diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 33c96db..dc49fc8 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -339,7 +339,7 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs)
 	struct bonding *bond = netdev_priv(bond_dev);
 	struct slave *slave = rtnl_dereference(bond->curr_active_slave);
 
-	xs->xso.slave_dev = slave->dev;
+	xs->xso.real_dev = slave->dev;
 	bond->xs = xs;
 
 	if (!(slave->dev->xfrmdev_ops
@@ -364,7 +364,7 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs)
 	if (!slave)
 		return;
 
-	xs->xso.slave_dev = slave->dev;
+	xs->xso.real_dev = slave->dev;
 
 	if (!(slave->dev->xfrmdev_ops
 	      && slave->dev->xfrmdev_ops->xdo_dev_state_delete)) {
@@ -396,7 +396,7 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)
 		return false;
 	}
 
-	xs->xso.slave_dev = slave_dev;
+	xs->xso.real_dev = slave_dev;
 	return slave_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index ad17c2c..5b95a34 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -427,14 +427,11 @@ static struct xfrm_state *ixgbe_ipsec_find_rx_state(struct ixgbe_ipsec *ipsec,
 static int ixgbe_ipsec_parse_proto_keys(struct xfrm_state *xs,
 					u32 *mykey, u32 *mysalt)
 {
-	struct net_device *dev = xs->xso.dev;
+	struct net_device *dev = xs->xso.real_dev;
 	unsigned char *key_data;
 	char *alg_name = NULL;
 	int key_len;
 
-	if (xs->xso.slave_dev)
-		dev = xs->xso.slave_dev;
-
 	if (!xs->aead) {
 		netdev_err(dev, "Unsupported IPsec algorithm\n");
 		return -EINVAL;
@@ -480,9 +477,9 @@ static int ixgbe_ipsec_parse_proto_keys(struct xfrm_state *xs,
  **/
 static int ixgbe_ipsec_check_mgmt_ip(struct xfrm_state *xs)
 {
-	struct net_device *dev = xs->xso.dev;
-	struct ixgbe_adapter *adapter;
-	struct ixgbe_hw *hw;
+	struct net_device *dev = xs->xso.real_dev;
+	struct ixgbe_adapter *adapter = netdev_priv(dev);
+	struct ixgbe_hw *hw = &adapter->hw;
 	u32 mfval, manc, reg;
 	int num_filters = 4;
 	bool manc_ipv4;
@@ -500,12 +497,6 @@ static int ixgbe_ipsec_check_mgmt_ip(struct xfrm_state *xs)
 #define BMCIP_V6                 0x3
 #define BMCIP_MASK               0x3
 
-	if (xs->xso.slave_dev)
-		dev = xs->xso.slave_dev;
-
-	adapter = netdev_priv(dev);
-	hw = &adapter->hw;
-
 	manc = IXGBE_READ_REG(hw, IXGBE_MANC);
 	manc_ipv4 = !!(manc & MANC_EN_IPV4_FILTER);
 	mfval = IXGBE_READ_REG(hw, IXGBE_MFVAL);
@@ -569,22 +560,15 @@ static int ixgbe_ipsec_check_mgmt_ip(struct xfrm_state *xs)
  **/
 static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
 {
-	struct net_device *dev = xs->xso.dev;
-	struct ixgbe_adapter *adapter;
-	struct ixgbe_ipsec *ipsec;
-	struct ixgbe_hw *hw;
+	struct net_device *dev = xs->xso.real_dev;
+	struct ixgbe_adapter *adapter = netdev_priv(dev);
+	struct ixgbe_ipsec *ipsec = adapter->ipsec;
+	struct ixgbe_hw *hw = &adapter->hw;
 	int checked, match, first;
 	u16 sa_idx;
 	int ret;
 	int i;
 
-	if (xs->xso.slave_dev)
-		dev = xs->xso.slave_dev;
-
-	adapter = netdev_priv(dev);
-	ipsec = adapter->ipsec;
-	hw = &adapter->hw;
-
 	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
 		netdev_err(dev, "Unsupported protocol 0x%04x for ipsec offload\n",
 			   xs->id.proto);
@@ -766,20 +750,13 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
  **/
 static void ixgbe_ipsec_del_sa(struct xfrm_state *xs)
 {
-	struct net_device *dev = xs->xso.dev;
-	struct ixgbe_adapter *adapter;
-	struct ixgbe_ipsec *ipsec;
-	struct ixgbe_hw *hw;
+	struct net_device *dev = xs->xso.real_dev;
+	struct ixgbe_adapter *adapter = netdev_priv(dev);
+	struct ixgbe_ipsec *ipsec = adapter->ipsec;
+	struct ixgbe_hw *hw = &adapter->hw;
 	u32 zerobuf[4] = {0, 0, 0, 0};
 	u16 sa_idx;
 
-	if (xs->xso.slave_dev)
-		dev = xs->xso.slave_dev;
-
-	adapter = netdev_priv(dev);
-	ipsec = adapter->ipsec;
-	hw = &adapter->hw;
-
 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
 		struct rx_sa *rsa;
 		u8 ipi;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index 29ed227..b45ba45 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -212,12 +212,9 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry)
 
 static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
 {
-	struct net_device *netdev = x->xso.dev;
+	struct net_device *netdev = x->xso.real_dev;
 	struct mlx5e_priv *priv;
 
-	if (x->xso.slave_dev)
-		netdev = x->xso.slave_dev;
-
 	priv = netdev_priv(netdev);
 
 	if (x->props.aalgo != SADB_AALG_NONE) {
@@ -293,15 +290,12 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
 static int mlx5e_xfrm_add_state(struct xfrm_state *x)
 {
 	struct mlx5e_ipsec_sa_entry *sa_entry = NULL;
-	struct net_device *netdev = x->xso.dev;
+	struct net_device *netdev = x->xso.real_dev;
 	struct mlx5_accel_esp_xfrm_attrs attrs;
 	struct mlx5e_priv *priv;
 	unsigned int sa_handle;
 	int err;
 
-	if (x->xso.slave_dev)
-		netdev = x->xso.slave_dev;
-
 	priv = netdev_priv(netdev);
 
 	err = mlx5e_xfrm_validate_state(x);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index ff2aa14..e09ffbf 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -127,7 +127,7 @@ struct xfrm_state_walk {
 
 struct xfrm_state_offload {
 	struct net_device	*dev;
-	struct net_device	*slave_dev;
+	struct net_device	*real_dev;
 	unsigned long		offload_handle;
 	unsigned int		num_exthdrs;
 	u8			flags;
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 81db1d7..74541ed 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -94,8 +94,8 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
 	if (xo->flags & XFRM_GRO || x->xso.flags & XFRM_OFFLOAD_INBOUND)
 		return skb;
 
-	/* This skb was already validated on the master dev */
-	if ((x->xso.dev != dev) && (x->xso.slave_dev == dev))
+	/* This skb was already validated on the upper/virtual dev */
+	if ((x->xso.dev != dev) && (x->xso.real_dev == dev))
 		return skb;
 
 	local_irq_save(flags);
@@ -242,6 +242,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
 	}
 
 	xso->dev = dev;
+	xso->real_dev = dev;
 	xso->num_exthdrs = 1;
 	xso->flags = xuo->flags;
 
