[gearsyncd,macsec]: Deterministic MACsec backend selection for gearbox ports by rajshekhar-nexthop · Pull Request #3926 · sonic-net/sonic-swss

rajshekhar-nexthop · 2025-10-09T07:02:32Z

What I did
Introduce a platform capability flag in the gearbox config to determine, per PHY, whether MACsec is supported (applies to all ports mapped to that PHY). MACsec orchestration will:

Use PHY switch by default on gearbox ports
Use NPU/global switch only when the platform marks the PHY as not supporting MACsec

Have added three DVS testcases:

test_macsec_phy_switch_default: This tests the scenario when the macsec_supported field is absent in the gearbox_config.json
test_macsec_phy_switch_explicit: This tests the scenario when the macsec_supported field is set as true in the gearbox_config.json
test_macsec_npu_switch: This tests the scenario when the macsec_supported field is set as false in the gearbox_config.json

Why I did it
On gearbox ports, creating MACsec on the PHY switch fails (SAI_STATUS_NOT_IMPLEMENTED) if gearbox PHY does not have the MACsec engine.

How I verified it
Manually verified on DUT by adding macsec_supported=false in gearbox_config.json and configuring the macsec on the PHY port. Also ran the dvs testcase and made sure it is passing sudo pytest -v tests/test_macsec_gearbox.py

Details if related
HLD: sonic-net/SONiC#2072
gearbox_config.json changes are posted here: https://github.com/sonic-net/sonic-buildimage/pull/24169/files#diff-737ea59a7eba8ea0ed71a15a052868815f7faad351fd353736ad196932bed57a

Co-authored by @shreyansh-nexthop

mssonicbld · 2025-10-09T07:02:40Z

/azp run

azure-pipelines · 2025-10-09T07:03:07Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-10-09T07:03:10Z

/azp run

azure-pipelines · 2025-10-09T07:03:21Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-11-03T17:21:32Z

/azp run

azure-pipelines · 2025-11-03T17:21:43Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-11-03T17:27:15Z

/azp run

azure-pipelines · 2025-11-03T17:27:26Z

Azure Pipelines successfully started running 1 pipeline(s).

arista-nwolfe

Change LGTM, tested this against an Arista SKU which also has gearboxes that don't support macsec and the SAI call went to ASIC_DB as expected
sonic-net/sonic-buildimage#24761

tests/test_macsec_gearbox.py

judyjoseph

LGTM

judyjoseph · 2025-12-17T07:26:43Z

/azp run

azure-pipelines · 2025-12-17T07:26:53Z

Azure Pipelines successfully started running 1 pipeline(s).

rajshekhar-nexthop · 2025-12-17T07:39:34Z

Change LGTM, tested this against an Arista SKU which also has gearboxes that don't support macsec and the SAI call went to ASIC_DB as expected sonic-net/sonic-buildimage#24761

Thank you, @arista-nwolfe, for testing and validating the changes on the Arista SKU.

mssonicbld · 2025-12-17T12:26:00Z

/azp run

azure-pipelines · 2025-12-17T12:26:11Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: rajshekhar <[email protected]>

…csec_supported fix Why I did it On gearbox ports, creating MACsec on the PHY switch fails with SAI_STATUS_NOT_IMPLEMENTED if the gearbox PHY lacks a MACsec engine. A fix for this issue has already been committed. This PR aims to create the corresponding test case to validate that fix. How I did it Have added three testcases: - test_macsec_phy_switch_default: This tests the scenario when the macsec_supported field is absent in the gearbox_config.json - test_macsec_phy_switch_explicit: This tests the scenario when the macsec_supported field is set as true in the gearbox_config.json - test_macsec_npu_switch: This tests the scenario when the macsec_supported field is set as false in the gearbox_config.json Some helpers functions: - verify_macsec_in_asic_db: This verifies if the ASIC_DB has the required entries created or not. - verify_macsec_in_gb_asic_db: This verifies if the GB_ASIC_DB has the required entries created or not. - setup_gearbox_table: The job of this function is change the value of macsec_supported field. It modifies the value as per the requirement of the testcase. It writes the file gearbox_config.json - enable_macsec_on_port: Helper function to enable macsec. - cleanup_macsec: Helper function to delete macsec configuration. Signed-off-by: rajshekhar <[email protected]>

mssonicbld · 2025-12-17T13:09:49Z

/azp run

rajshekhar-nexthop · 2025-12-17T13:11:49Z

Hi @prsunny ,
Please enable workflows awaiting approval. Thanks

mssonicbld · 2025-12-18T18:31:35Z

/azp run

azure-pipelines · 2025-12-18T18:31:47Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-12-19T21:37:04Z

/azp run

azure-pipelines · 2025-12-19T21:37:15Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-01-06T03:58:28Z

/azp run

azure-pipelines · 2026-01-06T03:58:37Z

Azure Pipelines successfully started running 1 pipeline(s).

rajshekhar-nexthop · 2026-01-06T04:04:28Z

Hi @prsunny ,
Please check and merge this PR. Thank you

mssonicbld · 2026-01-12T19:55:35Z

Cherry-pick PR to 202511: #4126

…x ports (sonic-net#3926) What I did Introduce a platform capability flag in the gearbox config to determine, per PHY, whether MACsec is supported (applies to all ports mapped to that PHY). MACsec orchestration will: Use PHY switch by default on gearbox ports Use NPU/global switch only when the platform marks the PHY as not supporting MACsec Why I did it On gearbox ports, creating MACsec on the PHY switch fails (SAI_STATUS_NOT_IMPLEMENTED) if gearbox PHY does not have the MACsec engine.

This change is dependent on sonic-net/sonic-swss#3926 merging first. Signed-off-by: Nathan Wolfe <[email protected]>

…x ports (sonic-net#3926) What I did Introduce a platform capability flag in the gearbox config to determine, per PHY, whether MACsec is supported (applies to all ports mapped to that PHY). MACsec orchestration will: Use PHY switch by default on gearbox ports Use NPU/global switch only when the platform marks the PHY as not supporting MACsec Why I did it On gearbox ports, creating MACsec on the PHY switch fails (SAI_STATUS_NOT_IMPLEMENTED) if gearbox PHY does not have the MACsec engine. Signed-off-by: ganglyu <[email protected]>

…x ports (sonic-net#3926) What I did Introduce a platform capability flag in the gearbox config to determine, per PHY, whether MACsec is supported (applies to all ports mapped to that PHY). MACsec orchestration will: Use PHY switch by default on gearbox ports Use NPU/global switch only when the platform marks the PHY as not supporting MACsec Why I did it On gearbox ports, creating MACsec on the PHY switch fails (SAI_STATUS_NOT_IMPLEMENTED) if gearbox PHY does not have the MACsec engine. Signed-off-by: Baorong Liu <[email protected]>

sonic-net/sonic-swss#3926 introduces the ability to indicate whether a gearbox phy supports macsec or not. This allows the macsecorch to send the macsec SAI calls to the switching asic (syncd) instead of the gearbox phy (gbsyncd). arista_7280r4(k)_32qf_32df is a platform that has this same behavior (GB doesn't support macsec). The parent PR for this SKU is #24206 Signed-off-by: Nathan Wolfe <[email protected]> Co-authored-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]>

This change depends on sonic-net/sonic-swss#3926 merging first. sonic-net/sonic-swss#3926 introduces the ability to indicate whether a gearbox phy supports macsec or not. This allows the macsecorch to send the macsec SAI calls to the switching asic (syncd) instead of the gearbox phy (gbsyncd). `arista_7280r4(k)_32qf_32df` is a platform that has this same behavior (GB doesn't support macsec). The parent PR for this SKU is sonic-net#24206 #### Which release branch to backport (provide reason below if selected)  - [ ] 202205 - [ ] 202211 - [ ] 202305 - [ ] 202311 - [ ] 202405 - [ ] 202411 - [ ] 202505 - [x] 202511 Signed-off-by: Sonic Build Admin <[email protected]>

sonic-net/sonic-swss#3926 introduces the ability to indicate whether a gearbox phy supports macsec or not. This allows the macsecorch to send the macsec SAI calls to the switching asic (syncd) instead of the gearbox phy (gbsyncd). arista_7280r4(k)_32qf_32df is a platform that has this same behavior (GB doesn't support macsec). The parent PR for this SKU is sonic-net#24206 Signed-off-by: Nathan Wolfe <[email protected]> Co-authored-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]> Signed-off-by: jackson <[email protected]>

…#25960) This change depends on sonic-net/sonic-swss#3926 merging first. sonic-net/sonic-swss#3926 introduces the ability to indicate whether a gearbox phy supports macsec or not. This allows the macsecorch to send the macsec SAI calls to the switching asic (syncd) instead of the gearbox phy (gbsyncd). `arista_7280r4(k)_32qf_32df` is a platform that has this same behavior (GB doesn't support macsec). The parent PR for this SKU is #24206 #### Which release branch to backport (provide reason below if selected)  - [ ] 202205 - [ ] 202211 - [ ] 202305 - [ ] 202311 - [ ] 202405 - [ ] 202411 - [ ] 202505 - [x] 202511 Signed-off-by: Sonic Build Admin <[email protected]>

rajshekhar-nexthop requested a review from prsunny as a code owner October 9, 2025 07:02

rajshekhar-nexthop mentioned this pull request Oct 9, 2025

HLD - Deterministic MACsec backend selection for gearbox ports sonic-net/SONiC#2072

Open

rajshekhar-nexthop force-pushed the rajshekhar.macsec_gearbox branch from ec74bde to ca0690b Compare November 3, 2025 17:21

rajshekhar-nexthop force-pushed the rajshekhar.macsec_gearbox branch from ca0690b to aeca8bc Compare November 3, 2025 17:27

eswaran-nexthop added this to SONiC Chassis Nov 11, 2025

tjchadaga requested a review from judyjoseph November 21, 2025 20:52

rlhui requested a review from prgeor December 3, 2025 17:56

arista-nwolfe mentioned this pull request Dec 5, 2025

Disabling macsec support on arista_7280r4(k)_32qf_32df gearbox phys sonic-net/sonic-buildimage#24761

Merged

8 tasks

arista-nwolfe approved these changes Dec 5, 2025

View reviewed changes

judyjoseph reviewed Dec 10, 2025

View reviewed changes

tests/test_macsec_gearbox.py Show resolved Hide resolved

tjchadaga added the Request for 202511 Branch label Dec 10, 2025

judyjoseph approved these changes Dec 17, 2025

View reviewed changes

rajshekhar-nexthop added 2 commits December 17, 2025 13:08

Deterministic MACsec backend selection for gearbox ports

f0f53d3

Signed-off-by: rajshekhar <[email protected]>

rajshekhar-nexthop force-pushed the rajshekhar.macsec_gearbox branch from e5de6d2 to 0e5f3bf Compare December 17, 2025 13:09

Merge branch 'master' into rajshekhar.macsec_gearbox

1c5fe4d

Merge branch 'master' into rajshekhar.macsec_gearbox

07963d4

Merge branch 'master' into rajshekhar.macsec_gearbox

adc65ec

prsunny merged commit 0e233d1 into sonic-net:master Jan 6, 2026
16 checks passed

github-project-automation bot moved this to Done in SONiC Chassis Jan 6, 2026

vmittal-msft added the Approved for 202511 Branch label Jan 12, 2026

mssonicbld mentioned this pull request Jan 12, 2026

[action] [PR:3926] [gearsyncd,macsec]: Deterministic MACsec backend selection for gearbox ports #4126

Merged

mssonicbld added the Created PR to 202511 Branch label Jan 12, 2026

mssonicbld added Included in 202511 Branch and removed Created PR to 202511 Branch labels Jan 12, 2026

arista-nwolfe added a commit to arista-nwolfe/sonic-buildimage that referenced this pull request Jan 23, 2026

Disabling macsec support on Citrine gearbox phys

e3ba64b

This change is dependent on sonic-net/sonic-swss#3926 merging first. Signed-off-by: Nathan Wolfe <[email protected]>

shreyansh-nexthop mentioned this pull request Feb 3, 2026

Added a new testcase for macsec_gearbox #4182

Open

1 task

mssonicbld mentioned this pull request Mar 8, 2026

[action] [PR:24761] Disabling macsec support on arista_7280r4(k)_32qf_32df gearbox phys sonic-net/sonic-buildimage#25960

Merged

8 tasks

Conversation

rajshekhar-nexthop commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mssonicbld commented Oct 9, 2025

Uh oh!

azure-pipelines bot commented Oct 9, 2025

Uh oh!

mssonicbld commented Oct 9, 2025

Uh oh!

azure-pipelines bot commented Oct 9, 2025

Uh oh!

mssonicbld commented Nov 3, 2025

Uh oh!

azure-pipelines bot commented Nov 3, 2025

Uh oh!

mssonicbld commented Nov 3, 2025

Uh oh!

azure-pipelines bot commented Nov 3, 2025

Uh oh!

arista-nwolfe left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

judyjoseph left a comment

Choose a reason for hiding this comment

Uh oh!

judyjoseph commented Dec 17, 2025

Uh oh!

azure-pipelines bot commented Dec 17, 2025

Uh oh!

rajshekhar-nexthop commented Dec 17, 2025

Uh oh!

mssonicbld commented Dec 17, 2025

Uh oh!

azure-pipelines bot commented Dec 17, 2025

Uh oh!

mssonicbld commented Dec 17, 2025

Uh oh!

rajshekhar-nexthop commented Dec 17, 2025

Uh oh!

mssonicbld commented Dec 18, 2025

Uh oh!

azure-pipelines bot commented Dec 18, 2025

Uh oh!

mssonicbld commented Dec 19, 2025

Uh oh!

azure-pipelines bot commented Dec 19, 2025

Uh oh!

mssonicbld commented Jan 6, 2026

Uh oh!

azure-pipelines bot commented Jan 6, 2026

Uh oh!

rajshekhar-nexthop commented Jan 6, 2026

Uh oh!

Uh oh!

mssonicbld commented Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

rajshekhar-nexthop commented Oct 9, 2025 •

edited

Loading