Re: [PATCH ipsec 5/7] net/mlx5e: Use the packet sequence number for the IPsec IV

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-10-01 13:42, Sabrina Dubroca wrote:
> 2026-09-30, 14:45:22 +0000, Jérémy Jean wrote:
>> mlx5e_ipsec_set_iv_esn() may decrement xo->seq.hi for a GSO skb based
>> on the SA's current output counter. The metadata already contains the
> 
> And doing a check based on x->replay_esn->oseq, which may not match
> the value for this packet, seems really weird.
> 
> 
>> -	if (unlikely(skb_is_gso(skb) && oseq < MLX5E_IPSEC_ESN_SCOPE_MID &&
>> -		     MLX5E_IPSEC_ESN_SCOPE_MID < (oseq - 
>> skb_shinfo(skb)->gso_segs))) {
>> -		seq_hi = xo->seq.hi - 1;
>> -	} else {
>> -		seq_hi = xo->seq.hi;
>> -	}
> 
> I guess this is trying to solve the same thing as 4b549ccce941 ("xfrm:
> replay: Fix ESN wrap around for GSO")?

Yes, it seems so.

FWIW, another related commit to this fix is c05c5e5aa163 ("xfrm: replay:
Fix the update of replay_esn->oseq_hi for GSO").

>>  	/* Place the SN in the IV field */
>> -	seqno = cpu_to_be64(xo->seq.low + ((u64)seq_hi << 32));
>> +	seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));
> 
> This is starting to feel like we should have a helper to compose the
> 64b PN, and maybe give a name to the (low,hi) pair struct to pass it
> to that helper.

I don't have a strong opinion about this, but I'd say introducung a 
helper
to replace a oneliner is maybe not required?

Jérémy