[dpdk-dev] [RFC 1/2] drivers: add VXLAN header the last 8-bits matching support

[rongwei liu <rongweil@nvidia.com>]

This update adds support for the VXLAN alert bits matching when
creating steering rules. At the PCIe probe stage, we create a
dummy VXLAN matcher using misc5 to check rdma-core library's
capability.

The logic is, group 0 depends on HCA_CAP to enable misc or misc5
for VXLAN matching while group non zero depends on the rdma-core
capability.

Signed-off-by: rongwei liu <rongweil@nvidia.com>
---
 doc/guides/nics/mlx5.rst             |  11 +-
 drivers/common/mlx5/mlx5_devx_cmds.c |   3 +
 drivers/common/mlx5/mlx5_devx_cmds.h |   6 ++
 drivers/common/mlx5/mlx5_prm.h       |  41 ++++++--
 drivers/net/mlx5/linux/mlx5_os.c     |  77 ++++++++++++++
 drivers/net/mlx5/mlx5.h              |   2 +
 drivers/net/mlx5/mlx5_flow.c         |  26 ++++-
 drivers/net/mlx5/mlx5_flow.h         |   4 +-
 drivers/net/mlx5/mlx5_flow_dv.c      | 152 +++++++++++++++++++--------
 drivers/net/mlx5/mlx5_flow_verbs.c   |   3 +-
 drivers/vdpa/mlx5/mlx5_vdpa_steer.c  |   6 +-
 11 files changed, 270 insertions(+), 61 deletions(-)

diff --git a/doc/guides/nics/mlx5.rst b/doc/guides/nics/mlx5.rst
index 83299646dd..0bfe55dbdc 100644
--- a/doc/guides/nics/mlx5.rst
+++ b/doc/guides/nics/mlx5.rst
@@ -186,8 +186,15 @@ Limitations
   size and ``txq_inline_min`` settings and may be from 2 (worst case forced by maximal
   inline settings) to 58.
 
-- Flows with a VXLAN Network Identifier equal (or ends to be equal)
-  to 0 are not supported.
+- Match on VXLAN supports the following fields only:
+
+     - VNI
+     - Last reserved 8-bits
+
+  Last reserved 8-bits matching is only supported When using DV flow
+  engine (``dv_flow_en`` = 1).
+  Group zero's behavior may differ which depends on FW.
+  Matching value equals 0 (value & mask) is not supported.
 
 - L3 VXLAN and VXLAN-GPE tunnels cannot be supported together with MPLSoGRE and MPLSoUDP.
 
diff --git a/drivers/common/mlx5/mlx5_devx_cmds.c b/drivers/common/mlx5/mlx5_devx_cmds.c
index f5914bce32..63ae95832d 100644
--- a/drivers/common/mlx5/mlx5_devx_cmds.c
+++ b/drivers/common/mlx5/mlx5_devx_cmds.c
@@ -947,6 +947,9 @@ mlx5_devx_cmd_query_hca_attr(void *ctx,
 	attr->log_max_ft_sampler_num = MLX5_GET
 		(flow_table_nic_cap, hcattr,
 		 flow_table_properties_nic_receive.log_max_ft_sampler_num);
+	attr->flow.tunnel_header_0_1 = MLX5_GET
+		(flow_table_nic_cap, hcattr,
+		 ft_field_support_2_nic_receive.tunnel_header_0_1);
 	attr->pkt_integrity_match = mlx5_devx_query_pkt_integrity_match(hcattr);
 	/* Query HCA offloads for Ethernet protocol. */
 	memset(in, 0, sizeof(in));
diff --git a/drivers/common/mlx5/mlx5_devx_cmds.h b/drivers/common/mlx5/mlx5_devx_cmds.h
index f8a17b886b..124f43e852 100644
--- a/drivers/common/mlx5/mlx5_devx_cmds.h
+++ b/drivers/common/mlx5/mlx5_devx_cmds.h
@@ -89,6 +89,11 @@ struct mlx5_hca_vdpa_attr {
 	uint64_t doorbell_bar_offset;
 };
 
+struct mlx5_hca_flow_attr {
+	uint32_t tunnel_header_0_1;
+	uint32_t tunnel_header_2_3;
+};
+
 /* HCA supports this number of time periods for LRO. */
 #define MLX5_LRO_NUM_SUPP_PERIODS 4
 
@@ -155,6 +160,7 @@ struct mlx5_hca_attr {
 	uint32_t pkt_integrity_match:1; /* 1 if HW supports integrity item */
 	struct mlx5_hca_qos_attr qos;
 	struct mlx5_hca_vdpa_attr vdpa;
+	struct mlx5_hca_flow_attr flow;
 	int log_max_qp_sz;
 	int log_max_cq_sz;
 	int log_max_qp;
diff --git a/drivers/common/mlx5/mlx5_prm.h b/drivers/common/mlx5/mlx5_prm.h
index 26761f5bd3..7950070976 100644
--- a/drivers/common/mlx5/mlx5_prm.h
+++ b/drivers/common/mlx5/mlx5_prm.h
@@ -977,6 +977,18 @@ struct mlx5_ifc_fte_match_set_misc4_bits {
 	u8 reserved_at_100[0x100];
 };
 
+struct mlx5_ifc_fte_match_set_misc5_bits {
+	u8 macsec_tag_0[0x20];
+	u8 macsec_tag_1[0x20];
+	u8 macsec_tag_2[0x20];
+	u8 macsec_tag_3[0x20];
+	u8 tunnel_header_0[0x20];
+	u8 tunnel_header_1[0x20];
+	u8 tunnel_header_2[0x20];
+	u8 tunnel_header_3[0x20];
+	u8 reserved[0x100];
+};
+
 /* Flow matcher. */
 struct mlx5_ifc_fte_match_param_bits {
 	struct mlx5_ifc_fte_match_set_lyr_2_4_bits outer_headers;
@@ -985,12 +997,13 @@ struct mlx5_ifc_fte_match_param_bits {
 	struct mlx5_ifc_fte_match_set_misc2_bits misc_parameters_2;
 	struct mlx5_ifc_fte_match_set_misc3_bits misc_parameters_3;
 	struct mlx5_ifc_fte_match_set_misc4_bits misc_parameters_4;
+	struct mlx5_ifc_fte_match_set_misc5_bits misc_parameters_5;
 /*
  * Add reserved bit to match the struct size with the size defined in PRM.
  * This extension is not required in Linux.
  */
 #ifndef HAVE_INFINIBAND_VERBS_H
-	u8 reserved_0[0x400];
+	u8 reserved_0[0x200];
 #endif
 };
 
@@ -1007,6 +1020,7 @@ enum {
 	MLX5_MATCH_CRITERIA_ENABLE_MISC2_BIT,
 	MLX5_MATCH_CRITERIA_ENABLE_MISC3_BIT,
 	MLX5_MATCH_CRITERIA_ENABLE_MISC4_BIT,
+	MLX5_MATCH_CRITERIA_ENABLE_MISC5_BIT,
 };
 
 enum {
@@ -1784,7 +1798,12 @@ struct mlx5_ifc_roce_caps_bits {
  * Table 1872 - Flow Table Fields Supported 2 Format
  */
 struct mlx5_ifc_ft_fields_support_2_bits {
-	u8 reserved_at_0[0x14];
+	u8 reserved_at_0[0xf];
+	u8 tunnel_header_2_3[0x1];
+	u8 tunnel_header_0_1[0x1];
+	u8 macsec_syndrome[0x1];
+	u8 macsec_tag[0x1];
+	u8 outer_lrh_sl[0x1];
 	u8 inner_ipv4_ihl[0x1];
 	u8 outer_ipv4_ihl[0x1];
 	u8 psp_syndrome[0x1];
@@ -1797,18 +1816,26 @@ struct mlx5_ifc_ft_fields_support_2_bits {
 	u8 inner_l4_checksum_ok[0x1];
 	u8 outer_ipv4_checksum_ok[0x1];
 	u8 outer_l4_checksum_ok[0x1];
+	u8 reserved_at_20[0x60];
 };
 
 struct mlx5_ifc_flow_table_nic_cap_bits {
 	u8 reserved_at_0[0x200];
 	struct mlx5_ifc_flow_table_prop_layout_bits
-	       flow_table_properties_nic_receive;
+		flow_table_properties_nic_receive;
+	struct mlx5_ifc_flow_table_prop_layout_bits
+		flow_table_properties_nic_receive_rdma;
+	struct mlx5_ifc_flow_table_prop_layout_bits
+		flow_table_properties_nic_receive_sniffer;
+	struct mlx5_ifc_flow_table_prop_layout_bits
+		flow_table_properties_nic_transmit;
+	struct mlx5_ifc_flow_table_prop_layout_bits
+		flow_table_properties_nic_transmit_rdma;
 	struct mlx5_ifc_flow_table_prop_layout_bits
-	       flow_table_properties_unused[5];
-	u8 reserved_at_1C0[0x200];
-	u8 header_modify_nic_receive[0x400];
+		flow_table_properties_nic_transmit_sniffer;
+	u8 reserved_at_e00[0x600];
 	struct mlx5_ifc_ft_fields_support_2_bits
-	       ft_field_support_2_nic_receive;
+		ft_field_support_2_nic_receive;
 };
 
 struct mlx5_ifc_cmd_hca_cap_2_bits {
diff --git a/drivers/net/mlx5/linux/mlx5_os.c b/drivers/net/mlx5/linux/mlx5_os.c
index 534a56a555..386db44795 100644
--- a/drivers/net/mlx5/linux/mlx5_os.c
+++ b/drivers/net/mlx5/linux/mlx5_os.c
@@ -193,6 +193,79 @@ mlx5_alloc_verbs_buf(size_t size, void *data)
 	return ret;
 }
 
+/**
+ * Detect misc5 support or not
+ *
+ * @param[in] priv
+ *   Device private data pointer
+ */
+#ifdef HAVE_MLX5DV_DR
+static void
+__mlx5_discovery_misc5_cap(struct mlx5_priv *priv)
+{
+#ifdef HAVE_IBV_FLOW_DV_SUPPORT
+	/* Dummy VxLAN matcher to detect rdma-core misc5 cap
+	 * Case: IPv4--->UDP--->VxLAN--->vni
+	 */
+	void *tbl;
+	struct mlx5_flow_dv_match_params matcher_mask;
+	void *match_m;
+	void *matcher;
+	void *headers_m;
+	void *misc5_m;
+	uint32_t *tunnel_header_m;
+	struct mlx5dv_flow_matcher_attr dv_attr;
+
+	memset(&matcher_mask, 0, sizeof(matcher_mask));
+	matcher_mask.size = sizeof(matcher_mask.buf);
+	match_m = matcher_mask.buf;
+	headers_m = MLX5_ADDR_OF(fte_match_param, match_m, outer_headers);
+	misc5_m = MLX5_ADDR_OF(fte_match_param,
+			       match_m, misc_parameters_5);
+	tunnel_header_m = (uint32_t *)
+				MLX5_ADDR_OF(fte_match_set_misc5,
+				misc5_m, tunnel_header_1);
+	MLX5_SET(fte_match_set_lyr_2_4, headers_m, ip_protocol, 0xff);
+	MLX5_SET(fte_match_set_lyr_2_4, headers_m, ip_version, 4);
+	MLX5_SET(fte_match_set_lyr_2_4, headers_m, udp_dport, 0xffff);
+	*tunnel_header_m = 0xffffff;
+
+	tbl = mlx5_glue->dr_create_flow_tbl(priv->sh->rx_domain, 1);
+	if (!tbl) {
+		DRV_LOG(ERR, "dr_create_flow_tbl failed");
+		return;
+	}
+	dv_attr.type = IBV_FLOW_ATTR_NORMAL,
+	dv_attr.match_mask = (void *)&matcher_mask,
+	dv_attr.match_criteria_enable =
+			(1 << MLX5_MATCH_CRITERIA_ENABLE_OUTER_BIT) |
+			(1 << MLX5_MATCH_CRITERIA_ENABLE_MISC5_BIT);
+	dv_attr.priority = 3;
+#ifdef HAVE_MLX5DV_DR_ESWITCH
+	void *misc2_m;
+	if (priv->config.dv_esw_en) {
+		/* FDB enabled reg_c_0 */
+		dv_attr.match_criteria_enable |=
+				(1 << MLX5_MATCH_CRITERIA_ENABLE_MISC2_BIT);
+		misc2_m = MLX5_ADDR_OF(fte_match_param,
+				       match_m, misc_parameters_2);
+		MLX5_SET(fte_match_set_misc2, misc2_m,
+			 metadata_reg_c_0, 0xffff);
+	}
+#endif
+	matcher = mlx5_glue->dv_create_flow_matcher(priv->sh->ctx,
+						    &dv_attr, tbl);
+	if (matcher) {
+		priv->sh->misc5_cap = 1;
+		mlx5_glue->dv_destroy_flow_matcher(matcher);
+	}
+	mlx5_glue->dr_destroy_flow_tbl(tbl);
+#else
+	RTE_SET_USED(priv);
+#endif
+}
+#endif
+
 /**
  * Verbs callback to free a memory.
  *
@@ -355,6 +428,8 @@ mlx5_alloc_shared_dr(struct mlx5_priv *priv)
 			mlx5_glue->dr_reclaim_domain_memory(sh->fdb_domain, 1);
 	}
 	sh->pop_vlan_action = mlx5_glue->dr_create_flow_action_pop_vlan();
+
+	__mlx5_discovery_misc5_cap(priv);
 #endif /* HAVE_MLX5DV_DR */
 	sh->default_miss_action =
 			mlx5_glue->dr_create_flow_action_default_miss();
@@ -1312,6 +1387,8 @@ mlx5_dev_spawn(struct rte_device *dpdk_dev,
 				goto error;
 			}
 		}
+		if (config->hca_attr.flow.tunnel_header_0_1)
+			sh->tunnel_header_0_1 = 1;
 #endif
 #ifdef HAVE_MLX5_DR_CREATE_ACTION_ASO
 		if (config->hca_attr.flow_hit_aso &&
diff --git a/drivers/net/mlx5/mlx5.h b/drivers/net/mlx5/mlx5.h
index 32b2817bf2..2b2ddd02cf 100644
--- a/drivers/net/mlx5/mlx5.h
+++ b/drivers/net/mlx5/mlx5.h
@@ -1071,6 +1071,8 @@ struct mlx5_dev_ctx_shared {
 	uint32_t qp_ts_format:2; /* QP timestamp formats supported. */
 	uint32_t meter_aso_en:1; /* Flow Meter ASO is supported. */
 	uint32_t ct_aso_en:1; /* Connection Tracking ASO is supported. */
+	uint32_t tunnel_header_0_1:1; /* tunnel_header_0_1 is supported. */
+	uint32_t misc5_cap:1; /* misc5 matcher parameter is supported. */
 	uint32_t max_port; /* Maximal IB device port index. */
 	struct mlx5_bond_info bond; /* Bonding information. */
 	void *ctx; /* Verbs/DV/DevX context. */
diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index dbeca571b6..309f9f94bf 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -2368,12 +2368,14 @@ mlx5_flow_validate_item_tcp(const struct rte_flow_item *item,
 /**
  * Validate VXLAN item.
  *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
  * @param[in] item
  *   Item specification.
  * @param[in] item_flags
  *   Bit-fields that holds the items detected until now.
- * @param[in] target_protocol
- *   The next protocol in the previous item.
+ * @param[in] attr
+ *   Flow rule attributes.
  * @param[out] error
  *   Pointer to error structure.
  *
@@ -2381,24 +2383,32 @@ mlx5_flow_validate_item_tcp(const struct rte_flow_item *item,
  *   0 on success, a negative errno value otherwise and rte_errno is set.
  */
 int
-mlx5_flow_validate_item_vxlan(const struct rte_flow_item *item,
+mlx5_flow_validate_item_vxlan(struct rte_eth_dev *dev,
+			      const struct rte_flow_item *item,
 			      uint64_t item_flags,
+			      const struct rte_flow_attr *attr,
 			      struct rte_flow_error *error)
 {
 	const struct rte_flow_item_vxlan *spec = item->spec;
 	const struct rte_flow_item_vxlan *mask = item->mask;
 	int ret;
+	struct mlx5_priv *priv = dev->data->dev_private;
 	union vni {
 		uint32_t vlan_id;
 		uint8_t vni[4];
 	} id = { .vlan_id = 0, };
-
+	const struct rte_flow_item_vxlan nic_mask = {
+		.vni = "\xff\xff\xff",
+		.rsvd1 = 0xff,
+	};
+	const struct rte_flow_item_vxlan *valid_mask;
 
 	if (item_flags & MLX5_FLOW_LAYER_TUNNEL)
 		return rte_flow_error_set(error, ENOTSUP,
 					  RTE_FLOW_ERROR_TYPE_ITEM, item,
 					  "multiple tunnel layers not"
 					  " supported");
+	valid_mask = &rte_flow_item_vxlan_mask;
 	/*
 	 * Verify only UDPv4 is present as defined in
 	 * https://tools.ietf.org/html/rfc7348
@@ -2409,9 +2419,15 @@ mlx5_flow_validate_item_vxlan(const struct rte_flow_item *item,
 					  "no outer UDP layer found");
 	if (!mask)
 		mask = &rte_flow_item_vxlan_mask;
+	/* FDB domain & NIC domain non-zero group */
+	if ((attr->transfer || attr->group) && priv->sh->misc5_cap)
+		valid_mask = &nic_mask;
+	/* Group zero in NIC domain */
+	if (!attr->group && !attr->transfer && priv->sh->tunnel_header_0_1)
+		valid_mask = &nic_mask;
 	ret = mlx5_flow_item_acceptable
 		(item, (const uint8_t *)mask,
-		 (const uint8_t *)&rte_flow_item_vxlan_mask,
+		 (const uint8_t *)valid_mask,
 		 sizeof(struct rte_flow_item_vxlan),
 		 MLX5_ITEM_RANGE_NOT_ACCEPTED, error);
 	if (ret < 0)
diff --git a/drivers/net/mlx5/mlx5_flow.h b/drivers/net/mlx5/mlx5_flow.h
index 2f2aa962f9..3739dcc319 100644
--- a/drivers/net/mlx5/mlx5_flow.h
+++ b/drivers/net/mlx5/mlx5_flow.h
@@ -1521,8 +1521,10 @@ int mlx5_flow_validate_item_vlan(const struct rte_flow_item *item,
 				 uint64_t item_flags,
 				 struct rte_eth_dev *dev,
 				 struct rte_flow_error *error);
-int mlx5_flow_validate_item_vxlan(const struct rte_flow_item *item,
+int mlx5_flow_validate_item_vxlan(struct rte_eth_dev *dev,
+				  const struct rte_flow_item *item,
 				  uint64_t item_flags,
+				  const struct rte_flow_attr *attr,
 				  struct rte_flow_error *error);
 int mlx5_flow_validate_item_vxlan_gpe(const struct rte_flow_item *item,
 				      uint64_t item_flags,
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index c50649a107..14500421ad 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -6861,7 +6861,8 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 			last_item = MLX5_FLOW_LAYER_GRE_KEY;
 			break;
 		case RTE_FLOW_ITEM_TYPE_VXLAN:
-			ret = mlx5_flow_validate_item_vxlan(items, item_flags,
+			ret = mlx5_flow_validate_item_vxlan(dev, items,
+							    item_flags, attr,
 							    error);
 			if (ret < 0)
 				return ret;
@@ -7820,15 +7821,7 @@ flow_dv_prepare(struct rte_eth_dev *dev,
 	memset(dev_flow, 0, sizeof(*dev_flow));
 	dev_flow->handle = dev_handle;
 	dev_flow->handle_idx = handle_idx;
-	/*
-	 * In some old rdma-core releases, before continuing, a check of the
-	 * length of matching parameter will be done at first. It needs to use
-	 * the length without misc4 param. If the flow has misc4 support, then
-	 * the length needs to be adjusted accordingly. Each param member is
-	 * aligned with a 64B boundary naturally.
-	 */
-	dev_flow->dv.value.size = MLX5_ST_SZ_BYTES(fte_match_param) -
-				  MLX5_ST_SZ_BYTES(fte_match_set_misc4);
+	dev_flow->dv.value.size = MLX5_ST_SZ_BYTES(fte_match_param);
 	dev_flow->ingress = attr->ingress;
 	dev_flow->dv.transfer = attr->transfer;
 	return dev_flow;
@@ -8609,6 +8602,10 @@ flow_dv_translate_item_nvgre(void *matcher, void *key,
 /**
  * Add VXLAN item to matcher and to the value.
  *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] attr
+ *   Flow rule attributes.
  * @param[in, out] matcher
  *   Flow matcher.
  * @param[in, out] key
@@ -8619,7 +8616,9 @@ flow_dv_translate_item_nvgre(void *matcher, void *key,
  *   Item is inner pattern.
  */
 static void
-flow_dv_translate_item_vxlan(void *matcher, void *key,
+flow_dv_translate_item_vxlan(struct rte_eth_dev *dev,
+			     const struct rte_flow_attr *attr,
+			     void *matcher, void *key,
 			     const struct rte_flow_item *item,
 			     int inner)
 {
@@ -8627,14 +8626,25 @@ flow_dv_translate_item_vxlan(void *matcher, void *key,
 	const struct rte_flow_item_vxlan *vxlan_v = item->spec;
 	void *headers_m;
 	void *headers_v;
-	void *misc_m = MLX5_ADDR_OF(fte_match_param, matcher, misc_parameters);
-	void *misc_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters);
+	void *misc_m;
+	void *misc_v;
+	void *misc5_m;
+	void *misc5_v;
+	uint32_t *tunnel_header_v;
+	uint32_t *tunnel_header_m;
 	char *vni_m;
 	char *vni_v;
 	uint16_t dport;
 	int size;
 	int i;
+	struct mlx5_priv *priv = dev->data->dev_private;
+	const struct rte_flow_item_vxlan nic_mask = {
+		.vni = "\xff\xff\xff",
+		.rsvd1 = 0xff,
+	};
 
+	misc5_m = MLX5_ADDR_OF(fte_match_param, matcher, misc_parameters_5);
+	misc5_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters_5);
 	if (inner) {
 		headers_m = MLX5_ADDR_OF(fte_match_param, matcher,
 					 inner_headers);
@@ -8652,14 +8662,44 @@ flow_dv_translate_item_vxlan(void *matcher, void *key,
 	}
 	if (!vxlan_v)
 		return;
-	if (!vxlan_m)
-		vxlan_m = &rte_flow_item_vxlan_mask;
-	size = sizeof(vxlan_m->vni);
-	vni_m = MLX5_ADDR_OF(fte_match_set_misc, misc_m, vxlan_vni);
-	vni_v = MLX5_ADDR_OF(fte_match_set_misc, misc_v, vxlan_vni);
-	memcpy(vni_m, vxlan_m->vni, size);
-	for (i = 0; i < size; ++i)
-		vni_v[i] = vni_m[i] & vxlan_v->vni[i];
+	if (!vxlan_m) {
+		if ((!attr->group && !priv->sh->tunnel_header_0_1) ||
+		    (attr->group && !priv->sh->misc5_cap))
+			vxlan_m = &rte_flow_item_vxlan_mask;
+		else
+			vxlan_m = &nic_mask;
+	}
+	if ((!attr->group && !attr->transfer && !priv->sh->tunnel_header_0_1) ||
+	    ((attr->group || attr->transfer) && !priv->sh->misc5_cap)) {
+		misc_m = MLX5_ADDR_OF(fte_match_param,
+				      matcher, misc_parameters);
+		misc_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters);
+		size = sizeof(vxlan_m->vni);
+		vni_m = MLX5_ADDR_OF(fte_match_set_misc, misc_m, vxlan_vni);
+		vni_v = MLX5_ADDR_OF(fte_match_set_misc, misc_v, vxlan_vni);
+		memcpy(vni_m, vxlan_m->vni, size);
+		for (i = 0; i < size; ++i)
+			vni_v[i] = vni_m[i] & vxlan_v->vni[i];
+		return;
+	}
+	tunnel_header_v = (uint32_t *)MLX5_ADDR_OF(fte_match_set_misc5,
+						   misc5_v,
+						   tunnel_header_1);
+	tunnel_header_m = (uint32_t *)MLX5_ADDR_OF(fte_match_set_misc5,
+						   misc5_m,
+						   tunnel_header_1);
+	*tunnel_header_v = (vxlan_v->vni[0] & vxlan_m->vni[0]) |
+			   (vxlan_v->vni[1] & vxlan_m->vni[1]) << 8 |
+			   (vxlan_v->vni[2] & vxlan_m->vni[2]) << 16;
+	if (*tunnel_header_v)
+		*tunnel_header_m = vxlan_m->vni[0] |
+			vxlan_m->vni[1] << 8 |
+			vxlan_m->vni[2] << 16;
+	else
+		*tunnel_header_m = 0x0;
+	*tunnel_header_v |= (vxlan_v->rsvd1 & vxlan_m->rsvd1) << 24;
+	if (vxlan_v->rsvd1 & vxlan_m->rsvd1)
+		*tunnel_header_m |= vxlan_m->rsvd1 << 24;
 }
 
 /**
@@ -9834,9 +9874,32 @@ flow_dv_matcher_enable(uint32_t *match_criteria)
 	match_criteria_enable |=
 		(!HEADER_IS_ZERO(match_criteria, misc_parameters_4)) <<
 		MLX5_MATCH_CRITERIA_ENABLE_MISC4_BIT;
+	match_criteria_enable |=
+		(!HEADER_IS_ZERO(match_criteria, misc_parameters_5)) <<
+		MLX5_MATCH_CRITERIA_ENABLE_MISC5_BIT;
 	return match_criteria_enable;
 }
 
+static void
+__flow_dv_adjust_buf_size(size_t *size, uint8_t match_criteria)
+{
+	/*
+	 * Check flow matching criteria first, subtract misc5/4 length if flow
+	 * doesn't own misc5/4 parameters. In some old rdma-core releases,
+	 * misc5/4 are not supported, and matcher creation failure is expected
+	 * w/o subtration. If misc5 is provided, misc4 must be counted in since
+	 * misc5 is right after misc4.
+	 */
+	if (!(match_criteria & (1 << MLX5_MATCH_CRITERIA_ENABLE_MISC5_BIT))) {
+		*size = MLX5_ST_SZ_BYTES(fte_match_param) -
+			MLX5_ST_SZ_BYTES(fte_match_set_misc5);
+		if (!(match_criteria & (1 <<
+			MLX5_MATCH_CRITERIA_ENABLE_MISC4_BIT))) {
+			*size -= MLX5_ST_SZ_BYTES(fte_match_set_misc4);
+		}
+	}
+}
+
 struct mlx5_hlist_entry *
 flow_dv_tbl_create_cb(struct mlx5_hlist *list, uint64_t key64, void *cb_ctx)
 {
@@ -10103,6 +10166,8 @@ flow_dv_matcher_create_cb(struct mlx5_cache_list *list,
 	*cache = *ref;
 	dv_attr.match_criteria_enable =
 		flow_dv_matcher_enable(cache->mask.buf);
+	__flow_dv_adjust_buf_size(&ref->mask.size,
+				  dv_attr.match_criteria_enable);
 	dv_attr.priority = ref->priority;
 	if (tbl->is_egress)
 		dv_attr.flags |= IBV_FLOW_ATTR_FLAGS_EGRESS;
@@ -10152,7 +10217,6 @@ flow_dv_matcher_register(struct rte_eth_dev *dev,
 		.error = error,
 		.data = ref,
 	};
-
 	/**
 	 * tunnel offload API requires this registration for cases when
 	 * tunnel match rule was inserted before tunnel set rule.
@@ -12011,8 +12075,7 @@ flow_dv_translate(struct rte_eth_dev *dev,
 	uint64_t action_flags = 0;
 	struct mlx5_flow_dv_matcher matcher = {
 		.mask = {
-			.size = sizeof(matcher.mask.buf) -
-				MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+			.size = sizeof(matcher.mask.buf),
 		},
 	};
 	int actions_n = 0;
@@ -12819,7 +12882,8 @@ flow_dv_translate(struct rte_eth_dev *dev,
 			last_item = MLX5_FLOW_LAYER_GRE;
 			break;
 		case RTE_FLOW_ITEM_TYPE_VXLAN:
-			flow_dv_translate_item_vxlan(match_mask, match_value,
+			flow_dv_translate_item_vxlan(dev, attr,
+						     match_mask, match_value,
 						     items, tunnel);
 			matcher.priority = MLX5_TUNNEL_PRIO_GET(rss_desc);
 			last_item = MLX5_FLOW_LAYER_VXLAN;
@@ -12917,10 +12981,6 @@ flow_dv_translate(struct rte_eth_dev *dev,
 						NULL,
 						"cannot create eCPRI parser");
 			}
-			/* Adjust the length matcher and device flow value. */
-			matcher.mask.size = MLX5_ST_SZ_BYTES(fte_match_param);
-			dev_flow->dv.value.size =
-					MLX5_ST_SZ_BYTES(fte_match_param);
 			flow_dv_translate_item_ecpri(dev, match_mask,
 						     match_value, items);
 			/* No other protocol should follow eCPRI layer. */
@@ -13221,6 +13281,7 @@ flow_dv_apply(struct rte_eth_dev *dev, struct rte_flow *flow,
 	int idx;
 	struct mlx5_flow_workspace *wks = mlx5_flow_get_thread_workspace();
 	struct mlx5_flow_rss_desc *rss_desc = &wks->rss_desc;
+	uint8_t misc_mask;
 
 	MLX5_ASSERT(wks);
 	for (idx = wks->flow_idx - 1; idx >= 0; idx--) {
@@ -13291,6 +13352,8 @@ flow_dv_apply(struct rte_eth_dev *dev, struct rte_flow *flow,
 			}
 			dv->actions[n++] = priv->sh->default_miss_action;
 		}
+		misc_mask = flow_dv_matcher_enable(dv->value.buf);
+		__flow_dv_adjust_buf_size(&dv->value.size, misc_mask);
 		err = mlx5_flow_os_create_flow(dv_h->matcher->matcher_object,
 					       (void *)&dv->value, n,
 					       dv->actions, &dh->drv_flow);
@@ -15339,14 +15402,13 @@ __flow_dv_create_policy_flow(struct rte_eth_dev *dev,
 {
 	int ret;
 	struct mlx5_flow_dv_match_params value = {
-		.size = sizeof(value.buf) -
-			MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+		.size = sizeof(value.buf),
 	};
 	struct mlx5_flow_dv_match_params matcher = {
-		.size = sizeof(matcher.buf) -
-			MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+		.size = sizeof(matcher.buf),
 	};
 	struct mlx5_priv *priv = dev->data->dev_private;
+	uint8_t misc_mask;
 
 	if (!is_default_policy && (priv->representor || priv->master)) {
 		if (flow_dv_translate_item_port_id(dev, matcher.buf,
@@ -15360,6 +15422,8 @@ __flow_dv_create_policy_flow(struct rte_eth_dev *dev,
 				(enum modify_reg)color_reg_c_idx,
 				rte_col_2_mlx5_col(color),
 				UINT32_MAX);
+	misc_mask = flow_dv_matcher_enable(value.buf);
+	__flow_dv_adjust_buf_size(&value.size, misc_mask);
 	ret = mlx5_flow_os_create_flow(matcher_object,
 			(void *)&value, actions_n, actions, rule);
 	if (ret) {
@@ -15382,14 +15446,12 @@ __flow_dv_create_policy_matcher(struct rte_eth_dev *dev,
 	struct mlx5_flow_tbl_resource *tbl_rsc = sub_policy->tbl_rsc;
 	struct mlx5_flow_dv_matcher matcher = {
 		.mask = {
-			.size = sizeof(matcher.mask.buf) -
-				MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+			.size = sizeof(matcher.mask.buf),
 		},
 		.tbl = tbl_rsc,
 	};
 	struct mlx5_flow_dv_match_params value = {
-		.size = sizeof(value.buf) -
-			MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+		.size = sizeof(value.buf),
 	};
 	struct mlx5_flow_cb_ctx ctx = {
 		.error = error,
@@ -15766,12 +15828,10 @@ flow_dv_create_mtr_tbls(struct rte_eth_dev *dev,
 	int domain, ret, i;
 	struct mlx5_flow_counter *cnt;
 	struct mlx5_flow_dv_match_params value = {
-		.size = sizeof(value.buf) -
-		MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+		.size = sizeof(value.buf),
 	};
 	struct mlx5_flow_dv_match_params matcher_para = {
-		.size = sizeof(matcher_para.buf) -
-		MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+		.size = sizeof(matcher_para.buf),
 	};
 	int mtr_id_reg_c = mlx5_flow_get_reg_id(dev, MLX5_MTR_ID,
 						     0, &error);
@@ -15780,8 +15840,7 @@ flow_dv_create_mtr_tbls(struct rte_eth_dev *dev,
 	struct mlx5_cache_entry *entry;
 	struct mlx5_flow_dv_matcher matcher = {
 		.mask = {
-			.size = sizeof(matcher.mask.buf) -
-			MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+			.size = sizeof(matcher.mask.buf),
 		},
 	};
 	struct mlx5_flow_dv_matcher *drop_matcher;
@@ -15789,6 +15848,7 @@ flow_dv_create_mtr_tbls(struct rte_eth_dev *dev,
 		.error = &error,
 		.data = &matcher,
 	};
+	uint8_t misc_mask;
 
 	if (!priv->mtr_en || mtr_id_reg_c < 0) {
 		rte_errno = ENOTSUP;
@@ -15838,6 +15898,8 @@ flow_dv_create_mtr_tbls(struct rte_eth_dev *dev,
 			actions[i++] = priv->sh->dr_drop_action;
 			flow_dv_match_meta_reg(matcher_para.buf, value.buf,
 				(enum modify_reg)mtr_id_reg_c, 0, 0);
+			misc_mask = flow_dv_matcher_enable(value.buf);
+			__flow_dv_adjust_buf_size(&value.size, misc_mask);
 			ret = mlx5_flow_os_create_flow
 				(mtrmng->def_matcher[domain]->matcher_object,
 				(void *)&value, i, actions,
@@ -15881,6 +15943,8 @@ flow_dv_create_mtr_tbls(struct rte_eth_dev *dev,
 					fm->drop_cnt, NULL);
 		actions[i++] = cnt->action;
 		actions[i++] = priv->sh->dr_drop_action;
+		misc_mask = flow_dv_matcher_enable(value.buf);
+		__flow_dv_adjust_buf_size(&value.size, misc_mask);
 		ret = mlx5_flow_os_create_flow(drop_matcher->matcher_object,
 					       (void *)&value, i, actions,
 					       &fm->drop_rule[domain]);
@@ -16161,10 +16225,12 @@ mlx5_flow_dv_discover_counter_offset_support(struct rte_eth_dev *dev)
 	if (ret)
 		goto err;
 	dv_attr.match_criteria_enable = flow_dv_matcher_enable(mask.buf);
+	__flow_dv_adjust_buf_size(&mask.size, dv_attr.match_criteria_enable);
 	ret = mlx5_flow_os_create_flow_matcher(sh->ctx, &dv_attr, tbl->obj,
 					       &matcher);
 	if (ret)
 		goto err;
+	__flow_dv_adjust_buf_size(&value.size, dv_attr.match_criteria_enable);
 	ret = mlx5_flow_os_create_flow(matcher, (void *)&value, 1,
 				       actions, &flow);
 err:
diff --git a/drivers/net/mlx5/mlx5_flow_verbs.c b/drivers/net/mlx5/mlx5_flow_verbs.c
index fe9673310a..7b3d0b320d 100644
--- a/drivers/net/mlx5/mlx5_flow_verbs.c
+++ b/drivers/net/mlx5/mlx5_flow_verbs.c
@@ -1381,7 +1381,8 @@ flow_verbs_validate(struct rte_eth_dev *dev,
 					     MLX5_FLOW_LAYER_OUTER_L4_TCP;
 			break;
 		case RTE_FLOW_ITEM_TYPE_VXLAN:
-			ret = mlx5_flow_validate_item_vxlan(items, item_flags,
+			ret = mlx5_flow_validate_item_vxlan(dev, items,
+							    item_flags, attr,
 							    error);
 			if (ret < 0)
 				return ret;
diff --git a/drivers/vdpa/mlx5/mlx5_vdpa_steer.c b/drivers/vdpa/mlx5/mlx5_vdpa_steer.c
index 1fcd24c002..383f003966 100644
--- a/drivers/vdpa/mlx5/mlx5_vdpa_steer.c
+++ b/drivers/vdpa/mlx5/mlx5_vdpa_steer.c
@@ -140,11 +140,13 @@ mlx5_vdpa_rss_flows_create(struct mlx5_vdpa_priv *priv)
 		/**< Matcher value. This value is used as the mask or a key. */
 	} matcher_mask = {
 				.size = sizeof(matcher_mask.buf) -
-					MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+					MLX5_ST_SZ_BYTES(fte_match_set_misc4) -
+					MLX5_ST_SZ_BYTES(fte_match_set_misc5),
 			},
 	  matcher_value = {
 				.size = sizeof(matcher_value.buf) -
-					MLX5_ST_SZ_BYTES(fte_match_set_misc4),
+					MLX5_ST_SZ_BYTES(fte_match_set_misc4) -
+					MLX5_ST_SZ_BYTES(fte_match_set_misc5),
 			};
 	struct mlx5dv_flow_matcher_attr dv_attr = {
 		.type = IBV_FLOW_ATTR_NORMAL,
-- 
2.27.0