Transforming a WiFi 7 Router into a 320Msps SDR Receiver

This project converts a Gemtek W1700K Wi-Fi 7 router into a high-bandwidth, software-defined radio (SDR) receiver capable of capturing wideband signals.

The system utilizes the MediaTek MT7996 radio to grab raw 14-bit IQ data at rates reaching $320 \text{ Msps}$. This data is then shuttled via the Airoha AN7581 SoC across a 10 GbE connection to a Linux host, which renders a live spectrum and waterfall display in a web browser.

🛠 System Architecture

The data flow from the antenna to the user's screen is visualized below:

📡 Technical Specifications

The receiver operates across multiple bands with highly flexible tuning. It uses MediaTek's original firmware completely replaces the factory code with a custom ROM patch and proprietary WM/WA builds.

Radio Capabilities

Tuning Ranges (Unit A):

• $2.081\text{--}2.748 \text{ GHz}$
• $4.647\text{--}7.509 \text{ GHz}$
• $4.707\text{--}7.576 \text{ GHz}$

💾 Data Transport & Processing

The pipeline is designed for maximum throughput and minimum latency:

1. On-Device: The radio DMAs data into a $1 \text{ GiB}$ ring buffer in the SoC's DRAM.
2. Transmission: The kernel transmits $8 \text{ KiB}$ slices as zero-copy UDP datagrams via 10 GbE.
   • Note: At $320 \text{ Msps}$, the SoC cores automatically pack half the slices to 28 bits per sample pair to ensure the link can handle the load.
3. Host Side: w1700k-stream manages the incoming export, placing it in shared memory as complex int16 with gap-tagging.
4. Correction: An optional "flatten" process is applied to correct the decimation roll-off.

📂 Repository Structure

The project is organized as follows:

• platform/: SoC environment (U-Boot, Linux 6.18, BusyBox).
• kernel/w1700k_sdr/: The MT7996 driver, DMA ring management, and 10 GbE export logic.
• firmware/: Custom MT7996 firmware (ROM patch, WM for RF control, WA for packing).
• host/:
  • w1700k/: General control, firmware loading, and web UI server.
  • stream/: w1700k-stream for shared memory and roll-off correction.
  • spectrum/: The web-based spectrum/waterfall server.
  • recv/: sdr-recv for recording streams.
• init/: Installation, backup, and recovery scripts.
• include/hw/: C headers containing the register map for MT7996 and AN7581.
• docs/: Roadmap and architectural details.

🚀 Getting Started

Hardware Requirements

• Gemtek W1700K Router.
• 3.3 V USB-to-Serial adapter (for console).
• Ethernet cable (Host $\rightarrow$ lan3 for setup).
• 10 GbE NIC (Host $\rightarrow$ wan for IQ stream; e.g., Intel X710 with copper SFP+).

Installation Sequence

# 1. Build the project
make 

# 2. Run tests
make check 

# 3. Set up the installation link (lan3)
sudo init/host/link up IFACE # Example: 192.168.1.10/24

# 4. Enable TFTP and install to NAND
sudo init/host/tftp-forward enable IFACE
init/install 

# 5. Set up the 10 GbE stream link (wan)
sudo init/host/link up IFACE10G 10.77.0.10/24 9216 

# 6. Launch the stream and spectrum server
host/stream/build/w1700k-stream
host/spectrum/build/w1700k-spectrum --controller " host/bin/w1700k serve " --listen 0.0.0.0:8073

Once running, navigate to http://HOST:8073/ and click the Play button.

Manual Control

If you prefer the CLI over the browser, use: host/bin/w1700k load|start|band|tune|gain|filter|stop|status

🛠 Build Dependencies

To compile this project, you will need:

• Compilers: C/C++ compiler, make, git, Python 3.10+.
• Toolchains: clang, ld.lld, llvm-objcopy, llvm-readobj (for RISC-V firmware).
• Libraries: openssl (encryption), libfftw3-dev, zlib, and standard Buildroot prerequisites.

---

Final Note: This implementation disables the MAC's transmit path and skips MediaTek's transmit calibrations to ensure a clean, receive-only environment.