CSI sensing project stages

Ladder of increasing difficulty for WiFi sensing on hardware we own (MT3000 router, Android phones, AX211 laptop — no purchases required). Every rung ends in something visible or verifiable. Deterministic signal processing throughout; ML appears only as classifiers labeling measured features — no image synthesis, no "guessed" renderings (project rule).

Context: docs/directions.md (capability directions), docs/findings.md (firmware facts). Key enabler already established: the stock MT7981 firmware registers CSI command handlers (0xc2/0xc3/0xc4 — F9 data), and MediaTek authored a driver-side CSI patch (2022, never mainlined).

Stage 0 — pipeline rehearsal, zero firmware work (tonight)

Laptop + phone only. Data is coarse (RSSI: one strength number per packet), but the tooling built here is reused by every later stage.

0.1 RSSI motion logger: phone streams UDP (iperf), laptop logs signal strength at high rate into Python.
0.2 Dashboard: streaming line plot + waterfall renderer.

Done when: waving at the phone visibly moves the plot; crossing the room leaves a streak.

Stage 1 — first real CSI (router powered again)

1.1 Router online; pull its exact firmware blobs; diff against linux-firmware copies (ground truth).
1.2 Port MediaTek's 2022 CSI patch to the router's OpenWrt mt76; rebuild, flash (U-Boot recovery available).
1.3 Verify firmware answers: 0xc2 CSI events flowing (RE says the handlers exist — prove live).
1.4 Collector: netlink → Python → live CSI heatmap (the barcode), phone as talker.

Done when: empty-room barcode sits still; walking through breaks it.

Stage 2 — clean physics, deterministic DSP

2.1 Phase cleaning (conjugate-multiply across packets).
2.2 Live Doppler spectrogram (speed-labeled streaks).
2.3 Breathing extraction: bandpass 0.1–0.6 Hz; verify breaths/min against a stopwatch.
2.4 Distance slices: tone-axis transform; verify at marked positions (2 m / 4 m / 6 m) against the ~2 m resolution budget.
2.5 Event detectors: entry/exit, travel direction, two-person counting (thresholds, no guessing).

Done when: views match physical reality checkable with tape measure and stopwatch.

Stage 3 — firmware upgrades (the RE project pays off)

3.1 Crank measurement rate: dedicated sounding traffic instead of borrowed network traffic.
3.2 CSI on every frame + ambient/monitor capture, not just the associated client.
3.3 Channel hopping across the 5 GHz band: synthesize ~555 MHz → ~10-inch distance slices. Verify at marked positions.
3.4 Dual-band simultaneous capture (2.4 + 5 GHz).

Done when: slice resolution measurably improves; the firmware's rate ceiling is documented and its patch location known.

Stage 4 — state of the art, deterministic only

4.1 Full range-Doppler radar screen (live, both transforms).
4.2 Gesture vocabulary: ~6 dynamic hand signs classified from measured Doppler streak shapes (small classifier on measured features; per-user training; honest accuracy reporting).
4.3 Transmitter voiceprinting: classify devices by RF signature; detect a MAC-spoofed clone.
4.4 Through-wall characterization: detection reliability vs distance through a known wall.
4.5 Optional (later hardware): second capture node → floor-plan overlay; SAR rail for outline imaging.

Out of scope per project rule: skeleton/pose renderings, point clouds, any network-invented pixels.

Gates

Physical: router must be powered (unblocks Stage 1).
Long grind: Stage 3 firmware work — same RE as the main project, now with concrete purpose; benefits from the dispatch/handler maps already built.

3.6 KiB Raw Blame History Unescape Escape