wifi: mt7996: harden FE/WED recovery against SCS and WDMA reset races

Crash analysis points to the FE/WED/mt7996 recovery path rather than a
standalone Wi-Fi fault.

The observed sequence is:
- mtk_eth detects an ADMA Rx hang and enters FE reset
- mtk_wed forwards the reset into mt7996 recovery
- mt7996 SCS work is still active and keeps sending MCU commands
- L1 SER starts while FE/WED reset is already in progress
- the system later hits a write-to-read-only-memory oops during the
  recovery window

The exact faulting instruction is not available from the crash log, but
the repeated "failed to send SCS MCU command" messages immediately before
L1 SER strongly indicate a reset-time race. Vendor Mediatek trees also
carry WDMA link handling around Wi-Fi L1 SER, which is missing here.

Fix this by:
- canceling scs_work in mt7996_mac_full_reset() so SCS MCU traffic cannot
  continue into reset/recovery
- disabling the PSE WDMA link before WED DMA reset and re-enabling it on
  WED start, matching the vendor SER flow more closely

Together these changes make the FE/WED/mt7996 reset path more robust under
hang recovery.

Signed-off-by: Rudy Andram <rmandrad@gmail.com>

Author: rmandrad

drivers/net/ethernet/mediatek/mtk_eth_soc.h

@@ -1853,6 +1853,18 @@ void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg);
 u32 mtk_r32(struct mtk_eth *eth, unsigned reg);
 u32 mtk_m32(struct mtk_eth *eth, u32 mask, u32 set, unsigned int reg);
 
+static inline void mtk_pse_wdma_enable(struct mtk_eth *eth, int id, bool enable)
+{
+	u32 val;
+
+	val = mtk_r32(eth, MTK_FE_GLO_CFG(PSE_WDMA_PORT(id)));
+	if (enable)
+		val &= ~MTK_FE_LINK_DOWN_P(PSE_WDMA_PORT(id));
+	else
+		val |= MTK_FE_LINK_DOWN_P(PSE_WDMA_PORT(id));
+	mtk_w32(eth, val, MTK_FE_GLO_CFG(PSE_WDMA_PORT(id)));
+}
+
 int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
 int mtk_gmac_2p5gphy_path_setup(struct mtk_eth *eth, int mac_id);
 int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);

drivers/net/ethernet/mediatek/mtk_wed.c

@@ -1762,6 +1762,8 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
 	u32 val;
 	int i;
 
+	mtk_pse_wdma_enable(dev->hw->eth, dev->wdma_idx, false);
+
 	for (i = 0; i < ARRAY_SIZE(dev->tx_ring); i++) {
 		if (!dev->tx_ring[i].desc)
 			continue;
@@ -2434,6 +2436,7 @@ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
 	mtk_wed_amsdu_init(dev);
 
 	mtk_wed_dma_enable(dev);
+	mtk_pse_wdma_enable(dev->hw->eth, dev->wdma_idx, true);
 	dev->running = true;
 }
 

drivers/net/wireless/mediatek/mt76/mt7996/mac.c

@@ -2554,6 +2554,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
 	ieee80211_stop_queues(hw);
 
 	cancel_work_sync(&dev->wed_rro.work);
+	cancel_delayed_work_sync(&dev->scs_work);
 	mt7996_for_each_phy(dev, phy)
 		cancel_delayed_work_sync(&phy->mt76->mac_work);