将WiFi 7路由器改造为320Msps软件无线电接收器
Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver
硬核工程实践，详细拆解了如何逆向定制 WiFi 7 芯片固件以实现 SDR 功能，包含完整的编译部署步骤与硬件连接细节，适合嵌入式与射频爱好者收藏参考。
W1700K SDR
Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.
将 Gemtek W1700K Wi-Fi 7 路由器转变为宽带软件定义接收器。路由器的 MediaTek MT7996 射频芯片以最高 320 Msps 的速率捕获原始 14 位 IQ 数据，其 Airoha AN7581 SoC 通过 10 GbE 端口将其传输，Linux 主机在浏览器中以实时频谱和瀑布图的形式显示该数据，并配有接收器控制面板。
The whole 2.4 GHz band at 320 Msps, live, with the decimation's roll-off corrected in the stream ("flatten"): a 262,144-point FFT of every sample, 100 spectra a second (this recording runs at 50 frames a second).
整个 2.4 GHz 频段以 320 Msps 速率实时运行，流中的抽取滚降已进行校正（“平坦化”）：对每个样本进行 262,144 点 FFT，每秒生成 100 个频谱（此录制以每秒 50 帧运行）。
The MT7996 runs only our own firmware: a ROM patch, WM and WA built from this repository, with no MediaTek code. It brings the radio up from a cold power-on by itself, from MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware, and takes its commands (LO, sample rate, capture, stream, gain, filter) from the host. See docs/architecture.md and docs/roadmap.md.
MT7996 仅运行我们自己的固件：包括 ROM 补丁、从本仓库构建的 WM 和 WA，不含任何 MediaTek 代码。它通过对照 MediaTek 自身固件跟踪逐寄存器解码初始化和校准过程，使射频从冷启动自行上线，并从主机获取控制指令（本地振荡器 LO、采样率、捕获、传输、增益、滤波器）。详见 docs/architecture.md 和 docs/roadmap.md。
What it does
功能说明
| Sample rates | 40, 80, 160 or 320 Msps of 14-bit complex IQ on every band, independent of the LO and the filter; on band 2 also 640/2 (every other sample of 640 Msps: flat to ±155 MHz, but signals 160–320 MHz away fold in) |
|---|---|
| Bands | 2.4 GHz (MT7976), 5 GHz and 6 GHz (two MT7977s); switching bands is a register write inside a running stream |
| Tuning | No channels: the LO is any Hz a band's synthesizer locks at (unit A: 2.081–2.748, 4.647–7.509 and 4.707–7.576 GHz), on its grid of 2.98 Hz (2.4 GHz) or 11.9–14.3 Hz steps; retuned mid-stream (about 1 ms) |
| Front end | AGC or manual LNA/baseband gain; analog filter 20–320 MHz |
| Transport | the radio DMAs into a 1 GiB ring in SoC DRAM; the kernel sends every 8 KiB slice as one UDP datagram, zero-copy, on the 10 GbE port; at 320 Msps half the slices are packed to 28 bits per sample pair on the radio's own cores to fit the link (lossless, automatic) |
| Host | w1700k-stream receives the export and serves the IQ stream to every consumer on the host (shared memory, complex int16, gap-tagged), with an optional correction ("flatten") of the decimation's roll-off applied to the samples themselves; w1700k-spectrum: 262,144-point FFT at 100 frames/s over every sample, browser UI, live controls; sdr-recv records the stream |
| 采样率 | 每个频段支持 40、80、160 或 320 Msps 的 14 位复数 IQ 数据，与本地振荡器 (LO) 和滤波器无关；在频段 2 上还支持 640/2（即每两个 640 Msps 样本取一个：平坦范围至 ±155 MHz，但距离 160–320 MHz 的信号会发生折叠） |
|---|---|
| 频段 | 2.4 GHz（MT7976）、5 GHz 和 6 GHz（两个 MT7977）；切换频段是在运行中的流内写入寄存器 |
| 调谐 | 无信道概念：LO 为频段合成器锁定的任意赫兹值（单元 A：2.081–2.748、4.647–7.509 和 4.707–7.576 GHz），步长为 2.98 Hz（2.4 GHz）或 11.9–14.3 Hz；可在流传输过程中重新调谐（约 1 ms） |
| 前端 | AGC 或手动 LNA/基带增益；模拟滤波器 20–320 MHz |
| 传输 | 射频 DMA 将数据写入 SoC DRAM 中的 1 GiB 环形缓冲区；内核以零拷贝方式通过 10 GbE 端口将每个 8 KiB 切片作为单个 UDP 数据报发送；在 320 Msps 下，一半切片由射频自身的核心打包为每样本对 28 位，以适应链路带宽（无损，自动） |
| 主机 | w1700k-stream 接收导出数据并向主机上的每个消费者提供 IQ 流（共享内存，复数 int16，带间隙标签），可选地对样本本身应用抽取滚降校正（“平坦化”）；w1700k-spectrum：对每个样本执行 262,144 点 FFT，100 帧/秒，提供浏览器 UI 和实时控制；sdr-recv 用于记录流 |
Screenshots
截图
2.4 GHz at 320 Msps, flattened: Wi-Fi frames and shorter hopping bursts on a floor that stays level to the band's edges. The Stream panel shows the link carrying 9.75 Gbit/s, half of the slices packed, and every sample transformed.
2.4 GHz 频段以 320 Msps 速率运行，已平坦化：Wi-Fi 帧和较短的跳频突发信号出现在保持平坦至频段边缘的底噪上。Stream 面板显示链路承载速率为 9.75 Gbit/s，一半切片已打包，且每个样本均已转换。
Two busy 80 MHz Wi-Fi channels at 5170–5330 MHz in a flattened 320 MHz view.
在展平的 320 MHz 视图中，5170–5330 MHz 频段内两个繁忙的 80 MHz Wi-Fi 信道。
Zoomed to 24 MHz around 5250 MHz: the two channels' edges and the guard gap between them, in 1.22 kHz bins.
以 5250 MHz 为中心放大至 24 MHz：显示两个信道的边缘及其之间的保护间隔，以 1.22 kHz 为粒度（bin）。
Repository
代码仓库
| Path | |
|---|---|
| platform/ | What runs on the SoC: our U-Boot, Linux 6.18 with board patches, a read-only BusyBox root |
| kernel/w1700k_sdr/ | The MT7996 driver (firmware download, the DMA ring, the 10 GbE export, the firmware's command mailbox) and its unit-side clients |
| firmware/ | Our MT7996 firmware: the ROM patch, the WM (radio bring-up and band set-up, streams, RF control) and the WA (packer) |
| host/w1700k/ | Host control: firmware load, streaming, RF control as firmware commands; w1700k serve for the web UI |
| host/stream/ | w1700k-stream, the host's one receiver of the export: the IQ stream in shared memory for every consumer, and the roll-off correction |
| host/spectrum/ | The spectrum/waterfall web server |
| host/recv/ | sdr-recv, the stream recorder |
| init/ | Installation from stock, updates, recovery |
| include/hw/ | Register reference: every known MT7996, A-die and AN7581 register, as C headers |
| docs/ | Architecture, roadmap |
| 路径 | |
|---|---|
| platform/ | SoC 上运行的内容：我们的 U-Boot、带有板级补丁的 Linux 6.18、只读的 BusyBox rootfs |
| kernel/w1700k_sdr/ | MT7996 驱动程序（固件下载、DMA 环、10 GbE 导出、固件的命令邮箱）及其单元侧客户端 |
| firmware/ | 我们的 MT7996 固件：ROM 补丁、WM（射频启动与频段设置、流、RF 控制）和 WA（打包器） |
| host/w1700k/ | 主机控制：固件加载、流传输、作为固件命令的 RF 控制；w1700k serve 用于 Web UI |
| host/stream/ | w1700k-stream，主机端的导出接收器：为每个消费者提供共享内存中的 IQ 流，以及滚降校正 |
| host/spectrum/ | 频谱/瀑布图 Web 服务器 |
| host/recv/ | sdr-recv，流记录器 |
| init/ | 从出厂状态安装、更新、恢复 |
| include/hw/ | 寄存器参考：所有已知的 MT7996 A-die 和 AN7581 寄存器，以 C 头文件形式提供 |
| docs/ | 架构、路线图 |
Getting started
入门指南
You need a W1700K, a 3.3 V USB serial adapter on its console header, an Ethernet cable to its lan3 port for installation, and a 10 GbE NIC on the host cabled to its wan port (10GBASE-T; an X710 with a copper SFP+ module works) for the IQ stream.
你需要一个 W1700K 设备，其控制台接头上连接一个 3.3 V USB 串口适配器，一根以太网线连接到其 lan3 端口用于安装，以及主机上连接至其 wan 端口的 10 GbE 网卡（10GBASE-T；配备铜质 SFP+ 模块的 X710 网卡可用），用于 IQ 流传输。
make # everything, from public sources (~10 min plus downloads)
make check # the test suite
sudo init/host/link up IFACE # 192.168.1.10/24 on the NIC cabled to lan3
sudo init/host/tftp-forward enable IFACE
init/install # back up the NAND, install, save the radio calibration
sudo init/host/link up IFACE10G 10.77.0.10/24 9216 # the 10 GbE stream link
host/stream/build/w1700k-stream & # the stream, for every consumer on this host
host/spectrum/build/w1700k-spectrum --controller "host/bin/w1700k serve" --listen 0.0.0.0:8073Then open http://HOST:8073/ and press ▶. The first start loads the radio firmware and brings the radio up (about 2 s). Without the browser, the same operations are host/bin/w1700k load|start|band|tune|gain|filter|stop|status.
然后打开 http://HOST:8073/ 并按 ▶。首次启动会加载射频固件并启动射频（约 2 秒）。若无浏览器，相同的操作可通过 host/bin/w1700k load|start|band|tune|gain|filter|stop|status 执行。
Build requirements: a C/C++ compiler, make, git, Python 3.10+, the usual Buildroot prerequisites, clang, ld.lld, llvm-objcopy and llvm-readobj (RISC-V firmware), openssl (firmware container encryption), and libfftw3-dev and zlib for the stream service and the spectrum server. No vendor firmware is downloaded or needed.
构建要求：C/C++ 编译器、make、git、Python 3.10+、通常的 Buildroot 前置依赖项、clang、ld.lld、llvm-objcopy 和 llvm-readobj（RISC-V 固件）、openssl（固件容器加密），以及 libfftw3-dev 和 zlib（用于流服务和频谱服务器）。无需下载或使用厂商固件。
Read before use
使用前必读
- Our firmware is receive-only. It runs none of MediaTek's transmit calibrations and keeps the MAC's transmit path disabled; a gapless watch at 5250 MHz saw nothing during a load, where MediaTek's firmware transmits a full-power burst. Still, do not cable an antenna port straight into a sensitive instrument without an attenuator.
- Our ROM patch writes no eFuse. MediaTek's ROM patches since 2025 permanently program one eFuse gate bit on their first run (also with MediaTek's own driver); a unit that ever ran one has that bit set.
- Installation replaces the stock operating system. init/install first copies the whole NAND to the host; keep that copy. Restoring stock needs a raw NAND writer, which this repository does not provide.
- Accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge the radio until a power cycle. include/hw/ marks every known hazard.
- 我们的固件仅支持接收。它不运行联发科的任何发射校准程序，并保持 MAC 发射路径禁用；在 5250 MHz 处进行无间隙监听时，加载过程中未检测到任何信号，而联发科的固件在此时会发射全功率突发信号。尽管如此，请勿在未使用衰减器的情况下将天线端口直接连接至敏感仪器。
- 我们的 ROM 补丁不会写入 eFuse。自 2025 年起，联发科的 ROM 补丁在其首次运行时永久编程一个 eFuse 门控位（也适用于联发科自己的驱动程序）；曾经运行过该补丁的设备该位将被置位。
- 安装会替换原厂操作系统。init/install 首先会将整个 NAND 闪存复制到主机；请保留该副本。恢复原厂系统需要原始 NAND 写入工具，本仓库未提供此类工具。
- 访问未公开的 MT7996 或 AN7581 地址可能导致 SoC 挂起或射频模块锁定，直至重新上电。include/hw/ 目录标记了所有已知风险点。
Licence
许可证
MIT, except the Linux driver and kernel patches (GPL-2.0-only), U-Boot patches (GPL-2.0+), the driver's user-space header (GPL-2.0 WITH Linux-syscall-note) and files derived from MediaTek's mt76 driver (BSD-3-Clause-Clear). See LICENSE.
MIT 许可证，但 Linux 驱动程序和内核补丁（GPL-2.0-only）、U-Boot 补丁（GPL-2.0+）、驱动程序的用户空间头文件（GPL-2.0 WITH Linux-syscall-note）以及源自联发科 mt76 驱动的文件（BSD-3-Clause-Clear）除外。详见 LICENSE。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力