1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include "mt7915.h"
5 #include "mac.h"
6 #include "mcu.h"
7 #include "testmode.h"
8 
9 enum {
10 	TM_CHANGED_TXPOWER,
11 	TM_CHANGED_FREQ_OFFSET,
12 
13 	/* must be last */
14 	NUM_TM_CHANGED
15 };
16 
17 static const u8 tm_change_map[] = {
18 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
19 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
20 };
21 
22 struct reg_band {
23 	u32 band[2];
24 };
25 
26 #define REG_BAND(_reg) \
27 	{ .band[0] = MT_##_reg(0), .band[1] = MT_##_reg(1) }
28 #define REG_BAND_IDX(_reg, _idx) \
29 	{ .band[0] = MT_##_reg(0, _idx), .band[1] = MT_##_reg(1, _idx) }
30 
31 static const struct reg_band reg_backup_list[] = {
32 	REG_BAND_IDX(AGG_PCR0, 0),
33 	REG_BAND_IDX(AGG_PCR0, 1),
34 	REG_BAND_IDX(AGG_AWSCR0, 0),
35 	REG_BAND_IDX(AGG_AWSCR0, 1),
36 	REG_BAND_IDX(AGG_AWSCR0, 2),
37 	REG_BAND_IDX(AGG_AWSCR0, 3),
38 	REG_BAND(AGG_MRCR),
39 	REG_BAND(TMAC_TFCR0),
40 	REG_BAND(TMAC_TCR0),
41 	REG_BAND(AGG_ATCR1),
42 	REG_BAND(AGG_ATCR3),
43 	REG_BAND(TMAC_TRCR0),
44 	REG_BAND(TMAC_ICR0),
45 	REG_BAND_IDX(ARB_DRNGR0, 0),
46 	REG_BAND_IDX(ARB_DRNGR0, 1),
47 	REG_BAND(WF_RFCR),
48 	REG_BAND(WF_RFCR1),
49 };
50 
51 static int
52 mt7915_tm_set_tx_power(struct mt7915_phy *phy)
53 {
54 	struct mt7915_dev *dev = phy->dev;
55 	struct mt76_phy *mphy = phy->mt76;
56 	struct cfg80211_chan_def *chandef = &mphy->chandef;
57 	int freq = chandef->center_freq1;
58 	int ret;
59 	struct {
60 		u8 format_id;
61 		u8 dbdc_idx;
62 		s8 tx_power;
63 		u8 ant_idx;	/* Only 0 is valid */
64 		u8 center_chan;
65 		u8 rsv[3];
66 	} __packed req = {
67 		.format_id = 0xf,
68 		.dbdc_idx = phy != &dev->phy,
69 		.center_chan = ieee80211_frequency_to_channel(freq),
70 	};
71 	u8 *tx_power = NULL;
72 
73 	if (phy->mt76->test.state != MT76_TM_STATE_OFF)
74 		tx_power = phy->mt76->test.tx_power;
75 
76 	/* Tx power of the other antennas are the same as antenna 0 */
77 	if (tx_power && tx_power[0])
78 		req.tx_power = tx_power[0];
79 
80 	ret = mt76_mcu_send_msg(&dev->mt76,
81 				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
82 				&req, sizeof(req), false);
83 
84 	return ret;
85 }
86 
87 static int
88 mt7915_tm_set_freq_offset(struct mt7915_phy *phy, bool en, u32 val)
89 {
90 	struct mt7915_dev *dev = phy->dev;
91 	struct mt7915_tm_cmd req = {
92 		.testmode_en = en,
93 		.param_idx = MCU_ATE_SET_FREQ_OFFSET,
94 		.param.freq.band = phy != &dev->phy,
95 		.param.freq.freq_offset = cpu_to_le32(val),
96 	};
97 
98 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
99 				 sizeof(req), false);
100 }
101 
102 static int
103 mt7915_tm_mode_ctrl(struct mt7915_dev *dev, bool enable)
104 {
105 	struct {
106 		u8 format_id;
107 		bool enable;
108 		u8 rsv[2];
109 	} __packed req = {
110 		.format_id = 0x6,
111 		.enable = enable,
112 	};
113 
114 	return mt76_mcu_send_msg(&dev->mt76,
115 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
116 				 &req, sizeof(req), false);
117 }
118 
119 static int
120 mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
121 {
122 	struct mt7915_dev *dev = phy->dev;
123 	struct mt7915_tm_cmd req = {
124 		.testmode_en = 1,
125 		.param_idx = MCU_ATE_SET_TRX,
126 		.param.trx.type = type,
127 		.param.trx.enable = en,
128 		.param.trx.band = phy != &dev->phy,
129 	};
130 
131 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
132 				 sizeof(req), false);
133 }
134 
135 static int
136 mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
137 {
138 	struct mt7915_dev *dev = phy->dev;
139 	struct mt7915_tm_cmd req = {
140 		.testmode_en = 1,
141 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
142 		.param.clean.wcid = wcid,
143 		.param.clean.band = phy != &dev->phy,
144 	};
145 
146 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
147 				 sizeof(req), false);
148 }
149 
150 static int
151 mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
152 {
153 	struct mt7915_dev *dev = phy->dev;
154 	struct mt7915_tm_cmd req = {
155 		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
156 		.param_idx = MCU_ATE_SET_SLOT_TIME,
157 		.param.slot.slot_time = slot_time,
158 		.param.slot.sifs = sifs,
159 		.param.slot.rifs = 2,
160 		.param.slot.eifs = cpu_to_le16(60),
161 		.param.slot.band = phy != &dev->phy,
162 	};
163 
164 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
165 				 sizeof(req), false);
166 }
167 
168 static int
169 mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
170 {
171 	struct mt7915_dev *dev = phy->dev;
172 	struct {
173 		__le32 cmd;
174 		u8 op_mode;
175 	} __packed req = {
176 		.cmd = cpu_to_le32(MURU_SET_ARB_OP_MODE),
177 	};
178 
179 	if (!enable)
180 		req.op_mode = TAM_ARB_OP_MODE_NORMAL;
181 	else if (mu)
182 		req.op_mode = TAM_ARB_OP_MODE_TEST;
183 	else
184 		req.op_mode = TAM_ARB_OP_MODE_FORCE_SU;
185 
186 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
187 				 sizeof(req), false);
188 }
189 
190 static int
191 mt7915_tm_set_wmm_qid(struct mt7915_dev *dev, u8 qid, u8 aifs, u8 cw_min,
192 		      u16 cw_max, u16 txop)
193 {
194 	struct mt7915_mcu_tx req = { .total = 1 };
195 	struct edca *e = &req.edca[0];
196 
197 	e->queue = qid;
198 	e->set = WMM_PARAM_SET;
199 
200 	e->aifs = aifs;
201 	e->cw_min = cw_min;
202 	e->cw_max = cpu_to_le16(cw_max);
203 	e->txop = cpu_to_le16(txop);
204 
205 	return mt7915_mcu_update_edca(dev, &req);
206 }
207 
208 static int
209 mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
210 {
211 #define TM_DEFAULT_SIFS	10
212 #define TM_MAX_SIFS	127
213 #define TM_MAX_AIFSN	0xf
214 #define TM_MIN_AIFSN	0x1
215 #define BBP_PROC_TIME	1500
216 	struct mt7915_dev *dev = phy->dev;
217 	u8 sig_ext = (mode == MT76_TM_TX_MODE_CCK) ? 0 : 6;
218 	u8 slot_time = 9, sifs = TM_DEFAULT_SIFS;
219 	u8 aifsn = TM_MIN_AIFSN;
220 	u32 i2t_time, tr2t_time, txv_time;
221 	bool ext_phy = phy != &dev->phy;
222 	u16 cw = 0;
223 
224 	if (ipg < sig_ext + slot_time + sifs)
225 		ipg = 0;
226 
227 	if (!ipg)
228 		goto done;
229 
230 	ipg -= sig_ext;
231 
232 	if (ipg <= (TM_MAX_SIFS + slot_time)) {
233 		sifs = ipg - slot_time;
234 	} else {
235 		u32 val = (ipg + slot_time) / slot_time;
236 
237 		while (val >>= 1)
238 			cw++;
239 
240 		if (cw > 16)
241 			cw = 16;
242 
243 		ipg -= ((1 << cw) - 1) * slot_time;
244 
245 		aifsn = ipg / slot_time;
246 		if (aifsn > TM_MAX_AIFSN)
247 			aifsn = TM_MAX_AIFSN;
248 
249 		ipg -= aifsn * slot_time;
250 
251 		if (ipg > TM_DEFAULT_SIFS) {
252 			if (ipg < TM_MAX_SIFS)
253 				sifs = ipg;
254 			else
255 				sifs = TM_MAX_SIFS;
256 		}
257 	}
258 done:
259 	txv_time = mt76_get_field(dev, MT_TMAC_ATCR(ext_phy),
260 				  MT_TMAC_ATCR_TXV_TOUT);
261 	txv_time *= 50;	/* normal clock time */
262 
263 	i2t_time = (slot_time * 1000 - txv_time - BBP_PROC_TIME) / 50;
264 	tr2t_time = (sifs * 1000 - txv_time - BBP_PROC_TIME) / 50;
265 
266 	mt76_set(dev, MT_TMAC_TRCR0(ext_phy),
267 		 FIELD_PREP(MT_TMAC_TRCR0_TR2T_CHK, tr2t_time) |
268 		 FIELD_PREP(MT_TMAC_TRCR0_I2T_CHK, i2t_time));
269 
270 	mt7915_tm_set_slot_time(phy, slot_time, sifs);
271 
272 	return mt7915_tm_set_wmm_qid(dev,
273 				     mt7915_lmac_mapping(dev, IEEE80211_AC_BE),
274 				     aifsn, cw, cw, 0);
275 }
276 
277 static int
278 mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
279 {
280 	struct mt76_phy *mphy = phy->mt76;
281 	struct mt76_testmode_data *td = &mphy->test;
282 	struct ieee80211_supported_band *sband;
283 	struct rate_info rate = {};
284 	u16 flags = 0, tx_len;
285 	u32 bitrate;
286 	int ret;
287 
288 	if (!tx_time)
289 		return 0;
290 
291 	rate.mcs = td->tx_rate_idx;
292 	rate.nss = td->tx_rate_nss;
293 
294 	switch (td->tx_rate_mode) {
295 	case MT76_TM_TX_MODE_CCK:
296 	case MT76_TM_TX_MODE_OFDM:
297 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
298 			sband = &mphy->sband_5g.sband;
299 		else
300 			sband = &mphy->sband_2g.sband;
301 
302 		rate.legacy = sband->bitrates[rate.mcs].bitrate;
303 		break;
304 	case MT76_TM_TX_MODE_HT:
305 		rate.mcs += rate.nss * 8;
306 		flags |= RATE_INFO_FLAGS_MCS;
307 
308 		if (td->tx_rate_sgi)
309 			flags |= RATE_INFO_FLAGS_SHORT_GI;
310 		break;
311 	case MT76_TM_TX_MODE_VHT:
312 		flags |= RATE_INFO_FLAGS_VHT_MCS;
313 
314 		if (td->tx_rate_sgi)
315 			flags |= RATE_INFO_FLAGS_SHORT_GI;
316 		break;
317 	case MT76_TM_TX_MODE_HE_SU:
318 	case MT76_TM_TX_MODE_HE_EXT_SU:
319 	case MT76_TM_TX_MODE_HE_TB:
320 	case MT76_TM_TX_MODE_HE_MU:
321 		rate.he_gi = td->tx_rate_sgi;
322 		flags |= RATE_INFO_FLAGS_HE_MCS;
323 		break;
324 	default:
325 		break;
326 	}
327 	rate.flags = flags;
328 
329 	switch (mphy->chandef.width) {
330 	case NL80211_CHAN_WIDTH_160:
331 	case NL80211_CHAN_WIDTH_80P80:
332 		rate.bw = RATE_INFO_BW_160;
333 		break;
334 	case NL80211_CHAN_WIDTH_80:
335 		rate.bw = RATE_INFO_BW_80;
336 		break;
337 	case NL80211_CHAN_WIDTH_40:
338 		rate.bw = RATE_INFO_BW_40;
339 		break;
340 	default:
341 		rate.bw = RATE_INFO_BW_20;
342 		break;
343 	}
344 
345 	bitrate = cfg80211_calculate_bitrate(&rate);
346 	tx_len = bitrate * tx_time / 10 / 8;
347 
348 	ret = mt76_testmode_alloc_skb(phy->mt76, tx_len);
349 	if (ret)
350 		return ret;
351 
352 	return 0;
353 }
354 
355 static void
356 mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
357 {
358 	int n_regs = ARRAY_SIZE(reg_backup_list);
359 	struct mt7915_dev *dev = phy->dev;
360 	bool ext_phy = phy != &dev->phy;
361 	u32 *b = phy->test.reg_backup;
362 	int i;
363 
364 	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
365 		for (i = 0; i < n_regs; i++)
366 			mt76_wr(dev, reg_backup_list[i].band[ext_phy], b[i]);
367 		return;
368 	}
369 
370 	if (b)
371 		return;
372 
373 	b = devm_kzalloc(dev->mt76.dev, 4 * n_regs, GFP_KERNEL);
374 	if (!b)
375 		return;
376 
377 	phy->test.reg_backup = b;
378 	for (i = 0; i < n_regs; i++)
379 		b[i] = mt76_rr(dev, reg_backup_list[i].band[ext_phy]);
380 
381 	mt76_clear(dev, MT_AGG_PCR0(ext_phy, 0), MT_AGG_PCR0_MM_PROT |
382 		   MT_AGG_PCR0_GF_PROT | MT_AGG_PCR0_ERP_PROT |
383 		   MT_AGG_PCR0_VHT_PROT | MT_AGG_PCR0_BW20_PROT |
384 		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
385 	mt76_set(dev, MT_AGG_PCR0(ext_phy, 0), MT_AGG_PCR0_PTA_WIN_DIS);
386 
387 	mt76_wr(dev, MT_AGG_PCR0(ext_phy, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
388 		MT_AGG_PCR1_RTS0_LEN_THRES);
389 
390 	mt76_clear(dev, MT_AGG_MRCR(ext_phy), MT_AGG_MRCR_BAR_CNT_LIMIT |
391 		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
392 		   MT_AGG_MRCR_TXCMD_RTS_FAIL_LIMIT);
393 
394 	mt76_rmw(dev, MT_AGG_MRCR(ext_phy), MT_AGG_MRCR_RTS_FAIL_LIMIT |
395 		 MT_AGG_MRCR_TXCMD_RTS_FAIL_LIMIT,
396 		 FIELD_PREP(MT_AGG_MRCR_RTS_FAIL_LIMIT, 1) |
397 		 FIELD_PREP(MT_AGG_MRCR_TXCMD_RTS_FAIL_LIMIT, 1));
398 
399 	mt76_wr(dev, MT_TMAC_TFCR0(ext_phy), 0);
400 	mt76_clear(dev, MT_TMAC_TCR0(ext_phy), MT_TMAC_TCR0_TBTT_STOP_CTRL);
401 
402 	/* config rx filter for testmode rx */
403 	mt76_wr(dev, MT_WF_RFCR(ext_phy), 0xcf70a);
404 	mt76_wr(dev, MT_WF_RFCR1(ext_phy), 0);
405 }
406 
407 static void
408 mt7915_tm_init(struct mt7915_phy *phy, bool en)
409 {
410 	struct mt7915_dev *dev = phy->dev;
411 
412 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
413 		return;
414 
415 	mt7915_mcu_set_sku_en(phy, !en);
416 
417 	mt7915_tm_mode_ctrl(dev, en);
418 	mt7915_tm_reg_backup_restore(phy);
419 	mt7915_tm_set_trx(phy, TM_MAC_TXRX, !en);
420 
421 	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
422 	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
423 
424 	if (!en)
425 		mt7915_tm_set_tam_arb(phy, en, 0);
426 }
427 
428 static void
429 mt7915_tm_update_channel(struct mt7915_phy *phy)
430 {
431 	mutex_unlock(&phy->dev->mt76.mutex);
432 	mt7915_set_channel(phy);
433 	mutex_lock(&phy->dev->mt76.mutex);
434 
435 	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
436 }
437 
438 static void
439 mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
440 {
441 	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
442 					 9, 8, 6, 10, 16, 12, 18, 0};
443 	struct mt76_testmode_data *td = &phy->mt76->test;
444 	struct mt7915_dev *dev = phy->dev;
445 	struct ieee80211_tx_info *info;
446 	u8 duty_cycle = td->tx_duty_cycle;
447 	u32 tx_time = td->tx_time;
448 	u32 ipg = td->tx_ipg;
449 
450 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
451 	mt7915_tm_clean_hwq(phy, dev->mt76.global_wcid.idx);
452 
453 	if (en) {
454 		mt7915_tm_update_channel(phy);
455 
456 		if (td->tx_spe_idx) {
457 			phy->test.spe_idx = td->tx_spe_idx;
458 		} else {
459 			u8 tx_ant = td->tx_antenna_mask;
460 
461 			if (phy != &dev->phy)
462 				tx_ant >>= 2;
463 			phy->test.spe_idx = spe_idx_map[tx_ant];
464 		}
465 	}
466 
467 	mt7915_tm_set_tam_arb(phy, en,
468 			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
469 
470 	/* if all three params are set, duty_cycle will be ignored */
471 	if (duty_cycle && tx_time && !ipg) {
472 		ipg = tx_time * 100 / duty_cycle - tx_time;
473 	} else if (duty_cycle && !tx_time && ipg) {
474 		if (duty_cycle < 100)
475 			tx_time = duty_cycle * ipg / (100 - duty_cycle);
476 	}
477 
478 	mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
479 	mt7915_tm_set_tx_len(phy, tx_time);
480 
481 	if (ipg)
482 		td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
483 
484 	if (!en || !td->tx_skb)
485 		return;
486 
487 	info = IEEE80211_SKB_CB(td->tx_skb);
488 	info->control.vif = phy->monitor_vif;
489 
490 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
491 }
492 
493 static void
494 mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
495 {
496 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
497 
498 	if (en) {
499 		struct mt7915_dev *dev = phy->dev;
500 
501 		mt7915_tm_update_channel(phy);
502 
503 		/* read-clear */
504 		mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
505 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
506 	}
507 }
508 
509 static int
510 mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
511 {
512 	struct mt7915_tm_rf_test req = {
513 		.op.op_mode = cpu_to_le32(oper),
514 	};
515 
516 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
517 				 sizeof(req), true);
518 }
519 
520 static int
521 mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
522 {
523 #define TX_CONT_START	0x05
524 #define TX_CONT_STOP	0x06
525 	struct mt7915_dev *dev = phy->dev;
526 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
527 	int freq1 = ieee80211_frequency_to_channel(chandef->center_freq1);
528 	struct mt76_testmode_data *td = &phy->mt76->test;
529 	u32 func_idx = en ? TX_CONT_START : TX_CONT_STOP;
530 	u8 rate_idx = td->tx_rate_idx, mode;
531 	u16 rateval;
532 	struct mt7915_tm_rf_test req = {
533 		.action = 1,
534 		.icap_len = 120,
535 		.op.rf.func_idx = cpu_to_le32(func_idx),
536 	};
537 	struct tm_tx_cont *tx_cont = &req.op.rf.param.tx_cont;
538 
539 	tx_cont->control_ch = chandef->chan->hw_value;
540 	tx_cont->center_ch = freq1;
541 	tx_cont->tx_ant = td->tx_antenna_mask;
542 	tx_cont->band = phy != &dev->phy;
543 
544 	switch (chandef->width) {
545 	case NL80211_CHAN_WIDTH_40:
546 		tx_cont->bw = CMD_CBW_40MHZ;
547 		break;
548 	case NL80211_CHAN_WIDTH_80:
549 		tx_cont->bw = CMD_CBW_80MHZ;
550 		break;
551 	case NL80211_CHAN_WIDTH_80P80:
552 		tx_cont->bw = CMD_CBW_8080MHZ;
553 		break;
554 	case NL80211_CHAN_WIDTH_160:
555 		tx_cont->bw = CMD_CBW_160MHZ;
556 		break;
557 	case NL80211_CHAN_WIDTH_5:
558 		tx_cont->bw = CMD_CBW_5MHZ;
559 		break;
560 	case NL80211_CHAN_WIDTH_10:
561 		tx_cont->bw = CMD_CBW_10MHZ;
562 		break;
563 	case NL80211_CHAN_WIDTH_20:
564 		tx_cont->bw = CMD_CBW_20MHZ;
565 		break;
566 	case NL80211_CHAN_WIDTH_20_NOHT:
567 		tx_cont->bw = CMD_CBW_20MHZ;
568 		break;
569 	default:
570 		return -EINVAL;
571 	}
572 
573 	if (!en) {
574 		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
575 		goto out;
576 	}
577 
578 	if (td->tx_rate_mode <= MT76_TM_TX_MODE_OFDM) {
579 		struct ieee80211_supported_band *sband;
580 		u8 idx = rate_idx;
581 
582 		if (chandef->chan->band == NL80211_BAND_5GHZ)
583 			sband = &phy->mt76->sband_5g.sband;
584 		else
585 			sband = &phy->mt76->sband_2g.sband;
586 
587 		if (td->tx_rate_mode == MT76_TM_TX_MODE_OFDM)
588 			idx += 4;
589 		rate_idx = sband->bitrates[idx].hw_value & 0xff;
590 	}
591 
592 	switch (td->tx_rate_mode) {
593 	case MT76_TM_TX_MODE_CCK:
594 		mode = MT_PHY_TYPE_CCK;
595 		break;
596 	case MT76_TM_TX_MODE_OFDM:
597 		mode = MT_PHY_TYPE_OFDM;
598 		break;
599 	case MT76_TM_TX_MODE_HT:
600 		mode = MT_PHY_TYPE_HT;
601 		break;
602 	case MT76_TM_TX_MODE_VHT:
603 		mode = MT_PHY_TYPE_VHT;
604 		break;
605 	case MT76_TM_TX_MODE_HE_SU:
606 		mode = MT_PHY_TYPE_HE_SU;
607 		break;
608 	case MT76_TM_TX_MODE_HE_EXT_SU:
609 		mode = MT_PHY_TYPE_HE_EXT_SU;
610 		break;
611 	case MT76_TM_TX_MODE_HE_TB:
612 		mode = MT_PHY_TYPE_HE_TB;
613 		break;
614 	case MT76_TM_TX_MODE_HE_MU:
615 		mode = MT_PHY_TYPE_HE_MU;
616 		break;
617 	default:
618 		return -EINVAL;
619 	}
620 
621 	rateval =  mode << 6 | rate_idx;
622 	tx_cont->rateval = cpu_to_le16(rateval);
623 
624 out:
625 	if (!en) {
626 		int ret;
627 
628 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
629 					sizeof(req), true);
630 		if (ret)
631 			return ret;
632 
633 		return mt7915_tm_rf_switch_mode(dev, RF_OPER_NORMAL);
634 	}
635 
636 	mt7915_tm_rf_switch_mode(dev, RF_OPER_RF_TEST);
637 	mt7915_tm_update_channel(phy);
638 
639 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
640 				 sizeof(req), true);
641 }
642 
643 static void
644 mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
645 {
646 	struct mt76_testmode_data *td = &phy->mt76->test;
647 	bool en = phy->mt76->test.state != MT76_TM_STATE_OFF;
648 
649 	if (changed & BIT(TM_CHANGED_FREQ_OFFSET))
650 		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
651 	if (changed & BIT(TM_CHANGED_TXPOWER))
652 		mt7915_tm_set_tx_power(phy);
653 }
654 
655 static int
656 mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
657 {
658 	struct mt76_testmode_data *td = &mphy->test;
659 	struct mt7915_phy *phy = mphy->priv;
660 	enum mt76_testmode_state prev_state = td->state;
661 
662 	mphy->test.state = state;
663 
664 	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
665 	    state == MT76_TM_STATE_TX_FRAMES)
666 		mt7915_tm_set_tx_frames(phy, state == MT76_TM_STATE_TX_FRAMES);
667 	else if (prev_state == MT76_TM_STATE_RX_FRAMES ||
668 		 state == MT76_TM_STATE_RX_FRAMES)
669 		mt7915_tm_set_rx_frames(phy, state == MT76_TM_STATE_RX_FRAMES);
670 	else if (prev_state == MT76_TM_STATE_TX_CONT ||
671 		 state == MT76_TM_STATE_TX_CONT)
672 		mt7915_tm_set_tx_cont(phy, state == MT76_TM_STATE_TX_CONT);
673 	else if (prev_state == MT76_TM_STATE_OFF ||
674 		 state == MT76_TM_STATE_OFF)
675 		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
676 
677 	if ((state == MT76_TM_STATE_IDLE &&
678 	     prev_state == MT76_TM_STATE_OFF) ||
679 	    (state == MT76_TM_STATE_OFF &&
680 	     prev_state == MT76_TM_STATE_IDLE)) {
681 		u32 changed = 0;
682 		int i;
683 
684 		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
685 			u16 cur = tm_change_map[i];
686 
687 			if (td->param_set[cur / 32] & BIT(cur % 32))
688 				changed |= BIT(i);
689 		}
690 
691 		mt7915_tm_update_params(phy, changed);
692 	}
693 
694 	return 0;
695 }
696 
697 static int
698 mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
699 		     enum mt76_testmode_state new_state)
700 {
701 	struct mt76_testmode_data *td = &mphy->test;
702 	struct mt7915_phy *phy = mphy->priv;
703 	u32 changed = 0;
704 	int i;
705 
706 	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
707 
708 	if (new_state == MT76_TM_STATE_OFF ||
709 	    td->state == MT76_TM_STATE_OFF)
710 		return 0;
711 
712 	if (td->tx_antenna_mask & ~mphy->chainmask)
713 		return -EINVAL;
714 
715 	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
716 		if (tb[tm_change_map[i]])
717 			changed |= BIT(i);
718 	}
719 
720 	mt7915_tm_update_params(phy, changed);
721 
722 	return 0;
723 }
724 
725 static int
726 mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
727 {
728 	struct mt7915_phy *phy = mphy->priv;
729 	struct mt7915_dev *dev = phy->dev;
730 	bool ext_phy = phy != &dev->phy;
731 	enum mt76_rxq_id q;
732 	void *rx, *rssi;
733 	u16 fcs_err;
734 	int i;
735 
736 	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
737 	if (!rx)
738 		return -ENOMEM;
739 
740 	if (nla_put_s32(msg, MT76_TM_RX_ATTR_FREQ_OFFSET, phy->test.last_freq_offset))
741 		return -ENOMEM;
742 
743 	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_RCPI);
744 	if (!rssi)
745 		return -ENOMEM;
746 
747 	for (i = 0; i < ARRAY_SIZE(phy->test.last_rcpi); i++)
748 		if (nla_put_u8(msg, i, phy->test.last_rcpi[i]))
749 			return -ENOMEM;
750 
751 	nla_nest_end(msg, rssi);
752 
753 	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
754 	if (!rssi)
755 		return -ENOMEM;
756 
757 	for (i = 0; i < ARRAY_SIZE(phy->test.last_ib_rssi); i++)
758 		if (nla_put_s8(msg, i, phy->test.last_ib_rssi[i]))
759 			return -ENOMEM;
760 
761 	nla_nest_end(msg, rssi);
762 
763 	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_WB_RSSI);
764 	if (!rssi)
765 		return -ENOMEM;
766 
767 	for (i = 0; i < ARRAY_SIZE(phy->test.last_wb_rssi); i++)
768 		if (nla_put_s8(msg, i, phy->test.last_wb_rssi[i]))
769 			return -ENOMEM;
770 
771 	nla_nest_end(msg, rssi);
772 
773 	if (nla_put_u8(msg, MT76_TM_RX_ATTR_SNR, phy->test.last_snr))
774 		return -ENOMEM;
775 
776 	nla_nest_end(msg, rx);
777 
778 	fcs_err = mt76_get_field(dev, MT_MIB_SDR3(ext_phy),
779 				 MT_MIB_SDR3_FCS_ERR_MASK);
780 	q = ext_phy ? MT_RXQ_EXT : MT_RXQ_MAIN;
781 	mphy->test.rx_stats.packets[q] += fcs_err;
782 	mphy->test.rx_stats.fcs_error[q] += fcs_err;
783 
784 	return 0;
785 }
786 
787 const struct mt76_testmode_ops mt7915_testmode_ops = {
788 	.set_state = mt7915_tm_set_state,
789 	.set_params = mt7915_tm_set_params,
790 	.dump_stats = mt7915_tm_dump_stats,
791 };
792