Claude review: accel/neutron: Add job submission IOCTL

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Critical bug — NULL spinlock in `dma_fence_init`:**
```c
dma_fence_init(fence, &neutron_fence_ops, NULL,
	       ndev->fence_context, ++ndev->job_seqno);
```
`dma_fence_init` requires a non-NULL `spinlock_t *lock`. Every other accel driver passes a valid spinlock (ethosu uses `&dev->fence_lock`, rocket uses `&core->fence_lock`, etc.). Passing NULL will cause a NULL pointer dereference when `dma_fence_signal()` tries to acquire the lock. This is a crash bug. Add a spinlock to `struct neutron_device` and pass it here.

**`dma_fence_set_error` with raw hw error code:**
```c
if (state.err_code != 0) {
	dev_warn(ndev->dev, "Job finished with error: 0x%x\n",
		 state.err_code);
	dma_fence_set_error(fence, state.err_code);
}
```
`dma_fence_set_error()` expects a negative errno value (it has a `WARN_ON(error >= 0)` check). Passing a raw firmware error code (likely a positive value) will trigger a kernel warning. This needs to be mapped to a proper errno like `-EIO`.

**`job_seqno` incremented without locking:**
```c
ndev->fence_context, ++ndev->job_seqno);
```
`job_seqno` is incremented in `neutron_run_job` which runs in the scheduler workqueue. If there's only one scheduler with credit_limit=1, this is likely safe in practice, but it's still not obviously safe. Consider using `atomic64_inc_return`.

**`neutron_timedout_job` calls `drm_sched_start` with int 0 instead of bool:**
```c
drm_sched_start(&ndev->sched, 0);
```
Minor type issue; the function takes `bool full_recovery`. Should be `drm_sched_start(&ndev->sched, true)` if full recovery is intended.

**Missing validation of inference job offsets against BO size:**
```c
cmd.args[0] = job->inference.tensor_offset;
cmd.args[1] = job->inference.microcode_offset;
```
There's no validation that `tensor_offset` or `microcode_offset` are within the bounds of the associated BO. While the firmware presumably validates this, the kernel should perform bounds checking at submit time to avoid passing garbage to the device.

**`neutron_job_done_handler` called from threaded IRQ without job_lock initially:**
```c
neutron_mbox_read_state(ndev, &state);
if (state.status != NEUTRON_FW_STATUS_DONE) {
	...
	return neutron_job_err_handler(ndev);
}
neutron_mbox_reset_state(ndev);
```
The mbox reset and state read happen outside the `job_lock`, creating a potential race between the IRQ handler and the timeout handler, which both manipulate `active_job`.

---
Generated by Claude Code Patch Reviewer