Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.
\n*The whole 2.4 GHz band at 320 Msps, live, with the decimation's roll-off\ncorrected in the stream ("flatten"): a 262,144-point FFT of every sample, 100\nspectra a second (this recording runs at 50 frames a second).*
\nThe MT7996 runs only our own firmware: a ROM patch, WM and WA built from this repository, with no MediaTek code. It brings the radio up from a cold power-on by itself, from MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware, and takes its commands (LO, sample rate, capture, stream, gain, filter) from the host. See docs/architecture.md and docs/roadmap.md.
\n| Sample rates | 40, 80, 160 or 320 Msps of 14-bit complex IQ on every band, independent of the LO and the filter; on band 2 also 640/2 (every other sample of 640 Msps: flat to ±155 MHz, but signals 160–320 MHz away fold in) | \n| Bands | 2.4 GHz (MT7976), 5 GHz and 6 GHz (two MT7977s); switching bands is a register write inside a running stream | \n| Tuning | No channels: the LO is any Hz a band's synthesizer locks at (unit A: 2.081–2.748, 4.647–7.509 and 4.707–7.576 GHz), on its grid of 2.98 Hz (2.4 GHz) or 11.9–14.3 Hz steps; retuned mid-stream (about 1 ms) | \n| Front end | AGC or manual LNA/baseband gain; analog filter 20–320 MHz | \n| Transport | the radio DMAs into a 1 GiB ring in SoC DRAM; the kernel sends every 8 KiB slice as one UDP datagram, zero-copy, on the 10 GbE port; at 320 Msps half the slices are packed to 28 bits per sample pair on the radio's own cores to fit the link (lossless, automatic) | \n| Host | w1700k-stream receives the export and serves the IQ stream to every consumer on the host (shared memory, complex int16, gap-tagged), with an optional correction ("flatten") of the decimation's roll-off applied to the samples themselves;w1700k-spectrum : 262,144-point FFT at 100 frames/s over every sample, browser UI, live controls;sdr-recv records the stream |
*2.4 GHz at 320 Msps, flattened: Wi-Fi frames and shorter hopping bursts on a\nfloor that stays level to the band's edges. The Stream panel shows the link\ncarrying 9.75 Gbit/s, half of the slices packed, and every sample transformed.*
\nTwo busy 80 MHz Wi-Fi channels at 5170–5330 MHz in a flattened 320 MHz view.
\n*Zoomed to 24 MHz around 5250 MHz: the two channels' edges and the guard gap\nbetween them, in 1.22 kHz bins.*
\n| Path | |
|---|---|
platform/ | What runs on the SoC: our U-Boot, Linux 6.18 with board patches, a read-only BusyBox root |
kernel/w1700k_sdr/ | The MT7996 driver (firmware download, the DMA ring, the 10 GbE export, the firmware's command mailbox) and its unit-side clients |
firmware/ | Our MT7996 firmware: the ROM patch, the WM (radio bring-up and band set-up, streams, RF control) and the WA (packer) |
host/w1700k/ | Host control: firmware load, streaming, RF control as firmware commands; w1700k serve for the web UI |
host/stream/ | w1700k-stream , the host's one receiver of the export: the IQ stream in shared memory for every consumer, and the roll-off correction |
host/spectrum/ | The spectrum/waterfall web server |
host/recv/ | sdr-recv , the stream recorder |
init/ | Installation from stock, updates, recovery, return to stock |
include/hw/ | Register reference: every known MT7996, A-die and AN7581 register, as C headers |
docs/ | Architecture, roadmap |
You need a W1700K (HW 1.x) or W1700K2 (HW 2.1), a 3.3 V USB serial adapter on\nits console header, an Ethernet cable to its lan3 port for installation, and\na 10 GbE NIC on the host cabled to its wan port (10GBASE-T; an X710 with a\ncopper SFP+ module works) for the IQ stream. Both revisions run the same images.\nMost units carry a W25N04KV NAND; some W1700K2s carry a W25N04LV (ID ef 8b 23),\nwhich is supported but has never been run on a unit: init/install stops on\none until you pass --i-dont-care-about-nand-corruption, and asks for a raw\ndump of it (init/rawdump) for the maintainers.
make # everything, from public sources (~10 min plus downloads)\nmake check # the test suite\nsudo init/host/link up IFACE # 192.168.1.10/24 on the NIC cabled to lan3\nsudo init/host/tftp-forward enable IFACE\ninit/install # back up the NAND, install, save the radio calibration\nsudo init/host/link up IFACE10G 10.77.0.10/24 9216 # the 10 GbE stream link\nhost/stream/build/w1700k-stream & # the stream, for every consumer on this host\nhost/spectrum/build/w1700k-spectrum --controller "host/bin/w1700k serve" --listen 0.0.0.0:8073Then open http://HOST:8073/ and press ▶. The first start loads the radio\nfirmware and brings the radio up (about 2 s). Without the browser, the same\noperations are host/bin/w1700k load|start|band|tune|gain|filter|stop|status.
Build requirements: a C/C++ compiler, make, git, Python 3.10+, the usual\nBuildroot prerequisites, clang, ld.lld, llvm-objcopy and llvm-readobj (RISC-V\nfirmware), openssl (firmware container encryption), and\nlibfftw3-dev and zlib for the stream service and the spectrum server. No vendor firmware is\ndownloaded or needed.
Our firmware is receive-only. It runs none of MediaTek's transmit
calibrations and keeps the MAC's transmit path disabled; a gapless watch at\n5250 MHz saw nothing during a load, where MediaTek's firmware transmits a\nfull-power burst. Still, do not cable an antenna port straight into a\nsensitive instrument without an attenuator.
Our ROM patch writes no eFuse. MediaTek's ROM patches since 2025
permanently program one eFuse gate bit on their first run (also with\nMediaTek's own driver); a unit that ever ran one has that bit set.
Installation replaces the stock operating system.init/install first
copies the NAND's data to the host; keep that copy.init/restore writes it\nback and returns the unit to its stock firmware.
Accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge
the radio until a power cycle. include/hw/ marks every known hazard.
MIT, except the Linux driver and kernel patches (GPL-2.0-only), U-Boot patches (GPL-2.0+), the driver's user-space header (GPL-2.0 WITH Linux-syscall-note) and files derived from MediaTek's mt76 driver (BSD-3-Clause-Clear). See LICENSE.
","headings":[]}}