PaperlayerView exact revision on arXiv

Source-linked AI summary

Eliminating the Barriers: Demystifying Wi-Fi Baseband Design and Introducing the PicoScenes Wi-Fi Sensing Platform

Zhiping Jiang, Tom H. Luan, Xincheng Ren, Dongtao Lv, Han Hao, Jing Wang, Kun Zhao, Wei Xi, Yueshen Xu, Rui Li

arXiv:2010.10233v4cs.AR

TL;DR

Wi-Fi sensing is limited by unknown baseband effects, inadequate hardware, and inflexible measurement software. The paper addresses these barriers through QCA9300 baseband analysis, expanded QCA9300 and SDR capabilities, and the PicoScenes platform. Reported evaluations include concurrent multi-NIC measurement and high-rate QCA9300 and SDR operation, while the SDR decoder remains single-threaded.

  • Problem

    Wi-Fi sensing research faces missing hardware features, inaccessible baseband effects, and limited physical-layer measurements.

  • Method

    The paper studies QCA9300 baseband design, expands QCA9300 and SDR controls, and releases PicoScenes for flexible concurrent measurements.

  • Results

    An array of 27 NICs achieves >95% receive success at an 8 kHz packet-injection rate.

  • Takeaways & Limitations

    PicoScenes combines multi-NIC and SDR measurement with low-level control and plugin-based flexibility for Wi-Fi sensing research.

  • Takeaways & Limitations

    The SDR decoding flow is single-threaded, and the authors expect 5× higher performance on an 8-core CPU after parallelization.

Abstract

from arXiv · show

The research on Wi-Fi sensing has been thriving over the past decade but the process has not been smooth. Three barriers always hamper the research: unknown baseband design and its influence, inadequate hardware, and the lack of versatile and flexible measurement software. This paper tries to eliminate these barriers through the following work. First, we present an in-depth study of the baseband design of the Qualcomm Atheros AR9300 (QCA9300) NIC. We identify a missing item of the existing CSI model, namely, the CSI distortion, and identify the baseband filter as its origin. We also propose a distortion removal method. Second, we reintroduce both the QCA9300 and software-defined radio (SDR) as powerful hardware for research. For the QCA9300, we unlock the arbitrary tuning of both the carrier frequency and bandwidth. For SDR, we develop a high?performance software implementation of the 802.11a/g/n/ac/ax baseband, allowing users to fully control the baseband and access the complete physical-layer information. Third, we release the PicoScenes software, which supports concurrent CSI measure?ment from multiple QCA9300, Intel Wireless Link (IWL5300) and SDR hardware. PicoScenes features rich low-level controls, packet injection and software baseband implementation. It also allows users to develop their own measurement plugins. Finally, we report state-of-the-art results in the extensive evaluations of the PicoScenes system, such as the >2 GHz available spectrum on the QCA9300, concurrent CSI measurement, and up to 40 kHz and 1 kHz CSI measurement rates achieved by the QCA9300 and SDR. PicoScenes is available at https://ps.zpj.io.

I. INTRODUCTION

Wi-Fi sensing research is hindered by unknown baseband effects, inadequate hardware, and inflexible measurement software. This paper addresses these barriers through QCA9300 analysis, expanded hardware capabilities, and the PicoScenes platform.

  • Barrier 1: Unknown baseband design: CSI measurements reveal strong nonflat magnitude and phase responses even in a radioanechoic chamber, with HT40+/- magnitude differences exceeding 15 dB.These observations motivate treating CSI distortion as a substantive sensing concern rather than assuming smooth channel measurements.
  • Barrier 2: Inadequate hardware: Advanced hardware features, low-level controls, and complete physical-layer information remain inaccessible on conventional Wi-Fi sensing hardware.Missing capabilities include external clocks, synchronization, carrier-frequency and sampling-rate tuning, gain control, and measurements beyond conventional CSI.
  • Barrier 1: Unknown baseband design: The paper identifies baseband filtering as the most influential factor in CSI distortion and proposes a method to eliminate that distortion.Evaluations indicate that distortion is pervasive across the QCA9300, IWL5300, and SDR devices.
  • Barrier 2: Inadequate hardware: The paper unlocks QCA9300 carrier-frequency and sampling-rate tuning, per-packet multi-CSI measurement, manual receive gain control, and a controllable SDR Wi-Fi baseband.The SDR implementation supports 802.11a/g/n/ac/ax and exposes low-level controls plus complete PHY-layer information.
  • Barrier 3: Measurement software: PicoScenes integrates packet injection, CSI parsing, low-level hardware control, multi-NIC concurrency, and plugins for complex interactive measurements.It supports concurrent operation of QCA9300 and IWL5300 NICs and SDR devices, including a reference 27-NIC array.
  • Evaluation: >2 GHz spectrum availability, 8 kHz CSI measurement with a 27-NIC array, 40 kHz SDR packet injection, 1 kHz SDR packet decoding, and 200 MHz SDR CSI bandwidth are reported.These are among the state-of-the-art evaluation results reported for PicoScenes.

II. QCA9300 HARDWARE ARCHITECTURE

The QCA9300 architecture comprises digital baseband, analog baseband, and analog passband stages. Its design combines packet-processing components, sampling and filtering, and RF frequency conversion across multiple transceiver chains.

  • Architecture overview: The QCA9300 architecture contains digital baseband, analog baseband, and analog passband stages, whose operation is examined through reconstructed hardware design.The study focuses on designs relevant to Wi-Fi sensing and uses the architecture to infer how other NICs may operate.
  • Digital baseband: The digital baseband handles complex baseband signals through FFT/IFFT processing, packet generation and detection, channel estimation, receive control, and FEC codecs.These components support both transmission and reception processing.
  • Analog baseband: The analog baseband performs sampling and filtering, with distinct transmit and receive filtering settings driven by synchronized clocking.The transmit path includes a reconstruction filter formed by a V2I, notch filter, and BIQUAD1.
  • Analog passband: The analog passband performs carrier synthesis, up/down-conversion, power amplification, and antenna-switch control for the 2.4 and 5 GHz bands.A single frequency synthesizer generates carrier frequencies for both Wi-Fi bands.

B. Three core design elements of the QCA9300

The QCA9300’s design combines register-controlled hardware, multirate baseband clocking, and tunable bandwidth to support diverse Wi-Fi configurations.

  • Register-based control mechanism: The ath9k driver controls QCA9300 hardware through registers, which PicoScenes uses to direct NIC operation.The registers expose hardware functions such as CSI reporting and control.
  • Baseband multirate clocking: The QCA9300 uses oversampling and multiple clock rates to address DAC imperfections, power consumption, and 802.11b compatibility.The DAC runs at 160 MHz, while the Rx ADC and digital baseband use lower rates; additional rate converters support incompatible protocol bandwidths.
  • Baseband multirate clocking: Tuning the baseband PLL tunes channel bandwidth, which PicoScenes exposes across a 2.5–80 MHz operable range.The PLL controls the baseband pace, and the platform integrates bandwidth selection through the “–rate” option.
  • Carrier frequency synthesis: The QCA9300 uses a shared frequency synthesizer for both Wi-Fi bands, with different conversion paths for 2.4 and 5 GHz operation.The synthesizer architecture and supported carrier-frequency range are described in the carrier-frequency synthesis figures and table.

3) Wide-range and user-tunable carrier frequency synthesizer:

The QCA9300 uses a tunable shared synthesizer to generate carriers across both Wi-Fi bands, enabling broad continuous frequency access.

  • Wide-range and user-tunable carrier frequency synthesizer: The QCA9300’s shared VCO-based synthesizer operates from 3.0 to 4.0 GHz and serves both the 2.4 and 5 GHz bands.Different frequency-conversion paths produce carriers in the two bands.
  • Wide-range and user-tunable carrier frequency synthesizer: The 2.4 GHz path mixes and divides a synthesizer output, while the 5 GHz path uses two downconversion stages to reach baseband.For 2.4 GHz, a 3.2 GHz synthesizer setting is illustrated; for a 5.4 GHz signal, a 3.6 GHz setting produces successive 1.8 GHz conversions.
  • Wide-range and user-tunable carrier frequency synthesizer: The QCA9300 supports 700 MHz and 1.7 GHz continuous spectra in the 2.4 and 5 GHz bands, respectively.The synthesizer’s minimum tuning step is approximately 305 Hz.

C. What can we learn from the QCA9300 NIC?

The QCA9300 reveals that Wi-Fi sensing hardware contributes substantial CSI distortion and that common CSI assumptions about filtering, sampling, and frequency offsets require reassessment.

  • Lessons from the QCA9300 NIC: Baseband filters influence in-band CSI, so the CSI model cannot treat hardware effects as merely a linear phase offset.The paper identifies filtering as a reason to re-evaluate the conventional model.
  • Lessons from the QCA9300 NIC: The QCA9300 and USRP sampling rates do not necessarily equal channel bandwidth, challenging assumptions used in phase-based sensing.The QCA9300 Rx ADC operates at 88 MHz in 2.4 GHz and 80 MHz in 5 GHz; USRP devices use 100 or 200 MHz master clocks.
  • Lessons from the QCA9300 NIC: Synthesizer tuning resolution can create small CFOs that may mix with Doppler and contaminate Doppler-frequency estimates.For a desired 5.2 GHz frequency, the QCA9300 may operate at 5199.999389 or 5200.000305 MHz.
  • Lessons from the QCA9300 NIC: Bandwidth is the dominant distortion factor, while both Tx and Rx hardware contribute and the Rx end contributes more.The tests also report distortion across hardware and configurations, with stronger distortion for the IWL5300 than the QCA9300.

2) T2, test of the influence of the Tx baseband:

The tests show that Tx power and Rx I/Q mismatch do not determine CSI distortion, whereas bandwidth strongly changes its magnitude and phase shape. Across hardware and configurations, distortion is pervasive, with bandwidth identified as the dominant factor.

  • T2, test of the influence of the Tx baseband:: Changing Rx I/Q mismatch adds in-band disturbance and shifts magnitude but leaves the characteristic M-shaped magnitude and S-shaped phase distortion unchanged.The result suggests I/Q mismatch is not associated with the main CSI distortion.
  • T2, test of the influence of the Tx baseband:: Increasing Tx power does not alter CSI distortion, although CSI magnitude drops, which the authors attribute to Rx AGC suppression.
  • T2, test of the influence of the Tx baseband:: As bandwidth increases, the M-shaped magnitude and horizontal S-shaped phase distortions become more curved.The measurements scanned bandwidths from 5 to 55 MHz.
  • T2, test of the influence of the Tx baseband:: At lower bandwidths, the magnitude response changes from an M shape to an inverted V, while the phase response approaches a straight line.
  • T2, test of the influence of the Tx baseband:: Bandwidth is the dominant influence on CSI distortion, while Tx power and I/Q imbalance have no impact.The summary attributes distortion to both Tx and Rx ends, with the Rx end contributing more.

B. Reasonable conjectures about the cause of the distortion

The authors conjecture that CSI distortion arises from interactions among DAC fading, digital predistortion, and analog channel-reconstruction filtering. They revise the CSI model to combine Tx and Rx distortion into a measurable term that can support practical removal.

  • B. Reasonable conjectures about the cause of the distortion: Type-I distortion is conjectured to combine digital predistortion with the Rx analog channel-reconstruction filter, producing central and edge features.
  • B. Reasonable conjectures about the cause of the distortion: Type-II distortion is conjectured to result from Tx DAC sinc fading combined with weak, bandwidth-independent digital predistortion at low bandwidth.
  • B. Reasonable conjectures about the cause of the distortion: Type-III distortion may represent one half of Type-I distortion when HT20 communicates with an HT40+ or HT40- channel.
  • B. Reasonable conjectures about the cause of the distortion: The revised CSI model introduces separate Tx and Rx baseband influences, extending the model beyond in-air propagation and other phase errors.The model represents the baseband response as including Tx and Rx distortion terms.
  • B. Reasonable conjectures about the cause of the distortion: Because Tx and Rx distortions are difficult to measure independently, they are merged into H_dist, which can be measured through coaxial connection or strong line-of-sight placement.This merged term makes the revised model practical for real-world measurements.

D. Why does the distortion contaminate Wi-Fi sensing but not Wi-Fi communication?

CSI distortion contaminates Wi-Fi sensing because sensing seeks the in-air channel alone, unlike communication systems that absorb shared impairments through channel estimation. PicoScenes addresses the measurement gap with layered middleware, concurrent hardware access, extensible plugins, and unified APIs.

  • D. Why does the distortion contaminate Wi-Fi sensing but not Wi-Fi communication?: In OFDM communication, shared baseband distortion is canceled through channel estimation, but in sensing it appears as a phantom component that interferes with in-air-channel measurement.
  • D. Why does the distortion contaminate Wi-Fi sensing but not Wi-Fi communication?: Earlier distortion-removal methods focused mainly on Type-I phase distortion, whereas this work targets all three magnitude and phase distortion types.
  • D. Why does the distortion contaminate Wi-Fi sensing but not Wi-Fi communication?: PicoScenes uses drivers, a platform, and plugins to expose hardware features, provide unified APIs, and implement application-specific measurements.Its architecture is shown as three layers, with embedded software baseband support for SDR.
  • D. Why does the distortion contaminate Wi-Fi sensing but not Wi-Fi communication?: The drivers enable concurrent multi-NIC CSI collection and unified data formats, while the platform integrates packet injection and low-level controls.
  • D. Why does the distortion contaminate Wi-Fi sensing but not Wi-Fi communication?: An open plugin development kit lets researchers implement custom sensing protocols, including round-trip CSI measurement through the EchoProbe plugin.

B. PicoScenes on SDR

PicoScenes on SDR embeds a high-performance 802.11a/g/n/ac/ax baseband so USRPs can operate as full-featured Wi-Fi NICs with extensive Tx/Rx control. The broader PicoScenes evaluation also tests QCA9300 spectrum, bandwidth, and link-quality capabilities across 5856 configurations.

  • B. PicoScenes on SDR: PicoScenes embeds an 802.11a/g/n/ac/ax software baseband that lets SDR devices transmit and receive Wi-Fi packets as full-featured NICs.The implementation currently supports all USRP models.
  • B. PicoScenes on SDR: SDR operation provides complete Tx/Rx control, including scrambler initialization, beamforming, ESS, and additional physical-layer measurements.
  • B. PicoScenes on SDR: 5856 QCA9300 configurations were evaluated across carrier frequencies, bandwidths, spatial streams, and MCS settings using 5000 round-trip measurements per configuration.
  • B. PicoScenes on SDR: The QCA9300 maintained consistent link quality across the unlocked 2.2–2.9 GHz and 4.4–6.1 GHz spectrum, including channels without dedicated RF calibration.
  • B. PicoScenes on SDR: Bandwidths of 50 MHz and below showed good QCA9300 link quality, while sub-20 MHz bandwidths provided superior resilience across tested cases.At high bandwidths, excessive transmission failures caused early termination in some evaluations.

2) Evaluation of concurrent CSI measurements for multiple COTS Wi-Fi NICs:

The evaluation presents a 27-NIC QCA9300 sensing array and measures concurrent CSI reception under varying NIC counts, bandwidths, and injection rates. The array maintains high reception rates at 20 MHz, while wider bandwidth exposes clocking and driver bottlenecks.

  • Array design: The reference design uses a three-layer PCI-E hierarchy with bridge adapters connecting 27 QCA9300 NICs to one host computer.The array contains three modules and a main hub, with nine NICs per module.
  • Concurrent CSI measurement: At 20 MHz, mean Rx rates exceeded 97% for up to 18 NICs and remained above 91% with 27 NICs, largely independent of injection rate.These results demonstrate the efficiency of PicoScenes’ concurrent architecture.
  • Performance limits: At 40 MHz, Rx rates declined by approximately 7% for 9- and 18-NIC configurations because higher bandwidth increases sensitivity to clocking error.With 27 NICs, the ath9k driver became a bottleneck because host-side processing concentrated kernel jobs on a few CPU cores.
  • Limitations: The current 27-NIC setup is not a phased array because its NICs operate independently and remain unsynchronized.A synchronization method discussed by the authors would sacrifice one-third of the antennas and remains beyond this paper’s scope.
  • Platform support: PicoScenes also supports concurrent measurement with heterogeneous arrays built from different hardware.The shared driver enhancement applies to both QCA9300 and IWL5300 NICs.

3) Evaluation of the maximum packet injection rate and CSI measurement speed:

This evaluation measures packet injection and CSI measurement speed across QCA9300, IWL5300, and SDR devices using CSI Probing Frames. QCA9300 reaches the highest reported CSI measurement rate, while SDR provides substantial real-time injection performance.

  • Packet injection rate: The QCA9300 achieved a 10845 Hz maximum packet injection rate, compared with 6350 Hz for IWL5300 and 4304 Hz for real-time SDR on USRP X310.These corresponded to average packet intervals of 92, 157, and 232 µs, respectively.
  • Evaluation design: The evaluation spans 802.11a/g/n/ac/ax configurations with varying bandwidth, spatial streams, MCS, coding, and packet length.The SDR loopback evaluation repeats valid encoding-decoding configurations 1000 times while logging time consumption.
  • Rate calculation: The injection-rate limit for a 20 MHz CSI Probing Frame was calculated as 20325 packets per second from 864 signal samples plus 120 samples of 6 µs IFS.CSI measurement rate was estimated by multiplying the measured reception rate by the theoretical limit.
  • CSI measurement speed: 40 kHz was the maximum reported CSI measurement rate, achieved by the QCA9300 at 40 MHz bandwidth and 6 µs IFS.IWL5300 reception approached its theoretical limit but experienced frequent firmware crashes during signal bursts.

B. Performance evaluation of PicoScenes on SDR

PicoScenes on SDR is evaluated through broad loopback tests and real-world CSI measurements across Wi-Fi protocols, bandwidths, coding schemes, and antenna configurations. It achieves high reception rates at practical injection rates, while computational load limits performance as bandwidth, spatial streams, or antenna count increase.

  • Baseband timing: Encoding and decoding times increase with packet length and bandwidth, while decoding takes approximately twice as long as encoding.For 250-byte packets, encoding took under 1 ms and decoding under 2 ms.
  • Real-time SDR performance: At 20 MHz, SDR achieved a 99.8% Rx rate at 1000 Hz injection, while at 40 MHz it achieved 99.6% at 800 Hz.The authors describe these results as comparable to COTS Wi-Fi NIC performance.
  • Performance limits: Increasing injection rate or bandwidth eventually causes buffer drops when decoding cannot keep up with incoming signals.The observed computational bottleneck explains declining Rx rates under heavier workloads.
  • MIMO performance: For 2×2 MIMO at 500 Hz injection, Rx rate reached 100%; adding antennas reduced Rx rate by approximately 15% to 25%.Each additional spatial stream reduced Rx rate by about 5%, reflecting longer MIMO decoding requirements.
  • High-bandwidth CSI measurement: At 20 MHz, BCC produced a 43.3% Rx rate at 200 MHz baseband, equivalent to 200 Hz CSI sampling over 200 MHz.The evaluation attributes lower LDPC reception rates to its approximately three-times-longer decoding time than BCC.

C. Summary of evaluations

The evaluation summary reports broad QCA9300 spectrum coverage, high-rate concurrent multi-NIC measurement, and flexible SDR baseband and CSI measurement performance. Together, these results cover both COTS NIC arrays and software-defined-radio sensing.

  • QCA9300 coverage: The QCA9300 provided reliable SISO communication from 2.5 to 70 MHz and superior 3×3 MIMO link quality over a spectrum wider than 2 GHz.The summary also reports 40 MHz bandwidth for the 3×3 MIMO result.
  • Concurrent COTS measurement: The 27-NIC array achieved a >95% Rx success rate under an 8 kHz packet injection rate.This result summarizes the concurrent CSI measurement capability of the multi-NIC array.
  • QCA9300 measurement rate: Single-NIC QCA9300 CSI measurement reached 20 kHz at theoretical limits and up to 40 kHz with 40 MHz bandwidth.These rates summarize the maximum CSI measurement evaluation.
  • SDR baseband support: The SDR implementation supported most tested 802.11a/g/n/ac/ax configurations, including 20/40/80/160 MHz CBWs, MCS≤10, up to four spatial streams and antennas, and BCC or LDPC coding.This establishes broad baseband configuration coverage for the platform.
  • SDR CSI measurement: PicoScenes on SDR achieved 1 kHz and 800 Hz CSI measurement at 20 and 40 MHz, respectively, with up to four Rx antennas and 200 MHz bandwidth.The evaluation also demonstrated CSI measurement at an 80 MHz CBW and 200 MHz bandwidth.

VI. DISCUSSION & FUTURE WORK

The paper identifies remaining limitations in PicoScenes and related Wi-Fi sensing platforms, including incomplete hardware exploration, single-threaded decoding, and Linux-only support. It also situates these issues within broader Wi-Fi sensing hardware and software constraints.

  • Future hardware exploration: PicoScenes’ QCA9300 support remains incomplete because many hardware and driver aspects have not yet been explored.The authors plan to extend features for the QCA9300 and other CSI-capable commercial NICs.
  • Performance: The Wi-Fi baseband decoder is single-threaded, so it cannot fully use available computational resources.The authors expect a 5× performance improvement on an 8-core CPU through parallelizing the decoding flow.
  • Platform support: PicoScenes and existing CSI measurement tools are Linux-based because their driver and firmware modifications rely on the open-source kernel driver.The authors are working to port PicoScenes on SDR to Windows and macOS.
  • Broader context: Related Wi-Fi sensing hardware offers different trade-offs: common NICs simplify CSI measurement, whereas SDR provides control but lacks an accessible Wi-Fi implementation.This hardware gap makes SDR-based CSI extraction more difficult for researchers.
  • Overall contribution: The paper’s broader contribution combines QCA9300 baseband analysis, expanded hardware access, and PicoScenes software with extensive performance evaluations.The system supports concurrent packet injection and CSI measurement across QCA9300, IWL5300, and SDR hardware.
Loading 2010.10233v4…