mt7915: missing 2.4 GHz noise on Linksys E7350 with ECO0 / CCA firmware path

diff --git a/mt7915/mac.c b/mt7915/mac.c
index 06cddff..4c04bcc 100644
--- a/mt7915/mac.c
+++ b/mt7915/mac.c
@@ -2,7 +2,9 @@
 /* Copyright (C) 2020 MediaTek Inc. */
 
 #include <linux/etherdevice.h>
+#include <linux/module.h>
 #include <linux/timekeeping.h>
+#include <linux/of.h>
 #include "coredump.h"
 #include "mt7915.h"
 #include "../dma.h"
@@ -11,6 +13,13 @@
 
 #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
 
+/* Experimental, opt-in and restricted to the board/band measured in this
+ * investigation. Do not infer support for other ECO0 boards or 5 GHz.
+ */
+static bool cca_nf;
+module_param(cca_nf, bool, 0444);
+MODULE_PARM_DESC(cca_nf, "Experimental E7350 ECO0 2.4 GHz CCA noise reporting");
+
 static const struct mt7915_dfs_radar_spec etsi_radar_specs = {
 	.pulse_th = { 110, -10, -80, 40, 5200, 128, 5200 },
 	.radar_pattern = {
@@ -1093,6 +1102,91 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 	}
 }
 
+static bool mt7915_use_cca_nf(struct mt7915_phy *phy)
+{
+	struct mt7915_dev *dev = phy->dev;
+
+	return cca_nf && is_mt7915(&dev->mt76) && dev->dbdc_support &&
+	       !phy->mt76->band_idx && phy->mt76->chainmask == 3 &&
+	       phy->mt76->chandef.chan &&
+	       phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ &&
+	       phy->mt76->chandef.width == NL80211_CHAN_WIDTH_20 &&
+	       of_machine_is_compatible("linksys,e7350") &&
+	       !mt76_rr(dev, MT7915_HW_ECO);
+}
+
+static void mt7915_reset_cca_nf(struct mt7915_phy *phy)
+{
+	mt7915_nf_cca_clear(&phy->cca_nf);
+	phy->cca_nf_started = false;
+	phy->cca_nf_last = 0;
+	phy->noise = 0;
+	phy->mt76->chan_state->noise = 0;
+}
+
+/* WM b4e52: pulse only the band-0 idle-power accumulator's bit 30.
+ * The exact observed configuration is required for this experimental path;
+ * no other CCA settings are programmed, and band 1 is never written.
+ */
+static bool mt7915_reset_cca_window(struct mt7915_phy *phy)
+{
+	struct mt7915_dev *dev = phy->dev;
+	u32 ctrl = mt76_rr(dev, MT7915_CCA_IDLE_CTRL0);
+
+	if (ctrl != 0x33ca175b)
+		return false;
+
+	mt76_set(dev, MT7915_CCA_IDLE_CTRL0, MT7915_CCA_IDLE_RESET);
+	mt76_clear(dev, MT7915_CCA_IDLE_CTRL0, MT7915_CCA_IDLE_RESET);
+
+	return mt76_rr(dev, MT7915_CCA_IDLE_CTRL0) == ctrl;
+}
+
+static u8 mt7915_get_cca_nf(struct mt7915_phy *phy)
+{
+	struct mt7915_dev *dev = phy->dev;
+	unsigned long now = jiffies;
+	u16 raw0, raw1;
+	int nf;
+
+	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state)) {
+		mt7915_reset_cca_nf(phy);
+		return 0;
+	}
+
+	/* Survey polling must not shorten the window or weight cached values. */
+	if (phy->cca_nf_started &&
+	    time_before(now, phy->cca_nf_last + msecs_to_jiffies(100)))
+		return 0;
+
+	if (!phy->cca_nf_started ||
+	    time_after(now, phy->cca_nf_last + HZ)) {
+		mt7915_reset_cca_nf(phy);
+		if (mt7915_reset_cca_window(phy)) {
+			phy->cca_nf_started = true;
+			phy->cca_nf_last = jiffies;
+		}
+		return 0;
+	}
+
+	raw0 = FIELD_GET(MT7915_CCA_IDLE_PWR_MASK,
+			 mt76_rr(dev, MT7915_CCA_IDLE_PWR0));
+	raw1 = FIELD_GET(MT7915_CCA_IDLE_PWR_MASK,
+			 mt76_rr(dev, MT7915_CCA_IDLE_PWR1));
+	if (!mt7915_reset_cca_window(phy)) {
+		mt7915_reset_cca_nf(phy);
+		return 0;
+	}
+	phy->cca_nf_last = jiffies;
+	nf = mt7915_nf_cca_add(&phy->cca_nf, raw0, raw1);
+	if (nf < 0) {
+		mt7915_reset_cca_nf(phy);
+		return 0;
+	}
+
+	return nf;
+}
+
 void mt7915_mac_cca_stats_reset(struct mt7915_phy *phy)
 {
 	struct mt7915_dev *dev = phy->dev;
@@ -1120,6 +1214,8 @@ void mt7915_mac_reset_counters(struct mt7915_phy *phy)
 		 MT_WF_RMAC_MIB_RXTIME_CLR);
 
 	mt7915_mcu_get_chan_mib_info(phy, true);
+	if (mt7915_use_cca_nf(phy) || phy->cca_nf_started)
+		mt7915_reset_cca_nf(phy);
 }
 
 void mt7915_mac_set_timing(struct mt7915_phy *phy)
@@ -1230,7 +1326,13 @@ void mt7915_update_channel(struct mt76_phy *mphy)
 
 	mt7915_mcu_get_chan_mib_info(phy, false);
 
-	nf = mt7915_phy_get_nf(phy, phy->mt76->band_idx);
+	if (mt7915_use_cca_nf(phy)) {
+		nf = mt7915_get_cca_nf(phy);
+	} else {
+		if (phy->cca_nf_started)
+			mt7915_reset_cca_nf(phy);
+		nf = mt7915_phy_get_nf(phy, phy->mt76->band_idx);
+	}
 	if (!phy->noise)
 		phy->noise = nf << 4;
 	else if (nf)
diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
index 7ee9bed..2c6b916 100644
--- a/mt7915/mt7915.h
+++ b/mt7915/mt7915.h
@@ -8,6 +8,7 @@
 #include <linux/ktime.h>
 #include "../mt76_connac.h"
 #include "regs.h"
+#include "nf-cca.h"
 
 #define MT7915_MAX_INTERFACES		19
 #define MT7915_WTBL_SIZE		288
@@ -225,6 +226,9 @@ struct mt7915_phy {
 	u64 omac_mask;
 
 	u16 noise;
+	struct mt7915_nf_cca cca_nf;
+	unsigned long cca_nf_last;
+	bool cca_nf_started;
 
 	s16 coverage_class;
 	u8 slottime;
diff --git a/mt7915/regs.h b/mt7915/regs.h
index dc7bb9a..e06d4b6 100644
--- a/mt7915/regs.h
+++ b/mt7915/regs.h
@@ -1204,6 +1204,12 @@ enum offs_rev {
 
 /* PHY */
 #define MT_WF_PHY_BASE			0x83080000
+#define MT7915_HW_ECO			0x70010210
+#define MT7915_CCA_IDLE_CTRL0		0x830884f0
+#define MT7915_CCA_IDLE_RESET		BIT(30)
+#define MT7915_CCA_IDLE_PWR0		0x830a60ac
+#define MT7915_CCA_IDLE_PWR1		0x830a60b0
+#define MT7915_CCA_IDLE_PWR_MASK		GENMASK(17, 9)
 #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 
 #define MT_WF_PHY_RX_CTRL1(_phy)	MT_WF_PHY(0x2004 + ((_phy) << 16))
diff --git a/mt7915/nf-cca.h b/mt7915/nf-cca.h
new file mode 100644
index 0000000..0bd27ea
--- /dev/null
+++ b/mt7915/nf-cca.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: BSD-3-Clause-Clear */
+#ifndef __MT7915_NF_CCA_H
+#define __MT7915_NF_CCA_H
+
+#include <linux/types.h>
+
+#define MT7915_NF_CCA_SAMPLES 10
+
+struct mt7915_nf_cca {
+	u32 sum[2];
+	u8 count;
+};
+
+static inline void mt7915_nf_cca_clear(struct mt7915_nf_cca *state)
+{
+	state->sum[0] = 0;
+	state->sum[1] = 0;
+	state->count = 0;
+}
+
+/* Return -1 for an unsupported encoding, 0 while collecting, else |dBm|.
+ * Match the OEM order: average raw words per chain, convert to integer
+ * dBm, then average the two chains. No clipping or TX/RX threshold.
+ */
+static inline int mt7915_nf_cca_add(struct mt7915_nf_cca *state,
+				  u16 raw0, u16 raw1)
+{
+	u32 avg0, avg1, nf0, nf1;
+
+	if (raw0 < 256 || raw0 > 511 || raw1 < 256 || raw1 > 511) {
+		mt7915_nf_cca_clear(state);
+		return -1;
+	}
+
+	state->sum[0] += raw0;
+	state->sum[1] += raw1;
+	if (++state->count < MT7915_NF_CCA_SAMPLES)
+		return 0;
+
+	avg0 = state->sum[0] / MT7915_NF_CCA_SAMPLES;
+	avg1 = state->sum[1] / MT7915_NF_CCA_SAMPLES;
+	nf0 = (513 - avg0) / 2;
+	nf1 = (513 - avg1) / 2;
+	mt7915_nf_cca_clear(state);
+
+	return (nf0 + nf1) / 2;
+}
+
+#endif

This is diagnostic source, not a portable or production module. The include layout used an include/mt7915/ copy of the unmodified mt7915.h and regs.h from the exact mt76 commit; include/mt76_connac.h points to that revision's mt76_connac.h. The CCA helper at ../patched/mt7915/nf-cca.h is included in the patch above. The module Makefile was obj-m += mt7915-cca-probe.o and ccflags-y += -Werror -DCONFIG_MT76_LEDS. It was built using the matching kernel/backport headers and stock configuration. A different kernel/private-structure layout must not be used. The driver-patch binary itself was not inserted.

// SPDX-License-Identifier: GPL-2.0-only
/* Temporary, explicitly loaded diagnostic. No driver reload or UCI changes.
 * Built against the original private headers whose baseline .text/.rodata
 * were reproduced byte for byte. This is not a portable module interface.
 */
#include <linux/debugfs.h>
#include <linux/module.h>
#include <linux/of.h>
#include <linux/pci.h>
#include <linux/seq_file.h>
#include <linux/workqueue.h>
#include "include/mt7915/mt7915.h"
#include "../patched/mt7915/nf-cca.h"

#define CCA_CTRL0 0x830884f0
#define CCA_CTRL1 0x830984f0
#define CCA_RESET BIT(30)
#define CCA_POWER0 0x830a60ac
#define CCA_POWER1 0x830a60b0
#define CCA_POWER_MASK GENMASK(17, 9)

static unsigned int seconds = 30;
module_param(seconds, uint, 0444);
MODULE_PARM_DESC(seconds, "Bounded diagnostic duration, 5..60 seconds");

static struct {
	struct pci_dev *pdev;
	struct module *parent;
	struct mt7915_dev *dev;
	struct mt7915_phy *phy;
	struct mt76_channel_state *channel;
	struct ieee80211_channel *frequency;
	enum nl80211_chan_width width;
	struct delayed_work work;
	struct dentry *debugfs;
	struct mt7915_nf_cca accumulator;
	unsigned long deadline;
	u16 saved_phy_noise;
	s8 saved_channel_noise;
	u16 last_raw[2];
	u32 samples;
	u32 reports;
	u32 invalid;
	bool stopped;
} probe;

static bool reset_window(void)
{
	u32 original = mt76_rr(probe.dev, CCA_CTRL0);

	if (original != 0x33ca175b ||
	    mt76_rr(probe.dev, CCA_CTRL1) != 0x33ca175b)
		return false;
	mt76_set(probe.dev, CCA_CTRL0, CCA_RESET);
	mt76_clear(probe.dev, CCA_CTRL0, CCA_RESET);
	return mt76_rr(probe.dev, CCA_CTRL0) == original;
}

/* Caller holds the same mutex as the stock survey updater. */
static void stop_probe(void)
{
	if (probe.stopped)
		return;
	probe.phy->noise = probe.saved_phy_noise;
	probe.channel->noise = probe.saved_channel_noise;
	if (probe.phy->mt76->chan_state != probe.channel)
		probe.phy->mt76->chan_state->noise = 0;
	mt7915_nf_cca_clear(&probe.accumulator);
	probe.stopped = true;
}

static void sample_work(struct work_struct *work)
{
	struct mt76_phy *mphy = probe.phy->mt76;
	int nf;

	(void)work;
	mutex_lock(&probe.dev->mt76.mutex);
	if (time_after_eq(jiffies, probe.deadline) ||
	    !test_bit(MT76_STATE_RUNNING, &mphy->state) ||
	    test_bit(MT76_RESET, &mphy->state) ||
	    mphy->chan_state != probe.channel ||
	    mphy->chandef.chan != probe.frequency ||
	    mphy->chandef.width != probe.width) {
		stop_probe();
		goto out;
	}

	probe.last_raw[0] = FIELD_GET(CCA_POWER_MASK,
				     mt76_rr(probe.dev, CCA_POWER0));
	probe.last_raw[1] = FIELD_GET(CCA_POWER_MASK,
				     mt76_rr(probe.dev, CCA_POWER1));
	if (!reset_window()) {
		stop_probe();
		goto out;
	}
	probe.samples++;
	nf = mt7915_nf_cca_add(&probe.accumulator,
			       probe.last_raw[0], probe.last_raw[1]);
	if (nf < 0) {
		probe.invalid++;
		probe.phy->noise = 0;
		probe.channel->noise = 0;
	} else if (nf) {
		if (!probe.phy->noise)
			probe.phy->noise = nf << 4;
		else
			probe.phy->noise += nf - (probe.phy->noise >> 4);
		probe.channel->noise = -(probe.phy->noise >> 4);
		probe.reports++;
	}
	queue_delayed_work(system_wq, &probe.work, msecs_to_jiffies(100));
out:
	mutex_unlock(&probe.dev->mt76.mutex);
}

static int status_show(struct seq_file *seq, void *data)
{
	(void)data;
	mutex_lock(&probe.dev->mt76.mutex);
	seq_printf(seq,
		   "active=%u samples=%u reports=%u invalid=%u raw0=%u raw1=%u noise=%d\n",
		   !probe.stopped, probe.samples, probe.reports, probe.invalid,
		   probe.last_raw[0], probe.last_raw[1], probe.channel->noise);
	mutex_unlock(&probe.dev->mt76.mutex);
	return 0;
}
DEFINE_SHOW_ATTRIBUTE(status);

static int __init probe_init(void)
{
	struct mt76_dev *mdev;
	struct dentry *status;
	int ret = -ENODEV;

	if (seconds < 5 || seconds > 60 ||
	    !of_machine_is_compatible("linksys,e7350"))
		return -EINVAL;
	probe.pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, 0x7915, NULL);
	if (!probe.pdev)
		return -ENODEV;
	device_lock(&probe.pdev->dev);
	if (!probe.pdev->dev.driver ||
	    strcmp(probe.pdev->dev.driver->name, "mt7915e"))
		goto unlock_device;
	probe.parent = probe.pdev->dev.driver->owner;
	if (!probe.parent || !try_module_get(probe.parent))
		goto unlock_device;
	mdev = pci_get_drvdata(probe.pdev);
	if (!mdev)
		goto put_parent;
	probe.dev = container_of(mdev, struct mt7915_dev, mt76);
	probe.phy = &probe.dev->phy;
	mutex_lock(&mdev->mutex);
	if (!is_mt7915(mdev) || !probe.dev->dbdc_support ||
	    probe.phy->mt76 != &mdev->phy ||
	    mdev->phy.band_idx || mdev->phy.chainmask != 3 ||
	    !test_bit(MT76_STATE_RUNNING, &mdev->phy.state) ||
	    test_bit(MT76_RESET, &mdev->phy.state) ||
	    !mdev->phy.chandef.chan ||
	    mdev->phy.chandef.chan->band != NL80211_BAND_2GHZ ||
	    mdev->phy.chandef.width != NL80211_CHAN_WIDTH_20 ||
	    mt76_rr(probe.dev, 0x70010200) != 0x7915 ||
	    mt76_rr(probe.dev, 0x70010204) != 0x8a10 ||
	    mt76_rr(probe.dev, 0x70010208) != 0x8a01 ||
	    mt76_rr(probe.dev, 0x70010210) != 0 ||
	    probe.phy->noise || mdev->phy.chan_state->noise)
		goto unlock_mdev;
	probe.channel = mdev->phy.chan_state;
	probe.frequency = mdev->phy.chandef.chan;
	probe.width = mdev->phy.chandef.width;
	probe.saved_phy_noise = probe.phy->noise;
	probe.saved_channel_noise = probe.channel->noise;
	probe.debugfs = debugfs_create_dir("mt7915_cca_probe", NULL);
	if (IS_ERR_OR_NULL(probe.debugfs)) {
		ret = probe.debugfs ? PTR_ERR(probe.debugfs) : -ENOMEM;
		goto unlock_mdev;
	}
	status = debugfs_create_file("status", 0400, probe.debugfs, NULL,
				     &status_fops);
	if (IS_ERR_OR_NULL(status)) {
		ret = status ? PTR_ERR(status) : -ENOMEM;
		debugfs_remove_recursive(probe.debugfs);
		goto unlock_mdev;
	}
	if (!reset_window()) {
		debugfs_remove_recursive(probe.debugfs);
		goto unlock_mdev;
	}
	INIT_DELAYED_WORK(&probe.work, sample_work);
	probe.deadline = jiffies + seconds * HZ;
	queue_delayed_work(system_wq, &probe.work, msecs_to_jiffies(100));
	mutex_unlock(&mdev->mutex);
	device_unlock(&probe.pdev->dev);
	return 0;

unlock_mdev:
	mutex_unlock(&mdev->mutex);
put_parent:
	module_put(probe.parent);
unlock_device:
	device_unlock(&probe.pdev->dev);
	pci_dev_put(probe.pdev);
	return ret;
}

static void __exit probe_exit(void)
{
	cancel_delayed_work_sync(&probe.work);
	mutex_lock(&probe.dev->mt76.mutex);
	stop_probe();
	mutex_unlock(&probe.dev->mt76.mutex);
	debugfs_remove_recursive(probe.debugfs);
	module_put(probe.parent);
	pci_dev_put(probe.pdev);
}

module_init(probe_init);
module_exit(probe_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Bounded E7350 2.4 GHz OEM CCA diagnostic without driver reload");

SHA-256 of the stripped companion module tested: eee2724e39d59472324071fd5412c4e19de9e89a34d3f4421086685329e5173e.