
The flow when it works is the following:¶
if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {returns false, then what's in #ifdef CONFIG_PVR_SGX is executed, and it jumps to the end without executing
pa = (phys_addr_t) tiler_virt2phys(buffer);
The flow when it fails is the following:¶
if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {returns false,then what's in #ifdef CONFIG_PVR_SGX fails or is skipped,
Then it executes
pa = (phys_addr_t) tiler_virt2phys(buffer);and goes to the end.
Inside the PVR driver¶
struct ion_handle *
PVRSRVExportFDToIONHandle(int fd, struct ion_client **client)
{
[...]
eError = PVRSRVLookupHandle(KERNEL_HANDLE_BASE,
(IMG_PVOID *)&psKernelMemInfo,
psPrivateData->hKernelMemInfo,
PVRSRV_HANDLE_TYPE_MEM_INFO);
[...]
Then it uses psKernelMemInfo and returns a derivative of it.
}
PVRSRV_ERROR PVRSRVLookupHandle(PVRSRV_HANDLE_BASE *psBase, IMG_PVOID *ppvData, IMG_HANDLE hHandle, PVRSRV_HANDLE_TYPE eType)
{
struct sHandle *psHandle;
PVRSRV_ERROR eError;
PVR_ASSERT(eType != PVRSRV_HANDLE_TYPE_NONE)
eError = GetHandleStructure(psBase, &psHandle, hHandle, eType);
if (eError != PVRSRV_OK)
{
PVR_DPF((PVR_DBG_ERROR, "PVRSRVLookupHandle: Error looking up handle (%d)", eError));
return eError;
}
*ppvData = psHandle->pvData;
return PVRSRV_OK;
}
PVRSRV_ERROR GetHandleStructure(PVRSRV_HANDLE_BASE *psBase, struct sHandle **ppsHandle, IMG_HANDLE hHandle, PVRSRV_HANDLE_TYPE eType)
#endif
{
IMG_UINT32 ui32Index = HANDLE_TO_INDEX(hHandle);
struct sHandle *psHandle;
if (!INDEX_IS_VALID(psBase, ui32Index))
{
PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle index out of range (%u >= %u)", ui32Index, psBase->ui32TotalHandCount));
return PVRSRV_ERROR_HANDLE_INDEX_OUT_OF_RANGE;
}
psHandle = INDEX_TO_HANDLE_STRUCT_PTR(psBase, ui32Index);
if (psHandle->eType == PVRSRV_HANDLE_TYPE_NONE)
{
PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle not allocated (index: %u)", ui32Index));
return PVRSRV_ERROR_HANDLE_NOT_ALLOCATED;
}
if (eType != PVRSRV_HANDLE_TYPE_NONE && eType != psHandle->eType)
{
PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle type mismatch (%d != %d)", eType, psHandle->eType));
return PVRSRV_ERROR_HANDLE_TYPE_MISMATCH;
}
*ppsHandle = psHandle;
return PVRSRV_OK;
}
#define INDEX_IS_VALID(psBase, i) ((i) < (psBase)->ui32TotalHandCount)
trying to fix the issue:¶
<6>[ 313.967468] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 256) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c] <6>[ 313.967681] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c] <6>[ 313.967803] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]
was achieved with :
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
int main(){
int fd = open("/dev/pvrsrvkm",O_RDWR);
printf("fd = %d\n");
while(1)
sleep(10000);
return 0; //not reached
}
Updated by Denis 'GNUtoo' Carikli over 12 years ago · 28 revisions