diff --git a/.ci/linux-prepare.sh b/.ci/linux-prepare.sh

index c55125cf78..360c0a68ea 100755

--- a/.ci/linux-prepare.sh

+++ b/.ci/linux-prepare.sh

@@ -21,8 +21,7 @@ make -j4 HAVE_LLVM= HAVE_SQLITE= install

 cd ..

 pip3 install --disable-pip-version-check --user \

-    flake8 hacking sphinx pyOpenSSL wheel setuptools

-pip3 install --user --upgrade docutils

+    flake8 hacking sphinx wheel setuptools

 pip3 install --user  'meson==0.47.1'

 if [ "$M32" ]; then

diff --git a/.cirrus.yml b/.cirrus.yml

index 358f2ba256..a7ae793bc4 100644

--- a/.cirrus.yml

+++ b/.cirrus.yml

@@ -5,11 +5,11 @@ freebsd_build_task:

       image_family: freebsd-12-2-snap

       image_family: freebsd-11-4-snap

     cpu: 4

-    memory: 8G

+    memory: 4G

   env:

     DEPENDENCIES: automake libtool gmake gcc wget openssl python3

-    PY_DEPS:      sphinx|openssl

+    PY_DEPS:      sphinx

     matrix:

       COMPILER: gcc

       COMPILER: clang

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml

index e2350c6d9d..7434ad18ec 100644

--- a/.github/workflows/build-and-test.yml

+++ b/.github/workflows/build-and-test.yml

@@ -127,7 +127,7 @@ jobs:

     - name: set up python

       uses: actions/setup-python@v2

       with:

-        python-version: '3.x'

+        python-version: '3.9'

     - name: create ci signature file for the dpdk cache key

       if:   matrix.dpdk != '' || matrix.dpdk_shared != ''

@@ -215,7 +215,7 @@ jobs:

     - name: set up python

       uses: actions/setup-python@v2

       with:

-        python-version: '3.x'

+        python-version: '3.9'

     - name: install dependencies

       run:  brew install automake libtool

     - name: prepare

diff --git a/.travis.yml b/.travis.yml

index 51d0511080..c7aeede06e 100644

--- a/.travis.yml

+++ b/.travis.yml

@@ -17,7 +17,6 @@ addons:

       - libjemalloc-dev

       - libnuma-dev

       - libpcap-dev

-      - python3-openssl

       - python3-pip

       - python3-sphinx

       - libelf-dev

diff --git a/NEWS b/NEWS

index 559a51ba3f..139c24a4f8 100644

--- a/NEWS

+++ b/NEWS

@@ -1,3 +1,13 @@

+v2.16.2 - xx xxx xxxx

+---------------------

+   - Python:

+     * For SSL support, the use of the pyOpenSSL library has been replaced

+       with the native 'ssl' module.

+

+v2.16.1 - 21 Oct 2021

+---------------------

+   - Bug fixes

+

 v2.16.0 - 16 Aug 2021

 ---------------------

    - Removed support for 1024-bit Diffie-Hellman key exchange, which is now

diff --git a/configure.ac b/configure.ac

index 16b32be965..64c26828f2 100644

--- a/configure.ac

+++ b/configure.ac

@@ -13,7 +13,7 @@

 # limitations under the License.

 AC_PREREQ(2.63)

-AC_INIT(openvswitch, 2.16.0, bugs@openvswitch.org)

+AC_INIT(openvswitch, 2.16.2, bugs@openvswitch.org)

 AC_CONFIG_SRCDIR([datapath/datapath.c])

 AC_CONFIG_MACRO_DIR([m4])

 AC_CONFIG_AUX_DIR([build-aux])

diff --git a/datapath-windows/ovsext/Actions.c b/datapath-windows/ovsext/Actions.c

index e130c2f966..0c18c62548 100644

--- a/datapath-windows/ovsext/Actions.c

+++ b/datapath-windows/ovsext/Actions.c

@@ -1112,9 +1112,9 @@ OvsPopFieldInPacketBuf(OvsForwardingContext *ovsFwdCtx,

      * should split the function and refactor. */

     if (!bufferData) {

         EthHdr *ethHdr = (EthHdr *)bufferStart;

-        /* If the frame is not VLAN make it a no op */

         if (ethHdr->Type != ETH_TYPE_802_1PQ_NBO) {

-            return NDIS_STATUS_SUCCESS;

+            OVS_LOG_ERROR("Invalid ethHdr type %u, nbl %p", ethHdr->Type, ovsFwdCtx->curNbl);

+            return NDIS_STATUS_INVALID_PACKET;

         }

     }

     RtlMoveMemory(bufferStart + shiftLength, bufferStart, shiftOffset);

@@ -1137,6 +1137,9 @@ OvsPopFieldInPacketBuf(OvsForwardingContext *ovsFwdCtx,

 static __inline NDIS_STATUS

 OvsPopVlanInPktBuf(OvsForwardingContext *ovsFwdCtx)

 {

+    NDIS_STATUS status;

+    OVS_PACKET_HDR_INFO* layers = &ovsFwdCtx->layers;

+

     /*

      * Declare a dummy vlanTag structure since we need to compute the size

      * of shiftLength. The NDIS one is a unionized structure.

@@ -1145,7 +1148,15 @@ OvsPopVlanInPktBuf(OvsForwardingContext *ovsFwdCtx)

     UINT32 shiftLength = sizeof(vlanTag.TagHeader);

     UINT32 shiftOffset = sizeof(DL_EUI48) + sizeof(DL_EUI48);

-    return OvsPopFieldInPacketBuf(ovsFwdCtx, shiftOffset, shiftLength, NULL);

+    status = OvsPopFieldInPacketBuf(ovsFwdCtx, shiftOffset, shiftLength,

+                                    NULL);

+

+    if (status == NDIS_STATUS_SUCCESS) {

+        layers->l3Offset -= (UINT16) shiftLength;

+        layers->l4Offset -= (UINT16) shiftLength;

+    }

+

+    return status;

 }

@@ -1516,6 +1527,7 @@ OvsUpdateAddressAndPort(OvsForwardingContext *ovsFwdCtx,

     csumInfo.Value = NET_BUFFER_LIST_INFO(ovsFwdCtx->curNbl,

                                           TcpIpChecksumNetBufferListInfo);

+

     /*

      * Adjust the IP header inline as dictated by the action, and also update

      * the IP and the TCP checksum for the data modified.

@@ -1524,6 +1536,7 @@ OvsUpdateAddressAndPort(OvsForwardingContext *ovsFwdCtx,

      * ChecksumUpdate32(). Ignoring this for now, since for the most common

      * case, we only update the TTL.

      */

+     /*Only tx direction the checksum value will be reset to be PseudoChecksum*/

     if (isSource) {

         addrField = &ipHdr->saddr;

@@ -1540,7 +1553,7 @@ OvsUpdateAddressAndPort(OvsForwardingContext *ovsFwdCtx,

                         ((BOOLEAN)csumInfo.Receive.UdpChecksumSucceeded ||

                          (BOOLEAN)csumInfo.Receive.UdpChecksumFailed);

         }

-        if (l4Offload) {

+        if (isTx && l4Offload) {

             *checkField = IPPseudoChecksum(&newAddr, &ipHdr->daddr,

                 tcpHdr ? IPPROTO_TCP : IPPROTO_UDP,

                 ntohs(ipHdr->tot_len) - ipHdr->ihl * 4);

@@ -1561,7 +1574,7 @@ OvsUpdateAddressAndPort(OvsForwardingContext *ovsFwdCtx,

                          (BOOLEAN)csumInfo.Receive.UdpChecksumFailed);

         }

-       if (l4Offload) {

+       if (isTx && l4Offload) {

             *checkField = IPPseudoChecksum(&ipHdr->saddr, &newAddr,

                 tcpHdr ? IPPROTO_TCP : IPPROTO_UDP,

                 ntohs(ipHdr->tot_len) - ipHdr->ihl * 4);

@@ -1570,7 +1583,7 @@ OvsUpdateAddressAndPort(OvsForwardingContext *ovsFwdCtx,

     if (*addrField != newAddr) {

         UINT32 oldAddr = *addrField;

-        if (checkField && *checkField != 0 && !l4Offload) {

+        if ((checkField && *checkField != 0) && (!l4Offload || !isTx)) {

             /* Recompute total checksum. */

             *checkField = ChecksumUpdate32(*checkField, oldAddr,

                                             newAddr);

@@ -1579,11 +1592,12 @@ OvsUpdateAddressAndPort(OvsForwardingContext *ovsFwdCtx,

             ipHdr->check = ChecksumUpdate32(ipHdr->check, oldAddr,

                                             newAddr);

         }

+

         *addrField = newAddr;

     }

     if (portField && *portField != newPort) {

-        if (checkField && !l4Offload) {

+        if ((checkField) && (!l4Offload || !isTx)) {

             /* Recompute total checksum. */

             *checkField = ChecksumUpdate16(*checkField, *portField,

                                            newPort);

@@ -1792,9 +1806,11 @@ OvsExecuteRecirc(OvsForwardingContext *ovsFwdCtx,

     }

     if (newNbl) {

-        deferredAction = OvsAddDeferredActions(newNbl, key, NULL);

+        deferredAction = OvsAddDeferredActions(newNbl, key, &(ovsFwdCtx->layers),

+                                               NULL);

     } else {

-        deferredAction = OvsAddDeferredActions(ovsFwdCtx->curNbl, key, NULL);

+        deferredAction = OvsAddDeferredActions(ovsFwdCtx->curNbl, key,

+                                              &(ovsFwdCtx->layers), NULL);

     }

     if (deferredAction) {

@@ -1964,7 +1980,7 @@ OvsExecuteSampleAction(OvsForwardingContext *ovsFwdCtx,

         return STATUS_SUCCESS;

     }

-    if (!OvsAddDeferredActions(newNbl, key, a)) {

+    if (!OvsAddDeferredActions(newNbl, key, &(ovsFwdCtx->layers), a)) {

         OVS_LOG_INFO(

             "Deferred actions limit reached, dropping sample action.");

         OvsCompleteNBL(ovsFwdCtx->switchContext, newNbl, TRUE);

@@ -2100,6 +2116,7 @@ OvsDoExecuteActions(POVS_SWITCH_CONTEXT switchContext,

                  */

                 status = OvsPopVlanInPktBuf(&ovsFwdCtx);

                 if (status != NDIS_STATUS_SUCCESS) {

+                    OVS_LOG_ERROR("OVS-pop vlan action failed status = %lu", status);

                     dropReason = L"OVS-pop vlan action failed";

                     goto dropit;

                 }

@@ -2349,7 +2366,7 @@ OvsActionsExecute(POVS_SWITCH_CONTEXT switchContext,

     if (status == STATUS_SUCCESS) {

         status = OvsProcessDeferredActions(switchContext, completionList,

-                                           portNo, sendFlags, layers);

+                                           portNo, sendFlags, NULL);

     }

     return status;

diff --git a/datapath-windows/ovsext/Conntrack.c b/datapath-windows/ovsext/Conntrack.c

index 2610d626a0..fd6f3bae04 100644

--- a/datapath-windows/ovsext/Conntrack.c

+++ b/datapath-windows/ovsext/Conntrack.c

@@ -493,15 +493,32 @@ static __inline NDIS_STATUS

 OvsDetectCtPacket(OvsForwardingContext *fwdCtx,

                   OvsFlowKey *key)

 {

+    NDIS_STATUS status = NDIS_STATUS_SUCCESS;

+    OvsFlowKey  newFlowKey = { 0 };

+

     switch (ntohs(key->l2.dlType)) {

     case ETH_TYPE_IPV4:

         if (key->ipKey.nwFrag != OVS_FRAG_TYPE_NONE) {

-            return OvsProcessIpv4Fragment(fwdCtx->switchContext,

+            status = OvsProcessIpv4Fragment(fwdCtx->switchContext,

                                           &fwdCtx->curNbl,

                                           fwdCtx->completionList,

                                           fwdCtx->fwdDetail->SourcePortId,

                                           &fwdCtx->layers,

                                           key->tunKey.tunnelId);

+            if (status == NDIS_STATUS_SUCCESS) {

+                 /* After the Ipv4 Fragment is reassembled, update flow key as

+                   L3 and L4 headers are not correct */

+                 status =

+                      OvsExtractFlow(fwdCtx->curNbl, fwdCtx->srcVportNo,

+                                     &newFlowKey, &fwdCtx->layers,

+                                     fwdCtx->tunKey.dst != 0 ? &fwdCtx->tunKey : NULL);

+                if (status != NDIS_STATUS_SUCCESS) {

+                     OVS_LOG_ERROR("Extract flow failed Nbl %p", fwdCtx->curNbl);

+                     return status;

+                 }

+                *key = newFlowKey;

+            }

+            return status;

         }

         if (key->ipKey.nwProto == IPPROTO_TCP

             || key->ipKey.nwProto == IPPROTO_UDP

diff --git a/datapath-windows/ovsext/Recirc.c b/datapath-windows/ovsext/Recirc.c

index 2febf060dd..a32b75352b 100644

--- a/datapath-windows/ovsext/Recirc.c

+++ b/datapath-windows/ovsext/Recirc.c

@@ -277,16 +277,23 @@ OvsDeferredActionsQueuePush(POVS_DEFERRED_ACTION_QUEUE queue)

 POVS_DEFERRED_ACTION

 OvsAddDeferredActions(PNET_BUFFER_LIST nbl,

                       OvsFlowKey *key,

+                      POVS_PACKET_HDR_INFO layers,

                       const PNL_ATTR actions)

 {

     POVS_DEFERRED_ACTION_QUEUE queue = OvsDeferredActionsQueueGet();

     POVS_DEFERRED_ACTION deferredAction = NULL;

+    OVS_PACKET_HDR_INFO layersInit = { 0 };

     deferredAction = OvsDeferredActionsQueuePush(queue);

     if (deferredAction) {

         deferredAction->nbl = nbl;

         deferredAction->actions = actions;

         deferredAction->key = *key;

+        if (layers) {

+            deferredAction->layers = *layers;

+        } else {

+            deferredAction->layers = layersInit;

+        }

     }

     return deferredAction;

@@ -309,9 +316,16 @@ OvsProcessDeferredActions(POVS_SWITCH_CONTEXT switchContext,

     NDIS_STATUS status = NDIS_STATUS_SUCCESS;

     POVS_DEFERRED_ACTION_QUEUE queue = OvsDeferredActionsQueueGet();

     POVS_DEFERRED_ACTION deferredAction = NULL;

+    POVS_PACKET_HDR_INFO layersDeferred = NULL;

     /* Process all deferred actions. */

     while ((deferredAction = OvsDeferredActionsQueuePop(queue)) != NULL) {

+        if (layers) {

+            layersDeferred = layers;

+         } else {

+            layersDeferred = &(deferredAction->layers);

+         }

+

         if (deferredAction->actions) {

             status = OvsDoExecuteActions(switchContext,

                                          completionList,

@@ -319,7 +333,7 @@ OvsProcessDeferredActions(POVS_SWITCH_CONTEXT switchContext,

                                          portNo,

                                          sendFlags,

                                          &deferredAction->key, NULL,

-                                         layers, deferredAction->actions,

+                                         layersDeferred, deferredAction->actions,

                                          NlAttrGetSize(deferredAction->actions));

         } else {

             status = OvsDoRecirc(switchContext,

@@ -327,7 +341,7 @@ OvsProcessDeferredActions(POVS_SWITCH_CONTEXT switchContext,

                                  deferredAction->nbl,

                                  &deferredAction->key,

                                  portNo,

-                                 layers);

+                                 layersDeferred);

         }

     }

diff --git a/datapath-windows/ovsext/Recirc.h b/datapath-windows/ovsext/Recirc.h

index 2b314ce274..74130a4600 100644

--- a/datapath-windows/ovsext/Recirc.h

+++ b/datapath-windows/ovsext/Recirc.h

@@ -18,6 +18,7 @@

 #define __RECIRC_H_ 1

 #include "Actions.h"

+#include "NetProto.h"

 #define DEFERRED_ACTION_QUEUE_SIZE          10

 #define DEFERRED_ACTION_EXEC_LEVEL           4

@@ -26,6 +27,7 @@ typedef struct _OVS_DEFERRED_ACTION {

     PNET_BUFFER_LIST    nbl;

     PNL_ATTR            actions;

     OvsFlowKey          key;

+    OVS_PACKET_HDR_INFO layers;

 } OVS_DEFERRED_ACTION, *POVS_DEFERRED_ACTION;

 /*

@@ -52,6 +54,7 @@ OvsProcessDeferredActions(POVS_SWITCH_CONTEXT switchContext,

 POVS_DEFERRED_ACTION

 OvsAddDeferredActions(PNET_BUFFER_LIST packet,

                       OvsFlowKey *key,

+                      POVS_PACKET_HDR_INFO layers,

                       const PNL_ATTR actions);

 /*

diff --git a/debian/changelog b/debian/changelog

index 239d210b96..a0838ea3d7 100644

--- a/debian/changelog

+++ b/debian/changelog

@@ -1,3 +1,15 @@

+openvswitch (2.16.2-1) unstable; urgency=low

+   [ Open vSwitch team ]

+   * New upstream version

+

+ -- Open vSwitch team <dev@openvswitch.org>  Thu, 21 Oct 2021 23:58:12 +0200

+

+openvswitch (2.16.1-1) unstable; urgency=low

+   [ Open vSwitch team ]

+   * New upstream version

+

+ -- Open vSwitch team <dev@openvswitch.org>  Thu, 21 Oct 2021 23:58:12 +0200

+

 openvswitch (2.16.0-1) unstable; urgency=low

    * New upstream version

diff --git a/include/openvswitch/json.h b/include/openvswitch/json.h

index 73b562e03d..0831a9cee1 100644

--- a/include/openvswitch/json.h

+++ b/include/openvswitch/json.h

@@ -50,7 +50,9 @@ enum json_type {

     JSON_INTEGER,               /* 123. */

     JSON_REAL,                  /* 123.456. */

     JSON_STRING,                /* "..." */

-    JSON_N_TYPES

+    JSON_N_TYPES,

+    JSON_SERIALIZED_OBJECT,     /* Internal type to hold serialized version of

+                                 * data of other types. */

 };

 const char *json_type_to_string(enum json_type);

@@ -70,7 +72,7 @@ struct json {

         struct json_array array;

         long long int integer;

         double real;

-        char *string;

+        char *string; /* JSON_STRING or JSON_SERIALIZED_OBJECT. */

     };

 };

@@ -78,6 +80,7 @@ struct json *json_null_create(void);

 struct json *json_boolean_create(bool);

 struct json *json_string_create(const char *);

 struct json *json_string_create_nocopy(char *);

+struct json *json_serialized_object_create(const struct json *);

 struct json *json_integer_create(long long int);

 struct json *json_real_create(double);

@@ -99,6 +102,7 @@ void json_object_put_format(struct json *,

     OVS_PRINTF_FORMAT(3, 4);

 const char *json_string(const struct json *);

+const char *json_serialized_object(const struct json *);

 struct json_array *json_array(const struct json *);

 struct shash *json_object(const struct json *);

 bool json_boolean(const struct json *);

@@ -125,6 +129,7 @@ struct json *json_parser_finish(struct json_parser *);

 void json_parser_abort(struct json_parser *);

 struct json *json_from_string(const char *string);

+struct json *json_from_serialized_object(const struct json *);

 struct json *json_from_file(const char *file_name);

 struct json *json_from_stream(FILE *stream);

diff --git a/include/openvswitch/meta-flow.h b/include/openvswitch/meta-flow.h

index 95e52e3587..045dce8f5f 100644

--- a/include/openvswitch/meta-flow.h

+++ b/include/openvswitch/meta-flow.h

@@ -2305,6 +2305,7 @@ void mf_set_flow_value_masked(const struct mf_field *,

                               const union mf_value *mask,

                               struct flow *);

 bool mf_is_tun_metadata(const struct mf_field *);

+bool mf_is_frozen_metadata(const struct mf_field *);

 bool mf_is_pipeline_field(const struct mf_field *);

 bool mf_is_set(const struct mf_field *, const struct flow *);

 void mf_mask_field(const struct mf_field *, struct flow_wildcards *);

diff --git a/lib/db-ctl-base.c b/lib/db-ctl-base.c

index 77cc76a9f6..7074561588 100644

--- a/lib/db-ctl-base.c

+++ b/lib/db-ctl-base.c

@@ -247,15 +247,15 @@ record_id_equals(const union ovsdb_atom *name, enum ovsdb_atomic_type type,

                  const char *record_id)

 {

     if (type == OVSDB_TYPE_STRING) {

-        if (!strcmp(name->string, record_id)) {

+        if (!strcmp(name->s->string, record_id)) {

             return true;

         }

         struct uuid uuid;

         size_t len = strlen(record_id);

         if (len >= 4

-            && uuid_from_string(&uuid, name->string)

-            && !strncmp(name->string, record_id, len)) {

+            && uuid_from_string(&uuid, name->s->string)

+            && !strncmp(name->s->string, record_id, len)) {

             return true;

         }

@@ -314,15 +314,19 @@ get_row_by_id(struct ctl_context *ctx,

             row, id->name_column, key, value);

         /* Extract the name from the column. */

-        const union ovsdb_atom *name;

+        const union ovsdb_atom *name = NULL;

         if (!id->key) {

             name = datum->n == 1 ? &datum->keys[0] : NULL;

         } else {

-            const union ovsdb_atom key_atom

-                = { .string = CONST_CAST(char *, id->key) };

-            unsigned int i = ovsdb_datum_find_key(datum, &key_atom,

-                                                  OVSDB_TYPE_STRING);

-            name = i == UINT_MAX ? NULL : &datum->values[i];

+            union ovsdb_atom key_atom = {

+                .s = ovsdb_atom_string_create(CONST_CAST(char *, id->key)) };

+            unsigned int i;

+

+            if (ovsdb_datum_find_key(datum, &key_atom,

+                                     OVSDB_TYPE_STRING, &i)) {

+                name = &datum->values[i];

+            }

+            ovsdb_atom_destroy(&key_atom, OVSDB_TYPE_STRING);

         }

         if (!name) {

             continue;

@@ -819,14 +823,14 @@ check_condition(const struct ovsdb_idl_table_class *table,

             goto out;

         }

-        idx = ovsdb_datum_find_key(have_datum,

-                                   &want_key, column->type.key.type);

-        if (idx == UINT_MAX && !is_set_operator(operator)) {

+        bool found = ovsdb_datum_find_key(have_datum, &want_key,

+                                          column->type.key.type, &idx);

+        if (!found && !is_set_operator(operator)) {

             retval = false;

         } else {

             struct ovsdb_datum a;

-            if (idx != UINT_MAX) {

+            if (found) {

                 a.n = 1;

                 a.keys = &have_datum->values[idx];

                 a.values = NULL;

@@ -992,9 +996,8 @@ cmd_get(struct ctl_context *ctx)

                 return;

             }

-            idx = ovsdb_datum_find_key(datum, &key,

-                                       column->type.key.type);

-            if (idx == UINT_MAX) {

+            if (!ovsdb_datum_find_key(datum, &key,

+                                      column->type.key.type, &idx)) {

                 if (must_exist) {

                     ctl_error(

                         ctx, "no key \"%s\" in %s record \"%s\" column %s",

@@ -1375,7 +1378,7 @@ set_column(const struct ovsdb_idl_table_class *table,

         ovsdb_atom_destroy(&value, column->type.value.type);

         ovsdb_datum_union(&datum, ovsdb_idl_read(row, column),

-                          &column->type, false);

+                          &column->type);

         ovsdb_idl_txn_verify(row, column);

         ovsdb_idl_txn_write(row, column, &datum);

     } else {

@@ -1514,7 +1517,7 @@ cmd_add(struct ctl_context *ctx)

             ovsdb_datum_destroy(&old, &column->type);

             return;

         }

-        ovsdb_datum_union(&old, &add, type, false);

+        ovsdb_datum_union(&old, &add, type);

         ovsdb_datum_destroy(&add, type);

     }

     if (old.n > type->n_max) {

diff --git a/lib/dp-packet.h b/lib/dp-packet.h

index 08d93c2779..3dc582fbfd 100644

--- a/lib/dp-packet.h

+++ b/lib/dp-packet.h

@@ -199,6 +199,7 @@ struct dp_packet *dp_packet_clone_data_with_headroom(const void *, size_t,

 void dp_packet_resize(struct dp_packet *b, size_t new_headroom,

                       size_t new_tailroom);

 static inline void dp_packet_delete(struct dp_packet *);

+static inline void dp_packet_swap(struct dp_packet *, struct dp_packet *);

 static inline void *dp_packet_at(const struct dp_packet *, size_t offset,

                                  size_t size);

@@ -256,6 +257,18 @@ dp_packet_delete(struct dp_packet *b)

     }

 }

+/* Swaps content of two packets. */

+static inline void

+dp_packet_swap(struct dp_packet *a, struct dp_packet *b)

+{

+    ovs_assert(a->source == DPBUF_MALLOC || a->source == DPBUF_STUB);

+    ovs_assert(b->source == DPBUF_MALLOC || b->source == DPBUF_STUB);

+    struct dp_packet c = *a;

+

+    *a = *b;

+    *b = c;

+}

+

 /* If 'b' contains at least 'offset + size' bytes of data, returns a pointer to

  * byte 'offset'.  Otherwise, returns a null pointer. */

 static inline void *

diff --git a/lib/dpdk-stub.c b/lib/dpdk-stub.c

index b7d577870d..fe24f9abdf 100644

--- a/lib/dpdk-stub.c

+++ b/lib/dpdk-stub.c

@@ -83,7 +83,7 @@ bool

 dpdk_get_cpu_has_isa(const char *arch OVS_UNUSED,

                      const char *feature OVS_UNUSED)

 {

-    VLOG_ERR_ONCE("DPDK not supported in this version of Open vSwitch, "

+    VLOG_DBG_ONCE("DPDK not supported in this version of Open vSwitch, "

                   "cannot use CPU flag based optimizations");

     return false;

 }

diff --git a/lib/dpif-netdev-private-dfc.h b/lib/dpif-netdev-private-dfc.h

index 92092ebec9..3dfc91f0fe 100644

--- a/lib/dpif-netdev-private-dfc.h

+++ b/lib/dpif-netdev-private-dfc.h

@@ -59,7 +59,8 @@ extern "C" {

  * Thread-safety

  * =============

  *

- * Each pmd_thread has its own private exact match cache.

+ * Each pmd_thread has its own private exact match cache and signature match

+ * cache.

  * If dp_netdev_input is not called from a pmd thread, a mutex is used.

  */

diff --git a/lib/dpif-netdev-private-thread.h b/lib/dpif-netdev-private-thread.h

index a782d9678a..ac4885538c 100644

--- a/lib/dpif-netdev-private-thread.h

+++ b/lib/dpif-netdev-private-thread.h

@@ -78,10 +78,10 @@ struct dp_netdev_pmd_thread {

     struct ovs_refcount ref_cnt;    /* Every reference must be refcount'ed. */

     struct cmap_node node;          /* In 'dp->poll_threads'. */

-    /* Per thread exact-match cache.  Note, the instance for cpu core

-     * NON_PMD_CORE_ID can be accessed by multiple threads, and thusly

-     * need to be protected by 'non_pmd_mutex'.  Every other instance

-     * will only be accessed by its own pmd thread. */

+    /* Per thread exact match cache and signature match cache.  Note, the

+     * instance for cpu core NON_PMD_CORE_ID can be accessed by multiple

+     * threads, and thusly need to be protected by 'non_pmd_mutex'.  Every

+     * other instance will only be accessed by its own pmd thread. */

     OVS_ALIGNED_VAR(CACHE_LINE_SIZE) struct dfc_cache flow_cache;

     /* Flow-Table and classifiers

diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c

index bddce75b63..d6bee2a5a9 100644

--- a/lib/dpif-netdev.c

+++ b/lib/dpif-netdev.c

@@ -4061,7 +4061,10 @@ dpif_netdev_execute(struct dpif *dpif, struct dpif_execute *execute)

                                flow_hash_5tuple(execute->flow, 0));

     }

-    dp_packet_batch_init_packet(&pp, execute->packet);

+    /* Making a copy because the packet might be stolen during the execution

+     * and caller might still need it.  */

+    struct dp_packet *packet_clone = dp_packet_clone(execute->packet);

+    dp_packet_batch_init_packet(&pp, packet_clone);

     dp_netdev_execute_actions(pmd, &pp, false, execute->flow,

                               execute->actions, execute->actions_len);

     dp_netdev_pmd_flush_output_packets(pmd, true);

@@ -4071,6 +4074,24 @@ dpif_netdev_execute(struct dpif *dpif, struct dpif_execute *execute)

         dp_netdev_pmd_unref(pmd);

     }

+    if (dp_packet_batch_size(&pp) == 1) {

+        /* Packet wasn't dropped during the execution.  Swapping content with

+         * the original packet, because the caller might expect actions to

+         * modify it.  Uisng the packet from a batch instead of 'packet_clone'

+         * because it maybe stolen and replaced by other packet, e.g. by

+         * the fragmentation engine. */

+        dp_packet_swap(execute->packet, pp.packets[0]);

+        dp_packet_delete_batch(&pp, true);

+    } else if (dp_packet_batch_size(&pp)) {

+        /* FIXME: We have more packets than expected.  Likely, we got IP

+         * fragments of the reassembled packet.  Dropping them here as we have

+         * no way to get them to the caller.  It might be that all the required

+         * actions with them are already executed, but it also might not be a

+         * case, e.g. if dpif_netdev_execute() called to execute a single

+         * tunnel push. */

+        dp_packet_delete_batch(&pp, true);

+    }

+

     return 0;

 }

diff --git a/lib/dpif-netlink.c b/lib/dpif-netlink.c

index 34fc042373..5f4b60c5a6 100644

--- a/lib/dpif-netlink.c

+++ b/lib/dpif-netlink.c

@@ -84,6 +84,8 @@ enum { MAX_PORTS = USHRT_MAX };

 #define EPOLLEXCLUSIVE (1u << 28)

 #endif

+#define OVS_DP_F_UNSUPPORTED (1 << 31);

+

 /* This PID is not used by the kernel datapath when using dispatch per CPU,

  * but it is required to be set (not zero). */

 #define DPIF_NETLINK_PER_CPU_PID UINT32_MAX

@@ -382,36 +384,62 @@ dpif_netlink_open(const struct dpif_class *class OVS_UNUSED, const char *name,

         dp_request.cmd = OVS_DP_CMD_SET;

     }

-    /* The Open vSwitch kernel module has two modes for dispatching upcalls:

-     * per-vport and per-cpu.

-     *

-     * When dispatching upcalls per-vport, the kernel will

-     * send the upcall via a Netlink socket that has been selected based on the

-     * vport that received the packet that is causing the upcall.

-     *

-     * When dispatching upcall per-cpu, the kernel will send the upcall via

-     * a Netlink socket that has been selected based on the cpu that received

-     * the packet that is causing the upcall.

-     *

-     * First we test to see if the kernel module supports per-cpu dispatching

-     * (the preferred method). If it does not support per-cpu dispatching, we

-     * fall back to the per-vport dispatch mode.

+    /* Some older kernels will not reject unknown features. This will cause

+     * 'ovs-vswitchd' to incorrectly assume a feature is supported. In order to

+     * test for that, we attempt to set a feature that we know is not supported

+     * by any kernel. If this feature is not rejected, we can assume we are

+     * running on one of these older kernels.

      */

     dp_request.user_features |= OVS_DP_F_UNALIGNED;

-    dp_request.user_features &= ~OVS_DP_F_VPORT_PIDS;

-    dp_request.user_features |= OVS_DP_F_DISPATCH_UPCALL_PER_CPU;

+    dp_request.user_features |= OVS_DP_F_VPORT_PIDS;

+    dp_request.user_features |= OVS_DP_F_UNSUPPORTED;

     error = dpif_netlink_dp_transact(&dp_request, &dp, &buf;;

     if (error) {

-        dp_request.user_features &= ~OVS_DP_F_DISPATCH_UPCALL_PER_CPU;

+        /* The Open vSwitch kernel module has two modes for dispatching

+         * upcalls: per-vport and per-cpu.

+         *

+         * When dispatching upcalls per-vport, the kernel will

+         * send the upcall via a Netlink socket that has been selected based on

+         * the vport that received the packet that is causing the upcall.

+         *

+         * When dispatching upcall per-cpu, the kernel will send the upcall via

+         * a Netlink socket that has been selected based on the cpu that

+         * received the packet that is causing the upcall.

+         *

+         * First we test to see if the kernel module supports per-cpu

+         * dispatching (the preferred method). If it does not support per-cpu

+         * dispatching, we fall back to the per-vport dispatch mode.

+         */

+        dp_request.user_features &= ~OVS_DP_F_UNSUPPORTED;

+        dp_request.user_features |= OVS_DP_F_UNALIGNED;

+        dp_request.user_features &= ~OVS_DP_F_VPORT_PIDS;

+        dp_request.user_features |= OVS_DP_F_DISPATCH_UPCALL_PER_CPU;

+        error = dpif_netlink_dp_transact(&dp_request, &dp, &buf;;

+        if (error) {

+            dp_request.user_features &= ~OVS_DP_F_DISPATCH_UPCALL_PER_CPU;

+            dp_request.user_features |= OVS_DP_F_VPORT_PIDS;

+            error = dpif_netlink_dp_transact(&dp_request, &dp, &buf;;

+        }

+        if (error) {

+            return error;

+        }

+

+        error = open_dpif(&dp, dpifp);

+        dpif_netlink_set_features(*dpifp, OVS_DP_F_TC_RECIRC_SHARING);

+    } else {

+        VLOG_INFO("Kernel does not correctly support feature negotiation. "

+                  "Using standard features.");

+        dp_request.cmd = OVS_DP_CMD_SET;

+        dp_request.user_features = 0;

+        dp_request.user_features |= OVS_DP_F_UNALIGNED;

         dp_request.user_features |= OVS_DP_F_VPORT_PIDS;

         error = dpif_netlink_dp_transact(&dp_request, &dp, &buf;;

-    }

-    if (error) {

-        return error;

+        if (error) {

+            return error;

+        }

+        error = open_dpif(&dp, dpifp);

     }

-    error = open_dpif(&dp, dpifp);

-    dpif_netlink_set_features(*dpifp, OVS_DP_F_TC_RECIRC_SHARING);

     ofpbuf_delete(buf);

     if (create) {

diff --git a/lib/ipf.c b/lib/ipf.c

index d9f781147a..507db2aea2 100644

--- a/lib/ipf.c

+++ b/lib/ipf.c

@@ -943,6 +943,8 @@ ipf_extract_frags_from_batch(struct ipf *ipf, struct dp_packet_batch *pb,

             ovs_mutex_lock(&ipf->ipf_lock);

             if (!ipf_handle_frag(ipf, pkt, dl_type, zone, now, hash_basis)) {

                 dp_packet_batch_refill(pb, pkt, pb_idx);

+            } else {

+                dp_packet_delete(pkt);

             }

             ovs_mutex_unlock(&ipf->ipf_lock);

         } else {

@@ -1152,52 +1154,56 @@ ipf_post_execute_reass_pkts(struct ipf *ipf,

          * NETDEV_MAX_BURST. */

         DP_PACKET_BATCH_REFILL_FOR_EACH (pb_idx, pb_cnt, pkt, pb) {

             if (rp && pkt == rp->list->reass_execute_ctx) {

+                const struct ipf_frag *frag_0 = &rp->list->frag_list[0];

+                void *l4_frag = dp_packet_l4(frag_0->pkt);

+                void *l4_reass = dp_packet_l4(pkt);

+                memcpy(l4_frag, l4_reass, dp_packet_l4_size(frag_0->pkt));

+

                 for (int i = 0; i <= rp->list->last_inuse_idx; i++) {

-                    rp->list->frag_list[i].pkt->md.ct_label = pkt->md.ct_label;

-                    rp->list->frag_list[i].pkt->md.ct_mark = pkt->md.ct_mark;

-                    rp->list->frag_list[i].pkt->md.ct_state = pkt->md.ct_state;

-                    rp->list->frag_list[i].pkt->md.ct_zone = pkt->md.ct_zone;

-                    rp->list->frag_list[i].pkt->md.ct_orig_tuple_ipv6 =

+                    const struct ipf_frag *frag_i = &rp->list->frag_list[i];

+

+                    frag_i->pkt->md.ct_label = pkt->md.ct_label;

+                    frag_i->pkt->md.ct_mark = pkt->md.ct_mark;

+                    frag_i->pkt->md.ct_state = pkt->md.ct_state;

+                    frag_i->pkt->md.ct_zone = pkt->md.ct_zone;

+                    frag_i->pkt->md.ct_orig_tuple_ipv6 =

                         pkt->md.ct_orig_tuple_ipv6;

                     if (pkt->md.ct_orig_tuple_ipv6) {

-                        rp->list->frag_list[i].pkt->md.ct_orig_tuple.ipv6 =

+                        frag_i->pkt->md.ct_orig_tuple.ipv6 =

                             pkt->md.ct_orig_tuple.ipv6;

                     } else {

-                        rp->list->frag_list[i].pkt->md.ct_orig_tuple.ipv4  =

+                        frag_i->pkt->md.ct_orig_tuple.ipv4 =

                             pkt->md.ct_orig_tuple.ipv4;

                     }

-                }

-

-                const struct ipf_frag *frag_0 = &rp->list->frag_list[0];

-                void *l4_frag = dp_packet_l4(frag_0->pkt);

-                void *l4_reass = dp_packet_l4(pkt);

-                memcpy(l4_frag, l4_reass, dp_packet_l4_size(frag_0->pkt));

-

-                if (v6) {

-                    struct ovs_16aligned_ip6_hdr *l3_frag

-                        = dp_packet_l3(frag_0->pkt);

-                    struct ovs_16aligned_ip6_hdr *l3_reass = dp_packet_l3(pkt);

-                    l3_frag->ip6_src = l3_reass->ip6_src;

-                    l3_frag->ip6_dst = l3_reass->ip6_dst;

-                } else {

-                    struct ip_header *l3_frag = dp_packet_l3(frag_0->pkt);

-                    struct ip_header *l3_reass = dp_packet_l3(pkt);

-                    if (!dp_packet_hwol_is_ipv4(frag_0->pkt)) {

-                        ovs_be32 reass_ip =

-                            get_16aligned_be32(&l3_reass->ip_src);

-                        ovs_be32 frag_ip =

-                            get_16aligned_be32(&l3_frag->ip_src);

-

-                        l3_frag->ip_csum = recalc_csum32(l3_frag->ip_csum,

-                                                         frag_ip, reass_ip);

-                        reass_ip = get_16aligned_be32(&l3_reass->ip_dst);

-                        frag_ip = get_16aligned_be32(&l3_frag->ip_dst);

-                        l3_frag->ip_csum = recalc_csum32(l3_frag->ip_csum,

-                                                         frag_ip, reass_ip);

+                    if (v6) {