iommu/tegra241-cmdqv: Fix error-interrupt races and VINTF lifecycle bugs

These fix a cluster of bugs reported by Sashiko during patch reviews. The patches are ordered roughly most-critical-first, so some later ones fix smaller pre-existing issues in the same functions that earlier patches touch.

Issues fixed:
- the error ISR racing VINTF (de)init and reading a NULL, freed, or not yet fully initialized slot
- the probe fallback dereferencing an smmu freed by devm_krealloc()
- a guest vSID programmed without validating its width or the device's Stream ID count
- VINTF0 leaked on an init-failure path
- error-map index/bounds handling and a VCMDQ base above the 48-bit limit
- the error ISR flooding the kernel log under repeated guest errors

False positives raised by Sashiko:
- a viommu outliving an SMMU unbind and touching freed memory on close: a physical IOMMU is not a pluggable device, so iommufd holds no reference on the one behind a viommu, and this teardown cannot arise.
- the ISR running after cmdqv is freed on probe failure: free_irq() runs first from tegra241_cmdqv_remove(), the devm device_remove action, which devres invokes before the cmdqv allocation is released.
- a guest never acking its VCMDQ error wedging the shared interrupt: the interrupt is edge-signaled per event, and the host ISR only snapshots the error map into the guest's bounded vEVENTQ, never depending on a guest-side GERRORN ack.
- the ISR accessing a de-assigned LVCMDQ page after a VINTF hw_init()
failure: the page remains a mapped MMIO region backed by empty registers, so reads are benign and writes are dropped.

In parallel to Shameer's Tegra241 CMDQV CMD_SYNC use-after-free fix:
https://lore.kernel.org/all/[email protected]/

This is on github:
https://github.com/nicolinc/iommufd/commits/fix_cmdqv_sashiko-v2

Changelog
v2
* Return -EOPNOTSUPP in tegra241_vintf_init_vsid
v1
https://lore.kernel.org/all/[email protected]/

Nicolin Chen (11):
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully
initialized
iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init iommu/tegra241-cmdqv: Harden error-map index handling in the error ISR iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up
vintfs
iommu/tegra241-cmdqv: Don't fall back to a freed smmu after
devm_krealloc()
iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path iommu/tegra241-cmdqv: Warn on a VCMDQ base above the 48-bit hardware
limit
iommu/tegra241-cmdqv: Rate-limit the error ISR's log message

 .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c    | 224 ++++++++++++------
 1 file changed, 156 insertions(+), 68 deletions(-)

2.43.0