Claude review: drm/v3d: Ensure atomic submissions in v3d_submit_jobs()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

The key correctness fix. Restructures `v3d_submit_jobs()` into three phases:
1. **Arm** all jobs (`drm_sched_job_arm()`)
2. **Wire dependencies** between consecutive jobs
3. **Push** all jobs to the scheduler

If phase 2 fails, all armed jobs get their finished fence marked with an error and are pushed anyway. The `run_job()` callbacks (BIN, RENDER, TFU, CSD, CPU, CACHE_CLEAN) all check `s_fence->finished.error` and skip execution.

This patch also adds the error check to `v3d_cpu_job_run()` and `v3d_cache_clean_job_run()`, which previously lacked it (the other queue types already had it from patch 2's pre-existing code).

**One observation about the error path**: On failure, `v3d_submit_jobs()` calls `v3d_submit_unlock_reservations()` but does *not* call `v3d_submit_attach_object_fences()`. This means on error, the BOs' reservation objects don't get the errored fence attached. This is correct — on error, the caller returns the error to userspace, and the errored jobs will complete via the scheduler without touching hardware. No BO fences are needed.

**Error path cleanup in callers**: The callers now handle `v3d_submit_jobs()` failure differently than other failures:
```c
ret = v3d_submit_jobs(&submit);
if (ret) {
    v3d_submit_put_jobs(&submit);
    v3d_submit_put_post_deps(sync_out, &se);
    return ret;
}
```
This is because after `v3d_submit_jobs()` (even on error), the jobs have been armed+pushed and are now owned by the scheduler. The caller uses `v3d_submit_put_jobs()` (kref_put) instead of `v3d_submit_cleanup_jobs()` (drm_sched_job_cleanup + kfree). This is correct.

**Potential concern**: The `v3d_submit_cpu_ioctl()` error-after-submit path does:
```c
if (ret) {
    v3d_submit_put_jobs(&submit);
    v3d_submit_put_post_deps(NULL, &se);
    return ret;
}
```
This skips the `kvfree(cpu_job->timestamp_query.queries)` and `kvfree(cpu_job->performance_query.queries)` cleanup that happens in the `fail:` label. However, since the jobs are now scheduler-owned and will be freed through the scheduler's cleanup path (via `v3d_job_free`), those allocations should be freed when the job's kref drops to zero. I'd verify that `v3d_job_free()` (the `free` callback) handles freeing these sub-allocations. If it does, this is correct. If not, this would be a memory leak on this specific error path.

Overall, this is a solid and well-organized series. The bounds check in `v3d_submit_add_job()` is the main thing I'd want added before merging.

---
Generated by Claude Code Patch Reviewer