mt76: mt76s: move queue accounting in mt76s_tx_queue_skb

In order to avoid possible overflows, move tx queue accounting from
mt7663s_tx_run_queue() to mt76s_tx_queue_skb_raw()/mt76s_tx_queue_skb()
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c

@@ -180,14 +180,11 @@ static int mt7663s_tx_run_queue(struct mt7615_dev *dev, struct mt76_queue *q)
 			return -EIO;
 		}
 
+		e->done = true;
 		q->first = (q->first + 1) % q->ndesc;
 		nframes++;
 	}
 
-	spin_lock_bh(&q->lock);
-	q->queued += nframes;
-	spin_unlock_bh(&q->lock);
-
 	return nframes;
 }
 

drivers/net/wireless/mediatek/mt76/sdio.c

@@ -138,6 +138,9 @@ static int mt76s_process_tx_queue(struct mt76_dev *dev, enum mt76_txq_id qid)
 	bool wake;
 
 	while (q->queued > n_dequeued) {
+		if (!q->entry[q->head].done)
+			break;
+
 		if (q->entry[q->head].schedule) {
 			q->entry[q->head].schedule = false;
 			n_sw_dequeued++;
@@ -229,6 +232,7 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
 	q->entry[q->tail].skb = tx_info.skb;
 	q->entry[q->tail].buf_sz = len;
 	q->tail = (q->tail + 1) % q->ndesc;
+	q->queued++;
 
 	return idx;
 }
@@ -251,6 +255,7 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
 	q->entry[q->tail].buf_sz = len;
 	q->entry[q->tail].skb = skb;
 	q->tail = (q->tail + 1) % q->ndesc;
+	q->queued++;
 
 out:
 	spin_unlock_bh(&q->lock);