BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |
              BIT(FLOW_DISSECTOR_KEY_ENC_PORTS) |
              BIT(FLOW_DISSECTOR_KEY_ENC_CONTROL) |
-             BIT(FLOW_DISSECTOR_KEY_TCP))) {
+             BIT(FLOW_DISSECTOR_KEY_TCP) |
+             BIT(FLOW_DISSECTOR_KEY_IP))) {
                netdev_warn(priv->netdev, "Unsupported key used: 0x%x\n",
                            f->dissector->used_keys);
                return -EOPNOTSUPP;
                        *min_inline = MLX5_INLINE_MODE_TCP_UDP;
        }
 
+       if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_IP)) {
+               struct flow_dissector_key_ip *key =
+                       skb_flow_dissector_target(f->dissector,
+                                                 FLOW_DISSECTOR_KEY_IP,
+                                                 f->key);
+               struct flow_dissector_key_ip *mask =
+                       skb_flow_dissector_target(f->dissector,
+                                                 FLOW_DISSECTOR_KEY_IP,
+                                                 f->mask);
+
+               MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_ecn, mask->tos & 0x3);
+               MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_ecn, key->tos & 0x3);
+
+               MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_dscp, mask->tos >> 2);
+               MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_dscp, key->tos  >> 2);
+
+               if (mask->tos)
+                       *min_inline = MLX5_INLINE_MODE_IP;
+
+               if (mask->ttl) /* currently not supported */
+                       return -EOPNOTSUPP;
+       }
+
        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_TCP)) {
                struct flow_dissector_key_tcp *key =
                        skb_flow_dissector_target(f->dissector,