[gearsyncd,macsec]: Deterministic MACsec backend selection for gearbox ports #3926
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
rajshekhar-nexthop
force-pushed
the
rajshekhar.macsec_gearbox
branch
from
ec74bde to
ca0690b
Compare
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
…csec_supported fix Why I did it On gearbox ports, creating MACsec on the PHY switch fails with SAI_STATUS_NOT_IMPLEMENTED if the gearbox PHY lacks a MACsec engine. A fix for this issue has already been committed. This PR aims to create the corresponding test case to validate that fix. How I did it Have added three testcases: - test_macsec_phy_switch_default: This tests the scenario when the macsec_supported field is absent in the gearbox_config.json - test_macsec_phy_switch_explicit: This tests the scenario when the macsec_supported field is set as true in the gearbox_config.json - test_macsec_npu_switch: This tests the scenario when the macsec_supported field is set as false in the gearbox_config.json Some helpers functions: - verify_macsec_in_asic_db: This verifies if the ASIC_DB has the required entries created or not. - verify_macsec_in_gb_asic_db: This verifies if the GB_ASIC_DB has the required entries created or not. - setup_gearbox_table: The job of this function is change the value of macsec_supported field. It modifies the value as per the requirement of the testcase. It writes the file gearbox_config.json - enable_macsec_on_port: Helper function to enable macsec. - cleanup_macsec: Helper function to delete macsec configuration.
rajshekhar-nexthop
force-pushed
the
rajshekhar.macsec_gearbox
branch
from
ca0690b to
aeca8bc
Compare
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What I did
Introduce a platform capability flag in the gearbox config to determine, per PHY, whether MACsec is supported (applies to all ports mapped to that PHY). MACsec orchestration will:
Have added three DVS testcases:
test_macsec_phy_switch_default: This tests the scenario when the macsec_supported field is absent in the gearbox_config.json
test_macsec_phy_switch_explicit: This tests the scenario when the macsec_supported field is set as true in the gearbox_config.json
test_macsec_npu_switch: This tests the scenario when the macsec_supported field is set as false in the gearbox_config.json
Why I did it
On gearbox ports, creating MACsec on the PHY switch fails (SAI_STATUS_NOT_IMPLEMENTED) if gearbox PHY does not have the MACsec engine.
How I verified it
Manually verified on DUT by adding macsec_supported=false in gearbox_config.json and configuring the macsec on the PHY port. Also ran the dvs testcase and made sure it is passing
sudo pytest -v tests/test_macsec_gearbox.pyDetails if related
HLD: sonic-net/SONiC#2072
gearbox_config.json changes are posted here: https://github.com/sonic-net/sonic-buildimage/pull/24169/files#diff-737ea59a7eba8ea0ed71a15a052868815f7faad351fd353736ad196932bed57a
Co-authored by @shreyansh-nexthop