[BUG] xhci: repeated URB cancel on UVC status interrupt EP (0x83) loops for ~15s, stalls camera - Intel Cannon Point-LP [8086:9ded]

Hi,

The built-in UVC webcam on an ASUS VivoBook X509FL freezes after a few

rapid stream restart cycles: video hitches for a second at random, then

stalls completely for ~15 s before recovering on its own. ftrace of

xhci-hcd points at a repeated URB-cancel loop on the camera's VideoControl

status interrupt endpoint (0x83), not at the isoc video stream.

This is not application-specific and not a regression. It reproduces with

a plain v4l2-ctl restart loop (no browser/Zoom), and behaves the same on

6.8.11, 6.11.11 and 7.1.3 (Fedora builds); the dmesg event storm is just

more verbose on 6.12+.

Hardware:

- Intel Cannon Point-LP USB 3.1 xHCI Controller [8086:9ded] (rev 30)

- Camera: 13d3:5a11 "USB2.0 VGA UVC WebCam", UVC 1.00

- EP 0x81: isochronous video (VideoStreaming, 8 alt settings, max

alt 7 = 3x1024 B/uframe), appears as "ep 2" in the xhci context

- EP 0x83: interrupt IN (VideoControl status)

- No ALSA device is exposed by the camera; audio is not involved.

Reproducer (no application needed):

# continuous single stream - always stable, 30 fps, never stalls:

timeout 120 v4l2-ctl -d /dev/video0 --stream-mmap --stream-count=3600

# rapid STREAMON/STREAMOFF loop - stalls within a few iterations

# (v4l2-ctl hangs, zero frames), recovers by itself after ~15 s:

for i in $(seq 1 40); do

v4l2-ctl -d /dev/video0 --stream-mmap --stream-count=120

echo "run $i: $?"

done

ftrace (events: xhci-hcd) captured while reproducing. During the stall,

one URB on ep 0x83 is cancelled 68 times over ~14.7 s (t=6119.476 ..

6134.178), each iteration advancing TR Deq Ptr by exactly one TRB (0x10):

xhci_dbg_cancel_urb: Cancel URB 00000000978a08ef, dev 5, ep 0x83, starting at offset 0x1167e9440

xhci_handle_cmd_stop_ep: ...

xhci_dbg_cancel_urb: Removing canceled TD starting at 0x1167e9440 (dma) in stream 0 URB 00000000978a08ef

xhci_dbg_cancel_urb: Set TR Deq ptr 0x1167e9450, cycle 0

xhci_handle_cmd_set_deq_ep: ...

xhci_dbg_cancel_urb: Successful Set TR Deq Ptr cmd, deq = @1167e9450

xhci_dbg_cancel_urb: Cancel URB 00000000978a08ef, dev 5, ep 0x83, starting at offset 0x1167e9450

... (repeats, deq crawling +0x10 each time: 440 -> 450 -> 460 -> ...)

ep 0x81 shows 10 cancels in the same window. Note the trace logs

"in stream 0" for an interrupt endpoint, which has no streams - possibly

relevant.

As a side effect, the isoc video endpoint (0x81 / "ep 2") floods dmesg

during the stall:

xhci_hcd 0000:00:14.0: Event dma 0x... for ep 2 status 13 not part of TD at 0x...

xhci_hcd 0000:00:14.0: Event dma 0x... for ep 2 status 1 not part of TD at 0x...

xhci_hcd 0000:00:14.0: Event TRB for slot 4 ep 2 with no TDs queued

The USB control path is clean: usbmon shows the standard UVC restart

(VS_PROBE/COMMIT SET_CUR/GET_CUR, then SET_INTERFACE alt 7 / alt 0)

completing without any STALL. The device responds correctly; the failure

is on the xHCI cancel/set-deq side.

Attached:

- xhci ftrace (trace-cmd report output), the main exhibit

- usbmon capture (bus 1) across the transition into the stall

- dmesg fragment with the event storm

- lsusb -v -d 13d3:5a11

- lspci -nnvv -s 00:14.0

Happy to test patches, add dynamic debug, or capture more tracing.

Thanks,

Dmitry

Link to files if weren't sent: https://pixeldrain.com/l/iPwNbqVf