[PATCH v2 1/2] usb: uas: implement .change_queue_depth to allow per-device queue depth override

[Luca Cecchi <luca.cecchi.info@gmail.com>]

uas_host_template does not implement .change_queue_depth. Because of
that, the standard sysfs queue_depth attribute stays read-only for
every UAS device, not just mine: scsi_sysfs.c:sdev_store_queue_depth()
requires sht->change_queue_depth to be non-NULL before it allows a
write.

uas_probe() already defaults can_queue to qdepth - 2, with a comment
acknowledging that "some bridge firmwares" need extra margin. That
margin isn't enough for every bridge. Right now the only way to work
around a bridge that needs more headroom is the IGNORE_UAS quirk,
which disables UAS entirely and falls back to BOT/usb-storage - a
large performance cost for a queue-depth problem.

This patch wires up .change_queue_depth so affected users can lower
the depth for just their device (e.g. via a udev rule matching
idVendor/idProduct), without disabling UAS altogether. Default
behaviour (qdepth - 2) is unchanged unless userspace asks for less.

Tested against a Lexar ES3 external SSD enclosure (VID:PID 21c4:0003)
that locks up under sustained heavy concurrent random writes at the
default queue depth. Capping the depth to 24 via this interface
eliminated the lockup across 6 consecutive test runs, including a
continuous 1-hour soak test (1.36TB written, ~822MB/s, no
uas_eh_abort_handler events).

v2: guard against devinfo->qdepth holding a negative error code left
    over from a failed uas_configure_endpoints() call in
    uas_post_reset()/uas_reset_resume() (the device stays live after
    such a failure); without the guard a negative depth would reach
    scsi_change_queue_depth() and underflow the unsigned queue_depth
    in the block layer (found by Sashiko AI review)

    Re-tested on the same Lexar ES3 hardware: writing 0 or a negative
    value to the sysfs queue_depth attribute is now rejected cleanly
    (queue_depth stays at the previously set 24, no error in dmesg),
    confirming the "depth < 1" guard behaves correctly against real
    userspace input. I was not able to reproduce the specific failure
    path itself (devinfo->qdepth left negative by a failed
    usb_alloc_streams() during reset) on this machine - the running
    kernel has CONFIG_FAULT_INJECTION disabled, so I could not force
    that call to fail on demand. That half of the fix is verified by
    code inspection only, not by a live reproduction.

    Also switched devinfo's lookup to sdev->hostdata (same pattern
    already used by uas_sdev_configure() and the other scsi_device-
    level callbacks in this file) instead of casting
    sdev->host->hostdata, which was pushing the line past 80 columns.

Signed-off-by: Luca Cecchi <luca.cecchi.info@gmail.com>
---
 drivers/usb/storage/uas.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 2651629..971a47f 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -910,6 +910,38 @@ static int uas_sdev_configure(struct scsi_device *sdev,
 	return 0;
 }
 
+/*
+ * uas does not implement .change_queue_depth, so the standard sysfs
+ * queue_depth attribute stays read-only for every UAS device (see
+ * scsi_sysfs.c:sdev_store_queue_depth(), which requires
+ * sht->change_queue_depth != NULL). Some bridge chips become
+ * unstable under deep command queueing; wiring this up lets affected
+ * users lower the depth for just their device (e.g. via a udev rule
+ * matching idVendor/idProduct), without disabling UAS altogether.
+ * Default behaviour (qdepth - 2) is unchanged unless userspace asks
+ * for less.
+ */
+static int uas_change_queue_depth(struct scsi_device *sdev, int depth)
+{
+	struct uas_dev_info *devinfo = sdev->hostdata;
+	int max_depth = devinfo->qdepth - 2;
+
+	/*
+	 * devinfo->qdepth can be left holding a negative error code (e.g.
+	 * -ENOMEM from usb_alloc_streams()) if a reset via uas_post_reset()
+	 * or uas_reset_resume() fails to reconfigure the endpoints; the
+	 * device stays live in that case. Refuse rather than let a
+	 * negative depth reach scsi_change_queue_depth() and underflow
+	 * the unsigned queue_depth in the block layer.
+	 */
+	if (depth < 1 || max_depth < 1)
+		return -EINVAL;
+
+	if (depth > max_depth)
+		depth = max_depth;
+	return scsi_change_queue_depth(sdev, depth);
+}
+
 static const struct scsi_host_template uas_host_template = {
 	.module = THIS_MODULE,
 	.name = "uas",
@@ -917,6 +949,7 @@ static const struct scsi_host_template uas_host_template = {
 	.target_alloc = uas_target_alloc,
 	.sdev_init = uas_sdev_init,
 	.sdev_configure = uas_sdev_configure,
+	.change_queue_depth = uas_change_queue_depth,
 	.eh_abort_handler = uas_eh_abort_handler,
 	.eh_host_reset_handler = uas_eh_host_reset_handler,
 	.this_id = -1,
-- 
2.55.0