]> pilppa.org Git - linux-2.6-omap-h63xx.git/blobdiff - drivers/net/forcedeth.c
[netdrvr] fix array overflows in Chelsio driver
[linux-2.6-omap-h63xx.git] / drivers / net / forcedeth.c
index 22aec6ed80f56b7dcfd547cf5d5f149fc8310fb2..3682ec61e8a8f539a6860f415ad3cd83b9a2d720 100644 (file)
@@ -10,7 +10,7 @@
  * trademarks of NVIDIA Corporation in the United States and other
  * countries.
  *
- * Copyright (C) 2003,4 Manfred Spraul
+ * Copyright (C) 2003,4,5 Manfred Spraul
  * Copyright (C) 2004 Andrew de Quincey (wol support)
  * Copyright (C) 2004 Carl-Daniel Hailfinger (invalid MAC handling, insane
  *             IRQ rate fixes, bigendian fixes, cleanups, verification)
@@ -80,7 +80,7 @@
  *                        into nv_close, otherwise reenabling for wol can
  *                        cause DMA to kfree'd memory.
  *     0.31: 14 Nov 2004: ethtool support for getting/setting link
- *                        capabilities.
+ *                        capabilities.
  *     0.32: 16 Apr 2005: RX_ERROR4 handling added.
  *     0.33: 16 May 2005: Support for MCP51 added.
  *     0.34: 18 Jun 2005: Add DEV_NEED_LINKTIMER to all nForce nics.
  *     0.37: 10 Jul 2005: Additional ethtool support, cleanup of pci id list
  *     0.38: 16 Jul 2005: tx irq rewrite: Use global flags instead of
  *                        per-packet flags.
- *      0.39: 18 Jul 2005: Add 64bit descriptor support.
- *      0.40: 19 Jul 2005: Add support for mac address change.
- *      0.41: 30 Jul 2005: Write back original MAC in nv_close instead
+ *     0.39: 18 Jul 2005: Add 64bit descriptor support.
+ *     0.40: 19 Jul 2005: Add support for mac address change.
+ *     0.41: 30 Jul 2005: Write back original MAC in nv_close instead
  *                        of nv_remove
- *      0.42: 06 Aug 2005: Fix lack of link speed initialization
+ *     0.42: 06 Aug 2005: Fix lack of link speed initialization
  *                        in the second (and later) nv_open call
- *      0.43: 10 Aug 2005: Add support for tx checksum.
- *      0.44: 20 Aug 2005: Add support for scatter gather and segmentation.
+ *     0.43: 10 Aug 2005: Add support for tx checksum.
+ *     0.44: 20 Aug 2005: Add support for scatter gather and segmentation.
+ *     0.45: 18 Sep 2005: Remove nv_stop/start_rx from every link check
+ *     0.46: 20 Oct 2005: Add irq optimization modes.
+ *     0.47: 26 Oct 2005: Add phyaddr 0 in phy scan.
+ *     0.48: 24 Dec 2005: Disable TSO, bugfix for pci_map_single
+ *     0.49: 10 Dec 2005: Fix tso for large buffers.
  *
  * Known bugs:
  * We suspect that on some hardware no TX done interrupts are generated.
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
-#define FORCEDETH_VERSION              "0.44"
+#define FORCEDETH_VERSION              "0.49"
 #define DRV_NAME                       "forcedeth"
 
 #include <linux/module.h>
@@ -163,7 +168,8 @@ enum {
 #define NVREG_IRQ_LINK                 0x0040
 #define NVREG_IRQ_TX_ERROR             0x0080
 #define NVREG_IRQ_TX1                  0x0100
-#define NVREG_IRQMASK_WANTED           0x00df
+#define NVREG_IRQMASK_THROUGHPUT       0x00df
+#define NVREG_IRQMASK_CPU              0x0040
 
 #define NVREG_IRQ_UNKNOWN      (~(NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF|NVREG_IRQ_TX_ERR| \
                                        NVREG_IRQ_TX_OK|NVREG_IRQ_TIMER|NVREG_IRQ_LINK|NVREG_IRQ_TX_ERROR| \
@@ -177,7 +183,8 @@ enum {
  * NVREG_POLL_DEFAULT=97 would result in an interval length of 1 ms
  */
        NvRegPollingInterval = 0x00c,
-#define NVREG_POLL_DEFAULT     970
+#define NVREG_POLL_DEFAULT_THROUGHPUT  970
+#define NVREG_POLL_DEFAULT_CPU 13
        NvRegMisc1 = 0x080,
 #define NVREG_MISC1_HD         0x02
 #define NVREG_MISC1_FORCE      0x3b0f3c
@@ -343,6 +350,8 @@ typedef union _ring_type {
 #define NV_TX2_VALID           (1<<31)
 #define NV_TX2_TSO             (1<<28)
 #define NV_TX2_TSO_SHIFT       14
+#define NV_TX2_TSO_MAX_SHIFT   14
+#define NV_TX2_TSO_MAX_SIZE    (1<<NV_TX2_TSO_MAX_SHIFT)
 #define NV_TX2_CHECKSUM_L3     (1<<27)
 #define NV_TX2_CHECKSUM_L4     (1<<26)
 
@@ -402,15 +411,15 @@ typedef union _ring_type {
 #define NV_WATCHDOG_TIMEO      (5*HZ)
 
 #define RX_RING                128
-#define TX_RING                64
+#define TX_RING                256
 /* 
  * If your nic mysteriously hangs then try to reduce the limits
  * to 1/0: It might be required to set NV_TX_LASTPACKET in the
  * last valid ring entry. But this would be impossible to
  * implement - probably a disassembly error.
  */
-#define TX_LIMIT_STOP  63
-#define TX_LIMIT_START 62
+#define TX_LIMIT_STOP  255
+#define TX_LIMIT_START 254
 
 /* rx/tx mac addr + type + vlan + align + slack*/
 #define NV_RX_HEADERS          (64)
@@ -529,6 +538,7 @@ struct fe_priv {
        unsigned int next_tx, nic_tx;
        struct sk_buff *tx_skbuff[TX_RING];
        dma_addr_t tx_dma[TX_RING];
+       unsigned int tx_dma_len[TX_RING];
        u32 tx_flags;
 };
 
@@ -538,6 +548,25 @@ struct fe_priv {
  */
 static int max_interrupt_work = 5;
 
+/*
+ * Optimization can be either throuput mode or cpu mode
+ * 
+ * Throughput Mode: Every tx and rx packet will generate an interrupt.
+ * CPU Mode: Interrupts are controlled by a timer.
+ */
+#define NV_OPTIMIZATION_MODE_THROUGHPUT 0
+#define NV_OPTIMIZATION_MODE_CPU        1
+static int optimization_mode = NV_OPTIMIZATION_MODE_THROUGHPUT;
+
+/*
+ * Poll interval for timer irq
+ *
+ * This interval determines how frequent an interrupt is generated.
+ * The is value is determined by [(time_in_micro_secs * 100) / (2^10)]
+ * Min = 0, and Max = 65535
+ */
+static int poll_interval = -1;
+
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
        return netdev_priv(dev);
@@ -847,8 +876,8 @@ static int nv_alloc_rx(struct net_device *dev)
                } else {
                        skb = np->rx_skbuff[nr];
                }
-               np->rx_dma[nr] = pci_map_single(np->pci_dev, skb->data, skb->len,
-                                               PCI_DMA_FROMDEVICE);
+               np->rx_dma[nr] = pci_map_single(np->pci_dev, skb->data,
+                                       skb->end-skb->data, PCI_DMA_FROMDEVICE);
                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
                        np->rx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->rx_dma[nr]);
                        wmb();
@@ -910,6 +939,7 @@ static void nv_init_tx(struct net_device *dev)
                else
                        np->tx_ring.ex[i].FlagLen = 0;
                np->tx_skbuff[i] = NULL;
+               np->tx_dma[i] = 0;
        }
 }
 
@@ -920,30 +950,27 @@ static int nv_init_ring(struct net_device *dev)
        return nv_alloc_rx(dev);
 }
 
-static void nv_release_txskb(struct net_device *dev, unsigned int skbnr)
+static int nv_release_txskb(struct net_device *dev, unsigned int skbnr)
 {
        struct fe_priv *np = netdev_priv(dev);
-       struct sk_buff *skb = np->tx_skbuff[skbnr];
-       unsigned int j, entry, fragments;
-                       
-       dprintk(KERN_INFO "%s: nv_release_txskb for skbnr %d, skb %p\n",
-               dev->name, skbnr, np->tx_skbuff[skbnr]);
-       
-       entry = skbnr;
-       if ((fragments = skb_shinfo(skb)->nr_frags) != 0) {
-               for (j = fragments; j >= 1; j--) {
-                       skb_frag_t *frag = &skb_shinfo(skb)->frags[j-1];
-                       pci_unmap_page(np->pci_dev, np->tx_dma[entry],
-                                      frag->size,
-                                      PCI_DMA_TODEVICE);
-                       entry = (entry - 1) % TX_RING;
-               }
+
+       dprintk(KERN_INFO "%s: nv_release_txskb for skbnr %d\n",
+               dev->name, skbnr);
+
+       if (np->tx_dma[skbnr]) {
+               pci_unmap_page(np->pci_dev, np->tx_dma[skbnr],
+                              np->tx_dma_len[skbnr],
+                              PCI_DMA_TODEVICE);
+               np->tx_dma[skbnr] = 0;
+       }
+
+       if (np->tx_skbuff[skbnr]) {
+               dev_kfree_skb_irq(np->tx_skbuff[skbnr]);
+               np->tx_skbuff[skbnr] = NULL;
+               return 1;
+       } else {
+               return 0;
        }
-       pci_unmap_single(np->pci_dev, np->tx_dma[entry],
-                        skb->len - skb->data_len,
-                        PCI_DMA_TODEVICE);
-       dev_kfree_skb_irq(skb);
-       np->tx_skbuff[skbnr] = NULL;
 }
 
 static void nv_drain_tx(struct net_device *dev)
@@ -956,10 +983,8 @@ static void nv_drain_tx(struct net_device *dev)
                        np->tx_ring.orig[i].FlagLen = 0;
                else
                        np->tx_ring.ex[i].FlagLen = 0;
-               if (np->tx_skbuff[i]) {
-                       nv_release_txskb(dev, i);
+               if (nv_release_txskb(dev, i))
                        np->stats.tx_dropped++;
-               }
        }
 }
 
@@ -975,7 +1000,7 @@ static void nv_drain_rx(struct net_device *dev)
                wmb();
                if (np->rx_skbuff[i]) {
                        pci_unmap_single(np->pci_dev, np->rx_dma[i],
-                                               np->rx_skbuff[i]->len,
+                                               np->rx_skbuff[i]->end-np->rx_skbuff[i]->data,
                                                PCI_DMA_FROMDEVICE);
                        dev_kfree_skb(np->rx_skbuff[i]);
                        np->rx_skbuff[i] = NULL;
@@ -996,68 +1021,105 @@ static void drain_ring(struct net_device *dev)
 static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct fe_priv *np = netdev_priv(dev);
+       u32 tx_flags = 0;
        u32 tx_flags_extra = (np->desc_ver == DESC_VER_1 ? NV_TX_LASTPACKET : NV_TX2_LASTPACKET);
        unsigned int fragments = skb_shinfo(skb)->nr_frags;
-       unsigned int nr = (np->next_tx + fragments) % TX_RING;
+       unsigned int nr = (np->next_tx - 1) % TX_RING;
+       unsigned int start_nr = np->next_tx % TX_RING;
        unsigned int i;
+       u32 offset = 0;
+       u32 bcnt;
+       u32 size = skb->len-skb->data_len;
+       u32 entries = (size >> NV_TX2_TSO_MAX_SHIFT) + ((size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
+
+       /* add fragments to entries count */
+       for (i = 0; i < fragments; i++) {
+               entries += (skb_shinfo(skb)->frags[i].size >> NV_TX2_TSO_MAX_SHIFT) +
+                          ((skb_shinfo(skb)->frags[i].size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
+       }
 
        spin_lock_irq(&np->lock);
 
-       if ((np->next_tx - np->nic_tx + fragments) > TX_LIMIT_STOP) {
+       if ((np->next_tx - np->nic_tx + entries - 1) > TX_LIMIT_STOP) {
                spin_unlock_irq(&np->lock);
                netif_stop_queue(dev);
                return NETDEV_TX_BUSY;
        }
 
-       np->tx_skbuff[nr] = skb;
-       
-       if (fragments) {
-               dprintk(KERN_DEBUG "%s: nv_start_xmit: buffer contains %d fragments\n", dev->name, fragments);
-               /* setup descriptors in reverse order */
-               for (i = fragments; i >= 1; i--) {
-                       skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
-                       np->tx_dma[nr] = pci_map_page(np->pci_dev, frag->page, frag->page_offset, frag->size,
-                                                       PCI_DMA_TODEVICE);
+       /* setup the header buffer */
+       do {
+               bcnt = (size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : size;
+               nr = (nr + 1) % TX_RING;
+
+               np->tx_dma[nr] = pci_map_single(np->pci_dev, skb->data + offset, bcnt,
+                                               PCI_DMA_TODEVICE);
+               np->tx_dma_len[nr] = bcnt;
+
+               if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+                       np->tx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->tx_dma[nr]);
+                       np->tx_ring.orig[nr].FlagLen = cpu_to_le32((bcnt-1) | tx_flags);
+               } else {
+                       np->tx_ring.ex[nr].PacketBufferHigh = cpu_to_le64(np->tx_dma[nr]) >> 32;
+                       np->tx_ring.ex[nr].PacketBufferLow = cpu_to_le64(np->tx_dma[nr]) & 0x0FFFFFFFF;
+                       np->tx_ring.ex[nr].FlagLen = cpu_to_le32((bcnt-1) | tx_flags);
+               }
+               tx_flags = np->tx_flags;
+               offset += bcnt;
+               size -= bcnt;
+       } while(size);
+
+       /* setup the fragments */
+       for (i = 0; i < fragments; i++) {
+               skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+               u32 size = frag->size;
+               offset = 0;
+
+               do {
+                       bcnt = (size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : size;
+                       nr = (nr + 1) % TX_RING;
+
+                       np->tx_dma[nr] = pci_map_page(np->pci_dev, frag->page, frag->page_offset+offset, bcnt,
+                                                     PCI_DMA_TODEVICE);
+                       np->tx_dma_len[nr] = bcnt;
 
                        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
                                np->tx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->tx_dma[nr]);
-                               np->tx_ring.orig[nr].FlagLen = cpu_to_le32( (frag->size-1) | np->tx_flags | tx_flags_extra);
+                               np->tx_ring.orig[nr].FlagLen = cpu_to_le32((bcnt-1) | tx_flags);
                        } else {
                                np->tx_ring.ex[nr].PacketBufferHigh = cpu_to_le64(np->tx_dma[nr]) >> 32;
                                np->tx_ring.ex[nr].PacketBufferLow = cpu_to_le64(np->tx_dma[nr]) & 0x0FFFFFFFF;
-                               np->tx_ring.ex[nr].FlagLen = cpu_to_le32( (frag->size-1) | np->tx_flags | tx_flags_extra);
+                               np->tx_ring.ex[nr].FlagLen = cpu_to_le32((bcnt-1) | tx_flags);
                        }
-                       
-                       nr = (nr - 1) % TX_RING;
+                       offset += bcnt;
+                       size -= bcnt;
+               } while (size);
+       }
 
-                       if (np->desc_ver == DESC_VER_1)
-                               tx_flags_extra &= ~NV_TX_LASTPACKET;
-                       else
-                               tx_flags_extra &= ~NV_TX2_LASTPACKET;           
-               }
+       /* set last fragment flag  */
+       if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+               np->tx_ring.orig[nr].FlagLen |= cpu_to_le32(tx_flags_extra);
+       } else {
+               np->tx_ring.ex[nr].FlagLen |= cpu_to_le32(tx_flags_extra);
        }
 
+       np->tx_skbuff[nr] = skb;
+
 #ifdef NETIF_F_TSO
        if (skb_shinfo(skb)->tso_size)
-               tx_flags_extra |= NV_TX2_TSO | (skb_shinfo(skb)->tso_size << NV_TX2_TSO_SHIFT);
+               tx_flags_extra = NV_TX2_TSO | (skb_shinfo(skb)->tso_size << NV_TX2_TSO_SHIFT);
        else
 #endif
-       tx_flags_extra |= (skb->ip_summed == CHECKSUM_HW ? (NV_TX2_CHECKSUM_L3|NV_TX2_CHECKSUM_L4) : 0);
+       tx_flags_extra = (skb->ip_summed == CHECKSUM_HW ? (NV_TX2_CHECKSUM_L3|NV_TX2_CHECKSUM_L4) : 0);
 
-       np->tx_dma[nr] = pci_map_single(np->pci_dev, skb->data, skb->len-skb->data_len,
-                                       PCI_DMA_TODEVICE);
-       
+       /* set tx flags */
        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
-               np->tx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->tx_dma[nr]);
-               np->tx_ring.orig[nr].FlagLen = cpu_to_le32( (skb->len-skb->data_len-1) | np->tx_flags | tx_flags_extra);
+               np->tx_ring.orig[start_nr].FlagLen |= cpu_to_le32(tx_flags | tx_flags_extra);
        } else {
-               np->tx_ring.ex[nr].PacketBufferHigh = cpu_to_le64(np->tx_dma[nr]) >> 32;
-               np->tx_ring.ex[nr].PacketBufferLow = cpu_to_le64(np->tx_dma[nr]) & 0x0FFFFFFFF;
-               np->tx_ring.ex[nr].FlagLen = cpu_to_le32( (skb->len-skb->data_len-1) | np->tx_flags | tx_flags_extra);
+               np->tx_ring.ex[start_nr].FlagLen |= cpu_to_le32(tx_flags | tx_flags_extra);
        }       
 
-       dprintk(KERN_DEBUG "%s: nv_start_xmit: packet packet %d queued for transmission. tx_flags_extra: %x\n",
-                               dev->name, np->next_tx, tx_flags_extra);
+       dprintk(KERN_DEBUG "%s: nv_start_xmit: packet %d (entries %d) queued for transmission. tx_flags_extra: %x\n",
+               dev->name, np->next_tx, entries, tx_flags_extra);
        {
                int j;
                for (j=0; j<64; j++) {
@@ -1068,7 +1130,7 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
                dprintk("\n");
        }
 
-       np->next_tx += 1 + fragments;
+       np->next_tx += entries;
 
        dev->trans_start = jiffies;
        spin_unlock_irq(&np->lock);
@@ -1115,7 +1177,6 @@ static void nv_tx_done(struct net_device *dev)
                                        np->stats.tx_packets++;
                                        np->stats.tx_bytes += skb->len;
                                }
-                               nv_release_txskb(dev, i);
                        }
                } else {
                        if (Flags & NV_TX2_LASTPACKET) {
@@ -1131,9 +1192,9 @@ static void nv_tx_done(struct net_device *dev)
                                        np->stats.tx_packets++;
                                        np->stats.tx_bytes += skb->len;
                                }                               
-                               nv_release_txskb(dev, i);
                        }
                }
+               nv_release_txskb(dev, i);
                np->nic_tx++;
        }
        if (np->next_tx - np->nic_tx < TX_LIMIT_START)
@@ -1310,7 +1371,7 @@ static void nv_rx_process(struct net_device *dev)
                 * the performance.
                 */
                pci_unmap_single(np->pci_dev, np->rx_dma[i],
-                               np->rx_skbuff[i]->len,
+                               np->rx_skbuff[i]->end-np->rx_skbuff[i]->data,
                                PCI_DMA_FROMDEVICE);
 
                {
@@ -1328,67 +1389,71 @@ static void nv_rx_process(struct net_device *dev)
                        if (!(Flags & NV_RX_DESCRIPTORVALID))
                                goto next_pkt;
 
-                       if (Flags & NV_RX_MISSEDFRAME) {
-                               np->stats.rx_missed_errors++;
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & (NV_RX_ERROR1|NV_RX_ERROR2|NV_RX_ERROR3)) {
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & NV_RX_CRCERR) {
-                               np->stats.rx_crc_errors++;
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & NV_RX_OVERFLOW) {
-                               np->stats.rx_over_errors++;
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & NV_RX_ERROR4) {
-                               len = nv_getlen(dev, np->rx_skbuff[i]->data, len);
-                               if (len < 0) {
+                       if (Flags & NV_RX_ERROR) {
+                               if (Flags & NV_RX_MISSEDFRAME) {
+                                       np->stats.rx_missed_errors++;
                                        np->stats.rx_errors++;
                                        goto next_pkt;
                                }
-                       }
-                       /* framing errors are soft errors. */
-                       if (Flags & NV_RX_FRAMINGERR) {
-                               if (Flags & NV_RX_SUBSTRACT1) {
-                                       len--;
+                               if (Flags & (NV_RX_ERROR1|NV_RX_ERROR2|NV_RX_ERROR3)) {
+                                       np->stats.rx_errors++;
+                                       goto next_pkt;
+                               }
+                               if (Flags & NV_RX_CRCERR) {
+                                       np->stats.rx_crc_errors++;
+                                       np->stats.rx_errors++;
+                                       goto next_pkt;
+                               }
+                               if (Flags & NV_RX_OVERFLOW) {
+                                       np->stats.rx_over_errors++;
+                                       np->stats.rx_errors++;
+                                       goto next_pkt;
+                               }
+                               if (Flags & NV_RX_ERROR4) {
+                                       len = nv_getlen(dev, np->rx_skbuff[i]->data, len);
+                                       if (len < 0) {
+                                               np->stats.rx_errors++;
+                                               goto next_pkt;
+                                       }
+                               }
+                               /* framing errors are soft errors. */
+                               if (Flags & NV_RX_FRAMINGERR) {
+                                       if (Flags & NV_RX_SUBSTRACT1) {
+                                               len--;
+                                       }
                                }
                        }
                } else {
                        if (!(Flags & NV_RX2_DESCRIPTORVALID))
                                goto next_pkt;
 
-                       if (Flags & (NV_RX2_ERROR1|NV_RX2_ERROR2|NV_RX2_ERROR3)) {
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & NV_RX2_CRCERR) {
-                               np->stats.rx_crc_errors++;
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & NV_RX2_OVERFLOW) {
-                               np->stats.rx_over_errors++;
-                               np->stats.rx_errors++;
-                               goto next_pkt;
-                       }
-                       if (Flags & NV_RX2_ERROR4) {
-                               len = nv_getlen(dev, np->rx_skbuff[i]->data, len);
-                               if (len < 0) {
+                       if (Flags & NV_RX2_ERROR) {
+                               if (Flags & (NV_RX2_ERROR1|NV_RX2_ERROR2|NV_RX2_ERROR3)) {
                                        np->stats.rx_errors++;
                                        goto next_pkt;
                                }
-                       }
-                       /* framing errors are soft errors */
-                       if (Flags & NV_RX2_FRAMINGERR) {
-                               if (Flags & NV_RX2_SUBSTRACT1) {
-                                       len--;
+                               if (Flags & NV_RX2_CRCERR) {
+                                       np->stats.rx_crc_errors++;
+                                       np->stats.rx_errors++;
+                                       goto next_pkt;
+                               }
+                               if (Flags & NV_RX2_OVERFLOW) {
+                                       np->stats.rx_over_errors++;
+                                       np->stats.rx_errors++;
+                                       goto next_pkt;
+                               }
+                               if (Flags & NV_RX2_ERROR4) {
+                                       len = nv_getlen(dev, np->rx_skbuff[i]->data, len);
+                                       if (len < 0) {
+                                               np->stats.rx_errors++;
+                                               goto next_pkt;
+                                       }
+                               }
+                               /* framing errors are soft errors */
+                               if (Flags & NV_RX2_FRAMINGERR) {
+                                       if (Flags & NV_RX2_SUBSTRACT1) {
+                                               len--;
+                                       }
                                }
                        }
                        Flags &= NV_RX2_CHECKSUMMASK;
@@ -1612,6 +1677,17 @@ static void nv_set_multicast(struct net_device *dev)
        spin_unlock_irq(&np->lock);
 }
 
+/**
+ * nv_update_linkspeed: Setup the MAC according to the link partner
+ * @dev: Network device to be configured
+ *
+ * The function queries the PHY and checks if there is a link partner.
+ * If yes, then it sets up the MAC accordingly. Otherwise, the MAC is
+ * set to 10 MBit HD.
+ *
+ * The function returns 0 if there is no link partner and 1 if there is
+ * a good link partner.
+ */
 static int nv_update_linkspeed(struct net_device *dev)
 {
        struct fe_priv *np = netdev_priv(dev);
@@ -1751,13 +1827,11 @@ set_speed:
 static void nv_linkchange(struct net_device *dev)
 {
        if (nv_update_linkspeed(dev)) {
-               if (netif_carrier_ok(dev)) {
-                       nv_stop_rx(dev);
-               } else {
+               if (!netif_carrier_ok(dev)) {
                        netif_carrier_on(dev);
                        printk(KERN_INFO "%s: link up.\n", dev->name);
+                       nv_start_rx(dev);
                }
-               nv_start_rx(dev);
        } else {
                if (netif_carrier_ok(dev)) {
                        netif_carrier_off(dev);
@@ -1799,22 +1873,18 @@ static irqreturn_t nv_nic_irq(int foo, void *data, struct pt_regs *regs)
                if (!(events & np->irqmask))
                        break;
 
-               if (events & (NVREG_IRQ_TX1|NVREG_IRQ_TX_OK|NVREG_IRQ_TX_ERROR|NVREG_IRQ_TX_ERR)) {
+               spin_lock(&np->lock);
+               nv_tx_done(dev);
+               spin_unlock(&np->lock);
+               
+               nv_rx_process(dev);
+               if (nv_alloc_rx(dev)) {
                        spin_lock(&np->lock);
-                       nv_tx_done(dev);
+                       if (!np->in_shutdown)
+                               mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
                        spin_unlock(&np->lock);
                }
-
-               if (events & (NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF)) {
-                       nv_rx_process(dev);
-                       if (nv_alloc_rx(dev)) {
-                               spin_lock(&np->lock);
-                               if (!np->in_shutdown)
-                                       mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                               spin_unlock(&np->lock);
-                       }
-               }
-
+               
                if (events & NVREG_IRQ_LINK) {
                        spin_lock(&np->lock);
                        nv_link_irq(dev);
@@ -2216,7 +2286,14 @@ static int nv_open(struct net_device *dev)
        writel(NVREG_RNDSEED_FORCE | (i&NVREG_RNDSEED_MASK), base + NvRegRandomSeed);
        writel(NVREG_UNKSETUP1_VAL, base + NvRegUnknownSetupReg1);
        writel(NVREG_UNKSETUP2_VAL, base + NvRegUnknownSetupReg2);
-       writel(NVREG_POLL_DEFAULT, base + NvRegPollingInterval);
+       if (poll_interval == -1) {
+               if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT)
+                       writel(NVREG_POLL_DEFAULT_THROUGHPUT, base + NvRegPollingInterval);
+               else
+                       writel(NVREG_POLL_DEFAULT_CPU, base + NvRegPollingInterval);
+       }
+       else
+               writel(poll_interval & 0xFFFF, base + NvRegPollingInterval);
        writel(NVREG_UNKSETUP6_VAL, base + NvRegUnknownSetupReg6);
        writel((np->phyaddr << NVREG_ADAPTCTL_PHYSHIFT)|NVREG_ADAPTCTL_PHYVALID|NVREG_ADAPTCTL_RUNNING,
                        base + NvRegAdapterControl);
@@ -2501,7 +2578,11 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
        } else {
                np->tx_flags = NV_TX2_VALID;
        }
-       np->irqmask = NVREG_IRQMASK_WANTED;
+       if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT)
+               np->irqmask = NVREG_IRQMASK_THROUGHPUT;
+       else
+               np->irqmask = NVREG_IRQMASK_CPU;
+
        if (id->driver_data & DEV_NEED_TIMERIRQ)
                np->irqmask |= NVREG_IRQ_TIMER;
        if (id->driver_data & DEV_NEED_LINKTIMER) {
@@ -2514,16 +2595,17 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
        }
 
        /* find a suitable phy */
-       for (i = 1; i < 32; i++) {
+       for (i = 1; i <= 32; i++) {
                int id1, id2;
+               int phyaddr = i & 0x1F;
 
                spin_lock_irq(&np->lock);
-               id1 = mii_rw(dev, i, MII_PHYSID1, MII_READ);
+               id1 = mii_rw(dev, phyaddr, MII_PHYSID1, MII_READ);
                spin_unlock_irq(&np->lock);
                if (id1 < 0 || id1 == 0xffff)
                        continue;
                spin_lock_irq(&np->lock);
-               id2 = mii_rw(dev, i, MII_PHYSID2, MII_READ);
+               id2 = mii_rw(dev, phyaddr, MII_PHYSID2, MII_READ);
                spin_unlock_irq(&np->lock);
                if (id2 < 0 || id2 == 0xffff)
                        continue;
@@ -2531,23 +2613,19 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                id1 = (id1 & PHYID1_OUI_MASK) << PHYID1_OUI_SHFT;
                id2 = (id2 & PHYID2_OUI_MASK) >> PHYID2_OUI_SHFT;
                dprintk(KERN_DEBUG "%s: open: Found PHY %04x:%04x at address %d.\n",
-                               pci_name(pci_dev), id1, id2, i);
-               np->phyaddr = i;
+                       pci_name(pci_dev), id1, id2, phyaddr);
+               np->phyaddr = phyaddr;
                np->phy_oui = id1 | id2;
                break;
        }
-       if (i == 32) {
-               /* PHY in isolate mode? No phy attached and user wants to
-                * test loopback? Very odd, but can be correct.
-                */
+       if (i == 33) {
                printk(KERN_INFO "%s: open: Could not find a valid PHY.\n",
-                               pci_name(pci_dev));
-       }
-
-       if (i != 32) {
-               /* reset it */
-               phy_init(dev);
+                      pci_name(pci_dev));
+               goto out_freering;
        }
+       
+       /* reset it */
+       phy_init(dev);
 
        /* set default link speed settings */
        np->linkspeed = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_10;
@@ -2689,6 +2767,10 @@ static void __exit exit_nic(void)
 
 module_param(max_interrupt_work, int, 0);
 MODULE_PARM_DESC(max_interrupt_work, "forcedeth maximum events handled per interrupt");
+module_param(optimization_mode, int, 0);
+MODULE_PARM_DESC(optimization_mode, "In throughput mode (0), every tx & rx packet will generate an interrupt. In CPU mode (1), interrupts are controlled by a timer.");
+module_param(poll_interval, int, 0);
+MODULE_PARM_DESC(poll_interval, "Interval determines how frequent timer interrupt is generated by [(time_in_micro_secs * 100) / (2^10)]. Min is 0 and Max is 65535.");
 
 MODULE_AUTHOR("Manfred Spraul <manfred@colorfullife.com>");
 MODULE_DESCRIPTION("Reverse Engineered nForce ethernet driver");