net/mlx5: fix NVGRE matching
[dpdk.git] / drivers / net / mlx5 / mlx5_flow_dv.c
index e8560fd..f1d32bd 100644 (file)
@@ -6,6 +6,7 @@
 #include <stdalign.h>
 #include <stdint.h>
 #include <string.h>
+#include <unistd.h>
 
 /* Verbs header. */
 /* ISO C doesn't support unnamed structs/unions, disabling -pedantic. */
@@ -61,6 +62,9 @@ union flow_dv_attr {
        uint32_t attr;
 };
 
+#define MLX5_FLOW_IPV4_LRO (1 << 0)
+#define MLX5_FLOW_IPV6_LRO (1 << 1)
+
 /**
  * Initialize flow attributes structure according to flow items' types.
  *
@@ -136,9 +140,44 @@ struct field_modify_info modify_udp[] = {
 struct field_modify_info modify_tcp[] = {
        {2, 0, MLX5_MODI_OUT_TCP_SPORT},
        {2, 2, MLX5_MODI_OUT_TCP_DPORT},
+       {4, 4, MLX5_MODI_OUT_TCP_SEQ_NUM},
+       {4, 8, MLX5_MODI_OUT_TCP_ACK_NUM},
        {0, 0, 0},
 };
 
+static void
+mlx5_flow_tunnel_ip_check(const struct rte_flow_item *item, uint64_t *flags)
+{
+       uint8_t next_protocol = 0xFF;
+
+       if (item->mask != NULL) {
+               switch (item->type) {
+               case RTE_FLOW_ITEM_TYPE_IPV4:
+                       next_protocol =
+                               ((const struct rte_flow_item_ipv4 *)
+                                (item->spec))->hdr.next_proto_id;
+                       next_protocol &=
+                               ((const struct rte_flow_item_ipv4 *)
+                                (item->mask))->hdr.next_proto_id;
+                       break;
+               case RTE_FLOW_ITEM_TYPE_IPV6:
+                       next_protocol =
+                               ((const struct rte_flow_item_ipv6 *)
+                                (item->spec))->hdr.proto;
+                       next_protocol &=
+                               ((const struct rte_flow_item_ipv6 *)
+                                (item->mask))->hdr.proto;
+                       break;
+               default:
+                       break;
+               }
+       }
+       if (next_protocol == IPPROTO_IPIP)
+               *flags |= MLX5_FLOW_LAYER_IPIP;
+       if (next_protocol == IPPROTO_IPV6)
+               *flags |= MLX5_FLOW_LAYER_IPV6_ENCAP;
+}
+
 /**
  * Acquire the synchronizing object to protect multithreaded access
  * to shared dv context. Lock occurs only if context is actually
@@ -560,6 +599,96 @@ flow_dv_convert_action_modify_dec_ttl
                                             MLX5_MODIFICATION_TYPE_ADD, error);
 }
 
+/**
+ * Convert modify-header increment/decrement TCP Sequence number
+ * to DV specification.
+ *
+ * @param[in,out] resource
+ *   Pointer to the modify-header resource.
+ * @param[in] action
+ *   Pointer to action specification.
+ * @param[out] error
+ *   Pointer to the error structure.
+ *
+ * @return
+ *   0 on success, a negative errno value otherwise and rte_errno is set.
+ */
+static int
+flow_dv_convert_action_modify_tcp_seq
+                       (struct mlx5_flow_dv_modify_hdr_resource *resource,
+                        const struct rte_flow_action *action,
+                        struct rte_flow_error *error)
+{
+       const rte_be32_t *conf = (const rte_be32_t *)(action->conf);
+       uint64_t value = rte_be_to_cpu_32(*conf);
+       struct rte_flow_item item;
+       struct rte_flow_item_tcp tcp;
+       struct rte_flow_item_tcp tcp_mask;
+
+       memset(&tcp, 0, sizeof(tcp));
+       memset(&tcp_mask, 0, sizeof(tcp_mask));
+       if (action->type == RTE_FLOW_ACTION_TYPE_DEC_TCP_SEQ)
+               /*
+                * The HW has no decrement operation, only increment operation.
+                * To simulate decrement X from Y using increment operation
+                * we need to add UINT32_MAX X times to Y.
+                * Each adding of UINT32_MAX decrements Y by 1.
+                */
+               value *= UINT32_MAX;
+       tcp.hdr.sent_seq = rte_cpu_to_be_32((uint32_t)value);
+       tcp_mask.hdr.sent_seq = RTE_BE32(UINT32_MAX);
+       item.type = RTE_FLOW_ITEM_TYPE_TCP;
+       item.spec = &tcp;
+       item.mask = &tcp_mask;
+       return flow_dv_convert_modify_action(&item, modify_tcp, resource,
+                                            MLX5_MODIFICATION_TYPE_ADD, error);
+}
+
+/**
+ * Convert modify-header increment/decrement TCP Acknowledgment number
+ * to DV specification.
+ *
+ * @param[in,out] resource
+ *   Pointer to the modify-header resource.
+ * @param[in] action
+ *   Pointer to action specification.
+ * @param[out] error
+ *   Pointer to the error structure.
+ *
+ * @return
+ *   0 on success, a negative errno value otherwise and rte_errno is set.
+ */
+static int
+flow_dv_convert_action_modify_tcp_ack
+                       (struct mlx5_flow_dv_modify_hdr_resource *resource,
+                        const struct rte_flow_action *action,
+                        struct rte_flow_error *error)
+{
+       const rte_be32_t *conf = (const rte_be32_t *)(action->conf);
+       uint64_t value = rte_be_to_cpu_32(*conf);
+       struct rte_flow_item item;
+       struct rte_flow_item_tcp tcp;
+       struct rte_flow_item_tcp tcp_mask;
+
+       memset(&tcp, 0, sizeof(tcp));
+       memset(&tcp_mask, 0, sizeof(tcp_mask));
+       if (action->type == RTE_FLOW_ACTION_TYPE_DEC_TCP_ACK)
+               /*
+                * The HW has no decrement operation, only increment operation.
+                * To simulate decrement X from Y using increment operation
+                * we need to add UINT32_MAX X times to Y.
+                * Each adding of UINT32_MAX decrements Y by 1.
+                */
+               value *= UINT32_MAX;
+       tcp.hdr.recv_ack = rte_cpu_to_be_32((uint32_t)value);
+       tcp_mask.hdr.recv_ack = RTE_BE32(UINT32_MAX);
+       item.type = RTE_FLOW_ITEM_TYPE_TCP;
+       item.spec = &tcp;
+       item.mask = &tcp_mask;
+       return flow_dv_convert_modify_action(&item, modify_tcp, resource,
+                                            MLX5_MODIFICATION_TYPE_ADD, error);
+}
+
 /**
  * Validate META item.
  *
@@ -1213,12 +1342,12 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
 {
        struct rte_ether_hdr *eth = NULL;
        struct rte_vlan_hdr *vlan = NULL;
-       struct ipv4_hdr *ipv4 = NULL;
-       struct ipv6_hdr *ipv6 = NULL;
-       struct udp_hdr *udp = NULL;
+       struct rte_ipv4_hdr *ipv4 = NULL;
+       struct rte_ipv6_hdr *ipv6 = NULL;
+       struct rte_udp_hdr *udp = NULL;
        struct rte_vxlan_hdr *vxlan = NULL;
        struct rte_vxlan_gpe_hdr *vxlan_gpe = NULL;
-       struct gre_hdr *gre = NULL;
+       struct rte_gre_hdr *gre = NULL;
        size_t len;
        size_t temp_size = 0;
 
@@ -1247,10 +1376,10 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
                                                (void *)items->type,
                                                "eth header not found");
                        if (!eth->ether_type)
-                               eth->ether_type = RTE_BE16(ETHER_TYPE_VLAN);
+                               eth->ether_type = RTE_BE16(RTE_ETHER_TYPE_VLAN);
                        break;
                case RTE_FLOW_ITEM_TYPE_IPV4:
-                       ipv4 = (struct ipv4_hdr *)&buf[temp_size];
+                       ipv4 = (struct rte_ipv4_hdr *)&buf[temp_size];
                        if (!vlan && !eth)
                                return rte_flow_error_set(error, EINVAL,
                                                RTE_FLOW_ERROR_TYPE_ACTION,
@@ -1258,9 +1387,9 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
                                                "neither eth nor vlan"
                                                " header found");
                        if (vlan && !vlan->eth_proto)
-                               vlan->eth_proto = RTE_BE16(ETHER_TYPE_IPv4);
+                               vlan->eth_proto = RTE_BE16(RTE_ETHER_TYPE_IPV4);
                        else if (eth && !eth->ether_type)
-                               eth->ether_type = RTE_BE16(ETHER_TYPE_IPv4);
+                               eth->ether_type = RTE_BE16(RTE_ETHER_TYPE_IPV4);
                        if (!ipv4->version_ihl)
                                ipv4->version_ihl = MLX5_ENCAP_IPV4_VERSION |
                                                    MLX5_ENCAP_IPV4_IHL_MIN;
@@ -1268,7 +1397,7 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
                                ipv4->time_to_live = MLX5_ENCAP_IPV4_TTL_DEF;
                        break;
                case RTE_FLOW_ITEM_TYPE_IPV6:
-                       ipv6 = (struct ipv6_hdr *)&buf[temp_size];
+                       ipv6 = (struct rte_ipv6_hdr *)&buf[temp_size];
                        if (!vlan && !eth)
                                return rte_flow_error_set(error, EINVAL,
                                                RTE_FLOW_ERROR_TYPE_ACTION,
@@ -1276,9 +1405,9 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
                                                "neither eth nor vlan"
                                                " header found");
                        if (vlan && !vlan->eth_proto)
-                               vlan->eth_proto = RTE_BE16(ETHER_TYPE_IPv6);
+                               vlan->eth_proto = RTE_BE16(RTE_ETHER_TYPE_IPV6);
                        else if (eth && !eth->ether_type)
-                               eth->ether_type = RTE_BE16(ETHER_TYPE_IPv6);
+                               eth->ether_type = RTE_BE16(RTE_ETHER_TYPE_IPV6);
                        if (!ipv6->vtc_flow)
                                ipv6->vtc_flow =
                                        RTE_BE32(MLX5_ENCAP_IPV6_VTC_FLOW);
@@ -1286,7 +1415,7 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
                                ipv6->hop_limits = MLX5_ENCAP_IPV6_HOP_LIMIT;
                        break;
                case RTE_FLOW_ITEM_TYPE_UDP:
-                       udp = (struct udp_hdr *)&buf[temp_size];
+                       udp = (struct rte_udp_hdr *)&buf[temp_size];
                        if (!ipv4 && !ipv6)
                                return rte_flow_error_set(error, EINVAL,
                                                RTE_FLOW_ERROR_TYPE_ACTION,
@@ -1331,7 +1460,7 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
                        break;
                case RTE_FLOW_ITEM_TYPE_GRE:
                case RTE_FLOW_ITEM_TYPE_NVGRE:
-                       gre = (struct gre_hdr *)&buf[temp_size];
+                       gre = (struct rte_gre_hdr *)&buf[temp_size];
                        if (!gre->proto)
                                return rte_flow_error_set(error, EINVAL,
                                                RTE_FLOW_ERROR_TYPE_ACTION,
@@ -1362,6 +1491,50 @@ flow_dv_convert_encap_data(const struct rte_flow_item *items, uint8_t *buf,
        return 0;
 }
 
+static int
+flow_dv_zero_encap_udp_csum(void *data, struct rte_flow_error *error)
+{
+       struct rte_ether_hdr *eth = NULL;
+       struct rte_vlan_hdr *vlan = NULL;
+       struct rte_ipv6_hdr *ipv6 = NULL;
+       struct rte_udp_hdr *udp = NULL;
+       char *next_hdr;
+       uint16_t proto;
+
+       eth = (struct rte_ether_hdr *)data;
+       next_hdr = (char *)(eth + 1);
+       proto = RTE_BE16(eth->ether_type);
+
+       /* VLAN skipping */
+       while (proto == RTE_ETHER_TYPE_VLAN || proto == RTE_ETHER_TYPE_QINQ) {
+               next_hdr += sizeof(struct rte_vlan_hdr);
+               vlan = (struct rte_vlan_hdr *)next_hdr;
+               proto = RTE_BE16(vlan->eth_proto);
+       }
+
+       /* HW calculates IPv4 csum. no need to proceed */
+       if (proto == RTE_ETHER_TYPE_IPV4)
+               return 0;
+
+       /* non IPv4/IPv6 header. not supported */
+       if (proto != RTE_ETHER_TYPE_IPV6) {
+               return rte_flow_error_set(error, ENOTSUP,
+                                         RTE_FLOW_ERROR_TYPE_ACTION,
+                                         NULL, "Cannot offload non IPv4/IPv6");
+       }
+
+       ipv6 = (struct rte_ipv6_hdr *)next_hdr;
+
+       /* ignore non UDP */
+       if (ipv6->proto != IPPROTO_UDP)
+               return 0;
+
+       udp = (struct rte_udp_hdr *)(ipv6 + 1);
+       udp->dgram_cksum = 0;
+
+       return 0;
+}
+
 /**
  * Convert L2 encap action to DV specification.
  *
@@ -1400,6 +1573,8 @@ flow_dv_create_action_l2_encap(struct rte_eth_dev *dev,
                        (const struct rte_flow_action_raw_encap *)action->conf;
                res.size = raw_encap_data->size;
                memcpy(res.buf, raw_encap_data->data, res.size);
+               if (flow_dv_zero_encap_udp_csum(res.buf, error))
+                       return -rte_errno;
        } else {
                if (action->type == RTE_FLOW_ACTION_TYPE_VXLAN_ENCAP)
                        encap_data =
@@ -1667,6 +1842,96 @@ flow_dv_validate_action_modify_tp(const uint64_t action_flags,
        return ret;
 }
 
+/**
+ * Validate the modify-header actions of increment/decrement
+ * TCP Sequence-number.
+ *
+ * @param[in] action_flags
+ *   Holds the actions detected until now.
+ * @param[in] action
+ *   Pointer to the modify action.
+ * @param[in] item_flags
+ *   Holds the items detected.
+ * @param[out] error
+ *   Pointer to error structure.
+ *
+ * @return
+ *   0 on success, a negative errno value otherwise and rte_errno is set.
+ */
+static int
+flow_dv_validate_action_modify_tcp_seq(const uint64_t action_flags,
+                                      const struct rte_flow_action *action,
+                                      const uint64_t item_flags,
+                                      struct rte_flow_error *error)
+{
+       int ret = 0;
+
+       ret = flow_dv_validate_action_modify_hdr(action_flags, action, error);
+       if (!ret) {
+               if (!(item_flags & MLX5_FLOW_LAYER_OUTER_L4_TCP))
+                       return rte_flow_error_set(error, EINVAL,
+                                                 RTE_FLOW_ERROR_TYPE_ACTION,
+                                                 NULL, "no TCP item in"
+                                                 " pattern");
+               if ((action->type == RTE_FLOW_ACTION_TYPE_INC_TCP_SEQ &&
+                       (action_flags & MLX5_FLOW_ACTION_DEC_TCP_SEQ)) ||
+                   (action->type == RTE_FLOW_ACTION_TYPE_DEC_TCP_SEQ &&
+                       (action_flags & MLX5_FLOW_ACTION_INC_TCP_SEQ)))
+                       return rte_flow_error_set(error, EINVAL,
+                                                 RTE_FLOW_ERROR_TYPE_ACTION,
+                                                 NULL,
+                                                 "cannot decrease and increase"
+                                                 " TCP sequence number"
+                                                 " at the same time");
+       }
+       return ret;
+}
+
+/**
+ * Validate the modify-header actions of increment/decrement
+ * TCP Acknowledgment number.
+ *
+ * @param[in] action_flags
+ *   Holds the actions detected until now.
+ * @param[in] action
+ *   Pointer to the modify action.
+ * @param[in] item_flags
+ *   Holds the items detected.
+ * @param[out] error
+ *   Pointer to error structure.
+ *
+ * @return
+ *   0 on success, a negative errno value otherwise and rte_errno is set.
+ */
+static int
+flow_dv_validate_action_modify_tcp_ack(const uint64_t action_flags,
+                                      const struct rte_flow_action *action,
+                                      const uint64_t item_flags,
+                                      struct rte_flow_error *error)
+{
+       int ret = 0;
+
+       ret = flow_dv_validate_action_modify_hdr(action_flags, action, error);
+       if (!ret) {
+               if (!(item_flags & MLX5_FLOW_LAYER_OUTER_L4_TCP))
+                       return rte_flow_error_set(error, EINVAL,
+                                                 RTE_FLOW_ERROR_TYPE_ACTION,
+                                                 NULL, "no TCP item in"
+                                                 " pattern");
+               if ((action->type == RTE_FLOW_ACTION_TYPE_INC_TCP_ACK &&
+                       (action_flags & MLX5_FLOW_ACTION_DEC_TCP_ACK)) ||
+                   (action->type == RTE_FLOW_ACTION_TYPE_DEC_TCP_ACK &&
+                       (action_flags & MLX5_FLOW_ACTION_INC_TCP_ACK)))
+                       return rte_flow_error_set(error, EINVAL,
+                                                 RTE_FLOW_ERROR_TYPE_ACTION,
+                                                 NULL,
+                                                 "cannot decrease and increase"
+                                                 " TCP acknowledgment number"
+                                                 " at the same time");
+       }
+       return ret;
+}
+
 /**
  * Validate the modify-header TTL actions.
  *
@@ -1885,6 +2150,8 @@ flow_dv_modify_hdr_resource_register
        return 0;
 }
 
+#define MLX5_CNT_CONTAINER_RESIZE 64
+
 /**
  * Get or create a flow counter.
  *
@@ -1899,34 +2166,34 @@ flow_dv_modify_hdr_resource_register
  *   pointer to flow counter on success, NULL otherwise and rte_errno is set.
  */
 static struct mlx5_flow_counter *
-flow_dv_counter_new(struct rte_eth_dev *dev, uint32_t shared, uint32_t id)
+flow_dv_counter_alloc_fallback(struct rte_eth_dev *dev, uint32_t shared,
+                              uint32_t id)
 {
        struct mlx5_priv *priv = dev->data->dev_private;
        struct mlx5_flow_counter *cnt = NULL;
-       struct mlx5_devx_counter_set *dcs = NULL;
-       int ret;
+       struct mlx5_devx_obj *dcs = NULL;
 
        if (!priv->config.devx) {
-               ret = -ENOTSUP;
-               goto error_exit;
+               rte_errno = ENOTSUP;
+               return NULL;
        }
        if (shared) {
-               LIST_FOREACH(cnt, &priv->flow_counters, next) {
+               TAILQ_FOREACH(cnt, &priv->sh->cmng.flow_counters, next) {
                        if (cnt->shared && cnt->id == id) {
                                cnt->ref_cnt++;
                                return cnt;
                        }
                }
        }
+       dcs = mlx5_devx_cmd_flow_counter_alloc(priv->sh->ctx, 0);
+       if (!dcs)
+               return NULL;
        cnt = rte_calloc(__func__, 1, sizeof(*cnt), 0);
-       dcs = rte_calloc(__func__, 1, sizeof(*dcs), 0);
-       if (!dcs || !cnt) {
-               ret = -ENOMEM;
-               goto error_exit;
+       if (!cnt) {
+               claim_zero(mlx5_devx_cmd_destroy(cnt->dcs));
+               rte_errno = ENOMEM;
+               return NULL;
        }
-       ret = mlx5_devx_cmd_flow_counter_alloc(priv->sh->ctx, dcs);
-       if (ret)
-               goto error_exit;
        struct mlx5_flow_counter tmpl = {
                .shared = shared,
                .ref_cnt = 1,
@@ -1935,42 +2202,568 @@ flow_dv_counter_new(struct rte_eth_dev *dev, uint32_t shared, uint32_t id)
        };
        tmpl.action = mlx5_glue->dv_create_flow_action_counter(dcs->obj, 0);
        if (!tmpl.action) {
-               ret = errno;
-               goto error_exit;
+               claim_zero(mlx5_devx_cmd_destroy(cnt->dcs));
+               rte_errno = errno;
+               rte_free(cnt);
+               return NULL;
        }
        *cnt = tmpl;
-       LIST_INSERT_HEAD(&priv->flow_counters, cnt, next);
+       TAILQ_INSERT_HEAD(&priv->sh->cmng.flow_counters, cnt, next);
        return cnt;
-error_exit:
-       rte_free(cnt);
-       rte_free(dcs);
-       rte_errno = -ret;
-       return NULL;
 }
 
 /**
  * Release a flow counter.
  *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
  * @param[in] counter
  *   Pointer to the counter handler.
  */
 static void
-flow_dv_counter_release(struct mlx5_flow_counter *counter)
+flow_dv_counter_release_fallback(struct rte_eth_dev *dev,
+                                struct mlx5_flow_counter *counter)
 {
-       int ret;
+       struct mlx5_priv *priv = dev->data->dev_private;
 
        if (!counter)
                return;
        if (--counter->ref_cnt == 0) {
-               ret = mlx5_devx_cmd_flow_counter_free(counter->dcs->obj);
-               if (ret)
-                       DRV_LOG(ERR, "Failed to free devx counters, %d", ret);
-               LIST_REMOVE(counter, next);
-               rte_free(counter->dcs);
+               TAILQ_REMOVE(&priv->sh->cmng.flow_counters, counter, next);
+               claim_zero(mlx5_devx_cmd_destroy(counter->dcs));
                rte_free(counter);
        }
 }
 
+/**
+ * Query a devx flow counter.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] cnt
+ *   Pointer to the flow counter.
+ * @param[out] pkts
+ *   The statistics value of packets.
+ * @param[out] bytes
+ *   The statistics value of bytes.
+ *
+ * @return
+ *   0 on success, otherwise a negative errno value and rte_errno is set.
+ */
+static inline int
+_flow_dv_query_count_fallback(struct rte_eth_dev *dev __rte_unused,
+                    struct mlx5_flow_counter *cnt, uint64_t *pkts,
+                    uint64_t *bytes)
+{
+       return mlx5_devx_cmd_flow_counter_query(cnt->dcs, 0, 0, pkts, bytes,
+                                               0, NULL, NULL, 0);
+}
+
+/**
+ * Get a pool by a counter.
+ *
+ * @param[in] cnt
+ *   Pointer to the counter.
+ *
+ * @return
+ *   The counter pool.
+ */
+static struct mlx5_flow_counter_pool *
+flow_dv_counter_pool_get(struct mlx5_flow_counter *cnt)
+{
+       if (!cnt->batch) {
+               cnt -= cnt->dcs->id % MLX5_COUNTERS_PER_POOL;
+               return (struct mlx5_flow_counter_pool *)cnt - 1;
+       }
+       return cnt->pool;
+}
+
+/**
+ * Get a pool by devx counter ID.
+ *
+ * @param[in] cont
+ *   Pointer to the counter container.
+ * @param[in] id
+ *   The counter devx ID.
+ *
+ * @return
+ *   The counter pool pointer if exists, NULL otherwise,
+ */
+static struct mlx5_flow_counter_pool *
+flow_dv_find_pool_by_id(struct mlx5_pools_container *cont, int id)
+{
+       struct mlx5_flow_counter_pool *pool;
+
+       TAILQ_FOREACH(pool, &cont->pool_list, next) {
+               int base = (pool->min_dcs->id / MLX5_COUNTERS_PER_POOL) *
+                               MLX5_COUNTERS_PER_POOL;
+
+               if (id >= base && id < base + MLX5_COUNTERS_PER_POOL)
+                       return pool;
+       };
+       return NULL;
+}
+
+/**
+ * Allocate a new memory for the counter values wrapped by all the needed
+ * management.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] raws_n
+ *   The raw memory areas - each one for MLX5_COUNTERS_PER_POOL counters.
+ *
+ * @return
+ *   The new memory management pointer on success, otherwise NULL and rte_errno
+ *   is set.
+ */
+static struct mlx5_counter_stats_mem_mng *
+flow_dv_create_counter_stat_mem_mng(struct rte_eth_dev *dev, int raws_n)
+{
+       struct mlx5_ibv_shared *sh = ((struct mlx5_priv *)
+                                       (dev->data->dev_private))->sh;
+       struct mlx5_devx_mkey_attr mkey_attr;
+       struct mlx5_counter_stats_mem_mng *mem_mng;
+       volatile struct flow_counter_stats *raw_data;
+       int size = (sizeof(struct flow_counter_stats) *
+                       MLX5_COUNTERS_PER_POOL +
+                       sizeof(struct mlx5_counter_stats_raw)) * raws_n +
+                       sizeof(struct mlx5_counter_stats_mem_mng);
+       uint8_t *mem = rte_calloc(__func__, 1, size, sysconf(_SC_PAGESIZE));
+       int i;
+
+       if (!mem) {
+               rte_errno = ENOMEM;
+               return NULL;
+       }
+       mem_mng = (struct mlx5_counter_stats_mem_mng *)(mem + size) - 1;
+       size = sizeof(*raw_data) * MLX5_COUNTERS_PER_POOL * raws_n;
+       mem_mng->umem = mlx5_glue->devx_umem_reg(sh->ctx, mem, size,
+                                                IBV_ACCESS_LOCAL_WRITE);
+       if (!mem_mng->umem) {
+               rte_errno = errno;
+               rte_free(mem);
+               return NULL;
+       }
+       mkey_attr.addr = (uintptr_t)mem;
+       mkey_attr.size = size;
+       mkey_attr.umem_id = mem_mng->umem->umem_id;
+       mkey_attr.pd = sh->pdn;
+       mem_mng->dm = mlx5_devx_cmd_mkey_create(sh->ctx, &mkey_attr);
+       if (!mem_mng->dm) {
+               mlx5_glue->devx_umem_dereg(mem_mng->umem);
+               rte_errno = errno;
+               rte_free(mem);
+               return NULL;
+       }
+       mem_mng->raws = (struct mlx5_counter_stats_raw *)(mem + size);
+       raw_data = (volatile struct flow_counter_stats *)mem;
+       for (i = 0; i < raws_n; ++i) {
+               mem_mng->raws[i].mem_mng = mem_mng;
+               mem_mng->raws[i].data = raw_data + i * MLX5_COUNTERS_PER_POOL;
+       }
+       LIST_INSERT_HEAD(&sh->cmng.mem_mngs, mem_mng, next);
+       return mem_mng;
+}
+
+/**
+ * Resize a counter container.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] batch
+ *   Whether the pool is for counter that was allocated by batch command.
+ *
+ * @return
+ *   The new container pointer on success, otherwise NULL and rte_errno is set.
+ */
+static struct mlx5_pools_container *
+flow_dv_container_resize(struct rte_eth_dev *dev, uint32_t batch)
+{
+       struct mlx5_priv *priv = dev->data->dev_private;
+       struct mlx5_pools_container *cont =
+                       MLX5_CNT_CONTAINER(priv->sh, batch, 0);
+       struct mlx5_pools_container *new_cont =
+                       MLX5_CNT_CONTAINER_UNUSED(priv->sh, batch, 0);
+       struct mlx5_counter_stats_mem_mng *mem_mng;
+       uint32_t resize = cont->n + MLX5_CNT_CONTAINER_RESIZE;
+       uint32_t mem_size = sizeof(struct mlx5_flow_counter_pool *) * resize;
+       int i;
+
+       if (cont != MLX5_CNT_CONTAINER(priv->sh, batch, 1)) {
+               /* The last resize still hasn't detected by the host thread. */
+               rte_errno = EAGAIN;
+               return NULL;
+       }
+       new_cont->pools = rte_calloc(__func__, 1, mem_size, 0);
+       if (!new_cont->pools) {
+               rte_errno = ENOMEM;
+               return NULL;
+       }
+       if (cont->n)
+               memcpy(new_cont->pools, cont->pools, cont->n *
+                      sizeof(struct mlx5_flow_counter_pool *));
+       mem_mng = flow_dv_create_counter_stat_mem_mng(dev,
+               MLX5_CNT_CONTAINER_RESIZE + MLX5_MAX_PENDING_QUERIES);
+       if (!mem_mng) {
+               rte_free(new_cont->pools);
+               return NULL;
+       }
+       for (i = 0; i < MLX5_MAX_PENDING_QUERIES; ++i)
+               LIST_INSERT_HEAD(&priv->sh->cmng.free_stat_raws,
+                                mem_mng->raws + MLX5_CNT_CONTAINER_RESIZE +
+                                i, next);
+       new_cont->n = resize;
+       rte_atomic16_set(&new_cont->n_valid, rte_atomic16_read(&cont->n_valid));
+       TAILQ_INIT(&new_cont->pool_list);
+       TAILQ_CONCAT(&new_cont->pool_list, &cont->pool_list, next);
+       new_cont->init_mem_mng = mem_mng;
+       rte_cio_wmb();
+        /* Flip the master container. */
+       priv->sh->cmng.mhi[batch] ^= (uint8_t)1;
+       return new_cont;
+}
+
+/**
+ * Query a devx flow counter.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] cnt
+ *   Pointer to the flow counter.
+ * @param[out] pkts
+ *   The statistics value of packets.
+ * @param[out] bytes
+ *   The statistics value of bytes.
+ *
+ * @return
+ *   0 on success, otherwise a negative errno value and rte_errno is set.
+ */
+static inline int
+_flow_dv_query_count(struct rte_eth_dev *dev,
+                    struct mlx5_flow_counter *cnt, uint64_t *pkts,
+                    uint64_t *bytes)
+{
+       struct mlx5_priv *priv = dev->data->dev_private;
+       struct mlx5_flow_counter_pool *pool =
+                       flow_dv_counter_pool_get(cnt);
+       int offset = cnt - &pool->counters_raw[0];
+
+       if (priv->counter_fallback)
+               return _flow_dv_query_count_fallback(dev, cnt, pkts, bytes);
+
+       rte_spinlock_lock(&pool->sl);
+       /*
+        * The single counters allocation may allocate smaller ID than the
+        * current allocated in parallel to the host reading.
+        * In this case the new counter values must be reported as 0.
+        */
+       if (unlikely(!cnt->batch && cnt->dcs->id < pool->raw->min_dcs_id)) {
+               *pkts = 0;
+               *bytes = 0;
+       } else {
+               *pkts = rte_be_to_cpu_64(pool->raw->data[offset].hits);
+               *bytes = rte_be_to_cpu_64(pool->raw->data[offset].bytes);
+       }
+       rte_spinlock_unlock(&pool->sl);
+       return 0;
+}
+
+/**
+ * Create and initialize a new counter pool.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[out] dcs
+ *   The devX counter handle.
+ * @param[in] batch
+ *   Whether the pool is for counter that was allocated by batch command.
+ *
+ * @return
+ *   A new pool pointer on success, NULL otherwise and rte_errno is set.
+ */
+static struct mlx5_flow_counter_pool *
+flow_dv_pool_create(struct rte_eth_dev *dev, struct mlx5_devx_obj *dcs,
+                   uint32_t batch)
+{
+       struct mlx5_priv *priv = dev->data->dev_private;
+       struct mlx5_flow_counter_pool *pool;
+       struct mlx5_pools_container *cont = MLX5_CNT_CONTAINER(priv->sh, batch,
+                                                              0);
+       int16_t n_valid = rte_atomic16_read(&cont->n_valid);
+       uint32_t size;
+
+       if (cont->n == n_valid) {
+               cont = flow_dv_container_resize(dev, batch);
+               if (!cont)
+                       return NULL;
+       }
+       size = sizeof(*pool) + MLX5_COUNTERS_PER_POOL *
+                       sizeof(struct mlx5_flow_counter);
+       pool = rte_calloc(__func__, 1, size, 0);
+       if (!pool) {
+               rte_errno = ENOMEM;
+               return NULL;
+       }
+       pool->min_dcs = dcs;
+       pool->raw = cont->init_mem_mng->raws + n_valid %
+                                                    MLX5_CNT_CONTAINER_RESIZE;
+       pool->raw_hw = NULL;
+       rte_spinlock_init(&pool->sl);
+       /*
+        * The generation of the new allocated counters in this pool is 0, 2 in
+        * the pool generation makes all the counters valid for allocation.
+        */
+       rte_atomic64_set(&pool->query_gen, 0x2);
+       TAILQ_INIT(&pool->counters);
+       TAILQ_INSERT_TAIL(&cont->pool_list, pool, next);
+       cont->pools[n_valid] = pool;
+       /* Pool initialization must be updated before host thread access. */
+       rte_cio_wmb();
+       rte_atomic16_add(&cont->n_valid, 1);
+       return pool;
+}
+
+/**
+ * Prepare a new counter and/or a new counter pool.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[out] cnt_free
+ *   Where to put the pointer of a new counter.
+ * @param[in] batch
+ *   Whether the pool is for counter that was allocated by batch command.
+ *
+ * @return
+ *   The free counter pool pointer and @p cnt_free is set on success,
+ *   NULL otherwise and rte_errno is set.
+ */
+static struct mlx5_flow_counter_pool *
+flow_dv_counter_pool_prepare(struct rte_eth_dev *dev,
+                            struct mlx5_flow_counter **cnt_free,
+                            uint32_t batch)
+{
+       struct mlx5_priv *priv = dev->data->dev_private;
+       struct mlx5_flow_counter_pool *pool;
+       struct mlx5_devx_obj *dcs = NULL;
+       struct mlx5_flow_counter *cnt;
+       uint32_t i;
+
+       if (!batch) {
+               /* bulk_bitmap must be 0 for single counter allocation. */
+               dcs = mlx5_devx_cmd_flow_counter_alloc(priv->sh->ctx, 0);
+               if (!dcs)
+                       return NULL;
+               pool = flow_dv_find_pool_by_id
+                       (MLX5_CNT_CONTAINER(priv->sh, batch, 0), dcs->id);
+               if (!pool) {
+                       pool = flow_dv_pool_create(dev, dcs, batch);
+                       if (!pool) {
+                               mlx5_devx_cmd_destroy(dcs);
+                               return NULL;
+                       }
+               } else if (dcs->id < pool->min_dcs->id) {
+                       rte_atomic64_set(&pool->a64_dcs,
+                                        (int64_t)(uintptr_t)dcs);
+               }
+               cnt = &pool->counters_raw[dcs->id % MLX5_COUNTERS_PER_POOL];
+               TAILQ_INSERT_HEAD(&pool->counters, cnt, next);
+               cnt->dcs = dcs;
+               *cnt_free = cnt;
+               return pool;
+       }
+       /* bulk_bitmap is in 128 counters units. */
+       if (priv->config.hca_attr.flow_counter_bulk_alloc_bitmap & 0x4)
+               dcs = mlx5_devx_cmd_flow_counter_alloc(priv->sh->ctx, 0x4);
+       if (!dcs) {
+               rte_errno = ENODATA;
+               return NULL;
+       }
+       pool = flow_dv_pool_create(dev, dcs, batch);
+       if (!pool) {
+               mlx5_devx_cmd_destroy(dcs);
+               return NULL;
+       }
+       for (i = 0; i < MLX5_COUNTERS_PER_POOL; ++i) {
+               cnt = &pool->counters_raw[i];
+               cnt->pool = pool;
+               TAILQ_INSERT_HEAD(&pool->counters, cnt, next);
+       }
+       *cnt_free = &pool->counters_raw[0];
+       return pool;
+}
+
+/**
+ * Search for existed shared counter.
+ *
+ * @param[in] cont
+ *   Pointer to the relevant counter pool container.
+ * @param[in] id
+ *   The shared counter ID to search.
+ *
+ * @return
+ *   NULL if not existed, otherwise pointer to the shared counter.
+ */
+static struct mlx5_flow_counter *
+flow_dv_counter_shared_search(struct mlx5_pools_container *cont,
+                             uint32_t id)
+{
+       static struct mlx5_flow_counter *cnt;
+       struct mlx5_flow_counter_pool *pool;
+       int i;
+
+       TAILQ_FOREACH(pool, &cont->pool_list, next) {
+               for (i = 0; i < MLX5_COUNTERS_PER_POOL; ++i) {
+                       cnt = &pool->counters_raw[i];
+                       if (cnt->ref_cnt && cnt->shared && cnt->id == id)
+                               return cnt;
+               }
+       }
+       return NULL;
+}
+
+/**
+ * Allocate a flow counter.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] shared
+ *   Indicate if this counter is shared with other flows.
+ * @param[in] id
+ *   Counter identifier.
+ * @param[in] group
+ *   Counter flow group.
+ *
+ * @return
+ *   pointer to flow counter on success, NULL otherwise and rte_errno is set.
+ */
+static struct mlx5_flow_counter *
+flow_dv_counter_alloc(struct rte_eth_dev *dev, uint32_t shared, uint32_t id,
+                     uint16_t group)
+{
+       struct mlx5_priv *priv = dev->data->dev_private;
+       struct mlx5_flow_counter_pool *pool = NULL;
+       struct mlx5_flow_counter *cnt_free = NULL;
+       /*
+        * Currently group 0 flow counter cannot be assigned to a flow if it is
+        * not the first one in the batch counter allocation, so it is better
+        * to allocate counters one by one for these flows in a separate
+        * container.
+        * A counter can be shared between different groups so need to take
+        * shared counters from the single container.
+        */
+       uint32_t batch = (group && !shared) ? 1 : 0;
+       struct mlx5_pools_container *cont = MLX5_CNT_CONTAINER(priv->sh, batch,
+                                                              0);
+
+       if (priv->counter_fallback)
+               return flow_dv_counter_alloc_fallback(dev, shared, id);
+       if (!priv->config.devx) {
+               rte_errno = ENOTSUP;
+               return NULL;
+       }
+       if (shared) {
+               cnt_free = flow_dv_counter_shared_search(cont, id);
+               if (cnt_free) {
+                       if (cnt_free->ref_cnt + 1 == 0) {
+                               rte_errno = E2BIG;
+                               return NULL;
+                       }
+                       cnt_free->ref_cnt++;
+                       return cnt_free;
+               }
+       }
+       /* Pools which has a free counters are in the start. */
+       TAILQ_FOREACH(pool, &cont->pool_list, next) {
+               /*
+                * The free counter reset values must be updated between the
+                * counter release to the counter allocation, so, at least one
+                * query must be done in this time. ensure it by saving the
+                * query generation in the release time.
+                * The free list is sorted according to the generation - so if
+                * the first one is not updated, all the others are not
+                * updated too.
+                */
+               cnt_free = TAILQ_FIRST(&pool->counters);
+               if (cnt_free && cnt_free->query_gen + 1 <
+                   rte_atomic64_read(&pool->query_gen))
+                       break;
+               cnt_free = NULL;
+       }
+       if (!cnt_free) {
+               pool = flow_dv_counter_pool_prepare(dev, &cnt_free, batch);
+               if (!pool)
+                       return NULL;
+       }
+       cnt_free->batch = batch;
+       /* Create a DV counter action only in the first time usage. */
+       if (!cnt_free->action) {
+               uint16_t offset;
+               struct mlx5_devx_obj *dcs;
+
+               if (batch) {
+                       offset = cnt_free - &pool->counters_raw[0];
+                       dcs = pool->min_dcs;
+               } else {
+                       offset = 0;
+                       dcs = cnt_free->dcs;
+               }
+               cnt_free->action = mlx5_glue->dv_create_flow_action_counter
+                                       (dcs->obj, offset);
+               if (!cnt_free->action) {
+                       rte_errno = errno;
+                       return NULL;
+               }
+       }
+       /* Update the counter reset values. */
+       if (_flow_dv_query_count(dev, cnt_free, &cnt_free->hits,
+                                &cnt_free->bytes))
+               return NULL;
+       cnt_free->shared = shared;
+       cnt_free->ref_cnt = 1;
+       cnt_free->id = id;
+       if (!priv->sh->cmng.query_thread_on)
+               /* Start the asynchronous batch query by the host thread. */
+               mlx5_set_query_alarm(priv->sh);
+       TAILQ_REMOVE(&pool->counters, cnt_free, next);
+       if (TAILQ_EMPTY(&pool->counters)) {
+               /* Move the pool to the end of the container pool list. */
+               TAILQ_REMOVE(&cont->pool_list, pool, next);
+               TAILQ_INSERT_TAIL(&cont->pool_list, pool, next);
+       }
+       return cnt_free;
+}
+
+/**
+ * Release a flow counter.
+ *
+ * @param[in] dev
+ *   Pointer to the Ethernet device structure.
+ * @param[in] counter
+ *   Pointer to the counter handler.
+ */
+static void
+flow_dv_counter_release(struct rte_eth_dev *dev,
+                       struct mlx5_flow_counter *counter)
+{
+       struct mlx5_priv *priv = dev->data->dev_private;
+
+       if (!counter)
+               return;
+       if (priv->counter_fallback) {
+               flow_dv_counter_release_fallback(dev, counter);
+               return;
+       }
+       if (--counter->ref_cnt == 0) {
+               struct mlx5_flow_counter_pool *pool =
+                               flow_dv_counter_pool_get(counter);
+
+               /* Put the counter in the end - the last updated one. */
+               TAILQ_INSERT_TAIL(&pool->counters, counter, next);
+               counter->query_gen = rte_atomic64_read(&pool->query_gen);
+       }
+}
+
 /**
  * Verify the @p attributes will be correctly understood by the NIC and store
  * them in the @p flow if everything is correct.
@@ -2066,6 +2859,14 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
        uint64_t last_item = 0;
        uint8_t next_protocol = 0xff;
        int actions_n = 0;
+       const struct rte_flow_item *gre_item = NULL;
+       struct rte_flow_item_tcp nic_tcp_mask = {
+               .hdr = {
+                       .tcp_flags = 0xFF,
+                       .src_port = RTE_BE16(UINT16_MAX),
+                       .dst_port = RTE_BE16(UINT16_MAX),
+               }
+       };
 
        if (items == NULL)
                return -1;
@@ -2082,7 +2883,7 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
                                        (dev, items, attr, item_flags, error);
                        if (ret < 0)
                                return ret;
-                       last_item |= MLX5_FLOW_ITEM_PORT_ID;
+                       last_item = MLX5_FLOW_ITEM_PORT_ID;
                        break;
                case RTE_FLOW_ITEM_TYPE_ETH:
                        ret = mlx5_flow_validate_item_eth(items, item_flags,
@@ -2120,6 +2921,7 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
                                /* Reset for inner layer. */
                                next_protocol = 0xff;
                        }
+                       mlx5_flow_tunnel_ip_check(items, &last_item);
                        break;
                case RTE_FLOW_ITEM_TYPE_IPV6:
                        ret = mlx5_flow_validate_item_ipv6(items, item_flags,
@@ -2141,12 +2943,13 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
                                /* Reset for inner layer. */
                                next_protocol = 0xff;
                        }
+                       mlx5_flow_tunnel_ip_check(items, &last_item);
                        break;
                case RTE_FLOW_ITEM_TYPE_TCP:
                        ret = mlx5_flow_validate_item_tcp
                                                (items, item_flags,
                                                 next_protocol,
-                                                &rte_flow_item_tcp_mask,
+                                                &nic_tcp_mask,
                                                 error);
                        if (ret < 0)
                                return ret;
@@ -2163,13 +2966,28 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
                                             MLX5_FLOW_LAYER_OUTER_L4_UDP;
                        break;
                case RTE_FLOW_ITEM_TYPE_GRE:
-               case RTE_FLOW_ITEM_TYPE_NVGRE:
                        ret = mlx5_flow_validate_item_gre(items, item_flags,
                                                          next_protocol, error);
                        if (ret < 0)
                                return ret;
+                       gre_item = items;
                        last_item = MLX5_FLOW_LAYER_GRE;
                        break;
+               case RTE_FLOW_ITEM_TYPE_NVGRE:
+                       ret = mlx5_flow_validate_item_nvgre(items, item_flags,
+                                                           next_protocol,
+                                                           error);
+                       if (ret < 0)
+                               return ret;
+                       last_item = MLX5_FLOW_LAYER_NVGRE;
+                       break;
+               case RTE_FLOW_ITEM_TYPE_GRE_KEY:
+                       ret = mlx5_flow_validate_item_gre_key
+                               (items, item_flags, gre_item, error);
+                       if (ret < 0)
+                               return ret;
+                       last_item = MLX5_FLOW_LAYER_GRE_KEY;
+                       break;
                case RTE_FLOW_ITEM_TYPE_VXLAN:
                        ret = mlx5_flow_validate_item_vxlan(items, item_flags,
                                                            error);
@@ -2200,6 +3018,22 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
                                return ret;
                        last_item = MLX5_FLOW_ITEM_METADATA;
                        break;
+               case RTE_FLOW_ITEM_TYPE_ICMP:
+                       ret = mlx5_flow_validate_item_icmp(items, item_flags,
+                                                          next_protocol,
+                                                          error);
+                       if (ret < 0)
+                               return ret;
+                       last_item = MLX5_FLOW_LAYER_ICMP;
+                       break;
+               case RTE_FLOW_ITEM_TYPE_ICMP6:
+                       ret = mlx5_flow_validate_item_icmp6(items, item_flags,
+                                                           next_protocol,
+                                                           error);
+                       if (ret < 0)
+                               return ret;
+                       last_item = MLX5_FLOW_LAYER_ICMP6;
+                       break;
                default:
                        return rte_flow_error_set(error, ENOTSUP,
                                                  RTE_FLOW_ERROR_TYPE_ITEM,
@@ -2409,6 +3243,40 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
                        ++actions_n;
                        action_flags |= MLX5_FLOW_ACTION_JUMP;
                        break;
+               case RTE_FLOW_ACTION_TYPE_INC_TCP_SEQ:
+               case RTE_FLOW_ACTION_TYPE_DEC_TCP_SEQ:
+                       ret = flow_dv_validate_action_modify_tcp_seq
+                                                               (action_flags,
+                                                                actions,
+                                                                item_flags,
+                                                                error);
+                       if (ret < 0)
+                               return ret;
+                       /* Count all modify-header actions as one action. */
+                       if (!(action_flags & MLX5_FLOW_MODIFY_HDR_ACTIONS))
+                               ++actions_n;
+                       action_flags |= actions->type ==
+                                       RTE_FLOW_ACTION_TYPE_INC_TCP_SEQ ?
+                                               MLX5_FLOW_ACTION_INC_TCP_SEQ :
+                                               MLX5_FLOW_ACTION_DEC_TCP_SEQ;
+                       break;
+               case RTE_FLOW_ACTION_TYPE_INC_TCP_ACK:
+               case RTE_FLOW_ACTION_TYPE_DEC_TCP_ACK:
+                       ret = flow_dv_validate_action_modify_tcp_ack
+                                                               (action_flags,
+                                                                actions,
+                                                                item_flags,
+                                                                error);
+                       if (ret < 0)
+                               return ret;
+                       /* Count all modify-header actions as one action. */
+                       if (!(action_flags & MLX5_FLOW_MODIFY_HDR_ACTIONS))
+                               ++actions_n;
+                       action_flags |= actions->type ==
+                                       RTE_FLOW_ACTION_TYPE_INC_TCP_ACK ?
+                                               MLX5_FLOW_ACTION_INC_TCP_ACK :
+                                               MLX5_FLOW_ACTION_DEC_TCP_ACK;
+                       break;
                default:
                        return rte_flow_error_set(error, ENOTSUP,
                                                  RTE_FLOW_ERROR_TYPE_ACTION,
@@ -2486,7 +3354,7 @@ flow_dv_prepare(const struct rte_flow_attr *attr __rte_unused,
                                   "not enough memory to create flow");
                return NULL;
        }
-       flow->dv.value.size = MLX5_ST_SZ_DB(fte_match_param);
+       flow->dv.value.size = MLX5_ST_SZ_BYTES(fte_match_param);
        return flow;
 }
 
@@ -2510,7 +3378,7 @@ flow_dv_check_valid_spec(void *match_mask, void *match_value)
        uint8_t *v = match_value;
        unsigned int i;
 
-       for (i = 0; i < MLX5_ST_SZ_DB(fte_match_param); ++i) {
+       for (i = 0; i < MLX5_ST_SZ_BYTES(fte_match_param); ++i) {
                if (v[i] & ~m[i]) {
                        DRV_LOG(ERR,
                                "match_value differs from match_criteria"
@@ -2862,6 +3730,10 @@ flow_dv_translate_item_tcp(void *matcher, void *key,
                 rte_be_to_cpu_16(tcp_m->hdr.dst_port));
        MLX5_SET(fte_match_set_lyr_2_4, headers_v, tcp_dport,
                 rte_be_to_cpu_16(tcp_v->hdr.dst_port & tcp_m->hdr.dst_port));
+       MLX5_SET(fte_match_set_lyr_2_4, headers_m, tcp_flags,
+                tcp_m->hdr.tcp_flags);
+       MLX5_SET(fte_match_set_lyr_2_4, headers_v, tcp_flags,
+                (tcp_v->hdr.tcp_flags & tcp_m->hdr.tcp_flags));
 }
 
 /**
@@ -2911,6 +3783,45 @@ flow_dv_translate_item_udp(void *matcher, void *key,
                 rte_be_to_cpu_16(udp_v->hdr.dst_port & udp_m->hdr.dst_port));
 }
 
+/**
+ * Add GRE optional Key item to matcher and to the value.
+ *
+ * @param[in, out] matcher
+ *   Flow matcher.
+ * @param[in, out] key
+ *   Flow matcher value.
+ * @param[in] item
+ *   Flow pattern to translate.
+ * @param[in] inner
+ *   Item is inner pattern.
+ */
+static void
+flow_dv_translate_item_gre_key(void *matcher, void *key,
+                                  const struct rte_flow_item *item)
+{
+       const rte_be32_t *key_m = item->mask;
+       const rte_be32_t *key_v = item->spec;
+       void *misc_m = MLX5_ADDR_OF(fte_match_param, matcher, misc_parameters);
+       void *misc_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters);
+       rte_be32_t gre_key_default_mask = RTE_BE32(UINT32_MAX);
+
+       if (!key_v)
+               return;
+       if (!key_m)
+               key_m = &gre_key_default_mask;
+       /* GRE K bit must be on and should already be validated */
+       MLX5_SET(fte_match_set_misc, misc_m, gre_k_present, 1);
+       MLX5_SET(fte_match_set_misc, misc_v, gre_k_present, 1);
+       MLX5_SET(fte_match_set_misc, misc_m, gre_key_h,
+                rte_be_to_cpu_32(*key_m) >> 8);
+       MLX5_SET(fte_match_set_misc, misc_v, gre_key_h,
+                rte_be_to_cpu_32((*key_v) & (*key_m)) >> 8);
+       MLX5_SET(fte_match_set_misc, misc_m, gre_key_l,
+                rte_be_to_cpu_32(*key_m) & 0xFF);
+       MLX5_SET(fte_match_set_misc, misc_v, gre_key_l,
+                rte_be_to_cpu_32((*key_v) & (*key_m)) & 0xFF);
+}
+
 /**
  * Add GRE item to matcher and to the value.
  *
@@ -2934,6 +3845,20 @@ flow_dv_translate_item_gre(void *matcher, void *key,
        void *headers_v;
        void *misc_m = MLX5_ADDR_OF(fte_match_param, matcher, misc_parameters);
        void *misc_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters);
+       struct {
+               union {
+                       __extension__
+                       struct {
+                               uint16_t version:3;
+                               uint16_t rsvd0:9;
+                               uint16_t s_present:1;
+                               uint16_t k_present:1;
+                               uint16_t rsvd_bit1:1;
+                               uint16_t c_present:1;
+                       };
+                       uint16_t value;
+               };
+       } gre_crks_rsvd0_ver_m, gre_crks_rsvd0_ver_v;
 
        if (inner) {
                headers_m = MLX5_ADDR_OF(fte_match_param, matcher,
@@ -2954,6 +3879,23 @@ flow_dv_translate_item_gre(void *matcher, void *key,
                 rte_be_to_cpu_16(gre_m->protocol));
        MLX5_SET(fte_match_set_misc, misc_v, gre_protocol,
                 rte_be_to_cpu_16(gre_v->protocol & gre_m->protocol));
+       gre_crks_rsvd0_ver_m.value = rte_be_to_cpu_16(gre_m->c_rsvd0_ver);
+       gre_crks_rsvd0_ver_v.value = rte_be_to_cpu_16(gre_v->c_rsvd0_ver);
+       MLX5_SET(fte_match_set_misc, misc_m, gre_c_present,
+                gre_crks_rsvd0_ver_m.c_present);
+       MLX5_SET(fte_match_set_misc, misc_v, gre_c_present,
+                gre_crks_rsvd0_ver_v.c_present &
+                gre_crks_rsvd0_ver_m.c_present);
+       MLX5_SET(fte_match_set_misc, misc_m, gre_k_present,
+                gre_crks_rsvd0_ver_m.k_present);
+       MLX5_SET(fte_match_set_misc, misc_v, gre_k_present,
+                gre_crks_rsvd0_ver_v.k_present &
+                gre_crks_rsvd0_ver_m.k_present);
+       MLX5_SET(fte_match_set_misc, misc_m, gre_s_present,
+                gre_crks_rsvd0_ver_m.s_present);
+       MLX5_SET(fte_match_set_misc, misc_v, gre_s_present,
+                gre_crks_rsvd0_ver_v.s_present &
+                gre_crks_rsvd0_ver_m.s_present);
 }
 
 /**
@@ -2984,7 +3926,21 @@ flow_dv_translate_item_nvgre(void *matcher, void *key,
        int size;
        int i;
 
-       flow_dv_translate_item_gre(matcher, key, item, inner);
+       /* For NVGRE, GRE header fields must be set with defined values. */
+       const struct rte_flow_item_gre gre_spec = {
+               .c_rsvd0_ver = RTE_BE16(0x2000),
+               .protocol = RTE_BE16(RTE_ETHER_TYPE_TEB)
+       };
+       const struct rte_flow_item_gre gre_mask = {
+               .c_rsvd0_ver = RTE_BE16(0xB000),
+               .protocol = RTE_BE16(UINT16_MAX),
+       };
+       const struct rte_flow_item gre_item = {
+               .spec = &gre_spec,
+               .mask = &gre_mask,
+               .last = NULL,
+       };
+       flow_dv_translate_item_gre(matcher, key, &gre_item, inner);
        if (!nvgre_v)
                return;
        if (!nvgre_m)
@@ -3094,7 +4050,7 @@ flow_dv_translate_item_mpls(void *matcher, void *key,
        case MLX5_FLOW_LAYER_GRE:
                MLX5_SET(fte_match_set_misc, misc_m, gre_protocol, 0xffff);
                MLX5_SET(fte_match_set_misc, misc_v, gre_protocol,
-                        ETHER_TYPE_MPLS);
+                        RTE_ETHER_TYPE_MPLS);
                break;
        default:
                MLX5_SET(fte_match_set_lyr_2_4, headers_m, ip_protocol, 0xff);
@@ -3234,6 +4190,102 @@ flow_dv_translate_item_port_id(struct rte_eth_dev *dev, void *matcher,
        return 0;
 }
 
+/**
+ * Add ICMP6 item to matcher and to the value.
+ *
+ * @param[in, out] matcher
+ *   Flow matcher.
+ * @param[in, out] key
+ *   Flow matcher value.
+ * @param[in] item
+ *   Flow pattern to translate.
+ * @param[in] inner
+ *   Item is inner pattern.
+ */
+static void
+flow_dv_translate_item_icmp6(void *matcher, void *key,
+                             const struct rte_flow_item *item,
+                             int inner)
+{
+       const struct rte_flow_item_icmp6 *icmp6_m = item->mask;
+       const struct rte_flow_item_icmp6 *icmp6_v = item->spec;
+       void *headers_m;
+       void *headers_v;
+       void *misc3_m = MLX5_ADDR_OF(fte_match_param, matcher,
+                                    misc_parameters_3);
+       void *misc3_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters_3);
+       if (inner) {
+               headers_m = MLX5_ADDR_OF(fte_match_param, matcher,
+                                        inner_headers);
+               headers_v = MLX5_ADDR_OF(fte_match_param, key, inner_headers);
+       } else {
+               headers_m = MLX5_ADDR_OF(fte_match_param, matcher,
+                                        outer_headers);
+               headers_v = MLX5_ADDR_OF(fte_match_param, key, outer_headers);
+       }
+       MLX5_SET(fte_match_set_lyr_2_4, headers_m, ip_protocol, 0xFF);
+       MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol, IPPROTO_ICMPV6);
+       if (!icmp6_v)
+               return;
+       if (!icmp6_m)
+               icmp6_m = &rte_flow_item_icmp6_mask;
+       MLX5_SET(fte_match_set_misc3, misc3_m, icmpv6_type, icmp6_m->type);
+       MLX5_SET(fte_match_set_misc3, misc3_v, icmpv6_type,
+                icmp6_v->type & icmp6_m->type);
+       MLX5_SET(fte_match_set_misc3, misc3_m, icmpv6_code, icmp6_m->code);
+       MLX5_SET(fte_match_set_misc3, misc3_v, icmpv6_code,
+                icmp6_v->code & icmp6_m->code);
+}
+
+/**
+ * Add ICMP item to matcher and to the value.
+ *
+ * @param[in, out] matcher
+ *   Flow matcher.
+ * @param[in, out] key
+ *   Flow matcher value.
+ * @param[in] item
+ *   Flow pattern to translate.
+ * @param[in] inner
+ *   Item is inner pattern.
+ */
+static void
+flow_dv_translate_item_icmp(void *matcher, void *key,
+                           const struct rte_flow_item *item,
+                           int inner)
+{
+       const struct rte_flow_item_icmp *icmp_m = item->mask;
+       const struct rte_flow_item_icmp *icmp_v = item->spec;
+       void *headers_m;
+       void *headers_v;
+       void *misc3_m = MLX5_ADDR_OF(fte_match_param, matcher,
+                                    misc_parameters_3);
+       void *misc3_v = MLX5_ADDR_OF(fte_match_param, key, misc_parameters_3);
+       if (inner) {
+               headers_m = MLX5_ADDR_OF(fte_match_param, matcher,
+                                        inner_headers);
+               headers_v = MLX5_ADDR_OF(fte_match_param, key, inner_headers);
+       } else {
+               headers_m = MLX5_ADDR_OF(fte_match_param, matcher,
+                                        outer_headers);
+               headers_v = MLX5_ADDR_OF(fte_match_param, key, outer_headers);
+       }
+       MLX5_SET(fte_match_set_lyr_2_4, headers_m, ip_protocol, 0xFF);
+       MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol, IPPROTO_ICMP);
+       if (!icmp_v)
+               return;
+       if (!icmp_m)
+               icmp_m = &rte_flow_item_icmp_mask;
+       MLX5_SET(fte_match_set_misc3, misc3_m, icmp_type,
+                icmp_m->hdr.icmp_type);
+       MLX5_SET(fte_match_set_misc3, misc3_v, icmp_type,
+                icmp_v->hdr.icmp_type & icmp_m->hdr.icmp_type);
+       MLX5_SET(fte_match_set_misc3, misc3_m, icmp_code,
+                icmp_m->hdr.icmp_code);
+       MLX5_SET(fte_match_set_misc3, misc3_v, icmp_code,
+                icmp_v->hdr.icmp_code & icmp_m->hdr.icmp_code);
+}
+
 static uint32_t matcher_zero[MLX5_ST_SZ_DW(fte_match_param)] = { 0 };
 
 #define HEADER_IS_ZERO(match_criteria, headers)                                     \
@@ -3718,8 +4770,10 @@ flow_dv_translate(struct rte_eth_dev *dev,
                                rte_errno = ENOTSUP;
                                goto cnt_err;
                        }
-                       flow->counter = flow_dv_counter_new(dev, count->shared,
-                                                           count->id);
+                       flow->counter = flow_dv_counter_alloc(dev,
+                                                             count->shared,
+                                                             count->id,
+                                                             attr->group);
                        if (flow->counter == NULL)
                                goto cnt_err;
                        dev_flow->dv.actions[actions_n++] =
@@ -3884,6 +4938,27 @@ cnt_err:
                                return -rte_errno;
                        action_flags |= MLX5_FLOW_ACTION_SET_TTL;
                        break;
+               case RTE_FLOW_ACTION_TYPE_INC_TCP_SEQ:
+               case RTE_FLOW_ACTION_TYPE_DEC_TCP_SEQ:
+                       if (flow_dv_convert_action_modify_tcp_seq(&res, actions,
+                                                                 error))
+                               return -rte_errno;
+                       action_flags |= actions->type ==
+                                       RTE_FLOW_ACTION_TYPE_INC_TCP_SEQ ?
+                                       MLX5_FLOW_ACTION_INC_TCP_SEQ :
+                                       MLX5_FLOW_ACTION_DEC_TCP_SEQ;
+                       break;
+
+               case RTE_FLOW_ACTION_TYPE_INC_TCP_ACK:
+               case RTE_FLOW_ACTION_TYPE_DEC_TCP_ACK:
+                       if (flow_dv_convert_action_modify_tcp_ack(&res, actions,
+                                                                 error))
+                               return -rte_errno;
+                       action_flags |= actions->type ==
+                                       RTE_FLOW_ACTION_TYPE_INC_TCP_ACK ?
+                                       MLX5_FLOW_ACTION_INC_TCP_ACK :
+                                       MLX5_FLOW_ACTION_DEC_TCP_ACK;
+                       break;
                case RTE_FLOW_ACTION_TYPE_END:
                        actions_end = true;
                        if (action_flags & MLX5_FLOW_MODIFY_HDR_ACTIONS) {
@@ -3942,6 +5017,7 @@ cnt_err:
                                         MLX5_IPV4_IBV_RX_HASH);
                        last_item = tunnel ? MLX5_FLOW_LAYER_INNER_L3_IPV4 :
                                             MLX5_FLOW_LAYER_OUTER_L3_IPV4;
+                       mlx5_flow_tunnel_ip_check(items, &last_item);
                        break;
                case RTE_FLOW_ITEM_TYPE_IPV6:
                        flow_dv_translate_item_ipv6(match_mask, match_value,
@@ -3954,6 +5030,7 @@ cnt_err:
                                         MLX5_IPV6_IBV_RX_HASH);
                        last_item = tunnel ? MLX5_FLOW_LAYER_INNER_L3_IPV6 :
                                             MLX5_FLOW_LAYER_OUTER_L3_IPV6;
+                       mlx5_flow_tunnel_ip_check(items, &last_item);
                        break;
                case RTE_FLOW_ITEM_TYPE_TCP:
                        flow_dv_translate_item_tcp(match_mask, match_value,
@@ -3984,6 +5061,11 @@ cnt_err:
                                                   items, tunnel);
                        last_item = MLX5_FLOW_LAYER_GRE;
                        break;
+               case RTE_FLOW_ITEM_TYPE_GRE_KEY:
+                       flow_dv_translate_item_gre_key(match_mask,
+                                                      match_value, items);
+                       last_item = MLX5_FLOW_LAYER_GRE_KEY;
+                       break;
                case RTE_FLOW_ITEM_TYPE_NVGRE:
                        flow_dv_translate_item_nvgre(match_mask, match_value,
                                                     items, tunnel);
@@ -4009,6 +5091,16 @@ cnt_err:
                                                    items);
                        last_item = MLX5_FLOW_ITEM_METADATA;
                        break;
+               case RTE_FLOW_ITEM_TYPE_ICMP:
+                       flow_dv_translate_item_icmp(match_mask, match_value,
+                                                   items, tunnel);
+                       last_item = MLX5_FLOW_LAYER_ICMP;
+                       break;
+               case RTE_FLOW_ITEM_TYPE_ICMP6:
+                       flow_dv_translate_item_icmp6(match_mask, match_value,
+                                                     items, tunnel);
+                       last_item = MLX5_FLOW_LAYER_ICMP6;
+                       break;
                default:
                        break;
                }
@@ -4093,13 +5185,27 @@ flow_dv_apply(struct rte_eth_dev *dev, struct rte_flow *flow,
                                             dv->hash_fields,
                                             (*flow->queue),
                                             flow->rss.queue_num);
-                       if (!hrxq)
+                       if (!hrxq) {
+                               int lro = 0;
+
+                               if (mlx5_lro_on(dev)) {
+                                       if ((dev_flow->layers &
+                                            MLX5_FLOW_LAYER_IPV4_LRO)
+                                           == MLX5_FLOW_LAYER_IPV4_LRO)
+                                               lro = MLX5_FLOW_IPV4_LRO;
+                                       else if ((dev_flow->layers &
+                                                 MLX5_FLOW_LAYER_IPV6_LRO)
+                                                == MLX5_FLOW_LAYER_IPV6_LRO)
+                                               lro = MLX5_FLOW_IPV6_LRO;
+                               }
                                hrxq = mlx5_hrxq_new
                                        (dev, flow->key, MLX5_RSS_HASH_KEY_LEN,
                                         dv->hash_fields, (*flow->queue),
                                         flow->rss.queue_num,
                                         !!(dev_flow->layers &
-                                           MLX5_FLOW_LAYER_TUNNEL));
+                                           MLX5_FLOW_LAYER_TUNNEL), lro);
+                       }
+
                        if (!hrxq) {
                                rte_flow_error_set
                                        (error, rte_errno,
@@ -4354,7 +5460,7 @@ flow_dv_destroy(struct rte_eth_dev *dev, struct rte_flow *flow)
                return;
        flow_dv_remove(dev, flow);
        if (flow->counter) {
-               flow_dv_counter_release(flow->counter);
+               flow_dv_counter_release(dev, flow->counter);
                flow->counter = NULL;
        }
        if (flow->tag_resource) {
@@ -4399,9 +5505,6 @@ flow_dv_query_count(struct rte_eth_dev *dev, struct rte_flow *flow,
 {
        struct mlx5_priv *priv = dev->data->dev_private;
        struct rte_flow_query_count *qc = data;
-       uint64_t pkts = 0;
-       uint64_t bytes = 0;
-       int err;
 
        if (!priv->config.devx)
                return rte_flow_error_set(error, ENOTSUP,
@@ -4409,15 +5512,14 @@ flow_dv_query_count(struct rte_eth_dev *dev, struct rte_flow *flow,
                                          NULL,
                                          "counters are not supported");
        if (flow->counter) {
-               err = mlx5_devx_cmd_flow_counter_query
-                                               (flow->counter->dcs,
-                                                qc->reset, &pkts, &bytes);
+               uint64_t pkts, bytes;
+               int err = _flow_dv_query_count(dev, flow->counter, &pkts,
+                                              &bytes);
+
                if (err)
-                       return rte_flow_error_set
-                               (error, err,
-                                RTE_FLOW_ERROR_TYPE_UNSPECIFIED,
-                                NULL,
-                                "cannot read counters");
+                       return rte_flow_error_set(error, -err,
+                                       RTE_FLOW_ERROR_TYPE_UNSPECIFIED,
+                                       NULL, "cannot read counters");
                qc->hits_set = 1;
                qc->bytes_set = 1;
                qc->hits = pkts - flow->counter->hits;