Since the gang_size check is outside of chunk parsing
loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

fence Decrements the reference count before exiting.
Avoid Race Vulnerabilities for fence use-after-free.

v2 (chk): actually fix the use after free and not just move it.

Signed-off-by: shanzhulig <shanzhulig@gmail.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Since adding gang submit we need to take the gang size into account
while reserving fences.

Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Instead of using the VRAM lost counter add a 64bit token which indicates
if a context or job is still valid to use.

Should the VRAM be lost or the page tables need re-creation the token will
change indicating that userspace needs to act and re-create the contexts
and re-submit the work.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Once command submission failed due to userptr invalidation in
amdgpu_cs_submit, legacy code will perform cleanup of scheduler
job. However, it's not needed at all, as former commit has integrated
job cleanup stuff into amdgpu_job_free. Otherwise, because of double
free, a NULL pointer dereference will occur in such scenario.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457
Fixes: f7d66fb2ea43 ("drm/amdgpu: cleanup scheduler job initialization v2")
Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

The following checkpatch errors & warning is removed.

ERROR: else should follow close brace '}'
ERROR: trailing statements should be on next line
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
WARNING: Possible repeated word: 'Fences'
WARNING: Missing a blank line after declarations
WARNING: braces {} are not necessary for single statement blocks
WARNING: Comparisons should place the constant on the right side of the test
WARNING: printk() should include KERN_<LEVEL> facility level

Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Add support for submitting the shadow update packet
when submitting an IB.  Needed for MCBP on GFX11.

v2: update API for CSA (Alex)
v3: fix ordering; SET_Q_PREEMPTION_MODE most come before COND_EXEC
    Add missing check for AMDGPU_CHUNK_ID_CP_GFX_SHADOW in
    amdgpu_cs_pass1()
    Only initialize shadow on first use
    (Alex)
v4: Pass parameters rather than job to new ring callback (Alex)
v5: squash in change to call SET_Q_PREEMPTION_MODE/COND_EXEC
    before RELEASE_MEM to complete the UMDs use of the shadow (Alex)

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

The type of size is unsigned int, if size is 0x40000000, there will
be an integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

And ensure each ring supports that many submissions. This makes
sure that we don't get surprises after the submission has been
scheduled where the ring allocation actually gets rejected.

My calculations on the existing limits:
COMPUTE v10: 128
COMPUTE v11: 128
COMPUTE v6: 157
COMPUTE v7: 133
COMPUTE v8: 130
COMPUTE v9: 125
GFX v10: 208
GFX v11: 213
GFX v6: 154 (doubling this in the previous patch)
GFX v7: 226
GFX v8: 213
GFX v9: 208
GFX v9 (SW): 208
SDMA CIK: 87
SDMA SI: 97
SDMA v2.4: 74
SDMA v3.0: 74
SDMA v4.0: 72
SDMA v5.0: 51
SDMA v6.0: 52
UVD ENC v6.0: 98
UVD ENC v7.0: 92
UVD v3.1: 124
UVD v4.2: 124
UVD v5.0: 83
UVD v6.0  (VM): 55
UVD v7.0: 51
VCE v2.0: 126
VCE v3.0 (VM): 98
VCE v4.0: 93
VCN DEC v1.0: 49
VCN DEC v2.0: 51
VCN DEC v3.0: 51
VCN ENC v1.0: 58
VCN ENC v2.0: 93
VCN ENC v3.0: 93
VCN ENC v4.0: 93
VCN JPEG v1.0: 17
VCN JPEG v2.0: 16
VCN JPEG v2.5: 17
VCN JPEG v3.0: 17
VCN JPEG v4.0: 17

Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2498
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Pull drm updates from Dave Airlie:
 "There are a bunch of changes all over in the usual places.

  Highlights:

   - habanalabs moves from misc to accel

   - first accel driver for Intel VPU (Versatile Processing Unit)
     inference engine

   - dropped all the ancient legacy DRI1 drivers. I think it's been at
     least 10 years since anyone has heard about these.

   - Intel DG2 updates and prelim Meteorlake enablement

   - etnaviv adds support for Versilicon NPU device (a GPU like engine
     with inference accelerators)

  Detailed summary:

  Removals:
   - remove legacy dri1 drivers: i810, mga, r128, savage, sis, tdfx, via

  New driver:
   - intel VPU accelerator driver
   - habanalabs comes via drm tree now

  drm/core:
   - use drm_dbg_ helpers in several places
   - Document defaults for CRTC backgrounds
   - Document use of drm_minor

  edid:
   - improve mode parsing and refactoring

  connector:
   - support analog TV mode property

  media:
   - add some common formats

  udmabuf:
   - add vmap/vunmap methods

  fourcc:
   - add XRGB1555 and RGB565 formats
   - document open source user waiver

  firmware:
   - fix color-format selection for system framebuffer

  format-helper:
   - Add conversion from XRGB8888 to various sysfb formats
   - Make XRGB8888 the only driver-emulated legacy format
   - Add conversion from XRGB8888 to XBGR8888 and ABGR8888

  fb-helper:
   - fix preferred depth and bpp values across drivers
   - Avoid blank consoles from selecting an incorrect color format

  probe-helper:
   - Enable/disable HPD on connectors

  scheduler:
   - Fix lockup in drm_sched_entity_kill()
   - Deprecate drm_sched_resubmit_jobs()

  bridge:
   - remove unused functions
   - implement i2c probe_new in various drivers
   - ite-it6505: Locking fixes, Cache EDID data
   - ite-it66121: Support IT6610 chip
   - lontium-tl9611: Fix HDMI on DragonBoard 845c
   - parade-ps8640: Use atomic bridge functions
   - Support i.MX93 LDB plus DT bindings

  debugfs:
   - add per device helpers and convert drivers

  displayport:
   - mst fixes
   - add DP adaptive sync DPCD definitions

  fbdev:
   - always pick 32bpp as default
   - remove some unused code

  simpledrm:
   - support system memory framebuffers

  panel:
   - add orientation quirks for Lenovo Yoga Tab 3 X90F and DynaBook K50
   - Use ktime_get_boottime() to measure power-down delay
   - Fix auto-suspend delay
   - Visionox VTDR6130 AMOLED DSI
   - Support Himax HX8394
   - Convert many drivers to common generic DSI write-sequence helper
   - AUO A030JTN01

  ttm:
   - drop bo wait wrapper
   - fix MIPS build

  habanalabs:
   - moved driver to accel subsystem
   - gaudi2 decoder error improvement
   - more trace events
   - Gaudi2 abrupt reset by firmware support
   - add uAPI to flush memory transactions
   - add uAPI to pass through userspace reqs to fw
   - remove dma-buf export by handle

  amdgpu:
   - add new INFO queries for peak and min sclk/mclk for profile modes
   - Add PCIe info to the INFO IOCTL
   - secure display support for multiple displays
   - DML optimizations
   - DCN 3.2 updates
   - PSR updates
   - DP 2.1 updates
   - SR-IOV RAS updates
   - VCN RAS support
   - SMU 13.x updates
   - Switch 1 element arrays to flexible arrays
   - Add RAS support for DF 4.3
   - Stack size improvements
   - S0ix rework
   - Allow 0 as a vram limit on APUs
   - Handle profiling modes for SMU13.x
   - Fix possible segfault in failure case
   - Rework FW requests to happen in early_init for all IPs so that we
     don't lose the sbios console if FW is missing
   - Fix power reporting on certain firmwares for CZN/RN
   - Allow S0ix without BIOS support
   - Enable freesync over PCon
   - Re-enable the AGP aperture on GMC 11.x

  amdkfd:
   - Error handling fixes
   - PASID fixes
   - Fix for cleared VRAM BOs
   - Fix cleanup if GPUVM creation fails
   - Memory accounting fix
   - Use resource_size rather than open codeing it
   - GC11 mGPU fix

  radeon:
   - Switch 1 element arrays to flexible arrays
   - Fix memory leak on shutdown
   - move to new logging

  i915:
   - Meteorlake display/OA/GSC fw/workarounds enabling
   - DP MST DSC support
   - Gamma/degamma readout support for the state checker
   - Enable SDP split support for DP 2.0
   - Add probe blocking support to i915.force_probe parameter
   - Enable Xe HP 4tile support
   - Avoid display direct calls to uncore
   - Fix HuC delayed load memory leaks
   - Add DG2 workarounds Wa_18018764978 and Wa_18019271663
   - Improve suspend / resume times with VT-d scanout workaround active
   - Fix DG2 visual corruption on small BAR systems by not forgetting to
     copy CCS aux state
   - Fix TLB invalidation for Gen12.50 video and compute engines
   - Enable HF-EEODB by switching HDMI, DP and LVDS to use struct
     drm_edid
   - Start using unversioned DMC firmware paths for new platforms
   - ELD refactor: Stop using hardware buffer, precompute ELD
   - lots of display code refactoring

  nouveau:
   - drop legacy ioctl support
   - replace 0-sized array

  msm:
   - dpu/dsi/mdss: Support for SM8350, SM8450 SM8550 and SC8280XP platform
   - Added bindings for SM8150
   - dpu: Partial support for DSC on SM8150 and SM8250
   - dpu: Fixed color transformation matrix being lost on suspend/resume
   - dp: Support SDM845 and SC8280XP platforms
   - dp: Support for limiting DP link rate via DT property
   - dsi: Validate display modes according to the DSI OPP table
   - dsi: DSI PHY support for the SM6375 platform
   - Add MSM_SUBMIT_BO_NO_IMPLICI
   - a2xx: Support to load legacy firmware
   - a6xx: GPU devcore dump updates for a650/a660
   - GPU devfreq tuning and fixes
   - Turn 8960 HDMI PHY into clock provider,
   - Make 8960 HDMI PHY use PXO clock from DT

  etnaviv:
   - experimental versilicon NPU support
   - report GPU load via fdinfo format
   - MMU fault message improvements

  tegra:
   - rework syncpoint interrupt

  mediatek:
   - DSI timing fix
   - fix config deps

  ast:
   - various fixes

  exynos:
   - restore bridge chain order fixes

  gud:
   - convert to shadow plane buffers
   - perform flushing synchronously during atomic update
   - Use new debugfs helpers

  arm/hdlcd:
   - Use new debugfs helper

  ili9486:
   - Support 16-bit pixel data

  imx:
   - Split off IPUv3 driver

  mipi-dbi:
   - convert to DRM shadow-plane helpers
   - rsp driver changes
   - Support separate I/O-voltage supply

  mxsfb:
   - Depend on ARCH_MXS or ARCH_MXC

  sun4i:
   - convert to new TV mode property

  vc4:
   - convert to new TV mode property
   - kunit tests
   - Support RGB565 and RGB666 formats
   - convert dsi driver to bridge
   - Various HVS an CRTC fixes

  v3d:
   - Do not opencode drm_gem_object_lookup()

  virtio:
   - improve tracing

  vkms:
   - support small cursors in IGT tests
   - Fix SEGFAULT from incorrect GEM-buffer mapping

  rcar-du:
   - fixes and improvements"

* tag 'drm-next-2023-02-23' of git://anongit.freedesktop.org/drm/drm: (1455 commits)
  msm/fbdev: fix unused variable warning with clang.
  drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini()
  dma-buf: make kobj_type structure constant
  drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
  drm/amd/display: disable SubVP + DRR to prevent underflow
  drm/amd/display: Fail atomic_check early on normalize_zpos error
  drm/amd/pm: avoid unaligned access warnings
  drm/amd/display: avoid unaligned access warnings
  drm/amd/display: Remove duplicate/repeating expressions
  drm/amd/display: Remove duplicate/repeating expression
  drm/amd/display: Make variables declaration inside ifdef guard
  drm/amd/display: Fix excess arguments on kernel-doc
  drm/amd/display: Add previously missing includes
  drm/amd/amdgpu: Add function prototypes to headers
  drm/amd/display: Add function prototypes to headers
  drm/amd/display: Turn global functions into static
  drm/amd/display: remove unused _calculate_degamma_curve function
  drm/amd/display: remove unused func declaration from resource headers
  drm/amd/display: unset initial value for tf since it's never used
  drm/amd/display: camel case cleanup in color_gamma file
  ...