From: JP Hein <jp@jphein.com>
To: Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
Hans de Goede <hansg@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-media@vger.kernel.org, linux-usb@vger.kernel.org,
Ricardo Ribalda <ribalda@chromium.org>,
Michal Pecio <michal.pecio@gmail.com>, JP Hein <jp@jphein.com>
Subject: [PATCH v6 0/2] media: uvcvideo: Add quirks to prevent Razer Kiyo Pro xHCI cascade failure
Date: Thu, 9 Apr 2026 00:42:40 -0700 [thread overview]
Message-ID: <20260409074242.2115657-1-jp@jphein.com> (raw)
In-Reply-To: <20260331003806.212565-1-jp@jphein.com>
The Razer Kiyo Pro (1532:0e05) is a USB 3.0 webcam whose firmware has a
well-documented failure mode that cascades into complete xHCI host
controller death, disconnecting every USB device on the bus -- including
keyboards and mice, requiring a hard reboot.
The device has two crash triggers:
1. LPM/autosuspend resume: Device enters LPM or autosuspend, fails to
reinitialize on resume, producing EPIPE (-32) on UVC SET_CUR. The
stalled endpoint triggers an xHCI stop-endpoint timeout, and the
kernel declares the host controller dead.
2. Rapid control transfers: sustained rapid UVC control operations
(hundreds over several seconds) overwhelm the firmware. The error-code
query (GET_CUR on UVC_VC_REQUEST_ERROR_CODE_CONTROL) amplifies the
failure by sending a second transfer to the already-stalling device,
pushing it into a full lockup and xHCI controller death.
Patch 1 of the original 3-patch series (USB_QUIRK_NO_LPM for 1532:0e05)
has been merged by Greg Kroah-Hartman and backported to stable kernels
6.1, 6.6, 6.12, 6.18, and 6.19.
This v6 series covers the remaining two UVC patches:
Patch 1/2: UVC driver -- introduce UVC_QUIRK_CTRL_THROTTLE to rate-limit
all USB control transfers (50ms minimum interval) in __uvc_query_ctrl()
and skip the error-code query after EPIPE errors on affected devices.
Patch 2/2: UVC driver -- add Razer Kiyo Pro device table entry with
UVC_QUIRK_CTRL_THROTTLE, UVC_QUIRK_DISABLE_AUTOSUSPEND, and
UVC_QUIRK_NO_RESET_RESUME.
Changes since v5:
- Moved throttle from uvc_query_ctrl() to __uvc_query_ctrl() so
all callers are covered, including uvc_set_video_ctrl() which
bypasses the higher-level function (Ricardo Ribalda)
- Throttle now applies to all query types, not just SET_CUR -- the
firmware doesn't distinguish between query directions under load
(Ricardo Ribalda)
- Added lsusb -v Device Descriptor to patch 2/2 commit message
(Ricardo Ribalda)
- Bug reproduced on two separate Kiyo Pro units, confirming not
unit-specific
Changes since v4:
- Dropped stable CC (new quirks, not regression fixes)
- Updated cover letter with 6.17 test results
Changes since v3:
- Regenerated patches against media-committers next branch to fix
context mismatch (v3 was based on Ubuntu 6.8 source)
Tested on:
- Kernel: 6.17.0-20-generic (Ubuntu 24.04 HWE) and 6.8.0-106-generic
- Hardware: Intel Cannon Lake PCH xHCI (8086:a36d)
- Device: Two Razer Kiyo Pro units (1532:0e05), firmware 1.5.0.1
Stress test, crash evidence, and debug logs:
https://github.com/jphein/kiyo-xhci-fix
JP Hein (2):
media: uvcvideo: add UVC_QUIRK_CTRL_THROTTLE for fragile USB firmware
media: uvcvideo: add Razer Kiyo Pro to device info table
drivers/media/usb/uvc/uvc_driver.c | 16 ++++++++++++++++
drivers/media/usb/uvc/uvc_video.c | 30 ++++++++++++++++++++++++++++++
drivers/media/usb/uvc/uvcvideo.h | 3 +++
3 files changed, 49 insertions(+)
--
2.43.0
next prev parent reply other threads:[~2026-04-09 7:44 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-31 0:38 [PATCH v5 0/3] USB/UVC: Add quirks to prevent Razer Kiyo Pro xHCI cascade failure JP Hein
2026-03-31 0:38 ` [PATCH v5 1/3] USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam JP Hein
2026-03-31 0:38 ` [PATCH v5 2/3] media: uvcvideo: add UVC_QUIRK_CTRL_THROTTLE for fragile firmware JP Hein
2026-04-09 6:45 ` Ricardo Ribalda
[not found] ` <CAD5VvzAu8+Qz7hEEBzuKvO11X=YD-wrtX3_Tk77g2Cq5rZZD0Q@mail.gmail.com>
2026-04-09 7:51 ` Jeffrey Hein
2026-04-09 8:02 ` Michal Pecio
2026-04-09 8:15 ` Jeffrey Hein
2026-04-09 20:17 ` Michal Pecio
2026-04-10 0:01 ` Jeffrey Hein
2026-04-10 0:24 ` Jeffrey Hein
2026-04-10 4:47 ` Michal Pecio
2026-04-10 21:48 ` Mathias Nyman
2026-04-10 23:06 ` Jeffrey Hein
2026-04-11 13:39 ` Michal Pecio
2026-03-31 0:38 ` [PATCH v5 3/3] media: uvcvideo: add quirks for Razer Kiyo Pro webcam JP Hein
2026-04-09 6:49 ` Ricardo Ribalda
2026-04-09 7:38 ` Jeffrey Hein
2026-04-09 7:42 ` JP Hein [this message]
2026-04-09 7:42 ` [PATCH v6 1/2] media: uvcvideo: add UVC_QUIRK_CTRL_THROTTLE for fragile USB firmware JP Hein
2026-04-09 7:57 ` Ricardo Ribalda
2026-04-09 8:12 ` Jeffrey Hein
2026-04-09 7:42 ` [PATCH v6 2/2] media: uvcvideo: add Razer Kiyo Pro to device info table JP Hein
2026-04-09 7:57 ` Ricardo Ribalda
2026-04-09 8:13 ` Jeffrey Hein
2026-04-10 0:28 ` [PATCH v7 0/2] media: uvcvideo: Add quirks to prevent Razer Kiyo Pro xHCI cascade failure JP Hein
2026-04-10 0:28 ` [PATCH v7 1/2] media: uvcvideo: add UVC_QUIRK_CTRL_THROTTLE for fragile USB firmware JP Hein
2026-04-10 0:28 ` [PATCH v7 2/2] media: uvcvideo: add Razer Kiyo Pro to device info table JP Hein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260409074242.2115657-1-jp@jphein.com \
--to=jp@jphein.com \
--cc=gregkh@linuxfoundation.org \
--cc=hansg@kernel.org \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-media@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=michal.pecio@gmail.com \
--cc=ribalda@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox