Perhaps the most famous of all the software-defined radio (SDR) receivers is the RTL-SDR, a digital TV receiver on which an undocumented feature was found. Perhaps other radio-enabled chips also have the same undocumented feature? It seems in the case of some members of the ESP32 family, they do. It’s a discovery made independently in two places, by Espargos, and a Reddit user by the name of h0m3us3r.
What’s happening is that the undocumented mode taps the I/Q stream off before the WiFi modem, and this can be read and processed by SDR software on an external computer. The undocumented mode can be found on ESP32 chips with the earlier Tensilica hardware onwards, so the low power Bluetooth only chips or the non-radio-equipped P4 won’t work. Sadly it’s also only possible with the receive side, with both 2.4 and 5 GHz bands being supported depending on the microcontroller in question.
This isn’t quite the general purpose SDR we got with the RTL-SDR, but there are still plenty of uses to which it can be put. We’re curious as to whether someone can implement the software side of an SDR on the same chip, but we are guessing that might be beyond their capabilities. Either way, we’re looking forward to what the community does with this new-found knowledge.
probably just mix the desired signal with a local oscillator and job done? i find it slightly funny to imagine up-converting say hf to an intermediate frequency of 5ghz.
This!!! That would be awesome
Transmit does seem to be possible, according to the Espargos page, just still undocumented.
He does not want to share it because of ‘rule3’.
I guess there another undocumented register to find!
Challenge accepted!
I documented TX in one of the issues on https://github.com/h0m3us3r/eSpDR/issues/3
Don’t have time to properly implement it, but a quick test on actual hw passed.
Hey mate, thanks a lot for the hard work, we really appreciate it!
So not Rule 3, Issue 3.
Great work and thanks for sharing! This is the kind of stuff that makes hardware so much fun.
Documentation is probably available for NDA customers. Maybe someone could start a company manufacturing IoT trinkets, grab the docs from Espressif and then leak them to libgen for all to use.
You need to be big enough before they even talk to you. And you run into the risk of ruining the rest of your professional career.
Better to just ask a fleet of AI bots to hack into a company that has these documents and steal them. That seems to have no legal repercussions right now…
lol, I can imagine it’s only a matter of time before OpenAI issues a new press release.
If the wifi/BT is developed by Espressif themselves, and there is a massive interest in using the ESP32 as an SDR (and I am pretty sure there will!), then they might very well add support for this functionnality and who knows, one day sell a SDR SoC (a SDR SoC with on-chip FPGA would be awesome !).
The original product was a WiFi-serial adapter and it quickly turned into an extremely popular MCU, most of Hackaday projects are either RP2350 or ESP32 nowadays. So given that they move fast, if there is a commercial incentive they will likely grab it.
The issue is, there is the possibility that the WiFi/BT is a third-party IP (or even worse, a combination of third-party IPs) which come with their software stack and an NDA.
The only thing we know is that at some point Espressif licensed RivieraWaves’s Bluetooth IP (and since they didn’t mention Wi-Fi, then it’s likely it came from yet another vendor).
Espressif features such as ESP-NOW either means that Espressif developed their own WiFi IP (which would be good news), or that they developed it on top of a third-party IP. It is extremely likely that the such IPs allow access to the I/Q samples for debugging purposes, but they might not be allowed to make all of that functionnality user-accessible.
And also : SDR functionnality can be expected to work well within the 2.4GHz band, but operation outside the band is likely to be unstable or have poor sensitivity. So if they officially support it one day, thet it will likely be 2.4GHz-band only.
So, in other words :
– Yes, if they want, they may add support for 2.4GHz SDR functionnality
– No, they likely won’t publicly document the registers of the WiFi IP, and if it’s not their own, they might not even be allowed to do so.
In reality Realtek never made a dedicated chip for SDR AFAIK, regardless of the interest.
And it would be relatively easy for them to take something they have and mod it slightly for that task.
So there goes your theory about companies jumping to it when there is a market.
From Realtek’s perspective, there isn’t a market for SDR that I’m aware of.
Realtek sells three billion chips each year. A “market” for them is an order for 100 million units. Not me buying one last year and you buying one this year.
I think esp-now is not different at the wifi level, it’s mostly just a custom ethernet packet type and protocol (remember IPX?) that simplifies and removes all the ARP/DHCP/etc back-and-forth chatter required for establishing and maintaining TCP/IP connections. But I might be wrong…
They definitely licensed all the RF stuff. I came across information recently which gave me a pretty good idea of where it originally came from, but do you think I can remember the details now? sigh
Even without hard evidence to back it up, it doesn’t seem sensible that espressif would have developed their own amazing rf frontend, simply for the purposes of a cheap smart lighting chip. No, it’s clear their original business was assembling preexisting licensed IP to create a product for a specific niche, happened to stumble into a massive untapped market, and was able to pivot to take advantage of it.
Maybe as the control channel for a trunking duo in combo with an RTL–SDR?
But how do we transfer the 2.56 Gbit/s (80Msps, 32 bit/sample) to a computer with more processing power? The 4 bit SDIO interface doesn’t go beyond 50 MHz and the 8 bit PARLIO is spec’ed up to 40 MHz.
It would be interesting to see cable modems being used for SDR. They handle an insane amount of spectrum concurrently.
Yes, that’s the main challenge… Especially without adding more cost like an external FPGA would.
The latest ESP32 family chip, the ESP32-31, is still really cheap but has Gigabit Ethernet (1000 Mbit/s) and USB High Speed (480 Mbit/s), which makes continuous streaming of 8-bit IQ at 40 MSa/s (Ethernet) and 20 MSa/s (USB) possible.
See https://github.com/ESPARGOS/SoapyESPSDR
That could make for an actually useful low-cost SDR!
200MB/s after dense packing. I extracted it by bitbanging wur.gpio_out to an fpga (that aligns it and dumps to host over usb3). wur.gpio_out is afaik the only way to achieve enough throughput. fpga can technically be replaced with something else, i just had one on my desk already.
Sounds like the dynamic range is very nice. Has me wondering what the ENOB is.
Shame about the following sentence:
original ESP32, ESP32-C3, ESP32-C5, ESP32-C6, ESP32-C61, ESP32-S2, ESP32-S3, ESP32-S31 all have a maximum SPI throughput of 80 Mbps so at 32 bit I and Q samples that would be a bandwidth of 1.25 MHz. If they drop 24 bits (to 8 bit samples) that could be a bandwidth of 5MHz. And if they drop 31 bits (to 1 bit samples), that could be 40 MHz of bandwidth which may be of interest to people doing radio astronomy either with a RF mixer to look at a different part of the spectrum (or in isolated locations far far from humans activities).
Most radio spectrum doesn’t contain data so you could use
compression.zstdto pack and unpack it for transmission over USART or SPI.I bet it contains a bunch of random noise. Random doesn’t compress.
Yes, but since it’s useless noise you can just save it’s parameters (amplitude, color) and recreate it at the receiver while sending just the useful signal. Kinda like what’s available in MIDI.
facepalm
shuffling data already solved https://github.com/ESPARGOS/SoapyESPSDR ESP32-S31 USB 2.0 streaming 20 MSa/s @8bit to PC, pretty amazing at $7 + shipping.
reply
Seriously nice hack!
The FPGA-free ESP32-S3 transmits as well. espdr-tx sends narrowband FM or SSB voice on 13 cm from a WAV file, a pipe or a sound card. The chip has no I/Q input, so the Wi-Fi PHY’s test tone is steered in frequency and amplitude. Built on h0m3us3r’s work: https://github.com/jochenhammes/esp32-sdr-trx
This is really interesting. espargos has a Web-Serial version, where you can directly flash your chip from Chrome and view what happens in your Wifi bands.
This could be used to get a real estimate on what Wifi channel to use. Since 10 Networks on Channel 1 might never transmit more then the next wordle website, while the one network on channel 6 is used by the family of 5 each streaming 4k Netflix 24/7. And AFAIK most channel selectors only really use the amount of beacons received.
I mean this could even run 24/7 and scan the entire wifi band to give you a real time estimate… this uses about 0.5W.
I mean there is marauder but okay this adds another layer.
Marauder and the like send raw Wifi packets. This is much wider as any packet can be rx/tx
C5VRX was the first to publicly use this feature, around 2 months ago :)
That is really impressive work!
Guys, is it possible to feed the IQ ADC inputs directly, bypassing the RF receiver?
You should read the link h0m3us3r posted above (https://github.com/h0m3us3r/eSpDR/issues/3) It describes his current discoveries rather well.
Someone is already working on LoRa: https://github.com/jochenhammes/esp32-sdr-trx/tree/research/iq-tx#research-lora-at-13-cm