Re: [PATCH ipsec 5/7] net/mlx5e: Use the packet sequence number for the IPsec IV

[Sabrina Dubroca <sd@queasysnail.net>]

2026-09-30, 14:45:22 +0000, Jérémy Jean wrote:
> mlx5e_ipsec_set_iv_esn() may decrement xo->seq.hi for a GSO skb based
> on the SA's current output counter. The metadata already contains the

And doing a check based on x->replay_esn->oseq, which may not match
the value for this packet, seems really weird.


> -	if (unlikely(skb_is_gso(skb) && oseq < MLX5E_IPSEC_ESN_SCOPE_MID &&
> -		     MLX5E_IPSEC_ESN_SCOPE_MID < (oseq - skb_shinfo(skb)->gso_segs))) {
> -		seq_hi = xo->seq.hi - 1;
> -	} else {
> -		seq_hi = xo->seq.hi;
> -	}

I guess this is trying to solve the same thing as 4b549ccce941 ("xfrm:
replay: Fix ESN wrap around for GSO")?


>  	/* Place the SN in the IV field */
> -	seqno = cpu_to_be64(xo->seq.low + ((u64)seq_hi << 32));
> +	seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));

This is starting to feel like we should have a helper to compose the
64b PN, and maybe give a name to the (low,hi) pair struct to pass it
to that helper.

-- 
Sabrina