ice: Protect the PF mailbox from flooding VFsHEADmain

Wire the shared code mailbox-overflow detector into the VF lifecycle and
virtchnl dispatcher.  E830 controllers use their per-VF hardware
in-flight-message watermark.  On older controllers, attribute a
congested mailbox snapshot to its sender, reset it with its queues
disabled, and discard its subsequent requests.  Advance snapshot
accounting even for discarded requests.  A physical VFLR, PF reset, or
IOV recreation releases the VF.  A blocked VF can still submit mailbox
messages after reset, so discarding requests does not stop it from
replenishing the shared queue.

Process at most one initially full mailbox immediately.  If producers
keep it nonempty, mask only the mailbox interrupt cause and let the
periodic admin timer schedule bounded drain work.  Keep the shared admin
vector enabled so that OICR and other control-queue events can still be
serviced.  Re-enable the mailbox cause after draining and recheck the
queue head for arrivals while the cause was masked.  Retry failed reads
through the same deferred path instead of treating them as an empty queue.

Document both protection models and add failure-injection points for the
isolation and scheduling paths.

E810-XXV tests with two host-attached iavf VFs injected overflow on VF 0,
disabling only that VF while VF 1 completed 60 of 60 pings.  A physical
VFLR and a PF reset each released VF 0; IOV recreation also reset its
cumulative count.  Forced persistent mailbox-pending state produced 20
admin and control-queue passes in five seconds, remained timer-paced,
and did not interrupt sibling traffic.

MFC after:	2 weeks
Sponsored by:	BBOX.io
Differential Revision:	https://reviews.freebsd.org/D59029

0 files changed, 0 insertions, 0 deletions