diff --git a/Documentation/ref/ovs-actions.7.rst b/Documentation/ref/ovs-actions.7.rst

index b59b7634f..d13895655 100644

--- a/Documentation/ref/ovs-actions.7.rst

+++ b/Documentation/ref/ovs-actions.7.rst

@@ -1380,7 +1380,7 @@ The ``delete_field`` action

   | ``delete_field:``\ *field*

 The ``delete_field`` action deletes a *field* in the syntax described under

-`Field Specifications`_ above.  Currently, only the ``tun_metadta`` fields are

+`Field Specifications`_ above.  Currently, only the ``tun_metadata`` fields are

 supported.

 This action was added in Open vSwitch 2.14.

diff --git a/NEWS b/NEWS

index 37a01dea5..e59f9530b 100644

--- a/NEWS

+++ b/NEWS

@@ -1,3 +1,12 @@

+v3.1.2 - xx xxx xxxx

+--------------------

+

+v3.1.1 - 06 Apr 2023

+--------------------

+   - Bug fixes

+   - Security:

+     * Fixed vulnerability CVE-2023-1668.

+

 v3.1.0 - 16 Feb 2023

 --------------------

    - ovs-vswitchd now detects changes in CPU affinity and adjusts the number

diff --git a/configure.ac b/configure.ac

index 9bf896c01..78a7ae31a 100644

--- a/configure.ac

+++ b/configure.ac

@@ -13,7 +13,7 @@

 # limitations under the License.

 AC_PREREQ(2.63)

-AC_INIT(openvswitch, 3.1.0, bugs@openvswitch.org)

+AC_INIT(openvswitch, 3.1.2, bugs@openvswitch.org)

 AC_CONFIG_SRCDIR([vswitchd/ovs-vswitchd.c])

 AC_CONFIG_MACRO_DIR([m4])

 AC_CONFIG_AUX_DIR([build-aux])

diff --git a/debian/changelog b/debian/changelog

index a5ad222c4..4663a2c29 100644

--- a/debian/changelog

+++ b/debian/changelog

@@ -1,3 +1,15 @@

+openvswitch (3.1.2-1) unstable; urgency=low

+   [ Open vSwitch team ]

+   * New upstream version

+

+ -- Open vSwitch team <dev@openvswitch.org>  Thu, 06 Apr 2023 15:10:30 +0200

+

+openvswitch (3.1.1-1) unstable; urgency=low

+   [ Open vSwitch team ]

+   * New upstream version

+

+ -- Open vSwitch team <dev@openvswitch.org>  Thu, 06 Apr 2023 15:10:30 +0200

+

 openvswitch (3.1.0-1) unstable; urgency=low

    * New upstream version

diff --git a/include/openvswitch/meta-flow.h b/include/openvswitch/meta-flow.h

index 045dce8f5..3b0220aaa 100644

--- a/include/openvswitch/meta-flow.h

+++ b/include/openvswitch/meta-flow.h

@@ -2366,6 +2366,10 @@ void mf_format_subvalue(const union mf_subvalue *subvalue, struct ds *s);

 void field_array_set(enum mf_field_id id, const union mf_value *,

                      struct field_array *);

+/* Mask the required l3 prerequisites if a 'set' action occurs. */

+void mf_set_mask_l3_prereqs(const struct mf_field *, const struct flow *,

+                            struct flow_wildcards *);

+

 #ifdef __cplusplus

 }

 #endif

diff --git a/lib/classifier.c b/lib/classifier.c

index 0a89626cc..18dbfc83a 100644

--- a/lib/classifier.c

+++ b/lib/classifier.c

@@ -1695,6 +1695,8 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,

     const struct cls_match *rule = NULL;

     struct flowmap stages_map = FLOWMAP_EMPTY_INITIALIZER;

     unsigned int mask_offset = 0;

+    bool adjust_ports_mask = false;

+    ovs_be32 ports_mask;

     int i;

     /* Try to finish early by checking fields in segments. */

@@ -1722,6 +1724,9 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,

                     subtable->index_maps[i], flow, wc)) {

         goto no_match;

     }

+    /* Accumulate the map used so far. */

+    stages_map = flowmap_or(stages_map, subtable->index_maps[i]);

+

     hash = flow_hash_in_minimask_range(flow, &subtable->mask,

                                        subtable->index_maps[i],

                                        &mask_offset, &basis);

@@ -1731,14 +1736,16 @@ find_match_wc(const struct cls_subtable *subtable, ovs_version_t version,

          * unwildcarding all the ports bits, use the ports trie to figure out a

          * smaller set of bits to unwildcard. */

         unsigned int mbits;

-        ovs_be32 value, plens, mask;

+        ovs_be32 value, plens;

-        mask = miniflow_get_ports(&subtable->mask.masks);

-        value = ((OVS_FORCE ovs_be32 *)flow)[TP_PORTS_OFS32] & mask;

+        ports_mask = miniflow_get_ports(&subtable->mask.masks);

+        value = ((OVS_FORCE ovs_be32 *) flow)[TP_PORTS_OFS32] & ports_mask;

         mbits = trie_lookup_value(&subtable->ports_trie, &value, &plens, 32);

-        ((OVS_FORCE ovs_be32 *)&wc->masks)[TP_PORTS_OFS32] |=

-            mask & be32_prefix_mask(mbits);

+        ports_mask &= be32_prefix_mask(mbits);

+        ports_mask |= ((OVS_FORCE ovs_be32 *) &wc->masks)[TP_PORTS_OFS32];

+

+        adjust_ports_mask = true;

         goto no_match;

     }

@@ -1751,6 +1758,14 @@ no_match:

     /* Unwildcard the bits in stages so far, as they were used in determining

      * there is no match. */

     flow_wildcards_fold_minimask_in_map(wc, &subtable->mask, stages_map);

+    if (adjust_ports_mask) {

+        /* This has to be done after updating flow wildcards to overwrite

+         * the ports mask back.  We can't simply disable the corresponding bit

+         * in the stages map, because it has 64-bit resolution, i.e. one

+         * bit covers not only tp_src/dst, but also ct_tp_src/dst, which are

+         * not covered by the trie. */

+        ((OVS_FORCE ovs_be32 *) &wc->masks)[TP_PORTS_OFS32] = ports_mask;

+    }

     return NULL;

 }

diff --git a/lib/conntrack-tp.h b/lib/conntrack-tp.h

index 4d411d19f..7ece2eae2 100644

--- a/lib/conntrack-tp.h

+++ b/lib/conntrack-tp.h

@@ -17,8 +17,15 @@

 #ifndef CONNTRACK_TP_H

 #define CONNTRACK_TP_H 1

+#include <stdint.h>

+

 #define CT_DPIF_NETDEV_TP_MIN 30

+

 enum ct_timeout;

+struct conn;

+struct conntrack;

+struct timeout_policy;

+

 void timeout_policy_init(struct conntrack *ct);

 int timeout_policy_update(struct conntrack *ct, struct timeout_policy *tp);

 int timeout_policy_delete(struct conntrack *ct, uint32_t tp_id);

diff --git a/lib/conntrack.c b/lib/conntrack.c

index 524670e45..8cf7779c6 100644

--- a/lib/conntrack.c

+++ b/lib/conntrack.c

@@ -1512,12 +1512,12 @@ conntrack_clean(struct conntrack *ct, long long now)

     clean_end = n_conn_limit / 64;

     for (i = ct->next_sweep; i < N_EXP_LISTS; i++) {

-        count += ct_sweep(ct, &ct->exp_lists[i], now);

-

         if (count > clean_end) {

             next_wakeup = 0;

             break;

         }

+

+        count += ct_sweep(ct, &ct->exp_lists[i], now);

     }

     ct->next_sweep = (i < N_EXP_LISTS) ? i : 0;

diff --git a/lib/db-ctl-base.c b/lib/db-ctl-base.c

index 134496ef3..5d2635946 100644

--- a/lib/db-ctl-base.c

+++ b/lib/db-ctl-base.c

@@ -1492,7 +1492,7 @@ cmd_add(struct ctl_context *ctx)

     const struct ovsdb_idl_column *column;

     const struct ovsdb_idl_row *row;

     const struct ovsdb_type *type;

-    struct ovsdb_datum new;

+    struct ovsdb_datum old;

     int i;

     ctx->error = get_table(table_name, &table);

@@ -1516,13 +1516,7 @@ cmd_add(struct ctl_context *ctx)

     }

     type = &column->type;

-

-    if (ctx->last_command) {

-        ovsdb_datum_init_empty(&new;;

-    } else {

-        ovsdb_datum_clone(&new, ovsdb_idl_read(row, column));

-    }

-

+    ovsdb_datum_clone(&old, ovsdb_idl_read(row, column));

     for (i = 4; i < ctx->argc; i++) {

         struct ovsdb_type add_type;

         struct ovsdb_datum add;

@@ -1533,41 +1527,23 @@ cmd_add(struct ctl_context *ctx)

         ctx->error = ovsdb_datum_from_string(&add, &add_type, ctx->argv[i],

                                              ctx->symtab);

         if (ctx->error) {

-            ovsdb_datum_destroy(&new, &column->type);

+            ovsdb_datum_destroy(&old, &column->type);

             return;

         }

-        ovsdb_datum_union(&new, &add, type);

+        ovsdb_datum_union(&old, &add, type);

         ovsdb_datum_destroy(&add, type);

     }

-

-    if (!ctx->last_command && new.n > type->n_max) {

+    if (old.n > type->n_max) {

         ctl_error(ctx, "\"add\" operation would put %u %s in column %s of "

                   "table %s but the maximum number is %u",

-                  new.n,

+                  old.n,

                   type->value.type == OVSDB_TYPE_VOID ? "values" : "pairs",

                   column->name, table->name, type->n_max);

-        ovsdb_datum_destroy(&new, &column->type);

+        ovsdb_datum_destroy(&old, &column->type);

         return;

     }

-

-    if (ctx->last_command) {

-        /* Partial updates can only be made one by one. */

-        for (i = 0; i < new.n; i++) {

-            struct ovsdb_datum *datum = xmalloc(sizeof *datum);

-

-            ovsdb_datum_init_empty(datum);

-            ovsdb_datum_add_from_index_unsafe(datum, &new, i, type);

-            if (ovsdb_type_is_map(type)) {

-                ovsdb_idl_txn_write_partial_map(row, column, datum);

-            } else {

-                ovsdb_idl_txn_write_partial_set(row, column, datum);

-            }

-        }

-        ovsdb_datum_destroy(&new, &column->type);

-    } else {

-        ovsdb_idl_txn_verify(row, column);

-        ovsdb_idl_txn_write(row, column, &new;;

-    }

+    ovsdb_idl_txn_verify(row, column);

+    ovsdb_idl_txn_write(row, column, &old;;

     invalidate_cache(ctx);

 }

diff --git a/lib/dpctl.c b/lib/dpctl.c

index d12d9b8a5..970373389 100644

--- a/lib/dpctl.c

+++ b/lib/dpctl.c

@@ -1713,10 +1713,16 @@ dpctl_flush_conntrack(int argc, const char *argv[],

     uint16_t zone, *pzone = NULL;

     int error;

     int args = argc - 1;

+    int zone_pos = 1;

+

+    if (dp_arg_exists(argc, argv)) {

+        args--;

+        zone_pos = 2;

+    }

     /* Parse zone. */

-    if (args && !strncmp(argv[1], "zone=", 5)) {

-        if (!ovs_scan(argv[1], "zone=%"SCNu16, &zone)) {

+    if (args && !strncmp(argv[zone_pos], "zone=", 5)) {

+        if (!ovs_scan(argv[zone_pos], "zone=%"SCNu16, &zone)) {

             ds_put_cstr(&ds, "failed to parse zone");

             error = EINVAL;

             goto error;

@@ -1744,7 +1750,7 @@ dpctl_flush_conntrack(int argc, const char *argv[],

     }

     /* Report error if there is more than one unparsed argument. */

-    if (args > 1) {

+    if (args > 0) {

         ds_put_cstr(&ds, "invalid arguments");

         error = EINVAL;

         goto error;

diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c

index c9f7179c3..aed2c8fbb 100644

--- a/lib/dpif-netdev.c

+++ b/lib/dpif-netdev.c

@@ -9616,6 +9616,7 @@ dpif_netdev_bond_stats_get(struct dpif *dpif, uint32_t bond_id,

 const struct dpif_class dpif_netdev_class = {

     "netdev",

     true,                       /* cleanup_required */

+    true,                       /* synced_dp_layers */

     dpif_netdev_init,

     dpif_netdev_enumerate,

     dpif_netdev_port_open_type,

diff --git a/lib/dpif-netlink.c b/lib/dpif-netlink.c

index 026b0daa8..2f829f589 100644

--- a/lib/dpif-netlink.c

+++ b/lib/dpif-netlink.c

@@ -2582,7 +2582,7 @@ dpif_netlink_calculate_n_handlers(void)

         n_handlers = MIN(next_prime_num, total_cores);

     }

-    return n_handlers;

+    return MAX(n_handlers, 1);

 }

 static int

@@ -4515,6 +4515,7 @@ dpif_netlink_cache_set_size(struct dpif *dpif_, uint32_t level, uint32_t size)

 const struct dpif_class dpif_netlink_class = {

     "system",

     false,                      /* cleanup_required */

+    false,                      /* synced_dp_layers */

     NULL,                       /* init */

     dpif_netlink_enumerate,

     NULL,

diff --git a/lib/dpif-provider.h b/lib/dpif-provider.h

index 12477a24f..b8ead8a02 100644

--- a/lib/dpif-provider.h

+++ b/lib/dpif-provider.h

@@ -127,6 +127,14 @@ struct dpif_class {

      * datapaths that can not exist without it (e.g. netdev datapath).  */

     bool cleanup_required;

+    /* If 'true' the specific dpif implementation synchronizes the various

+     * datapath implementation layers, i.e., the dpif's layer in combination

+     * with the underlying netdev offload layers. For example, dpif-netlink

+     * does not sync its kernel flows with the tc ones, i.e., only one gets

+     * installed. On the other hand, dpif-netdev installs both flows,

+     * internally keeps track of both, and represents them as one. */

+    bool synced_dp_layers;

+

     /* Called when the dpif provider is registered, typically at program

      * startup.  Returning an error from this function will prevent any

      * datapath with this class from being created.

diff --git a/lib/dpif.c b/lib/dpif.c

index fe4db83fb..3305401fe 100644

--- a/lib/dpif.c

+++ b/lib/dpif.c

@@ -2109,3 +2109,9 @@ dpif_cache_set_size(struct dpif *dpif, uint32_t level, uint32_t size)

            ? dpif->dpif_class->cache_set_size(dpif, level, size)

            : EOPNOTSUPP;

 }

+

+bool

+dpif_synced_dp_layers(struct dpif *dpif)

+{

+    return dpif->dpif_class->synced_dp_layers;

+}

diff --git a/lib/dpif.h b/lib/dpif.h

index 6cb4dae6d..129cbf6a1 100644

--- a/lib/dpif.h

+++ b/lib/dpif.h

@@ -939,6 +939,7 @@ int dpif_get_pmds_for_port(const struct dpif * dpif, odp_port_t port_no,

 char *dpif_get_dp_version(const struct dpif *);

 bool dpif_supports_tnl_push_pop(const struct dpif *);

 bool dpif_supports_explicit_drop_action(const struct dpif *);

+bool dpif_synced_dp_layers(struct dpif *);

 /* Log functions. */

 struct vlog_module;

diff --git a/lib/meta-flow.c b/lib/meta-flow.c

index c576ae620..474344194 100644

--- a/lib/meta-flow.c

+++ b/lib/meta-flow.c

@@ -3676,3 +3676,28 @@ mf_bitmap_not(struct mf_bitmap x)

     bitmap_not(x.bm, MFF_N_IDS);

     return x;

 }

+

+void

+mf_set_mask_l3_prereqs(const struct mf_field *mf, const struct flow *fl,

+                       struct flow_wildcards *wc)

+{

+    if (is_ip_any(fl) &&

+        ((mf->id == MFF_IPV4_SRC) ||

+         (mf->id == MFF_IPV4_DST) ||

+         (mf->id == MFF_IPV6_SRC) ||

+         (mf->id == MFF_IPV6_DST) ||

+         (mf->id == MFF_IPV6_LABEL) ||

+         (mf->id == MFF_IP_DSCP) ||

+         (mf->id == MFF_IP_ECN) ||

+         (mf->id == MFF_IP_TTL))) {

+        WC_MASK_FIELD(wc, nw_proto);

+    } else if ((fl->dl_type == htons(ETH_TYPE_ARP)) &&

+               ((mf->id == MFF_ARP_OP) ||

+                (mf->id == MFF_ARP_SHA) ||

+                (mf->id == MFF_ARP_THA) ||

+                (mf->id == MFF_ARP_SPA) ||

+                (mf->id == MFF_ARP_TPA))) {

+        /* mask only the lower 8 bits. */

+        wc->masks.nw_proto = 0xff;

+    }

+}

diff --git a/lib/netdev-offload-tc.c b/lib/netdev-offload-tc.c

index 4c78c4816..c38247423 100644

--- a/lib/netdev-offload-tc.c

+++ b/lib/netdev-offload-tc.c

@@ -276,8 +276,9 @@ del_filter_and_ufid_mapping(struct tcf_id *id, const ovs_u128 *ufid,

     }

     err = tc_del_flower_filter(id);

-    if (!err) {

+    if (!err || err == ENODEV) {

         del_ufid_tc_mapping(ufid);

+        return 0;

     }

     return err;

 }

@@ -871,7 +872,7 @@ parse_tc_flower_to_actions__(struct tc_flower *flower, struct ofpbuf *buf,

                 outport =

                     netdev_ifindex_to_odp_port(action->out.ifindex_out);

                 if (!outport) {

-                    return ENOENT;

+                    return -ENOENT;

                 }

             }

             nl_msg_put_u32(buf, OVS_ACTION_ATTR_OUTPUT, odp_to_u32(outport));

@@ -964,7 +965,7 @@ parse_tc_flower_to_actions__(struct tc_flower *flower, struct ofpbuf *buf,

             uint32_t meter_id;

             if (police_idx_lookup(action->police.index, &meter_id)) {

-                return ENOENT;

+                return -ENOENT;

             }

             nl_msg_put_u32(buf, OVS_ACTION_ATTR_METER, meter_id);

         }

@@ -983,6 +984,9 @@ parse_tc_flower_to_actions__(struct tc_flower *flower, struct ofpbuf *buf,

                 buf, OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER);

             i = parse_tc_flower_to_actions__(flower, buf, i + 1,

                                              action->police.result_jump);

+            if (i < 0) {

+                return i;

+            }

             nl_msg_end_nested(buf, act_offset);

             act_offset = nl_msg_start_nested(

@@ -994,6 +998,9 @@ parse_tc_flower_to_actions__(struct tc_flower *flower, struct ofpbuf *buf,

             }

             if (jump != 0) {

                 i = parse_tc_flower_to_actions__(flower, buf, i, jump);

+                if (i < 0) {

+                    return i;

+                }

             }

             nl_msg_end_nested(buf, act_offset);

@@ -1013,11 +1020,11 @@ parse_tc_flower_to_actions__(struct tc_flower *flower, struct ofpbuf *buf,

     return i;

 }

-static void

+static int

 parse_tc_flower_to_actions(struct tc_flower *flower,

                            struct ofpbuf *buf)

 {

-    parse_tc_flower_to_actions__(flower, buf, 0, 0);

+    return parse_tc_flower_to_actions__(flower, buf, 0, 0);

 }

 static int

@@ -1030,9 +1037,10 @@ parse_tc_flower_to_match(const struct netdev *netdev,

                          struct ofpbuf *buf,

                          bool terse)

 {

-    size_t act_off;

     struct tc_flower_key *key = &flower->key;

     struct tc_flower_key *mask = &flower->mask;

+    size_t act_off;

+    int err;

     if (terse) {

         return parse_tc_flower_terse_to_match(flower, match, stats, attrs);

@@ -1229,7 +1237,10 @@ parse_tc_flower_to_match(const struct netdev *netdev,

     }

     act_off = nl_msg_start_nested(buf, OVS_FLOW_ATTR_ACTIONS);

-    parse_tc_flower_to_actions(flower, buf);

+    err = parse_tc_flower_to_actions(flower, buf);

+    if (err < 0) {

+        return -err;

+    }

     nl_msg_end_nested(buf, act_off);

     *actions = ofpbuf_at_assert(buf, act_off, sizeof(struct nlattr));

@@ -1272,8 +1283,8 @@ netdev_tc_flow_dump_next(struct netdev_flow_dump *dump,

             continue;

         }

-        if (flower.act_cookie.len) {

-            *ufid = *((ovs_u128 *) flower.act_cookie.data);

+        if (flower.act_cookie.len >= sizeof *ufid) {

+            *ufid = get_32aligned_u128(flower.act_cookie.data);

         } else if (!find_ufid(netdev, &id, ufid)) {

             continue;

         }

@@ -2490,15 +2501,23 @@ netdev_tc_flow_get(struct netdev *netdev,

     err = tc_get_flower(&id, &flower);

     if (err) {

-        VLOG_ERR_RL(&error_rl, "flow get failed (dev %s prio %d handle %d): %s",

+        VLOG_ERR_RL(&error_rl,

+                    "flow get failed (dev %s prio %d handle %d): %s",

                     netdev_get_name(netdev), id.prio, id.handle,

                     ovs_strerror(err));

         return err;

     }

     in_port = netdev_ifindex_to_odp_port(id.ifindex);

-    parse_tc_flower_to_match(netdev, &flower, match, actions,

-                             stats, attrs, buf, false);

+    err = parse_tc_flower_to_match(netdev, &flower, match, actions,

+                                   stats, attrs, buf, false);

+    if (err) {

+        VLOG_ERR_RL(&error_rl,

+                    "flow get parse failed (dev %s prio %d handle %d): %s",

+                    netdev_get_name(netdev), id.prio, id.handle,

+                    ovs_strerror(err));

+        return err;

+    }

     if (stats) {

         struct dpif_flow_stats adjust_stats;

diff --git a/lib/netdev-windows.c b/lib/netdev-windows.c

index 4ad45ffa1..3fad501e3 100644

--- a/lib/netdev-windows.c

+++ b/lib/netdev-windows.c

@@ -156,6 +156,7 @@ netdev_windows_system_construct(struct netdev *netdev_)

     struct netdev_windows_netdev_info info;

     struct ofpbuf *buf;

     int ret;

+    const char    *type = NULL;

     /* Query the attributes and runtime status of the netdev. */

     ret = query_netdev(netdev_get_name(&netdev->up), &info, &buf;;

@@ -167,6 +168,16 @@ netdev_windows_system_construct(struct netdev *netdev_)

     }

     ofpbuf_delete(buf);

+    /* Don't create netdev if ovs-type is "internal"

+     * but the type of netdev->up is "system". */

+    type = netdev_get_type(&netdev->up);

+    if (type && !strcmp(type, "system") &&

+        (info.ovs_type == OVS_VPORT_TYPE_INTERNAL)) {

+        VLOG_DBG("construct device %s, ovs_type: %u failed",

+                 netdev_get_name(&netdev->up), info.ovs_type);

+        return 1;

+    }

+

     netdev->change_seq = 1;

     netdev->dev_type = info.ovs_type;

     netdev->port_no = info.port_no;

diff --git a/lib/ovs-thread.c b/lib/ovs-thread.c

index 2d382f1e8..ac5d2c3d0 100644

--- a/lib/ovs-thread.c

+++ b/lib/ovs-thread.c

@@ -674,7 +674,7 @@ count_cpu_cores(void)

     static int cpu_cores;

     ovs_mutex_lock(&cpu_cores_mutex);

-    if (now - last_updated >= COUNT_CPU_UPDATE_TIME_MS) {

+    if (!last_updated || now - last_updated >= COUNT_CPU_UPDATE_TIME_MS) {

         last_updated = now;

         cpu_cores = count_cpu_cores__();

     }

diff --git a/ofproto/ofproto-dpif-ipfix.c b/ofproto/ofproto-dpif-ipfix.c

index 742eed399..f13478a88 100644

--- a/ofproto/ofproto-dpif-ipfix.c

+++ b/ofproto/ofproto-dpif-ipfix.c

@@ -124,11 +124,18 @@ struct dpif_ipfix_port {

     uint32_t ifindex;

 };

+struct dpif_ipfix_domain {

+    struct hmap_node hmap_node; /* In struct dpif_ipfix_exporter's domains. */

+    time_t last_template_set_time;

+};

+

 struct dpif_ipfix_exporter {

     uint32_t exporter_id; /* Exporting Process identifier */

-    struct collectors *collectors;

     uint32_t seq_number;

-    time_t last_template_set_time;

+    struct collectors *collectors;

+    struct hmap domains; /* Contains struct dpif_ipfix_domain indexed by

+                            observation domain id. */

+    time_t last_stats_sent_time;

     struct hmap cache_flow_key_map;  /* ipfix_flow_cache_entry. */

     struct ovs_list cache_flow_start_timestamp_list;  /* ipfix_flow_cache_entry. */

     uint32_t cache_active_timeout;  /* In seconds. */

@@ -617,6 +624,9 @@ static void get_export_time_now(uint64_t *, uint32_t *);

 static void dpif_ipfix_cache_expire_now(struct dpif_ipfix_exporter *, bool);

+static void dpif_ipfix_exporter_del_domain(struct dpif_ipfix_exporter *,

+                                           struct dpif_ipfix_domain *);

+

 static bool

 ofproto_ipfix_bridge_exporter_options_equal(

     const struct ofproto_ipfix_bridge_exporter_options *a,

@@ -697,13 +707,14 @@ dpif_ipfix_exporter_init(struct dpif_ipfix_exporter *exporter)

     exporter->exporter_id = ++exporter_total_count;

     exporter->collectors = NULL;

     exporter->seq_number = 1;

-    exporter->last_template_set_time = 0;

+    exporter->last_stats_sent_time = 0;

     hmap_init(&exporter->cache_flow_key_map);

     ovs_list_init(&exporter->cache_flow_start_timestamp_list);

     exporter->cache_active_timeout = 0;

     exporter->cache_max_flows = 0;

     exporter->virtual_obs_id = NULL;

     exporter->virtual_obs_len = 0;

+    hmap_init(&exporter->domains);

     memset(&exporter->ipfix_global_stats, 0,

            sizeof(struct dpif_ipfix_global_stats));

@@ -711,6 +722,7 @@ dpif_ipfix_exporter_init(struct dpif_ipfix_exporter *exporter)

 static void

 dpif_ipfix_exporter_clear(struct dpif_ipfix_exporter *exporter)

+    OVS_REQUIRES(mutex)

 {

     /* Flush the cache with flow end reason "forced end." */

     dpif_ipfix_cache_expire_now(exporter, true);

@@ -719,22 +731,29 @@ dpif_ipfix_exporter_clear(struct dpif_ipfix_exporter *exporter)

     exporter->exporter_id = 0;

     exporter->collectors = NULL;

     exporter->seq_number = 1;

-    exporter->last_template_set_time = 0;

+    exporter->last_stats_sent_time = 0;

     exporter->cache_active_timeout = 0;

     exporter->cache_max_flows = 0;

     free(exporter->virtual_obs_id);

     exporter->virtual_obs_id = NULL;

     exporter->virtual_obs_len = 0;

+    struct dpif_ipfix_domain *dom;

+    HMAP_FOR_EACH_SAFE (dom, hmap_node, &exporter->domains) {

+        dpif_ipfix_exporter_del_domain(exporter, dom);

+    }

+

     memset(&exporter->ipfix_global_stats, 0,

            sizeof(struct dpif_ipfix_global_stats));

 }

 static void

 dpif_ipfix_exporter_destroy(struct dpif_ipfix_exporter *exporter)

+    OVS_REQUIRES(mutex)

 {

     dpif_ipfix_exporter_clear(exporter);

     hmap_destroy(&exporter->cache_flow_key_map);

+    hmap_destroy(&exporter->domains);

 }

 static bool

@@ -742,7 +761,7 @@ dpif_ipfix_exporter_set_options(struct dpif_ipfix_exporter *exporter,

                                 const struct sset *targets,

                                 const uint32_t cache_active_timeout,

                                 const uint32_t cache_max_flows,

-                                const char *virtual_obs_id)

+                                const char *virtual_obs_id) OVS_REQUIRES(mutex)

 {

     size_t virtual_obs_len;

     collectors_destroy(exporter->collectors);

@@ -769,6 +788,37 @@ dpif_ipfix_exporter_set_options(struct dpif_ipfix_exporter *exporter,

     return true;

 }

+static struct dpif_ipfix_domain *

+dpif_ipfix_exporter_find_domain(const struct dpif_ipfix_exporter *exporter,

+                                uint32_t domain_id) OVS_REQUIRES(mutex)

+{

+    struct dpif_ipfix_domain *dom;

+    HMAP_FOR_EACH_WITH_HASH (dom, hmap_node, hash_int(domain_id, 0),

+                             &exporter->domains) {

+        return dom;

+    }

+    return NULL;

+}

+

+static struct dpif_ipfix_domain *

+dpif_ipfix_exporter_insert_domain(struct dpif_ipfix_exporter *exporter,

+                                  const uint32_t domain_id) OVS_REQUIRES(mutex)

+{

+    struct dpif_ipfix_domain *dom = xmalloc(sizeof *dom);

+    dom->last_template_set_time = 0;

+    hmap_insert(&exporter->domains, &dom->hmap_node, hash_int(domain_id, 0));

+    return dom;

+}

+

+static void

+dpif_ipfix_exporter_del_domain(struct dpif_ipfix_exporter *exporter,

+                               struct dpif_ipfix_domain *dom)

+    OVS_REQUIRES(mutex)

+{

+    hmap_remove(&exporter->domains, &dom->hmap_node);

+    free(dom);

+}

+

 static struct dpif_ipfix_port *

 dpif_ipfix_find_port(const struct dpif_ipfix *di,

                      odp_port_t odp_port) OVS_REQUIRES(mutex)

@@ -909,6 +959,7 @@ dpif_ipfix_bridge_exporter_init(struct dpif_ipfix_bridge_exporter *exporter)

 static void

 dpif_ipfix_bridge_exporter_clear(struct dpif_ipfix_bridge_exporter *exporter)

+    OVS_REQUIRES(mutex)

 {

     dpif_ipfix_exporter_clear(&exporter->exporter);

     ofproto_ipfix_bridge_exporter_options_destroy(exporter->options);

@@ -918,6 +969,7 @@ dpif_ipfix_bridge_exporter_clear(struct dpif_ipfix_bridge_exporter *exporter)

 static void

 dpif_ipfix_bridge_exporter_destroy(struct dpif_ipfix_bridge_exporter *exporter)

+    OVS_REQUIRES(mutex)

 {

     dpif_ipfix_bridge_exporter_clear(exporter);

     dpif_ipfix_exporter_destroy(&exporter->exporter);

@@ -927,7 +979,7 @@ static void

 dpif_ipfix_bridge_exporter_set_options(

     struct dpif_ipfix_bridge_exporter *exporter,

     const struct ofproto_ipfix_bridge_exporter_options *options,

-    bool *options_changed)

+    bool *options_changed) OVS_REQUIRES(mutex)

 {

     if (!options || sset_is_empty(&options->targets)) {

         /* No point in doing any work if there are no targets. */

@@ -1003,6 +1055,7 @@ dpif_ipfix_flow_exporter_init(struct dpif_ipfix_flow_exporter *exporter)

 static void

 dpif_ipfix_flow_exporter_clear(struct dpif_ipfix_flow_exporter *exporter)

+    OVS_REQUIRES(mutex)

 {

     dpif_ipfix_exporter_clear(&exporter->exporter);

     ofproto_ipfix_flow_exporter_options_destroy(exporter->options);

@@ -1011,6 +1064,7 @@ dpif_ipfix_flow_exporter_clear(struct dpif_ipfix_flow_exporter *exporter)

 static void

 dpif_ipfix_flow_exporter_destroy(struct dpif_ipfix_flow_exporter *exporter)

+    OVS_REQUIRES(mutex)

 {

     dpif_ipfix_flow_exporter_clear(exporter);

     dpif_ipfix_exporter_destroy(&exporter->exporter);

@@ -1020,7 +1074,7 @@ static bool

 dpif_ipfix_flow_exporter_set_options(

     struct dpif_ipfix_flow_exporter *exporter,

     const struct ofproto_ipfix_flow_exporter_options *options,

-    bool *options_changed)

+    bool *options_changed) OVS_REQUIRES(mutex)

 {

     if (sset_is_empty(&options->targets)) {

         /* No point in doing any work if there are no targets. */

@@ -1071,6 +1125,7 @@ dpif_ipfix_flow_exporter_set_options(

 static void

 remove_flow_exporter(struct dpif_ipfix *di,

                      struct dpif_ipfix_flow_exporter_map_node *node)

+                     OVS_REQUIRES(mutex)

 {

     hmap_remove(&di->flow_exporter_map, &node->node);

     dpif_ipfix_flow_exporter_destroy(&node->exporter);

@@ -2000,6 +2055,7 @@ static void

 ipfix_cache_update(struct dpif_ipfix_exporter *exporter,

                    struct ipfix_flow_cache_entry *entry,

                    enum ipfix_sampled_packet_type sampled_pkt_type)

+                   OVS_REQUIRES(mutex)

 {

     struct ipfix_flow_cache_entry *old_entry;

     size_t current_flows = 0;

@@ -2811,14 +2867,36 @@ dpif_ipfix_flow_sample(struct dpif_ipfix *di, const struct dp_packet *packet,

     ovs_mutex_unlock(&mutex);

 }

+static bool

+dpif_ipfix_should_send_template(struct dpif_ipfix_exporter *exporter,

+                                const uint32_t observation_domain_id,

+                                const uint32_t export_time_sec)

+    OVS_REQUIRES(mutex)

+{

+    struct dpif_ipfix_domain *domain;

+    domain = dpif_ipfix_exporter_find_domain(exporter,

+                                             observation_domain_id);

+    if (!domain) {

+        /* First time we see this obs_domain_id. */

+        domain = dpif_ipfix_exporter_insert_domain(exporter,

+                                                   observation_domain_id);

+    }

+

+    if ((domain->last_template_set_time + IPFIX_TEMPLATE_INTERVAL)

+        <= export_time_sec) {

+        domain->last_template_set_time = export_time_sec;

+        return true;

+    }

+    return false;

+}

+

 static void

 dpif_ipfix_cache_expire(struct dpif_ipfix_exporter *exporter,

                         bool forced_end, const uint64_t export_time_usec,

-                        const uint32_t export_time_sec)

+                        const uint32_t export_time_sec) OVS_REQUIRES(mutex)

 {

     struct ipfix_flow_cache_entry *entry;

     uint64_t max_flow_start_timestamp_usec;

-    bool template_msg_sent = false;

     enum ipfix_flow_end_reason flow_end_reason;

     if (ovs_list_is_empty(&exporter->cache_flow_start_timestamp_list)) {

@@ -2844,25 +2922,28 @@ dpif_ipfix_cache_expire(struct dpif_ipfix_exporter *exporter,

             break;

         }

-        ovs_list_remove(&entry->cache_flow_start_timestamp_list_node);

-        hmap_remove(&exporter->cache_flow_key_map,

-                    &entry->flow_key_map_node);

+        /* XXX: Make frequency of the (Options) Template and Exporter Process

+         * Statistics transmission configurable.

+         * Cf. IETF RFC 5101 Section 4.3. and 10.3.6. */

+        if ((exporter->last_stats_sent_time + IPFIX_TEMPLATE_INTERVAL)

+             <= export_time_sec) {

+            exporter->last_stats_sent_time = export_time_sec;

+            ipfix_send_exporter_data_msg(exporter, export_time_sec);

+        }

-         /* XXX: Make frequency of the (Options) Template and Exporter Process

-          * Statistics transmission configurable.

-          * Cf. IETF RFC 5101 Section 4.3. and 10.3.6. */

-        if (!template_msg_sent

-            && (exporter->last_template_set_time + IPFIX_TEMPLATE_INTERVAL)

-                <= export_time_sec) {

+        if (dpif_ipfix_should_send_template(exporter,

+                                            entry->flow_key.obs_domain_id,

+                                            export_time_sec)) {

+            VLOG_DBG("Sending templates for ObservationDomainID %"PRIu32,

+                     entry->flow_key.obs_domain_id);

             ipfix_send_template_msgs(exporter, export_time_sec,

                                      entry->flow_key.obs_domain_id);

-            exporter->last_template_set_time = export_time_sec;

-            template_msg_sent = true;

-

-            /* Send Exporter Process Statistics. */

-            ipfix_send_exporter_data_msg(exporter, export_time_sec);

         }

+        ovs_list_remove(&entry->cache_flow_start_timestamp_list_node);

+        hmap_remove(&exporter->cache_flow_key_map,

+                    &entry->flow_key_map_node);

+

         /* XXX: Group multiple data records for the same obs domain id

          * into the same message. */

         ipfix_send_data_msg(exporter, export_time_sec, entry, flow_end_reason);

@@ -2883,7 +2964,7 @@ get_export_time_now(uint64_t *export_time_usec, uint32_t *export_time_sec)

 static void

 dpif_ipfix_cache_expire_now(struct dpif_ipfix_exporter *exporter,

-                            bool forced_end)

+                            bool forced_end) OVS_REQUIRES(mutex)

 {

     uint64_t export_time_usec;

     uint32_t export_time_sec;

diff --git a/ofproto/ofproto-dpif-upcall.c b/ofproto/ofproto-dpif-upcall.c

index e05ffe312..89df92242 100644

--- a/ofproto/ofproto-dpif-upcall.c

+++ b/ofproto/ofproto-dpif-upcall.c

@@ -47,17 +47,20 @@

 #define UPCALL_MAX_BATCH 64

 #define REVALIDATE_MAX_BATCH 50

+#define UINT64_THREE_QUARTERS (UINT64_MAX / 4 * 3)

 VLOG_DEFINE_THIS_MODULE(ofproto_dpif_upcall);

 COVERAGE_DEFINE(dumped_duplicate_flow);

 COVERAGE_DEFINE(dumped_new_flow);

 COVERAGE_DEFINE(handler_duplicate_upcall);

-COVERAGE_DEFINE(upcall_ukey_contention);