Re: Regression: webcam freezing since Linux 6.15

[Bart Nagel <bart@tremby.net>]

[-- Attachment #1: Type: text/plain, Size: 3054 bytes --]

At 2026-07-25 11:59:56 +0200, Michal Pecio wrote:
> On Thu, 23 Jul 2026 15:45:25 -0700, Bart Nagel wrote:
> > I found that I can reproduce the freeze much, much faster if I run
> > `stress --cpu $(nproc)` at the same time.
> 
> Great news, good work.
> 
> What happens differently in absence of CPU load?
> - no Missed Service Errors anymore
> - ep_trb_dma (see below) becomes always zero
> - no obvious change, somehow the kernel gets more lucky

The log is a whole lot quieter. With ffplay it appears that no
uvc_v4l2_poll messages are produced. I ran for a few minutes and was
seeing no missed service errors at all. I can show the whole log from
that run in just a few lines once I strip the timestamps and run
through uniq -c:

       1 usb 2-6.1: uvc_v4l2_open
       1 usb 2-6.1: Trying format 0x56595559 (YUYV): 1920x1080
       1 usb 2-6.1: Using default frame interval 16666.6 us (60.0 fps)
       1 usb 2-6.1: Setting frame interval to 1/60 (166666)
      32 usb 2-6.1: uvc_v4l2_mmap
    7619 usb 2-6.1: Frame complete (EOF found)
       1 usb 2-6.1: uvc_v4l2_release
       5 xhci_hcd 0000:00:14.0: Stopped on Transfer TRB for slot 6 ep 2
       1 xhci_hcd 0000:00:14.0: Stopped on Transfer TRB for slot 6 ep 10
       1 xhci_hcd 0000:00:14.0: Stopped on Transfer TRB for slot 2 ep 2
       1 xhci_hcd 0000:00:14.0: Stopped on No-op or Link TRB for slot 2 ep 0

...
> But oddly, on your HW it sometimes isn't zero. The commit you bisected
> assumes that non-zero numbers are valid pointers and this seems to work
> more or less correctly, until it doesn't:
> 
...
> 
> For some reason the driver thought that all TDs were missed and
> returned them with -18 status; we see a burst of those logs from
> uvcvideo moment later. Then I suspect uvcvideo resubmitted enough
> URBs to go around the whole ring and overwrite pending transfers
> with opposite cycle bit, which caused the HW to stop and produce
> a Ring Overrun event.
> 
> The root cause is bogus ep_trb_dma from the HW or some kernel bug.
> 
> Maybe we could get enough info from debugfs to see what happened. If
> possible, disconnect other USB devices from bus 1 and 2, trigger the
> bug again, and *before* stopping video recording, run:
> 
> zip -r debugfs.zip /sys/kernel/debug/usb/xhci/0000:00:14.0
> 
> This requires debugfs to be enabled in the kernel and mounted. And zip
> will print some warnings, but generate a valid archive. If you need to
> use tar instead, you must first copy the directory, then archive it.
> 
> Email the zip (should be under 1MB) and corresponding dmesg as before.

OK, I've done this. I disconnected all USB devices but that webcam and
my keyboard, and the hubs those two are connected through (otherwise
would be a pain but let me know if it would be helpful).

For whatever reason it took longer to get a failure this time, even
with the CPU stressor running. About 12 minutes. To my eye the kernel
log looks very similar to last time. Since it ran for much longer it's
much larger and so I've gzipped it. Debugfs zip attached too.

Thank you.

[-- Attachment #2: dmesg-highload.txt.gz --]
[-- Type: application/gzip, Size: 611386 bytes --]

[-- Attachment #3: debugfs-freeze.zip --]
[-- Type: application/zip, Size: 499616 bytes --]