camera驱动交流高通平台

Camera驱动分析Auther:zhuyong2013.3.6Android 的 Camera 色含取另器（viewfinder'）知J2.、像的功 從。©命Android &布版的Camera程矗%鉉功視比施简单，僅昱農 移存的弯徇分成客户犹忌服务器鬲个祁分，它笛建立Android的迎 H向C? vfVBinder的传枸上。1 Framework 耀分朽Camera的代徧i走农以下的©录中：1.1 Camera 的JAVA <£ 4 的路各，Carrera, java 蛊主走空珈的 frameworks/ base/core/ java/android/hardware/Camera.Java 迫个盖盍滋£JNI申宝必的滋立互。冇哝方:主逼过JNI的方弍讷用 本的代親再到，有歧方:主仓乙空昵。1）、Camera -JJAVA 本他讷 用祁分（JNI ）:frameworks/ base/core/ jni/android_hardware_Camera.cpp 过部分内宕徧语成总 0 tr- S. Iibandroid_runtime.soo2）、Camera客户講3卩分的.丈J牛衣以下的£）杲中：frameworks/base/include/camera/Camera痔农以下的©杲申： frameworks/base/libs/camera/Ci 4p分的肉宕盘编詐戌诊libui.sOo 3）、Camera服务部分: frameworks/ base/services/camera/libcameraservice/祁分内宕斂务译 咸痔libcameraservice.sOo为3农观一个與体功施的Camera,右畏戾尼込甭爱一个砸借柯美的Carrier礎动痔(例上u通过诉!/Bvicieo fo厂linux礎为移序知Jpeg尙親 彼房空观)。巨个痔灣Camera的服务 庙 libcameraservice.so 讷 闸1.2 Camera的各个痔向的铐徇可以用下囹的表孑：!CaneraiC 件比Camera务侥的各个痔中，libui.so毎孑絃心的金瓷，它対上尼的 罐年的雄iCamera 塞，案 libandroid_runtime.so 遏过 iJf) >?)Camera 案摆供対JAVA 的摆 匕，并且広呢 3 android.hardware.camera 盖 olibcameraservice.so Camera 的陋务器需 >4 ,它遙卫他承libui.so 器的功能，并fi libui.so中的另夕卜一祁分内寡刖逼过辿褛向通讯（即 Binder机初）的为式辿紂逼机。libandroid_runtime.so 餉libui.so 荷个舟虽么用的農中除了 Camera 込衣典他方而的功能。Camera主爰的丛殳付侖以下几个：ICameraClient.hCamera.hICamera hICameraService hCameraHardwarelnterface h弦个Camera右迄街的时何，以尢致E分廉Client Server禺个 部分，它们分别衣花个迎翟申迄&,Binder机制空珈辿綬向逼帝电样衣客户荒诫用谑，劝從刖衣腿隽器申空呢，僅昱 农客户舵中讷用就阿像盍滋讷闱服參鴛中的功能，辿紅通帝的部分 对£尼襁序不可见。从桓 穽铐徇 E 来瘩，IGameraService.h5 IGameraClient.h 如ICamera.h 三个 案立文了 camera 的滋 庁和 穽枸，ICameraService.cppCamera.cpp 禺个 牛 用 孑Camera穽枸, Camera的駁体功能衣下思讷闱砸镌枸話的够来空呢 2孤祐毘分朽Camera礎动尼可分巧鬲祁分。一思kernel毘、E奏後侥的初碇化，加和）吞数伺洼。一vendor ,它framework昂京尼礎为的dA Q。/ hardware/qcom/cameraQCameraHWI.cppQCameraHWI.h/vendor/qcom/proprietary/mm-cximera/kernel/drivers/media/video/msm/ I"/ arch/arm/mach-msm/board-i370-camera.c2.2初餡亿的过綏/endor老石*刀能亿时令获取seasof 哎基本sensor的2惡，鑒毛支撼3D等。时施傅股后的传总另到用户空。Kernel层初始化时，主要是初始化I2C接II、配置参数、check sensor IDOpen 过程(7X)：GPIO ONEnabcl_powcrEnable elk初始化i2c找n皿旨IH钟 Check LDGPTO offOisabel poxve'Disable elkQiaroraniicnrvrpnIVu.(p«a”川 11 MhwcO"if wUw Hiif>ft*JnKl £<? jI.ii tnr«arfivfMtr心m “dmr咖 t«liC sil B"mjirBaliiM jnneonJ BtQ 2in ：nn 沁Wt can.? I trai_.cOTjHi a*. U io.' ertmr wm ra luT/tjttftail <)t(TW1 entire 他 nil卜、T.L叫呻 OXKtuenU)Openii程(8X)：JAVA层是一样的，不一样的在于HAL层的OPEN方法从/hardware/Qcom/camera/ Qua1commCamera2 epp HAL_openCameraHardware(camerald)改为了 new QCameraHardwarelnterface (camerald, mode); iMoiset (camHa 19 Q, sizeof (camera_hardware_t);camHal ->hardware 一 new QCameraHardwarelnterface(cameraIdr mode); /HA if (camHal->hardware && camHal ->hardware >isCameraReady()(camHal->cameraId = camerald;device = &camHal->hw dev;devi ce->commonclose = close_camera_device;device->ops = & cawexa_ops; device->priv = (void *)camHal;我接着一步步往下走/hardware/qcom/camera/QCameraHWI. cpp调用対象QCameraHardwarelnt erface的构造函数QCameraHardwarelnterface:QCameraHardwarelnterface(int camerald, int mode)/* Open camera stack! */result=cam_ops_open(mCamerald, MM_CAMERA_OP_MODE_NOTUSED);setPictureSizeTable ();setPreviewSizeTable();setVideoSizeTable ();initDefaultParameters () :/* 初始化默认的cam参数*/然后调用/hardware/qcom/camera/mm camerai nterface/QCameraHWI.cppmtmm_camera_open (mm_camera_c£> 1 _t *my_obj 9mm_came ra_op_ir.ode_t ype_t opjnode) -char dev_name|MM_C/kMERA_DEV_NAME_LEN;int32_t rc = MM_CAMERA_OK;int8_t q_S-MMCAMERA1dEV_0PEN_TR：ES;uint8_t sleep-jasec=MM_CAMERA_DEV_OPEN_RETRY_SLEEP; uint8_t i;LOGE (f,%s: beginnn, func );if (my_obj->op_mode !- MM_CAMERA_OP_MODE_NOTUSED) LOGE (f,%s: not allowed in existing op mode %dn,f, func, my_obj ->op_mode);return -MMCAME RA_E_T WVAL ID_OPE RAT I ON; 一 一if (opjnode >= MM_CAMERA_OP_MODE_MAX)LOGEr%s: invalid input %dnnz func z op_mode);return -MM-CAMERA E_INVALID_INPUT; -snprin(dev_namG# sizeof (dev_name) f ff/cLev/%sr, t znm_cani/rc = mm_camera_dev_open(&my_obj- >ctrl_fdz dev_name);LOGE (n%s : mm camera dev open rc = %dnn ffunc r rc);IX)GE (n%s the dev name = %swz _funct dev name);dontry;my_obj->ct rl_fd = open (dev name,O_RDWR | O_N0NBLOCKLOGE(n%s: ctrl_fd = %dn, func, my_obLOGE (f,Errno: %dff7e-r-2no);这个将调用系统调用open的方法，打开设备节点dev/videoO (后置相 机)，/dev/video2 (命畫枸机)，色个顺序渥.餉内絃(I 4动的县和 video的涯册顺好枸髯的。那Z卫个节点昱右哪儿注册的呢？/ kernel/ drivers/ media/video/msm/msm.cmsm_cam_devjnit 个禺敖舍対节.6.注册/ * register v4I2 video device to kernel as / dev/ videoXX */D (nvido_rgistGr_devicnn):rc = video_regi s ter_devi ce(pvdev,VFLT YPE_GRABBER,msm_v4 22_zlt );if (rc) _ 一pr_err (rf%s : video_register_device failednf, z funcgoto Leg_fail;我们接着看看open函数是怎么对sensor辿行上电操作的HAL层的OPEN方法会调用到如卞中的msm_openpvdev->re lease = video_device_re lease; pvdev->fops= &g sm_f ops;pvdev->ioctl_ops = & g_msm_ioctl_ops; pvdev->minor= -1;pvdev->vf1_type = 1;static struct v412_file_operations gops = owner= THIS_MODULEZ 一.open=msm_open,.poll=msmL_poll,.mmap=msm xnma.pz.release = msm_closez.ioctl = video_ioctl2,;在mctl_open中我们将真正的打开相机/ * now we really nave to activate tne cameraD (n%s : call metl_opennff z func);rc = pmctl->mutl_open (pmctl, MSM_APPS_ID_V4L2);if (rc < 0) 一pr_err (n%s : HW open failed rc = 0x%xnlf,fuigotoopen_failed; 一 -通过调用 msm_mctl_open 函数中的 v4l2_subdev_call (如卜)/* then sensor move sub dev later */rc - v412 subdev call (p mctl >sensor 3devz core, a power, 1); if (rc < 0*)一pr_err (fl%s : sensor power up failed: %dnn 9 func, rc);goto isensor_sdev_failed; - -s_power 会调用到 s5k4el_v4l2.c 中的static struct v412 subdev core ops s5k4el subdev core ops = wOHBw * ioctl 二 s_power 一 msm_sensor_power,； _从而调用到msm_sensor_power完成上电But此时camem并浚有迎紂*刀亦亿，口耀.E电年谆取1D而己，那Esensor 2昱去什E时何$初砧©的妮？摆第&下看：菽们r检力了科3 /dev/video2的节点，d msm.open也数中釆后舍去 讷 用 msm_send_open_server,迪个色敌 会去喘强我们用户空向的 config 銭裡。if(pcain->ase_count = 1) rc = msmsend_open_server (pcam);if (rc <0 &&_rc != -ERESTARTSYS) pr_err (f,%s : msni_send_cpen_server failed %dnff, funcz rc);gotoTmsm send open server failed;static int IT1SIT1_S6I1CI_OpGIl_SGrVGT (struct msm_cam_v412_dev: ( _ 一 一 一int rc = 0;struct msm_ctrl_cmd ctrlcmd;D(n%s qid %dnMr funcf pcam >server_queue_idx):ctrlcmd.type二 MShFV4L2_OPEN; 一一ct rlcmd.t imeout_ms = 10000;ctrlcmd. length = strnlen (g_sezrver_dev. con£±g info . config dMAX_DEV_NAME_LENj+1;_ctrlcmd.value - 7char*) 9se2rver_dev.config_info config d ctrlcmd. vnode_id = pcam->vnode_id;ctrlcmd.queue_idx = pcam >se rve r_queue_idx;ctr丄cmd.oonfig ident = g sezrvex- dev. config info.config dev i/* send comma nd to config thread in usersspBCG，and get retur n value */ rc = msm_server_contro 1(&g_servez_devf &ctrlcmd);农世个色歆中我们甭理谊童迪个timeout的时向陷刮，它蛊理车我們 的请求0细衣10s旳丈戌，舎则config彼裡就合超耐，从而呂妖枸机特 无:主值用，口能逼过金2夷修連。H个MSM./4L2.OPEN将舍调用到 vendorqcomproprietarymm-cameraservercoreQcamsvr.qcamsvr_process_server_node_event 迪/卜 色敌会 谜滋孫弘下:if (ctrl->type = MSM_V4L2_OPEN) LOGE (f,MSM_V4L2_OPENis receivednf,);snprintf (config_arg >config_namer MAX_DEV_NAME_LENr r (char *)ev©nt_data.isp_data.ctr1.value);CDBG(fl%s : OPEN %snr, func z config_arg->conf ig natmp_mctl_s t ru ct = malloc(sizeofl_inst_t); if (!tmp motl_struct) CDBG_ERROR (11 % 3 : cannot malloc mctl strucfuncctxlT>5ta tub = CAM_CTRL_FAILED;v412_ioctl . ioctl_ptr = Ctrl;goto terror;我们可以看到用户空间在这个地方已经收到了我们内核的请求了，这部分代码接着 往下走会去创建我们的config线程，如下：if (tmp_mctl_struct->handle = create_v412_conf_thread (config_arg) ) NULL) CDBG_ERROR (fls : create_v412_conf_thread failed11 Ctrl->status = CAM_CTRL_FAILE D； v412_ioctlioctl_ptr = Ctrl;goto >Lerror_config_thread_creation;那么我们/dev/configO的节点在什么地方打开的呢？往下看在cam_mctl_thread线程中仃个函数mctl_init,这个函数会完成节点的打开 vendorqcomproprietarymm-cameraservercoremctlmctl. c 中的函数mctl_init. p cfg ctrl->camfd = open(config device, 0 RDWR); i£ (p_cfg_ctrl->camfd < 0)CDBG_ERROR(n%s: open %s failed: %s!nn r funcpme->cfg_arg. conf ig_name, strerror (ermo); return -ENODEV;在打开这个节点后，随后用户空间就会利用这个节点去完成sensor的初始化了 我们看下而s comp ops = &p cfg ctrl->comp opsMCTL COMPID SENSOR; if(!s_comp_ops->handle) sensor init dara t sensor init data; ii«itmQ handle 一 sensor client open (s com© oids);if(!tmp_handle | (tmp_handle != s_comp_ops->handle)CDBG_ERROR ( n%s Error creating sensor interface 11 z func);sensor client open failed;sensor_client_open这个函数首先会去初始化具体的摄像头，如F：static int SGnSOTCl IGnt_init (uint32t handler met l_op3t 14 ops, voiddata)int status = 0;3ensor_init_data_tp_init_data;uint322t fd- init_data-fd;sensor_client_t *sensor_client = get_sensor_client_info(handle);if(!sensor_client)CDBG_ERRdR(fr%s: failed %dn* func LINE_ ); return -EINVAL;sensor_client->ops = ops;sensor Ctrl t sctrl = sensor dient->sensorCt工丄；CDBG (,f%s : sfd = %dnH 9 func9 fd);sctrl->sfd = fd;status 一 sensor_ini:return status; ? end sensor clientJnit ?int8_t sensor_init(sensor ctrlt *sctrl)(一 -struet mnm camsensor info sinfo;int8_t rc - 1;uint_t ent;LOGE(n %s: Ew z func );sensor_common_parm_init(sctri):rc = ioc(su匕MSM CAM IOCTL GET SENSOR INFO, &sinfo)；if (rc < 0) -一CDBG_ERROR(n%s: MSM_CAM_IOCTL_GET_SENSOR_INFO(*d) failed %d!nnr sctrl->sfd# rc);return rc;CDBG ( wkernel returned %snr, sinf o . name);for (cnt = 0; ent < (sizeof(sensors) / sizeof(sensors0); ent十十) CDBG(nkerne1 retuned %sr compared to %snn, sinfo.n曰me. sensorsent if (!stremp(sinfo.namer sensors ent.snme) strlcpy(sctrl >sensorsensormoae.no sinfo.name SENSOR_MODEL_NO)；/* Load chromatix file from chromatixType variable */LOGE (lf %s zhuyong cat sensor initM, func ); sctrl->start = &sensorsent;LOGE(n%s zhuyong cat sensor_init I”，_func_);/sCtrl->se nsorcam_mode = cctrl- >currentZmode7"rc 一 sctrl->start->s_start(sctrl);if (sctrl->sensor.out data.sensor output.output format = SENSOR r c = se n s o r_l oad_ch r oma 七 ix(su 七 zrl);rc = ioctl(sctrl->sfd, MSM_CAM_IOCTL_GET_SENSOR_INFO, &sinfo):ft先在sensor_init函数中，会先去sensor的信息(包括sensor的类型yuv or raw, af enable ?闪光灯类型，sensor名等)sctrl->start = &sensors .ent;/sCtrl->sensorcam_mode = cctrl->current_mode:rc = sctrl->start->s_start(sctrl):这个地方将获取数组名，并将调用函数s5k4el_process_start (),rc = sensor_load_chromatix(sctrl);这条语句就会去加载我们的库文件了(仅仅针对RAW sensor)我们看看s5k4el_process_start这个函数：int8_t s5k4el_process_start(void *ctrl)" "sensor_util_get_output_info(sctrl):这条诰句调用到内核获取长宽等 sensor_util_config(sctrl):这条语句调用到内核尢成初始化 整个open过程大致如上而。2.3相机的控制过程(以自动对焦为例)：public void onShutterDowrio (if (!mlnitialized) return;/ Lock AE and AWB so users can half press shutter and recompoj if (mLockAeAwbNeeded && !mAeAwbLouk && ImZislEndbled) mAeAwbLock = true;mListener. setFocuePagmeters();if (needAutoFocusCall()/ Do not focus if touch focus has been triggered.if (mState !- STATE_SUCCESS && mStcite !- STATE_FAI autoFocus ();/Feixun:added by junwei.xu for fixing IDZ-1272if(isCAF)mHandler. sendEmptyMessaqe (D£LAY_CAi? ); _ /Feixu n:end ? end onShutterDown ?Then autofocus 将调用private void autoFocus()Log.v(TAG, "Start autofocus.n);rrT厂 stener . autoFocus ();mState = STATE_FOCUSING;/ Pause the face view because the driver will keep sending face/ callbacks after the focus completesif (mFaceView != null) mFaceView.pause();upda teFocusUI();mHanaler.removeMessages(RESET_TOUCH_FOCUS); 一 一由于 Camera.java 实现了 FocusManager.Listener 接 I > 所以 mListener.autoFocus()的实现在 Camera.java 中(Overridepub丄:ic void autoFocus()if(mCameraState != SNAPSHCT_IN_EROGRES S) mFocusStartTime = System.currentTimeMillis(); qcameraUtiLProf ile (f,Start auto focus11); /Feixun:added by junwei.xu for fixing IDZ- 1593 if (mCameraDevice = null)return;/Feix un: endmCame ra Devi ce autoFocus (mAutoFocnsCa 1 Iback); setCameraSt(FOCUSING);qcamereUtiLProf ile (lfpost autofocus11);)随后代码对焦走向framework层public final void autoFocus(AutoFocusCalIback cb) 一 mAutoFocusCallback = cb;na t ive_au 10F0 cu s (); 一private native final void native_autoFocus();走向JNIstatic void android_hardware_Camera_autoFocus(jNiEnv *e -LOGV(nautoFocus n)；JNICameraContext' context;sp<Camera> c = get_native_camera (env# thizr &context:); xf (c = ) return;if (c->autoFocus()! NO_ERROR) jniThrowRuntimeException (env，f,autoFocuR failed*1);)然后代码通过c/s架构走向status_t CameraService:Client:autoFocus()LOGl ('*autoFocus (pid %d) n, getCallingPid ();Mutex:Autolock lock(mLock); stat resuIt = checkPidAndH&rdware(); if (result != NO_ERROR) return resuIt;return mHardware->autoEouus();Then进入HAL层/hardware/qcom/camera/QualcommCamera2. cppLOGE(f,Q%s: Er _func);int rc = -1;QCameraHardwarelnterface *hardware = util_get_Hal_obj(device); if(hardware != NULL)rc 一 hardware->autoFocus();)return rc;/hardware/qcom/camera/QcameraHWI. cppstatus_t QCameraHardwarelnterface:autoFocus()if(MM_CAMERA_OK != cam_ops_action(mCamerald, TRUE,MM_CAMERA_OPS_FOCUS, SafMode) hardware/qcom/camera/mm-camera-interface/mm_camera cint32_t mm_camera_action_start(帧 cflmera_obj_t 恤丫 0上 mm camera ops type t opcode, voic int32_t rc = -MM_CAMERA_E_GENERAL；int send_on_off_evt 1;mm_camera_channGl_type_t ch_type;switch(opcode)case MM_CAMERA_OPS_FOCUS:if(Iparm) return rc;LOGE (f,%s: CAMERA SET_PARM_AUTO_FOCUS begin. . .f,z _fur if (0 > mm_camera_send_native_ctrl_cmd (my_ob j ,CAMERA SET PARM AUTO FOCUS7sizeof(i sp3a_a f_mode_t) r parm)mm camera send af event(my ©bif FALSE);#if defined(I37O_CAMERA) I defined(I813_CAMERA)a.ut:o£ociL5 flag = 1;/LOGE(n%s: autofocus_flag =%d為_func,autofocus_flag);#endifLOGECAMERA_SET_PARM_AUTO_FOCUS ok!_func_);return MM CAMERA_OK;_ _-这个地方将要唤醒用户空间的config线程 vendorqcomproprietarymm-cameraservercoreconfigconfig_proc_ctrlcm dccase CAMERA_SET_PARM_AUTO_FOCUS :rc = configjproc_CAMERASET_PARM_AUTO_FOCUS (Ctrl, ctrlCn brea.k;Thenstatic int8_t config_proc_CAMERA_SET_PARM_Al'TO_FOCUS(void *parml, void *parm2) rc 二 ctrl>comp_opsMCTL_COMPID_SENSOR. set_params(ctrl>comp_opsMCTL_COMPID_SENSOR. handle,SENSOR_SET_AUTO_FOCUS, NULL, NULL):在上面这个函数有对YUV和RAW sensor进行区分，RAW sensor走的是MCTL_COMPID_STATSPROC,而YUV是通过MCTL_COMPID_SENSOR往H设置参数的，MCTL_COMPID_STATSPROC涉及较多的VFE操作比较复朵, 我们此次只针对YUV的sensor进行讲解。Lett go SENSOR_SET_AUTO_FOCUS 再通过 sensor_client_set_pawms 这个接口 调度到vendorqcomproprietarymm-cameraserverhardwaresensoro v5640 ov5640_u. cstatic uint8 t OV5640 SGt SUtO fOCUS (void *sctrl/ int32 t "struct v412_control v412_ctrl; sensorctrl t *ctrl = (sensorctrl r *)sctrl;if (ctrl->sfd <= 0)return FALSE;LOGE ("ov5640_sejelly527_focus %dnf,r _LINE);v412_ctrl.id_- V4L2_CID_FOCUS_AUTO:"#if 1if (ioctl(ctrl->sfd/ MSM_CAM_IOCTL_SENSOR_V412_S_CTRIo &v412_ctr LOGE(,fov5640 failed 帝dn巧 _LINE_)return FALSE;#endifreturn TRUE;这个函数就会最终通过ioctrl的方式调用到内核mt ov5640_auto_focus_msm_sensor_s_ctrl_by_enum (struct msm_3en3or_ct struct msm_serTsor_v4T2jctrlinTo_t 1 ctrl_inforint value -CDBG (f,CAMERA一一 jelly527%s INf value : %dntf z f unc , vaJreturn ov5640 sensor start af();MM口动对焦的过程到此结束。2. 3女1何定位Oops通常岀现Oops的时候，我们可以从内核的日志中发现如下信息：baeO:c09026f8 OOOOOOOO 00000012 00000000 cO8eO5aO OOOOOOOibbOO: OOOOOOOO c5cabba8 OOOOOOff c5caa000 e4aff8a0 4015c0a3 00000024 c5catob3ibb20: c040fdl4 c040fe34 80000013 ffffffff<c05c5f2c> ( datot. svc+0x4c/0x60) from <c040fe34> (msm actuator move foe<c040fe34> f展卅74/Oxlf8) frow <c040fdl4> (ittsn*i_ac；f<c040fdl4><c0410514><c0408bfS><c0401a70><c017e27c><c017e32c>(msm_actuator_set_default_focus+0x50/0x60) from <cO4 10514> (nu (msm_actuator_con.fig+0xe4/0xl50i from <c0408bf8> (msm_inctl_cim lcmd+Ox6dO/ OxbcO) from <cO4Oia7O> (msm_ ioctlconf ig+i (rosm_iocrl_con£ig+0x4to8/0x540) £roro <c017e27c>(do_vfs_ioc1+>(do_v±3_ioct1+0x500/0x57c) from <cO17e32c> (sys_ioct1+0x34/0x. (sys ioc11+0x34/0x54) from <c0041e60> (ret. fast syscal 14-0x0/0:.c:m3m_adsp_disable disabl40009 (2013-02-19 02:11:54.965(2013-02-19 02:11:： put c6e3c>(handle IPI+Ox104/0x214) from <c003c3Sc> (gic handle irq+0xbc.从上面的日志中我们可以知道，死机是出现在msm_actuator_move_focus函数的首地址加上0x74的偏移地址上面 那么我们可以通过android自带的gdb來调试vmlinux从而定位到代码中岀现空指针的那一行，Gdb我们可以使用prebuiltlinux-x86toolchainarm-eabi一4. 4. 3binarm-eabi-gdb在linux终端运行zhuyongtfPTRD-2:zhuyongPTRD-2:./arm-eabi-gdb vmlinuxGNU gdb (GDB) 7.l-android-gg2Copyright (C) 2010 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <htcp:/gnu.org/licenses/gpl.html>This is free software: you are free to change and redistribute it.There is NO WARRANTYr to the extent permitted by law. Type show copying- and -show warranty- for details.This GDB was configured as -host«x86_64-linux-gnu targetann-elf-linux*1.For bug reporting instructions, please see:<http:/www.gnu.org/software/gdb/bugs/Reading symbols from /home/zhuyong/vmlinux.done.(gdb) IThen我们再打个断点For buc reputing i：3tninio：3r pleases)kj12 f:ci /here/zhuyDnjAiling.dene.(gib) b *：ic34Dfe343rsakpcint 1 a: CicUC:e34: file /hcifi/zhjy:ng/r;pcj813/kerLel/drr;er3/ttaiezvidf：；i3i.ra:t-at3r2/z3ni_aoiat3r.cf line 242.(吐)I这样我们就知道了问题是出在msm_actuator. c的242行，这个地方出现了空指针导致 的系统crasho我们还可以这样去定位(g呵 i)f 0x74恭洱口12 a: ：icU0fe34: file 饥止.Z呼眄:ep:；13底犹庄怔说/血论二曲t.dtH.s lise 242. (pjl2. 3 Chromatix Light 软件的使用略2. 4 Camera调试分享略