datapath-windows: Make VPORT ovs number values smaller than MAXUINT16
[cascardo/ovs.git] / datapath / flow_netlink.c
index 5a978f0..762ea03 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2013 Nicira, Inc.
+ * Copyright (c) 2007-2014 Nicira, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
 
 #include "flow_netlink.h"
 
-static void update_range__(struct sw_flow_match *match,
-                          size_t offset, size_t size, bool is_mask)
+static void update_range(struct sw_flow_match *match,
+                        size_t offset, size_t size, bool is_mask)
 {
-       struct sw_flow_key_range *range = NULL;
+       struct sw_flow_key_range *range;
        size_t start = rounddown(offset, sizeof(long));
        size_t end = roundup(offset + size, sizeof(long));
 
        if (!is_mask)
                range = &match->range;
-       else if (match->mask)
+       else
                range = &match->mask->range;
 
-       if (!range)
-               return;
-
        if (range->start == range->end) {
                range->start = start;
                range->end = end;
@@ -81,38 +78,41 @@ static void update_range__(struct sw_flow_match *match,
 
 #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \
        do { \
-               update_range__(match, offsetof(struct sw_flow_key, field),  \
-                                    sizeof((match)->key->field), is_mask); \
-               if (is_mask) {                                              \
-                       if ((match)->mask)                                  \
-                               (match)->mask->key.field = value;           \
-               } else {                                                    \
+               update_range(match, offsetof(struct sw_flow_key, field),    \
+                            sizeof((match)->key->field), is_mask);         \
+               if (is_mask)                                                \
+                       (match)->mask->key.field = value;                   \
+               else                                                        \
                        (match)->key->field = value;                        \
-               }                                                           \
        } while (0)
 
-#define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask) \
-       do { \
-               update_range__(match, offset, len, is_mask);                \
-               if (is_mask) {                                              \
-                       if ((match)->mask)                                  \
-                               memcpy((u8 *)&(match)->mask->key + offset, value_p, len);\
-               } else {                                                    \
-                       memcpy((u8 *)(match)->key + offset, value_p, len);         \
-               }                                                           \
+#define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask)            \
+       do {                                                                \
+               update_range(match, offset, len, is_mask);                  \
+               if (is_mask)                                                \
+                       memcpy((u8 *)&(match)->mask->key + offset, value_p, len);\
+               else                                                        \
+                       memcpy((u8 *)(match)->key + offset, value_p, len);  \
        } while (0)
 
-#define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask) \
+#define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask)                      \
        SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \
                                  value_p, len, is_mask)
 
-static u16 range_n_bytes(const struct sw_flow_key_range *range)
-{
-       return range->end - range->start;
-}
+#define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask)             \
+       do {                                                                \
+               update_range(match, offsetof(struct sw_flow_key, field),    \
+                            sizeof((match)->key->field), is_mask);         \
+               if (is_mask)                                                \
+                       memset((u8 *)&(match)->mask->key.field, value,      \
+                              sizeof((match)->mask->key.field));           \
+               else                                                        \
+                       memset((u8 *)&(match)->key->field, value,           \
+                              sizeof((match)->key->field));                \
+       } while (0)
 
 static bool match_validate(const struct sw_flow_match *match,
-                          u64 key_attrs, u64 mask_attrs)
+                          u64 key_attrs, u64 mask_attrs, bool log)
 {
        u64 key_expected = 1ULL << OVS_KEY_ATTR_ETHERNET;
        u64 mask_allowed = key_attrs;  /* At most allow all key attributes */
@@ -222,7 +222,7 @@ static bool match_validate(const struct sw_flow_match *match,
                                                htons(NDISC_NEIGHBOUR_SOLICITATION) ||
                                    match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
                                        key_expected |= 1ULL << OVS_KEY_ATTR_ND;
-                                       if (match->mask && (match->mask->key.tp.src == htons(0xffff)))
+                                       if (match->mask && (match->mask->key.tp.src == htons(0xff)))
                                                mask_allowed |= 1ULL << OVS_KEY_ATTR_ND;
                                }
                        }
@@ -231,21 +231,65 @@ static bool match_validate(const struct sw_flow_match *match,
 
        if ((key_attrs & key_expected) != key_expected) {
                /* Key attributes check failed. */
-               OVS_NLERR("Missing expected key attributes (key_attrs=%llx, expected=%llx).\n",
-                               (unsigned long long)key_attrs, (unsigned long long)key_expected);
+               OVS_NLERR(log,
+                         "Missing expected key attributes (key_attrs=%llx, expected=%llx).",
+                         (unsigned long long)key_attrs,
+                         (unsigned long long)key_expected);
                return false;
        }
 
        if ((mask_attrs & mask_allowed) != mask_attrs) {
                /* Mask attributes check failed. */
-               OVS_NLERR("Contain more than allowed mask fields (mask_attrs=%llx, mask_allowed=%llx).\n",
-                               (unsigned long long)mask_attrs, (unsigned long long)mask_allowed);
+               OVS_NLERR(log,
+                         "Contain more than allowed mask fields (mask_attrs=%llx, mask_allowed=%llx).",
+                         (unsigned long long)mask_attrs,
+                         (unsigned long long)mask_allowed);
                return false;
        }
 
        return true;
 }
 
+size_t ovs_tun_key_attr_size(void)
+{
+       /* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider
+        * updating this function.  */
+       return    nla_total_size(8)    /* OVS_TUNNEL_KEY_ATTR_ID */
+               + nla_total_size(4)    /* OVS_TUNNEL_KEY_ATTR_IPV4_SRC */
+               + nla_total_size(4)    /* OVS_TUNNEL_KEY_ATTR_IPV4_DST */
+               + nla_total_size(1)    /* OVS_TUNNEL_KEY_ATTR_TOS */
+               + nla_total_size(1)    /* OVS_TUNNEL_KEY_ATTR_TTL */
+               + nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */
+               + nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_CSUM */
+               + nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_OAM */
+               + nla_total_size(256)  /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */
+               + nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
+               + nla_total_size(2);   /* OVS_TUNNEL_KEY_ATTR_TP_DST */
+}
+
+size_t ovs_key_attr_size(void)
+{
+       /* Whenever adding new OVS_KEY_ FIELDS, we should consider
+        * updating this function.  */
+       BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 22);
+
+       return    nla_total_size(4)   /* OVS_KEY_ATTR_PRIORITY */
+               + nla_total_size(0)   /* OVS_KEY_ATTR_TUNNEL */
+                 + ovs_tun_key_attr_size()
+               + nla_total_size(4)   /* OVS_KEY_ATTR_IN_PORT */
+               + nla_total_size(4)   /* OVS_KEY_ATTR_SKB_MARK */
+               + nla_total_size(4)   /* OVS_KEY_ATTR_DP_HASH */
+               + nla_total_size(4)   /* OVS_KEY_ATTR_RECIRC_ID */
+               + nla_total_size(12)  /* OVS_KEY_ATTR_ETHERNET */
+               + nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
+               + nla_total_size(4)   /* OVS_KEY_ATTR_VLAN */
+               + nla_total_size(0)   /* OVS_KEY_ATTR_ENCAP */
+               + nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
+               + nla_total_size(40)  /* OVS_KEY_ATTR_IPV6 */
+               + nla_total_size(2)   /* OVS_KEY_ATTR_ICMPV6 */
+               + nla_total_size(28); /* OVS_KEY_ATTR_ND */
+}
+
 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute.  */
 static const int ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
        [OVS_KEY_ATTR_ENCAP] = -1,
@@ -287,7 +331,7 @@ static bool is_all_zero(const u8 *fp, size_t size)
 
 static int __parse_flow_nlattrs(const struct nlattr *attr,
                                const struct nlattr *a[],
-                               u64 *attrsp, bool nz)
+                               u64 *attrsp, bool log, bool nz)
 {
        const struct nlattr *nla;
        u64 attrs;
@@ -299,20 +343,22 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
                int expected_len;
 
                if (type > OVS_KEY_ATTR_MAX) {
-                       OVS_NLERR("Unknown key attribute (type=%d, max=%d).\n",
+                       OVS_NLERR(log,
+                                 "Unknown key attribute (type=%d, max=%d).",
                                  type, OVS_KEY_ATTR_MAX);
                        return -EINVAL;
                }
 
                if (attrs & (1ULL << type)) {
-                       OVS_NLERR("Duplicate key attribute (type %d).\n", type);
+                       OVS_NLERR(log, "Duplicate key attribute (type %d).",
+                                 type);
                        return -EINVAL;
                }
 
                expected_len = ovs_key_lens[type];
                if (nla_len(nla) != expected_len && expected_len != -1) {
-                       OVS_NLERR("Key attribute has unexpected length (type=%d"
-                                 ", length=%d, expected=%d).\n", type,
+                       OVS_NLERR(log, "Key attribute has unexpected length "
+                                 "(type=%d, length=%d, expected=%d).", type,
                                  nla_len(nla), expected_len);
                        return -EINVAL;
                }
@@ -323,7 +369,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
                }
        }
        if (rem) {
-               OVS_NLERR("Message has %d unknown bytes.\n", rem);
+               OVS_NLERR(log, "Message has %d unknown bytes.", rem);
                return -EINVAL;
        }
 
@@ -332,19 +378,22 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
 }
 
 static int parse_flow_mask_nlattrs(const struct nlattr *attr,
-                                  const struct nlattr *a[], u64 *attrsp)
+                                  const struct nlattr *a[], u64 *attrsp,
+                                  bool log)
 {
-       return __parse_flow_nlattrs(attr, a, attrsp, true);
+       return __parse_flow_nlattrs(attr, a, attrsp, log, true);
 }
 
 static int parse_flow_nlattrs(const struct nlattr *attr,
-                             const struct nlattr *a[], u64 *attrsp)
+                             const struct nlattr *a[], u64 *attrsp,
+                             bool log)
 {
-       return __parse_flow_nlattrs(attr, a, attrsp, false);
+       return __parse_flow_nlattrs(attr, a, attrsp, log, false);
 }
 
 static int ipv4_tun_from_nlattr(const struct nlattr *attr,
-                               struct sw_flow_match *match, bool is_mask)
+                               struct sw_flow_match *match, bool is_mask,
+                               bool log)
 {
        struct nlattr *a;
        int rem;
@@ -361,21 +410,26 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
                        [OVS_TUNNEL_KEY_ATTR_TTL] = 1,
                        [OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = 0,
                        [OVS_TUNNEL_KEY_ATTR_CSUM] = 0,
+                       [OVS_TUNNEL_KEY_ATTR_TP_SRC] = sizeof(u16),
+                       [OVS_TUNNEL_KEY_ATTR_TP_DST] = sizeof(u16),
                        [OVS_TUNNEL_KEY_ATTR_OAM] = 0,
                        [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS] = -1,
                };
 
                if (type > OVS_TUNNEL_KEY_ATTR_MAX) {
-                       OVS_NLERR("Unknown IPv4 tunnel attribute (type=%d, max=%d).\n",
-                       type, OVS_TUNNEL_KEY_ATTR_MAX);
+                       OVS_NLERR(log,
+                                 "Unknown tunnel attribute (type=%d, max=%d).",
+                                 type, OVS_TUNNEL_KEY_ATTR_MAX);
                        return -EINVAL;
                }
 
                if (ovs_tunnel_key_lens[type] != nla_len(a) &&
                    ovs_tunnel_key_lens[type] != -1) {
-                       OVS_NLERR("IPv4 tunnel attribute type has unexpected "
-                                 " length (type=%d, length=%d, expected=%d).\n",
-                                 type, nla_len(a), ovs_tunnel_key_lens[type]);
+                       OVS_NLERR(log,
+                                 "Tunnel attribute has unexpected length "
+                                 "(type=%d, length=%d, expected=%d).",
+                                 type, nla_len(a),
+                                 ovs_tunnel_key_lens[type]);
                        return -EINVAL;
                }
 
@@ -408,21 +462,30 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
                case OVS_TUNNEL_KEY_ATTR_CSUM:
                        tun_flags |= TUNNEL_CSUM;
                        break;
+               case OVS_TUNNEL_KEY_ATTR_TP_SRC:
+                       SW_FLOW_KEY_PUT(match, tun_key.tp_src,
+                                       nla_get_be16(a), is_mask);
+                       break;
+               case OVS_TUNNEL_KEY_ATTR_TP_DST:
+                       SW_FLOW_KEY_PUT(match, tun_key.tp_dst,
+                                       nla_get_be16(a), is_mask);
+                       break;
                case OVS_TUNNEL_KEY_ATTR_OAM:
                        tun_flags |= TUNNEL_OAM;
                        break;
                case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
+                       tun_flags |= TUNNEL_OPTIONS_PRESENT;
                        if (nla_len(a) > sizeof(match->key->tun_opts)) {
-                               OVS_NLERR("Geneve option length exceeds "
-                                         "maximum size (len %d, max %zu).\n",
+                               OVS_NLERR(log, "Geneve option too long "
+                                         "(len %d, max %zu).",
                                          nla_len(a),
                                          sizeof(match->key->tun_opts));
                                return -EINVAL;
                        }
 
                        if (nla_len(a) % 4 != 0) {
-                               OVS_NLERR("Geneve option length is not "
-                                         "a multiple of 4 (len %d).\n",
+                               OVS_NLERR(log, "Geneve option length is not "
+                                         "a multiple of 4 (len %d).",
                                          nla_len(a));
                                return -EINVAL;
                        }
@@ -446,9 +509,11 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
                                 * information later.
                                 */
                                if (match->key->tun_opts_len != nla_len(a)) {
-                                       OVS_NLERR("Geneve option key length (%d)"
-                                          " is different from mask length (%d).",
-                                          match->key->tun_opts_len, nla_len(a));
+                                       OVS_NLERR(log,
+                                                 "Geneve option key length (%d)"
+                                                 " is different from mask length (%d).",
+                                                 match->key->tun_opts_len,
+                                                 nla_len(a));
                                        return -EINVAL;
                                }
 
@@ -462,6 +527,8 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
                                nla_data(a), nla_len(a), is_mask);
                        break;
                default:
+                       OVS_NLERR(log, "Unknown IPv4 tunnel attribute (%d).",
+                                 type);
                        return -EINVAL;
                }
        }
@@ -469,18 +536,20 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
        SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask);
 
        if (rem > 0) {
-               OVS_NLERR("IPv4 tunnel attribute has %d unknown bytes.\n", rem);
+               OVS_NLERR(log, "IPv4 tunnel attribute has %d unknown bytes.",
+                         rem);
                return -EINVAL;
        }
 
        if (!is_mask) {
                if (!match->key->tun_key.ipv4_dst) {
-                       OVS_NLERR("IPv4 tunnel destination address is zero.\n");
+                       OVS_NLERR(log,
+                                 "IPv4 tunnel destination address is zero.");
                        return -EINVAL;
                }
 
                if (!ttl) {
-                       OVS_NLERR("IPv4 tunnel TTL not specified.\n");
+                       OVS_NLERR(log, "IPv4 tunnel TTL not specified.");
                        return -EINVAL;
                }
        }
@@ -488,17 +557,11 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
        return 0;
 }
 
-static int ipv4_tun_to_nlattr(struct sk_buff *skb,
-                             const struct ovs_key_ipv4_tunnel *output,
-                             const struct geneve_opt *tun_opts,
-                             int swkey_tun_opts_len)
+static int __ipv4_tun_to_nlattr(struct sk_buff *skb,
+                               const struct ovs_key_ipv4_tunnel *output,
+                               const struct geneve_opt *tun_opts,
+                               int swkey_tun_opts_len)
 {
-       struct nlattr *nla;
-
-       nla = nla_nest_start(skb, OVS_KEY_ATTR_TUNNEL);
-       if (!nla)
-               return -EMSGSIZE;
-
        if (output->tun_flags & TUNNEL_KEY &&
            nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id))
                return -EMSGSIZE;
@@ -519,20 +582,55 @@ static int ipv4_tun_to_nlattr(struct sk_buff *skb,
        if ((output->tun_flags & TUNNEL_CSUM) &&
                nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM))
                return -EMSGSIZE;
+       if (output->tp_src &&
+               nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src))
+               return -EMSGSIZE;
+       if (output->tp_dst &&
+               nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst))
+               return -EMSGSIZE;
        if ((output->tun_flags & TUNNEL_OAM) &&
                nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM))
                return -EMSGSIZE;
        if (tun_opts &&
            nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,
-                   swkey_tun_opts_len, tun_opts));
+                   swkey_tun_opts_len, tun_opts))
+               return -EMSGSIZE;
+
+       return 0;
+}
+
+
+static int ipv4_tun_to_nlattr(struct sk_buff *skb,
+                             const struct ovs_key_ipv4_tunnel *output,
+                             const struct geneve_opt *tun_opts,
+                             int swkey_tun_opts_len)
+{
+       struct nlattr *nla;
+       int err;
+
+       nla = nla_nest_start(skb, OVS_KEY_ATTR_TUNNEL);
+       if (!nla)
+               return -EMSGSIZE;
+
+       err = __ipv4_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len);
+       if (err)
+               return err;
 
        nla_nest_end(skb, nla);
        return 0;
 }
 
+int ovs_nla_put_egress_tunnel_key(struct sk_buff *skb,
+                                 const struct ovs_tunnel_info *egress_tun_info)
+{
+       return __ipv4_tun_to_nlattr(skb, &egress_tun_info->tunnel,
+                                   egress_tun_info->options,
+                                   egress_tun_info->options_len);
+}
 
 static int metadata_from_nlattrs(struct sw_flow_match *match,  u64 *attrs,
-                                const struct nlattr **a, bool is_mask)
+                                const struct nlattr **a, bool is_mask,
+                                bool log)
 {
        if (*attrs & (1ULL << OVS_KEY_ATTR_DP_HASH)) {
                u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]);
@@ -557,10 +655,14 @@ static int metadata_from_nlattrs(struct sw_flow_match *match,  u64 *attrs,
        if (*attrs & (1ULL << OVS_KEY_ATTR_IN_PORT)) {
                u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
 
-               if (is_mask)
+               if (is_mask) {
                        in_port = 0xffffffff; /* Always exact match in_port. */
-               else if (in_port >= DP_MAX_PORTS)
+               } else if (in_port >= DP_MAX_PORTS) {
+                       OVS_NLERR(log,
+                                 "Input port (%d) exceeds maximum allowable (%d).",
+                                 in_port, DP_MAX_PORTS);
                        return -EINVAL;
+               }
 
                SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask);
                *attrs &= ~(1ULL << OVS_KEY_ATTR_IN_PORT);
@@ -576,7 +678,7 @@ static int metadata_from_nlattrs(struct sw_flow_match *match,  u64 *attrs,
        }
        if (*attrs & (1ULL << OVS_KEY_ATTR_TUNNEL)) {
                if (ipv4_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
-                                        is_mask))
+                                        is_mask, log))
                        return -EINVAL;
                *attrs &= ~(1ULL << OVS_KEY_ATTR_TUNNEL);
        }
@@ -584,12 +686,12 @@ static int metadata_from_nlattrs(struct sw_flow_match *match,  u64 *attrs,
 }
 
 static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
-                               const struct nlattr **a, bool is_mask)
+                               const struct nlattr **a, bool is_mask,
+                               bool log)
 {
        int err;
-       u64 orig_attrs = attrs;
 
-       err = metadata_from_nlattrs(match, &attrs, a, is_mask);
+       err = metadata_from_nlattrs(match, &attrs, a, is_mask, log);
        if (err)
                return err;
 
@@ -610,17 +712,18 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
                tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
                if (!(tci & htons(VLAN_TAG_PRESENT))) {
                        if (is_mask)
-                               OVS_NLERR("VLAN TCI mask does not have exact match for VLAN_TAG_PRESENT bit.\n");
+                               OVS_NLERR(log,
+                                         "VLAN TCI mask does not have exact match for VLAN_TAG_PRESENT bit.");
                        else
-                               OVS_NLERR("VLAN TCI does not have VLAN_TAG_PRESENT bit set.\n");
+                               OVS_NLERR(log,
+                                         "VLAN TCI does not have VLAN_TAG_PRESENT bit set.");
 
                        return -EINVAL;
                }
 
                SW_FLOW_KEY_PUT(match, eth.tci, tci, is_mask);
                attrs &= ~(1ULL << OVS_KEY_ATTR_VLAN);
-       } else if (!is_mask)
-               SW_FLOW_KEY_PUT(match, eth.tci, htons(0xffff), true);
+       }
 
        if (attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE)) {
                __be16 eth_type;
@@ -630,8 +733,9 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
                        /* Always exact match EtherType. */
                        eth_type = htons(0xffff);
                } else if (ntohs(eth_type) < ETH_P_802_3_MIN) {
-                       OVS_NLERR("EtherType is less than minimum (type=%x, min=%x).\n",
-                                       ntohs(eth_type), ETH_P_802_3_MIN);
+                       OVS_NLERR(log,
+                                 "EtherType is less than minimum (type=%x, min=%x).",
+                                 ntohs(eth_type), ETH_P_802_3_MIN);
                        return -EINVAL;
                }
 
@@ -646,8 +750,9 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
 
                ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]);
                if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) {
-                       OVS_NLERR("Unknown IPv4 fragment type (value=%d, max=%d).\n",
-                               ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
+                       OVS_NLERR(log,
+                                 "Unknown IPv4 fragment type (value=%d, max=%d).",
+                                 ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
                        return -EINVAL;
                }
                SW_FLOW_KEY_PUT(match, ip.proto,
@@ -670,8 +775,15 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
 
                ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]);
                if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) {
-                       OVS_NLERR("Unknown IPv6 fragment type (value=%d, max=%d).\n",
-                               ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
+                       OVS_NLERR(log,
+                                 "Unknown IPv6 fragment type (value=%d, max=%d).",
+                                 ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
+                       return -EINVAL;
+               }
+               if (ipv6_key->ipv6_label & htonl(0xFFF00000)) {
+                       OVS_NLERR(log,
+                                 "Invalid IPv6 flow label value (value=%x, max=%x).",
+                                 ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
                        return -EINVAL;
                }
                SW_FLOW_KEY_PUT(match, ipv6.label,
@@ -701,7 +813,7 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
 
                arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
                if (!is_mask && (arp_key->arp_op & htons(0xff00))) {
-                       OVS_NLERR("Unknown ARP opcode (opcode=%d).\n",
+                       OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).",
                                  arp_key->arp_op);
                        return -EINVAL;
                }
@@ -728,7 +840,7 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
                                mpls_key->mpls_lse, is_mask);
 
                attrs &= ~(1ULL << OVS_KEY_ATTR_MPLS);
-        }
+       }
 
        if (attrs & (1ULL << OVS_KEY_ATTR_TCP)) {
                const struct ovs_key_tcp *tcp_key;
@@ -740,15 +852,9 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
        }
 
        if (attrs & (1ULL << OVS_KEY_ATTR_TCP_FLAGS)) {
-               if (orig_attrs & (1ULL << OVS_KEY_ATTR_IPV4)) {
-                       SW_FLOW_KEY_PUT(match, tp.flags,
-                                       nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
-                                       is_mask);
-               } else {
-                       SW_FLOW_KEY_PUT(match, tp.flags,
-                                       nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
-                                       is_mask);
-               }
+               SW_FLOW_KEY_PUT(match, tp.flags,
+                               nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
+                               is_mask);
                attrs &= ~(1ULL << OVS_KEY_ATTR_TCP_FLAGS);
        }
 
@@ -807,19 +913,35 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
                attrs &= ~(1ULL << OVS_KEY_ATTR_ND);
        }
 
-       if (attrs != 0)
+       if (attrs != 0) {
+               OVS_NLERR(log, "Unknown key attributes (%llx).",
+                         (unsigned long long)attrs);
                return -EINVAL;
+       }
 
        return 0;
 }
 
-static void sw_flow_mask_set(struct sw_flow_mask *mask,
-                            struct sw_flow_key_range *range, u8 val)
+static void nlattr_set(struct nlattr *attr, u8 val, bool is_attr_mask_key)
 {
-       u8 *m = (u8 *)&mask->key + range->start;
+       struct nlattr *nla;
+       int rem;
 
-       mask->range = *range;
-       memset(m, val, range_n_bytes(range));
+       /* The nlattr stream should already have been validated */
+       nla_for_each_nested(nla, attr, rem) {
+               /* We assume that ovs_key_lens[type] == -1 means that type is a
+                * nested attribute
+                */
+               if (is_attr_mask_key && ovs_key_lens[nla_type(nla)] == -1)
+                       nlattr_set(nla, val, false);
+               else
+                       memset(nla_data(nla), val, nla_len(nla));
+       }
+}
+
+static void mask_set_nlattr(struct nlattr *attr, u8 val)
+{
+       nlattr_set(attr, val, true);
 }
 
 /**
@@ -833,19 +955,24 @@ static void sw_flow_mask_set(struct sw_flow_mask *mask,
  * of this flow.
  * @mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink
  * attribute specifies the mask field of the wildcarded flow.
+ * @log: Boolean to allow kernel error logging.  Normally true, but when
+ * probing for feature compatibility this should be passed in as false to
+ * suppress unnecessary error logging.
  */
 int ovs_nla_get_match(struct sw_flow_match *match,
-                     const struct nlattr *key,
-                     const struct nlattr *mask)
+                     const struct nlattr *nla_key,
+                     const struct nlattr *nla_mask,
+                     bool log)
 {
        const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
        const struct nlattr *encap;
+       struct nlattr *newmask = NULL;
        u64 key_attrs = 0;
        u64 mask_attrs = 0;
        bool encap_valid = false;
        int err;
 
-       err = parse_flow_nlattrs(key, a, &key_attrs);
+       err = parse_flow_nlattrs(nla_key, a, &key_attrs, log);
        if (err)
                return err;
 
@@ -856,7 +983,7 @@ int ovs_nla_get_match(struct sw_flow_match *match,
 
                if (!((key_attrs & (1ULL << OVS_KEY_ATTR_VLAN)) &&
                      (key_attrs & (1ULL << OVS_KEY_ATTR_ENCAP)))) {
-                       OVS_NLERR("Invalid Vlan frame.\n");
+                       OVS_NLERR(log, "Invalid Vlan frame.");
                        return -EINVAL;
                }
 
@@ -867,37 +994,74 @@ int ovs_nla_get_match(struct sw_flow_match *match,
                encap_valid = true;
 
                if (tci & htons(VLAN_TAG_PRESENT)) {
-                       err = parse_flow_nlattrs(encap, a, &key_attrs);
+                       err = parse_flow_nlattrs(encap, a, &key_attrs, log);
                        if (err)
                                return err;
                } else if (!tci) {
                        /* Corner case for truncated 802.1Q header. */
                        if (nla_len(encap)) {
-                               OVS_NLERR("Truncated 802.1Q header has non-zero encap attribute.\n");
+                               OVS_NLERR(log,
+                                         "Truncated 802.1Q header has non-zero encap attribute.");
                                return -EINVAL;
                        }
                } else {
-                       OVS_NLERR("Encap attribute is set for a non-VLAN frame.\n");
+                       OVS_NLERR(log,
+                                 "Encap attribute is set for a non-VLAN frame.");
                        return  -EINVAL;
                }
        }
 
-       err = ovs_key_from_nlattrs(match, key_attrs, a, false);
+       err = ovs_key_from_nlattrs(match, key_attrs, a, false, log);
        if (err)
                return err;
 
-       if (mask) {
-               err = parse_flow_mask_nlattrs(mask, a, &mask_attrs);
+       if (match->mask) {
+
+               if (!nla_mask) {
+                       /* Create an exact match mask. We need to set to 0xff
+                        * all the 'match->mask' fields that have been touched
+                        * in 'match->key'. We cannot simply memset
+                        * 'match->mask', because padding bytes and fields not
+                        * specified in 'match->key' should be left to 0.
+                        * Instead, we use a stream of netlink attributes,
+                        * copied from 'key' and set to 0xff: ovs_key_from_nlattrs()
+                        * will take care of filling 'match->mask'
+                        * appropriately.
+                        */
+                       newmask = kmemdup(nla_key,
+                                         nla_total_size(nla_len(nla_key)),
+                                         GFP_KERNEL);
+                       if (!newmask)
+                               return -ENOMEM;
+
+                       mask_set_nlattr(newmask, 0xff);
+
+                       /* The userspace does not send tunnel attributes that
+                        * are 0, but we should not wildcard them nonetheless.
+                        */
+                       if (match->key->tun_key.ipv4_dst)
+                               SW_FLOW_KEY_MEMSET_FIELD(match, tun_key,
+                                                        0xff, true);
+
+                       nla_mask = newmask;
+               }
+
+               err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log);
                if (err)
-                       return err;
+                       goto free_newmask;
+
+               /* Always match on tci. */
+               SW_FLOW_KEY_PUT(match, eth.tci, htons(0xffff), true);
 
-               if (mask_attrs & 1ULL << OVS_KEY_ATTR_ENCAP)  {
+               if (mask_attrs & 1ULL << OVS_KEY_ATTR_ENCAP) {
                        __be16 eth_type = 0;
                        __be16 tci = 0;
 
                        if (!encap_valid) {
-                               OVS_NLERR("Encap mask attribute is set for non-VLAN frame.\n");
-                               return  -EINVAL;
+                               OVS_NLERR(log,
+                                         "Encap mask attribute is set for non-VLAN frame.");
+                               err = -EINVAL;
+                               goto free_newmask;
                        }
 
                        mask_attrs &= ~(1ULL << OVS_KEY_ATTR_ENCAP);
@@ -907,80 +1071,80 @@ int ovs_nla_get_match(struct sw_flow_match *match,
                        if (eth_type == htons(0xffff)) {
                                mask_attrs &= ~(1ULL << OVS_KEY_ATTR_ETHERTYPE);
                                encap = a[OVS_KEY_ATTR_ENCAP];
-                               err = parse_flow_mask_nlattrs(encap, a, &mask_attrs);
+                               err = parse_flow_mask_nlattrs(encap, a,
+                                                             &mask_attrs, log);
+                               if (err)
+                                       goto free_newmask;
                        } else {
-                               OVS_NLERR("VLAN frames must have an exact match on the TPID (mask=%x).\n",
-                                               ntohs(eth_type));
-                               return -EINVAL;
+                               OVS_NLERR(log,
+                                         "VLAN frames must have an exact match on the TPID (mask=%x).",
+                                         ntohs(eth_type));
+                               err = -EINVAL;
+                               goto free_newmask;
                        }
 
                        if (a[OVS_KEY_ATTR_VLAN])
                                tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
 
                        if (!(tci & htons(VLAN_TAG_PRESENT))) {
-                               OVS_NLERR("VLAN tag present bit must have an exact match (tci_mask=%x).\n", ntohs(tci));
-                               return -EINVAL;
+                               OVS_NLERR(log,
+                                         "VLAN tag present bit must have an exact match (tci_mask=%x).",
+                                         ntohs(tci));
+                               err = -EINVAL;
+                               goto free_newmask;
                        }
                }
 
-               err = ovs_key_from_nlattrs(match, mask_attrs, a, true);
+               err = ovs_key_from_nlattrs(match, mask_attrs, a, true, log);
                if (err)
-                       return err;
-       } else {
-               /* Populate exact match flow's key mask. */
-               if (match->mask)
-                       sw_flow_mask_set(match->mask, &match->range, 0xff);
+                       goto free_newmask;
        }
 
-       if (!match_validate(match, key_attrs, mask_attrs))
-               return -EINVAL;
+       if (!match_validate(match, key_attrs, mask_attrs, log))
+               err = -EINVAL;
 
-       return 0;
+free_newmask:
+       kfree(newmask);
+       return err;
 }
 
 /**
  * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key.
- * @flow: Receives extracted in_port, priority, tun_key and skb_mark.
+ * @key: Receives extracted in_port, priority, tun_key and skb_mark.
  * @attr: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
  * sequence.
+ * @log: Boolean to allow kernel error logging.  Normally true, but when
+ * probing for feature compatibility this should be passed in as false to
+ * suppress unnecessary error logging.
  *
  * This parses a series of Netlink attributes that form a flow key, which must
  * take the same form accepted by flow_from_nlattrs(), but only enough of it to
  * get the metadata, that is, the parts of the flow key that cannot be
  * extracted from the packet itself.
  */
-
-int ovs_nla_get_flow_metadata(struct sw_flow *flow,
-                             const struct nlattr *attr)
+int ovs_nla_get_flow_metadata(const struct nlattr *attr,
+                             struct sw_flow_key *key,
+                             bool log)
 {
-       struct ovs_key_ipv4_tunnel *tun_key = &flow->key.tun_key;
        const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
+       struct sw_flow_match match;
        u64 attrs = 0;
        int err;
-       struct sw_flow_match match;
-
-       flow->key.phy.in_port = DP_MAX_PORTS;
-       flow->key.phy.priority = 0;
-       flow->key.phy.skb_mark = 0;
-       flow->key.ovs_flow_hash = 0;
-       flow->key.recirc_id = 0;
-       memset(tun_key, 0, sizeof(flow->key.tun_key));
 
-       err = parse_flow_nlattrs(attr, a, &attrs);
+       err = parse_flow_nlattrs(attr, a, &attrs, log);
        if (err)
                return -EINVAL;
 
        memset(&match, 0, sizeof(match));
-       match.key = &flow->key;
+       match.key = key;
 
-       err = metadata_from_nlattrs(&match, &attrs, a, false);
-       if (err)
-               return err;
+       memset(key, 0, OVS_SW_FLOW_KEY_METADATA_SIZE);
+       key->phy.in_port = DP_MAX_PORTS;
 
-       return 0;
+       return metadata_from_nlattrs(&match, &attrs, a, false, log);
 }
 
-int ovs_nla_put_flow(struct datapath *dp, const struct sw_flow_key *swkey,
+int ovs_nla_put_flow(const struct sw_flow_key *swkey,
                     const struct sw_flow_key *output, struct sk_buff *skb)
 {
        struct ovs_key_ethernet *eth_key;
@@ -999,16 +1163,8 @@ int ovs_nla_put_flow(struct datapath *dp, const struct sw_flow_key *swkey,
        if ((swkey->tun_key.ipv4_dst || is_mask)) {
                const struct geneve_opt *opts = NULL;
 
-               if (!is_mask) {
-                       struct vport *in_port;
-
-                       in_port = ovs_vport_ovsl_rcu(dp, swkey->phy.in_port);
-                       if (in_port->ops->type == OVS_VPORT_TYPE_GENEVE)
-                               opts = GENEVE_OPTS(output, swkey->tun_opts_len);
-               } else {
-                       if (output->tun_opts_len)
-                               opts = GENEVE_OPTS(output, swkey->tun_opts_len);
-               }
+               if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT)
+                       opts = GENEVE_OPTS(output, swkey->tun_opts_len);
 
                if (ipv4_tun_to_nlattr(skb, &output->tun_key, opts,
                                        swkey->tun_opts_len))
@@ -1205,12 +1361,15 @@ nla_put_failure:
 
 #define MAX_ACTIONS_BUFSIZE    (32 * 1024)
 
-struct sw_flow_actions *ovs_nla_alloc_flow_actions(int size)
+static struct sw_flow_actions *nla_alloc_flow_actions(int size, bool log)
 {
        struct sw_flow_actions *sfa;
 
-       if (size > MAX_ACTIONS_BUFSIZE)
+       if (size > MAX_ACTIONS_BUFSIZE) {
+               OVS_NLERR(log, "Flow action size (%u bytes) exceeds maximum "
+                         "(%u bytes)", size, MAX_ACTIONS_BUFSIZE);
                return ERR_PTR(-EINVAL);
+       }
 
        sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
        if (!sfa)
@@ -1236,7 +1395,7 @@ void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
 }
 
 static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
-                                      int attr_len)
+                                      int attr_len, bool log)
 {
 
        struct sw_flow_actions *acts;
@@ -1256,7 +1415,7 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
                new_acts_size = MAX_ACTIONS_BUFSIZE;
        }
 
-       acts = ovs_nla_alloc_flow_actions(new_acts_size);
+       acts = nla_alloc_flow_actions(new_acts_size, log);
        if (IS_ERR(acts))
                return (void *)acts;
 
@@ -1271,11 +1430,11 @@ out:
 }
 
 static struct nlattr *__add_action(struct sw_flow_actions **sfa, int attrtype,
-                                  void *data, int len)
+                                  void *data, int len, bool log)
 {
        struct nlattr *a;
 
-       a = reserve_sfa_size(sfa, nla_attr_size(len));
+       a = reserve_sfa_size(sfa, nla_attr_size(len), log);
        if (IS_ERR(a))
                return a;
 
@@ -1290,11 +1449,11 @@ static struct nlattr *__add_action(struct sw_flow_actions **sfa, int attrtype,
 }
 
 static int add_action(struct sw_flow_actions **sfa, int attrtype,
-                     void *data, int len)
+                     void *data, int len, bool log)
 {
        struct nlattr *a;
 
-       a = __add_action(sfa, attrtype, data, len);
+       a = __add_action(sfa, attrtype, data, len, log);
        if (IS_ERR(a))
                return PTR_ERR(a);
 
@@ -1302,12 +1461,12 @@ static int add_action(struct sw_flow_actions **sfa, int attrtype,
 }
 
 static inline int add_nested_action_start(struct sw_flow_actions **sfa,
-                                         int attrtype)
+                                         int attrtype, bool log)
 {
        int used = (*sfa)->actions_len;
        int err;
 
-       err = add_action(sfa, attrtype, NULL, 0);
+       err = add_action(sfa, attrtype, NULL, 0, log);
        if (err)
                return err;
 
@@ -1323,15 +1482,15 @@ static inline void add_nested_action_end(struct sw_flow_actions *sfa,
        a->nla_len = sfa->actions_len - st_offset;
 }
 
-static int ovs_nla_copy_actions__(const struct nlattr *attr,
+static int __ovs_nla_copy_actions(const struct nlattr *attr,
                                  const struct sw_flow_key *key,
                                  int depth, struct sw_flow_actions **sfa,
-                                 __be16 eth_type, __be16 vlan_tci);
+                                 __be16 eth_type, __be16 vlan_tci, bool log);
 
 static int validate_and_copy_sample(const struct nlattr *attr,
                                    const struct sw_flow_key *key, int depth,
                                    struct sw_flow_actions **sfa,
-                                   __be16 eth_type, __be16 vlan_tci)
+                                   __be16 eth_type, __be16 vlan_tci, bool log)
 {
        const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
        const struct nlattr *probability, *actions;
@@ -1357,19 +1516,19 @@ static int validate_and_copy_sample(const struct nlattr *attr,
                return -EINVAL;
 
        /* validation done, copy sample action. */
-       start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE);
+       start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log);
        if (start < 0)
                return start;
        err = add_action(sfa, OVS_SAMPLE_ATTR_PROBABILITY,
-                        nla_data(probability), sizeof(u32));
+                        nla_data(probability), sizeof(u32), log);
        if (err)
                return err;
-       st_acts = add_nested_action_start(sfa, OVS_SAMPLE_ATTR_ACTIONS);
+       st_acts = add_nested_action_start(sfa, OVS_SAMPLE_ATTR_ACTIONS, log);
        if (st_acts < 0)
                return st_acts;
 
-       err = ovs_nla_copy_actions__(actions, key, depth + 1, sfa,
-                                    eth_type, vlan_tci);
+       err = __ovs_nla_copy_actions(actions, key, depth + 1, sfa,
+                                    eth_type, vlan_tci, log);
        if (err)
                return err;
 
@@ -1406,7 +1565,7 @@ void ovs_match_init(struct sw_flow_match *match,
 }
 
 static int validate_and_copy_set_tun(const struct nlattr *attr,
-                                    struct sw_flow_actions **sfa)
+                                    struct sw_flow_actions **sfa, bool log)
 {
        struct sw_flow_match match;
        struct sw_flow_key key;
@@ -1415,7 +1574,7 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
        int err, start;
 
        ovs_match_init(&match, &key, NULL);
-       err = ipv4_tun_from_nlattr(nla_data(attr), &match, false);
+       err = ipv4_tun_from_nlattr(nla_data(attr), &match, false, log);
        if (err)
                return err;
 
@@ -1444,12 +1603,12 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
                key.tun_key.tun_flags |= crit_opt ? TUNNEL_CRIT_OPT : 0;
        };
 
-       start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET);
+       start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log);
        if (start < 0)
                return start;
 
        a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
-                       sizeof(*tun_info) + key.tun_opts_len);
+                        sizeof(*tun_info) + key.tun_opts_len, log);
        if (IS_ERR(a))
                return PTR_ERR(a);
 
@@ -1462,9 +1621,9 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
                 * everything else will go away after flow setup. We can append
                 * it to tun_info and then point there.
                 */
-               tun_info->options = (struct geneve_opt *)(tun_info + 1);
-               memcpy(tun_info->options, GENEVE_OPTS(&key, key.tun_opts_len),
+               memcpy((tun_info + 1), GENEVE_OPTS(&key, key.tun_opts_len),
                        key.tun_opts_len);
+               tun_info->options = (struct geneve_opt *)(tun_info + 1);
        } else {
                tun_info->options = NULL;
        }
@@ -1477,7 +1636,7 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
 static int validate_set(const struct nlattr *a,
                        const struct sw_flow_key *flow_key,
                        struct sw_flow_actions **sfa,
-                       bool *set_tun, __be16 eth_type)
+                       bool *set_tun, __be16 eth_type, bool log)
 {
        const struct nlattr *ovs_key = nla_data(a);
        int key_type = nla_type(ovs_key);
@@ -1503,7 +1662,7 @@ static int validate_set(const struct nlattr *a,
 
        case OVS_KEY_ATTR_TUNNEL:
                *set_tun = true;
-               err = validate_and_copy_set_tun(a, sfa);
+               err = validate_and_copy_set_tun(a, sfa, log);
                if (err)
                        return err;
                break;
@@ -1578,6 +1737,7 @@ static int validate_userspace(const struct nlattr *attr)
        static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = {
                [OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 },
                [OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC },
+               [OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 },
        };
        struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
        int error;
@@ -1595,12 +1755,12 @@ static int validate_userspace(const struct nlattr *attr)
 }
 
 static int copy_action(const struct nlattr *from,
-                      struct sw_flow_actions **sfa)
+                      struct sw_flow_actions **sfa, bool log)
 {
        int totlen = NLA_ALIGN(from->nla_len);
        struct nlattr *to;
 
-       to = reserve_sfa_size(sfa, from->nla_len);
+       to = reserve_sfa_size(sfa, from->nla_len, log);
        if (IS_ERR(to))
                return PTR_ERR(to);
 
@@ -1608,10 +1768,10 @@ static int copy_action(const struct nlattr *from,
        return 0;
 }
 
-static int ovs_nla_copy_actions__(const struct nlattr *attr,
+static int __ovs_nla_copy_actions(const struct nlattr *attr,
                                  const struct sw_flow_key *key,
                                  int depth, struct sw_flow_actions **sfa,
-                                 __be16 eth_type, __be16 vlan_tci)
+                                 __be16 eth_type, __be16 vlan_tci, bool log)
 {
        const struct nlattr *a;
        int rem, err;
@@ -1672,6 +1832,7 @@ static int ovs_nla_copy_actions__(const struct nlattr *attr,
                }
 
                case OVS_ACTION_ATTR_POP_VLAN:
+                       vlan_tci = htons(0);
                        break;
 
                case OVS_ACTION_ATTR_PUSH_VLAN:
@@ -1693,13 +1854,7 @@ static int ovs_nla_copy_actions__(const struct nlattr *attr,
                                return -EINVAL;
                        /* Prohibit push MPLS other than to a white list
                         * for packets that have a known tag order.
-                        *
-                        * vlan_tci indicates that the packet at one
-                        * point had a VLAN. It may have been subsequently
-                        * removed using pop VLAN so this rule is stricter
-                        * than necessary. This is because it is not
-                        * possible to know if a VLAN is still present
-                        * after a pop VLAN action. */
+                        */
                        if (vlan_tci & htons(VLAN_TAG_PRESENT) ||
                            (eth_type != htons(ETH_P_IP) &&
                             eth_type != htons(ETH_P_IPV6) &&
@@ -1729,14 +1884,15 @@ static int ovs_nla_copy_actions__(const struct nlattr *attr,
                        break;
 
                case OVS_ACTION_ATTR_SET:
-                       err = validate_set(a, key, sfa, &skip_copy, eth_type);
+                       err = validate_set(a, key, sfa, &skip_copy, eth_type,
+                                          log);
                        if (err)
                                return err;
                        break;
 
                case OVS_ACTION_ATTR_SAMPLE:
                        err = validate_and_copy_sample(a, key, depth, sfa,
-                                                      eth_type, vlan_tci);
+                                                      eth_type, vlan_tci, log);
                        if (err)
                                return err;
                        skip_copy = true;
@@ -1746,7 +1902,7 @@ static int ovs_nla_copy_actions__(const struct nlattr *attr,
                        return -EINVAL;
                }
                if (!skip_copy) {
-                       err = copy_action(a, sfa);
+                       err = copy_action(a, sfa, log);
                        if (err)
                                return err;
                }
@@ -1760,10 +1916,20 @@ static int ovs_nla_copy_actions__(const struct nlattr *attr,
 
 int ovs_nla_copy_actions(const struct nlattr *attr,
                         const struct sw_flow_key *key,
-                        struct sw_flow_actions **sfa)
+                        struct sw_flow_actions **sfa, bool log)
 {
-       return ovs_nla_copy_actions__(attr, key, 0, sfa, key->eth.type,
-                                     key->eth.tci);
+       int err;
+
+       *sfa = nla_alloc_flow_actions(nla_len(attr), log);
+       if (IS_ERR(*sfa))
+               return PTR_ERR(*sfa);
+
+       err = __ovs_nla_copy_actions(attr, key, 0, sfa, key->eth.type,
+                                    key->eth.tci, log);
+       if (err)
+               kfree(*sfa);
+
+       return err;
 }
 
 static int sample_action_to_attr(const struct nlattr *attr, struct sk_buff *skb)