AXON V0.2 (RK3588): NPU IOMMU page fault (fdab9000) and kernel oops under multi-model RKNN load

We run an edge inference workload on an AXON V0.2 (RK3588, 8 GB RAM, eMMC).
The box hangs under multi-model RKNN load. The pstore shows an NPU IOMMU
page fault and a kernel oops. We would like to know whether this is a known
driver/runtime issue and which versions you recommend.

Environment

Item Value
Board Vicharak AXON V0.2, RK3588, 8 GB RAM, eMMC
OS Ubuntu 24.04.5 LTS, aarch64
Kernel 6.1.75-axon #axon SMP Mon Oct 5 19:20:01 IST 2026
NPU driver RKNPU driver: v0.9.8
Runtime librknnrt version: 2.3.0 (c949ad889d@2024-11-07T11:35:33)
Workload Python edge service, 5 RTSP streams from an 8-channel analog DVR
Models YOLO11s-640 (3 contexts), SCRFD-640, ArcFace-112, OSNet-256x128, kitchen-PPE, kitchen-gear, pose-640
Thermal 85 °C passive trip; 85–90 °C under the 5-stream load; fan at max

Observed failure

  • After 12 minutes to 4 hours, the box stops. There is no heartbeat, no SSH
    and no further log.
  • With the SoC watchdog armed, it resets every 12–60 minutes under the
    5-stream load. The resets become a boot loop.
  • fdab9000 is the NPU IOMMU for fdab0000.npu (rockchip,rk3588-rknpu).
    It is not the VPU decoder.

pstore console:

rk_iommu fdab9000.iommu: Page fault at 0x... of type write
rk_iommu fdab9000.iommu: iova = 0x...; dte_index ... pte ... valid: 1

pstore dmesg:

Internal error: Oops - Undefined instruction: 0000000002000000 [#2] SMP
CPU: 3 PID: 2021 Comm: python Tainted: G      D   6.1.75-axon #axon
pc : percpu_ref_put_many.constprop.0+0x0/0x8c
lr : obj_cgroup_uncharge_pages+0x98/0x120
Call trace:
  percpu_ref_put_many
  refill_obj_stock
  obj_cgroup_uncharge
  kmem_cache_free
  file_free_rcu
  rcu_do_batch

The NPU DMA appears to write to a page the kernel has already freed. The
kernel oopses during memory reclaim or process exit.

The VPU also logs:

mpp_platform: client 4 driver is not ready!

That is a separate VPU probe warning. It is not the NPU fault.

What we ruled out

  • eMMC: life_time=0x01, pre_eol_info=0x01; a storage canary writes
    and reads back every 60 s with no error; no mmc or EXT4-fs errors.
  • Power: a second device on the same supply stayed up.
  • Clean shutdown: no shutdown request, power-key event, OOM kill or
    thermal-critical message. The ext4 recovery is the result of the resets.
  • VPU decoder: the fault persisted after we disabled hardware decode
    and ran 3 cameras on software decode. The NPU inference was the common
    path.

Workaround

We reduced the load to:

  • 1 camera,
  • only YOLO11s-640,
  • one RKNN context,
  • optional pose/PPE/face/reID models off.

The box has been stable for 20+ minutes with no fdab9000 fault, at
73–74 °C. This suggests a multi-model or multi-context issue, but we have
not isolated the exact model.

Questions

  1. Is RKNPU driver v0.9.8 the correct driver for librknnrt 2.3.0 on kernel
    20261005-axon? Do you recommend a newer driver/runtime pair?
  2. Is there a known IOMMU page-fault or use-after-free issue with multiple
    RKNN contexts or multiple models on RK3588?
  3. Is there newer AXON V0.2 NPU firmware or librknnrt that we should use?
  4. Are there debug knobs (NPU IOMMU logs, rknn memory flags,
    RKNN_LOG_LEVEL) that would help isolate the failing model?
  5. Is sustained 85–90 °C at the 85 °C passive trip expected to be safe, or
    could it contribute to the fault?

@riddhi_raj, will guide you on this.

hi! can you try running your program with latest rknn-toolkit2 version 2.5.0. It has some multi modal runtime update fixes for preventing dma-buf/fd and some other fixes also, which can stabilize multi-modal inferences. same can be downloaded from here. You would need to update models, librknnrt.so and rknnlite too (if using python for inference).
Also make sure to use active heat sink and not to let cpu get overheated during deployment.

can you check and share logs of npu as
dmesg | grep -i rknpu

[ 18.395002] RKNPU fdab0000.npu: Adding to iommu group 0
[ 18.395167] RKNPU fdab0000.npu: RKNPU: rknpu iommu is enabled, using iommu mode
[ 18.396483] RKNPU fdab0000.npu: can’t request region for resource [mem 0xfdab0000-0xfdabffff]
[ 18.396572] RKNPU fdab0000.npu: can’t request region for resource [mem 0xfdac0000-0xfdacffff]
[ 18.396591] RKNPU fdab0000.npu: can’t request region for resource [mem 0xfdad0000-0xfdadffff]
[ 18.396909] [drm] Initialized rknpu 0.9.8 20240828 for fdab0000.npu on minor 2
[ 18.399409] RKNPU fdab0000.npu: RKNPU: bin=0
[ 18.399655] RKNPU fdab0000.npu: leakage=7
[ 18.399693] debugfs: Directory ‘fdab0000.npu-rknpu’ with parent ‘vdd_npu_s0’ already present!
[ 18.406923] RKNPU fdab0000.npu: pvtm=855
[ 18.411368] RKNPU fdab0000.npu: pvtm-volt-sel=2
[ 18.411438] debugfs: Directory ‘fdab0000.npu-rknpu’ with parent ‘vdd_npu_s0’ already present!
[ 18.413634] RKNPU fdab0000.npu: avs=0
[ 18.413762] RKNPU fdab0000.npu: l=15000 h=85000 hyst=5000 l_limit=0 h_limit=800000000 h_table=0

doesn’t seem any issue here. did you record this log while the software crashed or these are logs under just normal conditions?

Also, in earlier version of NPU runtime environment, if you try to use same core from more than one model, it some times crashed the os kernel. For this I used to create 3 npu threads which would execute different multiple models taken from job queue, thus preventing simultaneous execution and utilization of more than 3 models at any moment. However, hopefully they should have resolved this issue in latest rknn-toolkit2 version which is 2.5.0.