diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml

index 724e3e2f0f..d90b9273a6 100644

--- a/.github/workflows/build-and-test.yml

+++ b/.github/workflows/build-and-test.yml

@@ -610,7 +610,7 @@ jobs:

   build-linux-rpm:

     name: linux rpm fedora

     runs-on: ubuntu-latest

-    container: fedora:39

+    container: fedora:41

     timeout-minutes: 30

     strategy:

diff --git a/AUTHORS.rst b/AUTHORS.rst

index 05c2fb7046..8454641758 100644

--- a/AUTHORS.rst

+++ b/AUTHORS.rst

@@ -312,6 +312,7 @@ Mark Kavanagh                      mark.b.kavanagh81@gmail.com

 Mark Maglana                       mmaglana@gmail.com

 Mark Michelson                     mmichels@redhat.com

 Markos Chandras                    mchandras@suse.de

+Markus Linnala                     markus.linnala@gmail.com

 Martin Casado                      casado@cs.stanford.edu

 Martin Fong                        mwfong@csl.sri.com

 Martin Kalcok                      martin.kalcok@canonical.com

diff --git a/Documentation/faq/releases.rst b/Documentation/faq/releases.rst

index c9acc1e80e..1368f52b84 100644

--- a/Documentation/faq/releases.rst

+++ b/Documentation/faq/releases.rst

@@ -216,12 +216,13 @@ Q: What DPDK version does each Open vSwitch release work with?

     2.14.x       19.11.13

     2.15.x       20.11.6

     2.16.x       20.11.6

-    2.17.x       21.11.8

-    3.0.x        21.11.8

-    3.1.x        22.11.6

-    3.2.x        22.11.6

-    3.3.x        23.11.2

-    3.4.x        23.11.2

+    2.17.x       21.11.9

+    3.0.x        21.11.9

+    3.1.x        22.11.7

+    3.2.x        22.11.7

+    3.3.x        23.11.3

+    3.4.x        23.11.3

+    3.5.x        24.11.1

     ============ ========

 Q: Are all the DPDK releases that OVS versions work with maintained?

diff --git a/Documentation/intro/install/general.rst b/Documentation/intro/install/general.rst

index 42b7172891..0f3cb4e496 100644

--- a/Documentation/intro/install/general.rst

+++ b/Documentation/intro/install/general.rst

@@ -166,7 +166,7 @@ other than plain text, only if you have the following:

 If you are going to extensively modify Open vSwitch, consider installing the

 following to obtain better warnings:

-- "sparse" version 0.6.2 or later

+- "sparse" version 0.6.4 or later

   (https://git.kernel.org/pub/scm/devel/sparse/sparse.git/).

 - GNU make.

diff --git a/Documentation/ref/ovs-flowviz.8.rst b/Documentation/ref/ovs-flowviz.8.rst

index e8d84d995e..54adff498a 100644

--- a/Documentation/ref/ovs-flowviz.8.rst

+++ b/Documentation/ref/ovs-flowviz.8.rst

@@ -52,7 +52,7 @@ them in one of the predefined *format*\ s.

 Options

 =======

-.. program: ovs-flowviz

+.. program:: ovs-flowviz

 .. option:: -h, --help

@@ -151,6 +151,8 @@ option.

 Arguments:

+.. program:: ovs-flowviz [datapath|openflow] console

+

 .. option:: -h, --heat-map

    Color of the packet and byte counters to reflect their relative size.

@@ -201,6 +203,8 @@ A logical block is a set of flows that have:

 Arguments:

+.. program:: ovs-flowviz openflow logic

+

 .. option:: -s, --show-flows

     Show all the flows under each logical block.

@@ -277,6 +281,8 @@ same tree-like flow hierarchy that the ``tree`` format prints.

 Arguments:

+.. program:: ovs-flowviz datapath console

+

 .. option:: -h, --html

     Print the graphviz format as an svg image alongside an interactive HTML

diff --git a/Documentation/ref/ovs-sim.1.rst b/Documentation/ref/ovs-sim.1.rst

index f59cd7af7a..60971de3c7 100644

--- a/Documentation/ref/ovs-sim.1.rst

+++ b/Documentation/ref/ovs-sim.1.rst

@@ -58,7 +58,7 @@ such privileges.

 Options

 =======

-.. program: ovs-sim

+.. program:: ovs-sim

 *script*

     Runs *script*, which should be a Bash script, within a subshell

diff --git a/Documentation/topics/userspace-tso.rst b/Documentation/topics/userspace-tso.rst

index ae08496bdd..ed4d36edd1 100644

--- a/Documentation/topics/userspace-tso.rst

+++ b/Documentation/topics/userspace-tso.rst

@@ -109,9 +109,9 @@ then started again. OvS will then report::

 Limitations

 ~~~~~~~~~~~

-The current OvS userspace `TSO` implementation supports flat and VLAN networks

-only (i.e. no support for `TSO` over tunneled connection [VxLAN, GRE, IPinIP,

-etc.]).

+The current OvS userspace `TSO` implementation supports flat, VLAN networks,

+and some tunneled connections.  Currently only VxLAN, Geneve and GRE tunnels

+are supported.

 The NIC driver must support and advertise checksum offload for TCP and UDP.

 However, SCTP is not mandatory because very few drivers advertised support

@@ -120,11 +120,11 @@ in Open vSwitch. Currently, if the NIC supports that, then the feature is

 enabled, otherwise TSO can still be enabled but SCTP packets sent to the NIC

 will be dropped.

-There is no software implementation of TSO, so all ports attached to the

-datapath must support TSO or packets using that feature will be dropped

-on ports without TSO support.  That also means guests using vhost-user

-in client mode will receive TSO packet regardless of TSO being enabled

-or disabled within the guest.

+There is a limited software implementation of TSO when tunnels are used which

+only supports VxLAN, Geneve, and GRE.  When these tunnels are used with TSO,

+not all ports attached to the datapath need to support hardware TSO.

+Guests using vhost-user in client mode will receive TSO packet regardless of

+TSO being enabled or disabled within the guest.

 All kernel devices that use the raw socket interface (veth, for example)

 require the kernel commit 9d2f67e43b73 ("net/packet: fix packet drop as of

diff --git a/Makefile.am b/Makefile.am

index dc5c34a6ae..a61a1cadfb 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -339,6 +339,8 @@ check-tabs:

 	fi

 .PHONY: check-tabs

+# NOTE: test-lib-route-table.c excluded due to use of system() to execute

+#       ip route commands provided as arguments by test suite.

 ALL_LOCAL += thread-safety-check

 thread-safety-check:

 	@cd $(srcdir); \

@@ -346,7 +348,8 @@ thread-safety-check:

 	  grep -n -f build-aux/thread-safety-forbidden \

 	    `git ls-files | grep '\.[ch]$$' \

 	      | $(EGREP) -v '^datapath-windows|^lib/sflow|^third-party'` /dev/null \

-	      | $(EGREP) -v ':[ 	]*/?\*'; \

+	      | $(EGREP) -v ':[ 	]*/?\*' \

+	      | $(EGREP) -v '^tests/test-lib-route-table.c'; \

 	then \

 	  echo "See above for list of calls to functions that are"; \

 	  echo "forbidden due to thread safety issues"; \

diff --git a/NEWS b/NEWS

index 83f0513797..ec2f85c015 100644

--- a/NEWS

+++ b/NEWS

@@ -1,4 +1,4 @@

-Post-v3.4.0

+v3.5.0 - xx xxx xxxx

 --------------------

    - The limit on the number of fields for address prefix tracking in flow

      tables increased from 3 to 4.  For example, it is now possible to

@@ -31,6 +31,8 @@ Post-v3.4.0

        that does not have a specific value defined, rather than being

        treated as a global value, aligning the behavior with that of

        the kernel datapath.

+     * Extended the support for TSO software fallback to include support for

+       VXLAN, Geneve, and GRE tunneled packets.

    - Linux TC offload:

      * Add support for matching tunnel flags if the kernel supports it.

      * Add support for the "Don't Fragment" (DF) flag in the encap action,

@@ -55,6 +57,8 @@ Post-v3.4.0

        to make it not configure any crypto options (ike/esp) for connections.

        Most useful in combination with '--root-ipsec-conf' where system-wide

        crypto-policy is included from the root ipsec.conf.

+     * New option '--ovs-monitor-ipsec-options' for 'ovs-ctl start-ovs-ipsec'

+       to pass above new options to ovs-monitor-ipsec.

 v3.4.0 - 15 Aug 2024

diff --git a/configure.ac b/configure.ac

index 266e9d4799..2b19888775 100644

--- a/configure.ac

+++ b/configure.ac

@@ -13,7 +13,7 @@

 # limitations under the License.

 AC_PREREQ(2.63)

-AC_INIT(openvswitch, 3.4.90, bugs@openvswitch.org)

+AC_INIT(openvswitch, 3.5.0, bugs@openvswitch.org)

 AC_CONFIG_SRCDIR([vswitchd/ovs-vswitchd.c])

 AC_CONFIG_MACRO_DIR([m4])

 AC_CONFIG_AUX_DIR([build-aux])

diff --git a/debian/automake.mk b/debian/automake.mk

index fe8febdd3c..7ae4e00e58 100644

--- a/debian/automake.mk

+++ b/debian/automake.mk

@@ -14,6 +14,8 @@ EXTRA_DIST += \

 	debian/openvswitch-common.lintian-overrides \

 	debian/openvswitch-doc.doc-base \

 	debian/openvswitch-doc.install \

+	debian/openvswitch-ipsec.default \

+	debian/openvswitch-ipsec.dirs \

 	debian/openvswitch-ipsec.init \

 	debian/openvswitch-ipsec.install \

 	debian/openvswitch-ipsec.service \

@@ -56,8 +58,6 @@ EXTRA_DIST += \

 	debian/openvswitch-vtep.init \

 	debian/openvswitch-vtep.install \

 	debian/ovs-systemd-reload \

-	debian/patches/ovs-ctl-ipsec.patch \

-	debian/patches/series \

 	debian/python3-openvswitch.install \

 	debian/rules \

 	debian/source/format \

diff --git a/debian/changelog b/debian/changelog

index f1a071141d..3f4e2c56e3 100644

--- a/debian/changelog

+++ b/debian/changelog

@@ -1,8 +1,8 @@

-openvswitch (3.4.90-1) unstable; urgency=low

+openvswitch (3.5.0-1) unstable; urgency=low

    * New upstream version

- -- Open vSwitch team <dev@openvswitch.org>  Mon, 15 Jul 2024 13:00:01 +0100

+ -- Open vSwitch team <dev@openvswitch.org>  Mon, 16 Jan 2025 13:00:01 +0100

 openvswitch (3.4.0-1) unstable; urgency=low

diff --git a/debian/control.in b/debian/control.in

index 47b1f8cdd6..dfcf10bcc4 100644

--- a/debian/control.in

+++ b/debian/control.in

@@ -39,14 +39,17 @@ Rules-Requires-Root: no

 Homepage: http://openvswitch.org/

 Vcs-Browser: https://salsa.debian.org/openstack-team/third-party/openvswitch/-/tree/debian/experimental

 Vcs-Git: https://salsa.debian.org/openstack-team/third-party/openvswitch.git

+X-Python3-Version: >= 3.10

 Package: openvswitch-common

 Architecture: linux-any

 Depends:

  openssl,

  ${misc:Depends},

- ${python3:Depends},

  ${shlibs:Depends},

+Recommends:

+ python3-openvswitch (= ${binary:Version}),

+ ${python3:Depends},

 Suggests:

  ethtool,

  openvswitch-doc,

@@ -94,7 +97,6 @@ Depends:

  python3-openvswitch (= ${source:Version}),

  strongswan,

  ${misc:Depends},

- ${shlibs:Depends},

 Suggests: python3:any

 Breaks:

  openvswitch-common (<< 2.17~),

@@ -154,12 +156,13 @@ Depends:

  netbase,

  openvswitch-common (= ${binary:Version}),

  procps,

- python3-netifaces,

- python3-openvswitch (>= ${source:Version}),

  uuid-runtime,

  ${misc:Depends},

- ${python3:Depends},

  ${shlibs:Depends},

+Recommends:

+ python3-netifaces,

+ python3-openvswitch (>= ${source:Version}),

+ ${python3:Depends},

 Breaks:

  openvswitch-common (<< 2.17~),

 Replaces:

@@ -183,7 +186,6 @@ Description: Open vSwitch switch implementations

 # DPDK_NETDEV  dpdk,

 # DPDK_NETDEV  openvswitch-switch (= ${binary:Version}),

 # DPDK_NETDEV  ${misc:Depends},

-# DPDK_NETDEV  ${python3:Depends},

 # DPDK_NETDEV  ${shlibs:Depends},

 # DPDK_NETDEV Enhances:

 # DPDK_NETDEV  openvswitch-switch,

@@ -258,7 +260,6 @@ Depends:

  openvswitch-switch (>= ${binary:Version}),

  python3-openvswitch (>= ${source:Version}),

  ${misc:Depends},

- ${python3:Depends},

  ${shlibs:Depends},

 Suggests: python3:any

 Breaks:

@@ -284,12 +285,13 @@ Depends:

  ${misc:Depends},

  ${python3:Depends},

  ${shlibs:Depends},

-Suggests:

+Recommends:

  python3-click,

- python3-graphviz,

  python3-netaddr,

  python3-pyparsing,

  python3-rich,

+Suggests:

+ python3-graphviz,

  python3-unbound,

 Description: Python 3 bindings for Open vSwitch

  Open vSwitch is a production quality, multilayer, software-based,

diff --git a/debian/openvswitch-common.install b/debian/openvswitch-common.install

index 9bdb43a6f2..5fef8de74e 100644

--- a/debian/openvswitch-common.install

+++ b/debian/openvswitch-common.install

@@ -1,6 +1,7 @@

 etc/bash_completion.d/ovs-appctl-bashcomp.bash usr/share/bash-completion/completions

 usr/bin/ovs-appctl

 usr/bin/ovs-docker

+usr/bin/ovs-flowviz

 usr/bin/ovs-ofctl

 usr/bin/ovs-parse-backtrace

 usr/bin/ovs-pki

@@ -20,6 +21,7 @@ usr/share/man/man7/ovsdb-server.7

 usr/share/man/man7/ovsdb.7

 usr/share/man/man8/ovs-appctl.8

 usr/share/man/man8/ovs-bugtool.8

+usr/share/man/man8/ovs-flowviz.8

 usr/share/man/man8/ovs-ofctl.8

 usr/share/man/man8/ovs-parse-backtrace.8

 usr/share/man/man8/ovs-pki.8

diff --git a/debian/openvswitch-ipsec.default b/debian/openvswitch-ipsec.default

new file mode 100644

index 0000000000..a074948591

--- /dev/null

+++ b/debian/openvswitch-ipsec.default

@@ -0,0 +1,5 @@

+# This is a POSIX shell fragment                -*- sh -*-

+

+# OVS_CTL_OPTS: Extra options to pass to ovs-ctl.  This is, for example,

+# a suitable place to specify --no-restart-ike-daemon.

+# OVS_CTL_OPTS=

diff --git a/debian/openvswitch-ipsec.dirs b/debian/openvswitch-ipsec.dirs

new file mode 100644

index 0000000000..4b83f29661

--- /dev/null

+++ b/debian/openvswitch-ipsec.dirs

@@ -0,0 +1 @@

+/usr/share/openvswitch/ipsec

diff --git a/debian/openvswitch-ipsec.init b/debian/openvswitch-ipsec.init

index aa68384547..4fc7701b83 100755

--- a/debian/openvswitch-ipsec.init

+++ b/debian/openvswitch-ipsec.init

@@ -41,6 +41,8 @@ test -x $DAEMON || exit 0

 . /lib/lsb/init-functions

+test -e /etc/default/openvswitch-ipsec && . /etc/default/openvswitch-ipsec

+

 DODTIME=10              # Time to wait for the server to die, in seconds

                         # If this value is set too low you might not

                         # let some servers to die gracefully and

@@ -72,7 +74,8 @@ running() {

 }

 start_server() {

-    ${DATADIR}/scripts/ovs-ctl --ike-daemon=strongswan start-ovs-ipsec

+    ${DATADIR}/scripts/ovs-ctl --ike-daemon=strongswan \

+        start-ovs-ipsec $OVS_CTL_OPTS

     return 0

 }

diff --git a/debian/openvswitch-ipsec.install b/debian/openvswitch-ipsec.install

old mode 100644

new mode 100755

index 31a8945e2f..ae127e2d4d

--- a/debian/openvswitch-ipsec.install

+++ b/debian/openvswitch-ipsec.install

@@ -1 +1,3 @@

+#!/usr/bin/dh-exec

+debian/openvswitch-ipsec.default => /usr/share/openvswitch/ipsec/default.template

 usr/share/openvswitch/scripts/ovs-monitor-ipsec

diff --git a/debian/openvswitch-ipsec.service b/debian/openvswitch-ipsec.service

index 608a6a6188..2f92def514 100644

--- a/debian/openvswitch-ipsec.service

+++ b/debian/openvswitch-ipsec.service

@@ -6,8 +6,10 @@ After=openvswitch-switch.service

 [Service]

 Type=forking

 PIDFile=/run/openvswitch/ovs-monitor-ipsec.pid

-ExecStart=/usr/share/openvswitch/scripts/ovs-ctl \

-                    --ike-daemon=strongswan start-ovs-ipsec

+Restart=on-failure

+EnvironmentFile=-/etc/default/openvswitch-ipsec

+ExecStart=/usr/share/openvswitch/scripts/ovs-ctl --no-monitor \

+                    --ike-daemon=strongswan start-ovs-ipsec $OVS_CTL_OPTS

 ExecStop=/usr/share/openvswitch/scripts/ovs-ctl stop-ovs-ipsec

 [Install]

diff --git a/debian/openvswitch-switch.ovs-vswitchd.service b/debian/openvswitch-switch.ovs-vswitchd.service

index 519d80d8ed..a4d445b953 100644

--- a/debian/openvswitch-switch.ovs-vswitchd.service

+++ b/debian/openvswitch-switch.ovs-vswitchd.service

@@ -11,6 +11,7 @@ DefaultDependencies=no

 [Service]

 LimitNOFILE=1048576

 Type=forking

+PIDFile=/run/openvswitch/ovs-vswitchd.pid

 Restart=on-failure

 Environment=HOME=/var/run/openvswitch

 EnvironmentFile=-/etc/default/openvswitch-switch

diff --git a/debian/openvswitch-switch.ovsdb-server.service b/debian/openvswitch-switch.ovsdb-server.service

index 339665b255..35654d7059 100644

--- a/debian/openvswitch-switch.ovsdb-server.service

+++ b/debian/openvswitch-switch.ovsdb-server.service

@@ -8,6 +8,7 @@ DefaultDependencies=no

 [Service]

 LimitNOFILE=1048576

 Type=forking

+PIDFile=/run/openvswitch/ovsdb-server.pid

 Restart=on-failure

 EnvironmentFile=-/etc/default/openvswitch-switch

 ExecStart=/usr/share/openvswitch/scripts/ovs-ctl \

@@ -18,6 +19,3 @@ ExecStop=/usr/share/openvswitch/scripts/ovs-ctl --no-ovs-vswitchd stop

 ExecReload=/usr/share/openvswitch/scripts/ovs-ctl --no-ovs-vswitchd \

           --no-record-hostname \

           --no-monitor restart $OVS_CTL_OPTS

-RuntimeDirectory=openvswitch

-RuntimeDirectoryMode=0755

-RuntimeDirectoryPreserve=yes

diff --git a/debian/openvswitch-test.install b/debian/openvswitch-test.install

index 88c8252805..dfc8ebf302 100644

--- a/debian/openvswitch-test.install

+++ b/debian/openvswitch-test.install

@@ -2,4 +2,5 @@ usr/bin/ovs-l3ping

 usr/bin/ovs-test

 usr/share/man/man8/ovs-l3ping.8

 usr/share/man/man8/ovs-test.8

+usr/share/openvswitch/python/ovstest usr/lib/python3/dist-packages/

 usr/share/openvswitch/scripts/usdt/*

diff --git a/debian/patches/ovs-ctl-ipsec.patch b/debian/patches/ovs-ctl-ipsec.patch

deleted file mode 100644

index 63375cd47d..0000000000

--- a/debian/patches/ovs-ctl-ipsec.patch

+++ /dev/null

@@ -1,18 +0,0 @@

-Description: Don't monitor ipsec daemon

- For Ubuntu systemd will monitor the ovs-monitor-ipsec daemon so

- there is no need to spawn a separate monitor thread to deal with

- restarts.  Doing so has the side effect of confusing systemd into

- monitoring the wrong process.

-Author: James Page <james.page@ubuntu.com>

-Forwarded: not-needed

-

---- a/utilities/ovs-ctl.in

-+++ b/utilities/ovs-ctl.in

-@@ -245,7 +245,7 @@ start_ovs_ipsec () {

-         --pidfile=${rundir}/ovs-monitor-ipsec.pid \

-         --ike-daemon=$IKE_DAEMON \

-         $no_restart \

--        --log-file --detach --monitor unix:${rundir}/db.sock || return 1

-+        --log-file --detach unix:${rundir}/db.sock || return 1

-     return 0

- }

diff --git a/debian/patches/series b/debian/patches/series

deleted file mode 100644

index 87a2a1d97c..0000000000

--- a/debian/patches/series

+++ /dev/null

@@ -1 +0,0 @@

-ovs-ctl-ipsec.patch

diff --git a/debian/python3-openvswitch.install b/debian/python3-openvswitch.install

index e1e8c3a6e1..cd1dae3aff 100644

--- a/debian/python3-openvswitch.install

+++ b/debian/python3-openvswitch.install

@@ -1 +1,6 @@

-usr/share/man/man8/ovs-flowviz.8

+# At the dh_install stage we need to retain python version specific directory

+# tree to support extensions.

+#

+# dh_python will consolidate into usr/lib/python3/dist-packages retaining

+# version specific shared object files.

+usr/lib/python3* usr/lib/

diff --git a/debian/rules b/debian/rules

index b6f905f3cd..6b51b51e16 100755

--- a/debian/rules

+++ b/debian/rules

@@ -16,7 +16,6 @@ else

 PARALLEL =

 endif

-PYTHON3S:=$(shell py3versions -vr)

 DEB_HOST_ARCH?=$(shell dpkg-architecture -qDEB_HOST_ARCH)

 override_dh_auto_configure:

@@ -80,9 +79,26 @@ endif # nodpdk

 endif # i386/amd64/ppc64el

 endif # nocheck

+export PYBUILD_DESTDIR = $(CURDIR)/debian/tmp

+export PYBUILD_DIR = $(CURDIR)/python

+

+pybuild = \

+	export PKG_CONFIG_PATH=$(CURDIR)/debian/tmp/usr/lib/pkgconfig; \

+	export PKG_CONFIG_SYSROOT_DIR=$(CURDIR)/debian/tmp; \

+	export PKG_CONFIG_SYSTEM_INCLUDE_PATH=/; \

+	export PKG_CONFIG_SYSTEM_LIBRARY_PATH=/; \

+	enable_shared=no \

+	extra_cflags="`pkg-config --cflags libopenvswitch`" \

+	extra_libs="-Wl,-Bstatic -lopenvswitch -Wl,-Bdynamic `pkg-config --libs --static libopenvswitch`" \

+	pybuild

+

 override_dh_auto_build:

 	dh_auto_build --sourcedirectory=_debian -- dist distdir=openvswitch

 	dh_auto_build --sourcedirectory=_debian

+	# We need an extra install here so that we can use pkgconfig to

+	# retrieve accurate CFLAGS and LDFLAGS for building Python extensions.

+	dh_auto_install --sourcedirectory=_debian

+	$(pybuild) --build

 ifneq (,$(filter i386 amd64 ppc64el arm64, $(DEB_HOST_ARCH)))

 ifeq (,$(filter nodpdk, $(DEB_BUILD_OPTIONS)))

 	dh_auto_build --sourcedirectory=_dpdk

@@ -91,28 +107,15 @@ endif

 execute_before_dh_auto_clean:

 	find . -name "*.pyc" -delete

+	if test -d $(PYBUILD_DIR)/build; then \

+		pybuild --clean ; \

+	fi

 override_dh_auto_install:

+	# We need to use pybuild to install Python extensions.

+	$(pybuild) --install

 	dh_auto_install --sourcedirectory=_debian

-execute_after_dh_install:

-	set -e && for pyvers in $(PYTHON3S); do \

-		cd python; \

-		export PKG_CONFIG_PATH=$(CURDIR)/debian/tmp/usr/lib/pkgconfig; \

-		export PKG_CONFIG_SYSROOT_DIR=$(CURDIR)/debian/tmp; \

-		export PKG_CONFIG_SYSTEM_INCLUDE_PATH=/; \

-		export PKG_CONFIG_SYSTEM_LIBRARY_PATH=/; \

-		enable_shared=no \

-		extra_cflags="`pkg-config --cflags libopenvswitch`" \

-		extra_libs="-Wl,-Bstatic -lopenvswitch -Wl,-Bdynamic `pkg-config --libs --static libopenvswitch`" \

-		python$$pyvers setup.py install --install-layout=deb \

-			--root $(CURDIR)/debian/python3-openvswitch; \

-		cd ..; \

-		mkdir -p $(CURDIR)/debian/openvswitch-test/usr/lib/python$$pyvers/dist-packages/ovstest; \

-		install -v -D python/ovstest/*.py \

-			$(CURDIR)/debian/openvswitch-test/usr/lib/python$$pyvers/dist-packages/ovstest; \

-	done

-

 override_dh_installinit:

 	dh_installinit --restart-after-upgrade

 	dh_installinit -popenvswitch-switch --name=ovsdb-server --no-start

@@ -134,8 +137,8 @@ override_dh_python3:

 # Helper target for creating snapshots from upstream git

 DATE=$(shell date +%Y%m%d)

 # Upstream branch to track

-BRANCH=branch-3.4

-VERSION=3.4.0

+BRANCH=branch-3.5

+VERSION=3.5.0

 get-orig-snapshot:

 	rm -Rf openvswitch-upstream

diff --git a/include/openvswitch/ofp-ct.h b/include/openvswitch/ofp-ct.h

index d57b626784..ea68c2e605 100644

--- a/include/openvswitch/ofp-ct.h

+++ b/include/openvswitch/ofp-ct.h

@@ -24,6 +24,8 @@

 #include "openflow/nicira-ext.h"

+struct ds;

+

 #ifdef __cplusplus

 extern "C" {

 #endif

diff --git a/include/sparse/automake.mk b/include/sparse/automake.mk

index 45e6202c52..052a1b4b82 100644

--- a/include/sparse/automake.mk

+++ b/include/sparse/automake.mk

@@ -12,10 +12,7 @@ noinst_HEADERS += \

         include/sparse/netinet/ip6.h \

         include/sparse/netpacket/packet.h \

         include/sparse/pthread.h \

-        include/sparse/rte_atomic.h \

-        include/sparse/rte_mbuf.h \

         include/sparse/rte_memcpy.h \

-        include/sparse/rte_trace_point.h \

         include/sparse/sys/socket.h \

         include/sparse/sys/sysmacros.h \

         include/sparse/sys/types.h \

diff --git a/include/sparse/rte_atomic.h b/include/sparse/rte_atomic.h

deleted file mode 100644

index ae49fe5c03..0000000000

--- a/include/sparse/rte_atomic.h

+++ /dev/null

@@ -1,25 +0,0 @@

-/* Copyright (c) 2015 Nicira, Inc.

- *

- * Licensed under the Apache License, Version 2.0 (the "License");

- * you may not use this file except in compliance with the License.

- * You may obtain a copy of the License at:

- *

- *     http://www.apache.org/licenses/LICENSE-2.0

- *

- * Unless required by applicable law or agreed to in writing, software

- * distributed under the License is distributed on an "AS IS" BASIS,

- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

- * See the License for the specific language governing permissions and

- * limitations under the License.

- */

-

-#ifndef __CHECKER__

-#error "Use this header only with sparse.  It is not a correct implementation."

-#endif

-

-/* Fix sparse technicality about types in one of the function calls by just

- * ignoring it. */

-#define __sync_add_and_fetch(a, b) (0)

-

-/* Get actual <rte_atomic.h> definitions for us to annotate and build on. */

-#include_next <rte_atomic.h>

diff --git a/include/sparse/rte_mbuf.h b/include/sparse/rte_mbuf.h

deleted file mode 100644

index 981cdb441f..0000000000

--- a/include/sparse/rte_mbuf.h

+++ /dev/null

@@ -1,29 +0,0 @@

-/* Copyright (c) 2020 Intel, Inc.

- *

- * Licensed under the Apache License, Version 2.0 (the "License");

- * you may not use this file except in compliance with the License.

- * You may obtain a copy of the License at:

- *

- *     http://www.apache.org/licenses/LICENSE-2.0

- *

- * Unless required by applicable law or agreed to in writing, software

- * distributed under the License is distributed on an "AS IS" BASIS,

- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

- * See the License for the specific language governing permissions and

- * limitations under the License.

- */

-

-#ifndef __CHECKER__

-#error "Use this header only with sparse.  It is not a correct implementation."

-#endif

-

-/* sparse doesn't know about gcc atomic builtins. */

-#ifndef __ATOMIC_ACQ_REL

-#define __ATOMIC_ACQ_REL 0

-#define __ATOMIC_RELAXED 1

-#define __atomic_add_fetch(p, val, memorder) (*(p) = *(p) + (val))

-#define __atomic_store_n(p, val, memorder) (*(p) = (val))

-#endif

-

-/* Get actual <rte_mbuf.h> definitions for us to annotate and build on. */

-#include_next <rte_mbuf.h>

diff --git a/include/sparse/rte_trace_point.h b/include/sparse/rte_trace_point.h

deleted file mode 100644

index 8039232754..0000000000

--- a/include/sparse/rte_trace_point.h

+++ /dev/null

@@ -1,28 +0,0 @@

-/* Copyright 2020, Red Hat, Inc.

- *

- * Licensed under the Apache License, Version 2.0 (the "License");

- * you may not use this file except in compliance with the License.

- * You may obtain a copy of the License at:

- *

- *     http://www.apache.org/licenses/LICENSE-2.0

- *

- * Unless required by applicable law or agreed to in writing, software

- * distributed under the License is distributed on an "AS IS" BASIS,

- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

- * See the License for the specific language governing permissions and

- * limitations under the License.

- */

-

-#ifndef __CHECKER__

-#error "Use this header only with sparse.  It is not a correct implementation."

-#endif

-

-/* sparse doesn't know about gcc atomic builtins. */

-#ifndef __ATOMIC_ACQUIRE

-#define __ATOMIC_ACQUIRE 0

-#define __atomic_load_n(p, memorder) *(p)

-#endif

-

-/* Get actual <rte_trace_point.h> definitions for us to annotate and

- * build on. */

-#include_next <rte_trace_point.h>

diff --git a/lib/dp-packet-gso.c b/lib/dp-packet-gso.c

index 04ebb19da1..2356359772 100644

--- a/lib/dp-packet-gso.c

+++ b/lib/dp-packet-gso.c

@@ -73,8 +73,7 @@ dp_packet_gso_nr_segs(struct dp_packet *p)

     const char *data_tail;

     const char *data_pos;

-    if (dp_packet_hwol_is_tunnel_vxlan(p) ||

-        dp_packet_hwol_is_tunnel_geneve(p)) {

+    if (dp_packet_hwol_is_tunnel(p)) {

         data_pos = dp_packet_get_inner_tcp_payload(p);

     } else {

         data_pos = dp_packet_get_tcp_payload(p);

@@ -105,7 +104,9 @@ dp_packet_gso(struct dp_packet *p, struct dp_packet_batch **batches)

     bool outer_ipv4;

     int hdr_len;

     int seg_len;

-    bool tnl;

+    bool udp_tnl = dp_packet_hwol_is_tunnel_vxlan(p) ||

+                   dp_packet_hwol_is_tunnel_geneve(p);

+    bool gre_tnl = dp_packet_hwol_is_tunnel_gre(p);

     tso_segsz = dp_packet_get_tso_segsz(p);

     if (!tso_segsz) {

@@ -114,11 +115,9 @@ dp_packet_gso(struct dp_packet *p, struct dp_packet_batch **batches)

         return false;

     }

-    if (dp_packet_hwol_is_tunnel_vxlan(p) ||

-        dp_packet_hwol_is_tunnel_geneve(p)) {

+    if (udp_tnl || gre_tnl) {

         outer_ipv4 = dp_packet_hwol_is_outer_ipv4(p);

         tcp_hdr = dp_packet_inner_l4(p);

-        tnl = true;

         if (outer_ipv4) {

             outer_ip_id = ntohs(((struct ip_header *) dp_packet_l3(p))->ip_id);

@@ -130,7 +129,6 @@ dp_packet_gso(struct dp_packet *p, struct dp_packet_batch **batches)

     } else {

         outer_ipv4 = dp_packet_hwol_is_ipv4(p);

         tcp_hdr = dp_packet_l4(p);

-        tnl = false;

         if (outer_ipv4) {

             struct ip_header *ip_hdr = dp_packet_l3(p);

@@ -156,13 +154,15 @@ dp_packet_gso(struct dp_packet *p, struct dp_packet_batch **batches)

         seg = dp_packet_gso_seg_new(p, hdr_len, data_pos, seg_len);

         data_pos += seg_len;

-        if (tnl) {

+        if (udp_tnl) {

             /* Update tunnel UDP header length. */

             struct udp_header *tnl_hdr;

             tnl_hdr = dp_packet_l4(seg);

             tnl_hdr->udp_len = htons(dp_packet_l4_size(seg));

+        }

+        if (udp_tnl || gre_tnl) {

             /* Update tunnel inner L3 header. */

             if (dp_packet_hwol_is_ipv4(seg)) {

                 struct ip_header *ip_hdr = dp_packet_inner_l3(seg);

@@ -194,7 +194,7 @@ dp_packet_gso(struct dp_packet *p, struct dp_packet_batch **batches)

         }

         /* Update L4 header. */

-        if (tnl) {

+        if (udp_tnl || gre_tnl) {

             tcp_hdr = dp_packet_inner_l4(seg);

         } else {

             tcp_hdr = dp_packet_l4(seg);

@@ -208,6 +208,18 @@ dp_packet_gso(struct dp_packet *p, struct dp_packet_batch **batches)

             tcp_hdr->tcp_ctl = TCP_CTL(tcp_flags, tcp_offset);

         }

+        if (gre_tnl) {

+            struct gre_base_hdr *ghdr;

+

+            ghdr = dp_packet_l4(seg);

+

+            if (ghdr->flags & htons(GRE_CSUM)) {

+                ovs_be16 *csum_opt = (ovs_be16 *) (ghdr + 1);

+                *csum_opt = 0;

+                *csum_opt = csum(ghdr, dp_packet_l4_size(seg));

+            }

+        }

+

         if (dp_packet_batch_is_full(curr_batch)) {

             curr_batch++;

         }

diff --git a/lib/dp-packet.c b/lib/dp-packet.c

index df7bf8e6b3..dad0d7be3a 100644

--- a/lib/dp-packet.c

+++ b/lib/dp-packet.c

@@ -604,6 +604,8 @@ dp_packet_ol_send_prepare(struct dp_packet *p, uint64_t flags)

                        NETDEV_TX_OFFLOAD_SCTP_CKSUM |

                        NETDEV_TX_OFFLOAD_IPV4_CKSUM);

         }

+    } else if (dp_packet_hwol_is_tunnel_gre(p)) {

+        tnl_inner = true;

     }

     if (dp_packet_hwol_tx_ip_csum(p)) {

diff --git a/lib/dp-packet.h b/lib/dp-packet.h

index 4afbbe7223..f94a82b07c 100644

--- a/lib/dp-packet.h

+++ b/lib/dp-packet.h

@@ -104,6 +104,9 @@ enum dp_packet_offload_mask {

     /* Offload tunnel packet, outer header is IPv6. */

     DEF_OL_FLAG(DP_PACKET_OL_TX_OUTER_IPV6,

                 RTE_MBUF_F_TX_OUTER_IPV6, 0x40000),

+    /* Offload packet is GRE tunnel. */

+    DEF_OL_FLAG(DP_PACKET_OL_TX_TUNNEL_GRE,

+                RTE_MBUF_F_TX_TUNNEL_GRE, 0x80000),

     /* Adding new field requires adding to DP_PACKET_OL_SUPPORTED_MASK. */

 };

@@ -123,6 +126,7 @@ enum dp_packet_offload_mask {

                                      DP_PACKET_OL_TX_IP_CKSUM        | \

                                      DP_PACKET_OL_TX_TUNNEL_GENEVE   | \

                                      DP_PACKET_OL_TX_TUNNEL_VXLAN    | \

+                                     DP_PACKET_OL_TX_TUNNEL_GRE      | \

                                      DP_PACKET_OL_TX_OUTER_IPV4      | \

                                      DP_PACKET_OL_TX_OUTER_IP_CKSUM  | \

                                      DP_PACKET_OL_TX_OUTER_UDP_CKSUM | \

@@ -1171,6 +1175,22 @@ dp_packet_hwol_is_tunnel_vxlan(struct dp_packet *b)

     return !!(*dp_packet_ol_flags_ptr(b) & DP_PACKET_OL_TX_TUNNEL_VXLAN);

 }

+/* Returns 'true' if packet 'b' is marked for GRE tunnel offloading. */

+static inline bool

+dp_packet_hwol_is_tunnel_gre(struct dp_packet *b)

+{

+    return !!(*dp_packet_ol_flags_ptr(b) & DP_PACKET_OL_TX_TUNNEL_GRE);

+}

+

+/* Returns true if packet 'b' has any offloadable tunnel type. */

+static inline bool

+dp_packet_hwol_is_tunnel(struct dp_packet *b)

+{

+    return !!(*dp_packet_ol_flags_ptr(b) & (DP_PACKET_OL_TX_TUNNEL_VXLAN |

+                                            DP_PACKET_OL_TX_TUNNEL_GRE |

+                                            DP_PACKET_OL_TX_TUNNEL_GENEVE));

+}

+

 /* Returns 'true' if packet 'b' is marked for outer IPv4 checksum offload. */

 static inline bool

 dp_packet_hwol_is_outer_ipv4_cksum(const struct dp_packet *b)

@@ -1289,11 +1309,19 @@ dp_packet_hwol_set_tunnel_vxlan(struct dp_packet *b)

     *dp_packet_ol_flags_ptr(b) |= DP_PACKET_OL_TX_TUNNEL_VXLAN;

 }

+/* Mark packet 'b' for GRE tunnel offloading. */

+static inline void

+dp_packet_hwol_set_tunnel_gre(struct dp_packet *b)

+{

+    *dp_packet_ol_flags_ptr(b) |= DP_PACKET_OL_TX_TUNNEL_GRE;

+}

+

 /* Clears tunnel offloading marks. */

 static inline void

 dp_packet_hwol_reset_tunnel(struct dp_packet *b)

 {