Adreno X1-85 spontaneous reboot with multiple websites using video

[dblueman]

On Ubuntu 26.04 (7.0 kernel, Mesa 26.0.3) arm64 on a Lenovo Slim 7x X1E-80100 (Adreno X1-85), when opening 5-10 tabs of a website with video (eg https://ui.com/) in Firefox, we always see a spontaneous lockup and reboot.

In Firefox, disabling Settings > Use hardware acceleration when available or disabling CONFIG_VIDEO_QCOM_IRIS in the kernel prevents the spontaneous reboot in both cases.

Steps to reproduce (confirmed on v7.0 Ubuntu and v7.1-rc3 mainline):

$ wget https://www.ui.com/microsite/static/protect-tablet-Cq1SGa0b.mp4 -O in.mp4
$ firefox in.mp4 in.mp4 in.mp4 in.mp4 in.mp4 in.mp4 in.mp4 in.mp4

Note when attempting to simplify the reproducer further: (here using Linux 7.1-rc3)

$ for i in {1..8}; do (gst-launch-1.0 -q filesrc location=in.mp4 ! qtdemux ! h264parse ! v4l2h264dec ! fakesink sync=false &); done

you may run into a different issue:

qcom-iris aa00000.video-codec: session error received 0x1000006: unknown
qcom-iris aa00000.video-codec: session error received 0x4000004: invalid operation for current state
------------[ cut here ]------------
WARNING: drivers/media/common/videobuf2/videobuf2-core.c:1821 at vb2_start_streaming+0x14c/0x3a0, CPU#3:sr/9966
Modules linked in: xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_tcpudp xt_DSCP xt_dscp nft_compat x_tables nf_tables ath12k_wifi7 ath12k mac80211 hci_uart cfg80211 btqca snd_soc_x1e80100 btrtl snd_soc_qcom_sdw btbcm snd_soc_qcom_common pci_pwrctrl_pwrseq snd_soc_wsa884x regmap_sdw efi_pstore pstore nfnetlink qcom_pon reboot_mode soundwire_qcom snd_soc_lpass_rx_macro snd_soc_lpass_tx_macro snd_soc_lpass_wsa_macro snd_soc_lpass_va_macro pinctrl_sm8550_lpass_lpi soundwire_bus snd_soc_lpass_macro_common
CPU: 3 UID: 1000 PID: 9966 Comm: v4l2h264dec0:sr Not tainted 7.1.0-rc3+ #12 PREEMPTLAZY
Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN60WW 09/11/2025
pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : vb2_start_streaming (drivers/media/common/videobuf2/videobuf2-core.c:1821)
lr : vb2_start_streaming (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 drivers/media/common/videobuf2/videobuf2-core.c:1797)
sp : ffff800097d075c0
x29: ffff800097d075f0 x28: ffffca2f94b5d370 x27: 1fffe001025ada11
x26: 00000000fffffff4 x25: dfff800000000000 x24: dfff800000000000
x23: ffffca2f92bd2520 x22: 1fffe001025ada2a x21: ffff000812d6d150
x20: ffff000812d6d11c x19: ffff000812d6d028 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffff000807705238
x8 : ffff000812d6d120 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff00083bbc6260 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffff4
Call trace:
vb2_start_streaming (drivers/media/common/videobuf2/videobuf2-core.c:1821) (P)
vb2_core_streamon (drivers/media/common/videobuf2/videobuf2-core.c:2336)
vb2_streamon (drivers/media/common/videobuf2/videobuf2-v4l2.c:875)
v4l2_m2m_ioctl_streamon (drivers/media/v4l2-core/v4l2-mem2mem.c:861)
v4l_streamon (drivers/media/v4l2-core/v4l2-ioctl.c:1965)
__video_do_ioctl.llvm.18341201999866530306 (drivers/media/v4l2-core/v4l2-ioctl.c:3133)
video_usercopy (drivers/media/v4l2-core/v4l2-ioctl.c:3475)
video_ioctl2 (drivers/media/v4l2-core/v4l2-ioctl.c:3532)
v4l2_ioctl (drivers/media/v4l2-core/v4l2-dev.c:366)
__arm64_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:597 fs/ioctl.c:583 fs/ioctl.c:583)
invoke_syscall (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49)
el0_svc_common (arch/arm64/kernel/syscall.c:121)
do_el0_svc (arch/arm64/kernel/syscall.c:140)
el0_svc (arch/arm64/kernel/entry-common.c:723)
el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:742)
el0t_64_sync (arch/arm64/kernel/entry.S:594)

[vgarodia]

At the onset, thank you @dblueman for raising bug here.

I have gone through the discussions on this issue at https://gitlab.freedesktop.org/drm/msm/-/work_items/100

Qualcomm VPUs have a restriction with respect to device addresses for non-pixel buffers (you may call them internal buffers). The restriction is that, these buffers cannot have IOVA in the range 0x0 - 0x25800000. If it falls in this region, VPUs would generate a different stream-id, and would lead to page faults. This could be leading to device reboots.

When the usecase are like higher concurrent ones, the possibility of this issue increases as the IOVA assignment can reach from top, all the way to 0x0 - 0x25800000 range.

We can try a patch to optimize the memory, but that again saves us for a while in reaching to that range.
https://lore.kernel.org/linux-media/20260514-optimize_comv_buffer-v4-1-7da70b586aec@oss.qualcomm.com/

If it improves, we can certainly say that the issue is due to what i am suspecting as above explained scenario.

A permanent solution would be to

1. Avoid iris device from mapping any buffer in the range 0x0 - 0x25800000.

   • This is an un-optimal approach as it then applies to other buffers as well, which does not have such limitation
   • This approach would not work when we run a secure video session.

2. Prepare a separate device for non-pixel buffers which can be configured to map in a specific range. Other buffers can continue in iris main device. I tries this approach some time back, but the community did not like it.

https://lore.kernel.org/linux-media/20250627-video_cb-v3-0-51e18c0ffbce@quicinc.com/

[dblueman]

Thank you Vikash.

Kindly check if this reproduces on X1 on your end, and share a one-liner kernel patch so I can check if we have 100% correlation of the PA being under 600MB.

[vgarodia]

Hello Daniel,

i have seen that issue while running higher side of concurrent sessions, and the patch i recommended in earlier comment have certainly improved. I would request you to give it a try.

Incase, you want to print the IOVA, you can print the "buffer->kvaddr" at this line

https://elixir.bootlin.com/linux/v7.1-rc2/source/drivers/media/platform/qcom/iris/iris_buffer.c#L355

[vgarodia]

Hello @dblueman, checking if you got a chance to try the patch or print the buffer->kvaddr ?

[dblueman]

We have to ensure device_addr is lower tham 600MB. This terrible workaround does actually prevent crashing:

diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
index 1d53c7414b75..22ee96edc462 100644
--- a/drivers/media/platform/qcom/iris/iris_buffer.c
+++ b/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -347,6 +347,7 @@ static int iris_create_internal_buffer(struct iris_inst *inst,
                return -ENOMEM;

        INIT_LIST_HEAD(&buffer->list);
+again:
        buffer->type = buffer_type;
        buffer->index = index;
        buffer->buffer_size = buffers->size;
@@ -359,6 +360,13 @@ static int iris_create_internal_buffer(struct iris_inst *inst,
                return -ENOMEM;
        }

+       /* Workaround firmware crash on physical addresses below 600MB */
+       if (buffer->device_addr <= 0x25800000) {
+               dma_free_attrs(core->dev, buffer->buffer_size, buffer->kvaddr,
+                               buffer->device_addr, buffer->dma_attrs);
+               goto again;
+       }
+
        list_add_tail(&buffer->list, &buffers->list);

        return 0;

however we also see:

qcom-iris aa00000.video-codec: session error received 0x1000006: unknown
qcom-iris aa00000.video-codec: session error received 0x4000004: invalid operation for current state
qcom-iris aa00000.video-codec: session error received 0x4000004: invalid operation for current state
qcom-iris aa00000.video-codec: session error received 0x1000006: unknown
qcom-iris aa00000.video-codec: session error received 0x4000004: invalid operation for current state
qcom-iris aa00000.video-codec: session error received 0x1000006: unknown
qcom-iris aa00000.video-codec: session error received 0x4000004: invalid operation for current state
qcom-iris aa00000.video-codec: session error received 0x1000006: unknown
qcom-iris aa00000.video-codec: session error received 0x4000004: invalid operation for current state
------------[ cut here ]------------
WARNING: drivers/media/common/videobuf2/videobuf2-core.c:1821 at vb2_start_streaming+0x104/0x1a8, CPU#2: MediaPD~oder #1/6369
Modules linked in: xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_DSCP xt_dscp nft_compat nf_tables ath12k_wifi7 ath12k mac80211 hci_u
art btqca cfg80211 snd_soc_x1e80100 btrtl snd_soc_qcom_common btbcm snd_soc_qcom_sdw pci_pwrctrl_pwrseq snd_soc_wsa884x regmap_sdw efi_pstore psto
re nfnetlink qcom_pon reboot_mode soundwire_qcom pinctrl_sm8550_lpass_lpi snd_soc_lpass_va_macro snd_soc_lpass_rx_macro snd_soc_lpass_tx_macro sou
ndwire_bus snd_soc_lpass_wsa_macro snd_soc_lpass_macro_common
CPU: 2 UID: 1000 PID: 6369 Comm: MediaPD~oder #1 Not tainted 7.1.0-rc5+ #49 PREEMPTLAZY
Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN60WW 09/11/2025
pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : vb2_start_streaming (drivers/media/common/videobuf2/videobuf2-core.c:1823)
lr : vb2_start_streaming (drivers/media/common/videobuf2/videobuf2-core.c:1783 (discriminator 3))
sp : ffff8000ab66b9a0
x29: ffff8000ab66b9a0 x28: ffff8000ab66bb28 x27: 0000000040045612
x26: 0000000000000000 x25: 0000000000000000 x24: ffff000839746050
x23: ffff00088698be40 x22: ffffd90fcd652858 x21: ffff000810cd8d08
x20: ffff000810cd8d20 x19: 00000000fffffff4 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 00000000000000c0 x10: 1ef2848e9256b2a0 x9 : ffffd90fccc49b20
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000a1de15a38
Call trace:
vb2_start_streaming (drivers/media/common/videobuf2/videobuf2-core.c:1823) (P)
vb2_core_streamon (drivers/media/common/videobuf2/videobuf2-core.c:2336)
vb2_streamon (drivers/media/common/videobuf2/videobuf2-v4l2.c:875)
v4l2_m2m_ioctl_streamon (drivers/media/v4l2-core/v4l2-mem2mem.c:861 drivers/media/v4l2-core/v4l2-mem2mem.c:1454)
v4l_streamon (drivers/media/v4l2-core/v4l2-ioctl.c:1965)
__video_do_ioctl (drivers/media/v4l2-core/v4l2-ioctl.c:3133)
video_usercopy (drivers/media/v4l2-core/v4l2-ioctl.c:3475)
video_ioctl2 (drivers/media/v4l2-core/v4l2-ioctl.c:3532)
v4l2_ioctl (drivers/media/v4l2-core/v4l2-dev.c:366)
__arm64_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:597 fs/ioctl.c:583 fs/ioctl.c:583)
invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49)
el0_svc_common.constprop.0 (arch/arm64/kernel/syscall.c:121)
do_el0_svc (arch/arm64/kernel/syscall.c:140)
el0_svc (arch/arm64/kernel/entry-common.c:740)
el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:759)
el0t_64_sync (arch/arm64/kernel/entry.S:594)
---[ end trace 0000000000000000 ]---