mt76: mt76s: move queue accounting in mt76s_tx_queue_skb

In order to avoid possible overflows, move tx queue accounting from
mt7663s_tx_run_queue() to mt76s_tx_queue_skb_raw()/mt76s_tx_queue_skb()

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
index 156666a..443a4ec 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
@@ -180,14 +180,11 @@ static int mt7663s_tx_run_queue(struct mt7615_dev *dev, struct mt76_queue *q)
                        return -EIO;
                }
 
+               e->done = true;
                q->first = (q->first + 1) % q->ndesc;
                nframes++;
        }
 
-       spin_lock_bh(&q->lock);
-       q->queued += nframes;
-       spin_unlock_bh(&q->lock);
-
        return nframes;
 }
 

diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
index a6f3255..d2b38ed 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/sdio.c
@@ -138,6 +138,9 @@ static int mt76s_process_tx_queue(struct mt76_dev *dev, enum mt76_txq_id qid)
        bool wake;
 
        while (q->queued > n_dequeued) {
+               if (!q->entry[q->head].done)
+                       break;
+
                if (q->entry[q->head].schedule) {
                        q->entry[q->head].schedule = false;
                        n_sw_dequeued++;
@@ -229,6 +232,7 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
        q->entry[q->tail].skb = tx_info.skb;
        q->entry[q->tail].buf_sz = len;
        q->tail = (q->tail + 1) % q->ndesc;
+       q->queued++;
 
        return idx;
 }
@@ -251,6 +255,7 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
        q->entry[q->tail].buf_sz = len;
        q->entry[q->tail].skb = skb;
        q->tail = (q->tail + 1) % q->ndesc;
+       q->queued++;
 
 out:
        spin_unlock_bh(&q->lock);