tests/ocp/sriov: fix Mellanox CX6-DX switchdev and netdev-to-vfiopci test failures

Two bugs fixed for Mellanox ConnectX-6 DX (vendor 15b3) hardware running
in switchdev mode under OpenShift 4.19+:

1. sriovenv.go - verifySpoofCheck: replace MAC-based VF lookup with VF-line
   pattern matching. In switchdev mode, ip link show <PF> reports all VF
   MACs as 00:00:00:00:00:00 rather than the actual pod MAC, causing the
   spoof check verification to always fail. The fix scans any VF line for
   the expected spoof checking state instead of searching by MAC address.
   Also force eSwitchMode=legacy on SR-IOV policies to keep the test
   environment in a predictable state.

2. metricsExporter.go - runMetricsNettoVfioTests: add vendor-aware ICMP
   assertion for the Netdevice-to-Vfiopci test scenario. On Mellanox NICs,
   the vfiopci role uses netdevice+RDMA instead of vfio-pci, so the kernel
   network stack stays active and ICMP succeeds. On Intel NICs (true
   vfio-pci), the kernel has no VF access and ICMP fails. The fix asserts
   success for Mellanox (devID == MlxVendorID) and failure otherwise.

Tested on a cluster with wsfd-advnetlab244 (Mellanox CX6-DX, 15b3:101d):
all three Netdevice-to-Vfiopci cases (Same PF, Different PF, Different
Worker) now pass.

Made-with: Cursor

Author: zhiqiangf

tests/ocp/sriov/internal/sriovenv/sriovenv.go

@@ -248,6 +248,8 @@ func initVFWithDevType(name, deviceID, interfaceName, vendor, devType string, vf
 			policy.Definition.Spec.NicSelector.DeviceID = deviceID
 		}
 
+		policy.Definition.Spec.EswitchMode = "legacy"
+
 		if _, err := policy.Create(); err != nil {
 			klog.V(90).Infof("Failed to create policy on node %q: %v", nodeName, err)
 
@@ -632,7 +634,7 @@ func VerifyLinkStateConfiguration(networkName, namespace, description string,
 // ============================================================================
 
 func verifySpoofCheck(clientPod *pod.Builder, interfaceName, expectedState string) error {
-	// Get node name and MAC
+	// Get node name
 	refreshedPod, err := pod.Pull(APIClient, clientPod.Definition.Name, clientPod.Definition.Namespace)
 	if err != nil {
 		return fmt.Errorf("failed to refresh pod: %w", err)
@@ -643,11 +645,6 @@ func verifySpoofCheck(clientPod *pod.Builder, interfaceName, expectedState strin
 		return fmt.Errorf("pod node name is empty")
 	}
 
-	mac, err := ExtractPodInterfaceMAC(clientPod, "net1")
-	if err != nil {
-		return fmt.Errorf("failed to extract MAC: %w", err)
-	}
-
 	// Execute on node via cluster helper
 	outputMap, err := cluster.ExecCmdWithStdout(APIClient, fmt.Sprintf("ip link show %s", interfaceName),
 		metav1.ListOptions{LabelSelector: fmt.Sprintf("kubernetes.io/hostname=%s", nodeName)})
@@ -671,19 +668,33 @@ func verifySpoofCheck(clientPod *pod.Builder, interfaceName, expectedState strin
 		}
 	}
 
-	// Find line with MAC and check spoof state
+	// Search VF lines for the expected spoof check state.
+	// Note: In switchdev mode (e.g., Mellanox CX6-DX), `ip link show <PF>` reports VF MACs as
+	// 00:00:00:00:00:00 regardless of the MAC assigned inside the pod, so matching by MAC address
+	// is unreliable. Instead, we check any VF line for the expected state, since the SR-IOV policy
+	// applies a uniform spoof checking configuration to all VFs it creates.
+	vfLinesFound := 0
+
 	for _, line := range strings.Split(output, "\n") {
-		if strings.Contains(line, mac) {
-			if strings.Contains(line, fmt.Sprintf("spoof checking %s", expectedState)) ||
-				strings.Contains(line, fmt.Sprintf("spoofchk %s", expectedState)) {
-				klog.V(90).Infof("Spoof check verified: %s for MAC %s", expectedState, mac)
+		if !strings.Contains(line, "vf ") {
+			continue
+		}
 
-				return nil
-			}
+		vfLinesFound++
+
+		if strings.Contains(line, fmt.Sprintf("spoof checking %s", expectedState)) ||
+			strings.Contains(line, fmt.Sprintf("spoofchk %s", expectedState)) {
+			klog.V(90).Infof("Spoof check verified: %s on interface %s", expectedState, interfaceName)
+
+			return nil
 		}
 	}
 
-	return fmt.Errorf("spoof check %s not found for MAC %s", expectedState, mac)
+	if vfLinesFound == 0 {
+		return fmt.Errorf("no VF information found in ip link show output for interface %s", interfaceName)
+	}
+
+	return fmt.Errorf("spoof check %s not found for interface %s", expectedState, interfaceName)
 }
 
 // ============================================================================

tests/ocp/sriov/tests/metricsExporter.go

@@ -304,9 +304,21 @@ func runMetricsNettoVfioTests(clientPf, serverPf, clientWorker, serverWorker, de
 		"Failed to add server mac address in client pod mac table. Output: %s", outputbuf.String()))
 
 	By("ICMP check between client and server pods")
-	Eventually(func() error {
-		return sriovocpenv.ICMPConnectivityCheck(cPod, []string{tsparams.ServerIPv4IPAddress}, "net1")
-	}, 1*time.Minute, 2*time.Second).Should(HaveOccurred(), "ICMP fail scenario could not be executed")
+
+	// For Mellanox NICs, "vfiopci" mode uses netdevice+RDMA instead of vfio-pci (see defineMetricsPolicy).
+	// With netdevice+RDMA, the kernel network stack remains active on the VF alongside the DPDK mlx5 PMD,
+	// so the kernel still responds to ICMP. With true vfio-pci (Intel), the VF is exclusively owned by
+	// DPDK, the kernel has no access, and ICMP fails because testpmd does not respond to it.
+	if devID == tsparams.MlxVendorID {
+		Eventually(func() error {
+			return sriovocpenv.ICMPConnectivityCheck(cPod, []string{tsparams.ServerIPv4IPAddress}, "net1")
+		}, 1*time.Minute, 2*time.Second).ShouldNot(HaveOccurred(),
+			"ICMP connectivity check failed for Mellanox netdevice+RDMA server")
+	} else {
+		Eventually(func() error {
+			return sriovocpenv.ICMPConnectivityCheck(cPod, []string{tsparams.ServerIPv4IPAddress}, "net1")
+		}, 1*time.Minute, 2*time.Second).Should(HaveOccurred(), "ICMP fail scenario could not be executed")
+	}
 
 	checkMetricsWithPromQL()
 }