Using the Zyxel WSM20 Wi-Fi HF-Frontend as a SDR
Inspired by the esp-sdr project I started poking around in the Wi-Fi firmware of my Zyxel WSM20.
They are quite capable little routers:
- MediaTek MT7621AT: dual-core, 880 MHz
- 128 MB NAND flash
- 256 MB RAM
- MT7915 Wi-Fi modem for 802.11ax
- The internal antennas can easily be replaced as they are connected via U.FL connectors
- Fully OpenWrt-compatible
- Quite cheap at around €20
The MT7915 has the advantage that the firmware file is not encrypted and uses a CPU architecture (NDS32) that is well integrated into common disassemblers such as Ghidra. There’s also a project somewhere on GitHub which allows you to repack the firmware blob after making modifications.
It’s connected to the CPU via PCIe Gen1 x1 providing plenty of performance for streaming.
Every manufacturer has a documented test mode for manufacturing purposes: sending a CW tone, etc. Often, this also includes a capture mode where we can access the I/Q (12-bit) frames of the frontend stage directly.
My chain for now looks like this: Modem ADC -> Modem SRAM -> Modem Event Buffer -> DMA Ring -> Router RAM -> UDP -> PC -> SDR++
Sadly, it’s not very performant yet (I’m only getting 42 Mbit/s) as there seems to be some modem-side limitation of the read-out speed. Even forcing it to use DMA doesn’t improve the situation.