Re: [PATCH v5 2/3] media: uvcvideo: add UVC_QUIRK_CTRL_THROTTLE for fragile firmware

[Michal Pecio <michal.pecio@gmail.com>]

On Fri, 10 Apr 2026 16:06:43 -0700, Jeffrey Hein wrote:
> Test 1: Michal's xhci patch + JP's UVC patches + NO_LPM
> =========================================================
> Active: usbcore.quirks=1532:0e05:k (NO_LPM), DKMS uvcvideo with
> UVC_QUIRK_CTRL_THROTTLE, Michal's xhci patch.
> 
> Result: HC died. The crash sequence from the full log:
> 
> 1) 437 repeated Cancel/resubmit cycles on EP5 IN (ep 0x85, slot 5
>    ep 10) over ~7 minutes starting mid-call:
> 
>   [15:18:58] Cancel URB 0000000028356cb5, dev 3.1, ep 0x85, starting
> at offset 0x114a49080
>   [15:18:58] Stopped on Transfer TRB for slot 5 ep 10
>   ... (437 cancel/resubmit cycles through 15:26:04)
> 
>    This is the same "repeated unlinks on EP5IN" pattern you noted in
>    the March 30 stall-6.17-stress-during-call log, Michal.
> 
> 2) After the last ep 0x85 cancellation + endpoint reconfigure (add
>    ep 0x81), ~994,000 spurious SHORT_PACKET events (comp_code 13)
>    flooded the HC for ~5 minutes:
> 
>   [15:26:04] add ep 0x81, slot id 5
>   [15:26:04] Successful Endpoint Configure command
>   [15:26:04] Spurious event dma ..., comp_code 13 after 13

That's not abnormal and it probably shouldn't be logged at all.
I filtered out some of this noise from subsequent log snippets.

This is interesting because it shows the isochronous video endpoint
being enabled and then stopped and removed shortly after:

[Fri Apr 10 15:26:04 2026] xhci_hcd 0000:00:14.0: add ep 0x81, slot id 5, new drop flags = 0x0, new add flags = 0x8
[Fri Apr 10 15:26:04 2026] xhci_hcd 0000:00:14.0: xhci_check_bandwidth called for udev 00000000921e7e25
[Fri Apr 10 15:26:04 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:26:04 2026] xhci_hcd 0000:00:14.0: Successful Endpoint Configure command
[Fri Apr 10 15:26:05 2026] xhci_hcd 0000:00:14.0: Cancel URB 0000000009b97440, dev 3.1, ep 0x81, starting at offset 0x2db0885f0
[Fri Apr 10 15:26:05 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:26:05 2026] xhci_hcd 0000:00:14.0: Stopped on Transfer TRB for slot 5 ep 2
[...]
[Fri Apr 10 15:26:05 2026] xhci_hcd 0000:00:14.0: drop ep 0x81, slot id 5, new drop flags = 0x8, new add flags = 0x0

Then EP5IN submit/unlink cycles continue.
And video starts again:

[Fri Apr 10 15:26:09 2026] xhci_hcd 0000:00:14.0: add ep 0x81, slot id 5, new drop flags = 0x0, new add flags = 0x8
[Fri Apr 10 15:26:09 2026] xhci_hcd 0000:00:14.0: xhci_check_bandwidth called for udev 00000000921e7e25
[Fri Apr 10 15:26:09 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:26:09 2026] xhci_hcd 0000:00:14.0: Successful Endpoint Configure command

Transfer error followed by normal operation, seems harmless so far:

[Fri Apr 10 15:29:04 2026] xhci_hcd 0000:00:14.0: Transfer error for slot 5 ep 2 on endpoint
[Fri Apr 10 15:29:04 2026] xhci_hcd 0000:00:14.0: Error mid isoc TD, wait for final completion event
[Fri Apr 10 15:29:04 2026] xhci_hcd 0000:00:14.0: Transfer error for slot 5 ep 2 on endpoint
[Fri Apr 10 15:29:04 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fb7e0, comp_code 13 after 13

EP0 stall, not seen before. A bit suspicious, but video still runs:

[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x00000002db088de0, comp_code 13 after 13
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x00000002db088e10, comp_code 13 after 13
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Stalled endpoint for slot 5 ep 0
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Hard-reset ep 0, slot 5
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Ignoring reset ep completion code of 1
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Removing canceled TD starting at 0x114a485c0 (dma) in stream 0 URB 000000000ffbecf4
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Set TR Deq ptr 0x114a485f0, cycle 0
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: xhci_giveback_invalidated_tds: Keep cancelled URB 000000000ffbecf4 TD as cancel_status is 2
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x00000002db088e40, comp_code 13 after 13
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Successful Set TR Deq Ptr cmd, deq = @114a485f0
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: xhci_handle_cmd_set_deq: Giveback cancelled URB 000000000ffbecf4 TD
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Giveback URB 000000000ffbecf4, len = 0, expected = 4, status = -32
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x00000002db088e80, comp_code 13 after 13
[Fri Apr 10 15:30:26 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x00000002db088eb0, comp_code 13 after 13

EP0 timeout and unlink, video endpoint fails shortly after:

[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbe30, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbe60, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Cancel URB 0000000008ead041, dev 3.1, ep 0x0, starting at offset 0x114a48290
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Stopped on Transfer TRB for slot 5 ep 0
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Removing canceled TD starting at 0x114a48290 (dma) in stream 0 URB 0000000008ead041
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Set TR Deq ptr 0x114a482c0, cycle 0
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000008ead041 TD as cancel_status is 2
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Successful Set TR Deq Ptr cmd, deq = @114a482c0
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000008ead041 TD
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Giveback URB 0000000008ead041, len = 2, expected = 2, status = -115
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[Fri Apr 10 15:30:48 2026] usb 2-3.1: ThreadPoolSingl timed out on ep0in len=2/2
[Fri Apr 10 15:30:48 2026] usb 2-3.1: Failed to query (GET_CUR) UVC control 6 on unit 1: -110 (exp. 2).
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbe90, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbec0, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbef0, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbf30, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Spurious event dma 0x000000028c6fbf60, comp_code 13 after 13
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Transfer error for slot 5 ep 2 on endpoint
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Miss service interval error for slot 5 ep 2, set skip flag
[Fri Apr 10 15:30:48 2026] xhci_hcd 0000:00:14.0: Miss service interval error for slot 5 ep 2, set skip flag

Now things are properly broken. Next EP0 URB times out too:

[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Cancel URB 000000008f70ed5c, dev 3.1, ep 0x0, starting at offset 0x114a482c0
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Set TR Deq ptr 0x114a482f0, cycle 0
[...]
[Fri Apr 10 15:30:53 2026] usb 2-3.1: ThreadPoolSingl timed out on ep0in len=0/2
[Fri Apr 10 15:30:53 2026] usb 2-3.1: Failed to query (GET_CUR) UVC control 6 on unit 1: -110 (exp. 2).

Fololwed by Transaction Error on the next and subsequent ones:

[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Transfer error for slot 5 ep 0 on endpoint
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: TRB error 4, halted endpoint index = 0
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Hard-reset ep 0, slot 5
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Ignoring reset ep completion code of 1
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Removing canceled TD starting at 0x114a482f0 (dma) in stream 0 URB 000000000ca6398c
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Set TR Deq ptr 0x114a48320, cycle 0
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: xhci_giveback_invalidated_tds: Keep cancelled URB 000000000ca6398c TD as cancel_status is 2
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Successful Set TR Deq Ptr cmd, deq = @114a48320
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: xhci_handle_cmd_set_deq: Giveback cancelled URB 000000000ca6398c TD
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: Giveback URB 000000000ca6398c, len = 0, expected = 2, status = -71
[Fri Apr 10 15:30:53 2026] xhci_hcd 0000:00:14.0: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[Fri Apr 10 15:30:53 2026] usb 2-3.1: Failed to query (GET_CUR) UVC control 6 on unit 1: -71 (exp. 2).

It seems the driver stopped resubmitting video URBs here and issued
some control transfer. It timed out and unlinking crashed the HC.

[Fri Apr 10 15:30:54 2026] xhci_hcd 0000:00:14.0: Miss service interval error for slot 5 ep 2, set skip flag
[Fri Apr 10 15:30:54 2026] xhci_hcd 0000:00:14.0: Miss service interval error for slot 5 ep 2, set skip flag
[Fri Apr 10 15:30:54 2026] xhci_hcd 0000:00:14.0: Overrun event on slot 5 ep 2
[Fri Apr 10 15:30:54 2026] xhci_hcd 0000:00:14.0: Skipped one TD for slot 5 ep 2
[Fri Apr 10 15:30:59 2026] xhci_hcd 0000:00:14.0: Cancel URB 000000007f4f069a, dev 3.1, ep 0x0, starting at offset 0x114a48770
[Fri Apr 10 15:30:59 2026] xhci_hcd 0000:00:14.0: // Ding dong!
[Fri Apr 10 15:31:04 2026] xhci_hcd 0000:00:14.0: Command timeout, USBSTS: 0x00000000
[Fri Apr 10 15:31:04 2026] xhci_hcd 0000:00:14.0: xHCI host not responding to stop endpoint command

---

Question: can you kill it by starting some video application to set the
camera up, closing it and then running this loop?

while :; do v4l2-ctl -d /dev/video0 --stream-mmap --stream-count=1; done

Regards,
Michal