[Galaxy Camera Q&A, Help & Troubleshooting] luscoma:
I've spent the last day or so poking around in the camera and have pretty much approached the limit of my knowledge. I'm going to post what I've found here so that maybe someone whose been down this road can give some more information.

TL;DR; The functionality we seek is not directly exposed, there's a possibility that some functions which look like factory test functions in the driver may do what we need to do but I am not sure if that can really be confirmed.

Okay starting with the bits I know:

First up the m9mo driver in the linux kernel (/drivers/media/video/m9mo.c/h). As far as I can tell this is the driver for the soc actually used in the camera it writes some i2c commands and maintains the state of the hardware. It has a lot of neat functions which are all exposed to the v4l2 subsystem and can be poked via ioctls if you can get a sysfs node to do it on. It seems to me that this thing is a registered as subdevice in v4l2 and subsequently it's set to not expose itself as a sysfs node. Only the main device which I believe is registered by libfimc is exposed in sysfs. Looking back at the m9mo driver it seems like the only way that manual control of the focus motor can be achieved is via a set of methods called factory_af*, particularly I'm looking at set_factory_af, set_factory_af_step, set_factory_af_position. set_factory_af has a lot of options for manually manipulating the focus lock and the focus range and things but I believe most of that functionality is exposed already via Android (with the exception of setting specific scan ranges).

The other two though look more interestin, particularly set_factory_af_position. If you look though the m9mo.h file it seems like the i2c commands it sends are divided into categories, this function sends a function under the CAMERA_LENS category called AUTOFOCUS_ADJUST which to me feels like a way to either relatively or absolutely position the camera motor. I have not tried sending the raw i2c command though it's pretty trivial to figure out what to send based on the driver code. I may try this if I find some time.

Going up a level to fimc (/drivers/media/video/s5p-fimc):

I'm pretty hazy on this but I think that this is the unified camera interface for samsung. This has been explored some by the CM team and so there's knowledge out there about this sub-system I just don't have it lol. Based on my rudimentary understanding of v4l2 this seems like it's registered as the main camera device and then m9mo is registered as a sub device of it. So on my device /dev/video2 and /dev/video3 are registered by libfimc and I can't seem to open /dev/video1 or 0 (the other video devices in the teens are libjpeg stuff).

Going up another level to the android hal type things, libcamera_client.so does contain some very interesting tidbits. This is the module that basically services android calls via android.hardware.camera and it seems to me that if you do objdump -T on it that it actually contains parameter name strings for the super interesting stuff in the m9mo driver. Things like:

000222f7 g DO .rodata	0000000b _ZN7android16CameraParameters26FACTORY_AF_ZONE_AUTO_MACROE

000233ea g DO .rodata	00000006 _ZN7android16CameraParameters21FACTORY_AF_ZONE_MACROE

00022899 g DO .rodata	00000007 _ZN7android16CameraParameters22FACTORY_AF_ZONE_NORMALE

0002298d g DO .rodata	00000006 _ZN7android16CameraParameters20FACTORY_AFLENS_CLOSEE

0002206a g DO .rodata	00000005 _ZN7android16CameraParameters19FACTORY_AFLENS_OPENE

0002283a g DO .rodata	00000002 _ZN7android16CameraParameters28FACTORY_AF_POSITION_POSITIONE

00022737 g DO .rodata	00000002 _ZN7android16CameraParameters24FACTORY_AF_POSITION_NEARE

00022406 g DO .rodata	00000002 _ZN7android16CameraParameters23FACTORY_AF_POSITION_FARE

00022847 g DO .rodata	00000008 _ZN7android16CameraParameters18FACTORY_AF_LED_LOGE

00022603 g DO .rodata	0000000e _ZN7android16CameraParameters24FACTORY_AF_LED_END_CHECKE

00022726 g DO .rodata	0000000a _ZN7android16CameraParameters20FACTORY_AF_STEP_SAVEE

00022eb8 g DO .rodata	00000008 _ZN7android16CameraParameters24FACTORY_AF_INTERRUPT_SETE

000222e5 g DO .rodata	0000000a _ZN7android16CameraParameters20FACTORY_AF_FOCUS_LOGE

000230a8 g DO .rodata	0000000a _ZN7android16CameraParameters20FACTORY_AF_RANGE_LOGE

00022ef1 g DO .rodata	0000000a _ZN7android16CameraParameters20FACTORY_AF_LOCK_STOPE

0002283c g DO .rodata	0000000b _ZN7android16CameraParameters21FACTORY_AF_LOCK_STARTE

00022d2c g DO .rodata	00000009 _ZN7android16CameraParameters19FACTORY_AF_STEP_LOGE

00022bfd g DO .rodata	0000000a _ZN7android16CameraParameters25FACTORY_AF_MOVE_END_CHECKE

00023359 g DO .rodata	00000005 _ZN7android16CameraParameters15FACTORY_AF_MOVEE

00022788 g DO .rodata	00000009 _ZN7android16CameraParameters23FACTORY_AF_LOCK_OFF_SETE

00022f87 g DO .rodata	00000008 _ZN7android16CameraParameters22FACTORY_AF_LOCK_ON_SETE

00022c1f g DO .rodata	00000003 _ZN7android16CameraParameters10AF_LAMP_ONE

00022445 g DO .rodata	00000004 _ZN7android16CameraParameters11AF_LAMP_OFFE

00022214 g DO .rodata	00000016 _ZN7android16CameraParameters25KEY_FACTORY_TILT_AF_RANGEE

00022ca3 g DO .rodata	00000014 _ZN7android16CameraParameters41KEY_FACTORY_DEFECTPIXEL_SET_NLV_DRAFT1_HDE

00023173 g DO .rodata	00000010 _ZN7android16CameraParameters40KEY_FACTORY_DEFECTPIXEL_SET_NLV_DRAFT_HSE

000225e7 g DO .rodata	00000011 _ZN7android16CameraParameters38KEY_FACTORY_DEFECTPIXEL_SET_NLV_DRAFT2E

000220a0 g DO .rodata	00000011 _ZN7android16CameraParameters38KEY_FACTORY_DEFECTPIXEL_SET_NLV_DRAFT1E

000235fc g DO .rodata	00000011 _ZN7android16CameraParameters38KEY_FACTORY_DEFECTPIXEL_SET_NLV_DRAFT0E

0002321c g DO .rodata	00000016 _ZN7android16CameraParameters25KEY_FACTORY_AF_DIFF_CHECKE

00022e07 g DO .rodata	00000013 _ZN7android16CameraParameters23KEY_FACTORY_AF_LED_TIMEE

00022b6b g DO .rodata	00000018 _ZN7android16CameraParameters27KEY_FACTORY_AF_LED_LV_LIMITE

00022bb3 g DO .rodata	00000015 _ZN7android16CameraParameters24KEY_FACTORY_AF_LED_RANGEE

00021f8c g DO .rodata	00000010 _ZN7android16CameraParameters19KEY_FACTORY_AF_ZONEE

000228ac g DO .rodata	0000000f _ZN7android16CameraParameters18KEY_FACTORY_AFLENSE

00022b8e g DO .rodata	00000019 _ZN7android16CameraParameters28KEY_FACTORY_AF_RESOL_CAPTUREE

00022049 g DO .rodata	00000016 _ZN7android16CameraParameters25KEY_FACTORY_AF_SCAN_RANGEE

00023583 g DO .rodata	00000016 _ZN7android16CameraParameters25KEY_FACTORY_AF_SCAN_LIMITE

00021f00 g DO .rodata	0000000f _ZN7android16CameraParameters23KEY_FACTORY_AF_POSITIONE

000226d2 g DO .rodata	00000010 _ZN7android16CameraParameters23KEY_FACTORY_AF_STEP_SETE

000233df g DO .rodata	0000000b _ZN7android16CameraParameters14KEY_FACTORY_AFE

000229ac g DO .rodata	00000008 _ZN7android16CameraParameters11KEY_AF_LAMPE

00022732 g DO .rodata	00000002 _ZN7android16CameraParameters23FACTORY_AF_POSITION_PARE

Going a step further and disasembling in ida or doing a string dump, the key_factory_* blah stuff actually maps to parameter names you can set in CameraParameters:

factory-af-pos

factory-af-zone

factory-af-scan-range

factory-tilt-af-range

factory-af-step

factory-aflens

af-lamp

factory-af-led-lv-limit

factory-af-resol-capture

factory-af-led-range

factory-af-ledtime

factory-af-diff-check

factory-af

factory-af-scan-limit

Unfortunately I tried just doing:

Camera c = Camera.open()

Parameters p = c.getParameters()

p.set("focus-mode", "manual") // This actually works the camera defines a valid autofocus mode of manual and if you look at the kernel logs this does get sent to the driver

p.set("factory-af-pos", 123) // The function in the driver writes a single byte of 0-255 so I imagine this is just a focus step range.

c.setParameters(p)

This appeared to do nothing but it doesn't raise a RuntimeError so that's something. If you try reading (most) of those parameters you just get null out, a few of them actually show up with factory data. My guess is that you probably have to put the camera into a special mode or know the right incantation to get it to respond properly -- even then I'm not sure how it is implemented in the hardware (i.e. it probably wouldn't trigger an AutoFocusMoved callback in Android).

Hope this helps someone, I'm dieing for this functionality :(