1 files changed, 13 insertions, 10 deletions

diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index cd856d7ce9f1..c724d96fd1e5 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -3739,6 +3739,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int i;
         int status = -ENXIO;
         int dac_enabled;
+        unsigned hdr_offset, ss_offset;
 
         netdev = alloc_etherdev_mq(sizeof(*mgp), MYRI10GE_MAX_SLICES);
         if (netdev == NULL) {
@@ -3806,14 +3807,6 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (mgp->mtrr >= 0)
                 mgp->wc_enabled = 1;
 #endif
-        /* Hack.  need to get rid of these magic numbers */
-        mgp->sram_size =
-            2 * 1024 * 1024 - (2 * (48 * 1024) + (32 * 1024)) - 0x100;
-        if (mgp->sram_size > mgp->board_span) {
-                dev_err(&pdev->dev, "board span %ld bytes too small\n",
-                        mgp->board_span);
-                goto abort_with_mtrr;
-        }
         mgp->sram = ioremap_wc(mgp->iomem_base, mgp->board_span);
         if (mgp->sram == NULL) {
                 dev_err(&pdev->dev, "ioremap failed for %ld bytes at 0x%lx\n",
@@ -3821,9 +3814,19 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 status = -ENXIO;
                 goto abort_with_mtrr;
         }
+        hdr_offset =
+            ntohl(__raw_readl(mgp->sram + MCP_HEADER_PTR_OFFSET)) & 0xffffc;
+        ss_offset = hdr_offset + offsetof(struct mcp_gen_header, string_specs);
+        mgp->sram_size = ntohl(__raw_readl(mgp->sram + ss_offset));
+        if (mgp->sram_size > mgp->board_span ||
+            mgp->sram_size <= MYRI10GE_FW_OFFSET) {
+                dev_err(&pdev->dev,
+                        "invalid sram_size %dB or board span %ldB\n",
+                        mgp->sram_size, mgp->board_span);
+                goto abort_with_ioremap;
+        }
         memcpy_fromio(mgp->eeprom_strings,
-                      mgp->sram + mgp->sram_size - MYRI10GE_EEPROM_STRINGS_SIZE,
-                      MYRI10GE_EEPROM_STRINGS_SIZE);
+                      mgp->sram + mgp->sram_size, MYRI10GE_EEPROM_STRINGS_SIZE);
         memset(mgp->eeprom_strings + MYRI10GE_EEPROM_STRINGS_SIZE - 2, 0, 2);
         status = myri10ge_read_mac_addr(mgp);
         if (status)