[PATCH v3 2/2] usb: uas: add US_FL_QDEPTH_075 quirk to cap queue depth at probe time

[Luca Cecchi <luca.cecchi.info@gmail.com>]

The previous patch in this series ("usb: uas: implement
.change_queue_depth to allow per-device queue depth override") lets
userspace lower a device's queue depth via the standard sysfs
attribute, but only after udev has had a chance to act. That still
leaves a window between probe and udev's write where the device runs
at the full default depth.

This adds US_FL_QDEPTH_075: it caps can_queue to 3/4 of the device's
reported maximum directly in uas_probe(), closing that window for
devices that need it. Applied here to the Lexar ES3 enclosure
(21c4:0003) from the previous patch.

v3: Sashiko AI review found two real issues in v2 (first version of
    this patch, sent alongside v2 of patch 1), both fixed:

    - [High] US_FL_QDEPTH_075 is bit 32 (0x100000000ULL - all 32 bits
      below it are already allocated upstream). UNUSUAL_DEV()'s
      driver_info field is kernel_ulong_t, i.e. a 32-bit unsigned
      long on 32-bit arches - storing this flag there would silently
      truncate to 0 at compile time, disabling the quirk on 32-bit
      kernels with no warning. Confirmed by checking
      include/linux/mod_devicetable.h's usb_device_id definition.

      Fix: dropped the UNUSUAL_DEV() table entry for the Lexar device
      entirely. uas-detect.h's uas_use_uas_driver() already has
      precedent for exactly this situation - the ASMedia/Seagate/
      HIKSEMI checks there match idVendor/idProduct directly and OR
      the flag into a local u64 variable, never touching driver_info.
      Added the Lexar check the same way. devinfo->flags itself is a
      plain u64 with no 32-bit-platform narrowing anywhere in that
      path, so this sidesteps the truncation entirely.

    - [Medium] the 3/4 cap in uas_probe() unconditionally overwrote
      can_queue, which could raise it instead of capping it for
      devices with a small qdepth (e.g. qdepth=4: the existing
      default is qdepth-2=2, but (4*3)/4=3 is larger, defeating the
      point of a cap). Fixed with min_t() against the existing
      qdepth-2 value - this quirk may now only lower can_queue, never
      raise it.

    Re-validated on bare metal with the same Lexar ES3 unit after the
    drive turned out to have been thermally stressed from several
    hours of back-to-back testing (confirmed by reproducing the same
    command-timeout/reset behaviour on Windows with a completely
    different driver stack, UASPStor - ruling out the driver/patch as
    the cause). After letting the drive rest:

    - Confirmed the quirk applies on its own at probe time
      (queue_depth=24) even with the udev rule from the previous
      patch disabled, so it isn't just masking a udev race.
    - Two 6-minute runs of the original load test (24 sync writers,
      randwrite, 64KiB, direct=1): 840-843MB/s, zero
      uas_eh_abort_handler/uas_eh_host_reset_handler events.
    - Same test run concurrently with a second USB flash drive under
      load on the same controller: no effect on throughput or
      stability.
    - Unplugged/replugged the drive mid-load: in-flight commands were
      cleaned up correctly (uas_zap_pending, no hang), the device
      re-enumerated as SuperSpeed, uas re-bound, and the quirk
      re-applied queue_depth=24 on the new probe without any help
      from udev.
    - Mixed 70/30 read/write load: 614MB/s read + 263MB/s write, zero
      events.

Signed-off-by: Luca Cecchi <luca.cecchi.info@gmail.com>
---
 drivers/usb/storage/uas-detect.h | 13 +++++++++++++
 drivers/usb/storage/uas.c        | 13 +++++++++++++
 include/linux/usb_usual.h        |  2 ++
 3 files changed, 28 insertions(+)

diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index 4d3b49e..5dd52d6 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -129,6 +129,19 @@ static int uas_use_uas_driver(struct usb_interface *intf,
 			(udev->product && !strcmp(udev->product, "MD202")))
 		flags |= US_FL_IGNORE_UAS;
 
+	/*
+	 * This Lexar ES3 enclosure locks up under sustained deep command
+	 * queueing. US_FL_QDEPTH_075 doesn't fit in the UNUSUAL_DEV()
+	 * table's driver_info (kernel_ulong_t, only 32 bits on 32-bit
+	 * arches - this flag is bit 32), so it's set here instead,
+	 * same as the ASMedia/Seagate/HIKSEMI cases above.
+	 *
+	 * Reported-by: Luca Cecchi <luca.cecchi.info@gmail.com>
+	 */
+	if (le16_to_cpu(udev->descriptor.idVendor) == 0x21c4 &&
+			le16_to_cpu(udev->descriptor.idProduct) == 0x0003)
+		flags |= US_FL_QDEPTH_075;
+
 	usb_stor_adjust_quirks(udev, &flags);
 
 	if (flags & US_FL_IGNORE_UAS) {
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 1b65e03..4cdf7f8 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -1067,6 +1067,19 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	 */
 	shost->can_queue = devinfo->qdepth - 2;
 
+	/*
+	 * Some bridge chips lock up under sustained deep command queueing
+	 * even within the margin above. For those, US_FL_QDEPTH_075 caps
+	 * the depth to 3/4 of the device's reported maximum at probe time,
+	 * closing the window a udev-triggered .change_queue_depth write
+	 * would otherwise leave open between probe and udev acting. Take
+	 * the min with the existing margin above - this must only ever
+	 * lower can_queue, never raise it back up for low-qdepth devices.
+	 */
+	if (devinfo->flags & US_FL_QDEPTH_075)
+		shost->can_queue = min_t(int, shost->can_queue,
+					 (devinfo->qdepth * 3) / 4);
+
 	usb_set_intfdata(intf, shost);
 	result = scsi_add_host(shost, &intf->dev);
 	if (result)
diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
index 712363c..b436c34 100644
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -88,6 +88,8 @@
 		/* Cannot handle WRITE_SAME */			\
 	US_FLAG(SENSE_AFTER_SYNC, 0x80000000)			\
 		/* Do REQUEST_SENSE after SYNCHRONIZE_CACHE */	\
+	US_FLAG(QDEPTH_075,	0x100000000ULL)			\
+		/* Cap UAS queue depth to 3/4 of device max at probe time */
 
 #define US_FLAG(name, value)	US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };
-- 
2.55.0