diff --git a/.ci/linux-build.sh b/.ci/linux-build.sh

index 3e5136fd4e..dd29a4182d 100755

--- a/.ci/linux-build.sh

+++ b/.ci/linux-build.sh

@@ -235,7 +235,7 @@ if [ "$TESTSUITE" ]; then

     configure_ovs

     export DISTCHECK_CONFIGURE_FLAGS="$OPTS"

-    if ! make distcheck CFLAGS="${CFLAGS_FOR_OVS}" \

+    if ! make distcheck -j4 CFLAGS="${CFLAGS_FOR_OVS}" \

          TESTSUITEFLAGS=-j4 RECHECK=yes; then

         # testsuite.log is necessary for debugging.

         cat */_build/sub/tests/testsuite.log

diff --git a/Documentation/topics/dpdk/pmd.rst b/Documentation/topics/dpdk/pmd.rst

index caa7d97bef..e481e79414 100644

--- a/Documentation/topics/dpdk/pmd.rst

+++ b/Documentation/topics/dpdk/pmd.rst

@@ -239,7 +239,9 @@ If not set, the default variance improvement threshold is 25%.

     PMD Auto Load Balancing doesn't currently work if queues are assigned

     cross NUMA as actual processing load could get worse after assignment

-    as compared to what dry run predicts.

+    as compared to what dry run predicts. The only exception is when all

+    PMD threads are running on cores from a single NUMA node.  In this case

+    Auto Load Balancing is still possible.

 The minimum time between 2 consecutive PMD auto load balancing iterations can

 also be configured by::

diff --git a/Documentation/topics/dpdk/qos.rst b/Documentation/topics/dpdk/qos.rst

index 103495415a..a98ec672fc 100644

--- a/Documentation/topics/dpdk/qos.rst

+++ b/Documentation/topics/dpdk/qos.rst

@@ -69,22 +69,24 @@ to prioritize certain traffic over others at a port level.

 For example, the following configuration will limit the traffic rate at a

 port level to a maximum of 2000 packets a second (64 bytes IPv4 packets).

-100pps as CIR (Committed Information Rate) and 1000pps as EIR (Excess

-Information Rate). High priority traffic is routed to queue 10, which marks

+1000pps as CIR (Committed Information Rate) and 1000pps as EIR (Excess

+Information Rate). CIR and EIR are measured in bytes without Ethernet header.

+As a result, 1000pps means (64-byte - 14-byte) * 1000 = 50,000 in the

+configuration below. High priority traffic is routed to queue 10, which marks

 all traffic as CIR, i.e. Green. All low priority traffic, queue 20, is

 marked as EIR, i.e. Yellow::

     $ ovs-vsctl --timeout=5 set port dpdk1 qos=@myqos -- \

         --id=@myqos create qos type=trtcm-policer \

-        other-config:cir=52000 other-config:cbs=2048 \

-        other-config:eir=52000 other-config:ebs=2048  \

+        other-config:cir=50000 other-config:cbs=2048 \

+        other-config:eir=50000 other-config:ebs=2048  \

         queues:10=@dpdk1Q10 queues:20=@dpdk1Q20 -- \

          --id=@dpdk1Q10 create queue \

-          other-config:cir=41600000 other-config:cbs=2048 \

+          other-config:cir=100000 other-config:cbs=2048 \

           other-config:eir=0 other-config:ebs=0 -- \

          --id=@dpdk1Q20 create queue \

            other-config:cir=0 other-config:cbs=0 \

-           other-config:eir=41600000 other-config:ebs=2048 \

+           other-config:eir=50000 other-config:ebs=2048

 This configuration accomplishes that the high priority traffic has a

 guaranteed bandwidth egressing the ports at CIR (1000pps), but it can also

diff --git a/NEWS b/NEWS

index bc901efdb1..036d4032c4 100644

--- a/NEWS

+++ b/NEWS

@@ -1,3 +1,11 @@

+v2.15.1 - xx xxx xxxx

+---------------------

+   - ovs-ctl:

+     * New option '--no-record-hostname' to disable hostname configuration

+       in ovsdb on startup.

+     * New command 'record-hostname-if-not-set' to update hostname in ovsdb.

+

+

 v2.15.0 - 15 Feb 2021

 ---------------------

    - OVSDB:

diff --git a/acinclude.m4 b/acinclude.m4

index 435685c93d..15a54d636f 100644

--- a/acinclude.m4

+++ b/acinclude.m4

@@ -209,10 +209,10 @@ dnl Configure Linux tc compat.

 AC_DEFUN([OVS_CHECK_LINUX_TC], [

   AC_COMPILE_IFELSE([

     AC_LANG_PROGRAM([#include <linux/pkt_cls.h>], [

-        int x = TCA_ACT_FLAGS;

+        int x = TCA_FLOWER_KEY_CT_FLAGS_REPLY;

     ])],

-    [AC_DEFINE([HAVE_TCA_ACT_FLAGS], [1],

-               [Define to 1 if TCA_ACT_FLAGS is available.])])

+    [AC_DEFINE([HAVE_TCA_FLOWER_KEY_CT_FLAGS_REPLY], [1],

+               [Define to 1 if TCA_FLOWER_KEY_CT_FLAGS_REPLY is available.])])

   AC_CHECK_MEMBERS([struct tcf_t.firstuse], [], [], [#include <linux/pkt_cls.h>])

diff --git a/configure.ac b/configure.ac

index fd82d7d270..9299342960 100644

--- a/configure.ac

+++ b/configure.ac

@@ -13,7 +13,7 @@

 # limitations under the License.

 AC_PREREQ(2.63)

-AC_INIT(openvswitch, 2.15.0, bugs@openvswitch.org)

+AC_INIT(openvswitch, 2.15.1, bugs@openvswitch.org)

 AC_CONFIG_SRCDIR([datapath/datapath.c])

 AC_CONFIG_MACRO_DIR([m4])

 AC_CONFIG_AUX_DIR([build-aux])

diff --git a/debian/changelog b/debian/changelog

index 1f2b7a3668..8b5d075840 100644

--- a/debian/changelog

+++ b/debian/changelog

@@ -1,3 +1,9 @@

+openvswitch (2.15.1-1) unstable; urgency=low

+   [ Open vSwitch team ]

+   * New upstream version

+

+ -- Open vSwitch team <dev@openvswitch.org>  Mon, 15 Feb 2021 17:35:33 +0100

+

 openvswitch (2.15.0-1) unstable; urgency=low

    * New upstream version

diff --git a/include/linux/pkt_cls.h b/include/linux/pkt_cls.h

index b0a5ce8bec..bc51a5767f 100644

--- a/include/linux/pkt_cls.h

+++ b/include/linux/pkt_cls.h

@@ -1,7 +1,7 @@

 #ifndef __LINUX_PKT_CLS_WRAPPER_H

 #define __LINUX_PKT_CLS_WRAPPER_H 1

-#if defined(__KERNEL__) || defined(HAVE_TCA_ACT_FLAGS)

+#if defined(__KERNEL__) || defined(HAVE_TCA_FLOWER_KEY_CT_FLAGS_REPLY)

 #include_next <linux/pkt_cls.h>

 #else

@@ -255,6 +255,9 @@ enum {

 	TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED = 1 << 1, /* Part of an existing connection. */

 	TCA_FLOWER_KEY_CT_FLAGS_RELATED = 1 << 2, /* Related to an established connection. */

 	TCA_FLOWER_KEY_CT_FLAGS_TRACKED = 1 << 3, /* Conntrack has occurred. */

+	TCA_FLOWER_KEY_CT_FLAGS_INVALID = 1 << 4, /* Conntrack is invalid. */

+	TCA_FLOWER_KEY_CT_FLAGS_REPLY = 1 << 5, /* Packet is in the reply direction. */

+	__TCA_FLOWER_KEY_CT_FLAGS_MAX,

 };

 enum {

diff --git a/ipsec/ovs-monitor-ipsec.in b/ipsec/ovs-monitor-ipsec.in

index 64111768b3..668507fd37 100755

--- a/ipsec/ovs-monitor-ipsec.in

+++ b/ipsec/ovs-monitor-ipsec.in

@@ -14,6 +14,7 @@

 # limitations under the License.

 import argparse

+import ipaddress

 import re

 import subprocess

 import sys

@@ -413,6 +414,11 @@ conn prevent_unencrypted_vxlan

     leftprotoport=udp/4789

     mark={0}

+"""

+

+    IPV6_CONN = """\

+    hostaddrfamily=ipv6

+    clientaddrfamily=ipv6

 """

     auth_tmpl = {"psk": Template("""\

@@ -520,6 +526,9 @@ conn prevent_unencrypted_vxlan

         else:

             auth_section = self.auth_tmpl["pki_ca"].substitute(tunnel.conf)

+        if tunnel.conf["address_family"] == "IPv6":

+            auth_section = self.IPV6_CONN + auth_section

+

         vals = tunnel.conf.copy()

         vals["auth_section"] = auth_section

         vals["version"] = tunnel.version

@@ -756,6 +765,7 @@ class IPsecTunnel(object):

   Tunnel Type:    $tunnel_type

   Local IP:       $local_ip

   Remote IP:      $remote_ip

+  Address Family: $address_family

   SKB mark:       $skb_mark

   Local cert:     $certificate

   Local name:     $local_name

@@ -797,6 +807,9 @@ class IPsecTunnel(object):

             "tunnel_type": row.type,

             "local_ip": options.get("local_ip", "%defaultroute"),

             "remote_ip": options.get("remote_ip"),

+            "address_family": self._get_conn_address_family(

+                                                   options.get("remote_ip"),

+                                                   options.get("local_ip")),

             "skb_mark": monitor.conf["skb_mark"],

             "certificate": monitor.conf["pki"]["certificate"],

             "private_key": monitor.conf["pki"]["private_key"],

@@ -865,6 +878,17 @@ class IPsecTunnel(object):

         return header + conf + status + spds + sas + cons + "\n"

+    def _get_conn_address_family(self, remote_ip, local_ip):

+        remote = address_family(remote_ip)

+        local = address_family(local_ip)

+

+        if local is None:

+            return remote

+        elif local != remote:

+            return None

+        else:

+            return remote

+

     def _is_valid_tunnel_conf(self):

         """This function verifies if IPsec tunnel has valid configuration

         set in 'conf'.  If it is valid, then it returns True.  Otherwise,

@@ -1120,6 +1144,19 @@ class IPsecMonitor(object):

         return m.group(1)

+def address_family(address):

+    try:

+        ip = ipaddress.ip_address(address)

+        ipstr = str(type(ip))

+    # ipaddress has inconsistencies with what exceptions are raised:

+    # https://mail.openvswitch.org/pipermail/ovs-dev/2021-April/381696.html

+    except (ValueError, ipaddress.AddressValueError):

+        return None

+    if ipstr.find('v6') != -1:

+        return "IPv6"

+    return "IPv4"

+

+

 def unixctl_xfrm_policies(conn, unused_argv, unused_aux):

     global xfrm

     policies = xfrm.get_policies()

diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c

index 4381c618f1..251788b049 100644

--- a/lib/dpif-netdev.c

+++ b/lib/dpif-netdev.c

@@ -279,8 +279,9 @@ static bool dpcls_lookup(struct dpcls *cls,

     ( 1 << OFPMBT13_DROP )

 struct dp_meter_band {

-    struct ofputil_meter_band up; /* type, prec_level, pad, rate, burst_size */

-    uint32_t bucket; /* In 1/1000 packets (for PKTPS), or in bits (for KBPS) */

+    uint32_t rate;

+    uint32_t burst_size;

+    uint64_t bucket; /* In 1/1000 packets (for PKTPS), or in bits (for KBPS) */

     uint64_t packet_count;

     uint64_t byte_count;

 };

@@ -3834,6 +3835,15 @@ dpif_netdev_flow_put(struct dpif *dpif, const struct dpif_flow_put *put)

         return error;

     }

+    if (match.wc.masks.in_port.odp_port != ODPP_NONE) {

+        static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5);

+

+        VLOG_ERR_RL(&rl, "failed to put%s flow: in_port is not an exact match",

+                    (put->flags & DPIF_FP_CREATE) ? "[create]"

+                    : (put->flags & DPIF_FP_MODIFY) ? "[modify]" : "[zero]");

+        return EINVAL;

+    }

+

     if (put->ufid) {

         ufid = *put->ufid;

     } else {

@@ -4878,6 +4888,12 @@ struct rr_numa {

     bool idx_inc;

 };

+static size_t

+rr_numa_list_count(struct rr_numa_list *rr)

+{

+    return hmap_count(&rr->numas);

+}

+

 static struct rr_numa *

 rr_numa_list_lookup(struct rr_numa_list *rr, int numa_id)

 {

@@ -5590,10 +5606,17 @@ get_dry_run_variance(struct dp_netdev *dp, uint32_t *core_list,

     for (int i = 0; i < n_rxqs; i++) {

         int numa_id = netdev_get_numa_id(rxqs[i]->port->netdev);

         numa = rr_numa_list_lookup(&rr, numa_id);

+        /* If there is no available pmd on the local numa but there is only one

+         * numa for cross-numa polling, we can estimate the dry run. */

+        if (!numa && rr_numa_list_count(&rr) == 1) {

+            numa = rr_numa_list_next(&rr, NULL);

+        }

         if (!numa) {

-            /* Abort if cross NUMA polling. */

-            VLOG_DBG("PMD auto lb dry run."

-                     " Aborting due to cross-numa polling.");

+            VLOG_DBG("PMD auto lb dry run: "

+                     "There's no available (non-isolated) PMD thread on NUMA "

+                     "node %d for port '%s' and there are PMD threads on more "

+                     "than one NUMA node available for cross-NUMA polling. "

+                     "Aborting.", numa_id, netdev_rxq_get_name(rxqs[i]->rx));

             goto cleanup;

         }

@@ -6203,12 +6226,14 @@ dp_netdev_run_meter(struct dp_netdev *dp, struct dp_packet_batch *packets_,

     /* Update all bands and find the one hit with the highest rate for each

      * packet (if any). */

     for (int m = 0; m < meter->n_bands; ++m) {

-        band = &meter->bands[m];

+        uint64_t max_bucket_size;

+        band = &meter->bands[m];

+        max_bucket_size = (band->rate + band->burst_size) * 1000ULL;

         /* Update band's bucket. */

-        band->bucket += delta_t * band->up.rate;

-        if (band->bucket > band->up.burst_size) {

-            band->bucket = band->up.burst_size;

+        band->bucket += (uint64_t) delta_t * band->rate;

+        if (band->bucket > max_bucket_size) {

+            band->bucket = max_bucket_size;

         }

         /* Drain the bucket for all the packets, if possible. */

@@ -6226,8 +6251,8 @@ dp_netdev_run_meter(struct dp_netdev *dp, struct dp_packet_batch *packets_,

                  * (Only one band will be fired by a packet, and that

                  * can be different for each packet.) */

                 for (int i = band_exceeded_pkt; i < cnt; i++) {

-                    if (band->up.rate > exceeded_rate[i]) {

-                        exceeded_rate[i] = band->up.rate;

+                    if (band->rate > exceeded_rate[i]) {

+                        exceeded_rate[i] = band->rate;

                         exceeded_band[i] = m;

                     }

                 }

@@ -6246,8 +6271,8 @@ dp_netdev_run_meter(struct dp_netdev *dp, struct dp_packet_batch *packets_,

                         /* Update the exceeding band for the exceeding packet.

                          * (Only one band will be fired by a packet, and that

                          * can be different for each packet.) */

-                        if (band->up.rate > exceeded_rate[i]) {

-                            exceeded_rate[i] = band->up.rate;

+                        if (band->rate > exceeded_rate[i]) {

+                            exceeded_rate[i] = band->rate;

                             exceeded_band[i] = m;

                         }

                     }

@@ -6329,16 +6354,15 @@ dpif_netdev_meter_set(struct dpif *dpif, ofproto_meter_id meter_id,

             config->bands[i].burst_size = config->bands[i].rate;

         }

-        meter->bands[i].up = config->bands[i];

-        /* Convert burst size to the bucket units: */

-        /* pkts => 1/1000 packets, kilobits => bits. */

-        meter->bands[i].up.burst_size *= 1000;

-        /* Initialize bucket to empty. */

-        meter->bands[i].bucket = 0;

+        meter->bands[i].rate = config->bands[i].rate;

+        meter->bands[i].burst_size = config->bands[i].burst_size;

+        /* Start with a full bucket. */

+        meter->bands[i].bucket =

+            (meter->bands[i].burst_size + meter->bands[i].rate) * 1000ULL;

         /* Figure out max delta_t that is enough to fill any bucket. */

         band_max_delta_t

-            = meter->bands[i].up.burst_size / meter->bands[i].up.rate;

+            = meter->bands[i].bucket / meter->bands[i].rate;

         if (band_max_delta_t > meter->max_delta_t) {

             meter->max_delta_t = band_max_delta_t;

         }

diff --git a/lib/dpif-netlink.c b/lib/dpif-netlink.c

index ceb56c6851..50520f8c06 100644

--- a/lib/dpif-netlink.c

+++ b/lib/dpif-netlink.c

@@ -2061,6 +2061,7 @@ parse_flow_put(struct dpif_netlink *dpif, struct dpif_flow_put *put)

     uint8_t csum_on = false;

     int err;

+    info.tc_modify_flow_deleted = false;

     if (put->flags & DPIF_FP_PROBE) {

         return EOPNOTSUPP;

     }

@@ -2105,7 +2106,6 @@ parse_flow_put(struct dpif_netlink *dpif, struct dpif_flow_put *put)

     info.tunnel_csum_on = csum_on;

     info.recirc_id_shared_with_tc = (dpif->user_features

                                      & OVS_DP_F_TC_RECIRC_SHARING);

-    info.tc_modify_flow_deleted = false;

     err = netdev_flow_put(dev, &match,

                           CONST_CAST(struct nlattr *, put->actions),

                           put->actions_len,

diff --git a/lib/dpif.c b/lib/dpif.c

index 56d0b4a654..26e8bfb7db 100644

--- a/lib/dpif.c

+++ b/lib/dpif.c

@@ -1240,6 +1240,7 @@ dpif_execute_helper_cb(void *aux_, struct dp_packet_batch *packets_,

         execute.needs_help = false;

         execute.probe = false;

         execute.mtu = 0;

+        execute.hash = 0;

         aux->error = dpif_execute(aux->dpif, &execute);

         log_execute_message(aux->dpif, &this_module, &execute,

                             true, aux->error);

diff --git a/lib/dpif.h b/lib/dpif.h

index ecda896c78..f9728e6739 100644

--- a/lib/dpif.h

+++ b/lib/dpif.h

@@ -727,7 +727,7 @@ struct dpif_execute {

     bool probe;                     /* Suppress error messages. */

     unsigned int mtu;               /* Maximum transmission unit to fragment.

                                        0 if not a fragmented packet */

-    uint64_t hash;

+    uint64_t hash;                  /* Packet flow hash. 0 if not specified. */

     const struct flow *flow;         /* Flow extracted from 'packet'. */

     /* Input, but possibly modified as a side effect of execution. */

diff --git a/lib/netdev-linux.c b/lib/netdev-linux.c

index 6be23dbeed..f87a200756 100644

--- a/lib/netdev-linux.c

+++ b/lib/netdev-linux.c

@@ -1255,21 +1255,21 @@ netdev_linux_batch_rxq_recv_sock(struct netdev_rxq_linux *rx, int mtu,

      * aux_buf is allocated so that it can be prepended to TSO buffer. */

     std_len = virtio_net_hdr_size + VLAN_ETH_HEADER_LEN + mtu;

     for (i = 0; i < NETDEV_MAX_BURST; i++) {

-         buffers[i] = dp_packet_new_with_headroom(std_len, DP_NETDEV_HEADROOM);

-         iovs[i][IOV_PACKET].iov_base = dp_packet_data(buffers[i]);

-         iovs[i][IOV_PACKET].iov_len = std_len;

-         if (iovlen == IOV_TSO_SIZE) {

-             iovs[i][IOV_AUXBUF].iov_base = dp_packet_data(rx->aux_bufs[i]);

-             iovs[i][IOV_AUXBUF].iov_len = dp_packet_tailroom(rx->aux_bufs[i]);

-         }

+        buffers[i] = dp_packet_new_with_headroom(std_len, DP_NETDEV_HEADROOM);

+        iovs[i][IOV_PACKET].iov_base = dp_packet_data(buffers[i]);

+        iovs[i][IOV_PACKET].iov_len = std_len;

+        if (iovlen == IOV_TSO_SIZE) {

+            iovs[i][IOV_AUXBUF].iov_base = dp_packet_data(rx->aux_bufs[i]);

+            iovs[i][IOV_AUXBUF].iov_len = dp_packet_tailroom(rx->aux_bufs[i]);

+        }

-         mmsgs[i].msg_hdr.msg_name = NULL;

-         mmsgs[i].msg_hdr.msg_namelen = 0;

-         mmsgs[i].msg_hdr.msg_iov = iovs[i];

-         mmsgs[i].msg_hdr.msg_iovlen = iovlen;

-         mmsgs[i].msg_hdr.msg_control = &cmsg_buffers[i];

-         mmsgs[i].msg_hdr.msg_controllen = sizeof cmsg_buffers[i];

-         mmsgs[i].msg_hdr.msg_flags = 0;

+        mmsgs[i].msg_hdr.msg_name = NULL;

+        mmsgs[i].msg_hdr.msg_namelen = 0;

+        mmsgs[i].msg_hdr.msg_iov = iovs[i];

+        mmsgs[i].msg_hdr.msg_iovlen = iovlen;

+        mmsgs[i].msg_hdr.msg_control = &cmsg_buffers[i];

+        mmsgs[i].msg_hdr.msg_controllen = sizeof cmsg_buffers[i];

+        mmsgs[i].msg_hdr.msg_flags = 0;

     }

     do {

@@ -2572,7 +2572,7 @@ exit:

 static struct tc_police

 tc_matchall_fill_police(uint32_t kbits_rate, uint32_t kbits_burst)

 {

-    unsigned int bsize = MIN(UINT32_MAX / 1024, kbits_burst) * 1024 / 64;

+    unsigned int bsize = MIN(UINT32_MAX / 1024, kbits_burst) * 1024 / 8;

     unsigned int bps = ((uint64_t) kbits_rate * 1000) / 8;

     struct tc_police police;

     struct tc_ratespec rate;

diff --git a/lib/netdev-offload-tc.c b/lib/netdev-offload-tc.c

index 72b7915052..7656427845 100644

--- a/lib/netdev-offload-tc.c

+++ b/lib/netdev-offload-tc.c

@@ -48,6 +48,7 @@ static struct hmap ufid_to_tc = HMAP_INITIALIZER(&ufid_to_tc);

 static struct hmap tc_to_ufid = HMAP_INITIALIZER(&tc_to_ufid);

 static bool multi_mask_per_prio = false;

 static bool block_support = false;

+static uint16_t ct_state_support;

 struct netlink_field {

     int offset;

@@ -676,6 +677,27 @@ parse_tc_flower_to_match(struct tc_flower *flower,

                 ct_statem |= OVS_CS_F_TRACKED;

             }

+            if (mask->ct_state & TCA_FLOWER_KEY_CT_FLAGS_REPLY) {

+                if (key->ct_state & TCA_FLOWER_KEY_CT_FLAGS_REPLY) {

+                    ct_statev |= OVS_CS_F_REPLY_DIR;

+                }

+                ct_statem |= OVS_CS_F_REPLY_DIR;

+            }

+

+            if (mask->ct_state & TCA_FLOWER_KEY_CT_FLAGS_INVALID) {

+                if (key->ct_state & TCA_FLOWER_KEY_CT_FLAGS_INVALID) {

+                    ct_statev |= OVS_CS_F_INVALID;

+                }

+                ct_statem |= OVS_CS_F_INVALID;

+            }

+

+            if (mask->ct_state & TCA_FLOWER_KEY_CT_FLAGS_RELATED) {

+                if (key->ct_state & TCA_FLOWER_KEY_CT_FLAGS_RELATED) {

+                    ct_statev |= OVS_CS_F_RELATED;

+                }

+                ct_statem |= OVS_CS_F_RELATED;

+            }

+

             match_set_ct_state_masked(match, ct_statev, ct_statem);

         }

@@ -1406,6 +1428,90 @@ flower_match_to_tun_opt(struct tc_flower *flower, const struct flow_tnl *tnl,

     flower->mask.tunnel.metadata.present.len = tnl->metadata.present.len;

 }

+static void

+parse_match_ct_state_to_flower(struct tc_flower *flower, struct match *match)

+{

+    const struct flow *key = &match->flow;

+    struct flow *mask = &match->wc.masks;

+

+    if (!ct_state_support) {

+        return;

+    }

+

+    if ((ct_state_support & mask->ct_state) == mask->ct_state) {

+        if (mask->ct_state & OVS_CS_F_NEW) {

+            if (key->ct_state & OVS_CS_F_NEW) {

+                flower->key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_NEW;

+            }

+            flower->mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_NEW;

+            mask->ct_state &= ~OVS_CS_F_NEW;

+        }

+

+        if (mask->ct_state & OVS_CS_F_ESTABLISHED) {

+            if (key->ct_state & OVS_CS_F_ESTABLISHED) {

+                flower->key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED;

+            }

+            flower->mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED;

+            mask->ct_state &= ~OVS_CS_F_ESTABLISHED;

+        }

+

+        if (mask->ct_state & OVS_CS_F_TRACKED) {

+            if (key->ct_state & OVS_CS_F_TRACKED) {

+                flower->key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_TRACKED;

+            }

+            flower->mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_TRACKED;

+            mask->ct_state &= ~OVS_CS_F_TRACKED;

+        }

+

+        if (mask->ct_state & OVS_CS_F_REPLY_DIR) {

+            if (key->ct_state & OVS_CS_F_REPLY_DIR) {

+                flower->key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_REPLY;

+            }

+            flower->mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_REPLY;

+            mask->ct_state &= ~OVS_CS_F_REPLY_DIR;

+        }

+

+        if (mask->ct_state & OVS_CS_F_INVALID) {

+            if (key->ct_state & OVS_CS_F_INVALID) {

+                flower->key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_INVALID;

+            }

+            flower->mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_INVALID;

+            mask->ct_state &= ~OVS_CS_F_INVALID;

+        }

+

+        if (mask->ct_state & OVS_CS_F_RELATED) {

+            if (key->ct_state & OVS_CS_F_RELATED) {

+                flower->key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_RELATED;

+            }

+            flower->mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_RELATED;

+            mask->ct_state &= ~OVS_CS_F_RELATED;

+        }

+

+        if (flower->key.ct_state & TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED) {

+            flower->key.ct_state &= ~(TCA_FLOWER_KEY_CT_FLAGS_NEW);

+            flower->mask.ct_state &= ~(TCA_FLOWER_KEY_CT_FLAGS_NEW);

+        }

+    }

+

+    if (mask->ct_zone) {

+        flower->key.ct_zone = key->ct_zone;

+        flower->mask.ct_zone = mask->ct_zone;

+        mask->ct_zone = 0;

+    }

+

+    if (mask->ct_mark) {

+        flower->key.ct_mark = key->ct_mark;

+        flower->mask.ct_mark = mask->ct_mark;

+        mask->ct_mark = 0;

+    }

+

+    if (!ovs_u128_is_zero(mask->ct_label)) {

+        flower->key.ct_label = key->ct_label;

+        flower->mask.ct_label = mask->ct_label;

+        mask->ct_label = OVS_U128_ZERO;

+    }

+}

+

 static int

 netdev_tc_flow_put(struct netdev *netdev, struct match *match,

                    struct nlattr *actions, size_t actions_len,

@@ -1650,54 +1756,7 @@ netdev_tc_flow_put(struct netdev *netdev, struct match *match,

         }

     }

-    if (mask->ct_state) {

-        if (mask->ct_state & OVS_CS_F_NEW) {

-            if (key->ct_state & OVS_CS_F_NEW) {

-                flower.key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_NEW;

-            }

-            flower.mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_NEW;

-            mask->ct_state &= ~OVS_CS_F_NEW;

-        }

-

-        if (mask->ct_state & OVS_CS_F_ESTABLISHED) {

-            if (key->ct_state & OVS_CS_F_ESTABLISHED) {

-                flower.key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED;

-            }

-            flower.mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED;

-            mask->ct_state &= ~OVS_CS_F_ESTABLISHED;

-        }

-

-        if (mask->ct_state & OVS_CS_F_TRACKED) {

-            if (key->ct_state & OVS_CS_F_TRACKED) {

-                flower.key.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_TRACKED;

-            }

-            flower.mask.ct_state |= TCA_FLOWER_KEY_CT_FLAGS_TRACKED;

-            mask->ct_state &= ~OVS_CS_F_TRACKED;

-        }

-

-        if (flower.key.ct_state & TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED) {

-            flower.key.ct_state &= ~(TCA_FLOWER_KEY_CT_FLAGS_NEW);

-            flower.mask.ct_state &= ~(TCA_FLOWER_KEY_CT_FLAGS_NEW);

-        }

-    }

-

-    if (mask->ct_zone) {

-        flower.key.ct_zone = key->ct_zone;

-        flower.mask.ct_zone = mask->ct_zone;

-        mask->ct_zone = 0;

-    }

-

-    if (mask->ct_mark) {

-        flower.key.ct_mark = key->ct_mark;

-        flower.mask.ct_mark = mask->ct_mark;

-        mask->ct_mark = 0;

-    }

-

-    if (!ovs_u128_is_zero(mask->ct_label)) {

-        flower.key.ct_label = key->ct_label;

-        flower.mask.ct_label = mask->ct_label;

-        mask->ct_label = OVS_U128_ZERO;

-    }

+    parse_match_ct_state_to_flower(&flower, match);

     /* ignore exact match on skb_mark of 0. */

     if (mask->pkt_mark == UINT32_MAX && !key->pkt_mark) {

@@ -1779,6 +1838,10 @@ netdev_tc_flow_put(struct netdev *netdev, struct match *match,

             const struct nlattr *ct = nl_attr_get(nla);

             const size_t ct_len = nl_attr_get_size(nla);

+            if (!ct_state_support) {

+                return -EOPNOTSUPP;

+            }

+

             err = parse_put_flow_ct_action(&flower, action, ct, ct_len);

             if (err) {

                 return err;

@@ -1971,6 +2034,96 @@ out:

     tc_add_del_qdisc(ifindex, false, block_id, TC_INGRESS);

 }

+

+static int

+probe_insert_ct_state_rule(int ifindex, uint16_t ct_state, struct tcf_id *id)

+{

+    int prio = TC_RESERVED_PRIORITY_MAX + 1;

+    struct tc_flower flower;

+

+    memset(&flower, 0, sizeof flower);

+    flower.key.ct_state = ct_state;

+    flower.mask.ct_state = ct_state;

+    flower.tc_policy = TC_POLICY_SKIP_HW;

+    flower.key.eth_type = htons(ETH_P_IP);

+    flower.mask.eth_type = OVS_BE16_MAX;

+

+    *id = tc_make_tcf_id(ifindex, 0, prio, TC_INGRESS);

+    return tc_replace_flower(id, &flower);

+}

+

+static void

+probe_ct_state_support(int ifindex)

+{

+    struct tc_flower flower;

+    uint16_t ct_state;

+    struct tcf_id id;

+    int error;

+

+    error = tc_add_del_qdisc(ifindex, true, 0, TC_INGRESS);

+    if (error) {

+        return;

+    }

+

+    /* Test for base ct_state match support */

+    ct_state = TCA_FLOWER_KEY_CT_FLAGS_NEW | TCA_FLOWER_KEY_CT_FLAGS_TRACKED;

+    error = probe_insert_ct_state_rule(ifindex, ct_state, &id;;

+    if (error) {

+        goto out;

+    }

+

+    error = tc_get_flower(&id, &flower);

+    if (error || flower.mask.ct_state != ct_state) {

+        goto out_del;

+    }

+

+    tc_del_filter(&id;;

+    ct_state_support = OVS_CS_F_NEW |

+                       OVS_CS_F_ESTABLISHED |

+                       OVS_CS_F_TRACKED |

+                       OVS_CS_F_RELATED;

+

+    /* Test for reject, ct_state >= MAX */

+    ct_state = ~0;

+    error = probe_insert_ct_state_rule(ifindex, ct_state, &id;;

+    if (!error) {

+        /* No reject, can't continue probing other flags */

+        goto out_del;

+    }

+

+    tc_del_filter(&id;;

+

+    /* Test for ct_state INVALID support */

+    memset(&flower, 0, sizeof flower);

+    ct_state = TCA_FLOWER_KEY_CT_FLAGS_TRACKED |

+               TCA_FLOWER_KEY_CT_FLAGS_INVALID;

+    error = probe_insert_ct_state_rule(ifindex, ct_state, &id;;

+    if (error) {

+        goto out;

+    }

+

+    tc_del_filter(&id;;

+    ct_state_support |= OVS_CS_F_INVALID;

+

+    /* Test for ct_state REPLY support */

+    memset(&flower, 0, sizeof flower);

+    ct_state = TCA_FLOWER_KEY_CT_FLAGS_TRACKED |

+               TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED |

+               TCA_FLOWER_KEY_CT_FLAGS_REPLY;

+    error = probe_insert_ct_state_rule(ifindex, ct_state, &id;;

+    if (error) {

+        goto out;

+    }

+

+    ct_state_support |= OVS_CS_F_REPLY_DIR;

+

+out_del:

+    tc_del_filter(&id;;

+out:

+    tc_add_del_qdisc(ifindex, false, 0, TC_INGRESS);

+    VLOG_INFO("probe tc: supported ovs ct_state bits: 0x%x", ct_state_support);

+}

+

 static void

 probe_tc_block_support(int ifindex)

 {

@@ -2038,6 +2191,7 @@ netdev_tc_init_flow_api(struct netdev *netdev)

         block_id = get_block_id_from_netdev(netdev);

         probe_multi_mask_per_prio(ifindex);

+        probe_ct_state_support(ifindex);

         ovsthread_once_done(&once);

     }

diff --git a/lib/odp-util.c b/lib/odp-util.c

index a8598d52af..e1199d1da6 100644

--- a/lib/odp-util.c

+++ b/lib/odp-util.c

@@ -3189,17 +3189,17 @@ tun_key_to_attr(struct ofpbuf *a, const struct flow_tnl *tun_key,

     if ((!tnl_type || !strcmp(tnl_type, "erspan") ||

         !strcmp(tnl_type, "ip6erspan")) &&

         (tun_key->erspan_ver == 1 || tun_key->erspan_ver == 2)) {

-        struct erspan_metadata opts;

+        struct erspan_metadata *opts;

-        opts.version = tun_key->erspan_ver;

-        if (opts.version == 1) {

-            opts.u.index = htonl(tun_key->erspan_idx);

+        opts = nl_msg_put_unspec_zero(a, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,

+                                      sizeof *opts);

+        opts->version = tun_key->erspan_ver;

+        if (opts->version == 1) {

+            opts->u.index = htonl(tun_key->erspan_idx);

         } else {

-            opts.u.md2.dir = tun_key->erspan_dir;

-            set_hwid(&opts.u.md2, tun_key->erspan_hwid);

+            opts->u.md2.dir = tun_key->erspan_dir;

+            set_hwid(&opts->u.md2, tun_key->erspan_hwid);

         }

-        nl_msg_put_unspec(a, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,

-                          &opts, sizeof(opts));

     }

     if ((!tnl_type || !strcmp(tnl_type, "gtpu")) &&

diff --git a/lib/ofp-actions.c b/lib/ofp-actions.c

index e2e829772a..0342a228b7 100644

--- a/lib/ofp-actions.c

+++ b/lib/ofp-actions.c

@@ -4431,6 +4431,7 @@ decode_NXAST_RAW_ENCAP(const struct nx_action_encap *nae,

 {

     struct ofpact_encap *encap;

     const struct ofp_ed_prop_header *ofp_prop;

+    const size_t encap_ofs = out->size;

     size_t props_len;

     uint16_t n_props = 0;

     int err;

@@ -4458,6 +4459,7 @@ decode_NXAST_RAW_ENCAP(const struct nx_action_encap *nae,

         }

         n_props++;

     }

+    encap = ofpbuf_at_assert(out, encap_ofs, sizeof *encap);

     encap->n_props = n_props;

     out->header = &encap->ofpact;

     ofpact_finish_ENCAP(out, &encap);

diff --git a/lib/ofp-group.c b/lib/ofp-group.c

index bf0f8af544..737f48047b 100644

--- a/lib/ofp-group.c

+++ b/lib/ofp-group.c

@@ -64,7 +64,7 @@ ofputil_group_from_string(const char *s, uint32_t *group_idp)

 void

 ofputil_format_group(uint32_t group_id, struct ds *s)

 {

-    char name[MAX_GROUP_NAME_LEN];

+    char name[MAX_GROUP_NAME_LEN + 1];

     ofputil_group_to_string(group_id, name, sizeof name);

     ds_put_cstr(s, name);

diff --git a/lib/ovsdb-cs.c b/lib/ovsdb-cs.c

index ff8adaefb5..6f9f912ac4 100644

--- a/lib/ovsdb-cs.c

+++ b/lib/ovsdb-cs.c

@@ -1367,7 +1367,7 @@ ovsdb_cs_send_transaction(struct ovsdb_cs *cs, struct json *operations)

                               sizeof *cs->txns);

     }

     cs->txns[cs->n_txns++] = request_id;

-    return request_id;

+    return json_clone(request_id);

 }

 /* Makes 'cs' drop its record of transaction 'request_id'.  If a reply arrives

@@ -1380,6 +1380,7 @@ ovsdb_cs_forget_transaction(struct ovsdb_cs *cs, const struct json *request_id)

 {

     for (size_t i = 0; i < cs->n_txns; i++) {

         if (json_equal(request_id, cs->txns[i])) {

+            json_destroy(cs->txns[i]);

             cs->txns[i] = cs->txns[--cs->n_txns];

             return true;

         }

diff --git a/lib/ovsdb-idl.c b/lib/ovsdb-idl.c

index 2c8a0c9cfe..1d385ca2fe 100644

--- a/lib/ovsdb-idl.c

+++ b/lib/ovsdb-idl.c

@@ -92,6 +92,9 @@ struct ovsdb_idl {

     struct ovsdb_idl_txn *txn;

     struct hmap outstanding_txns;

     bool verify_write_only;

+    struct ovs_list deleted_untracked_rows; /* Stores rows deleted in the

+                                             * current run, that are not yet

+                                             * added to the track_list. */

 };

 static struct ovsdb_cs_ops ovsdb_idl_cs_ops;

@@ -144,6 +147,7 @@ static bool ovsdb_idl_modify_row(struct ovsdb_idl_row *,

                                  const struct shash *values, bool xor);

 static void ovsdb_idl_parse_update(struct ovsdb_idl *,

                                    const struct ovsdb_cs_update_event *);

+static void ovsdb_idl_reparse_deleted(struct ovsdb_idl *);

 static void ovsdb_idl_txn_process_reply(struct ovsdb_idl *,

                                         const struct jsonrpc_msg *);

@@ -163,6 +167,10 @@ static void ovsdb_idl_row_unparse(struct ovsdb_idl_row *);

 static void ovsdb_idl_row_clear_old(struct ovsdb_idl_row *);

 static void ovsdb_idl_row_clear_new(struct ovsdb_idl_row *);

 static void ovsdb_idl_row_clear_arcs(struct ovsdb_idl_row *, bool destroy_dsts);

+static void ovsdb_idl_row_reparse_backrefs(struct ovsdb_idl_row *);

+static void ovsdb_idl_row_track_change(struct ovsdb_idl_row *,

+                                       enum ovsdb_idl_change);

+static void ovsdb_idl_row_untrack_change(struct ovsdb_idl_row *);