Bug 2402746 - IPU6 camera on Dell Pro Max 16 Premium MA16250 not working, requires vision-drivers
Summary: IPU6 camera on Dell Pro Max 16 Premium MA16250 not working, requires vision-d...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 43
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Hans de Goede
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 2407321 (view as bug list)
Depends On: 2413656
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-10-09 15:50 UTC by Ben Matteson
Modified: 2025-12-20 19:48 UTC (History)
18 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)
sudo journalctl -b 0 -k (156.98 KB, text/plain)
2025-10-09 15:50 UTC, Ben Matteson
no flags Details
ls -l /sys/bus/i2c/devices/ (3.15 KB, text/plain)
2025-10-09 15:51 UTC, Ben Matteson
no flags Details
ls -l /sys/bus/spi/devices/ (3.15 KB, text/plain)
2025-10-09 15:55 UTC, Ben Matteson
no flags Details
lsusb (580 bytes, text/plain)
2025-10-09 15:56 UTC, Ben Matteson
no flags Details
qcam command output (3.20 KB, text/plain)
2025-10-09 16:05 UTC, Ben Matteson
no flags Details
kernel output with usbio.dyndbg enabled (166.11 KB, text/plain)
2025-10-09 19:17 UTC, Ben Matteson
no flags Details
dmesg after sudo insmod intel_cvs.ko (2.21 KB, text/plain)
2025-10-10 18:15 UTC, Ben Matteson
no flags Details
sudo journalctl -b 0 -k after loading vision driver (184.72 KB, text/plain)
2025-10-10 18:21 UTC, Ben Matteson
no flags Details
journalctl --user --unit pipewire -b 0 > pipewire.txt (360.62 KB, text/plain)
2025-11-10 10:52 UTC, miha.garafolj
no flags Details
coredumpctl debug 88758 (3.86 KB, text/plain)
2025-11-10 10:52 UTC, miha.garafolj
no flags Details
Logs of pipewire after core dump (551.49 KB, text/plain)
2025-11-10 14:28 UTC, miha.garafolj
no flags Details
coredumpctl debug 88758 & bt with the new version libcamera (3.94 KB, text/plain)
2025-11-10 14:28 UTC, miha.garafolj
no flags Details
Debug of crash id=16441 (59.49 KB, text/plain)
2025-11-10 15:27 UTC, miha.garafolj
no flags Details
bt debug of crash id=16441 (3.68 KB, text/plain)
2025-11-10 15:28 UTC, miha.garafolj
no flags Details

Description Ben Matteson 2025-10-09 15:50:57 UTC
Created attachment 2109198 [details]
sudo journalctl -b 0 -k

1. Please describe the problem:

I'm testing the Mipi camera that comes with the Dell Pro Max 16 Premium MA16250. I installed Fedora 43 and updated to the latest kernel in updates-testing, but when I try to use the mipi camera with qcam, it seems to detect the camera, but shows nothing.


2. What is the Version-Release number of the kernel:

6.17.1-300.fc43.x86_64

3. Did it work previously in Fedora? If so, what kernel version did the issue
   *first* appear?  Old kernels are available for download at
   https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :

No, this has never worked before.

4. Can you reproduce this issue? If so, please provide the steps to reproduce
   the issue below:

Install Fedora 43 on a Dell Pro Max 16 Premium MA16250 that includes an intel ipu camera and try and use the camera with qcam (from the libcamera-qcam rpm).

5. Does this problem occur with the latest Rawhide kernel? To install the
   Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
   ``sudo dnf update --enablerepo=rawhide kernel``:

This is the latest kernel on Fedora 43, but not sure if 43 is still rawhide.

6. Are you running any modules that not shipped with directly Fedora's kernel?:

No.

7. Please attach the kernel logs. You can get the complete kernel log
   for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
   issue occurred on a previous boot, use the journalctl ``-b`` flag.

Comment 1 Ben Matteson 2025-10-09 15:51:53 UTC
Created attachment 2109199 [details]
ls -l /sys/bus/i2c/devices/

Comment 2 Ben Matteson 2025-10-09 15:55:31 UTC
Created attachment 2109200 [details]
ls -l /sys/bus/spi/devices/

Comment 3 Ben Matteson 2025-10-09 15:56:02 UTC
Created attachment 2109201 [details]
lsusb

Comment 4 Ben Matteson 2025-10-09 16:05:59 UTC
Created attachment 2109202 [details]
qcam command output

Comment 5 Hans de Goede 2025-10-09 17:50:17 UTC
The culprit seems to be these errors in the kernel logs:

Oct 09 10:38:14 saturn kernel: usb 3-8: USB disconnect, device number 2
Oct 09 10:38:14 saturn kernel: usbio-bridge 3-8:1.0: Bulk in error -108
Oct 09 10:38:14 saturn kernel: usbio-bridge 3-8:1.0: Bulk in short read: 0
Oct 09 10:38:14 saturn kernel: usbio-bridge 3-8:1.0: Bulk out failed: -19
Oct 09 10:38:14 saturn kernel: ov08x40 i2c-OVTI08F4:00: Failed to write reg 0x5152. error = -71
Oct 09 10:38:14 saturn kernel: ov08x40 i2c-OVTI08F4:00: ov08x40_start_streaming failed to set plls
Oct 09 10:38:14 saturn kernel: intel_ipu6_isys.isys intel_ipu6.isys.40: stream on Intel IPU6 CSI2 4 failed with -71

What you see here is the USB IO-expander dropping of the USB bus (not good) and after that trying to send i2c commands to the sensor fails (no surprise there).

Shortly after the USBIO chip re-appears:

Oct 09 10:38:15 saturn kernel: usb 3-8: new full-speed USB device number 5 using xhci_hcd
Oct 09 10:38:15 saturn kernel: usb 3-8: New USB device found, idVendor=06cb, idProduct=0701, bcdDevice=84.89
Oct 09 10:38:15 saturn kernel: usb 3-8: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Oct 09 10:38:15 saturn kernel: usb 3-8: Product: SVP7500
Oct 09 10:38:15 saturn kernel: usb 3-8: Manufacturer: Synaptics , Inc
Oct 09 10:38:15 saturn kernel: usb 3-8: SerialNumber: 01.00.00.00
Oct 09 10:38:15 saturn kernel: i2c_usbio.usbio-i2c usbio.usbio-i2c.0: Invalid speed 400000 adjusting to bus max 100000
Oct 09 10:38:15 saturn kernel: i2c_usbio.usbio-i2c usbio.usbio-i2c.1: Invalid speed 400000 adjusting to bus max 100000

but that is not really helpful.

Can you try adding "usbio.dyndbg" to the kernel commandline, then after that reboot and try to stream in qcam again.

After trying to stream collect a new "sudo journalctl -b 0 -k" and attach the new log here please.

There are 2 vendors / versions of the USBIO chip, Lattice and Synaptics. So far most testing has been done with Lattice USBIO chips and it looks like this laptop has a Synaptics one, so it looks like we may need to do some more work to get the Synaptics version to work.

Comment 6 Ben Matteson 2025-10-09 19:17:50 UTC
Created attachment 2109215 [details]
kernel output with usbio.dyndbg enabled

Comment 7 Ben Matteson 2025-10-09 19:20:00 UTC
Added new kernel.txt file with usbio.dyndbg enabled.

Comment 8 Hans de Goede 2025-10-10 15:38:54 UTC
(In reply to Ben Matteson from comment #7)
> Added new kernel.txt file with usbio.dyndbg enabled.

Thanks this new log with USBIO debugging which shows full packet dumps of all bulk/ctrk packets send to / received from the USBIO chip.

Everything looks great until the chip just drops of the bus. When this happens a standard single CCI register write is being done over I2C just like how it was done a couple of times before higher in the log, but now all of a sudden this causes the USBIO chip to just drop of the bus ...

I don't really know how to proceed from here, so I've asked the Intel team which works on the USBIO driver code to take a look.

Comment 9 Hans de Goede 2025-10-10 15:43:17 UTC
One thing which might be worth trying is loading the Intel vision driver for the CVS chip used in these laptops.

This CVS chip comes up in "pass-through" mode by default, so in the mainline kernels we just ignore it but maybe having the driver for it loaded avoids the problem which is being hit here.

Ben, can you try to load this driver before starting qcam:

git clone https://github.com/intel/vision-drivers.git
cd vision-drivers
make
sudo insmod intel_cvs.ko

Then check in dmesg the module loaded successfully (without errors) and then try qcam again ?

Comment 10 Ben Matteson 2025-10-10 18:05:29 UTC
I tried this. Those drivers built fine and loaded fine (output from dmesg):

[81592.746530] Intel CVS driver i2c-INTC10E0:00: cvs_i2c_probe with i2c_client:0000000006093fbb
[81592.748667] usbio-bridge 3-8:1.0: control out 8 hdr 03010404 data 000c0100
[81592.748979] usbio-bridge 3-8:1.0: control out 8 hdr 03010404 data 000e0100
[81592.749207] usbio-bridge 3-8:1.0: control out 11 hdr 03030407 data 00010001000000
[81592.749656] usbio-bridge 3-8:1.0: control out 8 hdr 03010404 data 00010107
[81592.750126] Intel CVS driver i2c-INTC10E0:00: find_oem_prod_id: ACPI method OPID not found
[81592.850432] usbio-bridge 3-8:1.0: bulk out 12 hdr 0401050700 data 007600a0860100
[81592.854015] usbio-bridge 3-8:1.0: bulk in 12 hdr 0401060700 data 007600a0860100
[81592.854057] usbio-bridge 3-8:1.0: bulk out 12 hdr 0403050700 data 00760002000802
[81592.854097] usbio-bridge 3-8:1.0: bulk in 10 hdr 0403060500 data 0076000200
[81592.854134] usbio-bridge 3-8:1.0: bulk out 8 hdr 0400040300 data 007600
[81592.854174] usbio-bridge 3-8:1.0: bulk out 12 hdr 0401050700 data 007600a0860100
[81592.857925] usbio-bridge 3-8:1.0: bulk in 12 hdr 0401060700 data 007600a0860100
[81592.857967] usbio-bridge 3-8:1.0: bulk out 10 hdr 0402050500 data 0076000400
[81592.858010] usbio-bridge 3-8:1.0: bulk in 14 hdr 0402060900 data 0076000400cb060107
[81592.858046] usbio-bridge 3-8:1.0: bulk out 8 hdr 0400040300 data 007600
[81592.858051] Intel CVS driver i2c-INTC10E0:00: magic number in dev response not supported
[81592.858053] Intel CVS driver i2c-INTC10E0:00: cvs_find_magic_num_support:Device protocol is 1.0
[81592.858089] usbio-bridge 3-8:1.0: bulk out 12 hdr 0401050700 data 007600a0860100
[81592.861926] usbio-bridge 3-8:1.0: bulk in 12 hdr 0401060700 data 007600a0860100
[81592.862063] usbio-bridge 3-8:1.0: bulk out 16 hdr 0403050b00 data 0076000600080500000080
[81592.864495] usbio-bridge 3-8:1.0: bulk in 10 hdr 0403060500 data 0076000600
[81592.864687] usbio-bridge 3-8:1.0: bulk out 8 hdr 0400040300 data 007600
[81592.880655] usbio-bridge 3-8:1.0: control out 11 hdr 03030407 data 00010000000000
[81592.986736] usbio-bridge 3-8:1.0: control out 7 hdr 03020503 data 000107
[81592.986990] usbio-bridge 3-8:1.0: control in 11 hdr 03020607 data 00010700000000
[81592.986997] Intel CVS driver i2c-INTC10E0:00: cvs_i2c_probe:Transfer of ownership success

but when I run `qcam` it doesn't detect the camera any longer (it used to detect something, even though it failed):

$ qcam
[22:52:21.947533067] [238127]  INFO Camera camera_manager.cpp:330 libcamera v0.5.2
[22:52:21.981377131] [238140]  INFO SimplePipeline simple.cpp:1687 No sensor found for /dev/media0
No camera detected

Comment 11 Ben Matteson 2025-10-10 18:15:37 UTC
Created attachment 2109319 [details]
dmesg after sudo insmod intel_cvs.ko

Comment 12 Ben Matteson 2025-10-10 18:21:29 UTC
Created attachment 2109320 [details]
sudo journalctl -b 0 -k after loading vision driver

Also added the kernel/journal output again after attempting with the vision drivers.

Comment 13 Hans de Goede 2025-10-10 19:34:22 UTC
I see in the latest journal output that you did the "sudo insmod intel_cvs.ko" after a failed qcam run and thus after the USBIO has already dropped from the bus once. The USBIO dropping from the bus causes the link between the sensor (which sits on its I2C bus) and the CSI2 receiver to be permanently broken since the media-controller code tracking the links does not expect sensors to get hot-unplugged and generally does not support hotplugging.

Can you please try:

1. reboot
2. Do NOT run qcam
3. sudo insmod intel_cvs.ko
4. Now run qcam

And see if qcam then works. If qcam does not work please collect new "journalctl -b 0 -k" output.

Comment 14 Ben Matteson 2025-10-13 16:02:36 UTC
OK, did as you asked, and indeed the camera worked when I insmod intel_cvs.ko before trying qcam!

Comment 15 Hans de Goede 2025-10-13 17:56:29 UTC
> OK, did as you asked, and indeed the camera worked when I insmod intel_cvs.ko before trying qcam!

That is good news. Now it is up to Intel to upstream that driver then.

Comment 16 Hans de Goede 2025-10-30 19:23:45 UTC
*** Bug 2407321 has been marked as a duplicate of this bug. ***

Comment 17 miha.garafolj 2025-11-04 19:18:10 UTC
(In reply to Ben Matteson from comment #14)
> OK, did as you asked, and indeed the camera worked when I insmod
> intel_cvs.ko before trying qcam!

I can confirm this as well (Dell Pro Premium 14 here). However, it does not work in any other app (Camera, Cheese, Firefox). Is this working for you?

`v4l2-ctl --list-devices` still lists 31 video devices and they all look the same.

Comment 18 Hans de Goede 2025-11-09 16:52:57 UTC
Note in Fedora 43 the camera should work in snapshot (aka Camera) and firefox after loading the vision drivers.

If they do not see the camera, then this is likely caused by by these kind of cameras not really sending hotplug events when they become ready.

As a workaround, after loading the vision drivers you can do:

systemctl --user restart pipewire

That should be enough, but if e.g. "Camera" still does not see the camera then you can also try:

systemctl --user restart wireplumber

Note the snapshot / camera app now default to using Vulkan for rendering which is known to cause issues with some iGPU-s to work around this you can start it from a terminal using:

GSK_RENDERER=gl snapshot

Comment 19 miha.garafolj 2025-11-10 10:06:49 UTC
(In reply to Hans de Goede from comment #18)

The issue is that the pipewire shuts off with a core-dumped when I start any camera app besides qcam (firefox access camera, cheese, or camera app). How can I provide the most relevant logs for this problem?
I suspect the issue might be on the pipewire-libcamera (or gstreamer?) relation.

```
> journalctl -r --user -u pipewire -u wireplumber -n 200
Nov 10 11:04:10 mxm systemd[3389]: Stopped wireplumber.service - Multimedia Service Session Manager.
Nov 10 11:04:10 mxm systemd[3389]: Stopping wireplumber.service - Multimedia Service Session Manager...
Nov 10 11:04:10 mxm wireplumber[87638]: pw.core: 0x562e8dda2df0: leaked proxy 0x562e8df19240 id:14
Nov 10 11:04:10 mxm wireplumber[87638]: pw.core: 0x562e8dda2df0: leaked proxy 0x562e8df94f50 id:6
Nov 10 11:04:10 mxm wireplumber[87638]: pw.core: 0x562e8dda2df0: leaked proxy 0x562e8de1fd80 id:4
Nov 10 11:04:10 mxm wireplumber[87638]: pw.core: 0x562e8dda2df0: leaked proxy 0x562e8ded2eb0 id:3
Nov 10 11:04:10 mxm systemd[3389]: pipewire.service: Main process exited, code=dumped, status=6/ABRT
Nov 10 11:04:09 mxm systemd-coredump[88483]: [🡕] Process 87637 (pipewire) of user 1000 dumped core.
                                             
                                             Module /usr/bin/pipewire from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libspa-audiomixer.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libffi.so.8 from rpm libffi-3.5.1-2.fc43.x86_64
                                             Module libbz2.so.1 from rpm bzip2-1.0.8-21.fc43.x86_64
                                             Module liblzma.so.5 from rpm xz-5.8.1-2.fc43.x86_64
                                             Module libzstd.so.1 from rpm zstd-1.5.7-2.fc43.x86_64
                                             Module libz.so.1 from rpm zlib-ng-2.2.5-2.fc43.x86_64
                                             Module libelf.so.1 from rpm elfutils-0.194-1.fc43.x86_64
                                             Module liblttng-ust-common.so.1 from rpm lttng-ust-2.14.0-4.fc43.x86_64
                                             Module liblttng-ust-tracepoint.so.1 from rpm lttng-ust-2.14.0-4.fc43.x86_64
                                             Module libnuma.so.1 from rpm numactl-2.0.19-3.fc43.x86_64
                                             Module libgmp.so.10 from rpm gmp-6.3.0-4.fc43.x86_64
                                             Module libnettle.so.8 from rpm nettle-3.10.1-2.fc43.x86_64
                                             Module libhogweed.so.6 from rpm nettle-3.10.1-2.fc43.x86_64
                                             Module libtasn1.so.6 from rpm libtasn1-4.20.0-2.fc43.x86_64
                                             Module libunistring.so.5 from rpm libunistring-1.1-10.fc43.x86_64
                                             Module libidn2.so.0 from rpm libidn2-2.3.8-2.fc43.x86_64
                                             Module libp11-kit.so.0 from rpm p11-kit-0.25.8-1.fc43.x86_64
                                             Module libjpeg.so.62 from rpm libjpeg-turbo-3.1.2-1.fc43.x86_64
                                             Module libunwind.so.8 from rpm libunwind-1.8.1-3.fc43.x86_64
                                             Module libdw.so.1 from rpm elfutils-0.194-1.fc43.x86_64
                                             Module libyaml-0.so.2 from rpm libyaml-0.2.5-17.fc43.x86_64
                                             Module liblttng-ust.so.1 from rpm lttng-ust-2.14.0-4.fc43.x86_64
                                             Module libgnutls.so.30 from rpm gnutls-3.8.10-3.fc43.x86_64
                                             Module libyuv.so.0 from rpm libyuv-0-0.57.20240704git96bbdb5.fc43.x86_64
                                             Module libcamera-base.so.0.5 from rpm libcamera-0.5.2-4.fc43.x86_64
                                             Module libcamera.so.0.5 from rpm libcamera-0.5.2-4.fc43.x86_64
                                             Module libspa-libcamera.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libudev.so.1 from rpm systemd-258.1-1.fc43.x86_64
                                             Module libasound.so.2 from rpm alsa-lib-1.2.14-4.fc43.x86_64
                                             Module libspa-alsa.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libspa-audioconvert.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libavahi-client.so.3 from rpm avahi-0.9~rc2-6.fc43.x86_64
                                             Module libavahi-common.so.3 from rpm avahi-0.9~rc2-6.fc43.x86_64
                                             Module libpipewire-module-raop-discover.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-session-manager.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-link-factory.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-adapter.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libglib-2.0.so.0 from rpm glib2-2.86.1-2.fc43.x86_64
                                             Module libpipewire-module-access.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-portal.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-client-device.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-client-node.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-spa-node-factory.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-spa-device-factory.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-metadata.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-profiler.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpcre2-8.so.0 from rpm pcre2-10.46-1.fc43.x86_64
                                             Module libselinux.so.1 from rpm libselinux-3.9-5.fc43.x86_64
                                             Module libpipewire-module-protocol-native.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libpipewire-module-rt.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libdbus-1.so.3 from rpm dbus-1.16.0-4.fc43.x86_64
                                             Module libspa-dbus.so from rpm pipewire-1.4.9-1.fc43.x86_64
                                             Module libcap.so.2 from rpm libcap-2.76-3.fc43.x86_64
                                             Module libsystemd.so.0 from rpm systemd-258.1-1.fc43.x86_64
                                             Module libspa-journal.so from rpm pipewire-1.4.9-1.fc43.x86_64
```


```
● pipewire.service - PipeWire Multimedia Service
     Loaded: loaded (/usr/lib/systemd/user/pipewire.service; disabled; preset: disabled)
    Drop-In: /usr/lib/systemd/user/pipewire.service.d
             └─00-uresourced.conf
             /usr/lib/systemd/user/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Mon 2025-11-10 11:04:55 CET; 1min 23s ago
 Invocation: d48f04596ef44b558e97a02174b7a9c2
TriggeredBy: ● pipewire.socket
   Main PID: 88758 (pipewire)
      Tasks: 9 (limit: 37757)
     Memory: 9.5M (peak: 10.5M)
        CPU: 196ms
     CGroup: /user.slice/user-1000.slice/user/session.slice/pipewire.service
             ├─88758 /usr/bin/pipewire
             └─88827 /usr/libexec/libcamera/soft_ipa_proxy /usr/lib64/libcamera/ipa/ipa_soft_simple.so 75

Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.786051296] [88826]  WARN CameraSensor camera_sensor_legacy.cpp:428 'ov08x40 17-0036': See Documentation/sensor_driver_requirements.rst in the libcamera sources for more information
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.786284243] [88826]  WARN CameraSensorProperties camera_sensor_properties.cpp:484 No static properties available for 'ov08x40'
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.786291932] [88826]  WARN CameraSensorProperties camera_sensor_properties.cpp:486 Please consider updating the camera sensor properties database
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.786302159] [88826]  WARN CameraSensor camera_sensor_legacy.cpp:501 'ov08x40 17-0036': No sensor delays found in static properties. Assuming unverified defaults.
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.790251449] [88826]  WARN IPAProxy ipa_proxy.cpp:177 Configuration file 'ov08x40.yaml' not found for IPA module 'simple', falling back to 'uncalibrated.yaml'
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.790353502] [88826] ERROR V4L2 v4l2_subdevice.cpp:1198 'ov08x40 17-0036': Unable to get rectangle 0 on pad 0/0: Inappropriate ioctl for device
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.790380544] [88826]  WARN CameraSensor camera_sensor_legacy.cpp:880 'ov08x40 17-0036': The analogue crop rectangle has been defaulted to the active area size
Nov 10 11:04:57 mxm pipewire[88827]: [18:20:28.800170196] [88827]  INFO IPAProxySoftWorker soft_ipa_proxy_worker.cpp:448 Starting worker for IPA module /usr/lib64/libcamera/ipa/ipa_soft_simple.so with IPC fd = 75
Nov 10 11:04:57 mxm pipewire[88827]: [18:20:28.800723532] [88827]  WARN IPASoft soft_simple.cpp:103 IPASoft: Failed to create camera sensor helper for ov08x40
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.801129154] [88826]  INFO Camera camera_manager.cpp:220 Adding camera '\_SB_.LNK1' for pipeline handler simple

```

Comment 20 miha.garafolj 2025-11-10 10:08:27 UTC
Also this seems like the direct culprit:

```
Nov 10 11:04:57 mxm pipewire[88758]: [18:20:28.801129154] [88826]  INFO Camera camera_manager.cpp:220 Adding camera '\_SB_.LNK1' for pipeline handler simple
Nov 10 11:07:05 mxm pipewire[88758]: [18:22:37.016670256] [88758]  INFO Camera camera.cpp:1215 configuring streams: (0) 1920x1080-ABGR8888/Unset
Nov 10 11:07:05 mxm pipewire[88827]: [18:22:37.017036174] [88827]  INFO IPASoft soft_simple.cpp:269 IPASoft: Exposure 4-4436, gain 128-1984 (1)
Nov 10 11:07:08 mxm pipewire[88758]: /usr/include/c++/15/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = unsigned int; long unsigned int _Nm = 64; reference = unsigned int&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.
Nov 10 11:07:08 mxm systemd-coredump[89261]: [🡕] Process 88758 (pipewire) of user 1000 dumped core.
```

Comment 21 Hans de Goede 2025-11-10 10:34:53 UTC
I see.

Can you try running:

coredumpctl debug 88758

(where 88758 is the PID from the assertion error you found in the logs) \

and then when it asks if it can download debuginfo say y / yes and then when it is done with downloading debug info do:

"bt"

inside the gdb prompt and then copy and paste the "bt" output to a comment here in bugzilla (or to a txt file and attach it).

snapshot works for me, so we need to figure out what is different on your setup which is causing this assertion / crash.


Also can you run:

journalctl --user --unit pipewire -b 0 > pipewire.txt

Note if you've rebooted since the crash please reproduce the crash before running this.

and then attach the generated pipewire.txt file here please.

Comment 22 miha.garafolj 2025-11-10 10:52:01 UTC
Created attachment 2113654 [details]
journalctl --user --unit pipewire -b 0 > pipewire.txt

Logs from pipewire after core dump

Comment 23 miha.garafolj 2025-11-10 10:52:43 UTC
Created attachment 2113665 [details]
coredumpctl debug 88758

coredumpctl debug 88758

Comment 24 Hans de Goede 2025-11-10 13:53:47 UTC
Thank you for the backtrace. I think that the problem is that the kernel is generating / letting through some camera frames with invalid data causing a crash in the softwareISP statistics code.

I've prepared a test libcamera build which stops the statistics code from crashing on invalid input:

https://koji.fedoraproject.org/koji/taskinfo?taskID=138821403

Please give this a try. To install this run:

1. Make a new folder to download the new build. E.g. "mkdir libcamera-testbuild"
2. Run "rpm -qa | grep libcamera | sort" to see which libcamera packages you've installed
3. Download the matching packages from (2.) and save them in the new dir
4. From the new dir run: "sudo rpm -Uvh libcamera*.rpm" 
5. systemctl --user restart pipewire
6. Give the "Camera" app (aka snapshot) another try

Comment 25 miha.garafolj 2025-11-10 14:27:50 UTC
Thanks for the help again, hope we can get to the bottom of this. I installed the builds from kojipkgs directly, here is the proof of installation. However, the pipewire still collapses. 

```
> rpm -qa | grep libcamera | sort
libcamera-0.5.2-5.fc43.x86_64
libcamera-debuginfo-0.5.2-5.fc43.x86_64
libcamera-debugsource-0.5.2-5.fc43.x86_64
libcamera-devel-0.5.2-5.fc43.x86_64
libcamera-doc-0.5.2-5.fc43.x86_64
libcamera-gstreamer-0.5.2-5.fc43.x86_64
libcamera-gstreamer-debuginfo-0.5.2-5.fc43.x86_64
libcamera-ipa-0.5.2-5.fc43.x86_64
libcamera-ipa-debuginfo-0.5.2-5.fc43.x86_64
libcamera-qcam-0.5.2-5.fc43.x86_64
libcamera-qcam-debuginfo-0.5.2-5.fc43.x86_64
libcamera-tools-0.5.2-5.fc43.x86_64
libcamera-tools-debuginfo-0.5.2-5.fc43.x86_64
libcamera-v4l2-0.5.2-5.fc43.x86_64
libcamera-v4l2-debuginfo-0.5.2-5.fc43.x86_64
pipewire-plugin-libcamera-1.4.9-1.fc43.x86_64
python3-libcamera-0.5.2-5.fc43.x86_64
python3-libcamera-debuginfo-0.5.2-5.fc43.x86_64
```

I will attach the new debug logs below

Comment 26 miha.garafolj 2025-11-10 14:28:22 UTC
Created attachment 2113698 [details]
Logs of pipewire after core dump

Comment 27 miha.garafolj 2025-11-10 14:28:58 UTC
Created attachment 2113699 [details]
coredumpctl debug 88758 & bt with the new version libcamera

Comment 28 miha.garafolj 2025-11-10 14:33:09 UTC
Note that this strange behavior is also still happening, I'm not even sure if the snapshot or cheese are picking up the right stream.

```
> v4l2-ctl --list-devices
ipu7 (PCI:0000:00:05.0):
	/dev/video0
	/dev/video1
	/dev/video2
	/dev/video3
	/dev/video4
	/dev/video5
	/dev/video6
	/dev/video7
	/dev/video8
	/dev/video9
	/dev/video10
	/dev/video11
	/dev/video12
	/dev/video13
	/dev/video14
	/dev/video15
	/dev/video16
	/dev/video17
	/dev/video18
	/dev/video19
	/dev/video20
	/dev/video21
	/dev/video22
	/dev/video23
	/dev/video24
	/dev/video25
	/dev/video26
	/dev/video27
	/dev/video28
	/dev/video29
	/dev/video30
	/dev/video31
	/dev/media0

```

Comment 29 Hans de Goede 2025-11-10 14:34:01 UTC
I think you forgot to restart pipewire after the update?

The new backtrace still points to the old linenumber of the crash-site which should have changed with the -5 build since there are some extra lines in the file above the crash site now.

Can you retry with a restarted pipewire?

Comment 30 Hans de Goede 2025-11-10 14:35:13 UTC
The large amount of /dev/video# nodes is normal on these complex/MIPI camera systems.

Comment 31 miha.garafolj 2025-11-10 14:58:39 UTC
I have restarted the pipewire as well as the wireplumber (already for the logs above). I have now also tried to reboot the laptop entirely and pipewire still crashes.

Comment 32 Hans de Goede 2025-11-10 15:17:40 UTC
Hmm, in comment 27 you wrote:

Created attachment 2113699 [details]
coredumpctl debug 88758 & bt with the new version libcamera

But that 88758 is the process-id of the first crash.

Since you now have a new crash, you should use the process id of the new crash, looking at the attachment from comment26, the new crashed pipewire process had a process-id of 3409 so the correct commands to get the new bt are:

coredumpctl debug 3409

and then at the gdb prompt type 'bt'

Comment 33 miha.garafolj 2025-11-10 15:27:47 UTC
Created attachment 2113703 [details]
Debug of crash id=16441

Comment 34 miha.garafolj 2025-11-10 15:28:25 UTC
Created attachment 2113704 [details]
bt debug of crash id=16441

Comment 35 Hans de Goede 2025-11-10 15:38:49 UTC
Thanks, that helps. Same problem now in the debayer code. I forgot that the debayer code also uses lookup-tables so that we will hit the same problem with corrupt input data causing out of bounds accesses there now...

I'm going to call it a day for today. But I'll get back to you soonish with a build which will hopefully be fixed for real.

Comment 36 miha.garafolj 2025-11-10 16:37:34 UTC
Thanks a lot, glad I was able to help debug!

Comment 37 Hans de Goede 2025-11-11 16:31:57 UTC
Hi, here is a new build with a new more comprehensive fix:

https://koji.fedoraproject.org/koji/taskinfo?taskID=138830321

Hopefully with this not only will the crash be gone, but snapshot will actually work.

It sometimes happens that the first few frames to be corrupt which is causing these crashes you were seeing (with the patch libcamera should be robust again corrupt frames). But after a few frames (you may not even notice) you should get a normal working image I hope.

Comment 38 miha.garafolj 2025-11-13 10:04:20 UTC
Indeed the pipewire not does not crash anymore, however snapshot does not work yet. Opens up, and after a couple of seconds crashes
Here are the initial logs. How can I provide more detailed logs for this?

```
> snapshot
2025-11-13T10:03:07.103216Z  INFO snapshot::application::imp: Snapshot (org.gnome.Snapshot)
2025-11-13T10:03:07.103236Z  INFO snapshot::application::imp: Version: 49.0
2025-11-13T10:03:07.103238Z  INFO snapshot::application::imp: Datadir: /usr/share/snapshot
MESA-INTEL: warning: ../src/intel/vulkan/anv_formats.c:981: FINISHME: support more multi-planar formats with DRM modifiers
MESA-INTEL: warning: ../src/intel/vulkan/anv_formats.c:949: FINISHME: support YUV colorspace with DRM format modifiers
2025-11-13T10:03:07.563724Z  INFO ashpd::desktop::request: Creating a org.freedesktop.portal.Request /org/freedesktop/portal/desktop/request/1_291/ashpd_KPfeUTZ0Gs
2025-11-13T10:03:07.565029Z  INFO ashpd::desktop::request: Received signal 'Response' on 'org.freedesktop.portal.Request'
2025-11-13T10:03:07.565078Z  INFO ashpd::proxy: Calling method org.freedesktop.portal.Camera:OpenPipeWireRemote

(snapshot:50920): Gdk-WARNING **: 11:03:10.535: Vulkan: ../src/intel/vulkan/xe/anv_kmd_backend.c:312: vm_bind failed with errno 22 (VK_ERROR_DEVICE_LOST)

(snapshot:50920): Gsk-WARNING **: 11:03:10.535: vkAllocateMemory(): The logical or physical device has been lost. (VK_ERROR_DEVICE_LOST) (-4)
[1]    50920 segmentation fault (core dumped)  snapshot
```

Comment 39 Hans de Goede 2025-11-13 10:11:13 UTC
Hi, known snapshot issue as mentioned in comment 18. As a workaround start snapshot from a terminal with:

GSK_RENDERER=gl snapshot

Comment 40 Hans de Goede 2025-11-13 11:01:43 UTC
Assuming things do work with `GSK_RENDERER=gl snapshot`:

I have not gotten around to reporting a bug for snapshot needing this workaround, since you can reproduce can you please file a bug for this here: https://gitlab.gnome.org/GNOME/snapshot/-/issues ? Note chances are the snapshot developers will just ask you to file a bug against mesa, but snapshot is the best place to start.

Comment 41 miha.garafolj 2025-11-13 13:18:02 UTC
Indeed the snapshot does not crash anymore, but all I see is white screen (same in firefox conferencing).
I will report the bug with the snapshot devs, thanks!

Comment 42 Hans de Goede 2025-11-17 12:35:16 UTC
Thank you for testing. I think that the problem with snapshot and Firefox is that qcam defaults to using the highest resolution which is 3840x2400 where as snapshot will default to 1920x1080 and in Firefox it depends on the website but it typically uses even lower resolutions.

To test this theory I've prepared a test kernel build with the lower resolutions disabled in the sensor. Note that the softISP will still give snapshot the desired resolution by cutting of the excess pixels, so if this works you will get the a quarter of the full-view from the camera centered in the middle of the full-view. Which will give the impression that things are zoomed in. This may be even worse in Firefox.

The kernel test-build to test this is currently building here:

https://koji.fedoraproject.org/koji/taskinfo?taskID=139002470

This should be done building in a couple of hours.

Here are instructions to install a test kernel-build directly from koji (Fedora's build system):

https://fedorapeople.org/~jwrdegoede/kernel-test-instructions.txt

Note you will need to rebuild the intel-vision driver and insmod it as usual before trying qcam and then if qcam works try snapshot/Firefox.

Comment 43 Hans de Goede 2025-11-17 14:29:42 UTC
The test kernel build is done now, please give this a try.

Comment 44 miha.garafolj 2025-11-25 16:16:31 UTC
Sorry for the delay. I installed the new kernel per instructions, but at the moment not even qcam recognizes and plays the camera stream anymore. I suspect this is due to not being to able to load the drivers suddenly anymore. Neither does the snapshot, so I can't really test properly. 

```
> sudo insmod intel_cvs.ko
insmod: ERROR: could not insert module intel_cvs.ko: Invalid module format
```


```
> qcam
[0:00:51.030262975] [6603]  INFO Camera camera_manager.cpp:330 libcamera v0.5.2
[0:00:51.035802437] [6619] ERROR V4L2 v4l2_subdevice.cpp:1198 'ov08x40 17-0036': Unable to get rectangle 2 on pad 0/0: Inappropriate ioctl for device
[0:00:51.035814905] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:401 'ov08x40 17-0036': The PixelArraySize property has been defaulted to 3856x2176
[0:00:51.035819177] [6619] ERROR V4L2 v4l2_subdevice.cpp:1198 'ov08x40 17-0036': Unable to get rectangle 1 on pad 0/0: Inappropriate ioctl for device
[0:00:51.035822476] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:412 'ov08x40 17-0036': The PixelArrayActiveAreas property has been defaulted to (0, 0)/3856x2176
[0:00:51.035824786] [6619] ERROR V4L2 v4l2_subdevice.cpp:1198 'ov08x40 17-0036': Unable to get rectangle 0 on pad 0/0: Inappropriate ioctl for device
[0:00:51.035826837] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:420 'ov08x40 17-0036': Failed to retrieve the sensor crop rectangle
[0:00:51.035828052] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:426 'ov08x40 17-0036': The sensor kernel driver needs to be fixed
[0:00:51.035829489] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:428 'ov08x40 17-0036': See Documentation/sensor_driver_requirements.rst in the libcamera sources for more information
[0:00:51.035926765] [6619]  WARN CameraSensorProperties camera_sensor_properties.cpp:484 No static properties available for 'ov08x40'
[0:00:51.035932161] [6619]  WARN CameraSensorProperties camera_sensor_properties.cpp:486 Please consider updating the camera sensor properties database
[0:00:51.035935651] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:501 'ov08x40 17-0036': No sensor delays found in static properties. Assuming unverified defaults.
[0:00:51.037568933] [6619]  WARN IPAProxy ipa_proxy.cpp:177 Configuration file 'ov08x40.yaml' not found for IPA module 'simple', falling back to 'uncalibrated.yaml'
[0:00:51.037589380] [6619] ERROR V4L2 v4l2_subdevice.cpp:1198 'ov08x40 17-0036': Unable to get rectangle 0 on pad 0/0: Inappropriate ioctl for device
[0:00:51.037597470] [6619]  WARN CameraSensor camera_sensor_legacy.cpp:880 'ov08x40 17-0036': The analogue crop rectangle has been defaulted to the active area size
[0:00:51.044896999] [6620]  INFO IPAProxySoftWorker soft_ipa_proxy_worker.cpp:448 Starting worker for IPA module /usr/lib64/libcamera/ipa/ipa_soft_simple.so with IPC fd = 35
[0:00:51.045397316] [6620]  WARN IPASoft soft_simple.cpp:103 IPASoft: Failed to create camera sensor helper for ov08x40
[0:00:51.045662871] [6619]  INFO Camera camera_manager.cpp:220 Adding camera '\_SB_.LNK1' for pipeline handler simple
[0:00:51.079833245] [6603]  INFO Camera camera.cpp:1215 configuring streams: (0) 3848x2176-ABGR8888/Unset
[0:00:51.080102294] [6620]  INFO IPASoft soft_simple.cpp:269 IPASoft: Exposure 4-4992, gain 128-1984 (1)
Zero-copy enabled
[0:00:53.687728218] [6619] ERROR V4L2 v4l2_videodevice.cpp:1781 /dev/video0[28:cap]: Failed to queue buffer 0: Protocol error
[0:00:53.687809722] [6619] ERROR V4L2 v4l2_videodevice.cpp:1781 /dev/video0[28:cap]: Failed to queue buffer 1: No such device
[0:00:53.687819476] [6619] ERROR V4L2 v4l2_videodevice.cpp:1781 /dev/video0[28:cap]: Failed to queue buffer 2: No such device
> qcam
[0:01:07.768936297] [6719]  INFO Camera camera_manager.cpp:330 libcamera v0.5.2
[0:01:07.774290305] [6737]  INFO SimplePipeline simple.cpp:1687 No sensor found for /dev/media0
No camera detected
```

Comment 45 Hans de Goede 2025-11-25 16:50:45 UTC
(In reply to miha.garafolj from comment #44)
> Sorry for the delay. I installed the new kernel per instructions, but at the
> moment not even qcam recognizes and plays the camera stream anymore. I
> suspect this is due to not being to able to load the drivers suddenly
> anymore. Neither does the snapshot, so I can't really test properly. 
> 
> ```
> > sudo insmod intel_cvs.ko
> insmod: ERROR: could not insert module intel_cvs.ko: Invalid module format
> ```

Thank you for testing. You need to rebuild the module for the new kernel, so do:

cd vision-drivers
make
sudo insmod intel_cvs.ko

the "make" will rebuild the module for the new kernel.

note in the mean time I've gotten confirmation by email that the test kernel does fix the issues in snapshot / firefox but as discussed with a zoom effect. Still this is good to know because it pinpoints where the problem is.

Comment 46 Gianpaolo 2025-12-15 13:20:39 UTC
I have a Dell Pro Max 16 Premium MA16250. I tried to compile the kernel myself, starting from mainline. The suggestion of including Intel Vision Drivers works perfectly for kernel 6.17.xx (together with usbio drivers: https://github.com/intel/usbio-drivers which are missing in mainline). But everything breaks with subsequent kernel versions, being 6.18.x or 6.19-rc1. Last kernel working seems to be 6.18-rc5. I tried bisecting but did not arrive to any conclusion (not an expert in bisecting changes).

Any hint?

Comment 47 Hans de Goede 2025-12-15 15:49:57 UTC
For 6.18.0 and 6.19-rc# you need:

https://lore.kernel.org/lkml/20251207184756.97904-1-johannes.goede@oss.qualcomm.com/

To fix things crashing when trying to stream from the IPU6. This will hopefully get merged into Torvald's current master tree soon.

Comment 48 miha.garafolj 2025-12-20 19:48:20 UTC
> note in the mean time I've gotten confirmation by email that the test kernel does fix the issues in snapshot / firefox but as discussed with a zoom effect. Still this is good to know because it pinpoints where the problem is.

Hey Hans! I have had some time lately to look into this again. Since cheese allows to set the camera resolution, I found out that low-res don't work (i.e. give the all-white output), however starting with 1440p onwards, it starts to stream normally. This is in line with what you have suggested in the earlier post. Is there any way to force default resolution with pipewire and snapshot/firefox without using your custom kernel? What else can I do with this information, what's the best place to further file a bug report?


Note You need to log in before you can comment on or make changes to this bug.