Re: [PATCH 0/3] USB/UVC: Add quirks to prevent Razer Kiyo Pro xHCI cascade failure

[Michal Pecio <michal.pecio@gmail.com>]

On Sun, 22 Mar 2026 15:10:28 -0700, Jeffrey Hein wrote:
> Both failure modes are in the device firmware (version 8.21), not the
> kernel, so they exist on any kernel version.  On 6.8.0-106-generic
> (where I tested), the TRB_STOP_RING case in
> xhci_handle_command_timeout() goes straight to xhci_halt() +
> xhci_hc_died() without attempting per-device recovery.

Command timeout is a failure of the xHCI controller, not the device,
and as Alan said, it's generally not supposed to happen so we are
curious how it happens and if it can be prevented in xhci-hcd.

Device behavior may be a contributing factor, as can be a kernel bug
or controller HW bug. It would be helpful if somebody tried this on
non-Intel hardware and on current kernels, because there were various
changes to xHCI error handling over the last two years.

> The stress test script is in the series repository:
> 
>     https://github.com/jphein/kiyo-xhci-fix
> 
> stress-test-kiyo.sh exercises UVC controls via v4l2-ctl at maximum
> rate -- brightness, contrast, saturation, white balance, exposure,
> focus, pan/tilt/zoom -- cycling through their full ranges each round.
> With 0ms delay between controls, the crash consistently occurs around
> round 25 of 50 (~5-10 seconds of sustained rapid SET_CUR).

OK, I will see if it does anything interesting on my hardware, but it
may be nothing because I don't have this camera.

Did you try it on a different camera in the same USB port?

> That said, the firmware lockup itself is controller-independent -- the
> device stops responding to USB control transfers regardless of the
> host controller.  What varies is the host controller's response to the
> resulting stop-endpoint timeout.  On 6.8, xhci-hcd takes the
> TRB_STOP_RING timeout straight to hc_died()

Nope, this is controller dependent because Stop Endpoint is a command
to the controller and it has no reason to fail. Something is broken.

Could you boot a newer kernel (compile 7.0-rc5 yourself or at least get
latest release (or beta) of your distribution), enable dynamic debug 

echo 'module xhci_hcd +p' >/proc/dynamic_debug/control
echo 'module usbcore +p' >/proc/dynamic_debug/control

then connect the camera, crash it again and send dmesg output?

Regards,
Michal