w1700k-sdr README

The project's README from github.com/h0m3us3r/w1700k-sdr. As one markdown file: README.md.

W1700K SDR

Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.

The 2.4 GHz band live: spectrum and waterfall

The whole 2.4 GHz band at 320 Msps, live, with the decimation's roll-off corrected in the stream ("flatten"): a 262,144-point FFT of every sample, 100 spectra a second (this recording runs at 50 frames a second).

The MT7996 runs only our own firmware: a ROM patch, WM and WA built from this repository, with no MediaTek code. It brings the radio up from a cold power-on by itself, from MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware, and takes its commands (LO, sample rate, capture, stream, gain, filter) from the host. See docs/architecture.md and docs/roadmap.md.

What it does
Sample rates 40, 80, 160 or 320 Msps of 14-bit complex IQ on every band, independent of the LO and the filter; on band 2 also 640/2 (every other sample of 640 Msps: flat to ±155 MHz, but signals 160–320 MHz away fold in)
Bands 2.4 GHz (MT7976), 5 GHz and 6 GHz (two MT7977s); switching bands is a register write inside a running stream
Tuning No channels: the LO is any Hz a band's synthesizer locks at (unit A: 2.081–2.748, 4.647–7.509 and 4.707–7.576 GHz), on its grid of 2.98 Hz (2.4 GHz) or 11.9–14.3 Hz steps; retuned mid-stream (about 1 ms)
Front end AGC or manual LNA/baseband gain; analog filter 20–320 MHz
Transport the radio DMAs into a 1 GiB ring in SoC DRAM; the kernel sends every 8 KiB slice as one UDP datagram, zero-copy, on the 10 GbE port; at 320 Msps half the slices are packed to 28 bits per sample pair on the radio's own cores to fit the link (lossless, automatic)
Host w1700k-stream receives the export and serves the IQ stream to every consumer on the host (shared memory, complex int16, gap-tagged), with an optional correction ("flatten") of the decimation's roll-off applied to the samples themselves; w1700k-spectrum: 262,144-point FFT at 100 frames/s over every sample, browser UI, live controls; sdr-recv records the stream

Screenshots

The web UI at 2.4 GHz

2.4 GHz at 320 Msps, flattened: Wi-Fi frames and shorter hopping bursts on a floor that stays level to the band's edges. The Stream panel shows the link carrying 9.75 Gbit/s, half of the slices packed, and every sample transformed.

The web UI at 5 GHz

Two busy 80 MHz Wi-Fi channels at 5170–5330 MHz in a flattened 320 MHz view.

The two channels' edges zoomed to 24 MHz

Zoomed to 24 MHz around 5250 MHz: the two channels' edges and the guard gap between them, in 1.22 kHz bins.

Repository

Path
platform/ What runs on the SoC: our U-Boot, Linux 6.18 with board patches, a read-only BusyBox root
kernel/w1700k_sdr/ The MT7996 driver (firmware download, the DMA ring, the 10 GbE export, the firmware's command mailbox) and its unit-side clients
firmware/ Our MT7996 firmware: the ROM patch, the WM (radio bring-up and band set-up, streams, RF control) and the WA (packer)
host/w1700k/ Host control: firmware load, streaming, RF control as firmware commands; w1700k serve for the web UI
host/stream/ w1700k-stream, the host's one receiver of the export: the IQ stream in shared memory for every consumer, and the roll-off correction
host/spectrum/ The spectrum/waterfall web server
host/recv/ sdr-recv, the stream recorder
init/ Installation from stock, updates, recovery, return to stock
include/hw/ Register reference: every known MT7996, A-die and AN7581 register, as C headers
docs/ Architecture, roadmap

Getting started

You need a W1700K (HW 1.x) or W1700K2 (HW 2.1), a 3.3 V USB serial adapter on its console header, an Ethernet cable to its lan3 port for installation, and a 10 GbE NIC on the host cabled to its wan port (10GBASE-T; an X710 with a copper SFP+ module works) for the IQ stream. Both revisions run the same images. Most units carry a W25N04KV NAND; some W1700K2s carry a W25N04LV (ID ef 8b 23), which is supported but has never been run on a unit: init/install stops on one until you pass --i-dont-care-about-nand-corruption, and asks for a raw dump of it (init/rawdump) for the maintainers.

make                                   # everything, from public sources (~10 min plus downloads)
make check                             # the test suite

sudo init/host/link up IFACE           # 192.168.1.10/24 on the NIC cabled to lan3
sudo init/host/tftp-forward enable IFACE
init/install                           # back up the NAND, install, save the radio calibration

sudo init/host/link up IFACE10G 10.77.0.10/24 9216    # the 10 GbE stream link
host/stream/build/w1700k-stream &                      # the stream, for every consumer on this host
host/spectrum/build/w1700k-spectrum --controller "host/bin/w1700k serve" --listen 0.0.0.0:8073

Then open http://HOST:8073/ and press ▶. The first start loads the radio firmware and brings the radio up (about 2 s). Without the browser, the same operations are host/bin/w1700k load|start|band|tune|gain|filter|stop|status.

Build requirements: a C/C++ compiler, make, git, Python 3.10+, the usual Buildroot prerequisites, clang, ld.lld, llvm-objcopy and llvm-readobj (RISC-V firmware), openssl (firmware container encryption), and libfftw3-dev and zlib for the stream service and the spectrum server. No vendor firmware is downloaded or needed.

Read before use

Licence

MIT, except the Linux driver and kernel patches (GPL-2.0-only), U-Boot patches (GPL-2.0+), the driver's user-space header (GPL-2.0 WITH Linux-syscall-note) and files derived from MediaTek's mt76 driver (BSD-3-Clause-Clear). See LICENSE.

w1700k-sdr (h0m3us3r/w1700k-sdr)

Searching Database…

814 ·GitHub
W1700k-sdr
What is this?W1700K SDR turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver: the router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser.
Do I install something on my computer, or is this firmware flashed onto the router?Both: custom firmware (a ROM patch plus the WM and WA programs, with no MediaTek code) replaces the router's stock radio/SoC firmware, and separate host software (w1700k-stream, w1700k-spectrum, sdr-recv) runs on a Linux PC to receive the IQ stream and show the browser UI.
How do I get it running?Wire a 3.3V USB serial adapter to the W1700K's console header, an Ethernet cable to its lan3 port for installation, and a 10 GbE NIC on the host to its wan port, then flash with init/install; afterward you just open the web UI and press play to load and start the radio firmware.
What do I need on the build machine besides the router hardware?Building needs a C/C++ compiler, make, git, Python 3.10+, the usual Buildroot prerequisites, clang, ld.lld, llvm-objcopy and llvm-readobj for the RISC-V firmware, openssl for the firmware container, and libfftw3-dev plus zlib for the stream and spectrum servers.
Is it safe to flash, and can I undo it?The custom firmware is receive-only (the transmit path stays disabled) and never writes MediaTek's permanent eFuse bit, but installing it replaces the router's stock OS entirely; init/install first backs up the NAND so init/restore can return the unit to stock, and poking undocumented registers can hang the SoC until a power cycle.
Why doesn't it just use MediaTek's vendor firmware?Everything that runs on the radio is written from scratch for this project (the ROM patch, WM and WA), with no MediaTek code included. The radio's cold-boot bring-up and calibration were decoded register by register from a trace of MediaTek's own firmware, so no vendor blobs are downloaded or needed at runtime.
What sample rates and bands can it capture?It captures 14-bit complex IQ at 40, 80, 160 or 320 Msps across the 2.4, 5 and 6 GHz bands using the MT7976/MT7977 radios, plus an extra 640/2 Msps mode on band 2. The LO can tune to any frequency the band's synthesizer locks on, and it can be retuned mid-stream in about 1 ms.
Can I go back to stock firmware if something breaks?Yes - init/install backs up the NAND's original data to the host before flashing, and init/restore writes that backup back to return the unit to its stock MediaTek firmware.
How fast is the live spectrum display?w1700k-spectrum runs a 262,144-point FFT over every sample at 100 spectra per second, with the decimation's roll-off corrected ('flattened') in the stream, rendered live in the browser next to the receiver controls.
What are similar projects?esp-sdr, ESP32-Bit-Pirate, mu300-linux, BLEhound, immortalwrt, unleashed-firmware, wifit3, xcertplay
Which topics is it in?sdr, wireless, radio, udp, wifi, usb, driver, router, embedded-systems, firmware, gplv2, embedded
Creator
h0m3us3r
Size
20.8 MB
Stars
814
Updated
CommitOct 13
Age
5d
Commits · 90 Days