Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.
*The whole 2.4 GHz band at 320 Msps, live, with the decimation's roll-off
corrected in the stream ("flatten"): a 262,144-point FFT of every sample, 100
spectra a second (this recording runs at 50 frames a second).*
The MT7996 runs only our own firmware: a ROM patch, WM and WA built from this repository, with no MediaTek code. It brings the radio up from a cold power-on by itself, from MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware, and takes its commands (LO, sample rate, capture, stream, gain, filter) from the host. See docs/architecture.md and docs/roadmap.md.
| Sample rates | 40, 80, 160 or 320 Msps of 14-bit complex IQ on every band, independent of the LO and the filter; on band 2 also 640/2 (every other sample of 640 Msps: flat to ±155 MHz, but signals 160–320 MHz away fold in) |
| Bands | 2.4 GHz (MT7976), 5 GHz and 6 GHz (two MT7977s); switching bands is a register write inside a running stream |
| Tuning | No channels: the LO is any Hz a band's synthesizer locks at (unit A: 2.081–2.748, 4.647–7.509 and 4.707–7.576 GHz), on its grid of 2.98 Hz (2.4 GHz) or 11.9–14.3 Hz steps; retuned mid-stream (about 1 ms) |
| Front end | AGC or manual LNA/baseband gain; analog filter 20–320 MHz |
| Transport | the radio DMAs into a 1 GiB ring in SoC DRAM; the kernel sends every 8 KiB slice as one UDP datagram, zero-copy, on the 10 GbE port; at 320 Msps half the slices are packed to 28 bits per sample pair on the radio's own cores to fit the link (lossless, automatic) |
| Host | w1700k-stream receives the export and serves the IQ stream to every consumer on the host (shared memory, complex int16, gap-tagged), with an optional correction ("flatten") of the decimation's roll-off applied to the samples themselves;w1700k-spectrum : 262,144-point FFT at 100 frames/s over every sample, browser UI, live controls;sdr-recv records the stream |
*2.4 GHz at 320 Msps, flattened: Wi-Fi frames and shorter hopping bursts on a
floor that stays level to the band's edges. The Stream panel shows the link
carrying 9.75 Gbit/s, half of the slices packed, and every sample transformed.*
Two busy 80 MHz Wi-Fi channels at 5170–5330 MHz in a flattened 320 MHz view.
*Zoomed to 24 MHz around 5250 MHz: the two channels' edges and the guard gap
between them, in 1.22 kHz bins.*
| Path | |
|---|
platform/ | What runs on the SoC: our U-Boot, Linux 6.18 with board patches, a read-only BusyBox root |
kernel/w1700k_sdr/ | The MT7996 driver (firmware download, the DMA ring, the 10 GbE export, the firmware's command mailbox) and its unit-side clients |
firmware/ | Our MT7996 firmware: the ROM patch, the WM (radio bring-up and band set-up, streams, RF control) and the WA (packer) |
host/w1700k/ | Host control: firmware load, streaming, RF control as firmware commands; w1700k serve for the web UI |
host/stream/ | w1700k-stream , the host's one receiver of the export: the IQ stream in shared memory for every consumer, and the roll-off correction |
host/spectrum/ | The spectrum/waterfall web server |
host/recv/ | sdr-recv , the stream recorder |
init/ | Installation from stock, updates, recovery, return to stock |
include/hw/ | Register reference: every known MT7996, A-die and AN7581 register, as C headers |
docs/ | Architecture, roadmap |
You need a W1700K (HW 1.x) or W1700K2 (HW 2.1), a 3.3 V USB serial adapter on
its console header, an Ethernet cable to its lan3 port for installation, and
a 10 GbE NIC on the host cabled to its wan port (10GBASE-T; an X710 with a
copper SFP+ module works) for the IQ stream. Both revisions run the same images.
Most units carry a W25N04KV NAND; some W1700K2s carry a W25N04LV (ID ef 8b 23),
which is supported but has never been run on a unit: init/install stops on
one until you pass --i-dont-care-about-nand-corruption, and asks for a raw
dump of it (init/rawdump) for the maintainers.
make # everything, from public sources (~10 min plus downloads)
make check # the test suite
sudo init/host/link up IFACE # 192.168.1.10/24 on the NIC cabled to lan3
sudo init/host/tftp-forward enable IFACE
init/install # back up the NAND, install, save the radio calibration
sudo init/host/link up IFACE10G 10.77.0.10/24 9216 # the 10 GbE stream link
host/stream/build/w1700k-stream & # the stream, for every consumer on this host
host/spectrum/build/w1700k-spectrum --controller "host/bin/w1700k serve" --listen 0.0.0.0:8073
Then open http://HOST:8073/ and press ▶. The first start loads the radio
firmware and brings the radio up (about 2 s). Without the browser, the same
operations are host/bin/w1700k load|start|band|tune|gain|filter|stop|status.
Build requirements: a C/C++ compiler, make, git, Python 3.10+, the usual
Buildroot prerequisites, clang, ld.lld, llvm-objcopy and llvm-readobj (RISC-V
firmware), openssl (firmware container encryption), and
libfftw3-dev and zlib for the stream service and the spectrum server. No vendor firmware is
downloaded or needed.
Our firmware is receive-only. It runs none of MediaTek's transmit
calibrations and keeps the MAC's transmit path disabled; a gapless watch at
5250 MHz saw nothing during a load, where MediaTek's firmware transmits a
full-power burst. Still, do not cable an antenna port straight into a
sensitive instrument without an attenuator.
Our ROM patch writes no eFuse. MediaTek's ROM patches since 2025
permanently program one eFuse gate bit on their first run (also with
MediaTek's own driver); a unit that ever ran one has that bit set.
Installation replaces the stock operating system.init/install first
copies the NAND's data to the host; keep that copy.init/restore writes it
back and returns the unit to its stock firmware.
Accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge
the radio until a power cycle. include/hw/ marks every known hazard.
MIT, except the Linux driver and kernel patches (GPL-2.0-only), U-Boot patches (GPL-2.0+), the driver's user-space header (GPL-2.0 WITH Linux-syscall-note) and files derived from MediaTek's mt76 driver (BSD-3-Clause-Clear). See LICENSE.