finally i got this reason, it is not about tomcat version ,but about spring default multipart resolver, we had to disable spring boot multipart by manner:
in application.properties
spring.http.multipart.enabled=false
Otherwise the requst body will be parsed first by spring default multipart resolver. (MultipartPayloadProvider will parse empty inputSteam)
But this workaround still not good enough, maybe it is better to enhance MultipartPayloadProvider not only read form parts from inputstream, could read request.parts as well which already be there (parsed by spring boot multipart resolver)