Project

General

Profile

OMAP4 Ducati Camera

Corresponding feature request: #351

The Galaxy Nexus and Galaxy Tab 2 chips have a camera that is accessible through the Ducati microcontroller. Some documentation can be found at omappedia.

Omap4 camera source code (used by Galaxy Tab 2, but currently disabled)
The Galaxy Nexus uses its own version, which is currently disabled as well.

In its current form, the camera source code cannot be used in Replicant. The code heavily depends on the PowerVR module which requires proprietary blobs. Below, attempts to remove this dependency are documented. Furthermore, the software renderer used with Replicant only works well with RGB565 as preview format, but the Ducati camera does not support this preview format. It uses YV12.

Plan:

We don't support YV12 in the gralloc and in the software libgl yet.
There are several approaches to solve the issue:

Approach 1: Add support for it

Long and complicated

Approach 2: Change format:

The Camera supports the following formats:
compile,push, and run the omap4 camera_test program with the "F" argument:
Here for the back camera:

   Choice: E
E
E
    Supported Cameras: (null)
    Supported Picture Sizes: 2592x1944,2592x1728,2592x1458,2048x1536,1600x1200,1280x1024,1152x864,1280x960,640x480,320x240
    Supported Picture Formats: yuv420sp,yuv420p,yuv422i-yuyv,rgb565,raw,jpeg
    Supported Preview Sizes: 1920x1080,1280x720,960x720,800x480,720x576,720x480,768x576,640x480,320x240,352x288,240x160,176x144,128x96
    Supported Preview Formats: yuv420sp,yuv420p,yuv422i-yuyv,yuv420p
    Supported Preview Frame Rates: 30,15
    Supported Thumbnail Sizes: 640x480,160x120,200x120,320x240,512x384,352x144,176x144,96x96,0x0
    Supported Whitebalance Modes: auto,daylight,cloudy-daylight,fluorescent,incandescent,
    Supported Effects: none,negative,solarize,sepia,mono,whiteboard,blackboard,aqua,posterize
    Supported Scene Modes: auto,action,night,party,sunset
    Supported Focus Modes: continuous-video,auto,macro,infinity,infinity,continuous-picture
    Supported Antibanding Options: auto,50hz,60hz,off
    Supported Flash Modes: off,on,auto,torch
    Supported Focus Areas: 10
    Focus Distances: Infinity,Infinity,Infinity 

Approach 3: Workaround

diff --git a/libs/ui/GraphicBufferAllocator.cpp b/libs/ui/GraphicBufferAllocator.cpp
index f7c4f4e..766a98f 100644
--- a/libs/ui/GraphicBufferAllocator.cpp
+++ b/libs/ui/GraphicBufferAllocator.cpp
@@ -99,8 +99,8 @@ status_t GraphicBufferAllocator::alloc(uint32_t w, uint32_t h, PixelFormat forma
     // we have a h/w allocator and h/w buffer is requested
     status_t err; 

-#ifdef MISSING_EGL_PIXEL_FORMAT_YV12
-    if (format == HAL_PIXEL_FORMAT_YV12) {
+#if 1
+    if (format == HAL_PIXEL_FORMAT_YV12 || format == 0x100 ) {
        format = HAL_PIXEL_FORMAT_RGBX_8888;
     }
     if (usage & GRALLOC_USAGE_EXTERNAL_DISP) {
diff --git a/media/libstagefright/colorconversion/SoftwareRenderer.cpp b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
index 2ce8fa7..abe68dd 100644
--- a/media/libstagefright/colorconversion/SoftwareRenderer.cpp
+++ b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
@@ -62,7 +62,7 @@ SoftwareRenderer::SoftwareRenderer(
     size_t bufWidth, bufHeight;

     switch (mColorFormat) {
-#ifndef MISSING_EGL_PIXEL_FORMAT_YV12
+#if 0
         case OMX_COLOR_FormatYUV420Planar:
         case OMX_TI_COLOR_FormatYUV420PackedSemiPlanar:
         {

Research

Using the camera application produces the following traces:

[...]
V/camera  ( 7834): Preview size is 960x720
V/MediaProfilesJNI( 7834): native_get_num_image_encoding_quality_levels
V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level
V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level
V/MediaProfilesJNI( 7834): native_get_image_encoding_quality_level
D/CameraSettings( 7834): Parameters: [antibanding-values=auto,50hz,60hz,off, antibanding=auto, auto-convergence-mode=, auto-convergence=, auto-exposure-lock-supported=true, auto-exposure-lock=false, auto-whitebalance-lock-supported=true, auto-whitebalance-lock=false, brightness=50, camera-mode=0, camera-name=S5K4E1GA, contrast=100, current-iso=100, effect-values=none,negative,solarize,sepia,mono,whiteboard,blackboard,aqua,posterize, effect=none, exif-make=Samsung, exif-model=Galaxy Nexus, exposure-compensation-step=0.1, exposure-compensation=0, exposure-mode-values=auto,night,backlighting,spotlight,sports,snow,beach,aperture,small-aperture,, exposure=auto, flash-mode-values=off,on,auto,torch, flash-mode=auto, focal-length=3.43, focus-distances=Infinity,Infinity,Infinity, focus-mode-values=continuous-video,auto,macro,infinity,infinity,continuous-picture, focus-mode=continuous-picture, gbce=disable, horizontal-view-angle=54.8, ipp-values=off,ldc,nsf,ldc-nsf, ipp=ldc-nsf, iso-mode-values=auto,100,200,400,800, iso=auto, jpeg-quality=95, jpeg-thumbnail-height=120, jpeg-thumbnail-quality=60, jpeg-thumbnail-size-values=640x480,160x120,200x120,320x240,512x384,352x144,176x144,96x96,0x0, jpeg-thumbnail-width=160, manual-convergence-values=, max-exposure-compensation=30, max-framerate=30, max-num-detected-faces-hw=35, max-num-detected-faces-sw=0, max-num-focus-areas=10, max-num-metering-areas=10, max-zoom=60, min-exposure-compensation=-30, min-framerate=15, picture-format-values=yuv420sp,yuv420p,yuv422i-yuyv,rgb565,raw,jpeg, picture-format=jpeg, picture-size-values=2592x1944,2592x1728,2592x1458,2048x1536,1600x1200,1280x1024,1152x864,1280x960,640x480,320x240, picture-size=2592x1944, preview-format-values=yuv420sp,yuv420p,yuv422i-yuyv,yuv420p, preview-format=yuv420sp, preview-fps-range-values=(15000,15000),(15000,30000),(24000,30000), preview-fps-range=15000,30000, preview-frame-rate-values=30,15, preview-frame-rate=30, preview-size-values=1920x1080,1280x720,960x720,800x480,720x576,720x480,768x576,640x480,320x240,352x288,240x160,176x144,128x96, preview-size=960x720, recording-hint=false, s3d-supported=, s3d2d-preview-values=, s3d2d-preview=, saturation=100, scene-mode-values=auto,action,night,party,sunset, scene-mode=auto, sensor-orientation-values=, sensor-orientation=, sharpness=100, smooth-zoom-supported=true, vertical-view-angle=42.5, video-frame-format=OMX_TI_COLOR_FormatYUV420PackedSemiPlanar, video-snapshot-supported=true, video-stabilization-supported=true, video-stabilization=false, whitebalance-values=auto,daylight,cloudy-daylight,fluorescent,incandescent,, whitebalance=auto, zoom-ratios=100,104,107,111,115,119,123,127,132,137,141,146,152,157,162,168,174,180,187,193,200,207,214,222,230,238,246,255,264,273,283,293,303,314,325,336,348,361,373,386,400,414,429,444,459,476,492,510,528,546,566,586,606,628,650,673,696,721,746,773,800, zoom-supported=true, zoom=0]
V/camera  ( 7834): startPreview
I/CameraHAL( 7751): NULL ANativeWindow passed to setPreviewWindow
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706507, pParamStruct = 0x41b5ebd4
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706506, pParamStruct = 0x41b5ebd0
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706548, pParamStruct = 0x41b5ebc8
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706469, pParamStruct = 0x41b5ebd4
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 2130706509, pConfigStruct = 0x41b5ebbc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706515, pParamStruct = 0x41b5ebd0
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706514, pParamStruct = 0x41b5ebcc
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440522, pConfigStruct = 0x41b5ebbc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440522, pConfigStruct = 0x41b5ebbc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706522, pParamStruct = 0x41b5eb14
I/Process (  189): Sending signal. PID: 7834 SIG: 3
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
I/dalvikvm( 7834): threadid=3: reacting to signal 3
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x41b5ebc0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706522, pParamStruct = 0x41b5eb14
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x41b5eb48
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706519, pParamStruct = 0x41b5ebfc
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x7f000057
I/CameraHAL( 7751): Preview not started. Preview in progress flag set
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 2, nParam = 2, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): TRACE: 
D/DOMX    ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__**
D/DOMX    ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x2,nData2: 0x2,pEventData: 0x0
D/DOMX    ( 7751): TRACE: Just Before Entering Proxy Event handler call
D/DOMX    ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x2, nData2=0x2, pEventData=0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 0, nParam = 2, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): TRACE: 
D/DOMX    ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__**
D/DOMX    ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x0,nData2: 0x2,pEventData: 0x0
D/DOMX    ( 7751): TRACE: Just Before Entering Proxy Event handler call
D/DOMX    ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x0, nData2=0x2, pEventData=0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 0, nParam = 3, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: 
D/DOMX    ( 7751): **__**Got eventhandler from Remote Core succesffuly - values are : **__**
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): TRACE: hComp :0x154e570,eEvent: 0x0,nData1: 0x0,nData2: 0x3,pEventData: 0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): TRACE: Just Before Entering Proxy Event handler call
D/DOMX    ( 7751): ENTER: hComponent=0x154e570, pCompPrv=0x1556240, eEvent=0x0, nData1=0x0, nData2=0x3, pEventData=0x0
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
V/camera  ( 7834): surfaceChanged. w=720. h=960
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 117440523, pConfigStruct = 0x413a1b50
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetConfig:564
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetParameter:348
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 33554433, pParamStruct = 0x413a1ad8
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x2000001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nConfigIndex = 2130706541, pConfigStruct = 0x413a1b58
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SetConfig:496
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, eCmd = 3, nParam = 2, pCmdData = 0x0
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_SendCommand:644
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706545, pParamStruct = 0x413a1ba0
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nPortIndex = 0x2, pAppPrivate = 0x0, nSizeBytes = 1142784, pBuffer = 0x154a580
D/DOMX    ( 7751): TRACE: In UB, no. of buffers = 0
D/DOMX    ( 7751): TRACE: Preparing buffer to Remote Core...
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1037
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    ( 7751): TRACE: Port Number: 2 :: NumOfLines 720
D/DOMX    ( 7751): EXIT: eError: 0
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1047
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570, pCompPrv = 0x1556240, nParamIndex = 2130706550, pParamStruct = 0x413a1b34
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_GetParameter:419
D/DOMX    ( 7751): TRACE: Recd. omx message
D/DOMX    ( 7751): TRACE: Waiting for messages from remote core
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): TRACE: Corresponding RPC function executed successfully
D/DOMX    ( 7751): EXIT: eError: 0 index: 0x7f000076
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1116
D/DOMX    ( 7751): TRACE: Metadata size = 12332
D/DOMX    ( 7751): TRACE: ion_fd=70
D/DOMX    ( 7751): TRACE: ION being USED for allocation!!!!! handle = c3e30380, ret =0
D/DOMX    ( 7751): ERROR: [DBG] eError = 0, line 1130
D/DOMX    ( 7751): TRACE: Metadata buffer ion handle = c3e30380
D/DOMX    ( 7751): ENTER: 
D/DOMX    ( 7751): TRACE: Marshaling data
D/DOMX    ( 7751): TRACE: eMapInfo = 3
D/DOMX    ( 7751): TRACE: UV buffer fd= 3141592
D/DOMX    ( 7751): TRACE: Metadata buffer = c3e30380
D/DOMX    ( 7751): TRACE: About to send packet
D/DOMX    ( 7751): TRACE: RPC_sendPacket_sync hCtx->fd_omx=26|nPacketSize=240
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync RPC_UseBuffer:1080
D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync write errno error 22
D/DOMX    ( 7751): ERROR: DOMX Write failed 0xffffffff -1
D/DOMX    ( 7751): ERROR: failed check:status >= 0 - returning error: 0x81001 - Write failed
D/DOMX    ( 7751): EXIT: 
D/DOMX    ( 7751): ERROR: RPC function returned error 0x81001
D/DOMX    ( 7751): TRACE: Use Buffer Successful
D/DOMX    ( 7751): TRACE: Value of pBufHeaderRemote: 0x0 LocalBufferHdr :0x15714e8, LocalBuffer :0x154a580
D/DOMX    ( 7751): TRACE: Metadata buffer ion handle given to ion map = c3e30380
D/DOMX    ( 7751): TRACE: Updating no. of buffer to 1
D/DOMX    ( 7751): ERROR: [DBG] eError = -2147479551, line 1192
D/DOMX    ( 7751): EXIT: eError: -2147479551
E/CameraHAL( 7751): OMX_UseBuffer-0x80001001
E/CameraHAL( 7751): Exiting function UseBuffersPreview because of ret 0 eError=80001001
D/DOMX    ( 7751): ENTER: hComponent = 0x154e570
E/ion     ( 7751): ioctl -1073460991 failed with code -1: Bad file number
F/libc    ( 7751): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree
F/libc    ( 7751): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
I/DEBUG   (  127): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (  127): Build fingerprint: 'google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys'
I/DEBUG   (  127): pid: 7751, tid: 7758  >>> /system/bin/mediaserver <<<
I/DEBUG   (  127): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad
I/DEBUG   (  127):  r0 deadbaad  r1 00000001  r2 a0000000  r3 00000000
I/DEBUG   (  127):  r4 00000000  r5 00000027  r6 401342f4  r7 401424d4
I/DEBUG   (  127):  r8 01571540  r9 40fe1000  10 0155f9a0  fp 01570e5c
I/DEBUG   (  127):  ip ffffffff  sp 413a19c0  lr 40115441  pc 40111788  cpsr 600f0030
I/DEBUG   (  127):  d0  656c696620646120  d1  373565343531786e
I/DEBUG   (  127):  d2  6c202c3135353975  d3  3239313120656e6d
I/DEBUG   (  127):  d4  7264487265666675  d5  3137353178303a20
I/DEBUG   (  127):  d6  636f4c202c386534  d7  7265666675426c61
I/DEBUG   (  127):  d8  0000000000000000  d9  0000000000000000
I/DEBUG   (  127):  d10 0000000000000000  d11 0000000000000000
I/DEBUG   (  127):  d12 0000000000000000  d13 0000000000000000
I/DEBUG   (  127):  d14 0000000000000000  d15 0000000000000000
I/DEBUG   (  127):  d16 3f7316d1d399f1e0  d17 3ffd42315763b9eb
I/DEBUG   (  127):  d18 4000000000000000  d19 3fc5ee7544e230aa
I/DEBUG   (  127):  d20 3f1152f62f5a4167  d21 bebbb7b7df4a3093
I/DEBUG   (  127):  d22 3ff0000000000000  d23 3ff316d1d399f1e0
I/DEBUG   (  127):  d24 3e66376972bea4d0  d25 3fee147ae0000000
I/DEBUG   (  127):  d26 0000000000000000  d27 0000000000000000
I/DEBUG   (  127):  d28 0000000000000000  d29 0000000000000000
I/DEBUG   (  127):  d30 0000000000000000  d31 0000000000000000
I/DEBUG   (  127):  scr 68000010
I/DEBUG   (  127): 
I/DEBUG   (  127):          #00  pc 00017788  /system/lib/libc.so
I/DEBUG   (  127):          #01  pc 00013732  /system/lib/libc.so
I/DEBUG   (  127):          #02  pc 00015a70  /system/lib/libc.so (dlfree)
I/DEBUG   (  127):          #03  pc 00016100  /system/lib/libc.so (free)
I/DEBUG   (  127):          #04  pc 000019e6  /system/lib/libmm_osal.so (TIMM_OSAL_Free)
I/DEBUG   (  127):          #05  pc 00006446  /system/lib/libdomx.so (PROXY_ComponentDeInit)
I/DEBUG   (  127):          #06  pc 000018ec  /system/lib/libOMX.TI.DUCATI1.VIDEO.CAMERA.so
I/DEBUG   (  127):          #07  pc 00001df6  /system/lib/libOMX_Core.so (OMX_FreeHandle)
I/DEBUG   (  127):          #08  pc 000284fc  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter24performCleanupAfterErrorEv)
I/DEBUG   (  127):          #09  pc 0002b04e  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter17UseBuffersPreviewEPvi)
I/DEBUG   (  127):          #10  pc 0002b182  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter10useBuffersENS_13CameraAdapter10CameraModeEPvijj)
I/DEBUG   (  127):          #11  pc 00024c4c  /system/lib/hw/camera.omap4.so (_ZN7android17BaseCameraAdapter11sendCommandENS_13CameraAdapter14CameraCommandsEiii)
I/DEBUG   (  127):          #12  pc 0001d3d0  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal12startPreviewEv)
I/DEBUG   (  127):          #13  pc 0001d6de  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal16setPreviewWindowEP18preview_stream_ops)
I/DEBUG   (  127):          #14  pc 0001ae80  /system/lib/hw/camera.omap4.so (_Z25camera_set_preview_windowP13camera_deviceP18preview_stream_ops)
I/DEBUG   (  127):          #15  pc 000076cc  /system/lib/libcameraservice.so
I/DEBUG   (  127):          #16  pc 000091b4  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client16setPreviewWindowERKNS_2spINS_7IBinderEEERKNS2_I13ANativeWindowEE)
I/DEBUG   (  127):          #17  pc 000092ea  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client17setPreviewDisplayERKNS_2spINS_7SurfaceEEE)
I/DEBUG   (  127):          #18  pc 00013592  /system/lib/libcamera_client.so (_ZN7android8BnCamera10onTransactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  127):          #19  pc 00017f44  /system/lib/libbinder.so (_ZN7android7BBinder8transactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  127):          #20  pc 0001b26e  /system/lib/libbinder.so (_ZN7android14IPCThreadState14executeCommandEi)
I/DEBUG   (  127):          #21  pc 0001b44a  /system/lib/libbinder.so (_ZN7android14IPCThreadState14joinThreadPoolEb)
I/DEBUG   (  127):          #22  pc 00020744  /system/lib/libbinder.so
I/DEBUG   (  127):          #23  pc 00022a1e  /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv)
I/DEBUG   (  127):          #24  pc 00023064  /system/lib/libutils.so
I/DEBUG   (  127):          #25  pc 00012e2c  /system/lib/libc.so (__thread_entry)
I/DEBUG   (  127):          #26  pc 0001295c  /system/lib/libc.so (pthread_create)
I/DEBUG   (  127): 
I/DEBUG   (  127): code around pc:
I/DEBUG   (  127): 40111768 4623b15c 2c006824 e026d1fb b12368db  \.#F$h.,..&..h#.
I/DEBUG   (  127): 40111778 21014a17 6011447a 48124798 24002527  .J.!zD.`.G.H'%.$
I/DEBUG   (  127): 40111788 f7f47005 2106ef8c e838f7f6 460aa901  .p.....!..8....F
I/DEBUG   (  127): 40111798 f04f2006 94015380 94029303 ebe4f7f5  . O..S..........
I/DEBUG   (  127): 401117a8 4622a905 f7f52002 f7f4ebee 2106ef78  .."F. ......x..!
I/DEBUG   (  127): 
I/DEBUG   (  127): code around lr:
I/DEBUG   (  127): 40115420 41f0e92d 46804c0c 447c2600 68a56824  -..A.L.F.&|D$h.h
I/DEBUG   (  127): 40115430 e0076867 300cf9b5 dd022b00 47c04628  gh.....0.+..(F.G
I/DEBUG   (  127): 40115440 35544306 37fff117 6824d5f4 d1ee2c00  .CT5...7..$h.,..
I/DEBUG   (  127): 40115450 e8bd4630 bf0081f0 000280be 41f0e92d  0F..........-..A
I/DEBUG   (  127): 40115460 fb01b086 9004f602 461f4815 4615460c  .........H.F.F.F
I/DEBUG   (  127): 
I/DEBUG   (  127): memory map around addr deadbaad:
I/DEBUG   (  127): bede2000-bee03000 [stack]
I/DEBUG   (  127): (no map for address)
I/DEBUG   (  127): ffff0000-ffff1000 [vectors]
I/DEBUG   (  127): 
I/DEBUG   (  127): stack:
I/DEBUG   (  127):     413a1980  00000001  
I/DEBUG   (  127):     413a1984  413a19c0  
I/DEBUG   (  127):     413a1988  4013d7e0  /system/lib/libc.so
I/DEBUG   (  127):     413a198c  0000000c  
I/DEBUG   (  127):     413a1990  4013d780  /system/lib/libc.so
I/DEBUG   (  127):     413a1994  4013d718  /system/lib/libc.so
I/DEBUG   (  127):     413a1998  00000000  
I/DEBUG   (  127):     413a199c  40115441  /system/lib/libc.so
I/DEBUG   (  127):     413a19a0  00000000  
I/DEBUG   (  127):     413a19a4  413a19d4  
I/DEBUG   (  127):     413a19a8  401342f4  /system/lib/libc.so
I/DEBUG   (  127):     413a19ac  401424d4  
I/DEBUG   (  127):     413a19b0  01571540  [heap]
I/DEBUG   (  127):     413a19b4  401145ad  /system/lib/libc.so
I/DEBUG   (  127):     413a19b8  df0027ad  
I/DEBUG   (  127):     413a19bc  00000000  
I/DEBUG   (  127): #00 413a19c0  413a19bc  
I/DEBUG   (  127):     413a19c4  00000001  
I/DEBUG   (  127):     413a19c8  401342d8  /system/lib/libc.so
I/DEBUG   (  127):     413a19cc  00000005  
I/DEBUG   (  127):     413a19d0  413a19ec  
I/DEBUG   (  127):     413a19d4  fffffbdf  
I/DEBUG   (  127):     413a19d8  413a19ec  
I/DEBUG   (  127):     413a19dc  413a19ec  
I/DEBUG   (  127):     413a19e0  401377f4  /system/lib/libc.so
I/DEBUG   (  127):     413a19e4  4010d737  /system/lib/libc.so
I/DEBUG   (  127): #01 413a19e8  01571560  [heap]
I/DEBUG   (  127):     413a19ec  20404040  
I/DEBUG   (  127):     413a19f0  524f4241  
I/DEBUG   (  127):     413a19f4  474e4954  
I/DEBUG   (  127):     413a19f8  4e49203a  
I/DEBUG   (  127):     413a19fc  494c4156  
I/DEBUG   (  127):     413a1a00  45482044  
I/DEBUG   (  127):     413a1a04  41205041  /dev/snd/pcmC0D0p
I/DEBUG   (  127):     413a1a08  45524444  
I/DEBUG   (  127):     413a1a0c  49205353  
I/DEBUG   (  127):     413a1a10  6c64204e  
I/DEBUG   (  127):     413a1a14  65657266  
I/DEBUG   (  127):     413a1a18  00000000  
I/DEBUG   (  127):     413a1a1c  17f80cb3  
I/DEBUG   (  127):     413a1a20  00000000  
I/DEBUG   (  127):     413a1a24  00000060  
I/DEBUG   (  127):     413a1a28  40fa4b13  /system/lib/libdomx.so
I/DEBUG   (  127):     413a1a2c  40fa7c7d  /system/lib/libdomx.so
I/DEBUG   (  127):     413a1a30  00000020  
I/DEBUG   (  127):     413a1a34  40f95340  /system/lib/libmm_osal.so
I/DEBUG   (  127):     413a1a38  ffffffff  
I/DEBUG   (  127):     413a1a3c  02000001  
I/DEBUG   (  127):     413a1a40  000000fb  
I/DEBUG   (  127):     413a1a44  401424d4  
I/DEBUG   (  127):     413a1a48  01571568  [heap]
I/DEBUG   (  127):     413a1a4c  00000000  
I/DEBUG   (  127):     413a1a50  00000000  
I/DEBUG   (  127):     413a1a54  401424d4  
I/DEBUG   (  127):     413a1a58  7f000076  
I/DEBUG   (  127):     413a1a5c  4010ec25  /system/lib/libc.so
I/DEBUG   (  127):     413a1a60  01571560  [heap]
I/DEBUG   (  127):     413a1a64  01571658  [heap]
I/DEBUG   (  127):     413a1a68  000000fb  
I/DEBUG   (  127):     413a1a6c  401424d4  
I/DEBUG   (  127):     413a1a70  01571568  [heap]
I/DEBUG   (  127):     413a1a74  00000000  
I/DEBUG   (  127):     413a1a78  8060f290  
I/DEBUG   (  127):     413a1a7c  401424d4  
I/DEBUG   (  127):     413a1a80  00000002  
I/DEBUG   (  127):     413a1a84  4010ec25  /system/lib/libc.so
I/DEBUG   (  127):     413a1a88  01571560  [heap]
I/DEBUG   (  127):     413a1a8c  01571658  [heap]
I/DEBUG   (  127):     413a1a90  00006288  
I/DEBUG   (  127):     413a1a94  401424d4  
I/DEBUG   (  127):     413a1a98  01571568  [heap]
I/DEBUG   (  127):     413a1a9c  0157157c  [heap]
I/DEBUG   (  127):     413a1aa0  00000002  
I/DEBUG   (  127):     413a1aa4  4010fa89  /system/lib/libc.so
I/DEBUG   (  127):     413a1aa8  015714e8  [heap]
I/DEBUG   (  127):     413a1aac  01571568  [heap]
I/DEBUG   (  127):     413a1ab0  80001001  
I/DEBUG   (  127):     413a1ab4  00000003  
I/DEBUG   (  127):     413a1ab8  00000046  
I/DEBUG   (  127):     413a1abc  413a1acc  
I/DEBUG   (  127):     413a1ac0  015714e0  [heap]
I/DEBUG   (  127):     413a1ac4  01571538  [heap]
I/DEBUG   (  127):     413a1ac8  00006308  
I/DEBUG   (  127):     413a1acc  401424d4  
I/DEBUG   (  127):     413a1ad0  015714e8  [heap]
I/DEBUG   (  127):     413a1ad4  40fa8ae1  /system/lib/libdomx.so
I/DEBUG   (  127):     413a1ad8  40143280  
I/DEBUG   (  127):     413a1adc  4011c8ad  /system/lib/libc.so
I/DEBUG   (  127):     413a1ae0  01556240  [heap]
I/DEBUG   (  127):     413a1ae4  01556240  [heap]
I/DEBUG   (  127):     413a1ae8  00000000  
I/DEBUG   (  127):     413a1aec  17f80cb3  
I/DEBUG   (  127):     413a1af0  01571538  [heap]
I/DEBUG   (  127):     413a1af4  01556240  [heap]
I/DEBUG   (  127):     413a1af8  00000000  
I/DEBUG   (  127):     413a1afc  4010fa75  /system/lib/libc.so
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioTrack( 7751): obtainBuffer timed out (is the CPU pegged?) 0x154a940 user=00150740, server=0014f800
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
W/AudioSystem(  189): AudioFlinger server died!
W/AudioSystem(  189): AudioPolicyService server died!
I/ServiceManager(  122): service 'media.audio_flinger' died
I/ServiceManager(  122): service 'media.player' died
I/ServiceManager(  122): service 'media.camera' died
I/ServiceManager(  122): service 'media.audio_policy' died
W/IMediaDeathNotifier(  723): media server died
E/MediaPlayer(  723): error (100, 0)
W/Camera  ( 7834): Camera server died!
W/Camera  ( 7834): ICamera died
E/MediaPlayer(  723): Error (100,0)
E/VanillaMusic(  723): MediaPlayer error: 100 0
I/ActivityManager(  189): Displayed com.android.camera/.Camera: +4s446ms
D/CameraStorage( 7834): External storage state=mounted
I/Thumbnail( 7834): Fail to load bitmap. java.io.FileNotFoundException: /data/data/com.android.camera/files/last_thumb: open failed: ENOENT (No such file or directory)
E/Camera  ( 7834): Error 100
E/CameraErrorCallback( 7834): Got camera error callback. error=100
D/AndroidRuntime( 7834): Shutting down VM
W/dalvikvm( 7834): threadid=1: thread exiting with uncaught exception (group=0x40a411f8)
I/        ( 7873): ServiceManager: 0x959958
E/SRS-Client( 7873): OpenClient_RILD
D/SRS-Client( 7873): Unsolicited handler isn't implemented yet!
I/AudioFlinger( 7873): Loaded primary audio interface from Tuna audio HW HAL (audio)
I/AudioFlinger( 7873): Using 'Tuna audio HW HAL' (audio.primary) as the primary audio interface
I/AudioFlinger( 7873): Loaded a2dp audio interface from A2DP Audio HW HAL (audio)
I/CameraService( 7873): CameraService started (pid=7873)
I/AudioFlinger( 7873): AudioFlinger's thread 0x960400 ready to run
I/AudioPolicyService( 7873): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy)
I/Process (  189): Sending signal. PID: 7834 SIG: 3
I/dalvikvm( 7834): threadid=3: reacting to signal 3
I/dalvikvm( 7834): Wrote stack traces to '/data/anr/traces.txt'
E/AudioService(  189): Media server died.
E/AudioService(  189): Media server started.
W/AudioPolicyManagerBase( 7873): setPhoneState() setting same state 0

The interesting part in all that noise is the following:

D/DOMX    ( 7751): ERROR: [DBG] RPC_sendPacket_sync write errno error 22
D/DOMX    ( 7751): ERROR: DOMX Write failed 0xffffffff -1

Basically write fails at:
#define RPC_sendPacket_sync(hCtx, pPacket, nPacketSize, nFxnIdx, pRetPacket, nSize) do { \
    DOMX_ERROR("[DBG] RPC_sendPacket_sync %s:%d",__func__,__LINE__); \
    status = write(hCtx->fd_omx, pPacket, nPacketSize); \
    if (status == -1){ \
        int errsv = errno; \
        DOMX_ERROR("[DBG] RPC_sendPacket_sync write errno error %d",errsv); \
    } \
    RPC_freePacket(pPacket); \
    pPacket = NULL; \
    if(status < 0 ) DOMX_ERROR("DOMX Write failed 0x%x %d",status,status); \
    RPC_assert(status >= 0, RPC_OMX_ErrorUndefined, "Write failed"); \
    eError = TIMM_OSAL_ReadFromPipe(hCtx->pMsgPipe[nFxnIdx], &pRetPacket, \
        RPC_MSG_SIZE_FOR_PIPE, (TIMM_OSAL_U32 *)(&nSize), TIMM_OSAL_SUSPEND); \
    RPC_assert(eError == TIMM_OSAL_ERR_NONE, eError, \
        "Read failed"); \
    } while(0)

That means that a normal unix write to /dev/rpmsg-omx1 fails with EINVAL.
Which produces something like that in the kernel when the powervr kernel driver is there but the non-free userland is not.
root@android:/ # dmesg                                                         
<6>[  105.768157] max17040 4-0036: online = 1 vcell = 4200000 soc = 100 status = 4 health = 1 temp = 380 charger status = 1
<6>[  108.557067] request_suspend_state: wakeup (3->0) at 108550701674 (2012-11-02 19:41:27.498122569 UTC)
<6>[  108.558135] DSSCOMP: dsscomp_late_resume
<6>[  109.513000] vibrator: value=20, pwmval=127
<6>[  109.872772] vibrator: value=20, pwmval=127
<6>[  110.213806] vibrator: value=20, pwmval=127
<6>[  110.543334] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
<4>[  110.557281] omap_hwmod: ipu: failed to hardreset
<6>[  110.560150] omap-iommu omap-iommu.0: ducati: version 2.1
<6>[  110.733123] sr_class1p5_calib_work: core: Calibration complete: Voltage:Nominal=1250000,Calib=1038160,margin=13000
<6>[  111.117462] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 0) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  111.117584] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  111.117706] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]
<6>[  114.291107] binder: release 138:532 transaction 8079 in, still active
<6>[  114.291168] binder: send failed reply for transaction 8079 to 814:814
<4>[  116.686065] sr_class1p5_calib_work: iva Stop sampling: Voltage Nominal=950000 samples=18
<6>[  116.686309] sr_class1p5_calib_work: iva: Calibration complete: Voltage:Nominal=950000,Calib=860920,margin=13000
<3>[  119.851684] omap-rproc omap-rproc.1: rproc_watchdog_isr
<6>[  119.851959] omap_rproc_dump_registers: REGISTER DUMP FOR REMOTEPROC ipu
<6>[  119.852264] omap_rproc_dump_registers: PC is at 002a5006
<6>[  119.852416] omap_rproc_dump_registers: LR is at 002a5007
<6>[  119.852722] omap_rproc_dump_registers: pc : [<002a5006>]    lr : [<002a5007>]    psr: 61000000
<6>[  119.852752] sp : 806041e8  ip : 806041a8  fp : 802b839c
<6>[  119.853210] omap_rproc_dump_registers: r10: 802a5f27  r9 : 0000804f  r8 : 00000000
<6>[  119.853515] omap_rproc_dump_registers: r7 : 00000137  r6 : 00000000  r5 : 80604214  r4 : 00254a3c
<6>[  119.853698] omap_rproc_dump_registers: r3 : 00000000  r2 : 9f070000  r1 : 00000010  r0 : 00000000
<6>[  119.854003] omap_rproc_dump_registers: Flags: nZCv  IRQs on  FIQs on
<6>[  119.854675] _event_notify: remoteproc: ipu has crashed
<3>[  119.854827] rpmsg_rproc_error: Fatal error in ipu
<3>[  119.855133] rpmsg_rproc_error: Fatal error in ipu
<3>[  119.855316] rpmsg_reset_work: reseting virtio device 0
<6>[  119.855682] rpmsg_resmgr rpmsg0: Enter rprm_remove
<6>[  119.862121] rpmsg_omx rpmsg-omx0: rpmsg omx driver is removed
<3>[  119.866668] rpmsg_reset_work: reseting virtio device 1
<6>[  119.866912] rpmsg_resmgr rpmsg2: Enter rprm_remove
<6>[  119.868988] rpmsg_omx rpmsg-omx1: rpmsg omx driver is removed
<4>[  119.870544] rproc_reset_poolmem: invalid pool
<6>[  119.870819] omap-rproc omap-rproc.1: stopped remote processor ipu
<6>[  119.873626] omap-rproc omap-rproc.1: powering up ipu
<6>[  119.873962] virtio_rpmsg_bus virtio2: rpmsg backend virtproc probed successfully
<6>[  119.874877] virtio_rpmsg_bus virtio3: rpmsg backend virtproc probed successfully
<6>[  119.915710] omap-rproc omap-rproc.1: Loaded BIOS image ducati-m3.bin, size 4511300
<6>[  119.915893] omap-rproc omap-rproc.1: BIOS image version is 2
<6>[  119.927490] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
<4>[  119.941894] omap_hwmod: ipu: failed to hardreset
<6>[  119.943176] omap-iommu omap-iommu.0: ducati: version 2.1
<6>[  119.952117] omap-rproc omap-rproc.1: remote processor ipu is now up
<6>[  119.965270] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965393] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965545] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965637] omap_rpmsg_mbox_callback: received echo reply from ipu !
<6>[  119.965820] virtio_rpmsg_bus virtio2: creating channel rpmsg-client-sample addr 0x32
<6>[  119.966125] virtio_rpmsg_bus virtio2: creating channel rpmsg-client-sample addr 0x33
<6>[  119.966400] virtio_rpmsg_bus virtio2: creating channel rpmsg-omx addr 0x3c
<6>[  119.966827] rpmsg_omx rpmsg-omx0: new OMX connection srv channel: 1024 -> 60!
<6>[  121.112823] virtio_rpmsg_bus virtio3: creating channel rpmsg-omx addr 0x3c
<6>[  121.116668] rpmsg_omx rpmsg-omx1: new OMX connection srv channel: 1024 -> 60!

Disabling the pvr driver with:

diff --git a/arch/arm/configs/cyanogenmod_tuna_defconfig b/arch/arm/configs/cyanogenmod_tuna_defconfig
index 1a060a2..a9e3990 100644
--- a/arch/arm/configs/cyanogenmod_tuna_defconfig
+++ b/arch/arm/configs/cyanogenmod_tuna_defconfig
@@ -1,6 +1,6 @@
 #
 # Automatically generated make config: don't edit
-# Linux/arm 3.0.34 Kernel Configuration
+# Linux/arm 3.0.36 Kernel Configuration
 #
 CONFIG_ARM=y
 CONFIG_HAVE_PWM=y
@@ -70,6 +70,7 @@ CONFIG_GENERIC_IRQ_CHIP=y
 # RCU Subsystem
 #
 CONFIG_TREE_PREEMPT_RCU=y
+# CONFIG_TINY_RCU is not set
 CONFIG_PREEMPT_RCU=y
 # CONFIG_RCU_TRACE is not set
 CONFIG_RCU_FANOUT=32
@@ -583,6 +584,8 @@ CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_CUBIC=y
+# CONFIG_DEFAULT_CUBIC is not set
+# CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic" 
 # CONFIG_TCP_MD5SIG is not set
 CONFIG_IPV6=y
@@ -785,6 +788,9 @@ CONFIG_IP6_NF_RAW=y
 # CONFIG_BRIDGE_NF_EBTABLES is not set
 # CONFIG_IP_DCCP is not set
 # CONFIG_IP_SCTP is not set
+# CONFIG_SCTP_HMAC_NONE is not set
+# CONFIG_SCTP_HMAC_SHA1 is not set
+# CONFIG_SCTP_HMAC_MD5 is not set
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -917,6 +923,8 @@ CONFIG_CFG80211_DEFAULT_PS=y
 # CONFIG_LIB80211 is not set
 CONFIG_CFG80211_ALLOW_RECONNECT=y
 # CONFIG_MAC80211 is not set
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+# CONFIG_MAC80211_RC_DEFAULT_MINSTREL is not set
 # CONFIG_WIMAX is not set
 CONFIG_RFKILL=y
 CONFIG_RFKILL_PM=y
@@ -1204,6 +1212,9 @@ CONFIG_WLAN=y
 # CONFIG_USB_NET_RNDIS_WLAN is not set
 CONFIG_WIFI_CONTROL_FUNC=y
 # CONFIG_ATH_COMMON is not set
+# CONFIG_B43LEGACY_DMA_AND_PIO_MODE is not set
+# CONFIG_B43LEGACY_DMA_MODE is not set
+# CONFIG_B43LEGACY_PIO_MODE is not set
 # CONFIG_BCM4329 is not set
 CONFIG_BCMDHD=y
 CONFIG_BCMDHD_FW_PATH="/system/vendor/firmware/fw_bcmdhd.bin" 
@@ -1688,24 +1699,13 @@ CONFIG_TILER_ENABLE_USERSPACE=y
 # Graphics support
 #
 # CONFIG_DRM is not set
-CONFIG_PVR_SGX=y
-CONFIG_PVR_SGXCORE_540=y
-CONFIG_PVR_BUILD_RELEASE=y
+# CONFIG_PVR_SGX is not set
+# CONFIG_PVR_SGXCORE_540 is not set
+# CONFIG_PVR_BUILD_RELEASE is not set
 # CONFIG_PVR_BUILD_DEBUG is not set
-CONFIG_PVR_NEED_PVR_DPF=y
-CONFIG_PVR_NEED_PVR_ASSERT=y
-CONFIG_PVR_PERCONTEXT_PB=y
-CONFIG_PVR_ACTIVE_POWER_MANAGEMENT=y
-CONFIG_PVR_ACTIVE_POWER_LATENCY_MS=100
-CONFIG_PVR_SGX_LOW_LATENCY_SCHEDULING=y
-CONFIG_PVR_USSE_EDM_STATUS_DEBUG=y
-CONFIG_PVR_DUMP_MK_TRACE=y
-# CONFIG_PVR_PDUMP is not set
-CONFIG_PVR_OMAP_DSS2=y
 # CONFIG_SGX_DVFS_MODE_NONE is not set
 # CONFIG_SGX_DVFS_MODE_LINEAR is not set
-CONFIG_SGX_DVFS_MODE_OPTIMIZED=y
-CONFIG_SGX_DVFS_IDLE_TIMEOUT=1000
+# CONFIG_SGX_DVFS_MODE_OPTIMIZED is not set
 CONFIG_ION=y
 CONFIG_ION_OMAP=y
 # CONFIG_VGASTATE is not set
@@ -1734,10 +1734,13 @@ CONFIG_FB_MODE_HELPERS=y
 # Frame buffer hardware drivers
 #
 # CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_CARMINE_DRAM_EVAL is not set
+# CONFIG_CARMINE_DRAM_CUSTOM is not set
 # CONFIG_FB_TMIO is not set
 # CONFIG_FB_UDL is not set
 # CONFIG_FB_VIRTUAL is not set
 # CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MB862XX_PCI_GDC is not set
 # CONFIG_FB_BROADSHEET is not set
 CONFIG_HDMI_TI_4XXX_IP=y
 CONFIG_SII9234=y
@@ -1765,7 +1768,6 @@ CONFIG_FB_OMAP2_NUM_FBS=3
 CONFIG_PANEL_S6E8AA0=y
 # CONFIG_PANEL_TAAL is not set
 CONFIG_COLOR_HACK=y
-CONFIG_DSSCOMP=y
 CONFIG_DSSCOMP_DEBUG_LOG=y
 CONFIG_OMAP4_HDCP=y
 # CONFIG_OMAP4_HDCP_DEBUG is not set
@@ -2094,6 +2096,12 @@ CONFIG_USB_GADGET_SELECTED=y
 # CONFIG_USB_GADGET_R8A66597 is not set
 # CONFIG_USB_GADGET_PXA_U2O is not set
 # CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_AMD5536UDC is not set
+# CONFIG_USB_GADGET_CI13XXX_PCI is not set
+# CONFIG_USB_GADGET_NET2280 is not set
+# CONFIG_USB_GADGET_GOKU is not set
+# CONFIG_USB_GADGET_LANGWELL is not set
+# CONFIG_USB_GADGET_EG20T is not set
 # CONFIG_USB_GADGET_DUMMY_HCD is not set
 CONFIG_USB_GADGET_DUALSPEED=y
 # CONFIG_USB_ZERO is not set
@@ -2113,6 +2121,9 @@ CONFIG_USB_G_ANDROID=y
 # CONFIG_USB_G_MULTI is not set
 # CONFIG_USB_G_HID is not set
 # CONFIG_USB_G_DBGP is not set
+# CONFIG_USB_G_DBGP_PRINTK is not set
+# CONFIG_USB_G_DBGP_SERIAL is not set
+# CONFIG_USB_G_WEBCAM is not set

 #
 # OTG and related infrastructure
@@ -2265,9 +2276,15 @@ CONFIG_ANDROID_LOW_MEMORY_KILLER=y
 # CONFIG_USB_SERIAL_QUATECH_USB2 is not set
 # CONFIG_VT6656 is not set
 # CONFIG_IIO is not set
+# CONFIG_LIS3L02DQ_BUF_KFIFO is not set
+# CONFIG_LIS3L02DQ_BUF_RING_SW is not set
+# CONFIG_AD2S1210_GPIO_INPUT is not set
+# CONFIG_AD2S1210_GPIO_OUTPUT is not set
+# CONFIG_AD2S1210_GPIO_NONE is not set
 # CONFIG_XVMALLOC is not set
 # CONFIG_ZRAM is not set
 # CONFIG_FB_SM7XX is not set
+# CONFIG_EASYCAP_SND is not set
 CONFIG_MACH_NO_WESTBRIDGE=y
 # CONFIG_ATH6K_LEGACY is not set
 # CONFIG_USB_ENESTORAGE is not set
@@ -2381,6 +2398,10 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_EFS_FS is not set
 # CONFIG_YAFFS_FS is not set
 # CONFIG_JFFS2_FS is not set
+# CONFIG_JFFS2_CMODE_NONE is not set
+# CONFIG_JFFS2_CMODE_PRIORITY is not set
+# CONFIG_JFFS2_CMODE_SIZE is not set
+# CONFIG_JFFS2_CMODE_FAVOURLZO is not set
 # CONFIG_LOGFS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
@@ -2390,6 +2411,9 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
+# CONFIG_ROMFS_BACKED_BY_BLOCK is not set
+# CONFIG_ROMFS_BACKED_BY_MTD is not set
+# CONFIG_ROMFS_BACKED_BY_BOTH is not set
 # CONFIG_PSTORE is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
@@ -2595,6 +2619,10 @@ CONFIG_SECURITY_MIDDLEWARE_COMPONENT=y
 # CONFIG_SMC_KERNEL_CRYPTO is not set
 CONFIG_SECURE_TRACE=y
 # CONFIG_TF_DRIVER_DEBUG_SUPPORT is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
 CONFIG_DEFAULT_SECURITY="" 
 CONFIG_CRYPTO=y

Didn't fix it.

replicant-4.0/kernel/samsung/tuna/drivers/rpmsg$ grep rpmsg-omx -r *
rpmsg_omx.c:                        "rpmsg-omx");
rpmsg_omx.c:            "rpmsg-omx%d", minor);
rpmsg_omx.c:    { .name    = "rpmsg-omx" },
replicant-4.0/kernel/samsung/tuna/drivers/rpmsg$ grep pvr -r *
rpmsg_omx.c:#include "../gpu/pvr/ion.h" 
rpmsg_omx.c:        struct ion_client *pvr_ion_client;
rpmsg_omx.c:        handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
rpmsg_omx.c:            !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {

TODO

  • investigate why the kernel fails without the PVR here:
    static u32 _rpmsg_omx_buffer_lookup(struct rpmsg_omx_instance *omx, long buffer)
    {
        phys_addr_t pa;
        u32 va;
    #ifdef CONFIG_ION_OMAP
        struct ion_handle *handle;
        ion_phys_addr_t paddr;
        size_t unused;
        int fd;
    
        /* is it an ion handle? */
        handle = (struct ion_handle *)buffer;
        if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {
            pa = (phys_addr_t) paddr;
            goto to_va;
        }
    #ifdef CONFIG_PVR_SGX
        /* how about an sgx buffer wrapping an ion handle? */
        {
            struct ion_client *pvr_ion_client;
            fd = buffer;
            handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
            if (handle &&
                !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
                pa = (phys_addr_t)paddr;
                goto to_va;
            }
        }
    #endif
    #endif
        pa = (phys_addr_t) tiler_virt2phys(buffer);
    
    #ifdef CONFIG_ION_OMAP
    to_va:
    #endif
        va = _rpmsg_pa_to_da(pa);
        return va;
    }
    

    That has to be corelated with:
    <6>[  111.117462] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 0) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
    <6>[  111.117584] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
    <6>[  111.117706] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]
    

Newer infos from the kernel

static ssize_t rpmsg_omx_write(struct file *filp, const char __user *ubuf,
                                                size_t len, loff_t *offp)
{
        struct rpmsg_omx_instance *omx = filp->private_data;
        struct rpmsg_omx_service *omxserv = omx->omxserv;
        char kbuf[512];
        struct omx_msg_hdr *hdr = (struct omx_msg_hdr *) kbuf;
        int use, ret;

        if (omx->state != OMX_CONNECTED)
                return -ENOTCONN;

        /*
         * for now, limit msg size to 512 bytes (incl. header).
         * (note: rpmsg's limit is even tighter. this whole thing needs fixing)
         */
        use = min(sizeof(kbuf) - sizeof(*hdr), len);

        /*
         * copy the data. Later, number of copies can be optimized if found to
         * be significant in real use cases
         */
        if (copy_from_user(hdr->data, ubuf, use))
                return -EMSGSIZE;

        ret = _rpmsg_omx_map_buf(omx, hdr->data);
        if (ret < 0)
                return ret;

        hdr->type = OMX_RAW_MSG;
        hdr->flags = 0;
        hdr->len = use;

        use += sizeof(*hdr);

        ret = rpmsg_send_offchannel(omxserv->rpdev, omx->ept->addr,
                                                omx->dst, kbuf, use);
        if (ret) {
                dev_err(omxserv->dev, "rpmsg_send failed: %d\n", ret);
                return ret;
        }

        return use;
}

So it copies the userspace data to hdr->data and passes it to _rpmsg_omx_map_buf
ret = _rpmsg_omx_map_buf(omx, hdr->data);

Then _rpmsg_omx_map_buf is like that:

static int _rpmsg_omx_map_buf(struct rpmsg_omx_instance *omx, char *packet)
{
    int ret = -EINVAL, offset = 0;
    long *buffer;
    char *data;
    enum rpc_omx_map_info_type maptype;
    u32 da = 0;

    data = (char *)((struct omx_packet *)packet)->data;
    maptype = *((enum rpc_omx_map_info_type *)data);

    /*Nothing to map*/
    if (maptype == RPC_OMX_MAP_INFO_NONE)
        return 0;
    if ((maptype != RPC_OMX_MAP_INFO_THREE_BUF) &&
        (maptype != RPC_OMX_MAP_INFO_TWO_BUF) &&
            (maptype != RPC_OMX_MAP_INFO_ONE_BUF))
        return ret;

    offset = *(int *)((int)data + sizeof(maptype));
    buffer = (long *)((int)data + offset);

    da = _rpmsg_omx_buffer_lookup(omx, *buffer);
    printk("[DBG] [%s] da = %x \n",__func__,da);
    if (da) {
            printk("[DBG] [%s] inside da\n",__func__);    
        *buffer = da;
        ret = 0;
    }else {
        printk("[DBG] [%s] outside da\n",__func__);
    }

    if (!ret && (maptype >= RPC_OMX_MAP_INFO_TWO_BUF)) {
        buffer = (long *)((int)data + offset + sizeof(*buffer));
        if (*buffer != 0) {
            ret = -EIO;
            da = _rpmsg_omx_buffer_lookup(omx, *buffer);
            if (da) {
                *buffer = da;
                ret = 0;
            }
        }
    }

    if (!ret && maptype >= RPC_OMX_MAP_INFO_THREE_BUF) {
        buffer = (long *)((int)data + offset + 2*sizeof(*buffer));
        if (*buffer != 0) {
            ret = -EIO;
            da = _rpmsg_omx_buffer_lookup(omx, *buffer);
            if (da) {
                *buffer = da;
                ret = 0;
            }
        }
    }
    return ret;
}

It calls

da = _rpmsg_omx_buffer_lookup(omx, *buffer);
which is like that:
static u32 _rpmsg_omx_buffer_lookup(struct rpmsg_omx_instance *omx, long buffer)
{
    phys_addr_t pa;
    u32 va;
#ifdef CONFIG_ION_OMAP
    struct ion_handle *handle;
    ion_phys_addr_t paddr;
    size_t unused;
    int fd;

    /* is it an ion handle? */
    handle = (struct ion_handle *)buffer;
    printk("[DBG] handle:%x\n",handle);
    if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {
        printk("[DBG] is ion_phys\n");
        pa = (phys_addr_t) paddr;
        goto to_va;
    }
#if 0
#ifdef CONFIG_PVR_SGX
    printk("[DBG] INSIDE CONFIG_PVR_SGX\n");
    /* how about an sgx buffer wrapping an ion handle? */
    {
        struct ion_client *pvr_ion_client;
        fd = buffer;
        handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
        printk("[DBG] [INSIDE CONFIG_PVR_SGX] handle:%x\n",handle);
        if (handle &&
            !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
            printk("[DBG] [INSIDE CONFIG_PVR_SGX] goto to_va\n");
            pa = (phys_addr_t)paddr;
            goto to_va;
        }
    }
#endif
#endif
#endif
    printk("[DBG] [after CONFIG_PVR_SGX]\n");
    pa = (phys_addr_t) tiler_virt2phys(buffer);
    printk("[DBG] [after CONFIG_PVR_SGX] pa = %x \n");

#ifdef CONFIG_ION_OMAP
to_va:
#endif
    printk("[DBG] [to_va] \n");
    va = _rpmsg_pa_to_da(pa);
    printk("[DBG] [to_va] = %x \n",va);
    return va;
}

which calls

/*
 * TODO: Need to do this using lookup with rproc, but rproc is not
 * visible to rpmsg_omx
 */
#define TILER_START    0x60000000
#define TILER_END    0x80000000
#define ION_1D_START    0xBA300000
#define ION_1D_END    0xBFD00000
#define ION_1D_VA    0x88000000
static u32 _rpmsg_pa_to_da(u32 pa)
{
    if (pa >= TILER_START && pa < TILER_END){
        printk("[DBG] TILER\n");
        return pa;
    }
    else if (pa >= ION_1D_START && pa < ION_1D_END){
                printk("[DBG] ION\n");
        return (pa - ION_1D_START + ION_1D_VA);
    }
    else{
               printk("[DBG] ELSE(not tiler and not ion)\n");
    }
        return 0;
}

which prints ION for the 2 good buffers and print ELSE for the bad buffer(the one which produces the EINVAL in write)...

then _rpmsg_omx_buffer_lookup returns 0 which results in:

static int _rpmsg_omx_map_buf(struct rpmsg_omx_instance *omx, char *packet)
{
    int ret = -EINVAL, offset = 0;
[...]
    da = _rpmsg_omx_buffer_lookup(omx, *buffer);
    printk("[DBG] [%s] da = %x \n",__func__,da);
    if (da) {
->not reached
            printk("[DBG] [%s] inside da\n",__func__);    
        *buffer = da;
        ret = 0;
    }else {
->reached
        printk("[DBG] [%s] outside da\n",__func__);
    }

    if (!ret && (maptype >= RPC_OMX_MAP_INFO_TWO_BUF)) {
        [...] (not reached)
    }

    if (!ret && maptype >= RPC_OMX_MAP_INFO_THREE_BUF) {
        [...] (not reached)
    }
    return ret;
}

Runtime tests.

Running replicant kernel with:

#if 0
#ifdef CONFIG_PVR_SGX
        printk("[DBG] INSIDE CONFIG_PVR_SGX\n");
        /* how about an sgx buffer wrapping an ion handle? */
        {
                struct ion_client *pvr_ion_client;
                fd = buffer;
                handle = PVRSRVExportFDToIONHandle(fd, &pvr_ion_client);
                printk("[DBG] [INSIDE CONFIG_PVR_SGX] handle:%x\n",handle);
                if (handle &&
                        !ion_phys(pvr_ion_client, handle, &paddr, &unused)) {
                        printk("[DBG] [INSIDE CONFIG_PVR_SGX] goto to_va\n");
                        pa = (phys_addr_t)paddr;
                        goto to_va;
                }
        }
#endif
#endif

with cyanogenmod userspace produces the same issue:

D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nConfigIndex = 117440523, pConfigStruct = 0x41365b50
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0 index: 0x2000001
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 33554433, pParamStruct = 0x41365ad8
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0 index: 0x2000001
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nConfigIndex = 2130706541, pConfigStruct = 0x41365b58
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, eCmd = 3, nParam = 2, pCmdData = 0x0
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 2130706545, pParamStruct = 0x41365ba0
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nPortIndex = 0x2, pAppPrivate = 0x0, nSizeBytes = 1142784, pBuffer = 0x1046f40
D/DOMX    (  135): TRACE: In UB, no. of buffers = 0
D/DOMX    (  135): TRACE: Preparing buffer to Remote Core...
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE:  PROXY_UTIL Get Parameter Successful
D/DOMX    (  135): TRACE: Port Number: 2 :: NumOfLines 720
D/DOMX    (  135): EXIT: eError: 0
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0, pCompPrv = 0x1035ee0, nParamIndex = 2130706550, pParamStruct = 0x41365b34
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Recd. omx message
D/DOMX    (  135): TRACE: Waiting for messages from remote core
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): TRACE: Corresponding RPC function executed successfully
D/DOMX    (  135): EXIT: eError: 0 index: 0x7f000076
D/DOMX    (  135): TRACE: Metadata size = 12332
D/DOMX    (  135): TRACE: ION being USED for allocation!!!!! handle = c63ccd80, ret =0
D/DOMX    (  135): TRACE: Metadata buffer ion handle = -969093760
D/DOMX    (  135): ENTER: 
D/DOMX    (  135): TRACE: Marshaling data
D/DOMX    (  135): TRACE: eMapInfo = 3
D/DOMX    (  135): TRACE: UV buffer fd= 109
D/DOMX    (  135): TRACE: Metadata buffer = -969093760
D/DOMX    (  135): TRACE: About to send packet
D/DOMX    (  135): ERROR: DOMX Write failed 0xffffffff -1
D/DOMX    (  135): ERROR: failed check:status >= 0 - returning error: 0x81001 - Write failed
D/DOMX    (  135): EXIT: 
D/DOMX    (  135): ERROR: RPC function returned error 0x81001
D/DOMX    (  135): TRACE: Use Buffer Successful
D/DOMX    (  135): TRACE: Value of pBufHeaderRemote: 0x0 LocalBufferHdr :0x104f118, LocalBuffer :0x1046f40
D/DOMX    (  135): TRACE: Metadata buffer ion handle given to ion map = -969093760
D/DOMX    (  135): TRACE: Updating no. of buffer to 1
D/DOMX    (  135): EXIT: eError: -2147479551
E/CameraHAL(  135): OMX_UseBuffer-0x80001001
E/CameraHAL(  135): Exiting function UseBuffersPreview because of ret 0 eError=80001001
D/DOMX    (  135): ENTER: hComponent = 0x103f7e0
E/ion     (  135): ioctl -1073460991 failed with code -1: Bad file number
F/libc    (  135): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree
F/libc    (  135): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/DEBUG   (  130): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (  130): Build fingerprint: 'google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys'
I/DEBUG   (  130): pid: 135, tid: 187  >>> /system/bin/mediaserver <<<
I/DEBUG   (  130): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad
I/DEBUG   (  130):  r0 deadbaad  r1 00000001  r2 a0000000  r3 00000000
I/DEBUG   (  130):  r4 00000000  r5 00000027  r6 401022f4  r7 401104d4
I/DEBUG   (  130):  r8 0104f170  r9 40110600  10 01040eb0  fp 010387fc
I/DEBUG   (  130):  ip ffffffff  sp 413659c0  lr 400e3441  pc 400df788  cpsr 60000030
I/DEBUG   (  130):  d0  656c696620646120  d1  653766333031786e
I/DEBUG   (  130):  d2  68206e6f69207275  d3  696720656c646e6d
I/DEBUG   (  130):  d4  426c61636f4c2030  d5  7264487265666675
I/DEBUG   (  130):  d6  6634303178303a20  d7  636f4c202c383131
I/DEBUG   (  130):  d8  0000000000000000  d9  0000000000000000
I/DEBUG   (  130):  d10 0000000000000000  d11 0000000000000000
I/DEBUG   (  130):  d12 0000000000000000  d13 0000000000000000
I/DEBUG   (  130):  d14 0000000000000000  d15 0000000000000000
I/DEBUG   (  130):  d16 3ff0000000000000  d17 3ff0000000000000
I/DEBUG   (  130):  d18 7e37e43c8800759c  d19 bfba43196d2f888d
I/DEBUG   (  130):  d20 3f115549a0c32687  d21 bebbbb72a4af9d58
I/DEBUG   (  130):  d22 3ff0000000000000  d23 3fecedd52e2a681e
I/DEBUG   (  130):  d24 3e66376972bea4d0  d25 3fee147ae0000000
I/DEBUG   (  130):  d26 0000000000000000  d27 0000000000000000
I/DEBUG   (  130):  d28 0000000000000000  d29 0000000000000000
I/DEBUG   (  130):  d30 0000000000000000  d31 0000000000000000
I/DEBUG   (  130):  scr 68000010
I/DEBUG   (  130): 
I/DEBUG   (  130):          #00  pc 00017788  /system/lib/libc.so
I/DEBUG   (  130):          #01  pc 00013732  /system/lib/libc.so
I/DEBUG   (  130):          #02  pc 00015a70  /system/lib/libc.so (dlfree)
I/DEBUG   (  130):          #03  pc 00016100  /system/lib/libc.so (free)
I/DEBUG   (  130):          #04  pc 000019e6  /system/lib/libmm_osal.so (TIMM_OSAL_Free)
I/DEBUG   (  130):          #05  pc 00005dda  /system/lib/libdomx.so (PROXY_ComponentDeInit)
I/DEBUG   (  130):          #06  pc 000018ec  /system/lib/libOMX.TI.DUCATI1.VIDEO.CAMERA.so
I/DEBUG   (  130):          #07  pc 00001df6  /system/lib/libOMX_Core.so (OMX_FreeHandle)
I/DEBUG   (  130):          #08  pc 000284fc  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter24performCleanupAfterErrorEv)
I/DEBUG   (  130):          #09  pc 0002b04e  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter17UseBuffersPreviewEPvi)
I/DEBUG   (  130):          #10  pc 0002b182  /system/lib/hw/camera.omap4.so (_ZN7android16OMXCameraAdapter10useBuffersENS_13CameraAdapter10CameraModeEPvijj)
I/DEBUG   (  130):          #11  pc 00024c4c  /system/lib/hw/camera.omap4.so (_ZN7android17BaseCameraAdapter11sendCommandENS_13CameraAdapter14CameraCommandsEiii)
I/DEBUG   (  130):          #12  pc 0001d3d0  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal12startPreviewEv)
I/DEBUG   (  130):          #13  pc 0001d6de  /system/lib/hw/camera.omap4.so (_ZN7android9CameraHal16setPreviewWindowEP18preview_stream_ops)
I/DEBUG   (  130):          #14  pc 0001ae80  /system/lib/hw/camera.omap4.so (_Z25camera_set_preview_windowP13camera_deviceP18preview_stream_ops)
I/DEBUG   (  130):          #15  pc 000076cc  /system/lib/libcameraservice.so
I/DEBUG   (  130):          #16  pc 000091b4  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client16setPreviewWindowERKNS_2spINS_7IBinderEEERKNS2_I13ANativeWindowEE)
I/DEBUG   (  130):          #17  pc 000092ea  /system/lib/libcameraservice.so (_ZN7android13CameraService6Client17setPreviewDisplayERKNS_2spINS_7SurfaceEEE)
I/DEBUG   (  130):          #18  pc 00013592  /system/lib/libcamera_client.so (_ZN7android8BnCamera10onTransactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  130):          #19  pc 00017f44  /system/lib/libbinder.so (_ZN7android7BBinder8transactEjRKNS_6ParcelEPS1_j)
I/DEBUG   (  130):          #20  pc 0001b26e  /system/lib/libbinder.so (_ZN7android14IPCThreadState14executeCommandEi)
I/DEBUG   (  130):          #21  pc 0001b44a  /system/lib/libbinder.so (_ZN7android14IPCThreadState14joinThreadPoolEb)
I/DEBUG   (  130):          #22  pc 00020744  /system/lib/libbinder.so
I/DEBUG   (  130):          #23  pc 00022a1e  /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv)
I/DEBUG   (  130):          #24  pc 00023064  /system/lib/libutils.so
I/DEBUG   (  130):          #25  pc 00012e2c  /system/lib/libc.so (__thread_entry)
I/DEBUG   (  130):          #26  pc 0001295c  /system/lib/libc.so (pthread_create)
I/DEBUG   (  130): 
I/DEBUG   (  130): code around pc:
I/DEBUG   (  130): 400df768 4623b15c 2c006824 e026d1fb b12368db  \.#F$h.,..&..h#.
I/DEBUG   (  130): 400df778 21014a17 6011447a 48124798 24002527  .J.!zD.`.G.H'%.$
I/DEBUG   (  130): 400df788 f7f47005 2106ef8c e838f7f6 460aa901  .p.....!..8....F
I/DEBUG   (  130): 400df798 f04f2006 94015380 94029303 ebe4f7f5  . O..S..........
I/DEBUG   (  130): 400df7a8 4622a905 f7f52002 f7f4ebee 2106ef78  .."F. ......x..!
I/DEBUG   (  130): 
I/DEBUG   (  130): code around lr:
I/DEBUG   (  130): 400e3420 41f0e92d 46804c0c 447c2600 68a56824  -..A.L.F.&|D$h.h
I/DEBUG   (  130): 400e3430 e0076867 300cf9b5 dd022b00 47c04628  gh.....0.+..(F.G
I/DEBUG   (  130): 400e3440 35544306 37fff117 6824d5f4 d1ee2c00  .CT5...7..$h.,..
I/DEBUG   (  130): 400e3450 e8bd4630 bf0081f0 000280be 41f0e92d  0F..........-..A
I/DEBUG   (  130): 400e3460 fb01b086 9004f602 461f4815 4615460c  .........H.F.F.F
I/DEBUG   (  130): 
I/DEBUG   (  130): memory map around addr deadbaad:
I/DEBUG   (  130): bec5b000-bec7c000 [stack]
I/DEBUG   (  130): (no map for address)
I/DEBUG   (  130): ffff0000-ffff1000 [vectors]
I/DEBUG   (  130): 
I/DEBUG   (  130): stack:
I/DEBUG   (  130):     41365980  00000001  
I/DEBUG   (  130):     41365984  413659c0  
I/DEBUG   (  130):     41365988  4010b7e0  /system/lib/libc.so
I/DEBUG   (  130):     4136598c  0000000c  
I/DEBUG   (  130):     41365990  4010b780  /system/lib/libc.so
I/DEBUG   (  130):     41365994  4010b718  /system/lib/libc.so
I/DEBUG   (  130):     41365998  00000000  
I/DEBUG   (  130):     4136599c  400e3441  /system/lib/libc.so
I/DEBUG   (  130):     413659a0  00000000  
I/DEBUG   (  130):     413659a4  413659d4  
I/DEBUG   (  130):     413659a8  401022f4  /system/lib/libc.so
I/DEBUG   (  130):     413659ac  401104d4  
I/DEBUG   (  130):     413659b0  0104f170  [heap]
I/DEBUG   (  130):     413659b4  400e25ad  /system/lib/libc.so
I/DEBUG   (  130):     413659b8  df0027ad  
I/DEBUG   (  130):     413659bc  00000000  
I/DEBUG   (  130): #00 413659c0  413659bc  
I/DEBUG   (  130):     413659c4  00000001  
I/DEBUG   (  130):     413659c8  401022d8  /system/lib/libc.so
I/DEBUG   (  130):     413659cc  00000005  
I/DEBUG   (  130):     413659d0  413659ec  
I/DEBUG   (  130):     413659d4  fffffbdf  
I/DEBUG   (  130):     413659d8  413659ec  
I/DEBUG   (  130):     413659dc  413659ec  
I/DEBUG   (  130):     413659e0  401057f4  /system/lib/libc.so
I/DEBUG   (  130):     413659e4  400db737  /system/lib/libc.so
I/DEBUG   (  130): #01 413659e8  02000001  
I/DEBUG   (  130):     413659ec  20404040  
I/DEBUG   (  130):     413659f0  524f4241  
I/DEBUG   (  130):     413659f4  474e4954  
I/DEBUG   (  130):     413659f8  4e49203a  
I/DEBUG   (  130):     413659fc  494c4156  
I/DEBUG   (  130):     41365a00  45482044  
I/DEBUG   (  130):     41365a04  41205041  /dev/ashmem/OMXCodec (deleted)
I/DEBUG   (  130):     41365a08  45524444  
I/DEBUG   (  130):     41365a0c  49205353  
I/DEBUG   (  130):     41365a10  6c64204e  
I/DEBUG   (  130):     41365a14  65657266  
I/DEBUG   (  130):     41365a18  00000000  
I/DEBUG   (  130):     41365a1c  00000000  
I/DEBUG   (  130):     41365a20  8060f270  
I/DEBUG   (  130):     41365a24  a5d1751e  
I/DEBUG   (  130):     41365a28  00000060  
I/DEBUG   (  130):     41365a2c  41365a78  
I/DEBUG   (  130):     41365a30  40fb75e9  /system/lib/libdomx.so
I/DEBUG   (  130):     41365a34  40fba619  /system/lib/libdomx.so
I/DEBUG   (  130):     41365a38  0000001c  
I/DEBUG   (  130):     41365a3c  40021340  /system/lib/libmm_osal.so
I/DEBUG   (  130):     41365a40  ffffffff  
I/DEBUG   (  130):     41365a44  02000001  
I/DEBUG   (  130):     41365a48  000000fb  
I/DEBUG   (  130):     41365a4c  401104d4  
I/DEBUG   (  130):     41365a50  0104f198  [heap]
I/DEBUG   (  130):     41365a54  00000000  
I/DEBUG   (  130):     41365a58  8060f270  
I/DEBUG   (  130):     41365a5c  401104d4  
I/DEBUG   (  130):     41365a60  7f000076  
I/DEBUG   (  130):     41365a64  400dcc25  /system/lib/libc.so
I/DEBUG   (  130):     41365a68  0104f190  [heap]
I/DEBUG   (  130):     41365a6c  0104f288  [heap]
I/DEBUG   (  130):     41365a70  000000fb  
I/DEBUG   (  130):     41365a74  401104d4  
I/DEBUG   (  130):     41365a78  0104f198  [heap]
I/DEBUG   (  130):     41365a7c  00000000  
I/DEBUG   (  130):     41365a80  00000000  
I/DEBUG   (  130):     41365a84  401104d4  
I/DEBUG   (  130):     41365a88  00000002  
I/DEBUG   (  130):     41365a8c  400dcc25  /system/lib/libc.so
I/DEBUG   (  130):     41365a90  0104f190  [heap]
I/DEBUG   (  130):     41365a94  401105f0  
I/DEBUG   (  130):     41365a98  000000f8  
I/DEBUG   (  130):     41365a9c  401104d4  
I/DEBUG   (  130):     41365aa0  0104f198  [heap]
I/DEBUG   (  130):     41365aa4  0104f1ac  [heap]
I/DEBUG   (  130):     41365aa8  00000002  
I/DEBUG   (  130):     41365aac  400dda89  /system/lib/libc.so
I/DEBUG   (  130):     41365ab0  0104f118  [heap]
I/DEBUG   (  130):     41365ab4  00000024  
I/DEBUG   (  130):     41365ab8  01035ee0  [heap]
I/DEBUG   (  130):     41365abc  00000003  
I/DEBUG   (  130):     41365ac0  0000004d  
I/DEBUG   (  130):     41365ac4  41365ad4  
I/DEBUG   (  130):     41365ac8  0104f110  [heap]
I/DEBUG   (  130):     41365acc  00000001  
I/DEBUG   (  130):     41365ad0  00000178  
I/DEBUG   (  130):     41365ad4  00000001  
I/DEBUG   (  130):     41365ad8  40111280  
I/DEBUG   (  130):     41365adc  400ea8ad  /system/lib/libc.so
I/DEBUG   (  130):     41365ae0  01035ee0  [heap]
I/DEBUG   (  130):     41365ae4  01035ee0  [heap]
I/DEBUG   (  130):     41365ae8  00000000  
I/DEBUG   (  130):     41365aec  a5d1751e  
I/DEBUG   (  130):     41365af0  0104f168  [heap]
I/DEBUG   (  130):     41365af4  01035ee0  [heap]
I/DEBUG   (  130):     41365af8  00000000  
I/DEBUG   (  130):     41365afc  400dda75  /system/lib/libc.so
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
D/dalvikvm(  203): GC_FOR_ALLOC freed 3709K, 60% free 4952K/12288K, paused 29ms
W/AudioSystem(  203): AudioFlinger server died!
W/IMediaDeathNotifier(  203): media server died
W/AudioSystem(  203): AudioPolicyService server died!
W/AudioSystem(  420): AudioFlinger server died!
W/AudioSystem(  420): AudioPolicyService server died!
I/ServiceManager(  124): service 'media.audio_flinger' died
I/ServiceManager(  124): service 'media.player' died
I/ServiceManager(  124): service 'media.camera' died
I/ServiceManager(  124): service 'media.audio_policy' died
W/IMediaDeathNotifier(  437): media server died
W/Camera  (  914): Camera server died!
W/Camera  (  914): ICamera died
I/ActivityManager(  203): Displayed com.android.camera/.Camera: +4s438ms
D/CameraStorage(  914): External storage state=mounted
I/Thumbnail(  914): Fail to load bitmap. java.io.FileNotFoundException: /data/data/com.android.camera/files/last_thumb: open failed: ENOENT (No such file or directory)
E/Camera  (  914): Error 100
E/CameraErrorCallback(  914): Got camera error callback. error=100
D/AndroidRuntime(  914): Shutting down VM
W/dalvikvm(  914): threadid=1: thread exiting with uncaught exception (group=0x40a4e1f8)
I/        (  948): ServiceManager: 0x5cd958
I/AudioFlinger(  948): Loaded primary audio interface from Tuna audio HW HAL (audio)
I/AudioFlinger(  948): Using 'Tuna audio HW HAL' (audio.primary) as the primary audio interface
I/AudioFlinger(  948): Loaded a2dp audio interface from A2DP Audio HW HAL (audio)
I/CameraService(  948): CameraService started (pid=948)
I/AudioFlinger(  948): AudioFlinger's thread 0x5d44b8 ready to run
D/dalvikvm(  203): GC_FOR_ALLOC freed 1181K, 59% free 5063K/12288K, paused 27ms
I/AudioPolicyService(  948): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy)
I/Process (  203): Sending signal. PID: 914 SIG: 3
I/dalvikvm(  914): threadid=3: reacting to signal 3
I/dalvikvm(  914): Wrote stack traces to '/data/anr/traces.txt'
E/AudioService(  203): Media server died.
E/AudioService(  203): Media server started.
W/AudioPolicyManagerBase(  948): setPhoneState() setting same state 0
W/AudioFlinger(  948): session id 13 not found for pid 203
I/Process (  914): Sending signal. PID: 914 SIG: 9
[  104.225494] binder: release proc 914, transaction 18351, not freed
[  104.234130] binder: release proc 914, transaction 18352, not freed
W/InputDispatcher(  203): channel '40f93a50 com.android.camera/com.android.camera.Camera (server)' ~ Consumer closed input channel or an error occurred.  events=0x8
E/InputDispatcher(  203): channel '40f93a50 com.android.camera/com.android.camera.Camera (server)' ~ Channel is unrecoverably broken and will be disposed!
W/InputDispatcher(  203): Attempted to unregister already unregistered input channel '40f93a50 com.android.camera/com.android.camera.Camera (server)'

The flow when it works is the following:

if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {

returns false, then what's in #ifdef CONFIG_PVR_SGX is executed, and it jumps to the end without executing
pa = (phys_addr_t) tiler_virt2phys(buffer);

The flow when it fails is the following:

if (!ion_phys(omx->ion_client, handle, &paddr, &unused)) {

returns false,then what's in #ifdef CONFIG_PVR_SGX fails or is skipped,
Then it executes
pa = (phys_addr_t) tiler_virt2phys(buffer);
and goes to the end.

Inside the PVR driver

struct ion_handle *
PVRSRVExportFDToIONHandle(int fd, struct ion_client **client)
{
[...]
    eError = PVRSRVLookupHandle(KERNEL_HANDLE_BASE,
                                (IMG_PVOID *)&psKernelMemInfo,
                                psPrivateData->hKernelMemInfo,
                                PVRSRV_HANDLE_TYPE_MEM_INFO);
[...]
Then it uses psKernelMemInfo and returns a derivative of it.
}
PVRSRV_ERROR PVRSRVLookupHandle(PVRSRV_HANDLE_BASE *psBase, IMG_PVOID *ppvData, IMG_HANDLE hHandle, PVRSRV_HANDLE_TYPE eType)
{
        struct sHandle *psHandle;
        PVRSRV_ERROR eError;

        PVR_ASSERT(eType != PVRSRV_HANDLE_TYPE_NONE)

        eError = GetHandleStructure(psBase, &psHandle, hHandle, eType);
        if (eError != PVRSRV_OK)
        {
                PVR_DPF((PVR_DBG_ERROR, "PVRSRVLookupHandle: Error looking up handle (%d)", eError));
                return eError;
        }

        *ppvData = psHandle->pvData;

        return PVRSRV_OK;
}
PVRSRV_ERROR GetHandleStructure(PVRSRV_HANDLE_BASE *psBase, struct sHandle **ppsHandle, IMG_HANDLE hHandle, PVRSRV_HANDLE_TYPE eType)
#endif
{
        IMG_UINT32 ui32Index = HANDLE_TO_INDEX(hHandle);
        struct sHandle *psHandle;

        if (!INDEX_IS_VALID(psBase, ui32Index))
        {
                PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle index out of range (%u >= %u)", ui32Index, psBase->ui32TotalHandCount));

                return PVRSRV_ERROR_HANDLE_INDEX_OUT_OF_RANGE;
        }

        psHandle =  INDEX_TO_HANDLE_STRUCT_PTR(psBase, ui32Index);
        if (psHandle->eType == PVRSRV_HANDLE_TYPE_NONE)
        {
                PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle not allocated (index: %u)", ui32Index));

                return PVRSRV_ERROR_HANDLE_NOT_ALLOCATED;
        }

        if (eType != PVRSRV_HANDLE_TYPE_NONE && eType != psHandle->eType)
        {
                PVR_DPF((PVR_DBG_ERROR, "GetHandleStructure: Handle type mismatch (%d != %d)", eType, psHandle->eType));

                return PVRSRV_ERROR_HANDLE_TYPE_MISMATCH;
        }

        *ppsHandle = psHandle;

        return PVRSRV_OK;
}

#define INDEX_IS_VALID(psBase, i) ((i) < (psBase)->ui32TotalHandCount)

trying to fix the issue:

<6>[  313.967468] PVR_K:(Error): GetHandleStructure: Handle index out of range (1835561824 >= 256) [454, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  313.967681] PVR_K:(Error): PVRSRVLookupHandle: Error looking up handle (149) [1407, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/handle.c]
<6>[  313.967803] PVR_K:(Error): PVRSRVExportFDToIONHandle: Failed to look up MEM_INFO handle [78, /home/gnutoo/embedded/android/replicant-4.0/kernel/samsung/tuna/drivers/gpu/pvr/ion.c]

was achieved with :
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(){

    int fd = open("/dev/pvrsrvkm",O_RDWR);
    printf("fd = %d\n");
    while(1)
        sleep(10000);
    return 0; //not reached
}

possible solution:

https://groleo.wordpress.com/2012/07/24/ion-buffer-sharing-mechanism/
https://groleo.wordpress.com/2012/07/31/jelly-bean-codec-infrastructure/

=> we need to modify OMXCameraAdapter.cpp not to send its acquired buffer to OMX, and instead to reimplement that part, by looking at how the TI V4l2 camera does it.

=> we probably need to replace the UseBuffer functions and look at how OMX_UseBuffer works in order to replace them:
there is a use buffer function which calls different functions according to its state, for instance OMXCameraAdapter::UseBuffersPreview which uses OMX_UseBuffer...

OMX_UseBuffer calls PROXY_UseBuffer in hardware/ti/omap4xxx/domx/domx/omx_proxy_common/src/omx_proxy_common.c