--- /dev/null
+From 07b3975352374c3f5ebb4a42ef0b253fe370542d Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@nokia.com>
+Date: Wed, 27 Mar 2019 22:35:37 +0200
+Subject: net: stmmac: don't stop NAPI processing when dropping a packet
+
+From: Aaro Koskinen <aaro.koskinen@nokia.com>
+
+commit 07b3975352374c3f5ebb4a42ef0b253fe370542d upstream.
+
+Currently, if we drop a packet, we exit from NAPI loop before the budget
+is consumed. In some situations this will make the RX processing stall
+e.g. when flood pinging the system with oversized packets, as the
+errorneous packets are not dropped efficiently.
+
+If we drop a packet, we should just continue to the next one as long as
+the budget allows.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[acj: backport v4.9 -stable
+-adjust context]
+Signed-off-by: Aviraj CJ <acj@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2499,8 +2499,7 @@ static inline void stmmac_rx_refill(stru
+ */
+ static int stmmac_rx(struct stmmac_priv *priv, int limit)
+ {
+- unsigned int entry = priv->cur_rx;
+- unsigned int next_entry;
++ unsigned int next_entry = priv->cur_rx;
+ unsigned int count = 0;
+ int coe = priv->hw->rx_csum;
+
+@@ -2516,10 +2515,12 @@ static int stmmac_rx(struct stmmac_priv
+ priv->hw->desc->display_ring(rx_head, DMA_RX_SIZE, true);
+ }
+ while (count < limit) {
+- int status;
++ int entry, status;
+ struct dma_desc *p;
+ struct dma_desc *np;
+
++ entry = next_entry;
++
+ if (priv->extend_desc)
+ p = (struct dma_desc *)(priv->dma_erx + entry);
+ else
+@@ -2584,7 +2585,7 @@ static int stmmac_rx(struct stmmac_priv
+ priv->dev->name, frame_len,
+ priv->dma_buf_sz);
+ priv->dev->stats.rx_length_errors++;
+- break;
++ continue;
+ }
+
+ /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
+@@ -2615,7 +2616,7 @@ static int stmmac_rx(struct stmmac_priv
+ dev_warn(priv->device,
+ "packet dropped\n");
+ priv->dev->stats.rx_dropped++;
+- break;
++ continue;
+ }
+
+ dma_sync_single_for_cpu(priv->device,
+@@ -2638,7 +2639,7 @@ static int stmmac_rx(struct stmmac_priv
+ pr_err("%s: Inconsistent Rx chain\n",
+ priv->dev->name);
+ priv->dev->stats.rx_dropped++;
+- break;
++ continue;
+ }
+ prefetch(skb->data - NET_IP_ALIGN);
+ priv->rx_skbuff[entry] = NULL;
+@@ -2672,7 +2673,6 @@ static int stmmac_rx(struct stmmac_priv
+ priv->dev->stats.rx_packets++;
+ priv->dev->stats.rx_bytes += frame_len;
+ }
+- entry = next_entry;
+ }
+
+ stmmac_rx_refill(priv);
--- /dev/null
+From 583e6361414903c5206258a30e5bd88cb03c0254 Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@nokia.com>
+Date: Wed, 27 Mar 2019 22:35:35 +0200
+Subject: net: stmmac: use correct DMA buffer size in the RX descriptor
+
+From: Aaro Koskinen <aaro.koskinen@nokia.com>
+
+commit 583e6361414903c5206258a30e5bd88cb03c0254 upstream.
+
+We always program the maximum DMA buffer size into the receive descriptor,
+although the allocated size may be less. E.g. with the default MTU size
+we allocate only 1536 bytes. If somebody sends us a bigger frame, then
+memory may get corrupted.
+
+Fix by using exact buffer sizes.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[acj: backport to v4.9 -stable :
+- adjust context
+- skipped the section modifying non-existent functions in dwxgmac2_descs.c and
+hwif.h ]
+Signed-off-by: Aviraj CJ <acj@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h | 2 -
+ drivers/net/ethernet/stmicro/stmmac/descs_com.h | 23 +++++++++++++--------
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 2 -
+ drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 10 ++++++---
+ drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 10 ++++++---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ++---
+ 6 files changed, 34 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -354,7 +354,7 @@ struct dma_features {
+ struct stmmac_desc_ops {
+ /* DMA RX descriptor ring initialization */
+ void (*init_rx_desc) (struct dma_desc *p, int disable_rx_ic, int mode,
+- int end);
++ int end, int bfsize);
+ /* DMA TX descriptor ring initialization */
+ void (*init_tx_desc) (struct dma_desc *p, int mode, int end);
+
+--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+@@ -33,11 +33,14 @@
+ /* Specific functions used for Ring mode */
+
+ /* Enhanced descriptors */
+-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
++static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end,
++ int bfsize)
+ {
+- p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1)
+- << ERDES1_BUFFER2_SIZE_SHIFT)
+- & ERDES1_BUFFER2_SIZE_MASK);
++ if (bfsize == BUF_SIZE_16KiB)
++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
++ << ERDES1_BUFFER2_SIZE_SHIFT)
++ & ERDES1_BUFFER2_SIZE_MASK);
++
+
+ if (end)
+ p->des1 |= cpu_to_le32(ERDES1_END_RING);
+@@ -63,11 +66,15 @@ static inline void enh_set_tx_desc_len_o
+ }
+
+ /* Normal descriptors */
+-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
++static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
+ {
+- p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1)
+- << RDES1_BUFFER2_SIZE_SHIFT)
+- & RDES1_BUFFER2_SIZE_MASK);
++ if (bfsize >= BUF_SIZE_2KiB) {
++ int bfsize2;
++
++ bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
++ p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT)
++ & RDES1_BUFFER2_SIZE_MASK);
++ }
+
+ if (end)
+ p->des1 |= cpu_to_le32(RDES1_END_RING);
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -289,7 +289,7 @@ exit:
+ }
+
+ static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+- int mode, int end)
++ int mode, int end, int bfsize)
+ {
+ p->des3 = cpu_to_le32(RDES3_OWN | RDES3_BUFFER1_VALID_ADDR);
+
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -269,15 +269,19 @@ static int enh_desc_get_rx_status(void *
+ }
+
+ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+- int mode, int end)
++ int mode, int end, int bfsize)
+ {
++ int bfsize1;
++
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK);
++
++ bfsize1 = min(bfsize, BUF_SIZE_8KiB);
++ p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ehn_desc_rx_set_on_chain(p);
+ else
+- ehn_desc_rx_set_on_ring(p, end);
++ ehn_desc_rx_set_on_ring(p, end, bfsize);
+
+ if (disable_rx_ic)
+ p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC);
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -137,15 +137,19 @@ static int ndesc_get_rx_status(void *dat
+ }
+
+ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
+- int end)
++ int end, int bfsize)
+ {
++ int bfsize1;
++
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+- p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK);
++
++ bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1);
++ p->des1 |= cpu_to_le32(bfsize1 & RDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ndesc_rx_set_on_chain(p, end);
+ else
+- ndesc_rx_set_on_ring(p, end);
++ ndesc_rx_set_on_ring(p, end, bfsize);
+
+ if (disable_rx_ic)
+ p->des1 |= cpu_to_le32(RDES1_DISABLE_IC);
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -956,11 +956,11 @@ static void stmmac_clear_descriptors(str
+ if (priv->extend_desc)
+ priv->hw->desc->init_rx_desc(&priv->dma_erx[i].basic,
+ priv->use_riwt, priv->mode,
+- (i == DMA_RX_SIZE - 1));
++ (i == DMA_RX_SIZE - 1), priv->dma_buf_sz);
+ else
+ priv->hw->desc->init_rx_desc(&priv->dma_rx[i],
+ priv->use_riwt, priv->mode,
+- (i == DMA_RX_SIZE - 1));
++ (i == DMA_RX_SIZE - 1), priv->dma_buf_sz);
+ for (i = 0; i < DMA_TX_SIZE; i++)
+ if (priv->extend_desc)
+ priv->hw->desc->init_tx_desc(&priv->dma_etx[i].basic,
+@@ -2479,7 +2479,7 @@ static inline void stmmac_rx_refill(stru
+ wmb();
+
+ if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00))
+- priv->hw->desc->init_rx_desc(p, priv->use_riwt, 0, 0);
++ priv->hw->desc->init_rx_desc(p, priv->use_riwt, 0, 0, priv->dma_buf_sz);
+ else
+ priv->hw->desc->set_rx_owner(p);
+