OMAP4 Ducati Camera

The Galaxy Nexus chip has a camera that is accessible through the Ducati microcontroller.

Plan:

We don't support YV12 in the gralloc and in the software libgl yet.
There are several approaches to solve the issue:

Approach 1: Add support for it

Long and complicated

Approach 2: Change format:

The Camera supports the following formats:
compile,push, and run the omap4 camera_test program with the "F" argument:
Here for the back camera:

   Choice: E
E
E
    Supported Cameras: (null)
    Supported Picture Sizes: 2592x1944,2592x1728,2592x1458,2048x1536,1600x1200,1280x1024,1152x864,1280x960,640x480,320x240
    Supported Picture Formats: yuv420sp,yuv420p,yuv422i-yuyv,rgb565,raw,jpeg
    Supported Preview Sizes: 1920x1080,1280x720,960x720,800x480,720x576,720x480,768x576,640x480,320x240,352x288,240x160,176x144,128x96
    Supported Preview Formats: yuv420sp,yuv420p,yuv422i-yuyv,yuv420p
    Supported Preview Frame Rates: 30,15
    Supported Thumbnail Sizes: 640x480,160x120,200x120,320x240,512x384,352x144,176x144,96x96,0x0
    Supported Whitebalance Modes: auto,daylight,cloudy-daylight,fluorescent,incandescent,
    Supported Effects: none,negative,solarize,sepia,mono,whiteboard,blackboard,aqua,posterize
    Supported Scene Modes: auto,action,night,party,sunset
    Supported Focus Modes: continuous-video,auto,macro,infinity,infinity,continuous-picture
    Supported Antibanding Options: auto,50hz,60hz,off
    Supported Flash Modes: off,on,auto,torch
    Supported Focus Areas: 10
    Focus Distances: Infinity,Infinity,Infinity 

Approach 3: Workaround

diff --git a/libs/ui/GraphicBufferAllocator.cpp b/libs/ui/GraphicBufferAllocator.cpp
index f7c4f4e..766a98f 100644
--- a/libs/ui/GraphicBufferAllocator.cpp
+++ b/libs/ui/GraphicBufferAllocator.cpp
@@ -99,8 +99,8 @@ status_t GraphicBufferAllocator::alloc(uint32_t w, uint32_t h, PixelFormat forma
     // we have a h/w allocator and h/w buffer is requested
     status_t err; 

-#ifdef MISSING_EGL_PIXEL_FORMAT_YV12
-    if (format == HAL_PIXEL_FORMAT_YV12) {
+#if 1
+    if (format == HAL_PIXEL_FORMAT_YV12 || format == 0x100 ) {
        format = HAL_PIXEL_FORMAT_RGBX_8888;
     }
     if (usage & GRALLOC_USAGE_EXTERNAL_DISP) {
diff --git a/media/libstagefright/colorconversion/SoftwareRenderer.cpp b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
index 2ce8fa7..abe68dd 100644
--- a/media/libstagefright/colorconversion/SoftwareRenderer.cpp
+++ b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
@@ -62,7 +62,7 @@ SoftwareRenderer::SoftwareRenderer(
     size_t bufWidth, bufHeight;

     switch (mColorFormat) {
-#ifndef MISSING_EGL_PIXEL_FORMAT_YV12
+#if 0
         case OMX_COLOR_FormatYUV420Planar:
         case OMX_TI_COLOR_FormatYUV420PackedSemiPlanar:
         {

Research

Using the camera application produces the following traces:

[...]
V/camera  ( 7834): Preview size is 960x720
V/MediaProfilesJNI( 7834): native_get_num_image_encoding_quality_levels
V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level
V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level
V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level
D/CameraSettings( 7834): Parameters: [antibanding-values=auto,50hz,60hz,off, antibanding=auto, auto-convergence-mode=, auto-convergence=, auto-exposure-lock-supported=true, auto-exposure-lock=false, auto-whitebalance-lock-supported=true, auto-whitebalance-lock=false, brightness=50, camera-mode=0, camera-name=S5K4E1GA, contrast=100, current-iso=100, effect-values=none,negative,solarize,sepia,mono,whiteboard,blackboard,aqua,posterize, effect=none, exif-make=Samsung, exif-model=Galaxy Nexus, exposure-compensation-step=0.1, exposure-compensation=0, exposure-mode-values=auto,night,backlighting,spotlight,sports,snow,beach,aperture,small-aperture,, exposure=auto, flash-mode-values=off,on,auto,torch, flash-mode=auto, focal-length=3.43, focus-distances=Infinity,Infinity,Infinity, focus-mode-values=continuous-video,auto,macro,infinity,infinity,continuous-picture, focus-mode=continuous-picture, gbce=disable, horizontal-view-angle=54.8, ipp-values=off,ldc,nsf,ldc-nsf, ipp=ldc-nsf, iso-mode-values=auto,100,200,400,800, iso=auto, jpeg-quality=95, jpeg-thumbnail-height=120, jpeg-thumbnail-quality=60, jpeg-thumbnail-size-values=640x480,160x120,200x120,320x240,512x384,352x144,176x144,96x96,0x0, jpeg-thumbnail-width=160, manual-convergence-values=, max-exposure-compensation=30, max-framerate=30, max-num-detected-faces-hw=35, max-num-detected-faces-sw=0, max-num-focus-areas=10, max-num-metering-areas=10, max-zoom=60, min-exposure-compensation=-30, min-framerate=15, picture-format-values=yuv420sp,yuv420p,yuv422i-yuyv,rgb565,raw,jpeg, picture-format=jpeg, picture-size-values=2592x1944,2592x1728,2592x1458,2048x1536,1600x1200,1280x1024,1152x864,1280x960,640x480,320x240, picture-size=2592x1944, preview-format-values=yuv420sp,yuv420p,yuv422i-yuyv,yuv420p, preview-format=yuv420sp, preview-fps-range-values=(15000,15000),(15000,30000),(24000,30000), preview-fps-range=15000,30000, preview-frame-rate-values=30,15, preview-frame-rate=30, preview-size-values=1920x1080,1280x720,960x720,800x480,720x576,720x480,768x576,640x480,320x240,352x288,240x160,176x144,128x96, preview-size=960x720, recording-hint=false, s3d-supported=, s3d2d-preview-values=, s3d2d-preview=, saturation=100, scene-mode-values=auto,action,night,party,sunset, scene-mode=auto, sensor-orientation-values=, sensor-orientation=, sharpness=100, smooth-zoom-supported=true, vertical-view-angle=42.5, video-frame-format=OMX_TI_COLOR_FormatYUV420PackedSemiPlanar, video-snapshot-supported=true, video-stabilization-supported=true, video-stabilization=false, whitebalance-values=auto,daylight,cloudy-daylight,fluorescent,incandescent,, whitebalance=auto, zoom-ratios=100,104,107,111,115,119,123,127,132,137,141,146,152,157,162,168,174,180,187,193,200,207,214,222,230,238,246,255,264,273,283,293,303,314,325,336,348,361,373,386,400,414,429,444,459,476,492,510,528,546,566,586,606,628,650,673,696,721,746,773,800, zoom-supported=true, zoom=0]
V/camera  ( 7834): startPreview
I/CameraHAL( 7751): NULL ANativeWindow passed to setPreviewWindow
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706507, pParamStruct = 0x41b5ebd4
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706506, pParamStruct = 0x41b5ebd0
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706548, pParamStruct = 0x41b5ebc8
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706469, pParamStruct = 0x41b5ebd4
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 2130706509, pConfigStruct = 0x41b5ebbc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706515, pParamStruct = 0x41b5ebd0
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706514, pParamStruct = 0x41b5ebcc
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440522, pConfigStruct = 0x41b5ebbc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440522, pConfigStruct = 0x41b5ebbc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706522, pParamStruct = 0x41b5eb14
I/Process (  189): Sending signal. PID: 7834 SIG: 3
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
I/dalvikvm( 7834): threadid=3: reacting to signal 3
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706522, pParamStruct = 0x41b5eb14
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706519, pParamStruct = 0x41b5ebfc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x7f000057
I/CameraHAL( 7751): Preview not started. Preview in progress flag set
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 2, nParam = 2, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): TRACE: 
D/DOMX    ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__**
D/DOMX    ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x2,nData2: 0x2,pEventData: 0x0
D/DOMX    ( 7751): TRACE: Just Before Entering Proxy Event handler call
D/DOMX    ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x2, nData2=0x2, pEventData=0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 0, nParam = 2, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): TRACE: 
D/DOMX    ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__**
D/DOMX    ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x0,nData2: 0x2,pEventData: 0x0
D/DOMX    ( 7751): TRACE: Just Before Entering Proxy Event handler call
D/DOMX    ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x0, nData2=0x2, pEventData=0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 0, nParam = 3, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: 
D/DOMX    ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__**
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x0,nData2: 0x3,pEventData: 0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): TRACE: Just Before Entering Proxy Event handler call
D/DOMX    ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x0, nData2=0x3, pEventData=0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
V/camera  ( 7834): surfaceChanged. w=720. h=960
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 2130706541, pConfigStruct = 0x413a1b58
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 3, nParam = 2, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706545, pParamStruct = 0x413a1ba0
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nPortIndex = 0x2, pAppPrivate = 0x0, nSizeBytes = 1142784, pBuffer = 0x154a580
D/DOMX    ( 7751): TRACE: In UB, no. of buffers = 0
D/DOMX    ( 7751): TRACE: Preparing buffer to Remote Core...
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1037
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    ( 7751): TRACE: Port Number: 2 :: NumOfLines 720
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1047
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706550, pParamStruct = 0x413a1b34
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x7f000076
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1116
D/DOMX    ( 7751): TRACE: Metadata size = 12332
D/DOMX    ( 7751): TRACE: ion_fd=70
D/DOMX    ( 7751): TRACE: ION being USED for allocation!!!!! handle = c3e30380, ret =0
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1130
D/DOMX    ( 7751): TRACE: Metadata buffer ion handle = c3e30380
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): TRACE: Marshaling data
D/DOMX    ( 7751): TRACE: eMapInfo = 3
D/DOMX    ( 7751): TRACE: UV buffer fd= 3141592
D/DOMX    ( 7751): TRACE: Metadata buffer = c3e30380
D/DOMX    ( 7751): TRACE: About to send packet
D/DOMX    ( 7751): TRACE: RPC_sendPacket_sync hCtx->fd_omx=26|nPacketSize=240
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_UseBuffer:1080
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync write errno error 22
D/DOMX    ( 7751): ERROR: DOMX Write failed 0xffffffff -1
D/DOMX    ( 7751): ERROR: failed check:status >= 0 - returning error: 0x81001 - Write failed
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): ERROR: RPC function returned error 0x81001
D/DOMX    ( 7751): TRACE: Use Buffer Successful
D/DOMX    ( 7751): TRACE: Value of pBufHeaderRemote: 0x0 LocalBufferHdr :0x15714e8, LocalBuffer :0x154a580
D/DOMX    ( 7751): TRACE: Metadata buffer ion handle given to ion map = c3e30380
D/DOMX    ( 7751): TRACE: Updating no. of buffer to 1
D/DOMX    ( 7751): ERROR: [DBG] eError = -2147479551, line 1192
D/DOMX    ( 7751): EXIT: eError: -2147479551
E/CameraHAL( 7751): OMX_UseBuffer-0x80001001
E/CameraHAL( 7751): Exiting function UseBuffersPreview because of ret 0 eError=80001001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570
E/ion     ( 7751): ioctl -1073460991 failed with code -1: Bad file number
F/libc    ( 7751): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree
F/libc    ( 7751): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
I/DEBUG   (  127): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (  127): Build fingerprint: 'google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys'
I/DEBUG   (  127): pid: 7751, tid: 7758  >>> /system/bin/mediaserver <<<
I/DEBUG   (  127): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad
I/DEBUG   (  127):  r0 deadbaad  r1 00000001  r2 a0000000  r3 00000000
I/DEBUG   (  127):  r4 00000000  r5 00000027  r6 401342f4  r7 401424d4
I/DEBUG   (  127):  r8 01571540  r9 40fe1000  10 0155f9a0  fp 01570e5c
I/DEBUG   (  127):  ip ffffffff  sp 413a19c0  lr 40115441  pc 40111788  cpsr 600f0030
I/DEBUG   (  127):  d0  656c696620646120  d1  373565343531786e
I/DEBUG   (  127):  d2  6c202c3135353975  d3  3239313120656e6d
I/DEBUG   (  127):  d4  7264487265666675  d5  3137353178303a20
I/DEBUG   (  127):  d6  636f4c202c386534  d7  7265666675426c61
I/DEBUG   (  127):  d8  0000000000000000  d9  0000000000000000
I/DEBUG   (  127):  d10 0000000000000000  d11 0000000000000000
I/DEBUG   (  127):  d12 0000000000000000  d13 0000000000000000
I/DEBUG   (  127):  d14 0000000000000000  d15 0000000000000000
I/DEBUG   (  127):  d16 3f7316d1d399f1e0  d17 3ffd42315763b9eb
I/DEBUG   (  127):  d18 4000000000000000  d19 3fc5ee7544e230aa
I/DEBUG   (  127):  d20 3f1152f62f5a4167  d21 bebbb7b7df4a3093
I/DEBUG   (  127):  d22 3ff0000000000000  d23 3ff316d1d399f1e0
I/DEBUG   (  127):  d24 3e66376972bea4d0  d25 3fee147ae0000000
I/DEBUG   (  127):  d26 0000000000000000  d27 0000000000000000
I/DEBUG   (  127):  d28 0000000000000000  d29 0000000000000000
I/DEBUG   (  127):  d30 0000000000000000  d31 0000000000000000
I/DEBUG   (  127):  scr 68000010
I/DEBUG   (  127): 
I/DEBUG   (  127):          #00  pc 00017788  /system/lib/libc.so
I/DEBUG   (  127):          #01  pc 00013732  /system/lib/libc.so
I/DEBUG   (  127):          #02  pc 00015a70  /system/lib/libc.so (dlfree)
I/DEBUG   (  127):          #03  pc 00016100  /system/lib/libc.so (free)
I/DEBUG   (  127):          #04  pc 000019e6  /system/lib/libmm_osal.so (TIMM_OSAL_Free)
I/DEBUG   (  127):          #05  pc 00006446  /system/lib/libdomx.so (PROXY_ComponentDeInit)
I/DEBUG   (  127):          #06  pc 000018ec  /system/lib/libOMX.TI.DUCATI1.VIDEO.CAMERA.so
I/DEBUG   (  127):          #07  pc 00001df6  /system/lib/libOMX_Core.so (OMX_FreeHandle)
I/DEBUG   (  127):          #08  pc 000284fc  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter24performCleanupAfterErrorEv)
I/DEBUG   (  127):          #09  pc 0002b04e  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter17UseBuffersPreviewEPvi)
I/DEBUG   (  127):          #10  pc 0002b182  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter10useBuffersENS_13CameraAdapter10CameraModeEPvijj)
I/DEBUG   (  127):          #11  pc 00024c4c  /system/lib/hw/camera.omap4.so (_ZN7android17BaseCameraAdapter11sendCommandENS_13CameraAdapter14CameraCommandsEiii)
I/DEBUG   (  127):          #12  pc 0001d3d0  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal12startPreviewEv)
I/DEBUG   (  127):          #13  pc 0001d6de  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal16setPreviewWindowEP18preview_stream_ops)
I/DEBUG   (  127):          #14  pc 0001ae80  /system/lib/hw/camera.omap4.so (_Z25camera_set_preview_windowP13camera_deviceP18preview_stream_ops)
I/DEBUG   (  127):          #15  pc 000076cc  /system/lib/libcameraservice.so
I/DEBUG   (  127):          #16  pc 000091b4  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client16setPreviewWindowERKNS_2spINS_7IBinderEEERKNS2_I13ANativeWindowEE)
I/DEBUG   (  127):          #17  pc 000092ea  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client17setPreviewDisplayERKNS_2spINS_7SurfaceEEE)
I/DEBUG   (  127):          #18  pc 00013592  /system/lib/libcamera_client.so (_ZN7android8BnCamera10onTransactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  127):          #19  pc 00017f44  /system/lib/libbinder.so (_ZN7android7BBinder8transactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  127):          #20  pc 0001b26e  /system/lib/libbinder.so (_ZN7android14IPCThreadState14executeCommandEi)
I/DEBUG   (  127):          #21  pc 0001b44a  /system/lib/libbinder.so (_ZN7android14IPCThreadState14joinThreadPoolEb)
I/DEBUG   (  127):          #22  pc 00020744  /system/lib/libbinder.so
I/DEBUG   (  127):          #23  pc 00022a1e  /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv)
I/DEBUG   (  127):          #24  pc 00023064  /system/lib/libutils.so
I/DEBUG   (  127):          #25  pc 00012e2c  /system/lib/libc.so (__thread_entry)
I/DEBUG   (  127):          #26  pc 0001295c  /system/lib/libc.so (pthread_create)
I/DEBUG   (  127): 
I/DEBUG   (  127): code around pc:
I/DEBUG   (  127): 40111768 4623b15c 2c006824 e026d1fb b12368db  \.#F$h.,..&..h#.
I/DEBUG   (  127): 40111778 21014a17 6011447a 48124798 24002527  .J.!zD.`.G.H'%.$
I/DEBUG   (  127): 40111788 f7f47005 2106ef8c e838f7f6 460aa901  .p.....!..8....F
I/DEBUG   (  127): 40111798 f04f2006 94015380 94029303 ebe4f7f5  . O..S..........
I/DEBUG   (  127): 401117a8 4622a905 f7f52002 f7f4ebee 2106ef78  .."F. ......x..!
I/DEBUG   (  127): 
I/DEBUG   (  127): code around lr:
I/DEBUG   (  127): 40115420 41f0e92d 46804c0c 447c2600 68a56824  -..A.L.F.&|D$h.h
I/DEBUG   (  127): 40115430 e0076867 300cf9b5 dd022b00 47c04628  gh.....0.+..(F.G
I/DEBUG   (  127): 40115440 35544306 37fff117 6824d5f4 d1ee2c00  .CT5...7..$h.,..
I/DEBUG   (  127): 40115450 e8bd4630 bf0081f0 000280be 41f0e92d  0F..........-..A
I/DEBUG   (  127): 40115460 fb01b086 9004f602 461f4815 4615460c  .........H.F.F.F
I/DEBUG   (  127): 
I/DEBUG   (  127): memory map around addr deadbaad:
I/DEBUG   (  127): bede2000-bee03000 [stack]
I/DEBUG   (  127): (no map for address)
I/DEBUG   (  127): ffff0000-ffff1000 [vectors]
I/DEBUG   (  127): 
I/DEBUG   (  127): stack:
I/DEBUG   (  127):     413a1980  00000001  
I/DEBUG   (  127):     413a1984  413a19c0  
I/DEBUG   (  127):     413a1988  4013d7e0  /system/lib/libc.so
I/DEBUG   (  127):     413a198c  0000000c  
I/DEBUG   (  127):     413a1990  4013d780  /system/lib/libc.so
I/DEBUG   (  127):     413a1994  4013d718  /system/lib/libc.so
I/DEBUG   (  127):     413a1998  00000000  
I/DEBUG   (  127):     413a199c  40115441  /system/lib/libc.so
I/DEBUG   (  127):     413a19a0  00000000  
I/DEBUG   (  127):     413a19a4  413a19d4  
I/DEBUG   (  127):     413a19a8  401342f4  /system/lib/libc.so
I/DEBUG   (  127):     413a19ac  401424d4  
I/DEBUG   (  127):     413a19b0  01571540  [heap]
I/DEBUG   (  127):     413a19b4  401145ad  /system/lib/libc.so
I/DEBUG   (  127):     413a19b8  df0027ad  
I/DEBUG   (  127):     413a19bc  00000000  
I/DEBUG   (  127): #00 413a19c0  413a19bc  
I/DEBUG   (  127):     413a19c4  00000001  
I/DEBUG   (  127):     413a19c8  401342d8  /system/lib/libc.so
I/DEBUG   (  127):     413a19cc  00000005  
I/DEBUG   (  127):     413a19d0  413a19ec  
I/DEBUG   (  127):     413a19d4  fffffbdf  
I/DEBUG   (  127):     413a19d8  413a19ec  
I/DEBUG   (  127):     413a19dc  413a19ec  
I/DEBUG   (  127):     413a19e0  401377f4  /system/lib/libc.so
I/DEBUG   (  127):     413a19e4  4010d737  /system/lib/libc.so
I/DEBUG   (  127): #01 413a19e8  01571560  [heap]
I/DEBUG   (  127):     413a19ec  20404040  
I/DEBUG   (  127):     413a19f0  524f4241  
I/DEBUG   (  127):     413a19f4  474e4954  
I/DEBUG   (  127):     413a19f8  4e49203a  
I/DEBUG   (  127):     413a19fc  494c4156  
I/DEBUG   (  127):     413a1a00  45482044  
I/DEBUG   (  127):     413a1a04  41205041  /dev/snd/pcmC0D0p
I/DEBUG   (  127):     413a1a08  45524444  
I/DEBUG   (  127):     413a1a0c  49205353  
I/DEBUG   (  127):     413a1a10  6c64204e  
I/DEBUG   (  127):     413a1a14  65657266  
I/DEBUG   (  127):     413a1a18  00000000  
I/DEBUG   (  127):     413a1a1c  17f80cb3  
I/DEBUG   (  127):     413a1a20  00000000  
I/DEBUG   (  127):     413a1a24  00000060  
I/DEBUG   (  127):     413a1a28  40fa4b13  /system/lib/libdomx.so
I/DEBUG   (  127):     413a1a2c  40fa7c7d  /system/lib/libdomx.so
I/DEBUG   (  127):     413a1a30  00000020  
I/DEBUG   (  127):     413a1a34  40f95340  /system/lib/libmm_osal.so
I/DEBUG   (  127):     413a1a38  ffffffff  
I/DEBUG   (  127):     413a1a3c  02000001  
I/DEBUG   (  127):     413a1a40  000000fb  
I/DEBUG   (  127):     413a1a44  401424d4  
I/DEBUG   (  127):     413a1a48  01571568  [heap]
I/DEBUG   (  127):     413a1a4c  00000000  
I/DEBUG   (  127):     413a1a50  00000000  
I/DEBUG   (  127):     413a1a54  401424d4  
I/DEBUG   (  127):     413a1a58  7f000076  
I/DEBUG   (  127):     413a1a5c  4010ec25  /system/lib/libc.so
I/DEBUG   (  127):     413a1a60  01571560  [heap]
I/DEBUG   (  127):     413a1a64  01571658  [heap]
I/DEBUG   (  127):     413a1a68  000000fb  
I/DEBUG   (  127):     413a1a6c  401424d4  
I/DEBUG   (  127):     413a1a70  01571568  [heap]
I/DEBUG   (  127):     413a1a74  00000000  
I/DEBUG   (  127):     413a1a78  8060f290  
I/DEBUG   (  127):     413a1a7c  401424d4  
I/DEBUG   (  127):     413a1a80  00000002  
I/DEBUG   (  127):     413a1a84  4010ec25  /system/lib/libc.so
I/DEBUG   (  127):     413a1a88  01571560  [heap]
I/DEBUG   (  127):     413a1a8c  01571658  [heap]
I/DEBUG   (  127):     413a1a90  00006288  
I/DEBUG   (  127):     413a1a94  401424d4  
I/DEBUG   (  127):     413a1a98  01571568  [heap]
I/DEBUG   (  127):     413a1a9c  0157157c  [heap]
I/DEBUG   (  127):     413a1aa0  00000002  
I/DEBUG   (  127):     413a1aa4  4010fa89  /system/lib/libc.so
I/DEBUG   (  127):     413a1aa8  015714e8  [heap]
I/DEBUG   (  127):     413a1aac  01571568  [heap]
I/DEBUG   (  127):     413a1ab0  80001001  
I/DEBUG   (  127):     413a1ab4  00000003  
I/DEBUG   (  127):     413a1ab8  00000046  
I/DEBUG   (  127):     413a1abc  413a1acc  
I/DEBUG   (  127):     413a1ac0  015714e0  [heap]
I/DEBUG   (  127):     413a1ac4  01571538  [heap]
I/DEBUG   (  127):     413a1ac8  00006308  
I/DEBUG   (  127):     413a1acc  401424d4  
I/DEBUG   (  127):     413a1ad0  015714e8  [heap]
I/DEBUG   (  127):     413a1ad4  40fa8ae1  /system/lib/libdomx.so
I/DEBUG   (  127):     413a1ad8  40143280  
I/DEBUG   (  127):     413a1adc  4011c8ad  /system/lib/libc.so
I/DEBUG   (  127):     413a1ae0  01556240  [heap]
I/DEBUG   (  127):     413a1ae4  01556240  [heap]
I/DEBUG   (  127):     413a1ae8  00000000  
I/DEBUG   (  127):     413a1aec  17f80cb3  
I/DEBUG   (  127):     413a1af0  01571538  [heap]
I/DEBUG   (  127):     413a1af4  01556240  [heap]
I/DEBUG   (  127):     413a1af8  00000000  
I/DEBUG   (  127):     413a1afc  4010fa75  /system/lib/libc.so
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioSystem(  189): AudioFlinger server died!
W/AudioSystem(  189): AudioPolicyService server died!
I/ServiceManager(  122): service 'media.audio_flinger' died
I/ServiceManager(  122): service 'media.player' died
I/ServiceManager(  122): service 'media.camera' died
I/ServiceManager(  122): service 'media.audio_policy' died
W/IMediaDeathNotifier(  723): media server died
E/MediaPlayer(  723): error (100, 0)
W/Camera  ( 7834): Camera server died!
W/Camera  ( 7834): ICamera died
E/MediaPlayer(  723): Error (100,0)
E/VanillaMusic(  723): MediaPlayer error: 100 0
I/ActivityManager(  189): Displayed com.android.camera/.Camera: +4s446ms
D/CameraStorage( 7834): External storage state=mounted
I/Thumbnail( 7834): Fail to load bitmap. java.io.FileNotFoundException: /data/data/com.android.camera/files/last_thumb: open failed: ENOENT (No such file or directory)
E/Camera  ( 7834): Error 100
E/CameraErrorCallback( 7834): Got camera error callback. error=100
D/AndroidRuntime( 7834): Shutting down VM
W/dalvikvm( 7834): threadid=1: thread exiting with uncaught exception (group=0x40a411f8)
I/        ( 7873): ServiceManager: 0x959958
E/SRS-Client( 7873): OpenClient_RILD
D/SRS-Client( 7873): Unsolicited handler isn't implemented yet!
I/AudioFlinger( 7873): Loaded primary audio interface from Tuna audio HW HAL (audio)
I/AudioFlinger( 7873): Using 'Tuna audio HW HAL' (audio.primary) as the primary audio interface
I/AudioFlinger( 7873): Loaded a2dp audio interface from A2DP Audio HW HAL (audio)
I/CameraService( 7873): CameraService started (pid=7873)
I/AudioFlinger( 7873): AudioFlinger's thread 0x960400 ready to run
I/AudioPolicyService( 7873): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy)
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
E/AudioService(  189): Media server died.
E/AudioService(  189): Media server started.
W/AudioPolicyManagerBase( 7873): setPhoneState() setting same state 0

The interesting part in all that noise is the following:

D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync write errno error 22
D/DOMX    ( 7751): ERROR: DOMX Write failed 0xffffffff -1

Basically write fails at:
#define RPC_sendPacket_sync(hCtx, pPacket, nPacketSize, nFxnIdx, pRetPacket, nSize) do { \
    DOMX_ERROR("[DBG] RPC_sendPacket_sync %s:%d",__func__,__LINE__); \
    status = write(hCtx->fd_omx, pPacket, nPacketSize); \
    if (status == -1){ \
        int errsv = errno; \
        DOMX_ERROR("[DBG] RPC_sendPacket_sync write errno error %d",errsv); \
    } \
    RPC_freePacket(pPacket); \
    pPacket = NULL; \
    if(status < 0 ) DOMX_ERROR("DOMX Write failed 0x%x %d",status,status); \
    RPC_assert(status >= 0, RPC_OMX_ErrorUndefined, "Write failed"); \
    eError = TIMM_OSAL_ReadFromPipe(hCtx->pMsgPipe[nFxnIdx], &pRetPacket, \
        RPC_MSG_SIZE_FOR_PIPE, (TIMM_OSAL_U32 *)(&nSize), TIMM_OSAL_SUSPEND); \
    RPC_assert(eError == TIMM_OSAL_ERR_NONE, eError, \
        "Read failed"); \
    } while(0)

That means that a normal unix write to /dev/rpmsg-omx1 fails with EINVAL.
Which produces something like that in the kernel when the powervr kernel driver is there but the non-free userland is not.
root@android:/ # dmesg                                                         
<6>[  105.768157] max17040 4-0036: online = 1 vcell = 4200000 soc = 100 status = 4 health = 1 temp = 380 charger status = 1
<6>[  108.557067] request_suspend_state: wakeup (3->0) at 108550701674 (2012-11-02 19:41:27.498122569 UTC)
<6>[  108.558135] DSSCOMP: dsscomp_late_resume
<6>[  109.513000] vibrator: value=20, pwmval=127
<6>[  109.872772] vibrator: value=20, pwmval=127
<6>[  110.213806] vibrator: value=20, pwmval=127
<6>[  110.543334] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
<4>[  110.557281] omap_hwmod: ipu: failed to hardreset
<6>[  110.560150] omap-iommu omap-iommu.0: ducati: version 2.1
<6>[  110.733123] sr_class1p5_calib_work: core: Calibration complete: Voltage:Nominal=1250000,Calib=1038160,margin=13000
<6>[  111.117462] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 0) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  111.117584] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  111.117706] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]
<6>[  114.291107] binder: release 138:532 transaction 8079 in, still active
<6>[  114.291168] binder: send failed reply for transaction 8079 to 814:814
<4>[  116.686065] sr_class1p5_calib_work: iva Stop sampling: Voltage Nominal=950000 samples=18
<6>[  116.686309] sr_class1p5_calib_work: iva: Calibration complete: Voltage:Nominal=950000,Calib=860920,margin=13000
<3>[  119.851684] omap-rproc omap-rproc.1: rproc_watchdog_isr
<6>[  119.851959] omap_rproc_dump_registers: REGISTER DUMP FOR REMOTEPROC ipu
<6>[  119.852264] omap_rproc_dump_registers: PC is at 002a5006
<6>[  119.852416] omap_rproc_dump_registers: LR is at 002a5007
<6>[  119.852722] omap_rproc_dump_registers: pc : [<002a5006>]    lr : [<002a5007>]    psr: 61000000
<6>[  119.852752] sp : 806041e8  ip : 806041a8  fp : 802b839c
<6>[  119.853210] omap_rproc_dump_registers: r10: 802a5f27  r9 : 0000804f  r8 : 00000000
<6>[  119.853515] omap_rproc_dump_registers: r7 : 00000137  r6 : 00000000  r5 : 80604214  r4 : 00254a3c
<6>[  119.853698] omap_rproc_dump_registers: r3 : 00000000  r2 : 9f070000  r1 : 00000010  r0 : 00000000
<6>[  119.854003] omap_rproc_dump_registers: Flags: nZCv  IRQs on  FIQs on
<6>[  119.854675] _event_notify: remoteproc: ipu has crashed
<3>[  119.854827] rpmsg_rproc_error: Fatal error in ipu
<3>[  119.855133] rpmsg_rproc_error: Fatal error in ipu
<3>[  119.855316] rpmsg_reset_work: reseting virtio device 0
<6>[  119.855682] rpmsg_resmgr rpmsg0: Enter rprm_remove
<6>[  119.862121] rpmsg_omx rpmsg-omx0: rpmsg omx driver is removed
<3>[  119.866668] rpmsg_reset_work: reseting virtio device 1
<6>[  119.866912] rpmsg_resmgr rpmsg2: Enter rprm_remove
<6>[  119.868988] rpmsg_omx rpmsg-omx1: rpmsg omx driver is removed
<4>[  119.870544] rproc_reset_poolmem: invalid pool
<6>[  119.870819] omap-rproc omap-rproc.1: stopped remote processor ipu
<6>[  119.873626] omap-rproc omap-rproc.1: powering up ipu
<6>[  119.873962] virtio_rpmsg_bus virtio2: rpmsg backend virtproc probed successfully
<6>[  119.874877] virtio_rpmsg_bus virtio3: rpmsg backend virtproc probed successfully
<6>[  119.915710] omap-rproc omap-rproc.1: Loaded BIOS image ducati-m3.bin, size 4511300
<6>[  119.915893] omap-rproc omap-rproc.1: BIOS image version is 2
<6>[  119.927490] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
<4>[  119.941894] omap_hwmod: ipu: failed to hardreset
<6>[  119.943176] omap-iommu omap-iommu.0: ducati: version 2.1
<6>[  119.952117] omap-rproc omap-rproc.1: remote processor ipu is now up
<6>[  119.965270] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965393] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965545] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965637] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965820] virtio_rpmsg_bus virtio2: creating channel rpmsg-client-sample addr 0x32
<6>[  119.966125] virtio_rpmsg_bus virtio2: creating channel rpmsg-client-sample addr 0x33
<6>[  119.966400] virtio_rpmsg_bus virtio2: creating channel rpmsg-omx addr 0x3c
<6>[  119.966827] rpmsg_omx rpmsg-omx0: new OMX connection srv channel: 1024 -> 60!
<6>[  121.112823] virtio_rpmsg_bus virtio3: creating channel rpmsg-omx addr 0x3c
<6>[  121.116668] rpmsg_omx rpmsg-omx1: new OMX connection srv channel: 1024 -> 60!

Disabling the pvr driver with:

diff --git a/arch/arm/configs/cyanogenmod_tuna_defconfig b/arch/arm/configs/cyanogenmod_tuna_defconfig
index 1a060a2..a9e3990 100644
--- a/arch/arm/configs/cyanogenmod_tuna_defconfig
+++ b/arch/arm/configs/cyanogenmod_tuna_defconfig
@@ -1,6 +1,6 @@
 #
 # Automatically generated make config: don't edit
-# Linux/arm 3.0.34 Kernel Configuration
+# Linux/arm 3.0.36 Kernel Configuration
 #
 CONFIG_ARM=y
 CONFIG_HAVE_PWM=y
@@ -70,6 +70,7 @@ CONFIG_GENERIC_IRQ_CHIP=y
 # RCU Subsystem
 #
 CONFIG_TREE_PREEMPT_RCU=y
+# CONFIG_TINY_RCU is not set
 CONFIG_PREEMPT_RCU=y
 # CONFIG_RCU_TRACE is not set
 CONFIG_RCU_FANOUT=32
@@ -583,6 +584,8 @@ CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_CUBIC=y
+# CONFIG_DEFAULT_CUBIC is not set
+# CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic" 
 # CONFIG_TCP_MD5SIG is not set
 CONFIG_IPV6=y
@@ -785,6 +788,9 @@ CONFIG_IP6_NF_RAW=y
 # CONFIG_BRIDGE_NF_EBTABLES is not set
 # CONFIG_IP_DCCP is not set
 # CONFIG_IP_SCTP is not set
+# CONFIG_SCTP_HMAC_NONE is not set
+# CONFIG_SCTP_HMAC_SHA1 is not set
+# CONFIG_SCTP_HMAC_MD5 is not set
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -917,6 +923,8 @@ CONFIG_CFG80211_DEFAULT_PS=y
 # CONFIG_LIB80211 is not set
 CONFIG_CFG80211_ALLOW_RECONNECT=y
 # CONFIG_MAC80211 is not set
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+# CONFIG_MAC80211_RC_DEFAULT_MINSTREL is not set
 # CONFIG_WIMAX is not set
 CONFIG_RFKILL=y
 CONFIG_RFKILL_PM=y
@@ -1204,6 +1212,9 @@ CONFIG_WLAN=y
 # CONFIG_USB_NET_RNDIS_WLAN is not set
 CONFIG_WIFI_CONTROL_FUNC=y
 # CONFIG_ATH_COMMON is not set
+# CONFIG_B43LEGACY_DMA_AND_PIO_MODE is not set
+# CONFIG_B43LEGACY_DMA_MODE is not set
+# CONFIG_B43LEGACY_PIO_MODE is not set
 # CONFIG_BCM4329 is not set
 CONFIG_BCMDHD=y
 CONFIG_BCMDHD_FW_PATH="/system/vendor/firmware/fw_bcmdhd.bin" 
@@ -1688,24 +1699,13 @@ CONFIG_TILER_ENABLE_USERSPACE=y
 # Graphics support
 #
 # CONFIG_DRM is not set
-CONFIG_PVR_SGX=y
-CONFIG_PVR_SGXCORE_540=y
-CONFIG_PVR_BUILD_RELEASE=y
+# CONFIG_PVR_SGX is not set
+# CONFIG_PVR_SGXCORE_540 is not set
+# CONFIG_PVR_BUILD_RELEASE is not set
 # CONFIG_PVR_BUILD_DEBUG is not set
-CONFIG_PVR_NEED_PVR_DPF=y
-CONFIG_PVR_NEED_PVR_ASSERT=y
-CONFIG_PVR_PERCONTEXT_PB=y
-CONFIG_PVR_ACTIVE_POWER_MANAGEMENT=y
-CONFIG_PVR_ACTIVE_POWER_LATENCY_MS=100
-CONFIG_PVR_SGX_LOW_LATENCY_SCHEDULING=y
-CONFIG_PVR_USSE_EDM_STATUS_DEBUG=y
-CONFIG_PVR_DUMP_MK_TRACE=y
-# CONFIG_PVR_PDUMP is not set
-CONFIG_PVR_OMAP_DSS2=y
 # CONFIG_SGX_DVFS_MODE_NONE is not set
 # CONFIG_SGX_DVFS_MODE_LINEAR is not set
-CONFIG_SGX_DVFS_MODE_OPTIMIZED=y
-CONFIG_SGX_DVFS_IDLE_TIMEOUT=1000
+# CONFIG_SGX_DVFS_MODE_OPTIMIZED is not set
 CONFIG_ION=y
 CONFIG_ION_OMAP=y
 # CONFIG_VGASTATE is not set
@@ -1734,10 +1734,13 @@ CONFIG_FB_MODE_HELPERS=y
 # Frame buffer hardware drivers
 #
 # CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_CARMINE_DRAM_EVAL is not set
+# CONFIG_CARMINE_DRAM_CUSTOM is not set
 # CONFIG_FB_TMIO is not set
 # CONFIG_FB_UDL is not set
 # CONFIG_FB_VIRTUAL is not set
 # CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MB862XX_PCI_GDC is not set
 # CONFIG_FB_BROADSHEET is not set
 CONFIG_HDMI_TI_4XXX_IP=y
 CONFIG_SII9234=y
@@ -1765,7 +1768,6 @@ CONFIG_FB_OMAP2_NUM_FBS=3
 CONFIG_PANEL_S6E8AA0=y
 # CONFIG_PANEL_TAAL is not set
 CONFIG_COLOR_HACK=y
-CONFIG_DSSCOMP=y
 CONFIG_DSSCOMP_DEBUG_LOG=y
 CONFIG_OMAP4_HDCP=y
 # CONFIG_OMAP4_HDCP_DEBUG is not set
@@ -2094,6 +2096,12 @@ CONFIG_USB_GADGET_SELECTED=y
 # CONFIG_USB_GADGET_R8A66597 is not set
 # CONFIG_USB_GADGET_PXA_U2O is not set
 # CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_AMD5536UDC is not set
+# CONFIG_USB_GADGET_CI13XXX_PCI is not set
+# CONFIG_USB_GADGET_NET2280 is not set
+# CONFIG_USB_GADGET_GOKU is not set
+# CONFIG_USB_GADGET_LANGWELL is not set
+# CONFIG_USB_GADGET_EG20T is not set
 # CONFIG_USB_GADGET_DUMMY_HCD is not set
 CONFIG_USB_GADGET_DUALSPEED=y
 # CONFIG_USB_ZERO is not set
@@ -2113,6 +2121,9 @@ CONFIG_USB_G_ANDROID=y
 # CONFIG_USB_G_MULTI is not set
 # CONFIG_USB_G_HID is not set
 # CONFIG_USB_G_DBGP is not set
+# CONFIG_USB_G_DBGP_PRINTK is not set
+# CONFIG_USB_G_DBGP_SERIAL is not set
+# CONFIG_USB_G_WEBCAM is not set

 #
 # OTG and related infrastructure
@@ -2265,9 +2276,15 @@ CONFIG_ANDROID_LOW_MEMORY_KILLER=y
 # CONFIG_USB_SERIAL_QUATECH_USB2 is not set
 # CONFIG_VT6656 is not set
 # CONFIG_IIO is not set
+# CONFIG_LIS3L02DQ_BUF_KFIFO is not set
+# CONFIG_LIS3L02DQ_BUF_RING_SW is not set
+# CONFIG_AD2S1210_GPIO_INPUT is not set
+# CONFIG_AD2S1210_GPIO_OUTPUT is not set
+# CONFIG_AD2S1210_GPIO_NONE is not set
 # CONFIG_XVMALLOC is not set
 # CONFIG_ZRAM is not set
 # CONFIG_FB_SM7XX is not set
+# CONFIG_EASYCAP_SND is not set
 CONFIG_MACH_NO_WESTBRIDGE=y
 # CONFIG_ATH6K_LEGACY is not set
 # CONFIG_USB_ENESTORAGE is not set
@@ -2381,6 +2398,10 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_EFS_FS is not set
 # CONFIG_YAFFS_FS is not set
 # CONFIG_JFFS2_FS is not set
+# CONFIG_JFFS2_CMODE_NONE is not set
+# CONFIG_JFFS2_CMODE_PRIORITY is not set
+# CONFIG_JFFS2_CMODE_SIZE is not set
+# CONFIG_JFFS2_CMODE_FAVOURLZO is not set
 # CONFIG_LOGFS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
@@ -2390,6 +2411,9 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
+# CONFIG_ROMFS_BACKED_BY_BLOCK is not set
+# CONFIG_ROMFS_BACKED_BY_MTD is not set
+# CONFIG_ROMFS_BACKED_BY_BOTH is not set
 # CONFIG_PSTORE is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
@@ -2595,6 +2619,10 @@ CONFIG_SECURITY_MIDDLEWARE_COMPONENT=y
 # CONFIG_SMC_KERNEL_CRYPTO is not set
 CONFIG_SECURE_TRACE=y
 # CONFIG_TF_DRIVER_DEBUG_SUPPORT is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
 CONFIG_DEFAULT_SECURITY="" 
 CONFIG_CRYPTO=y

Didn't fix it.

replicant-4.0/kernel/samsung/tuna/drivers/rpmsg$ grep rpmsg-omx -r *
rpmsg_omx.c:                        "rpmsg-omx");
rpmsg_omx.c:            "rpmsg-omx%d", minor);
rpmsg_omx.c:    { .name    = "rpmsg-omx" },
replicant-4.0/kernel/samsung/tuna/drivers/rpmsg$ grep pvr -r *
rpmsg_omx.c:#include "../gpu/pvr/ion.h" 
rpmsg_omx.c:        struct ion_client *pvr_ion_client;
rpmsg_omx.c:        handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
rpmsg_omx.c:            !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {

TODO

  • investigate why the kernel fails without the PVR here:
    static u32 _rpmsg_omx_buffer_lookup(struct rpmsg_omx_instance *omx, long buffer)
    {
        phys_addr_t pa;
        u32 va;
    #ifdef CONFIG_ION_OMAP
        struct ion_handle *handle;
        ion_phys_addr_t paddr;
        size_t unused;
        int fd;
    
        /* is it an ion handle? */
        handle = (struct ion_handle *)buffer;
        if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {
            pa = (phys_addr_t) paddr;
            goto to_va;
        }
    #ifdef CONFIG_PVR_SGX
        /* how about an sgx buffer wrapping an ion handle? */
        {
            struct ion_client *pvr_ion_client;
            fd = buffer;
            handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
            if (handle &&
                !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
                pa = (phys_addr_t)paddr;
                goto to_va;
            }
        }
    #endif
    #endif
        pa = (phys_addr_t) tiler_virt2phys(buffer);
    
    #ifdef CONFIG_ION_OMAP
    to_va:
    #endif
        va = _rpmsg_pa_to_da(pa);
        return va;
    }
    

    That has to be corelated with:
    <6>[  111.117462] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 0) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
    <6>[  111.117584] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
    <6>[  111.117706] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]
    

Newer infos from the kernel

static ssize_t rpmsg_omx_write(struct file *filp, const char __user *ubuf,
                                                size_t len, loff_t *offp)
{
        struct rpmsg_omx_instance *omx = filp->private_data;
        struct rpmsg_omx_service *omxserv = omx->omxserv;
        char kbuf[512];
        struct omx_msg_hdr *hdr = (struct omx_msg_hdr *) kbuf;
        int use, ret;

        if (omx->state != OMX_CONNECTED)
                return -ENOTCONN;

        /*
         * for now, limit msg size to 512 bytes (incl. header).
         * (note: rpmsg's limit is even tighter. this whole thing needs fixing)
         */
        use = min(sizeof(kbuf) - sizeof(*hdr), len);

        /*
         * copy the data. Later, number of copies can be optimized if found to
         * be significant in real use cases
         */
        if (copy_from_user(hdr->data, ubuf, use))
                return -EMSGSIZE;

        ret = _rpmsg_omx_map_buf(omx, hdr->data);
        if (ret < 0)
                return ret;

        hdr->type = OMX_RAW_MSG;
        hdr->flags = 0;
        hdr->len = use;

        use += sizeof(*hdr);

        ret = rpmsg_send_offchannel(omxserv->rpdev, omx->ept->addr,
                                                omx->dst, kbuf, use);
        if (ret) {
                dev_err(omxserv->dev, "rpmsg_send failed: %d\n", ret);
                return ret;
        }

        return use;
}

So it copies the userspace data to hdr->data and passes it to _rpmsg_omx_map_buf
ret = _rpmsg_omx_map_buf(omx, hdr->data);

Then _rpmsg_omx_map_buf is like that:

static int _rpmsg_omx_map_buf(struct rpmsg_omx_instance *omx, char *packet)
{
    int ret = -EINVAL, offset = 0;
    long *buffer;
    char *data;
    enum rpc_omx_map_info_type maptype;
    u32 da = 0;

    data = (char *)((struct omx_packet *)packet)->data;
    maptype = *((enum rpc_omx_map_info_type *)data);

    /*Nothing to map*/
    if (maptype == RPC_OMX_MAP_INFO_NONE)
        return 0;
    if ((maptype != RPC_OMX_MAP_INFO_THREE_BUF) &&
        (maptype != RPC_OMX_MAP_INFO_TWO_BUF) &&
            (maptype != RPC_OMX_MAP_INFO_ONE_BUF))
        return ret;

    offset = *(int *)((int)data + sizeof(maptype));
    buffer = (long *)((int)data + offset);

    da = _rpmsg_omx_buffer_lookup(omx, *buffer);
    printk("[DBG] [%s] da = %x \n",__func__,da);
    if (da) {
            printk("[DBG] [%s] inside da\n",__func__);    
        *buffer = da;
        ret = 0;
    }else {
        printk("[DBG] [%s] outside da\n",__func__);
    }

    if (!ret && (maptype >= RPC_OMX_MAP_INFO_TWO_BUF)) {
        buffer = (long *)((int)data + offset + sizeof(*buffer));
        if (*buffer != 0) {
            ret = -EIO;
            da = _rpmsg_omx_buffer_lookup(omx, *buffer);
            if (da) {
                *buffer = da;
                ret = 0;
            }
        }
    }

    if (!ret && maptype >= RPC_OMX_MAP_INFO_THREE_BUF) {
        buffer = (long *)((int)data + offset + 2*sizeof(*buffer));
        if (*buffer != 0) {
            ret = -EIO;
            da = _rpmsg_omx_buffer_lookup(omx, *buffer);
            if (da) {
                *buffer = da;
                ret = 0;
            }
        }
    }
    return ret;
}

It calls

da = _rpmsg_omx_buffer_lookup(omx, *buffer);
which is like that:
static u32 _rpmsg_omx_buffer_lookup(struct rpmsg_omx_instance *omx, long buffer)
{
    phys_addr_t pa;
    u32 va;
#ifdef CONFIG_ION_OMAP
    struct ion_handle *handle;
    ion_phys_addr_t paddr;
    size_t unused;
    int fd;

    /* is it an ion handle? */
    handle = (struct ion_handle *)buffer;
    printk("[DBG] handle:%x\n",handle);
    if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {
        printk("[DBG] is ion_phys\n");
        pa = (phys_addr_t) paddr;
        goto to_va;
    }
#if 0
#ifdef CONFIG_PVR_SGX
    printk("[DBG] INSIDE CONFIG_PVR_SGX\n");
    /* how about an sgx buffer wrapping an ion handle? */
    {
        struct ion_client *pvr_ion_client;
        fd = buffer;
        handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
        printk("[DBG] [INSIDE CONFIG_PVR_SGX] handle:%x\n",handle);
        if (handle &&
            !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
            printk("[DBG] [INSIDE CONFIG_PVR_SGX] goto to_va\n");
            pa = (phys_addr_t)paddr;
            goto to_va;
        }
    }
#endif
#endif
#endif
    printk("[DBG] [after CONFIG_PVR_SGX]\n");
    pa = (phys_addr_t) tiler_virt2phys(buffer);
    printk("[DBG] [after CONFIG_PVR_SGX] pa = %x \n");

#ifdef CONFIG_ION_OMAP
to_va:
#endif
    printk("[DBG] [to_va] \n");
    va = _rpmsg_pa_to_da(pa);
    printk("[DBG] [to_va] = %x \n",va);
    return va;
}

which calls

/*
 * TODO: Need to do this using lookup with rproc, but rproc is not
 * visible to rpmsg_omx
 */
#define TILER_START    0x60000000
#define TILER_END    0x80000000
#define ION_1D_START    0xBA300000
#define ION_1D_END    0xBFD00000
#define ION_1D_VA    0x88000000
static u32 _rpmsg_pa_to_da(u32 pa)
{
    if (pa >= TILER_START && pa < TILER_END){
        printk("[DBG] TILER\n");
        return pa;
    }
    else if (pa >= ION_1D_START && pa < ION_1D_END){
                printk("[DBG] ION\n");
        return (pa - ION_1D_START + ION_1D_VA);
    }
    else{
               printk("[DBG] ELSE(not tiler and not ion)\n");
    }
        return 0;
}

which prints ION for the 2 good buffers and print ELSE for the bad buffer(the one which produces the EINVAL in write)...

then _rpmsg_omx_buffer_lookup returns 0 which results in:

static int _rpmsg_omx_map_buf(struct rpmsg_omx_instance *omx, char *packet)
{
    int ret = -EINVAL, offset = 0;
[...]
    da = _rpmsg_omx_buffer_lookup(omx, *buffer);
    printk("[DBG] [%s] da = %x \n",__func__,da);
    if (da) {
->not reached
            printk("[DBG] [%s] inside da\n",__func__);    
        *buffer = da;
        ret = 0;
    }else {
->reached
        printk("[DBG] [%s] outside da\n",__func__);
    }

    if (!ret && (maptype >= RPC_OMX_MAP_INFO_TWO_BUF)) {
        [...] (not reached)
    }

    if (!ret && maptype >= RPC_OMX_MAP_INFO_THREE_BUF) {
        [...] (not reached)
    }
    return ret;
}

Runtime tests.

Running replicant kernel with:

#if 0
#ifdef CONFIG_PVR_SGX
        printk("[DBG] INSIDE CONFIG_PVR_SGX\n");
        /* how about an sgx buffer wrapping an ion handle? */
        {
                struct ion_client *pvr_ion_client;
                fd = buffer;
                handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
                printk("[DBG] [INSIDE CONFIG_PVR_SGX] handle:%x\n",handle);
                if (handle &&
                        !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
                        printk("[DBG] [INSIDE CONFIG_PVR_SGX] goto to_va\n");
                        pa = (phys_addr_t)paddr;
                        goto to_va;
                }
        }
#endif
#endif

with cyanogenmod userspace produces the same issue:

D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nConfigIndex = 117440523, pConfigStruct = 0x41365b50
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0 index: 0x2000001
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0 index: 0x2000001
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nConfigIndex = 2130706541, pConfigStruct = 0x41365b58
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, eCmd = 3, nParam = 2, pCmdData = 0x0
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 2130706545, pParamStruct = 0x41365ba0
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nPortIndex = 0x2, pAppPrivate = 0x0, nSizeBytes = 1142784, pBuffer = 0x1046f40
D/DOMX    (  135): TRACE: In UB, no. of buffers = 0
D/DOMX    (  135): TRACE: Preparing buffer to Remote Core...
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    (  135): TRACE: Port Number: 2 :: NumOfLines 720
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 2130706550, pParamStruct = 0x41365b34
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0 index: 0x7f000076
D/DOMX    (  135): TRACE: Metadata size = 12332
D/DOMX    (  135): TRACE: ION being USED for allocation!!!!! handle = c63ccd80, ret =0
D/DOMX    (  135): TRACE: Metadata buffer ion handle = -969093760
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Marshaling data
D/DOMX    (  135): TRACE: eMapInfo = 3
D/DOMX    (  135): TRACE: UV buffer fd= 109
D/DOMX    (  135): TRACE: Metadata buffer = -969093760
D/DOMX    (  135): TRACE: About to send packet
D/DOMX    (  135): ERROR: DOMX Write failed 0xffffffff -1
D/DOMX    (  135): ERROR: failed check:status >= 0 - returning error: 0x81001 - Write failed
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): ERROR: RPC function returned error 0x81001
D/DOMX    (  135): TRACE: Use Buffer Successful
D/DOMX    (  135): TRACE: Value of pBufHeaderRemote: 0x0 LocalBufferHdr :0x104f118, LocalBuffer :0x1046f40
D/DOMX    (  135): TRACE: Metadata buffer ion handle given to ion map = -969093760
D/DOMX    (  135): TRACE: Updating no. of buffer to 1
D/DOMX    (  135): EXIT: eError: -2147479551
E/CameraHAL(  135): OMX_UseBuffer-0x80001001
E/CameraHAL(  135): Exiting function UseBuffersPreview because of ret 0 eError=80001001
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0
E/ion     (  135): ioctl -1073460991 failed with code -1: Bad file number
F/libc    (  135): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree
F/libc    (  135): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/DEBUG   (  130): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (  130): Build fingerprint: 'google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys'
I/DEBUG   (  130): pid: 135, tid: 187  >>> /system/bin/mediaserver <<<
I/DEBUG   (  130): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad
I/DEBUG   (  130):  r0 deadbaad  r1 00000001  r2 a0000000  r3 00000000
I/DEBUG   (  130):  r4 00000000  r5 00000027  r6 401022f4  r7 401104d4
I/DEBUG   (  130):  r8 0104f170  r9 40110600  10 01040eb0  fp 010387fc
I/DEBUG   (  130):  ip ffffffff  sp 413659c0  lr 400e3441  pc 400df788  cpsr 60000030
I/DEBUG   (  130):  d0  656c696620646120  d1  653766333031786e
I/DEBUG   (  130):  d2  68206e6f69207275  d3  696720656c646e6d
I/DEBUG   (  130):  d4  426c61636f4c2030  d5  7264487265666675
I/DEBUG   (  130):  d6  6634303178303a20  d7  636f4c202c383131
I/DEBUG   (  130):  d8  0000000000000000  d9  0000000000000000
I/DEBUG   (  130):  d10 0000000000000000  d11 0000000000000000
I/DEBUG   (  130):  d12 0000000000000000  d13 0000000000000000
I/DEBUG   (  130):  d14 0000000000000000  d15 0000000000000000
I/DEBUG   (  130):  d16 3ff0000000000000  d17 3ff0000000000000
I/DEBUG   (  130):  d18 7e37e43c8800759c  d19 bfba43196d2f888d
I/DEBUG   (  130):  d20 3f115549a0c32687  d21 bebbbb72a4af9d58
I/DEBUG   (  130):  d22 3ff0000000000000  d23 3fecedd52e2a681e
I/DEBUG   (  130):  d24 3e66376972bea4d0  d25 3fee147ae0000000
I/DEBUG   (  130):  d26 0000000000000000  d27 0000000000000000
I/DEBUG   (  130):  d28 0000000000000000  d29 0000000000000000
I/DEBUG   (  130):  d30 0000000000000000  d31 0000000000000000
I/DEBUG   (  130):  scr 68000010
I/DEBUG   (  130): 
I/DEBUG   (  130):          #00  pc 00017788  /system/lib/libc.so
I/DEBUG   (  130):          #01  pc 00013732  /system/lib/libc.so
I/DEBUG   (  130):          #02  pc 00015a70  /system/lib/libc.so (dlfree)
I/DEBUG   (  130):          #03  pc 00016100  /system/lib/libc.so (free)
I/DEBUG   (  130):          #04  pc 000019e6  /system/lib/libmm_osal.so (TIMM_OSAL_Free)
I/DEBUG   (  130):          #05  pc 00005dda  /system/lib/libdomx.so (PROXY_ComponentDeInit)
I/DEBUG   (  130):          #06  pc 000018ec  /system/lib/libOMX.TI.DUCATI1.VIDEO.CAMERA.so
I/DEBUG   (  130):          #07  pc 00001df6  /system/lib/libOMX_Core.so (OMX_FreeHandle)
I/DEBUG   (  130):          #08  pc 000284fc  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter24performCleanupAfterErrorEv)
I/DEBUG   (  130):          #09  pc 0002b04e  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter17UseBuffersPreviewEPvi)
I/DEBUG   (  130):          #10  pc 0002b182  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter10useBuffersENS_13CameraAdapter10CameraModeEPvijj)
I/DEBUG   (  130):          #11  pc 00024c4c  /system/lib/hw/camera.omap4.so (_ZN7android17BaseCameraAdapter11sendCommandENS_13CameraAdapter14CameraCommandsEiii)
I/DEBUG   (  130):          #12  pc 0001d3d0  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal12startPreviewEv)
I/DEBUG   (  130):          #13  pc 0001d6de  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal16setPreviewWindowEP18preview_stream_ops)
I/DEBUG   (  130):          #14  pc 0001ae80  /system/lib/hw/camera.omap4.so (_Z25camera_set_preview_windowP13camera_deviceP18preview_stream_ops)
I/DEBUG   (  130):          #15  pc 000076cc  /system/lib/libcameraservice.so
I/DEBUG   (  130):          #16  pc 000091b4  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client16setPreviewWindowERKNS_2spINS_7IBinderEEERKNS2_I13ANativeWindowEE)
I/DEBUG   (  130):          #17  pc 000092ea  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client17setPreviewDisplayERKNS_2spINS_7SurfaceEEE)
I/DEBUG   (  130):          #18  pc 00013592  /system/lib/libcamera_client.so (_ZN7android8BnCamera10onTransactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  130):          #19  pc 00017f44  /system/lib/libbinder.so (_ZN7android7BBinder8transactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  130):          #20  pc 0001b26e  /system/lib/libbinder.so (_ZN7android14IPCThreadState14executeCommandEi)
I/DEBUG   (  130):          #21  pc 0001b44a  /system/lib/libbinder.so (_ZN7android14IPCThreadState14joinThreadPoolEb)
I/DEBUG   (  130):          #22  pc 00020744  /system/lib/libbinder.so
I/DEBUG   (  130):          #23  pc 00022a1e  /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv)
I/DEBUG   (  130):          #24  pc 00023064  /system/lib/libutils.so
I/DEBUG   (  130):          #25  pc 00012e2c  /system/lib/libc.so (__thread_entry)
I/DEBUG   (  130):          #26  pc 0001295c  /system/lib/libc.so (pthread_create)
I/DEBUG   (  130): 
I/DEBUG   (  130): code around pc:
I/DEBUG   (  130): 400df768 4623b15c 2c006824 e026d1fb b12368db  \.#F$h.,..&..h#.
I/DEBUG   (  130): 400df778 21014a17 6011447a 48124798 24002527  .J.!zD.`.G.H'%.$
I/DEBUG   (  130): 400df788 f7f47005 2106ef8c e838f7f6 460aa901  .p.....!..8....F
I/DEBUG   (  130): 400df798 f04f2006 94015380 94029303 ebe4f7f5  . O..S..........
I/DEBUG   (  130): 400df7a8 4622a905 f7f52002 f7f4ebee 2106ef78  .."F. ......x..!
I/DEBUG   (  130): 
I/DEBUG   (  130): code around lr:
I/DEBUG   (  130): 400e3420 41f0e92d 46804c0c 447c2600 68a56824  -..A.L.F.&|D$h.h
I/DEBUG   (  130): 400e3430 e0076867 300cf9b5 dd022b00 47c04628  gh.....0.+..(F.G
I/DEBUG   (  130): 400e3440 35544306 37fff117 6824d5f4 d1ee2c00  .CT5...7..$h.,..
I/DEBUG   (  130): 400e3450 e8bd4630 bf0081f0 000280be 41f0e92d  0F..........-..A
I/DEBUG   (  130): 400e3460 fb01b086 9004f602 461f4815 4615460c  .........H.F.F.F
I/DEBUG   (  130): 
I/DEBUG   (  130): memory map around addr deadbaad:
I/DEBUG   (  130): bec5b000-bec7c000 [stack]
I/DEBUG   (  130): (no map for address)
I/DEBUG   (  130): ffff0000-ffff1000 [vectors]
I/DEBUG   (  130): 
I/DEBUG   (  130): stack:
I/DEBUG   (  130):     41365980  00000001  
I/DEBUG   (  130):     41365984  413659c0  
I/DEBUG   (  130):     41365988  4010b7e0  /system/lib/libc.so
I/DEBUG   (  130):     4136598c  0000000c  
I/DEBUG   (  130):     41365990  4010b780  /system/lib/libc.so
I/DEBUG   (  130):     41365994  4010b718  /system/lib/libc.so
I/DEBUG   (  130):     41365998  00000000  
I/DEBUG   (  130):     4136599c  400e3441  /system/lib/libc.so
I/DEBUG   (  130):     413659a0  00000000  
I/DEBUG   (  130):     413659a4  413659d4  
I/DEBUG   (  130):     413659a8  401022f4  /system/lib/libc.so
I/DEBUG   (  130):     413659ac  401104d4  
I/DEBUG   (  130):     413659b0  0104f170  [heap]
I/DEBUG   (  130):     413659b4  400e25ad  /system/lib/libc.so
I/DEBUG   (  130):     413659b8  df0027ad  
I/DEBUG   (  130):     413659bc  00000000  
I/DEBUG   (  130): #00 413659c0  413659bc  
I/DEBUG   (  130):     413659c4  00000001  
I/DEBUG   (  130):     413659c8  401022d8  /system/lib/libc.so
I/DEBUG   (  130):     413659cc  00000005  
I/DEBUG   (  130):     413659d0  413659ec  
I/DEBUG   (  130):     413659d4  fffffbdf  
I/DEBUG   (  130):     413659d8  413659ec  
I/DEBUG   (  130):     413659dc  413659ec  
I/DEBUG   (  130):     413659e0  401057f4  /system/lib/libc.so
I/DEBUG   (  130):     413659e4  400db737  /system/lib/libc.so
I/DEBUG   (  130): #01 413659e8  02000001  
I/DEBUG   (  130):     413659ec  20404040  
I/DEBUG   (  130):     413659f0  524f4241  
I/DEBUG   (  130):     413659f4  474e4954  
I/DEBUG   (  130):     413659f8  4e49203a  
I/DEBUG   (  130):     413659fc  494c4156  
I/DEBUG   (  130):     41365a00  45482044  
I/DEBUG   (  130):     41365a04  41205041  /dev/ashmem/OMXCodec (deleted)
I/DEBUG   (  130):     41365a08  45524444  
I/DEBUG   (  130):     41365a0c  49205353  
I/DEBUG   (  130):     41365a10  6c64204e  
I/DEBUG   (  130):     41365a14  65657266  
I/DEBUG   (  130):     41365a18  00000000  
I/DEBUG   (  130):     41365a1c  00000000  
I/DEBUG   (  130):     41365a20  8060f270  
I/DEBUG   (  130):     41365a24  a5d1751e  
I/DEBUG   (  130):     41365a28  00000060  
I/DEBUG   (  130):     41365a2c  41365a78  
I/DEBUG   (  130):     41365a30  40fb75e9  /system/lib/libdomx.so
I/DEBUG   (  130):     41365a34  40fba619  /system/lib/libdomx.so
I/DEBUG   (  130):     41365a38  0000001c  
I/DEBUG   (  130):     41365a3c  40021340  /system/lib/libmm_osal.so
I/DEBUG   (  130):     41365a40  ffffffff  
I/DEBUG   (  130):     41365a44  02000001  
I/DEBUG   (  130):     41365a48  000000fb  
I/DEBUG   (  130):     41365a4c  401104d4  
I/DEBUG   (  130):     41365a50  0104f198  [heap]
I/DEBUG   (  130):     41365a54  00000000  
I/DEBUG   (  130):     41365a58  8060f270  
I/DEBUG   (  130):     41365a5c  401104d4  
I/DEBUG   (  130):     41365a60  7f000076  
I/DEBUG   (  130):     41365a64  400dcc25  /system/lib/libc.so
I/DEBUG   (  130):     41365a68  0104f190  [heap]
I/DEBUG   (  130):     41365a6c  0104f288  [heap]
I/DEBUG   (  130):     41365a70  000000fb  
I/DEBUG   (  130):     41365a74  401104d4  
I/DEBUG   (  130):     41365a78  0104f198  [heap]
I/DEBUG   (  130):     41365a7c  00000000  
I/DEBUG   (  130):     41365a80  00000000  
I/DEBUG   (  130):     41365a84  401104d4  
I/DEBUG   (  130):     41365a88  00000002  
I/DEBUG   (  130):     41365a8c  400dcc25  /system/lib/libc.so
I/DEBUG   (  130):     41365a90  0104f190  [heap]
I/DEBUG   (  130):     41365a94  401105f0  
I/DEBUG   (  130):     41365a98  000000f8  
I/DEBUG   (  130):     41365a9c  401104d4  
I/DEBUG   (  130):     41365aa0  0104f198  [heap]
I/DEBUG   (  130):     41365aa4  0104f1ac  [heap]
I/DEBUG   (  130):     41365aa8  00000002  
I/DEBUG   (  130):     41365aac  400dda89  /system/lib/libc.so
I/DEBUG   (  130):     41365ab0  0104f118  [heap]
I/DEBUG   (  130):     41365ab4  00000024  
I/DEBUG   (  130):     41365ab8  01035ee0  [heap]
I/DEBUG   (  130):     41365abc  00000003  
I/DEBUG   (  130):     41365ac0  0000004d  
I/DEBUG   (  130):     41365ac4  41365ad4  
I/DEBUG   (  130):     41365ac8  0104f110  [heap]
I/DEBUG   (  130):     41365acc  00000001  
I/DEBUG   (  130):     41365ad0  00000178  
I/DEBUG   (  130):     41365ad4  00000001  
I/DEBUG   (  130):     41365ad8  40111280  
I/DEBUG   (  130):     41365adc  400ea8ad  /system/lib/libc.so
I/DEBUG   (  130):     41365ae0  01035ee0  [heap]
I/DEBUG   (  130):     41365ae4  01035ee0  [heap]
I/DEBUG   (  130):     41365ae8  00000000  
I/DEBUG   (  130):     41365aec  a5d1751e  
I/DEBUG   (  130):     41365af0  0104f168  [heap]
I/DEBUG   (  130):     41365af4  01035ee0  [heap]
I/DEBUG   (  130):     41365af8  00000000  
I/DEBUG   (  130):     41365afc  400dda75  /system/lib/libc.so
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
D/dalvikvm(  203): GC_FOR_ALLOC freed 3709K, 60% free 4952K/12288K, paused 29ms
W/AudioSystem(  203): AudioFlinger server died!
W/IMediaDeathNotifier(  203): media server died
W/AudioSystem(  203): AudioPolicyService server died!
W/AudioSystem(  420): AudioFlinger server died!
W/AudioSystem(  420): AudioPolicyService server died!
I/ServiceManager(  124): service 'media.audio_flinger' died
I/ServiceManager(  124): service 'media.player' died
I/ServiceManager(  124): service 'media.camera' died
I/ServiceManager(  124): service 'media.audio_policy' died
W/IMediaDeathNotifier(  437): media server died
W/Camera  (  914): Camera server died!
W/Camera  (  914): ICamera died
I/ActivityManager(  203): Displayed com.android.camera/.Camera: +4s438ms
D/CameraStorage(  914): External storage state=mounted
I/Thumbnail(  914): Fail to load bitmap. java.io.FileNotFoundException: /data/data/com.android.camera/files/last_thumb: open failed: ENOENT (No such file or directory)
E/Camera  (  914): Error 100
E/CameraErrorCallback(  914): Got camera error callback. error=100
D/AndroidRuntime(  914): Shutting down VM
W/dalvikvm(  914): threadid=1: thread exiting with uncaught exception (group=0x40a4e1f8)
I/        (  948): ServiceManager: 0x5cd958
I/AudioFlinger(  948): Loaded primary audio interface from Tuna audio HW HAL (audio)
I/AudioFlinger(  948): Using 'Tuna audio HW HAL' (audio.primary) as the primary audio interface
I/AudioFlinger(  948): Loaded a2dp audio interface from A2DP Audio HW HAL (audio)
I/CameraService(  948): CameraService started (pid=948)
I/AudioFlinger(  948): AudioFlinger's thread 0x5d44b8 ready to run
D/dalvikvm(  203): GC_FOR_ALLOC freed 1181K, 59% free 5063K/12288K, paused 27ms
I/AudioPolicyService(  948): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy)
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
E/AudioService(  203): Media server died.
E/AudioService(  203): Media server started.
W/AudioPolicyManagerBase(  948): setPhoneState() setting same state 0
W/AudioFlinger(  948): session id 13 not found for pid 203
I/Process (  914): Sending signal. PID: 914 SIG: 9
[  104.225494] binder: release proc 914, transaction 18351, not freed
[  104.234130] binder: release proc 914, transaction 18352, not freed
W/InputDispatcher(  203): channel '40f93a50 com.android.camera/com.android.camera.Camera (server)' ~ Consumer closed input channel or an error occurred.  events=0x8
E/InputDispatcher(  203): channel '40f93a50 com.android.camera/com.android.camera.Camera (server)' ~ Channel is unrecoverably broken and will be disposed!
W/InputDispatcher(  203): Attempted to unregister already unregistered input channel '40f93a50 com.android.camera/com.android.camera.Camera (server)'

The flow when it works is the following:

if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {

returns false, then what's in #ifdef CONFIG_PVR_SGX is executed, and it jumps to the end without executing
pa = (phys_addr_t) tiler_virt2phys(buffer);

The flow when it fails is the following:

if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {

returns false,then what's in #ifdef CONFIG_PVR_SGX fails or is skipped,
Then it executes
pa = (phys_addr_t) tiler_virt2phys(buffer);
and goes to the end.

Inside the PVR driver

struct ion_handle *
PVRSRVExportFDToIONHandle(int fd, struct ion_client **client)
{
[...]
    eError = PVRSRVLookupHandle(KERNEL_HANDLE_BASE,
                                (IMG_PVOID *)&psKernelMemInfo,
                                psPrivateData->hKernelMemInfo,
                                PVRSRV_HANDLE_TYPE_MEM_INFO);
[...]
Then it uses psKernelMemInfo and returns a derivative of it.
}
PVRSRV_ERROR PVRSRVLookupHandle(PVRSRV_HANDLE_BASE *psBase, IMG_PVOID *ppvData, IMG_HANDLE hHandle, PVRSRV_HANDLE_TYPE eType)
{
        struct sHandle *psHandle;
        PVRSRV_ERROR eError;

        PVR_ASSERT(eType != PVRSRV_HANDLE_TYPE_NONE)

        eError = GetHandleStructure(psBase, &psHandle, hHandle, eType);
        if (eError != PVRSRV_OK)
        {
                PVR_DPF((PVR_DBG_ERROR, "PVRSRVLookupHandle: Error looking up handle (%d)", eError));
                return eError;
        }

        *ppvData = psHandle->pvData;

        return PVRSRV_OK;
}
PVRSRV_ERROR GetHandleStructure(PVRSRV_HANDLE_BASE *psBase, struct sHandle **ppsHandle, IMG_HANDLE hHandle, PVRSRV_HANDLE_TYPE eType)
#endif
{
        IMG_UINT32 ui32Index = HANDLE_TO_INDEX(hHandle);
        struct sHandle *psHandle;

        if (!INDEX_IS_VALID(psBase, ui32Index))
        {
                PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle index out of range (%u >= %u)", ui32Index, psBase->ui32TotalHandCount));

                return PVRSRV_ERROR_HANDLE_INDEX_OUT_OF_RANGE;
        }

        psHandle =  INDEX_TO_HANDLE_STRUCT_PTR(psBase, ui32Index);
        if (psHandle->eType == PVRSRV_HANDLE_TYPE_NONE)
        {
                PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle not allocated (index: %u)", ui32Index));

                return PVRSRV_ERROR_HANDLE_NOT_ALLOCATED;
        }

        if (eType != PVRSRV_HANDLE_TYPE_NONE && eType != psHandle->eType)
        {
                PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle type mismatch (%d != %d)", eType, psHandle->eType));

                return PVRSRV_ERROR_HANDLE_TYPE_MISMATCH;
        }

        *ppsHandle = psHandle;

        return PVRSRV_OK;
}

#define INDEX_IS_VALID(psBase, i) ((i) < (psBase)->ui32TotalHandCount)

trying to fix the issue:

<6>[  313.967468] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 256) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  313.967681] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  313.967803] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]

was achieved with :
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(){

    int fd = open("/dev/pvrsrvkm",O_RDWR);
    printf("fd = %d\n");
    while(1)
        sleep(10000);
    return 0; //not reached
}

possible solution:

https://groleo.wordpress.com/2012/07/24/ion-buffer-sharing-mechanism/
https://groleo.wordpress.com/2012/07/31/jelly-bean-codec-infrastructure/

=> we need to modify OMXCameraAdapter.cpp not to send its acquired buffer to OMX, and instead to reimplement that part, by looking at how the TI V4l2 camera does it.

=> we probably need to replace the UseBuffer functions and look at how OMX_UseBuffer works in order to replace them:
there is a use buffer function which calls different functions according to its state, for instance OMXCameraAdapter::UseBuffersPreview which uses OMX_UseBuffer...

OMX_UseBuffer calls PROXY_UseBuffer in hardware/ti/omap4xxx/domx/domx/omx_proxy_common/src/omx_proxy_common.c


Wiki License: Creative Commons BY-SA