Changelog

Changelog (driver)

Condensed driver-side changelog of next after RC1 (v2026.10.11-rc1). The full stack log is on the OpenIMP wiki Changelog. Everything here is in next, not released; build, module-build and host tests only, no soak yet. "Device-tested" means run on a camera on its topic branch.

agg-38 (2026-10-12)

• AWB statistics only from a current frame: T23/T31 GetAwbZone (vendor 675-byte block, stock scaling: truncated zone means) and T41 GetAwbStatistics (three 15x15 planes, 2700 bytes) answer -EAGAIN unless the data comes from a statistics frame of the running stream within the last second. Device-tested on a T31, a T23 and a T41.
• fcrop_upscale_pct capped at 100 (T23, T31): a T31 with main 1920x1080 plus sub 640x360 ran clean through 10..100 % (windows down to 960x540); 150 % (2.5x) hard-hung the SoC until the hardware watchdog reset it. The default stays 0.
• T31 sharpness: the demosaic strength mapping is re-applied on a bank refresh like the stock driver (host test and module build only).
• T41 reload fixes: VIN index bounded in the CSI init (heap overwrite on reload), module pinned while frame-channel files are open, IRQs freed with their dev_id, WaitFrameDone woken from the frame-done event. 50 load/unload cycles clean on a T41. Known: WaitFrameDone still reports a constant frame counter.
• T41 tuning controls (stock 1.2.6 semantics, size-checked user copies): AWB converge step, AWB CT trend offset, TMO curve, EV/AT list, AE converge step (stored), statistics configuration (AWB grid change while streaming gives -EBUSY), WaitFrameDone. Seven of them device-tested on a T41; the TMO curve had no visible effect in that configuration (TMO map not running).
• Vendor-compatible /proc/jz/sensor file layout, all SoCs (host test only).
• Build fix: the T23 crop cap used READ_ONCE, which the 3.10 kernel does not have; it reads through TX_ISP_READ_ONCE.

agg-37 (2026-10-11)

• Smaller modules: T31 exports only the symbols other modules import (about -46 KB); T10/T20 per-function sections and --gc-sections (about -20 KB each).
• T23 SwitchBin reworked: new banks built in a private validated buffer pair and published by pointer; a failing select leaves everything untouched.
• T23/T31 msca_flip_state (read-only): bit mask of who flips each axis.
• T10/T20: anti-fog preset that cannot hang (the stock preset pair raced the frame path), lens-shading scale control (SetMeshShadingScale); scaler capability no longer shrinks after SET_SCALER.
• T40 and T23 kernel log quiet in normal operation (about 180 T40 lines became info notes; t40_runtime_trace=1 / t23_runtime_trace=1 bring them back).
• T41 stability (host build only at the time): /dev/isp-m0 handles counted (closing a second handle freed the tuning attributes under the running application; verified on a T41 in the agg-38 session), real DMA buffer for IVDC, IVDC and mode events delivered, out-of-object accesses of the recovered core removed, unrecovered WDR fusion body refused unless t41_wdr_fusion_unsafe=1, 55 progress lines quieted (t41_runtime_trace=1), /proc/jz/isp watcher (report only). t41_msca_enable_at_frame diagnostic (default 0).

agg-36 (2026-10-11)

• T41 SwitchBin, AutoZoom, mask block and scaler level controls (host tests and module build only). T41 SwitchBin swaps in a fully validated bin without tearing and no longer holds the tuning mutex while waiting for the ISP thread.

In progress, not in next

2026-10-17, branches claude/t41-boot-oops, claude/t41-ae-perframe, fable/t40-3a-perframe (device-tested, no soak):

• T41 boot oops fixed (claude/t41-boot-oops): a failed first IMP_ISP_AddSensor closes the device right after ispcore_core_ops_init(enable=1) started the firmware worker isp_fw_process; kthread_stop then returned -EINTR (worker had not run), the driver took that for a failure and left the pointer in the core, and the retry stopped an already freed task_struct (exit_creds NULL oops about 22 s after boot, seen twice). New helper t41_stop_isp_fw_thread: the pointer is cleared first (xchg), -EINTR is a normal early stop (warning "firmware thread stopped before first run"), other exit codes are only logged; the AE and frame-sync worker pointers are cleared the same way. Verified with a diagnostic parameter that stops the worker before its first run on every close: fixed driver 3/3 cycles without oops, the old logic reproduced the double stop; 12 boots clean, 40 start/kill cycles clean (that window is too small to hit the race). Open: why the first AddSensor fails at boot (tisp_top_init -16 on retries).
• T41 AE regulates (claude/t41-ae-perframe): (1) the sc5336 target table has two knots with the same EV; the knot validator rejected it, metering returned -1 on every frame and the update was skipped, so IT/gain stayed at the init values 1792/1x and the picture stayed black. Non-decreasing knots are accepted (a zero-width interval returns its left target, like the OEM routine), and any metering failure falls back to the histogram mean with a fixed target and one log line. (2) gc5603: the requested +11 % gain rounded back to the same LUT code while the deflicker lattice pinned IT, the update was dropped as "no change"; now IT is trimmed off the lattice first, the neighbouring gain code only if IT cannot move. (3) At the gain limit the lattice snap and the trim alternated every update; a plan that does not move the exposure toward the target counts as no change. (4) The sc5336 module rewrites its register table, including the frame length, at stream-on and undid the 25 fps set before; the frame rate is re-sent after the deferred sensor start (frame length 1800 with max IT 2152 gave black frames). Results: dark room reaches IT 2152 / 32x within 4 s, light on returns to IT 1620 / 2.9x (zone mean 62, target 63) within about 4 s, a 2x target step settles in under 1 s, gc5603 holds zone mean 71/70; 0 oops on both boards. Diagnostics t41_ae_meter_stage (read-only) and one-shot AEMETER/AEKNOT dumps are in and to be thinned before merge. Open: IT-max node above the lattice, ISP digital gain for the LUT remainder, the lifted vendor AE (t41_safe_ae_controller=0) is not repaired.
• T40 vendor AE per frame (fable/t40-3a-perframe, devtest on the T40 board, sc830ai): repaired lift defects in sequence: the tune divisor was shifted twice (steps 1024x too small), the anti-flicker IT ladder was built from a zero frame-rate rational (IT stuck at one node, now filled from the sensor fps: ladder 469/938/1406/1875 at 25 fps), pointer-scaling and ioctl stack-frame classes in the CCM/BCSH/LSC init structures. AE converges 2-3 frames after the first allocation, zone mean 44 = target 44, IT 1875, gain about 6x, stable, no oops. The vendor stack on the same board runs the same IT regime with gain 1.1-1.3x, so the open gain is still 4-5x too high (stats scaling or pipeline state of the devtest; open). Per-frame diagnostics via t40_ae_diag (level).
• T40 anti-flicker: t40_allow_antiflick defaults to 1, t40_antiflick_hz selects 50/60 Hz, Set/Get fixed (the earlier runtime switch oopsed on the Get after a Set; with the switch off the request was ignored).

In progress on the branch (default off, t40_module_ctx_inits bitmask): the lifted module inits for gamma, LSC, CCM, BCSH, CLM. Gamma and LSC are clean, CCM is clean without its refresh, the BCSH/CCM refresh loops still hang (same defect class as the AE lift: zero-base pointers, wrong loop starts). t40_ev_updates stays 0.

• The open T40 kernel driver on the T40XP board with the sc830ai sensor delivers real frames. It is not released and not part of any aggregate.
• T40 integration branch claude/t40-integration-1015 (2026-10-15, device-tested on the T40XP/sc830ai board): further lift defect classes fixed (OEM stack frames, relocations, pointer-typed declarations, ISR loop stride); test application 24/0 and 10 minutes of streaming without an oops. Colour cast solved with t40_gates_oem_offset=1 t40_gates_day_blc=1 (bin bypass flags read at the OEM offset, BLC kept active in day mode because GIB removes the black level behind the white-balance gains): colour-saturation index about 8 instead of 20. CDNS (enable_cdns), YSP (t40_ysp_on, with an init guard that removes the old YSP panic) and ADR (t40_adr_on) run as opt-in translations of the vendor code. Not in next, not released.