camera驱动交流高通平台

《camera驱动交流高通平台》由会员分享，可在线阅读，更多相关《camera驱动交流高通平台（18页珍藏版）》请在装配图网上搜索。

1、Camera驱动分析Auther:zhuyong2013.3.6Android 的 Camera 色含取另器（viewfinder）知J2.、像的功 從。命Android &布版的Camera程矗%鉉功視比施简单，僅昱農 移存的弯徇分成客户犹忌服务器鬲个祁分，它笛建立Android的迎 H向C? vfVBinder的传枸上。1 Framework 耀分朽Camera的代徧i走农以下的录中：1.1 Camera 的JAVA ?)Camera 案摆供対JAVA 的摆 匕，并且広呢 3 android.hardware.camera 盖 olibcameraservice.so Camera 的陋务

2、器需 4 ,它遙卫他承libui.so 器的功能，并fi libui.so中的另夕卜一祁分内寡刖逼过辿褛向通讯（即 Binder机初）的为式辿紂逼机。libandroid_runtime.so 餉libui.so 荷个舟虽么用的農中除了 Camera 込衣典他方而的功能。Camera主爰的丛殳付侖以下几个：ICameraClient.hCamera.hICamera hICameraService hCameraHardwarelnterface h弦个Camera右迄街的时何，以尢致E分廉Client Server禺个 部分，它们分别衣花个迎翟申迄&,Binder机制空珈辿綬向逼帝电样衣客户

3、荒诫用谑，劝從刖衣腿隽器申空呢，僅昱 农客户舵中讷用就阿像盍滋讷闱服參鴛中的功能，辿紅通帝的部分 对尼襁序不可见。从桓 穽铐徇 E 来瘩，IGameraService.h5 IGameraClient.h 如ICamera.h 三个 案立文了 camera 的滋 庁和 穽枸，ICameraService.cppCamera.cpp 禺个 牛 用 孑Camera穽枸, Camera的駁体功能衣下思讷闱砸镌枸話的够来空呢 2孤祐毘分朽Camera礎动尼可分巧鬲祁分。一思kernel毘、E奏後侥的初碇化，加和）吞数伺洼。一vendor ,它framework昂京尼礎为的dA Q。/ hardware

4、/qcom/cameraQCameraHWI.cppQCameraHWI.h/vendor/qcom/proprietary/mm-cximera/kernel/drivers/media/video/msm/ I/ arch/arm/mach-msm/board-i370-camera.c2.2初餡亿的过綏/endor老石*刀能亿时令获取seasof 哎基本sensor的2惡，鑒毛支撼3D等。时施傅股后的传总另到用户空。Kernel层初始化时，主要是初始化I2C接II、配置参数、check sensor IDOpen 过程(7X)：GPIO ONEnabcl_powcrEnable elk初

5、始化i2c找n皿旨IH钟 Check LDGPTO offOisabel poxveDisable elkQiaroraniicnrvrpnIVu.(pa”川 11 MhwcOif wUw Hiifft*JnKl ? jI.ii tnrarfivfMtr心m “dmr咖 tliC sil BmjirBaliiM jnneonJ BtQ 2in ：nn 沁Wt can.? I trai_.cOTjHi a*. U io. ertmr wm ra luT/tjttftail hardware 一 new QCameraHardwarelnterface(cameraIdr mode); /HA i

6、f (camHal-hardware & camHal -hardware isCameraReady()(camHal-cameraId = camerald;device = &camHal-hw dev;devi ce-commonclose = close_camera_device;device-ops = & cawexa_ops; device-priv = (void *)camHal;我接着一步步往下走/hardware/qcom/camera/QCameraHWI. cpp调用対象QCameraHardwarelnt erface的构造函数QCameraHardwareln

7、terface:QCameraHardwarelnterface(int camerald, int mode)/* Open camera stack! */result=cam_ops_open(mCamerald, MM_CAMERA_OP_MODE_NOTUSED);setPictureSizeTable ();setPreviewSizeTable();setVideoSizeTable ();initDefaultParameters () :/* 初始化默认的cam参数*/然后调用/hardware/qcom/camera/mm camerai nterface/QCameraH

8、WI.cppmtmm_camera_open (mm_camera_c 1 _t *my_obj 9mm_came ra_op_ir.ode_t ype_t opjnode) -char dev_name|MM_C/kMERA_DEV_NAME_LEN;int32_t rc = MM_CAMERA_OK;int8_t q_S-MMCAMERA1dEV_0PEN_TR：ES;uint8_t sleep-jasec=MM_CAMERA_DEV_OPEN_RETRY_SLEEP; uint8_t i;LOGE (f,%s: beginnn, func );if (my_obj-op_mode !-

9、MM_CAMERA_OP_MODE_NOTUSED) LOGE (f,%s: not allowed in existing op mode %dn,f, func, my_obj -op_mode);return -MMCAME RA_E_T WVAL ID_OPE RAT I ON; 一 一if (opjnode = MM_CAMERA_OP_MODE_MAX)LOGEr%s: invalid input %dnnz func z op_mode);return -MM-CAMERA E_INVALID_INPUT; -snprin(dev_namG# sizeof (dev_name)

10、f ff/cLev/%sr, t znm_cani/rc = mm_camera_dev_open(&my_obj- ctrl_fdz dev_name);LOGE (n%s : mm camera dev open rc = %dnn ffunc r rc);IX)GE (n%s the dev name = %swz _funct dev name);dontry;my_obj-ct rl_fd = open (dev name,O_RDWR | O_N0NBLOCKLOGE(n%s: ctrl_fd = %dn, func, my_obLOGE (f,Errno: %dff7e-r-2n

11、o);这个将调用系统调用open的方法，打开设备节点dev/videoO (后置相 机)，/dev/video2 (命畫枸机)，色个顺序渥.餉内絃(I 4动的县和 video的涯册顺好枸髯的。那Z卫个节点昱右哪儿注册的呢？/ kernel/ drivers/ media/video/msm/msm.cmsm_cam_devjnit 个禺敖舍対节.6.注册/ * register v4I2 video device to kernel as / dev/ videoXX */D (nvido_rgistGr_devicnn):rc = video_regi s ter_devi ce(pvdev

12、,VFLT YPE_GRABBER,msm_v4 22_zlt );if (rc) _ 一pr_err (rf%s : video_register_device failednf, z funcgoto Leg_fail;我们接着看看open函数是怎么对sensor辿行上电操作的HAL层的OPEN方法会调用到如卞中的msm_openpvdev-re lease = video_device_re lease; pvdev-fops= &g sm_f ops;pvdev-ioctl_ops = & g_msm_ioctl_ops; pvdev-minor= -1;pvdev-vf1_type

13、= 1;static struct v412_file_operations gops = owner= THIS_MODULEZ 一.open=msm_open,.poll=msmL_poll,.mmap=msm xnma.pz.release = msm_closez.ioctl = video_ioctl2,;在mctl_open中我们将真正的打开相机/ * now we really nave to activate tne cameraD (n%s : call metl_opennff z func);rc = pmctl-mutl_open (pmctl, MSM_APPS_ID

14、_V4L2);if (rc sensor 3devz core, a power, 1); if (rc ase_count = 1) rc = msmsend_open_server (pcam);if (rc server_queue_idx):ctrlcmd.type二 MShFV4L2_OPEN; 一一ct rlcmd.t imeout_ms = 10000;ctrlcmd. length = strnlen (g_sezrver_dev. cong info . config dMAX_DEV_NAME_LENj+1;_ctrlcmd.value - 7char*) 9se2rver

15、_dev.config_info config d ctrlcmd. vnode_id = pcam-vnode_id;ctrlcmd.queue_idx = pcam se rve r_queue_idx;ctr丄cmd.oonfig ident = g sezrvex- dev. config info.config dev i/* send comma nd to config thread in usersspBCG，and get retur n value */ rc = msm_server_contro 1(&g_servez_devf &ctrlcmd);农世个色歆中我们甭理

16、谊童迪个timeout的时向陷刮，它蛊理车我們 的请求0细衣10s旳丈戌，舎则config彼裡就合超耐，从而呂妖枸机特 无:主值用，口能逼过金2夷修連。H个MSM./4L2.OPEN将舍调用到 vendorqcomproprietarymm-cameraservercoreQcamsvr.qcamsvr_process_server_node_event 迪/卜 色敌会 谜滋孫弘下:if (ctrl-type = MSM_V4L2_OPEN) LOGE (f,MSM_V4L2_OPENis receivednf,);snprintf (config_arg config_namer MAX_D

17、EV_NAME_LENr r (char *)evnt_data.isp_data.ctr1.value);CDBG(fl%s : OPEN %snr, func z config_arg-conf ig natmp_mctl_s t ru ct = malloc(sizeofl_inst_t); if (!tmp motl_struct) CDBG_ERROR (11 % 3 : cannot malloc mctl strucfuncctxlT5ta tub = CAM_CTRL_FAILED;v412_ioctl . ioctl_ptr = Ctrl;goto terror;我们可以看到

18、用户空间在这个地方已经收到了我们内核的请求了，这部分代码接着 往下走会去创建我们的config线程，如下：if (tmp_mctl_struct-handle = create_v412_conf_thread (config_arg) ) NULL) CDBG_ERROR (fls : create_v412_conf_thread failed11 Ctrl-status = CAM_CTRL_FAILE D； v412_ioctlioctl_ptr = Ctrl;goto Lerror_config_thread_creation;那么我们/dev/configO的节点在什么地方打开的呢

19、？往下看在cam_mctl_thread线程中仃个函数mctl_init,这个函数会完成节点的打开 vendorqcomproprietarymm-cameraservercoremctlmctl. c 中的函数mctl_init. p cfg ctrl-camfd = open(config device, 0 RDWR); i (p_cfg_ctrl-camfd cfg_arg. conf ig_name, strerror (ermo); return -ENODEV;在打开这个节点后，随后用户空间就会利用这个节点去完成sensor的初始化了 我们看下而s comp ops = &p c

20、fg ctrl-comp opsMCTL COMPID SENSOR; if(!s_comp_ops-handle) sensor init dara t sensor init data; iiitmQ handle 一 sensor client open (s com oids);if(!tmp_handle | (tmp_handle != s_comp_ops-handle)CDBG_ERROR ( n%s Error creating sensor interface 11 z func);sensor client open failed;sensor_client_open这个

21、函数首先会去初始化具体的摄像头，如F：static int SGnSOTCl IGnt_init (uint32t handler met l_op3t 14 ops, voiddata)int status = 0;3ensor_init_data_tp_init_data;uint322t fd- init_data-fd;sensor_client_t *sensor_client = get_sensor_client_info(handle);if(!sensor_client)CDBG_ERRdR(fr%s: failed %dn* func LINE_ ); return -EI

22、NVAL;sensor_client-ops = ops;sensor Ctrl t sctrl = sensor dient-sensorCt工丄；CDBG (,f%s : sfd = %dnH 9 func9 fd);sctrl-sfd = fd;status 一 sensor_ini:return status; ? end sensor clientJnit ?int8_t sensor_init(sensor ctrlt *sctrl)(一 -struet mnm camsensor info sinfo;int8_t rc - 1;uint_t ent;LOGE(n %s: Ew

23、z func );sensor_common_parm_init(sctri):rc = ioc(su匕MSM CAM IOCTL GET SENSOR INFO, &sinfo)；if (rc sfd# rc);return rc;CDBG ( wkernel returned %snr, sinf o . name);for (cnt = 0; ent sensorsensormoae.no sinfo.name SENSOR_MODEL_NO)；/* Load chromatix file from chromatixType variable */LOGE (lf %s zhuyong

24、 cat sensor initM, func ); sctrl-start = &sensorsent;LOGE(n%s zhuyong cat sensor_init I”，_func_);/sCtrl-se nsorcam_mode = cctrl- currentZmode7rc 一 sctrl-start-s_start(sctrl);if (sctrl-sensor.out data.sensor output.output format = SENSOR r c = se n s o r_l oad_ch r oma 七 ix(su 七 zrl);rc = ioctl(sctrl

25、-sfd, MSM_CAM_IOCTL_GET_SENSOR_INFO, &sinfo):ft先在sensor_init函数中，会先去sensor的信息(包括sensor的类型yuv or raw, af enable ?闪光灯类型，sensor名等)sctrl-start = &sensors .ent;/sCtrl-sensorcam_mode = cctrl-current_mode:rc = sctrl-start-s_start(sctrl):这个地方将获取数组名，并将调用函数s5k4el_process_start (),rc = sensor_load_chromatix(sct

26、rl);这条语句就会去加载我们的库文件了(仅仅针对RAW sensor)我们看看s5k4el_process_start这个函数：int8_t s5k4el_process_start(void *ctrl) sensor_util_get_output_info(sctrl):这条诰句调用到内核获取长宽等 sensor_util_config(sctrl):这条语句调用到内核尢成初始化 整个open过程大致如上而。2.3相机的控制过程(以自动对焦为例)：public void onShutterDowrio (if (!mlnitialized) return;/ Lock AE and A

27、WB so users can half press shutter and recompoj if (mLockAeAwbNeeded & !mAeAwbLouk & ImZislEndbled) mAeAwbLock = true;mListener. setFocuePagmeters();if (needAutoFocusCall()/ Do not focus if touch focus has been triggered.if (mState !- STATE_SUCCESS & mStcite !- STATE_FAI autoFocus ();/Feixun:added b

28、y junwei.xu for fixing IDZ-1272if(isCAF)mHandler. sendEmptyMessaqe (DLAY_CAi? ); _ /Feixu n:end ? end onShutterDown ?Then autofocus 将调用private void autoFocus()Log.v(TAG, Start autofocus.n);rrT厂 stener . autoFocus ();mState = STATE_FOCUSING;/ Pause the face view because the driver will keep sending f

29、ace/ callbacks after the focus completesif (mFaceView != null) mFaceView.pause();upda teFocusUI();mHanaler.removeMessages(RESET_TOUCH_FOCUS); 一 一由于 Camera.java 实现了 FocusManager.Listener 接 I 所以 mListener.autoFocus()的实现在 Camera.java 中(Overridepub丄:ic void autoFocus()if(mCameraState != SNAPSHCT_IN_EROG

30、RES S) mFocusStartTime = System.currentTimeMillis(); qcameraUtiLProf ile (f,Start auto focus11); /Feixun:added by junwei.xu for fixing IDZ- 1593 if (mCameraDevice = null)return;/Feix un: endmCame ra Devi ce autoFocus (mAutoFocnsCa 1 Iback); setCameraSt(FOCUSING);qcamereUtiLProf ile (lfpost autofocus

31、11);)随后代码对焦走向framework层public final void autoFocus(AutoFocusCalIback cb) 一 mAutoFocusCallback = cb;na t ive_au 10F0 cu s (); 一private native final void native_autoFocus();走向JNIstatic void android_hardware_Camera_autoFocus(jNiEnv *e -LOGV(nautoFocus n)；JNICameraContext context;sp c = get_native_camer

32、a (env# thizr &context:); xf (c = ) return;if (c-autoFocus()! NO_ERROR) jniThrowRuntimeException (env，f,autoFocuR failed*1);)然后代码通过c/s架构走向status_t CameraService:Client:autoFocus()LOGl (*autoFocus (pid %d) n, getCallingPid ();Mutex:Autolock lock(mLock); stat resuIt = checkPidAndH&rdware(); if (result

33、 != NO_ERROR) return resuIt;return mHardware-autoEouus();Then进入HAL层/hardware/qcom/camera/QualcommCamera2. cppLOGE(f,Q%s: Er _func);int rc = -1;QCameraHardwarelnterface *hardware = util_get_Hal_obj(device); if(hardware != NULL)rc 一 hardware-autoFocus();)return rc;/hardware/qcom/camera/QcameraHWI. cpp

34、status_t QCameraHardwarelnterface:autoFocus()if(MM_CAMERA_OK != cam_ops_action(mCamerald, TRUE,MM_CAMERA_OPS_FOCUS, SafMode) hardware/qcom/camera/mm-camera-interface/mm_camera cint32_t mm_camera_action_start(帧 cflmera_obj_t 恤丫 0上 mm camera ops type t opcode, voic int32_t rc = -MM_CAMERA_E_GENERAL；in

35、t send_on_off_evt 1;mm_camera_channGl_type_t ch_type;switch(opcode)case MM_CAMERA_OPS_FOCUS:if(Iparm) return rc;LOGE (f,%s: CAMERA SET_PARM_AUTO_FOCUS begin. . .f,z _fur if (0 mm_camera_send_native_ctrl_cmd (my_ob j ,CAMERA SET PARM AUTO FOCUS7sizeof(i sp3a_a f_mode_t) r parm)mm camera send af event

36、(my bif FALSE);#if defined(I37O_CAMERA) I defined(I813_CAMERA)a.ut:oociL5 flag = 1;/LOGE(n%s: autofocus_flag =%d為_func,autofocus_flag);#endifLOGECAMERA_SET_PARM_AUTO_FOCUS ok!_func_);return MM CAMERA_OK;_ _-这个地方将要唤醒用户空间的config线程 vendorqcomproprietarymm-cameraservercoreconfigconfig_proc_ctrlcm dccase

37、 CAMERA_SET_PARM_AUTO_FOCUS :rc = configjproc_CAMERASET_PARM_AUTO_FOCUS (Ctrl, ctrlCn brea.k;Thenstatic int8_t config_proc_CAMERA_SET_PARM_AlTO_FOCUS(void *parml, void *parm2) rc 二 ctrlcomp_opsMCTL_COMPID_SENSOR. set_params(ctrlcomp_opsMCTL_COMPID_SENSOR. handle,SENSOR_SET_AUTO_FOCUS, NULL, NULL):在上

38、面这个函数有对YUV和RAW sensor进行区分，RAW sensor走的是MCTL_COMPID_STATSPROC,而YUV是通过MCTL_COMPID_SENSOR往H设置参数的，MCTL_COMPID_STATSPROC涉及较多的VFE操作比较复朵, 我们此次只针对YUV的sensor进行讲解。Lett go SENSOR_SET_AUTO_FOCUS 再通过 sensor_client_set_pawms 这个接口 调度到vendorqcomproprietarymm-cameraserverhardwaresensoro v5640 ov5640_u. cstatic uint8

39、 t OV5640 SGt SUtO fOCUS (void *sctrl/ int32 t struct v412_control v412_ctrl; sensorctrl t *ctrl = (sensorctrl r *)sctrl;if (ctrl-sfd sfd/ MSM_CAM_IOCTL_SENSOR_V412_S_CTRIo &v412_ctr LOGE(,fov5640 failed 帝dn巧 _LINE_)return FALSE;#endifreturn TRUE;这个函数就会最终通过ioctrl的方式调用到内核mt ov5640_auto_focus_msm_sens

40、or_s_ctrl_by_enum (struct msm_3en3or_ct struct msm_serTsor_v4T2jctrlinTo_t 1 ctrl_inforint value -CDBG (f,CAMERA一一 jelly527%s INf value : %dntf z f unc , vaJreturn ov5640 sensor start af();MM口动对焦的过程到此结束。2. 3女1何定位Oops通常岀现Oops的时候，我们可以从内核的日志中发现如下信息：baeO:c09026f8 OOOOOOOO 00000012 00000000 cO8eO5aO OOOO

41、OOOibbOO: OOOOOOOO c5cabba8 OOOOOOff c5caa000 e4aff8a0 4015c0a3 00000024 c5catob3ibb20: c040fdl4 c040fe34 80000013 ffffffff ( datot. svc+0x4c/0x60) from (msm actuator move foe f展卅74/Oxlf8) frow (ittsn*i_ac；f(msm_actuator_set_default_focus+0x50/0x60) from (nu (msm_actuator_con.fig+0xe4/0xl50i from (m

42、sm_inctl_cim lcmd+Ox6dO/ OxbcO) from (msm_ ioctlconf ig+i (rosm_iocrl_conig+0x4to8/0x540) roro (do_vfs_ioc1+(do_v3_ioct1+0x500/0x57c) from (sys_ioct1+0x34/0x. (sys ioc11+0x34/0x54) from (ret. fast syscal 14-0x0/0:.c:m3m_adsp_disable disabl40009 (2013-02-19 02:11:54.965(2013-02-19 02:11:： put c6e3c(h

43、andle IPI+Ox104/0x214) from (gic handle irq+0xbc.从上面的日志中我们可以知道，死机是出现在msm_actuator_move_focus函数的首地址加上0x74的偏移地址上面 那么我们可以通过android自带的gdb來调试vmlinux从而定位到代码中岀现空指针的那一行，Gdb我们可以使用prebuiltlinux-x86toolchainarm-eabi一4. 4. 3binarm-eabi-gdb在linux终端运行zhuyongtfPTRD-2:zhuyongPTRD-2:./arm-eabi-gdb vmlinuxGNU gdb (GD

44、B) 7.l-android-gg2Copyright (C) 2010 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it.There is NO WARRANTYr to the extent permitted by law. Type show copying- and -show warranty- for details.This GDB was config

45、ured as -hostx86_64-linux-gnu targetann-elf-linux*1.For bug reporting instructions, please see:http:/www.gnu.org/software/gdb/bugs/Reading symbols from /home/zhuyong/vmlinux.done.(gdb) IThen我们再打个断点For buc reputing i：3tninio：3r pleases)kj12 f:ci /here/zhuyDnjAiling.dene.(gib) b *：ic34Dfe343rsakpcint

46、1 a: CicUC:e34: file /hcifi/zhjy:ng/r;pcj813/kerLel/drr;er3/ttaiezvidf：；i3i.ra:t-at3r2/z3ni_aoiat3r.cf line 242.(吐)I这样我们就知道了问题是出在msm_actuator. c的242行，这个地方出现了空指针导致 的系统crasho我们还可以这样去定位(g呵 i)f 0x74恭洱口12 a: ：icU0fe34: file 饥止.Z呼眄:ep:；13底犹庄怔说/血论二曲t.dtH.s lise 242. (pjl2. 3 Chromatix Light 软件的使用略2. 4 Camera调试分享略