[PATCH] usb: dwc3: Increase no-IOC ENDTRANSFER delay

[PATCH] usb: dwc3: Increase no-IOC ENDTRANSFER delay

[Elson Serrao]

When ENDTRANSFER is issued without CMDIOC, software does not wait for
command completion and instead relies on a fixed delay before continuing
request teardown. The DWC3 programming guide recommends using a timeout
greater than 1 ms for command completion. Increase the post-ENDTRANSFER
delay to 2 ms to provide additional margin before request teardown. This
prevents SMMU faults that can occur when the controller accesses unmapped
requests before ENDTRANSFER processing has completed.

Fixes: d8a2bb4eb758 ("usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC")
Cc: stable@vger.kernel.org
Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com>
---
The DWC3 programming guide recommends a delay greater than 1 ms for
ENDTRANSFER completion without CMDIOC, but does not specify a worst-case
completion time. The delay is increased to 2 ms to provide additional
margin based on observed failures.

If 2 ms is considered excessive, guidance on an appropriate worst-case
timeout would be appreciated.
---
 drivers/usb/dwc3/gadget.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index a76f669a796c..a907fdfac8d7 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -445,7 +445,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
 
 	if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
 	    !(cmd & DWC3_DEPCMD_CMDIOC))
-		mdelay(1);
+		mdelay(2);
 
 	if (saved_config) {
 		reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
@@ -4158,7 +4158,7 @@ void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,
 	 * returning from this function.
 	 *
 	 * This mode is NOT available on the DWC_usb31 IP.  In this
-	 * case, if the IOC bit is not set, then delay by 1ms
+	 * case, if the IOC bit is not set, then delay by 2ms
 	 * after issuing the EndTransfer command.  This allows for the
 	 * controller to handle the command completely before DWC3
 	 * remove requests attempts to unmap USB request buffers.
-- 
2.34.1

Re: [PATCH] usb: dwc3: Increase no-IOC ENDTRANSFER delay

[Thinh Nguyen]

Hi,

On Tue, Nov 03, 2026, Elson Serrao wrote:
> When ENDTRANSFER is issued without CMDIOC, software does not wait for
> command completion and instead relies on a fixed delay before continuing
> request teardown. The DWC3 programming guide recommends using a timeout
> greater than 1 ms for command completion. Increase the post-ENDTRANSFER
> delay to 2 ms to provide additional margin before request teardown. This
> prevents SMMU faults that can occur when the controller accesses unmapped
> requests before ENDTRANSFER processing has completed.
> 
> Fixes: d8a2bb4eb758 ("usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC")
> Cc: stable@vger.kernel.org
> Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com>
> ---
> The DWC3 programming guide recommends a delay greater than 1 ms for
> ENDTRANSFER completion without CMDIOC, but does not specify a worst-case
> completion time. The delay is increased to 2 ms to provide additional
> margin based on observed failures.

Which platform and controller version did you see this on? What was the
connected speed? And where did the failure occur? usb_ep_disable() or
reset/disconnect?

Can you test against Greg's usb-linus branch? It has some changes to End
Transfer command handling. Note that the usb_ep_disable() now issues End
Transfer with CMDIOC and the delay moved to dwc3_remove_requests(), so
this patch no longer covers that path. Any change would need to go on
top of that.

Thanks,
Thinh